startLotusDecorations's last teardown deliberately wipes decorations = {}, and startLotusFocus's teardown drops the handler while the pin lives on the (possibly recreated) view model. The host's re-arm path after a reconnect, CallControl.resendForkState(), only resends set_deafen and set_quality — not decorations and not focus_participant. LotusDecorationPusher pushes only on a change to its map.current, so with an unchanged member list it never re-sends. Any EC-side remount of InCallView/ActiveCall that does not also unmount the host pusher therefore loses all avatar decorations (and the pin) permanently for the remainder of the call.
How to trigger
EC reconnect / ActiveCall remount while cinny stays joined (cinny's own comment at CallControl.ts:170 states the fork handlers "remount on reconnect"). Decorations disappear from tiles and never come back.
Suggested fix
add decorations (and the current focus pin) to resendForkState(), or have EC re-request state on handler registration; alternatively drop the decorations = {} wipe and key the roster by call id.
Filed from the September 2026 audit (branch lotus).
**Severity:** medium · **Type:** bug · **Confidence:** medium
**Location:** `src/lotus/lotusDecorations.ts:90-103`, `src/room/InCallView.tsx:295-305`, `/root/code/cinny/src/app/plugins/call/CallControl.ts:170-177`, `/root/code/cinny/src/app/features/lotus/LotusDecorationPusher.tsx:44-63`
### Problem
`startLotusDecorations`'s last teardown deliberately wipes `decorations = {}`, and `startLotusFocus`'s teardown drops the handler while the pin lives on the (possibly recreated) view model. The host's re-arm path after a reconnect, `CallControl.resendForkState()`, only resends `set_deafen` and `set_quality` — not `decorations` and not `focus_participant`. `LotusDecorationPusher` pushes only on a *change* to its `map.current`, so with an unchanged member list it never re-sends. Any EC-side remount of `InCallView`/`ActiveCall` that does not also unmount the host pusher therefore loses all avatar decorations (and the pin) permanently for the remainder of the call.
### How to trigger
EC reconnect / `ActiveCall` remount while cinny stays joined (cinny's own comment at CallControl.ts:170 states the fork handlers "remount on reconnect"). Decorations disappear from tiles and never come back.
### Suggested fix
add `decorations` (and the current focus pin) to `resendForkState()`, or have EC re-request state on handler registration; alternatively drop the `decorations = {}` wipe and key the roster by call id.
---
_Filed from the September 2026 audit (branch `lotus`)._
jared
added this to the EC fork audit 2026-09 · Medium & Low milestone 2026-09-12 02:13:06 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: medium · Type: bug · Confidence: medium
Location:
src/lotus/lotusDecorations.ts:90-103,src/room/InCallView.tsx:295-305,/root/code/cinny/src/app/plugins/call/CallControl.ts:170-177,/root/code/cinny/src/app/features/lotus/LotusDecorationPusher.tsx:44-63Problem
startLotusDecorations's last teardown deliberately wipesdecorations = {}, andstartLotusFocus's teardown drops the handler while the pin lives on the (possibly recreated) view model. The host's re-arm path after a reconnect,CallControl.resendForkState(), only resendsset_deafenandset_quality— notdecorationsand notfocus_participant.LotusDecorationPusherpushes only on a change to itsmap.current, so with an unchanged member list it never re-sends. Any EC-side remount ofInCallView/ActiveCallthat does not also unmount the host pusher therefore loses all avatar decorations (and the pin) permanently for the remainder of the call.How to trigger
EC reconnect /
ActiveCallremount while cinny stays joined (cinny's own comment at CallControl.ts:170 states the fork handlers "remount on reconnect"). Decorations disappear from tiles and never come back.Suggested fix
add
decorations(and the current focus pin) toresendForkState(), or have EC re-request state on handler registration; alternatively drop thedecorations = {}wipe and key the roster by call id.Filed from the September 2026 audit (branch
lotus).