python-aidot-cameras 0.15.8__tar.gz → 0.17.0__tar.gz

{python_aidot_cameras-0.15.8/python_aidot_cameras.egg-info → python_aidot_cameras-0.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 0.15.8
+Version: 0.17.0
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT

{python_aidot_cameras-0.15.8 → python_aidot_cameras-0.17.0}/aidot_cameras/camera/client.py

@@ -376,6 +376,18 @@ _SERVE_REORDER_QUEUE = int(os.environ.get("AIDOT_SERVE_REORDER_QUEUE", "500"))
 #: failure this is meant to prevent.
 _SERVE_MAX_DELAY_US = int(os.environ.get("AIDOT_SERVE_MAX_DELAY_US", "500000"))
 
+#: How long to wait after a camera answers -50002 / -50015 ("no free session").
+#: Both loops used to wait _MAX_DELAY (300s) on the belief that the camera
+#: "releases slowly". Measured 2026-08-07 on an A001064: reopening 2s after a
+#: close is refused, 8s reopens cleanly, every time - and that was minting a
+#: fresh peerid each attempt, the case the old comment warned about. A camera
+#: that clears in seconds paired with a five-minute refusal to retry is
+#: indistinguishable from one that needs a long rest, which is the likeliest
+#: origin of this project's "battery cameras need 30-45 minutes" rule.
+#: Still a real wait: retrying instantly would hammer a camera that genuinely
+#: has none free, and on a battery model risks a wake-then-sleep loop.
+_BUSY_BACKOFF_S = float(os.environ.get("AIDOT_BUSY_BACKOFF_S", "20"))
+
 
 def _build_sdes_serve_cmd(
     *,
@@ -773,6 +785,39 @@ _KEEPALIVE_WINDOW_S = 25
 _KEEPALIVE_RENEW_S = 20
 
 
+def _ack_matches_seq(msg, seq):
+    """Is ``msg`` the device's answer to the command we sent as ``seq``?
+
+    ``True`` for our own 200, the integer response code for our own non-200,
+    and ``False`` for anything that is not attributable to us - another
+    command's ack, the battery wake response, a message with no seq at all.
+
+    Correlating matters because several messages are in flight on the same four
+    wildcard subscriptions: battery cameras get a ``lowPowerActiveStateReq``
+    published alongside the write, and Home Assistant writes attributes in
+    bursts. Accepting a stranger's 200 reports that one control landed on the
+    evidence of a different one landing.
+    """
+    if not isinstance(msg, dict) or seq is None:
+        return False
+    got = msg.get("seq")
+    if got is None:
+        return False
+    # We send a string; nothing obliges the camera to echo the same type.
+    if str(got) != str(seq):
+        return False
+    code = (msg.get("ack") or {}).get("code")
+    if code is None:
+        code = msg.get("code")
+    if code is None:
+        inner = msg.get("payload") or {}
+        if isinstance(inner, dict):
+            code = inner.get("code")
+    if code == 200:
+        return True
+    return code if isinstance(code, int) else False
+
+
 class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
     """All camera/streaming methods, mixed into DeviceClient via inheritance."""
 
@@ -1902,6 +1947,7 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
         *,
         timeout: float = 8.0,
         ack_keyword: str = "setDevAttr",
+        seq: "Optional[str]" = None,
     ) -> bool:
         """Connect MQTT, optionally wake battery camera, publish command, wait for ack.
 
@@ -1980,6 +2026,36 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                 duration=timeout,
             )
 
