A sound implementation does not ask users to refresh until it works. Each phase has an input, an output, a timeout, and a terminal state. The user can stop capture from browser chrome or by closing the source. Track ended is the final fact, and its handler must idempotently notify, detach, and release.
Browser capability depends on version, permission, visibility, and device policy. Use capability detection and an explained fallback instead of treating one development machine as the product contract.
Define the system contract first
This capability crosses clients, networks, and servers, so a local optimization can create a system failure. Decisions must constrain both endpoints, persisted truth, and operating budgets together.
- Give every capture a share session ID so an ended callback closes only its own session.
- Persist terminal state, replaceTrack(null), stop all tracks, and then notify viewers.
- A new source gets a new version so late ended from the old track cannot stop it.
Track and session together define termination. Every stop path enters one idempotent cleanup routine fenced from new capture.
What can break that contract
Boundaries turn hidden assumptions into incidents. Weak networks, refresh, concurrency, and capacity need combined coverage because retries can hide each one in isolation.
- Only the app button is handled, leaving sender UI active after browser-level stop.
- One global ended handler lets an audio track terminate a healthy video share.
- Viewer refresh lacks session reconciliation, leaving the sender encoding for nobody.
How to test the contract line by line
A release gate combines deterministic regression, randomized timing, and real browser pairs. Preserve the seed and state trace from every failure as a permanent replay case.
- Stop from app, browser chrome, source closure, and permission revocation.
- Switch sources twice and delay the old ended event; the new session must remain.
- Refresh, disconnect, and leave as viewer while checking count, tracks, and sender state.
Completion is not one passing path. Every terminal state reconciles, automation stays below user intent, and every operational cost has an explicit ceiling.