entangled-worlds-orbiters-shared 4.0.0 → 4.1.0

package/dist/clock/Transport.d.ts

@@ -71,9 +71,15 @@ export declare class Transport {
     private _nextDist;
     setProjection(projection: MusicalProjectionLike | null): void;
     musicalPosition(): unknown;
-    applyAnchoredState(s: AnchoredState): void;
+    /**
+     * Apply a peer's anchored state. A malformed one (unknown playState, non-finite position, anchor or
+     * loop bounds, or a rate that is not a finite number > 0) is DROPPED whole and `false` is returned: the transport keeps its last
+     * good state until the next good one arrives. It never throws — this runs inside `tick()`.
+     */
+    applyAnchoredState(s: AnchoredState): boolean;
     /** Arm an anchored state (with optional control) to apply when audio time reaches `atAudioSec`. */
-    scheduleStateChange(atAudioSec: number, state: AnchoredState, meta?: ScheduleStateMeta): void;
+    /** Returns `false` (and arms nothing) for a non-finite `atAudioSec` or a malformed state. */
+    scheduleStateChange(atAudioSec: number, state: AnchoredState, meta?: ScheduleStateMeta): boolean;
     /** Drop pending changes older than a freshly-applied (term,seq) — supersession (Codex fix #4). */
     dropPendingOlderThan(term: number, seq: number): void;
     private _drainPending;