+        # Two passes, because being sure is worth more than being quick. A
+        # response carrying OUR seq is proof; anything else on these topics is
+        # only evidence that SOMETHING was acked - and several things are in
+        # flight here (the battery wake goes out alongside the write, and Home
+        # Assistant writes attributes in bursts).
+        for topic, raw in messages:
+            if ack_keyword and ack_keyword not in topic:
+                continue
+            try:
+                msg = _json.loads(raw)
+            except Exception:
+                continue
+            mine = _ack_matches_seq(msg, seq)
+            if mine is True:
+                _LOGGER.debug("device cmd ack 200 for seq=%s: topic=%s", seq, topic)
+                return True
+            if mine is not False:
+                # The camera answered OUR command with a non-200. Logged, not
+                # acted on: whether this firmware ever sends one is unknown, and
+                # turning it into a failure on a guess would report every
+                # working write as broken the moment the guess is wrong. If
+                # these show up in the wild, that is the evidence needed to make
+                # it a real error.
+                _LOGGER.warning(
+                    "device cmd for %s answered with code %s (seq=%s, topic=%s) "
+                    "- reporting the command as sent anyway; please report this "
+                    "log line, it is the evidence needed to handle it properly",
+                    device_id, mine, seq, topic,
+                )
+
         for topic, raw in messages:
             if ack_keyword and ack_keyword not in topic:
                 continue
@@ -1987,14 +2063,17 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                 msg = _json.loads(raw)
             except Exception:
                 continue
+            if _ack_matches_seq(msg, seq) is not False:
+                continue  # already considered above
             code = (msg.get("ack") or {}).get("code") or msg.get("code")
             if code == 200:
-                _LOGGER.debug("device cmd ack 200: topic=%s", topic)
+                _LOGGER.debug("device cmd ack 200 (unattributed): topic=%s", topic)
                 return True
             # Some firmware ACKs with code in payload.payload
             inner = msg.get("payload") or {}
             if isinstance(inner, dict) and inner.get("code") == 200:
-                _LOGGER.debug("device cmd ack 200 (inner): topic=%s", topic)
+                _LOGGER.debug(
+                    "device cmd ack 200 (inner, unattributed): topic=%s", topic)
                 return True
 
         # Fire-and-forget fallback: the official app uses a delivery callback,
@@ -2070,7 +2149,8 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
         pub_topic = f"iot/v1/c/{device_id}/device/setDevAttrReq"
         _LOGGER.info("setDevAttrReq: %s=%s -> %s  seq=%s", attr, value, device_id, seq)
         ok = await self._mqtt_device_cmd(
-            pub_topic, payload, timeout=timeout, ack_keyword="setDevAttr")
+            pub_topic, payload, timeout=timeout, ack_keyword="setDevAttr",
+            seq=seq)
         if ok:
             # Reflect the change in local status right away (optimistic), so HA
             # control entities show the new value immediately instead of waiting
@@ -3352,14 +3432,17 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                 # wake-then-sleep loop that serves nothing. Wait out the release
                 # window instead. (The DTLS loops have always done this; the SDES
                 # loop silently did not.)
+                #
+                # That release window is now measured rather than assumed: 8s is
+                # enough, 2s is not. See _BUSY_BACKOFF_S.
                 self._fast_attempt_override = None
                 _LOGGER.warning(
                     "SDES keepalive: camera %s refused the stream (%s) - "
                     "backing off %.0fs so its sessions can be released",
-                    self.device_id, busy, _MAX_DELAY,
+                    self.device_id, busy, _BUSY_BACKOFF_S,
                 )
                 try:
-                    await asyncio.sleep(_MAX_DELAY)
+                    await asyncio.sleep(_BUSY_BACKOFF_S)
                 except asyncio.CancelledError:
                     return
                 continue
@@ -3577,10 +3660,10 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                 # before trying again rather than hammering it.
                 _LOGGER.warning(
                     "Stream refused for %s (%s) - backing off %.0fs before retry",
-                    self.device_id, busy, _MAX_DELAY,
+                    self.device_id, busy, _BUSY_BACKOFF_S,
                 )
                 try:
-                    await asyncio.sleep(_MAX_DELAY)
+                    await asyncio.sleep(_BUSY_BACKOFF_S)
                 except asyncio.CancelledError:
                     return
                 continue

{python_aidot_cameras-0.15.8 → python_aidot_cameras-0.17.0}/aidot_cameras/camera/controls.py

@@ -13,6 +13,11 @@ from .constants import _PTZ_DIR_CODES, _STREAM_QUALITY, SETSTREAMCTRL_CMD
 
