python-aidot-cameras 0.16.0__tar.gz → 0.17.1__tar.gz

{python_aidot_cameras-0.16.0/python_aidot_cameras.egg-info → python_aidot_cameras-0.17.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 0.16.0
+Version: 0.17.1
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT

{python_aidot_cameras-0.16.0 → python_aidot_cameras-0.17.1}/aidot_cameras/camera/client.py

@@ -376,6 +376,44 @@ _SERVE_REORDER_QUEUE = int(os.environ.get("AIDOT_SERVE_REORDER_QUEUE", "500"))
 #: failure this is meant to prevent.
 _SERVE_MAX_DELAY_US = int(os.environ.get("AIDOT_SERVE_MAX_DELAY_US", "500000"))
 
+#: How long to wait after a camera answers -50002 / -50015 ("no free session").
+#: Both loops used to wait _MAX_DELAY (300s) on the belief that the camera
+#: "releases slowly". Measured 2026-08-07 on an A001064: reopening 2s after a
+#: close is refused, 8s reopens cleanly, every time - and that was minting a
+#: fresh peerid each attempt, the case the old comment warned about. A camera
+#: that clears in seconds paired with a five-minute refusal to retry is
+#: indistinguishable from one that needs a long rest, which is the likeliest
+#: origin of this project's "battery cameras need 30-45 minutes" rule.
+#: Still a real wait: retrying instantly would hammer a camera that genuinely
+#: has none free, and on a battery model risks a wake-then-sleep loop.
+_BUSY_BACKOFF_S = float(os.environ.get("AIDOT_BUSY_BACKOFF_S", "20"))
+
+#: Consecutive background sessions that deliver NO media before the keepalive
+#: stops reopening a battery camera. Observed 2026-08-07 on an A001513: 22 opens
+#: across ~8 hours, none of them delivering media, because the loop escalated
+#: its backoff but had no condition under which it ever stopped. On a mains
+#: camera that is wasteful; on a battery one it spends charge, and a unit has
+#: already been drained to 5% that way.
+#: 0 disables the ceiling entirely.
+_FUTILE_KEEPALIVE_LIMIT = int(os.environ.get("AIDOT_FUTILE_KEEPALIVE_LIMIT", "5"))
+
+
+def _should_abandon_keepalive(no_media_streak: int, *, is_battery: bool,
+                              limit: int = _FUTILE_KEEPALIVE_LIMIT) -> bool:
+    """Should the background keepalive stop reopening this camera?
+
+    Only for battery cameras. A mains camera has no charge to protect, and the
+    same persistence is what recovers a stream after a router reboot or a
+    power-cycle - there the loop is the feature.
+
+    Scoped to the BACKGROUND loop. A view still opens a session on demand: the
+    user asking to see the camera is new information, and a retry ceiling should
+    not decide on their behalf that it cannot work.
+    """
+    if not is_battery or limit <= 0:
+        return False
+    return no_media_streak >= limit
+
 
 def _build_sdes_serve_cmd(
     *,
@@ -773,6 +811,39 @@ _KEEPALIVE_WINDOW_S = 25
 _KEEPALIVE_RENEW_S = 20
 
 
+def _ack_matches_seq(msg, seq):
+    """Is ``msg`` the device's answer to the command we sent as ``seq``?
+
+    ``True`` for our own 200, the integer response code for our own non-200,
+    and ``False`` for anything that is not attributable to us - another
+    command's ack, the battery wake response, a message with no seq at all.
+
+    Correlating matters because several messages are in flight on the same four
+    wildcard subscriptions: battery cameras get a ``lowPowerActiveStateReq``
+    published alongside the write, and Home Assistant writes attributes in
+    bursts. Accepting a stranger's 200 reports that one control landed on the
+    evidence of a different one landing.
+    """
+    if not isinstance(msg, dict) or seq is None:
+        return False
+    got = msg.get("seq")
+    if got is None:
+        return False
+    # We send a string; nothing obliges the camera to echo the same type.
+    if str(got) != str(seq):
+        return False
+    code = (msg.get("ack") or {}).get("code")
+    if code is None:
+        code = msg.get("code")
+    if code is None:
+        inner = msg.get("payload") or {}
+        if isinstance(inner, dict):
+            code = inner.get("code")
+    if code == 200:
+        return True
+    return code if isinstance(code, int) else False
+
+
 class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
     """All camera/streaming methods, mixed into DeviceClient via inheritance."""
 
@@ -1902,6 +1973,7 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
         *,
         timeout: float = 8.0,
         ack_keyword: str = "setDevAttr",
+        seq: "Optional[str]" = None,
     ) -> bool:
         """Connect MQTT, optionally wake battery camera, publish command, wait for ack.
 