package/dist/clock/Transport.js

@@ -11,6 +11,22 @@
 //   - Looping is handled by computing each event's NEXT occurrence distance (wrapping across the loop
 //     boundary), so events just after loopStart are armed during the pre-wrap look-ahead.
 const EPS = 1e-9;
+function isValidRate(rate) {
+    return Number.isFinite(rate) && rate > 0;
+}
+function isValidAnchoredState(s) {
+    if (s.playState !== 'playing' && s.playState !== 'paused')
+        return false;
+    if (!Number.isFinite(s.positionSec))
+        return false;
+    if (s.anchorAudioSec != null && !Number.isFinite(s.anchorAudioSec))
+        return false;
+    if (s.rate != null && !isValidRate(s.rate))
+        return false;
+    if (s.loop && !(Number.isFinite(s.loop.startSec) && Number.isFinite(s.loop.endSec)))
+        return false;
+    return true;
+}
 export class Transport {
     backend;
     lookaheadSec;
@@ -63,13 +79,15 @@ export class Transport {
         this._cancelArmed(); // armed future audio must not sound during pause; re-armed on resume
     }
     seekSec(sec) {
+        if (!Number.isFinite(sec))
+            return; // a NaN seek is ignored, never freezes the transport
         this._reanchor(Math.max(0, sec));
         this._cancelArmed();
         this._reopenEvents(); // a seek MOVES position -> fired events may replay
     }
     setRate(rate) {
-        if (rate <= 0)
-            throw new Error('rate must be > 0');
+        if (!isValidRate(rate))
+            throw new Error('rate must be a finite number > 0');
         this._reanchor();
         this._rate = rate;
         this._cancelArmed(); // window/audio-time changed -> re-arm pending events (NOT replay fired ones)
@@ -81,6 +99,8 @@ export class Transport {
         return this._playing;
     }
     setLoopSec(loop) {
+        if (loop && !(Number.isFinite(loop.startSec) && Number.isFinite(loop.endSec)))
+            return; // ignored
         this._loop = loop ? { startSec: loop.startSec, endSec: loop.endSec } : null;
         this._cancelArmed();
         this._reopenEvents(); // loop topology changed -> events may re-enter/leave the loop window
@@ -149,6 +169,11 @@ export class Transport {
                     d += len; // wrapped into the next pass
                 return d;
             }
+            // At or past the loop end: the transport wraps back to startSec before getting there, so the
+            // event never occurs while looping. Without this, its look-ahead distance came out positive just
+            // before the wrap and it armed (and sounded) at the wrap instant, at a position never reached.
+            if (len > 0 && ev.atSec >= endSec - EPS)
+                return null;
         }
         const d = ev.atSec - pos;
         return d >= -EPS ? d : null; // non-loop: a passed event won't fire again until a seek
@@ -161,7 +186,14 @@ export class Transport {
         return this._projection ? this._projection.musicalAt(this.positionSec()) : null;
     }
     // ---- sync apply (Inc 3) -------------------------------------------------------------
+    /**
+     * Apply a peer's anchored state. A malformed one (unknown playState, non-finite position, anchor or
+     * loop bounds, or a rate that is not a finite number > 0) is DROPPED whole and `false` is returned: the transport keeps its last
+     * good state until the next good one arrives. It never throws — this runs inside `tick()`.
+     */
     applyAnchoredState(s) {
+        if (!isValidAnchoredState(s))
+            return false;
         this._playing = s.playState === 'playing';
         if (s.rate != null)
             this._rate = s.rate;
@@ -171,9 +203,14 @@ export class Transport {
             this._loop = s.loop ? { ...s.loop } : null;
         this._cancelArmed();
         this._reopenEvents(); // anchored apply repositions the timeline -> events re-evaluate
+        return true;
     }
     /** Arm an anchored state (with optional control) to apply when audio time reaches `atAudioSec`. */
+    /** Returns `false` (and arms nothing) for a non-finite `atAudioSec` or a malformed state. */
     scheduleStateChange(atAudioSec, state, meta = {}) {
+        // checked at intake too: a NaN time would never drain and would block every later change
+        if (!Number.isFinite(atAudioSec) || !isValidAnchoredState(state))
+            return false;
         this._pending.push({
             atAudioSec,
             state,
@@ -182,6 +219,7 @@ export class Transport {
             onApply: meta.onApply ?? null,
         });
         this._pending.sort((a, b) => a.atAudioSec - b.atAudioSec);
+        return true;
     }
     /** Drop pending changes older than a freshly-applied (term,seq) — supersession (Codex fix #4). */
     dropPendingOlderThan(term, seq) {
@@ -191,9 +229,10 @@ export class Transport {
         const now = this.backend.nowSec();
         while (this._pending.length && this._pending[0].atAudioSec <= now + EPS) {
             const p = this._pending.shift();
-            this.applyAnchoredState({ ...p.state, anchorAudioSec: p.state.anchorAudioSec ?? now });
-            if (p.onApply)
-                p.onApply(); // control rides WITH the state, applied atomically here (fix #5)
+            const applied = this.applyAnchoredState({ ...p.state, anchorAudioSec: p.state.anchorAudioSec ?? now });
+            // control rides WITH the state, applied atomically here (fix #5) — a dropped state drops its control too
+            if (applied && p.onApply)
+                p.onApply();
         }
     }
     // ---- the pump -----------------------------------------------------------------------
@@ -248,8 +287,8 @@ export class Transport {
             return;
         const { startSec, endSec } = this._loop;
         const len = endSec - startSec;
-        if (len <= 0)
-            return;
+        if (!(len > 0))
+            return; // also catches NaN
         const pos = this.positionSec();
         if (pos < endSec - EPS)
             return;