 _LOGGER = logging.getLogger(__name__)
 
+#: The camera's ack for SETSTREAMCTRL (800).
+SETSTREAMCTRL_RESP_CMD = 801
+#: Measured 0.01-0.03s; short so a control call never holds up a view.
+_SETSTREAMCTRL_ACK_S = 1.5
+
 
 class _CameraControlsMixin:
     """Device-control setters mixed into CameraMixin."""
@@ -166,12 +171,32 @@ class _CameraControlsMixin:
                 "resolution %s remembered; the camera is not streaming, so it "
                 "will be applied when a session next starts", quality)
             return True
-        ok = session._avio_cmd(SETSTREAMCTRL_CMD, payload)
-        _LOGGER.debug(
-            "set resolution %s (quality=%d) -> %s",
-            quality, q, "sent" if ok else "no channel yet",
+        # Ask, and read what comes back.  The camera acks with 801 in
+        # 0.01-0.03s (measured 2026-08-07 on an A000088) and reports the new
+        # value through GETSTREAMCTRL afterwards, so the command is genuinely
+        # accepted - it simply does not change the encode.
+        #
+        # The RETURN value deliberately still means "the command went out". An
+        # A001064 answers SPEAKERSTART but does not implement GETSTREAMCTRL at
+        # all, so how much a given firmware answers is model-dependent, and
+        # turning silence into a failure would break this call on exactly the
+        # quieter cameras. Reading the reply is what we could not do before; it
+        # makes a refusal visible instead of indistinguishable from success.
+        reply = await session.async_avio_request(
+            SETSTREAMCTRL_CMD, payload,
+            response_cmd=SETSTREAMCTRL_RESP_CMD, timeout=_SETSTREAMCTRL_ACK_S,
         )
-        return ok
+        if reply is None:
+            _LOGGER.debug(
+                "set resolution %s (quality=%d): sent, no ack within %.1fs",
+                quality, q, _SETSTREAMCTRL_ACK_S,
+            )
+        else:
+            _LOGGER.debug(
+                "set resolution %s (quality=%d): camera acked %d payload=%s",
+                quality, q, reply.command, reply.payload.hex() or "<empty>",
+            )
+        return True
 
     def _apply_pending_resolution(self) -> None:
         """Re-send the remembered resolution now that a session exists.

{python_aidot_cameras-0.15.8 → python_aidot_cameras-0.17.0}/aidot_cameras/camera/protocol.py

@@ -8,6 +8,7 @@ imports client.py -- the import edge is one-way (client -> protocol).
 """
 
 import asyncio
+import concurrent.futures as _cfutures
 import hashlib
 import ipaddress
 import json
@@ -22,7 +23,7 @@ import tempfile
 import threading
 import time
 import zlib
-from typing import Any, Callable, Optional
+from typing import Any, Callable, Optional, NamedTuple
 
