VAPI-4011 fix(v1): harden unpublish against races, unknown ids, and disconnect

[smoghe-bw]

Summary

Part of VAPI-4011. Fixes six bugs in the v1 unpublish path.

1. Race with an in-flight offer. unpublish removed transceivers outside publishMutex. offerPublishSdp sends the offer to the gateway before setLocalDescription, so a concurrent removal made the applied offer stale. Now transceiver cleanup runs under the mutex. publish() attach + negotiate also runs in one mutex section, which closes the race from the other side. The body of offerPublishSdp moves into negotiatePublishSdp, which does not lock.
2. An unknown id unpublished every stream. An empty resolved list meant "all". Now only a call with zero arguments means all. Unknown ids log a warning and do nothing.
3. Half-applied unpublish during an ICE blip. Local tracks still stop first. Then the SDK waits for the publish peer to reach connected (the gateway rejects offers before that) and negotiates. The wait runs outside publishMutex, so it does not block publish() or a gateway ICE-restart offer for up to 10 s. If that still fails, the SDK rejects with a BandwidthRtcError that says the stream was unpublished locally.
4. unpublish() after disconnect() threw a TypeError. Now it stops tracks locally and returns.
5. Unpublish during a reconnect could reopen the mic. republishStreams now skips streams that are no longer published and stops any tracks it reacquired for them.
6. AudioLevelDetector leaked an AudioContext and a setInterval per publish. Added an idempotent stop(). The detector is stored on PublishedStream and stopped on unpublish.

Notes

• Merges cleanly with VAPI-4011 fix(signaling): rebuild peer connections and re-publish media on signaling reconnect #18. The merged result passes tsc and all 123 tests.
• One existing test now spies on negotiatePublishSdp instead of offerPublishSdp, because publish() no longer goes through the locking wrapper.

Test plan

• npm test: 5 suites, 106 tests pass (10 new)
• npx tsc --noEmit clean
• Manual: publish → unpublish → publish during a call, confirm audio on the far end

🤖 Generated with Claude Code

[bwappsec]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.