package/dist/clock/musical.js

@@ -14,20 +14,25 @@ export class MusicalProjection {
     _sig;
     constructor(spec = {}) {
         this.ppq = spec.ppq ?? DEFAULT_PPQ;
-        const tempo = (spec.tempoMap && spec.tempoMap.length ? spec.tempoMap : [{ startSec: 0, bpm: 120 }])
-            .slice()
-            .sort((a, b) => a.startSec - b.startSec);
+        // An entry with bpm <= 0, a NaN bpm or a non-finite start would make beat <-> seconds return
+        // Infinity/NaN — skip it. If nothing usable is left, fall back to the same 120 BPM default as an
+        // empty map.
+        const usable = (spec.tempoMap ?? []).filter((e) => Number.isFinite(e.startSec) && Number.isFinite(e.bpm) && e.bpm > 0);
+        const tempo = (usable.length ? usable : [{ startSec: 0, bpm: 120 }]).sort((a, b) => a.startSec - b.startSec);
         // precompute the cumulative beat position at each tempo segment boundary
         this._tempo = tempo.map((s) => ({ ...s, startBeat: 0 }));
         for (let i = 1; i < this._tempo.length; i++) {
             const prev = this._tempo[i - 1];
             this._tempo[i].startBeat = prev.startBeat + (this._tempo[i].startSec - prev.startSec) * (prev.bpm / 60);
         }
-        const sig = (spec.signatureMap && spec.signatureMap.length
-            ? spec.signatureMap
-            : [{ startBar: 0, numerator: 4, denominator: 4 }])
-            .slice()
-            .sort((a, b) => a.startBar - b.startBar);
+        // Same rule for signatures: a zero/negative/NaN numerator or denominator, or a non-finite start
+        // bar, would give Infinity/NaN bars — skip it, and fall back to 4/4 if nothing usable is left.
+        const usableSig = (spec.signatureMap ?? []).filter((e) => Number.isFinite(e.startBar) &&
+            Number.isFinite(e.numerator) &&
+            e.numerator > 0 &&
+            Number.isFinite(e.denominator) &&
+            e.denominator > 0);
+        const sig = (usableSig.length ? usableSig : [{ startBar: 0, numerator: 4, denominator: 4 }]).sort((a, b) => a.startBar - b.startBar);
         // precompute the cumulative beat position at each signature segment's startBar
         this._sig = sig.map((s) => ({ ...s, beatsPerBar: (s.numerator * 4) / s.denominator, startBeat: 0 }));
         for (let i = 1; i < this._sig.length; i++) {

package/dist/clock/sync.js

@@ -12,6 +12,13 @@
 // Reuses the session-time substrate offset estimation; the server `sessionEpoch` gives every peer a
 // shared `sessionMs`; the beat timeline is anchored to that.
 const mod = (n, m) => ((n % m) + m) % m;
+/** A usable timeline: a finite tempo above zero and finite anchors. Anything else makes every beat
+ *  <-> time conversion NaN or Infinity, for this peer and for every peer that adopts it. */
+const isValidTimeline = (t) => !!t &&
+    Number.isFinite(t.tempoBpm) &&
+    t.tempoBpm > 0 &&
+    Number.isFinite(t.anchorBeat) &&
+    Number.isFinite(t.anchorSessionMs);
 const newerTs = (a, b) => a.time > b.time || (a.time === b.time && a.id > b.id);
 /** Cristian/SNTP offset estimate: median of (serverStamp + rtt/2 - t1). Asymmetry biases by (up-down)/2. */
 export function estimateOffset(node, relay, { samples = 7, upMs = relay.upMs, downMs = relay.downMs, jitterFn = () => 0 } = {}) {
@@ -132,6 +139,9 @@ export class BeatTimeline {
     }
     // ---- timeline mutations (all leaderless: broadcast + last-writer-wins) ---------------
     _commit(timeline) {
+        // Validated before it is broadcast: last-writer-wins would hand a broken timeline to every peer.
+        if (!isValidTimeline(timeline))
+            throw new Error('beat timeline needs a finite tempo > 0 and finite anchors');
         this.timeline = { ...timeline };
         this._ts = { time: this.sessionNowMs(), id: this.id };
         if (this.enabled)
@@ -177,7 +187,9 @@ export class BeatTimeline {
     // ---- start/stop intent (opt-in; never adopted on join) ------------------------------
     setLocalPlaying(playing) {
         this.localPlaying = playing;
-        this.relay.send(this.id, { kind: 'beat:transport', id: this.id, playing, atSessionMs: this.sessionNowMs() });
+        // Solo (`enabled` false) broadcasts nothing, as with the timeline and hello messages.
+        if (this.enabled)
+            this.relay.send(this.id, { kind: 'beat:transport', id: this.id, playing, atSessionMs: this.sessionNowMs() });
         if (this.onChange)
             this.onChange();
     }
@@ -196,7 +208,8 @@ export class BeatTimeline {
             case 'beat:timeline':
                 if (msg.id)
                     this.peers.add(msg.id);
-                if (newerTs(msg.ts, this._ts)) {
+                // A malformed timeline (tempo 0, NaN anchor, from a buggy or older peer) is never adopted.
+                if (isValidTimeline(msg.timeline) && msg.ts && newerTs(msg.ts, this._ts)) {
                     this.timeline = { ...msg.timeline };
                     this._ts = msg.ts;
                 }

