fix(lotus): decoration ring sized around the avatar, hidden on error / reduced motion, CDN-pinned, survives remount

- .lotusDecoration 50cqmin -> 62cqmin (cinny's inset ratio); onError
  hides a broken image (#4).
- display:none under prefers-reduced-motion, matching the host (#19).
- safeImageUrl only accepts ALLOWED_DECORATION_ORIGINS (the decorations
  CDN) plus blob: (#28).
- Roster is no longer wiped on last teardown; the handler sends
  io.lotus.request_state on (re)registration so the host can re-push
  decorations and the pin (#17 — host half in cinny).

Fixes #4
Fixes #19
Fixes #28
Fixes #17

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

src/lotus/lotusDecorations.ts

@@ -9,7 +9,7 @@ import { useSyncExternalStore } from "react";
 import { type IWidgetApiRequest } from "matrix-widget-api";
 
 import { widget } from "../widget";
-import { LotusWidgetActions } from "./lotusActions";
+import { LotusWidgetActions, lotusSendToHost } from "./lotusWidget";
 
 /**
  * Avatar decorations (#6 / A6). The Lotus host (cinny) owns the decoration
@@ -38,11 +38,26 @@ export function useLotusDecoration(userId: string): string | undefined {
   return useSyncExternalStore(subscribe, () => decorations[userId]);
 }
 
+// [lotus #28] The decoration URL comes from the host, which builds it from an
+// arbitrary (unvalidated on the wire) profile field. `safeImageUrl` used to
+// accept ANY https origin, so the only thing stopping a third-party image
+// beacon on every tile was the host happening to build the URL itself. Pin it
+// to the actual decoration CDN origin(s) — cinny's `DECORATION_CDN`
+// (`avatarDecorations.ts`) — plus `blob:`, which EC itself may use for local
+// previews. Exported so a future CDN move is a one-line edit here.
+export const ALLOWED_DECORATION_ORIGINS: readonly string[] = [
+  "https://drive.lotusguild.org",
+];
+
 function safeImageUrl(raw: unknown): string | null {
   if (typeof raw !== "string") return null;
   try {
     const u = new URL(raw, window.location.href);
-    return u.protocol === "https:" || u.protocol === "blob:" ? u.href : null;
+    if (u.protocol === "blob:") return u.href;
+    return u.protocol === "https:" &&
+      ALLOWED_DECORATION_ORIGINS.includes(u.origin)
+      ? u.href
+      : null;
   } catch {
     return null;
   }
@@ -87,6 +102,13 @@ export function startLotusDecorations(): () => void {
     unregister = (): void => {
       w.lazyActions.off(LotusWidgetActions.Decorations, handler);
     };
+    // [lotus #17] An EC-side remount of InCallView/ActiveCall tears this
+    // handler down and back up while cinny stays joined, and the host only
+    // re-pushes decorations on a CHANGE to its roster — with an unchanged
+    // member list it never re-sends, so the tiles would otherwise lose their
+    // decorations for the rest of the call. Ask the host to re-push whatever
+    // it currently has every time the handler (re)registers.
+    lotusSendToHost(LotusWidgetActions.RequestState, {});
   }
   registrations += 1;
 
@@ -96,11 +118,15 @@ export function startLotusDecorations(): () => void {
       registrations = 0;
       unregister?.();
       unregister = null;
-      // Reset the roster once the last registration goes away, so a decoration
-      // pushed in call A can't leak onto a shared user in call B before the
-      // host re-pushes. Notify listeners so any still-mounted tile drops the
-      // now-stale overlay via the render path.
-      decorations = {};
+      // [lotus #17] Do NOT wipe the roster here. It used to reset to `{}` so a
+      // decoration from call A couldn't leak onto a same-named user in call B,
+      // but `decorations` is a module-scope singleton for the lifetime of the
+      // PAGE (a fresh call is a fresh page/iframe load, which resets this
+      // module anyway), while an EC-side handler remount within the SAME call
+      // was wiping live decorations that the host has no reason to re-send
+      // (see the request_state ask above, which covers hosts that don't
+      // proactively resend). Listeners are still notified so a torn-down
+      // period doesn't itself change anything visible.
       emit();
     }
   };