overrideSpotlight$ resolves the pin with mediaItems.find(m => m.userId === manualUserId). A participant joined from two devices has two UserMediaViewModels with the same userId, and find deterministically takes the first in userMedia$ order — which may be the idle/muted device. This is avoidable: io.lotus.call_state already sends the stable per-device media id (${userId}:${deviceId}) to the host, so the host has everything needed to pin precisely, but focus_participant's payload only carries userId.
How to trigger
join a call from phone and desktop with the same account, have another user pin you.
Suggested fix
accept an optional id (media id) in the focus_participant payload and prefer it over the userId match; fall back to the currently-speaking device when only a userId is given.
Filed from the September 2026 audit (branch lotus).
**Severity:** low · **Type:** bug · **Confidence:** high
**Location:** `src/lotus/lotusSpotlight.ts:56-64,79-82`, `src/lotus/lotusCallState.ts:16-24`
### Problem
`overrideSpotlight$` resolves the pin with `mediaItems.find(m => m.userId === manualUserId)`. A participant joined from two devices has two `UserMediaViewModel`s with the same `userId`, and `find` deterministically takes the first in `userMedia$` order — which may be the idle/muted device. This is avoidable: `io.lotus.call_state` already sends the stable per-device media `id` (`${userId}:${deviceId}`) to the host, so the host has everything needed to pin precisely, but `focus_participant`'s payload only carries `userId`.
### How to trigger
join a call from phone and desktop with the same account, have another user pin you.
### Suggested fix
accept an optional `id` (media id) in the `focus_participant` payload and prefer it over the `userId` match; fall back to the currently-speaking device when only a userId is given.
---
_Filed from the September 2026 audit (branch `lotus`)._
jared
added this to the EC fork audit 2026-09 · Medium & Low milestone 2026-09-12 02:13:13 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: low · Type: bug · Confidence: high
Location:
src/lotus/lotusSpotlight.ts:56-64,79-82,src/lotus/lotusCallState.ts:16-24Problem
overrideSpotlight$resolves the pin withmediaItems.find(m => m.userId === manualUserId). A participant joined from two devices has twoUserMediaViewModels with the sameuserId, andfinddeterministically takes the first inuserMedia$order — which may be the idle/muted device. This is avoidable:io.lotus.call_statealready sends the stable per-device mediaid(${userId}:${deviceId}) to the host, so the host has everything needed to pin precisely, butfocus_participant's payload only carriesuserId.How to trigger
join a call from phone and desktop with the same account, have another user pin you.
Suggested fix
accept an optional
id(media id) in thefocus_participantpayload and prefer it over theuserIdmatch; fall back to the currently-speaking device when only a userId is given.Filed from the September 2026 audit (branch
lotus).