package/dist/loaders/glbLoader.js

@@ -2,6 +2,7 @@ import * as THREE from 'three';
 import { GLTFLoader } from 'three/examples/jsm/loaders/GLTFLoader.js';
 import { ensureStandardMaterial, applyFlagsToMaterial } from '../utils/materials.js';
 import { getKTX2LoaderForRenderer } from './ktx2.js';
+import { disposeObject3D } from '../utils/dispose.js';
 /**
  * `renderer` is REQUIRED at runtime (throws without one).
  * - `retries` (3): load attempts before giving up.
@@ -20,16 +21,28 @@ export async function loadGLB(url, { retries = 3, signal, onProgress, applyFlags
         throw new Error('[glb] loadGLB requires the owning renderer (KTX2 textures bind per WebGL context).');
     let attempt = 0;
     while (attempt < retries) {
+        // An abort during the pause between attempts must stop here: a listener added to an
+        // already-aborted signal never fires, so the next attempt would load and resolve anyway.
+        if (signal?.aborted)
+            throw new Error('aborted');
         try {
             const loader = new GLTFLoader()
                 .setCrossOrigin(withCredentials ? 'use-credentials' : 'anonymous')
                 .setWithCredentials(Boolean(withCredentials))
                 .setKTX2Loader(getKTX2LoaderForRenderer(renderer));
             const root = await new Promise((resolve, reject) => {
-                loader.load(url, (gltf) => resolve(gltf.scene), onProgress, reject);
-                if (signal) {
-                    signal.addEventListener('abort', () => reject(new Error('aborted')));
-                }
+                const onAbort = () => reject(new Error('aborted'));
+                signal?.addEventListener('abort', onAbort, { once: true });
+                loader.load(url, (gltf) => {
+                    signal?.removeEventListener('abort', onAbort);
+                    // Aborted while loading: the promise has already rejected and nobody will own this
+                    // scene, so free its geometry, materials and textures now instead of leaking them.
+                    if (signal?.aborted) {
+                        disposeObject3D(gltf.scene);
+                        return;
+                    }
+                    resolve(gltf.scene);
+                }, onProgress, (err) => { signal?.removeEventListener('abort', onAbort); reject(err); });
             });
             // Post-process materials
             root.traverse((object) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "entangled-worlds-orbiters-shared",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "description": "Shared library for entangled worlds orbiters - contains core world rendering, moons system, and UI components",
   "type": "module",
   "main": "dist/index.js",

package/src/clock/Transport.ts

@@ -77,6 +77,19 @@ export interface TransportOptions {
   lookaheadSec?: number;
 }
 
