diff --git a/src/lib.rs b/src/lib.rs
index 695c378c0..3e7435e57 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -464,13 +464,13 @@ pub fn init_log(_is_async: bool, _name: &str) -> Option<flexi_logger::LoggerHand
                         // much disk this uses. Bounding it here covers every call site at once.
                         Criterion::AgeOrSize(Age::Day, 16 * 1024 * 1024),
                         Naming::Timestamps,
-                        // Retention is a file count, so adding the size criterion also shortened
-                        // the history a flood can leave behind: the same actor that motivates the
-                        // size cap can now force rotations until every file predating its own
-                        // activity is cleaned up. Keep enough files that ~31 days survives even
-                        // when every one of them is a full 16 MiB — trading a bounded amount of
-                        // disk for not handing an attacker a log-erasure primitive.
-                        Cleanup::KeepLogFiles(31 * 8),
+                        // Unchanged at 31, which is ~31 days for any machine that stays under the
+                        // size criterion — i.e. every ordinary install, on every platform this
+                        // ships to. Raising it to protect the flood case would have bought little
+                        // (a count cannot outrun a flood; only the rate limits at the log sites
+                        // can) at the price of multiplying steady-state retention and disk for
+                        // everyone.
+                        Cleanup::KeepLogFiles(31),
                     )
                     .start()
                     .ok();
diff --git a/src/stream.rs b/src/stream.rs
index 8d8b3c47f..135dbaa99 100644
--- a/src/stream.rs
+++ b/src/stream.rs
@@ -90,11 +90,17 @@ impl Stream {
     /// A WebRTC pc is kept alive by the global session cache and its cleanup handler only fires on
     /// a terminal ICE state, so it must be closed explicitly at session end. TCP/WebSocket streams
     /// release their resources on drop and need nothing here.
+    ///
+    /// Deliberately not `async`: most callers sit in a `select!` arm or a future the UI can
+    /// abandon, and an awaited close that loses that race is unretryable — `close()` latches
+    /// `is_closed` before its first await, so every later attempt early-returns while the state
+    /// handler that would evict the session never runs. With no await point here there is
+    /// nothing to cancel; the teardown finishes on the runtime.
     #[inline]
-    pub async fn close_webrtc(&self) {
+    pub fn close_webrtc(&self) {
         match self {
             #[cfg(feature = "webrtc")]
-            Stream::WebRTC(s) => s.close().await,
+            Stream::WebRTC(s) => s.close_detached(),
             #[allow(unreachable_patterns)]
             _ => {}
         }
diff --git a/src/webrtc.rs b/src/webrtc.rs
index 7ddc12f9f..fdb7297be 100644
--- a/src/webrtc.rs
+++ b/src/webrtc.rs
@@ -928,18 +928,31 @@ impl WebRTCStream {
     /// `keep` carries anything whose lifetime must span the teardown rather than the caller's:
     /// the send path passes its logical-message permit, so no waiting clone can append to a
     /// partially-written fragment sequence while the close is still in flight.
-    fn close_detached_with<T: Send + 'static>(&self, keep: T) {
+    pub fn close_detached_with<T: Send + 'static>(&self, keep: T) {
         let pc = self.pc.clone();
-        tokio::spawn(async move {
-            let _keep = keep;
-            if let Err(err) = pc.close().await {
-                log::debug!("WebRTC background close failed: {}", err);
-            }
-        });
+        // Take the runtime handle explicitly rather than calling `tokio::spawn`: this also runs
+        // from `Drop` impls, which can execute during runtime teardown where a bare spawn panics.
+        // `Handle::spawn` can panic while the runtime is shutting down too, so catch it — a brief
+        // leak until process exit beats aborting the process from a destructor.
+        let Ok(handle) = tokio::runtime::Handle::try_current() else {
+            log::warn!("no tokio runtime available to close the WebRTC peer connection");
+            return;
+        };
+        let spawned = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            handle.spawn(async move {
+                let _keep = keep;
+                if let Err(err) = pc.close().await {
+                    log::debug!("WebRTC background close failed: {}", err);
+                }
+            });
+        }));
+        if spawned.is_err() {
+            log::warn!("failed to spawn the WebRTC close (runtime shutting down)");
+        }
     }
 
     #[inline]
-    fn close_detached(&self) {
+    pub fn close_detached(&self) {
         self.close_detached_with(());
     }
 
@@ -1041,8 +1054,8 @@ impl WebRTCStream {
             .await
             .map_err(|_| Error::new(ErrorKind::TimedOut, "WebRTC connect timeout"))??;
 
-            let deadline = Instant::now() + Duration::from_millis(send_timeout);
-            let send_permit = match timeout_at(deadline, send_gate.acquire_owned()).await {
+            let gate_deadline = Instant::now() + Duration::from_millis(send_timeout);
+            let send_permit = match timeout_at(gate_deadline, send_gate.acquire_owned()).await {
                 Ok(Ok(permit)) => permit,
                 Ok(Err(err)) => {
                     return Err(Error::new(
@@ -1059,7 +1072,13 @@ impl WebRTCStream {
                     return Err(Error::new(ErrorKind::TimedOut, "WebRTC send gate timeout").into());
                 }
             };
-            match timeout_at(deadline, self.send_bytes_inner(bytes)).await {
+            // Fresh budget once the permit is held: queueing behind another clone's message is
+            // not this message's progress, so charging it here meant a caller that only just lost
+            // the gate race got a few milliseconds to write in — and then tore the whole peer
+            // connection down for missing them. The narrower the miss, the more certain the
+            // teardown, which is precisely backwards.
+            let write_deadline = Instant::now() + Duration::from_millis(send_timeout);
+            match timeout_at(write_deadline, self.send_bytes_inner(bytes)).await {
                 Ok(res) => res,
                 Err(_) => {
                     // Hand the logical-message permit to the teardown so no waiting clone can