io.lotus.focus_participant only feeds spotlight$, which overrideSpotlight$ computes correctly — but spotlight$ is rendered only in spotlight-family layouts. In the default windowMode === "normal" + gridMode === "grid" path, gridLayoutMedia$ passes spotlight: spotlight.some(vm => vm.type === "screen share") ? spotlight : undefined, so a pinned camera with no screenshare is discarded outright. createLayoutModeSwitch defaults to "grid" (src/state/CallViewModel/LayoutSwitch.ts:57 — spotlight only for hasRemoteScreenShares || windowMode === "flat"), and 1:1 calls go through oneOnOneLandscapeLayoutMedia$, which ignores spotlight$ entirely. The action never forces a layout switch, and cinny's focusCameraParticipant (CallControl.ts:449) no longer clicks the spotlight toggle the way the old DOM hack did — its own docstring still claims it "switch[es] to spotlight mode if needed". Since cinny hides EC's control row (visibility: hidden, CallControl.ts:applyBodyMutation), the user cannot switch layout inside the iframe either.
Cross-reference:LotusGuild/cinny#56 covers the missing unpin UI on the host; this issue is why the pin does nothing in grid layout in the first place.
How to trigger
2–8 person call, no screenshare, desktop width. Member glance → "Focus camera". Nothing visibly changes; the pin is stored but never rendered.
Suggested fix
have setManualSpotlight(userId) with a non-null id also force setGridMode("spotlight") (and restore the user's prior mode on clear), or make gridLayoutMedia$ surface spotlight when a manual pin is active.
Filed from the September 2026 audit (branch lotus).
**Severity:** high · **Type:** bug · **Confidence:** high
**Location:** `src/state/CallViewModel/CallViewModel.ts:1076`, `src/state/CallViewModel/CallViewModel.ts:1214`, `src/lotus/lotusSpotlight.ts:56`, `src/lotus/lotusFocus.ts:36`
### Problem
`io.lotus.focus_participant` only feeds `spotlight$`, which `overrideSpotlight$` computes correctly — but `spotlight$` is *rendered* only in spotlight-family layouts. In the default `windowMode === "normal"` + `gridMode === "grid"` path, `gridLayoutMedia$` passes `spotlight: spotlight.some(vm => vm.type === "screen share") ? spotlight : undefined`, so a pinned camera with no screenshare is discarded outright. `createLayoutModeSwitch` defaults to `"grid"` (`src/state/CallViewModel/LayoutSwitch.ts:57` — spotlight only for `hasRemoteScreenShares || windowMode === "flat"`), and 1:1 calls go through `oneOnOneLandscapeLayoutMedia$`, which ignores `spotlight$` entirely. The action never forces a layout switch, and cinny's `focusCameraParticipant` (CallControl.ts:449) no longer clicks the spotlight toggle the way the old DOM hack did — its own docstring still claims it "switch[es] to spotlight mode if needed". Since cinny hides EC's control row (`visibility: hidden`, CallControl.ts:`applyBodyMutation`), the user cannot switch layout inside the iframe either.
**Cross-reference:** LotusGuild/cinny#56 covers the missing unpin UI on the host; this issue is why the pin does nothing in grid layout in the first place.
### How to trigger
2–8 person call, no screenshare, desktop width. Member glance → "Focus camera". Nothing visibly changes; the pin is stored but never rendered.
### Suggested fix
have `setManualSpotlight(userId)` with a non-null id also force `setGridMode("spotlight")` (and restore the user's prior mode on clear), or make `gridLayoutMedia$` surface `spotlight` when a manual pin is active.
---
_Filed from the September 2026 audit (branch `lotus`)._
jared
added this to the EC fork audit 2026-09 · High milestone 2026-09-12 02:12:57 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: high · Type: bug · Confidence: high
Location:
src/state/CallViewModel/CallViewModel.ts:1076,src/state/CallViewModel/CallViewModel.ts:1214,src/lotus/lotusSpotlight.ts:56,src/lotus/lotusFocus.ts:36Problem
io.lotus.focus_participantonly feedsspotlight$, whichoverrideSpotlight$computes correctly — butspotlight$is rendered only in spotlight-family layouts. In the defaultwindowMode === "normal"+gridMode === "grid"path,gridLayoutMedia$passesspotlight: spotlight.some(vm => vm.type === "screen share") ? spotlight : undefined, so a pinned camera with no screenshare is discarded outright.createLayoutModeSwitchdefaults to"grid"(src/state/CallViewModel/LayoutSwitch.ts:57— spotlight only forhasRemoteScreenShares || windowMode === "flat"), and 1:1 calls go throughoneOnOneLandscapeLayoutMedia$, which ignoresspotlight$entirely. The action never forces a layout switch, and cinny'sfocusCameraParticipant(CallControl.ts:449) no longer clicks the spotlight toggle the way the old DOM hack did — its own docstring still claims it "switch[es] to spotlight mode if needed". Since cinny hides EC's control row (visibility: hidden, CallControl.ts:applyBodyMutation), the user cannot switch layout inside the iframe either.Cross-reference: LotusGuild/cinny#56 covers the missing unpin UI on the host; this issue is why the pin does nothing in grid layout in the first place.
How to trigger
2–8 person call, no screenshare, desktop width. Member glance → "Focus camera". Nothing visibly changes; the pin is stored but never rendered.
Suggested fix
have
setManualSpotlight(userId)with a non-null id also forcesetGridMode("spotlight")(and restore the user's prior mode on clear), or makegridLayoutMedia$surfacespotlightwhen a manual pin is active.Filed from the September 2026 audit (branch
lotus).