+function isValidRate(rate: number): boolean {
+  return Number.isFinite(rate) && rate > 0;
+}
+
+function isValidAnchoredState(s: AnchoredState): boolean {
+  if (s.playState !== 'playing' && s.playState !== 'paused') return false;
+  if (!Number.isFinite(s.positionSec)) return false;
+  if (s.anchorAudioSec != null && !Number.isFinite(s.anchorAudioSec)) return false;
+  if (s.rate != null && !isValidRate(s.rate)) return false;
+  if (s.loop && !(Number.isFinite(s.loop.startSec) && Number.isFinite(s.loop.endSec))) return false;
+  return true;
+}
+
 export class Transport {
   backend: ClockBackend;
   lookaheadSec: number;
@@ -132,12 +145,13 @@ export class Transport {
     this._cancelArmed(); // armed future audio must not sound during pause; re-armed on resume
   }
   seekSec(sec: number): void {
+    if (!Number.isFinite(sec)) return; // a NaN seek is ignored, never freezes the transport
     this._reanchor(Math.max(0, sec));
     this._cancelArmed();
     this._reopenEvents(); // a seek MOVES position -> fired events may replay
   }
   setRate(rate: number): void {
-    if (rate <= 0) throw new Error('rate must be > 0');
+    if (!isValidRate(rate)) throw new Error('rate must be a finite number > 0');
     this._reanchor();
     this._rate = rate;
     this._cancelArmed(); // window/audio-time changed -> re-arm pending events (NOT replay fired ones)
@@ -149,6 +163,7 @@ export class Transport {
     return this._playing;
   }
   setLoopSec(loop: LoopSec | null): void {
+    if (loop && !(Number.isFinite(loop.startSec) && Number.isFinite(loop.endSec))) return; // ignored
     this._loop = loop ? { startSec: loop.startSec, endSec: loop.endSec } : null;
     this._cancelArmed();
     this._reopenEvents(); // loop topology changed -> events may re-enter/leave the loop window
@@ -218,6 +233,10 @@ export class Transport {
         if (d < -EPS) d += len; // wrapped into the next pass
         return d;
       }
+      // At or past the loop end: the transport wraps back to startSec before getting there, so the
+      // event never occurs while looping. Without this, its look-ahead distance came out positive just
+      // before the wrap and it armed (and sounded) at the wrap instant, at a position never reached.
+      if (len > 0 && ev.atSec >= endSec - EPS) return null;
     }
     const d = ev.atSec - pos;
     return d >= -EPS ? d : null; // non-loop: a passed event won't fire again until a seek
@@ -232,7 +251,13 @@ export class Transport {
   }
 
   // ---- sync apply (Inc 3) -------------------------------------------------------------
-  applyAnchoredState(s: AnchoredState): void {
+  /**
+   * Apply a peer's anchored state. A malformed one (unknown playState, non-finite position, anchor or
+   * loop bounds, or a rate that is not a finite number > 0) is DROPPED whole and `false` is returned: the transport keeps its last
+   * good state until the next good one arrives. It never throws — this runs inside `tick()`.
+   */
+  applyAnchoredState(s: AnchoredState): boolean {
+    if (!isValidAnchoredState(s)) return false;
     this._playing = s.playState === 'playing';
     if (s.rate != null) this._rate = s.rate;
     this._anchorPos = s.positionSec;
@@ -240,9 +265,13 @@ export class Transport {
     if (s.loop !== undefined) this._loop = s.loop ? { ...s.loop } : null;
     this._cancelArmed();
     this._reopenEvents(); // anchored apply repositions the timeline -> events re-evaluate
+    return true;
   }
   /** Arm an anchored state (with optional control) to apply when audio time reaches `atAudioSec`. */
-  scheduleStateChange(atAudioSec: number, state: AnchoredState, meta: ScheduleStateMeta = {}): void {
+  /** Returns `false` (and arms nothing) for a non-finite `atAudioSec` or a malformed state. */
+  scheduleStateChange(atAudioSec: number, state: AnchoredState, meta: ScheduleStateMeta = {}): boolean {
+    // checked at intake too: a NaN time would never drain and would block every later change
+    if (!Number.isFinite(atAudioSec) || !isValidAnchoredState(state)) return false;
     this._pending.push({
       atAudioSec,
       state,
@@ -251,6 +280,7 @@ export class Transport {
       onApply: meta.onApply ?? null,
     });
     this._pending.sort((a, b) => a.atAudioSec - b.atAudioSec);
+    return true;
   }
   /** Drop pending changes older than a freshly-applied (term,seq) — supersession (Codex fix #4). */
   dropPendingOlderThan(term: number, seq: number): void {
@@ -260,8 +290,9 @@ export class Transport {
     const now = this.backend.nowSec();
     while (this._pending.length && this._pending[0].atAudioSec <= now + EPS) {
       const p = this._pending.shift()!;
-      this.applyAnchoredState({ ...p.state, anchorAudioSec: p.state.anchorAudioSec ?? now });
-      if (p.onApply) p.onApply(); // control rides WITH the state, applied atomically here (fix #5)
+      const applied = this.applyAnchoredState({ ...p.state, anchorAudioSec: p.state.anchorAudioSec ?? now });
+      // control rides WITH the state, applied atomically here (fix #5) — a dropped state drops its control too
+      if (applied && p.onApply) p.onApply();
     }
   }
 
