merge: fold in lotus commits e36aef8a..cbd42bf9 landed during the v0.25.0 sync

Six fix(lotus) commits reached `lotus` while the upstream merge was in
progress (deafen via global output mute, denoise race/fallback fixes,
strictOriginCheck on the widget transport, call_state standalone skip,
set_quality null-clears-cap, plus four new src/lotus/*.test.ts files).
Merged them on top of the v0.25.0 sync so this branch is a superset of
current `lotus`.

One conflict, src/lotus/lotusDenoiseProcessor.ts: the sync commit had
dropped a meaningless `void` (oxlint no-meaningless-void-operator) on a
line the incoming commit also touched; kept the void-less form so oxlint
stays clean.

Verification after the fold-in (Node 24.11.1 / pnpm 11.21.0): tsc clean;
oxlint clean; oxfmt --check clean; knip exit 0; vitest unit 88 files /
639 passed / 9 skipped; build:embedded OK, staged to embedded/web/dist,
all six io.lotus.* actions present in the bundle.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

src/lotus/lotusDeafen.ts

@@ -15,29 +15,52 @@ import { logger } from "matrix-js-sdk/lib/logger";
 import { type IWidgetApiRequest } from "matrix-widget-api";
 
 import { type CallViewModel } from "../state/CallViewModel/CallViewModel";
+import { setAudioEnabled$ } from "../controls";
 import { widget } from "../widget";
 import { LotusWidgetActions } from "./lotusActions";
 
 /**
- * Handle the host's `io.lotus.set_deafen` toWidget action: silence remote audio
- * at the LiveKit source, replacing cinny's brittle iframe-DOM `.muted` hack
- * (which fought MatrixAudioRenderer and broke on re-render / late tracks).
+ * Handle the host's `io.lotus.set_deafen` toWidget action, replacing cinny's
+ * brittle iframe-DOM `.muted` hack (which fought MatrixAudioRenderer and broke
+ * on re-render / late tracks).
  *
- * `deafened` mutes every remote participant's microphone AND screenshare audio;
- * `screenshareAudioMuted` mutes only the screenshare audio (so the host can
- * drop shared-tab/game audio while still hearing voices). Volume is set PER
- * SOURCE via `RemoteParticipant.setVolume(volume, source)` — whose verified
- * signature in livekit-client ^2.18.1 is
- * `setVolume(volume, source?: Track.Source.Microphone | Track.Source.ScreenShareAudio)`
- * and DEFAULTS `source` to `Microphone` (NOT "all audio"), so each source must
- * be set explicitly. setVolume records the value in the participant's
- * `volumeMap`, so a track that (re)subscribes later re-applies it automatically.
+ * `deafened` drives EC's OWN global audio output mute: `setAudioEnabled$` feeds
+ * `muteAllAudio$` (`src/state/MuteAllAudioModel.ts`), which `InCallView` already
+ * passes as `muted` to every `LivekitRoomAudioRenderer` (and hence
+ * `MatrixAudioRenderer`), plus `CallEventAudioRenderer` and
+ * `ReactionsAudioRenderer`. That silences EVERY remote source — microphone,
+ * screenshare audio and `Track.Source.Unknown` soundboard clips — and needs no
+ * per-participant bookkeeping for late joiners or reconnects.
  *
- * State is closure-scoped (per invocation, matching the sibling lotus modules)
- * and re-applied to every current room's participants on change, and to LATE
- * JOINERS via `RoomEvent.ParticipantConnected`. The cinny host re-sends the
- * current state on every call join (CallControl.forceState), so a fresh call
- * never inherits a previous call's deafen state.
+ * This deliberately does NOT use `RemoteParticipant.setVolume` for deafen any
+ * more: EC's per-participant volume slider / per-tile mute writes the same
+ * `volumeMap` from `createVolumeControls` (`src/state/VolumeControls.ts`)
+ * whenever its `sink$` re-emits (every join, every participant re-resolution),
+ * so a `setVolume(0)` deafen was silently undone for anyone joining while
+ * deafened, and an undeafen `setVolume(1)` clobbered the user's own per-tile
+ * volume/mute state.
+ *
+ * `screenshareAudioMuted` is a NARROWER, independent host control (drop shared
+ * tab/game audio while still hearing voices). EC has no global per-source mute,
+ * so that one still has to go through
+ * `RemoteParticipant.setVolume(volume, Track.Source.ScreenShareAudio)` — whose
+ * verified signature in livekit-client ^2.18.1 is
+ * `setVolume(volume, source?: Track.Source.Microphone | Track.Source.ScreenShareAudio)`.
+ * It is re-applied to late joiners via `RoomEvent.ParticipantConnected`, and we
+ * only ever restore participants we muted ourselves. Known limitation: EC's own
+ * screenshare volume slider writes the same `volumeMap`, so a user who moves
+ * that slider while screenshare audio is host-muted wins; the mic path (the
+ * actual deafen) is no longer affected by that race at all.
+ *
+ * Undeafen restores the user's OWN output-enabled state as it was before the
+ * deafen (and never touches the `mute-all-audio` setting), so a user who had
+ * already muted all audio themselves stays muted.
+ *
+ * State is closure-scoped (per invocation, matching the sibling lotus modules).
+ * Applying the same state twice is a no-op, so the host's
+ * `CallControl.resendForkState()` after a reconnect is safe. The host re-sends
+ * the current state on every call join (CallControl.forceState), so a fresh
+ * call never inherits a previous call's deafen state.
  *
  * No effect unless the host sends the action. Returns a teardown function.
  */
@@ -48,32 +71,69 @@ export function startLotusDeafen(vm: CallViewModel): () => void {
   let deafened = false;
   let screenshareAudioMuted = false;
 