@@ -1980,6 +2052,36 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                 duration=timeout,
             )
 
+        # Two passes, because being sure is worth more than being quick. A
+        # response carrying OUR seq is proof; anything else on these topics is
+        # only evidence that SOMETHING was acked - and several things are in
+        # flight here (the battery wake goes out alongside the write, and Home
+        # Assistant writes attributes in bursts).
+        for topic, raw in messages:
+            if ack_keyword and ack_keyword not in topic:
+                continue
+            try:
+                msg = _json.loads(raw)
+            except Exception:
+                continue
+            mine = _ack_matches_seq(msg, seq)
+            if mine is True:
+                _LOGGER.debug("device cmd ack 200 for seq=%s: topic=%s", seq, topic)
+                return True
+            if mine is not False:
+                # The camera answered OUR command with a non-200. Logged, not
+                # acted on: whether this firmware ever sends one is unknown, and
+                # turning it into a failure on a guess would report every
+                # working write as broken the moment the guess is wrong. If
+                # these show up in the wild, that is the evidence needed to make
+                # it a real error.
+                _LOGGER.warning(
+                    "device cmd for %s answered with code %s (seq=%s, topic=%s) "
+                    "- reporting the command as sent anyway; please report this "
+                    "log line, it is the evidence needed to handle it properly",
+                    device_id, mine, seq, topic,
+                )
+
         for topic, raw in messages:
             if ack_keyword and ack_keyword not in topic:
                 continue
@@ -1987,14 +2089,17 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                 msg = _json.loads(raw)
             except Exception:
                 continue
+            if _ack_matches_seq(msg, seq) is not False:
+                continue  # already considered above
             code = (msg.get("ack") or {}).get("code") or msg.get("code")
             if code == 200:
-                _LOGGER.debug("device cmd ack 200: topic=%s", topic)
+                _LOGGER.debug("device cmd ack 200 (unattributed): topic=%s", topic)
                 return True
             # Some firmware ACKs with code in payload.payload
             inner = msg.get("payload") or {}
             if isinstance(inner, dict) and inner.get("code") == 200:
-                _LOGGER.debug("device cmd ack 200 (inner): topic=%s", topic)
+                _LOGGER.debug(
+                    "device cmd ack 200 (inner, unattributed): topic=%s", topic)
                 return True
 
         # Fire-and-forget fallback: the official app uses a delivery callback,
@@ -2070,7 +2175,8 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
         pub_topic = f"iot/v1/c/{device_id}/device/setDevAttrReq"
         _LOGGER.info("setDevAttrReq: %s=%s -> %s  seq=%s", attr, value, device_id, seq)
         ok = await self._mqtt_device_cmd(
-            pub_topic, payload, timeout=timeout, ack_keyword="setDevAttr")
+            pub_topic, payload, timeout=timeout, ack_keyword="setDevAttr",
+            seq=seq)
         if ok:
             # Reflect the change in local status right away (optimistic), so HA
             # control entities show the new value immediately instead of waiting
@@ -3277,6 +3383,7 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
         # camera (or a fleet reconnecting at once) isn't hammered into further
         # degradation / cloud rate-limiting; resets after a session that delivered
         # media (see end of loop).
+        _no_media_streak = 0
         _pacer = ReconnectPacer(_MIN_DELAY, _MAX_DELAY)
 
         # Adaptive fast-with-fallback (default on): the first open tries the fast
@@ -3352,14 +3459,17 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                 # wake-then-sleep loop that serves nothing. Wait out the release
                 # window instead. (The DTLS loops have always done this; the SDES
                 # loop silently did not.)
+                #
+                # That release window is now measured rather than assumed: 8s is
+                # enough, 2s is not. See _BUSY_BACKOFF_S.
                 self._fast_attempt_override = None
                 _LOGGER.warning(
                     "SDES keepalive: camera %s refused the stream (%s) - "
                     "backing off %.0fs so its sessions can be released",
-                    self.device_id, busy, _MAX_DELAY,
+                    self.device_id, busy, _BUSY_BACKOFF_S,
                 )
                 try:
-                    await asyncio.sleep(_MAX_DELAY)
+                    await asyncio.sleep(_BUSY_BACKOFF_S)
                 except asyncio.CancelledError:
                     return
                 continue
@@ -3496,6 +3606,23 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                 _loop_peer_id = self.generate_webrtc_peer_id(
                     live_type=2, stream_id=0, sdes=True)
                 _peer_reuses = 0
+                _no_media_streak = 0
+            else:
+                _no_media_streak += 1
+                if _should_abandon_keepalive(
+                        _no_media_streak, is_battery=self.is_battery_camera):
+                    # Every open so far has cost the camera a wake and returned
+                    # nothing. Continuing spends charge to learn the same thing
+                    # again; a view will still open a session on demand.
+                    _LOGGER.warning(
+                        "camera %s: %d consecutive keepalive sessions delivered no "
+                        "media - stopping the background keepalive to stop waking "
+                        "it. A live view will still open a session; set "
+                        "AIDOT_FUTILE_KEEPALIVE_LIMIT=0 to keep retrying.",
+                        self.device_id, _no_media_streak,
+                    )
+                    self._streaming_active = False
+                    return
             if _use_fast and not _healthy and not _fast_failed:
                 _LOGGER.info(
                     "SDES adaptive[%s]: fast attempt delivered no media - "
@@ -3577,10 +3704,10 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                 # before trying again rather than hammering it.
                 _LOGGER.warning(
                     "Stream refused for %s (%s) - backing off %.0fs before retry",
-                    self.device_id, busy, _MAX_DELAY,
+                    self.device_id, busy, _BUSY_BACKOFF_S,
                 )
                 try:
-                    await asyncio.sleep(_MAX_DELAY)
+                    await asyncio.sleep(_BUSY_BACKOFF_S)
                 except asyncio.CancelledError:
                     return
                 continue

