call ready before starting the goroutine that calls ended

[erikhortsch]

Stacked on #491. Review that first; this branch is one file.

The defect

createStream hands the caller ready and ended as a pair with no ordering between them. ready was deferred, so it ran on the way out of the goroutine that launches the one calling ended:

go func() {
    if ready != nil {
        defer func() { stats := ready(mimeTypes, err) }()   // runs last
    }
    mimeTypes, err = h.Start(ctx)
    ...
    go func() {                                            // launched first
        defer func() { ended(err) }()
        err = h.WaitForSessionEnd(s.ctx)
    }()
}()

For a bypassed WHIP session that is already over, WaitForSessionEnd selects on an already-broken done and returns without blocking. Init registers the RTC notify topic before it returns, so the SFU can break done at any point after the SDP exchange — a publisher whose connection fails during the handshake, a client that hangs up on the answer, an immediate resource delete.

This is not a narrow scheduling window. ready's second statement is SendStateUpdate, a psrpc round trip, so ready parks about two statements in and hands its P to the goroutine sitting in runnext. ended then runs to completion in the middle of it:

ready:  SetStatus(PUBLISHING) -> SendStateUpdate --park---------------+
ended:                          SetStatus(INACTIVE) -> SendStateUpdate|
                                SessionEnded -> IngressEnded          |
ready:  <-------------------------------------------------------------+
        IngressStarted -> SessionStarted     <- registers a dead session

Three consequences: the terminal state is overwritten by PUBLISHING (SetStatus has no terminal guard, last write wins); the notifier is told a released session started; and IngressStarted lands after IngressEnded, leaving an entry in the session manager that nothing removes, so IsIdle never comes true and shutdown does not complete.

Only bypassed WHIP is affected — ended is non-nil only under !*p.EnableTranscoding. Every other input registers synchronously inside ready and is handed a nil ended.

The fix

Call ready inline, before the goroutine that calls ended exists. There was exactly one return between the defer and the go, so the restructure is mechanical: the deferred body becomes straight-line code and the error branch keeps its own return.

No synchronization primitive. A sync.Once would force ended to synthesize a ready(nil, err) it has no arguments for, which rewrites a clean short session's terminal state to ENDPOINT_ERROR; a channel barrier works but deadlocks if ready is ever nil, since the close sits under the same if.

The only thing lost is panic-unwinding coverage, which was not real — nothing recovers here, so the process dies either way.

Verification

go build ./..., go vet ./pkg/..., go test -count=1 ./pkg/... — 8 packages, all pass.

Not covered by a test: createStream reaches the race only through a live SFU HTTP exchange in Init and a psrpc-backed notifier, neither of which has a seam here.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.