+  // The user's own audio-output state, tracked from `setAudioEnabled$` so an
+  // undeafen restores it rather than blindly enabling output. Defaults to
+  // `true`, matching `muteAllAudio$`'s `startWith(true)`.
+  let userAudioEnabled = true;
+  // Ignore our own (synchronous) emissions while tracking the user's state, and
+  // skip pushes that would not change anything so re-applying the same state
+  // (the host's `resendForkState()` after a reconnect) is a no-op.
+  let selfEmitting = false;
+  let lastApplied: boolean | null = null;
+
+  const applyGlobalMute = (): void => {
+    const desired = deafened ? false : userAudioEnabled;
+    // `lastApplied` is our own override, if any; otherwise the live state is
+    // whatever the user last set.
+    const current = lastApplied ?? userAudioEnabled;
+    lastApplied = desired;
+    if (desired === current) return;
+    selfEmitting = true;
+    try {
+      setAudioEnabled$.next(desired);
+    } finally {
+      selfEmitting = false;
+    }
+  };
+
+  const audioSub = setAudioEnabled$.subscribe((enabled) => {
+    if (selfEmitting) return;
+    userAudioEnabled = enabled;
+    if (deafened && enabled) {
+      // Something else (the native output controls) re-enabled audio while
+      // deafened — re-assert the mute instead of silently losing deafen.
+      lastApplied = true;
+      applyGlobalMute();
+    }
+  });
+
+  // Participants whose screenshare audio WE turned down, so undoing the host's
+  // screenshare mute never writes a volume to anyone else.
+  const screenshareMuted = new Set<RemoteParticipant>();
+
   const applyToParticipant = (p: RemoteParticipant): void => {
-    p.setVolume(deafened ? 0 : 1, Track.Source.Microphone);
-    p.setVolume(
-      deafened || screenshareAudioMuted ? 0 : 1,
-      Track.Source.ScreenShareAudio,
-    );
-    // NOTE: injected/soundboard audio (published as `Track.Source.Unknown`) is
-    // deliberately NOT silenced here. The verified `setVolume` type signature
-    // only accepts `Track.Source.Microphone | Track.Source.ScreenShareAudio`,
-    // so passing `Unknown` would fail the fork's `tsc` gate and require an
-    // unsafe cast. Soundboard clips are short, host-triggered content the host
-    // already controls at the inject source, so leaving them audible is the
-    // type-clean, safe choice (a full-parity "mute everything" is not needed
-    // for the deafen semantics: don't-hear-other-people's-voices).
+    if (screenshareAudioMuted) {
+      p.setVolume(0, Track.Source.ScreenShareAudio);
+      screenshareMuted.add(p);
+    } else if (screenshareMuted.delete(p)) {
+      p.setVolume(1, Track.Source.ScreenShareAudio);
+    }
   };
 
   const applyToRoom = (room: LivekitRoom): void =>
     room.remoteParticipants.forEach(applyToParticipant);
 
   // Per-room ParticipantConnected listeners, so LATE JOINERS pick up the
-  // current deafen state the moment they connect.
+  // current screenshare-audio mute the moment they connect. Drive off the
+  // local participant's connection(s), not `livekitRoomItems$` — that stream is
+  // empty until a matrix-validated REMOTE member resolves, so listeners would
+  // be attached too late for the first joiner (the sibling lotus modules all
+  // use `allConnections$` for the same reason).
   const roomListeners = new Map<LivekitRoom, () => void>();
   let rooms: LivekitRoom[] = [];
 
-  const sub = vm.livekitRoomItems$.subscribe((items) => {
-    const next = items.map((i) => i.livekitRoom);
+  const sub = vm.allConnections$.subscribe((data) => {
+    const next = data.getConnections().map((c) => c.livekitRoom);
     rooms = next;
     // Detach listeners for rooms that went away.
     for (const [room, off] of roomListeners) {
@@ -107,6 +167,7 @@ export function startLotusDeafen(vm: CallViewModel): () => void {
     logger.debug(
       `[lotus] set_deafen: deafened=${deafened} screenshareAudioMuted=${screenshareAudioMuted}`,
     );
+    applyGlobalMute();
     rooms.forEach(applyToRoom);
   };
 
@@ -115,6 +176,13 @@ export function startLotusDeafen(vm: CallViewModel): () => void {
     sub.unsubscribe();
     for (const off of roomListeners.values()) off();
     roomListeners.clear();
+    // Leave the user's own output state as they had it before deafen.
+    if (deafened) {
+      deafened = false;
+      applyGlobalMute();
+    }
+    screenshareMuted.clear();
+    audioSub.unsubscribe();
     w.lazyActions.off(LotusWidgetActions.SetDeafen, handler);
   };
 }