@@ -312,7 +343,7 @@ export class Transport {
     if (!this._loop) return;
     const { startSec, endSec } = this._loop;
     const len = endSec - startSec;
-    if (len <= 0) return;
+    if (!(len > 0)) return; // also catches NaN
     const pos = this.positionSec();
     if (pos < endSec - EPS) return;
     const overshoot = (pos - startSec) % len;

package/src/clock/musical.ts

@@ -58,9 +58,13 @@ export class MusicalProjection {
   constructor(spec: MusicalProjectionSpec = {}) {
     this.ppq = spec.ppq ?? DEFAULT_PPQ;
 
-    const tempo = (spec.tempoMap && spec.tempoMap.length ? spec.tempoMap : [{ startSec: 0, bpm: 120 }])
-      .slice()
-      .sort((a, b) => a.startSec - b.startSec);
+    // An entry with bpm <= 0, a NaN bpm or a non-finite start would make beat <-> seconds return
+    // Infinity/NaN — skip it. If nothing usable is left, fall back to the same 120 BPM default as an
+    // empty map.
+    const usable = (spec.tempoMap ?? []).filter(
+      (e) => Number.isFinite(e.startSec) && Number.isFinite(e.bpm) && e.bpm > 0,
+    );
+    const tempo = (usable.length ? usable : [{ startSec: 0, bpm: 120 }]).sort((a, b) => a.startSec - b.startSec);
     // precompute the cumulative beat position at each tempo segment boundary
     this._tempo = tempo.map((s) => ({ ...s, startBeat: 0 }));
     for (let i = 1; i < this._tempo.length; i++) {
@@ -68,11 +72,17 @@ export class MusicalProjection {
       this._tempo[i].startBeat = prev.startBeat + (this._tempo[i].startSec - prev.startSec) * (prev.bpm / 60);
     }
 
-    const sig = (spec.signatureMap && spec.signatureMap.length
-      ? spec.signatureMap
-      : [{ startBar: 0, numerator: 4, denominator: 4 }])
-      .slice()
-      .sort((a, b) => a.startBar - b.startBar);
+    // Same rule for signatures: a zero/negative/NaN numerator or denominator, or a non-finite start
+    // bar, would give Infinity/NaN bars — skip it, and fall back to 4/4 if nothing usable is left.
+    const usableSig = (spec.signatureMap ?? []).filter(
+      (e) =>
+        Number.isFinite(e.startBar) &&
+        Number.isFinite(e.numerator) &&
+        e.numerator > 0 &&
+        Number.isFinite(e.denominator) &&
+        e.denominator > 0,
+    );
+    const sig = (usableSig.length ? usableSig : [{ startBar: 0, numerator: 4, denominator: 4 }]).sort((a, b) => a.startBar - b.startBar);
     // precompute the cumulative beat position at each signature segment's startBar
     this._sig = sig.map((s) => ({ ...s, beatsPerBar: (s.numerator * 4) / s.denominator, startBeat: 0 }));
     for (let i = 1; i < this._sig.length; i++) {

package/src/clock/sync.ts

@@ -72,6 +72,14 @@ export interface EstimateOffsetOpts {
 }
 
 const mod = (n: number, m: number): number => ((n % m) + m) % m;
+/** A usable timeline: a finite tempo above zero and finite anchors. Anything else makes every beat
+ *  <-> time conversion NaN or Infinity, for this peer and for every peer that adopts it. */
+const isValidTimeline = (t: BeatTimelineState | null | undefined): t is BeatTimelineState =>
+  !!t &&
+  Number.isFinite(t.tempoBpm) &&
+  t.tempoBpm > 0 &&
+  Number.isFinite(t.anchorBeat) &&
+  Number.isFinite(t.anchorSessionMs);
 const newerTs = (a: TimelineStamp, b: TimelineStamp): boolean =>
   a.time > b.time || (a.time === b.time && a.id > b.id);
 