 from .constants import TALK_PCM_FRAME_BYTES, TALK_PCM_RATE
 
@@ -2176,3 +2177,296 @@ def _dedup_bundle_candidates(sdp: str) -> str:
         else:
             result.extend(ln for ln in sec if not ln.startswith('a=candidate:'))
     return '\r\n'.join(result)
+
+
+#: Header of an AVIO control frame: seq, command, timestamp(ms), payload length,
+#: reserved, then 4 bytes of padding.  Same layout we already build when sending.
+_AVIO_RESP_HDR = struct.Struct("<IIqII4x")
+
+#: Bytes of header before an AVIO payload begins.  Exported because the SDES
+#: receive path has to walk past one frame to reach the next in the same chunk.
+AVIO_HDR_LEN = _AVIO_RESP_HDR.size
+
+
+class AvioResponse(NamedTuple):
+    """A decoded AVIO control response."""
+
+    seq: int
+    command: int
+    payload: bytes
+
+
+def parse_avio_response(frame: bytes) -> "Optional[AvioResponse]":
+    """Decode an AVIO control response, or None if this is not a valid one.
+
+    Returns None rather than raising: this runs on the bridge's receive path,
+    where anything can arrive, and a malformed frame must be ignored rather than
+    kill the loop. A declared length that overruns the buffer is rejected too -
+    trusting it would hand the caller a truncated payload and, for example, read
+    a stream profile out of bytes the camera never sent.
+    """
+    if not frame or len(frame) < _AVIO_RESP_HDR.size:
+        return None
+    seq, command, _ts, length, _reserved = _AVIO_RESP_HDR.unpack_from(frame, 0)
+    body = frame[_AVIO_RESP_HDR.size:]
+    if len(body) < length:
+        return None
+    return AvioResponse(seq=seq, command=command, payload=body[:length])
+
+
+class _AvioWaiter:
+    """A single outstanding question, handed back by ``AvioResponseRouter.expect``.
+
+    Built on a ``concurrent.futures.Future`` rather than an ``asyncio`` one on
+    purpose: the reply is dispatched from the SDES bridge thread while the
+    caller awaits on the event loop, and setting an asyncio future's result from
+    a foreign thread does not wake the awaiting coroutine - the camera would
+    look silent.
+    """
+
+    def __init__(self, router: "AvioResponseRouter", command: int) -> None:
+        self._router  = router
+        self._command = command
+        self._future  = _cfutures.Future()
+
+    def cancel(self) -> None:
+        """Withdraw the question - used when the command could not be sent."""
+        self._router._forget(self)
+
+    async def result(self, timeout: float) -> "Optional[AvioResponse]":
+        """The camera's reply, or None if it did not answer within ``timeout``.
+
+        None is a real answer, not an error: this firmware may not implement a
+        response for every command we send, and a control call must never block
+        a view while we find out.
+        """
+        if self._future.done():
+            # A wait that timed out cancels its own wrapper, and that
+            # cancellation can propagate down to this future - asking again
+            # would then raise where the first call returned None.
+            if self._future.cancelled():
+                return None
+            try:
+                return self._future.result()
+            except Exception:
+                return None
+        try:
+            return await asyncio.wait_for(
+                asyncio.wrap_future(self._future), timeout
+            )
+        except TimeoutError:
+            # Stop listening.  _avio_cmd runs on the keepalive path, so a
+            # registration left behind on every unanswered command would grow
+            # for as long as the session lives.
+            self._router._forget(self)
+            return None
+        except asyncio.CancelledError:
+            # Cancellation is the caller's task being stopped (entity teardown,
+            # config-entry unload), NOT the camera declining to answer.  Drop
+            # the registration, then let it through: swallowing it would leave
+            # the caller running inside a task the loop has already given up on.
+            self._router._forget(self)
+            raise
+
+
+class AvioResponseRouter:
+    """Match inbound AVIO responses to the commands that asked for them.
+
+    The control channel also carries traffic nobody asked for (session-mode
+    notifications, track switches), so "the next frame in" is not the answer to
+    the last question out.  Register interest with ``expect()`` *before* sending,
+    then await the waiter; ``dispatch()`` is safe to call from the bridge thread
+    and never raises or blocks it.
+    """
+
+    def __init__(self) -> None:
+        self._lock = threading.Lock()
+        self._waiting: "dict[int, list[_AvioWaiter]]" = {}
+
+    def expect(self, command: int) -> _AvioWaiter:
+        """Register interest in the next response carrying ``command``.
+
+        Call this before sending the request: the camera can answer before the
+        sender returns, and a registration made afterwards would miss the reply.
+        """
+        waiter = _AvioWaiter(self, command)
+        with self._lock:
+            self._waiting.setdefault(command, []).append(waiter)
+        return waiter
+
+    def dispatch(self, frame: bytes) -> bool:
+        """Hand ``frame`` to whoever is waiting for it.
+
+        True if it answered an outstanding question.  False - not an error - for
+        junk, for a command nobody asked about, and for a retransmitted copy of
+        a reply already delivered.
+        """
+        try:
+            resp = parse_avio_response(frame)
+            if resp is None:
+                return False
+            with self._lock:
+                queue = self._waiting.get(resp.command)
+                waiter = None
+                while queue:
+                    candidate = queue.pop(0)
+                    if not candidate._future.done():
+                        waiter = candidate
+                        break
+                if queue is not None and not queue:
+                    self._waiting.pop(resp.command, None)
+            if waiter is None:
+                return False
+            waiter._future.set_result(resp)
+            return True
+        except Exception:
+            # Runs inline on the bridge's receive path; a bad frame must never
+            # take the media loop down with it.
+            return False
+
+    def _forget(self, waiter: "_AvioWaiter") -> None:
+        with self._lock:
+            queue = self._waiting.get(waiter._command)
+            if not queue:
+                return
+            try:
+                queue.remove(waiter)
+            except ValueError:
+                return
+            if not queue:
+                self._waiting.pop(waiter._command, None)
+
+
+def _avio_cmd_id(frame: bytes) -> "Optional[int]":
+    """The command id of an AVIO frame, or None if it does not look like one.
+
+    For the receive-path logs.  Which ids this firmware actually sends is not
+    documented anywhere we trust - the list we work from was assembled from
+    frames seen on the wire - so naming them as they arrive is what turns the
+    next question into a log grep instead of another live session.
+    """
+    resp = parse_avio_response(bytes(frame))
+    return None if resp is None else resp.command
+
+
+#: How long a control call waits for the camera before reporting "no reply".
+#: Short on purpose: these run behind Home Assistant service calls, and a
+#: firmware that implements the request but not the response must not be able to
+#: hold up a view while we find that out.
+AVIO_RESPONSE_TIMEOUT_S = 2.0
+
+
+#: How long to wait for the camera's SPEAKERSTART ack before opening the mic
+#: anyway.  Measured 0.01-0.86s across both transports; this is generous enough
+#: to cover a slow SDES open without making a press-to-talk feel stuck.
+SPEAKER_ACK_TIMEOUT_S = 2.0
+
+#: Ack payloads observed for SPEAKERSTART, all of them on speakers that opened:
+#: 0x0064 (M3 Pro / DTLS, PTZ / SDES, and an L2) and 0x00c8 (the same L2, on the
+#: very next session). One camera returning both across consecutive successful
+#: opens is what settles it - the payload is not a verdict, so there is nothing
+#: here to read as a refusal.
+_SPEAKER_ACKS_SEEN = (b"\x00\x64", b"\x00\xc8")
+
+
+async def _speaker_opened(session, cmd: int, resp_cmd: int, timeout: float) -> bool:
+    """Send SPEAKERSTART and decide whether the camera opened its speaker.
+
+    Everything currently counts as success, and that is the honest position
+    rather than a placeholder. Silence does, because an A001064 answers 848 but
+    does not implement 802 at all - a firmware with no response for a command is
+    a real and common state, and failing on it would remove two-way audio from
+    every camera quieter than the one measured. And any ack does, because no
+    refusal has ever been observed: the payload varies across models AND across
+    consecutive sessions on one camera, so it carries no verdict to read.
+
+    An earlier version treated 0x0064 as "the" success value and any other
+    two-byte payload as a refusal. That was a discriminator invented from a
+    single sample, and it would have disabled talk outright on an L2, which
+    answers 0x00c8 about half the time. The payload is logged instead, so a
+    genuine refusal can be recognised from evidence when one appears.
+    """
+    waiter = session._avio_responses.expect(resp_cmd)
+    try:
+        sent = session._avio_cmd(cmd, b"\x00" * 8)
+    except Exception:
+        sent = False
+    if not sent:
+        waiter.cancel()
+        return True  # no channel to refuse on; unchanged from before
+    return await _speaker_ack_accepted(waiter, timeout)
+
+
+async def _speaker_ack_accepted(waiter, timeout: float) -> bool:
+    """Read a SPEAKERSTART ack, defaulting to acceptance on anything unfamiliar.
+
+    Shared by both transports because the decision is the same, even though the
+    send is not: on SDES the command leaves from the bridge thread and this only
+    ever waits.
+    """
+    reply = await waiter.result(timeout)
+    if reply is None:
+        _LOGGER.debug("SPEAKERSTART: no ack within %.1fs - treating as opened", timeout)
+        return True
+    if reply.payload not in _SPEAKER_ACKS_SEEN:
+        _LOGGER.info(
+            "SPEAKERSTART acked with an unrecorded payload %s - treating the "
+            "speaker as open. Please report this: the payloads seen so far all "
+            "belong to speakers that opened, so a genuine refusal has never "
+            "been identified and this may be the first",
+            reply.payload.hex() or "<empty>",
+        )
+    return True
+
+
+class AvioRequestMixin:
+    """Ask an AVIO command and wait for the camera's reply.
+
+    Mixed into both session types.  ``_avio_cmd`` itself is left exactly as it
+    was - fire-and-forget, synchronous, returns a bool - because every camera on
+    both transports goes through it, for the speaker, the keepalive heartbeat
+    and resolution alike.  Wanting an answer is opt-in and additive.
+
+    A session that mixes this in must create its router in ``__init__``:
+    dispatch arrives from the bridge thread and creating one lazily could race
+    with the event loop and lose the reply to a second router.
+    """
+
+    _avio_responses: "AvioResponseRouter"
+
+    def dispatch_avio_frame(self, frame: bytes) -> bool:
+        """Offer an inbound control frame to whoever is waiting for it.
+
+        Called from the transports' receive paths (the DTLS DataChannel message
+        handler, the SDES bridge thread).  False - not an error - when nothing
+        was waiting for it, which is the common case: the camera sends session
+        notifications and track switches nobody asked for.
+        """
+        return self._avio_responses.dispatch(frame)
+
+    async def async_avio_request(
+        self,
+        cmd: int,
+        payload: bytes = b"",
+        *,
+        response_cmd: int,
+        timeout: float = AVIO_RESPONSE_TIMEOUT_S,
+    ) -> "Optional[AvioResponse]":
+        """Send ``cmd`` and return the camera's ``response_cmd`` reply, or None.
+
+        None means the camera did not answer in time.  That is a real result,
+        not a failure: this firmware may implement a request without a response,
+        and no reply at all points at the channel rather than the firmware.
+        """
+        waiter = self._avio_responses.expect(response_cmd)
+        # Registered BEFORE the send: a camera on the LAN can answer before the
+        # sending call returns, and a reply that arrives with nobody listening
+        # would be reported as silence.
+        try:
+            sent = self._avio_cmd(cmd, payload)
+        except Exception:
+            sent = False
+        if not sent:
+            waiter.cancel()
+            return None
+        return await waiter.result(timeout)

