fix(android): abandon room before signaling close (#108)

android/sender/app/src/main/java/icu/bonfire/screener/sender/RemoteSession.kt

@@ -76,8 +76,9 @@ class RemoteSession(
         if (!closed.compareAndSet(false, true)) return
         stopped.set(true)
         activeCall.get()?.cancel()
-        socket?.send(Wire.abandonRoom())
-        socket?.close(1000, "sender stopped")
+        val activeSocket = socket
+        if (room != null) activeSocket?.send(Wire.abandonRoom())
+        activeSocket?.close(1000, "sender stopped")
         socket = null
         peers.values.forEach(HostPeer::close)
         peers.clear()
@@ -88,7 +89,6 @@ class RemoteSession(
     fun cancelPending() {
         stopped.set(true)
         activeCall.get()?.cancel()
-        socket?.cancel()
     }
 
     private fun authenticateSite() {

docs/project-memory.md

@@ -24,7 +24,7 @@ Last updated: 2026-08-21
 - Browser relays resend remote `MediaStreamTrack` values and re-encode at each hop; WebRTC does not guarantee a shared encoder across peer connections, so measure the cost.
 - Keep experiments bounded: the standard representation sequence is below; native RTP relay, encoded-object striping, and FEC remain separate.
 - ADR-0006 remains no-go. VP8 is default; H.264 loopback rendered 298/299. Windows x64 evaluation packaging is source-complete; downloaded use, Pion timing, hardware, multi-viewer/endurance/public proof remain open.
-- Mobile Web Host is unsupported. Android 14+ P1 uses MediaProjection and hardware-only libwebrtc children; SFU fails boundedly, while audio and rotation remain later. iOS waits for stable ScreenCaptureKit. TV output: P2, local-only; do not change routing or invent Cast transport.
+- Mobile Web Host unsupported. Android 14+ sender is direct-child video-only; device, audio, rotation, and SFU remain open. iOS deferred; TV output is local-only P2.
 - ADR-0005 accepts direct/peer UDP, bounded SFU roots, then optional selected-edge TURN. Production now enables the one-shot selected-edge tuple after SFU; participant-wide TURN remains rejected and ordinary peer ICE stays STUN-only. No real TURN/SFU media canary has yet been run.
 - The controller is process-enabled, not room-allowlisted: `PEER_ASSISTED_MEDIA=true` gives every normal room the same direct/peer -> SFU -> selected-edge path with per-room state. Room `1` is historical smoke. Preserve sticky P2P, mobile leaves and break-before-make; recovery gets one attempt per layer (ICE restart, same-parent rebuild, alternate peer, then SFU), never three identical retries.
 - C+B quality reparenting is edge-local and cooldown-bound; no score, timer, or global parent penalty.

docs/research/native-shared-encode-sender.md

@@ -240,6 +240,11 @@ transient room TTL still caps the room, and restart drops it. A pre-auth
 connection or authentication failure gets one same-room/token/client-generation
 retry without a second room POST. SQLite remains v2 and ordinary Web creation is
 unchanged.
+Android stop/capture-failure cleanup keeps the established signaling socket until
+its single-thread teardown sends `abandon-room` and then performs a normal close;
+pending-work cancellation only blocks callbacks and cancels active HTTP. No ACK
+is awaited. A provisional room whose WebSocket handshake never opened remains
+bounded by the existing 300-second reclaim window.
 HTTP statuses, Cookie attributes, create-room responses, Host authentication,
 and ignored Viewer evidence are strict and bounded; errors retain only fixed categories.
 Focused Go and TypeScript checks pass. The overbroad unused gate/probe framework

docs/status.md

@@ -41,7 +41,7 @@ Flagship; parallel; min run/smoke/rollback; benchmark later. Active UI/config/lo
 ## Unverified Boundaries
 
 - The final deployment proves process/config health, not a retained SFU frame, retry/failback, selected UDP pair, admission rescue, edge cap, quality, or resource deltas; game-share load/blur remains unclassified.
-- Mobile Web Host unsupported; Viewer leaf-only. Android 14+ direct-child video source passes six local protocol tests and `assembleDebug`; its GitHub compile gate is account-billing blocked, while device media, SFU, audio, and rotation proof remain open. iOS is deferred; TV output is local-only P2.
+- Mobile Web Host unsupported; Viewer leaf-only. Android 14+ direct-child source passed six protocol tests and `assembleDebug`; GitHub compile is billing-blocked. Device media, SFU, audio, and rotation remain open. iOS deferred; TV output is local-only P2.
 - Silent partitions can wait 30 to 60 seconds for heartbeat detection before the default 5-second grace; this remains unverified.
 - The former release reportedly sustained bandwidth-limited blur on a capable LAN; Host refresh recovered while Viewer refresh did not. The new deployment has not yet reproduced or cleared it.
 - ADR-0006 has one Viewer proof; two-edge/FIFO, hardware, endurance, public/downloaded-package, and browser-diversity proof remain open.