@@ -225,6 +233,8 @@ export class BeatTimeline implements RelayNode {
 
   // ---- timeline mutations (all leaderless: broadcast + last-writer-wins) ---------------
   private _commit(timeline: BeatTimelineState): void {
+    // Validated before it is broadcast: last-writer-wins would hand a broken timeline to every peer.
+    if (!isValidTimeline(timeline)) throw new Error('beat timeline needs a finite tempo > 0 and finite anchors');
     this.timeline = { ...timeline };
     this._ts = { time: this.sessionNowMs(), id: this.id };
     if (this.enabled)
@@ -269,7 +279,9 @@ export class BeatTimeline implements RelayNode {
   // ---- start/stop intent (opt-in; never adopted on join) ------------------------------
   setLocalPlaying(playing: boolean): void {
     this.localPlaying = playing;
-    this.relay.send(this.id, { kind: 'beat:transport', id: this.id, playing, atSessionMs: this.sessionNowMs() });
+    // Solo (`enabled` false) broadcasts nothing, as with the timeline and hello messages.
+    if (this.enabled)
+      this.relay.send(this.id, { kind: 'beat:transport', id: this.id, playing, atSessionMs: this.sessionNowMs() });
     if (this.onChange) this.onChange();
   }
 
@@ -289,7 +301,8 @@ export class BeatTimeline implements RelayNode {
         break;
       case 'beat:timeline':
         if (msg.id) this.peers.add(msg.id);
-        if (newerTs(msg.ts, this._ts)) {
+        // A malformed timeline (tempo 0, NaN anchor, from a buggy or older peer) is never adopted.
+        if (isValidTimeline(msg.timeline) && msg.ts && newerTs(msg.ts, this._ts)) {
           this.timeline = { ...msg.timeline };
           this._ts = msg.ts;
         }

package/src/loaders/glbLoader.ts

@@ -2,6 +2,7 @@ import * as THREE from 'three';
 import { GLTFLoader } from 'three/examples/jsm/loaders/GLTFLoader.js';
 import { ensureStandardMaterial, applyFlagsToMaterial, type MaterialFlags } from '../utils/materials.js';
 import { getKTX2LoaderForRenderer } from './ktx2.js';
+import { disposeObject3D } from '../utils/dispose.js';
 
 /**
  * `renderer` is REQUIRED at runtime (throws without one).
@@ -43,6 +44,9 @@ export async function loadGLB(
 
   let attempt = 0;
   while (attempt < retries) {
+    // An abort during the pause between attempts must stop here: a listener added to an
+    // already-aborted signal never fires, so the next attempt would load and resolve anyway.
+    if (signal?.aborted) throw new Error('aborted');
     try {
       const loader = new GLTFLoader()
         .setCrossOrigin(withCredentials ? 'use-credentials' : 'anonymous')
@@ -50,15 +54,20 @@ export async function loadGLB(
         .setKTX2Loader(getKTX2LoaderForRenderer(renderer));
 
       const root = await new Promise<THREE.Group>((resolve, reject) => {
+        const onAbort = () => reject(new Error('aborted'));
+        signal?.addEventListener('abort', onAbort, { once: true });
         loader.load(
           url,
-            (gltf) => resolve(gltf.scene),
-            onProgress,
-            reject
+          (gltf) => {
+            signal?.removeEventListener('abort', onAbort);
+            // Aborted while loading: the promise has already rejected and nobody will own this
+            // scene, so free its geometry, materials and textures now instead of leaking them.
+            if (signal?.aborted) { disposeObject3D(gltf.scene); return; }
+            resolve(gltf.scene);
+          },
+          onProgress,
+          (err) => { signal?.removeEventListener('abort', onAbort); reject(err); }
         );
-        if (signal) {
-          signal.addEventListener('abort', () => reject(new Error('aborted')));
-        }
       });
 
       // Post-process materials