{python_aidot_cameras-0.15.8 → python_aidot_cameras-0.17.0}/aidot_cameras/camera/sdes.py

@@ -9,12 +9,27 @@ import asyncio
 import logging
 from typing import Callable, Optional
 
-from .constants import SDES_TALK_PUMP_IDLE_TICK
+from .constants import SDES_SPEAKERSTART_DELAY, SDES_TALK_PUMP_IDLE_TICK
+from .protocol import (
+    SPEAKER_ACK_TIMEOUT_S,
+    AvioRequestMixin,
+    AvioResponseRouter,
+    _speaker_ack_accepted,
+)
 
 _LOGGER = logging.getLogger(__name__)
 
+#: The bridge does not send SPEAKERSTART the moment talk starts - it waits
+#: SDES_SPEAKERSTART_DELAY after the command channel is up, because a
+#: SPEAKERSTART sent too early is ignored and never acked.  The ack budget
+#: has to cover that delay as well as the round trip, or the wait expires
+#: before the command has even left and every press-to-talk pays the full
+#: timeout for no verdict.
+SDES_SPEAKER_ACK_TIMEOUT_S = SDES_SPEAKERSTART_DELAY + SPEAKER_ACK_TIMEOUT_S
 
-class SdesSession:
+
+
+class SdesSession(AvioRequestMixin):
     """Active SDES-SRTP stream session managed by an ffmpeg subprocess.
 