docs/需求理解.md

@@ -42,7 +42,7 @@
 - [ ] 私密房间双入口：private room 接受现有 `/r/{code}#v={grant}` 合法邀请直接进入，或“站点访问 + 房间号 + 该房间观看密码”。没有 grant 的 `/join` 或 `/r/{code}` 先显示中性的站点访问验证，通过后才显示中性的房间密码输入。Host 可设置、轮换或移除房间观看密码。密码接受 1 至 64 个可见 ASCII 字符；异步 scrypt 全局最多执行 2 个、等待 16 个派生。站点口令和房间密码都不得进入 URL/query/storage/log/SQLite；不存在、错误密码、队满和正确密码后的满房都返回通用结果。
 
 - [ ] 统一自动路由：旗舰部署开启 `PEER_ASSISTED_MEDIA` 后，所有正常房间都进入同一个 direct/peer -> SFU -> selected-edge controller；每个房间独立保存 assignment/session/revision/connection generation 和容量状态。`PEER_ASSISTED_ROOM_IDS` 已退役，room `1` 只作为历史 smoke fixture，不能作为功能开关。未启用总开关的开发/轻量部署仍可保留 ordinary P2P；普通 peer 始终 STUN-only。selected-edge TURN 只能复用当前 controller 选中的异常 edge，不能向普通 peer edge 预发 candidates。该能力不增加 UI、用户选择、百分比发布或第二套路由器。
-- [ ] Android 原生分享端首片：Android 14/API 34+ 通过系统 `MediaProjection` picker、`mediaProjection` foreground service 和硬件-only libwebrtc VP8/H.264 encoder 发送一份 720p30 `HIGH` 视频；无硬件 encoder 时明确失败，不静默使用软件编码。它必须复用旗舰 `screener-v2` 的 site access、room、WSS 与 peer-assisted Host direct-child assignment，按权威 route revision/connection generation 维护至多两条 STUN-only downstream edge；direct active route 回报 `route-ready`，SFU publication assignment 在本首片中回报有界 `route-failed`。Viewer 与服务端媒体协议不变。不实现音频、`LOW`、AV1、codec ladder、第三条 Host edge、selected-edge TURN、SFU SDK、旋转热更新、后台重建或跨平台 framework；系统撤销/停止必须立即释放 capture、PeerConnection 和前台服务。
+- [ ] Android 原生分享端首片：Android 14/API 34+ 通过系统 `MediaProjection` picker、`mediaProjection` foreground service 和硬件-only libwebrtc VP8/H.264 encoder 发送一份 720p30 `HIGH` 视频；无硬件 encoder 时明确失败，不静默使用软件编码。它必须复用旗舰 `screener-v2` 的 site access、room、WSS 与 peer-assisted Host direct-child assignment，按权威 route revision/connection generation 维护至多两条 STUN-only downstream edge；direct active route 回报 `route-ready`，SFU publication assignment 在本首片中回报有界 `route-failed`。Viewer 与服务端媒体协议不变。不实现音频、`LOW`、AV1、codec ladder、第三条 Host edge、selected-edge TURN、SFU SDK、旋转热更新、后台重建或跨平台 framework；系统撤销/停止必须在串行 teardown 中先对已建立的房间发送一次 `abandon-room`、再正常关闭信令并立即释放 capture、PeerConnection 和前台服务，不等待 room-close ACK；尚未建立信令的 provisional room 仍由 300 秒上限回收。
 
 - [ ] 质量控制扩展：推荐档位仍是默认入口；折叠高级区只允许 720p/1080p/1440p 分辨率 ceiling、15 至 60 的整数 FPS ceiling、2 至 12 Mbps 视频码率 ceiling，以及清晰/平衡/流畅三种偏好。直播中显式应用后才生效，避免滑杆产生连续控制流量。当前 Web 发送端不提供音频声道、采样率、Opus 码率、stereo、DTX 或 FEC 控件：display capture 未把声道和采样率定义为可移植控制，标准音频 `maxBitrate` 只是可能导致更低质量或停播的发送上限，其他项依赖 codec/fmtp 协商而没有可移植 sender setter。除非真实音频矩阵证明用户问题、标准 API 能应用并读回且实际结果可独立观测，否则不得为这些控件新增应用层 SDP munging 或用默认值制造伪控制。实际质量持续低于所选上限时必须显示可解释的限制原因；在真实拥塞、编码器和接收端证据完成前，不把任一组合称为“完美平衡”。
 - [ ] 本地预览性能候选：在相同动态场景中 A/B 测量 Host 动态预览开/关的 CPU、GPU、encode time 和实际 FPS。只有稳定收益且捕获、编码和远端画面不受影响时，才允许直播开始后默认显示静止缩略图或隐藏动态预览并提供按需展开；未测前不宣称收益。