Lands the audit follow-ups that didn't require external input. Only the
wire-format draft pinning (MoQ #1, #8) remains deferred — that's gated
on the M4 manual interop pass, and the same-room-PIP-re-entry corner
case (Android #5) — Android has no programmatic PIP-exit API.
ViewModel:
- VM #10: serialize disconnect→connect via a tracked `pendingCloseJob`.
teardown() records the listener.close() launch (when not finalCleanup);
the next launchConnect() awaits it before opening a fresh transport.
Eliminates the brief two-QUIC-session overlap that some MoQ relays
reject by deduping on client pubkey.
- VM #4: extracted shared connect-launch body into `launchConnect(triggerRetryOnFailure)`
so connect() / connectInternal() share one implementation. Removed
the near-duplicate viewModelScope.launch block.
- VM #8b: setMicMuted no longer silently swallows handle failures.
BroadcastUiState.Broadcasting gains a `muteError: String?` field that
the UI can surface as an inline message; cleared on the next successful
toggle. The broadcast itself stays running with its previous mute
state — only the mute toggle failed.
- VM #6: documented the dispatcher-confinement contract in the class
kdoc. Audit was theoretical — every map mutation already runs on
viewModelScope (Dispatchers.Main.immediate on Android, same dispatcher
the MoQ flow's onEach callback uses because the player launch lives in
viewModelScope). Future cross-thread callers must marshal explicitly.
Android:
- Android #2: AudioRoomActivity.toggleMuteSignal type tightened from
`MutableSharedFlow<Unit>` to `SharedFlow<Unit>` so external code can't
tryEmit into it. Internal emit uses the private `_toggleMuteSignal`.
- Android #10: presence debounce-publisher (the LaunchedEffect keyed on
micMutedTag) now skips entirely when micMutedTag is null. Stops the
duplicate first-frame publish where heartbeat fires immediately AND
debounce-publisher fires 500 ms later, both with muted=null. Once the
user goes live the debounce-publisher kicks in for state changes.
MoQ session:
- MoQ #11: send() rollback comment rewritten to say "monotonic; gaps
acceptable per spec, this just minimises them on full-fanout failures"
instead of the misleading "strictly contiguous" claim.
Verified: spotlessApply clean; :commons:jvmTest, :nestsClient:jvmTest
(80 tests), :amethyst:compilePlayDebugKotlin all green.
Still deferred:
- MoQ #1, #8: wire-format draft pinning (draft-17 vs draft-11). Needs
M4 interop input from `nostrnests.com` to know what the relay actually
speaks.
- Android #5: same-room re-entry from MainActivity while in PIP doesn't
auto-exit PIP. Android has no programmatic PIP-exit API; user must tap
the expand button. Corner case.
- Test coverage gaps (round-1 VM #10, round-2 VM #13): retry-counter +
broadcast state + setMicMuted-no-handle + server-Closed cleanup +
double-connect-while-Failed. Each is a small dedicated test using the
existing connector-seam pattern; landing as a separate test-only commit.
Claude
2a932dc974