     Obtain via ``await DeviceClient.async_open_webrtc_stream(...)`` when the
@@ -39,6 +54,8 @@ class SdesSession:
         first_video_pt=None,
         first_audio_pt=None,
         device_id=None,
+        responses=None,
+        abort_chan=None,
     ) -> None:
         # Which camera this session belongs to, for logging only.  Optional so
         # an existing caller that does not pass it still works; the logs then
@@ -80,6 +97,17 @@ class SdesSession:
         # Mutable one-element list shared with the bridge thread.  Bridge sets
         # [0] to a callable(cmd, payload) once the SCTP channel is up.
         self._cmd_chan   = cmd_chan if cmd_chan is not None else [None]
+        # Matches inbound AVIO replies to the commands that asked for them.
+        # Created here, not lazily: the bridge thread dispatches into it.
+        self._avio_responses = (
+            responses if responses is not None else AvioResponseRouter()
+        )
+        # Mutable one-element list the bridge fills with a callable that sends
+        # an SCTP ABORT.  Unlike SPEAKERSTART this is safe to call from here:
+        # ABORT carries no TSN, so there is nothing for it to race, and it is
+        # the last thing the association ever sees.  None when the caller
+        # supplied no holder - teardown then behaves exactly as it did before.
+        self._abort_chan = abort_chan if abort_chan is not None else [None]
         # Shared talk state (dict) for outbound two-way audio, or None when the
         # session was not opened talk-capable (offer stayed recvonly).  Populated
         # by the bridge (camera audio addr) and by async_start_talk (provider).
@@ -131,13 +159,24 @@ class SdesSession:
         # SPEAKERSTART(848) is sent by the BRIDGE thread (not here) once the SCTP
         # command channel is up - all SCTP DATA must stay on one thread or the
         # command races the heartbeat's TSN and the camera drops it.
+        # Register interest BEFORE the pump starts, so the ack cannot arrive
+        # while nothing is listening.  Note this does NOT send 848 - the bridge
+        # thread does, once want_speaker is set.  Moving the send here would put
+        # SCTP DATA on a second thread, racing the heartbeat's TSN.
+        waiter = self._avio_responses.expect(851)
         if self._talk_thread is None or not self._talk_thread.is_alive():
             import threading
             self._talk_thread = threading.Thread(
                 target=_run_sdes_talk_pump, args=(self._talk_state,), daemon=True
             )
             self._talk_thread.start()
-        return True
+        if await _speaker_ack_accepted(waiter, SDES_SPEAKER_ACK_TIMEOUT_S):
+            return True
+        # The camera refused. Stop the microphone rather than stream viewer
+        # audio at a speaker that never opened.
+        self._talk_state["want_speaker"] = False
+        self._talk_state["provider"] = None
+        return False
 
     async def async_stop_talk(self) -> bool:
         """End two-way audio: close the camera speaker and stop sending audio."""
@@ -272,6 +311,23 @@ class SdesSession:
                 await asyncio.sleep(0.3)
             self._talk_state["stop"] = True
             self._talk_state["provider"] = None
+        # Close the SCTP association BEFORE anything else, while the bridge
+        # loop that sends it is still running - it dies with ffmpeg.  Measured
+        # 2026-08-07: reopening 2s after a close is refused with -50002 while 8s
+        # is fine, because the camera holds the session until it works out we
+        # have gone.  We were the only one of the three implementations that
+        # never said so; the official app disposes its data channel and our own
+        # DTLS path sends this same chunk.
+        _abort = self._abort_chan[0]
+        if _abort is not None:
+            try:
+                if _abort():
+                    _LOGGER.debug("camera %s: sent SCTP ABORT at teardown",
+                                  self._device_id)
+            except Exception:
+                # Never let closing politely stop us closing at all.
+                _LOGGER.debug("camera %s: swallowed exception in %s",
+                              self._device_id, 'stop', exc_info=True)
         # Flag this as a locally-initiated teardown BEFORE signalling ffmpeg, so
         # the bridge thread's observe loop never races a look at a stale False
         # if it polls the exit code immediately after terminate()/kill().