{python_aidot_cameras-0.16.0 → python_aidot_cameras-0.17.1}/aidot_cameras/camera/constants.py

@@ -131,9 +131,13 @@ _PTZ_DIR_CODES: dict = {
     "zoom_in": 23, "zoom_out": 24,
 }
 
-# Live-stream resolution (AVIOCTRL_QUALITY_*).  The official app's HD/SD toggle
-# switches between MAX(1) and MIDDLE(5) (f0.java g3() / LiveFragment d6); we
-# mirror those two.  Sent as SETSTREAMCTRL (cmd 800) over the active session,
+# Live-stream resolution (AVIOCTRL_QUALITY_*).  The official app's picker has
+# THREE arms, not two: MAX(1), MIDDLE(5), and 0x10 = 16, whose label is
+# _auto_resulution (HorLiveController.smali:629-631).  16 is deliberately absent
+# here: it is outside AVIOCTRL_QUALITY, and measured 2026-08-07 it behaves like
+# every other value - acked, and the encode unchanged in that session and the
+# next.  Adding it would offer a control that does nothing.  The two arms below
+# are the ones with enum names, kept for parity with the command the app sends.  Sent as SETSTREAMCTRL (cmd 800) over the active session,
 # payload <IB3x> = channel(0) + quality byte (SMsgAVIoctrlSetStreamCtrlReq).
 SETSTREAMCTRL_CMD = 800
 GETSTREAMCTRL_CMD = 802

{python_aidot_cameras-0.16.0 → python_aidot_cameras-0.17.1}/aidot_cameras/camera/controls.py

@@ -13,6 +13,11 @@ from .constants import _PTZ_DIR_CODES, _STREAM_QUALITY, SETSTREAMCTRL_CMD
 
 _LOGGER = logging.getLogger(__name__)
 
+#: The camera's ack for SETSTREAMCTRL (800).
+SETSTREAMCTRL_RESP_CMD = 801
+#: Measured 0.01-0.03s; short so a control call never holds up a view.
+_SETSTREAMCTRL_ACK_S = 1.5
+
 
 class _CameraControlsMixin:
     """Device-control setters mixed into CameraMixin."""
@@ -166,12 +171,40 @@ class _CameraControlsMixin:
                 "resolution %s remembered; the camera is not streaming, so it "
                 "will be applied when a session next starts", quality)
             return True
-        ok = session._avio_cmd(SETSTREAMCTRL_CMD, payload)
-        _LOGGER.debug(
-            "set resolution %s (quality=%d) -> %s",
-            quality, q, "sent" if ok else "no channel yet",
+        # Ask, and read what comes back.  The camera acks with 801 in
+        # 0.01-0.19s and reports the new value through GETSTREAMCTRL afterwards
+        # (where it implements 802), so the command is genuinely accepted - it
+        # simply does not change the encode.
+        #
+        # Settled 2026-08-07 across both transports and every value the enum
+        # defines, not just hd/sd: an A001064 was swept over all six
+        # AVIOCTRL_QUALITY values, each followed by a session that sent nothing
+        # to catch a setting that applies only to the NEXT session. Twelve
+        # sessions, twelve times h264 1280x720, no dimension change in any of
+        # them. Four of those values had never been sent to any camera here.
+        # See docs/APP-PARITY-STATUS.md for the table.
+        #
+        # The RETURN value deliberately still means "the command went out". An
+        # A001064 answers SPEAKERSTART but does not implement GETSTREAMCTRL at
+        # all, so how much a given firmware answers is model-dependent, and
+        # turning silence into a failure would break this call on exactly the
+        # quieter cameras. Reading the reply is what we could not do before; it
+        # makes a refusal visible instead of indistinguishable from success.
+        reply = await session.async_avio_request(
+            SETSTREAMCTRL_CMD, payload,
+            response_cmd=SETSTREAMCTRL_RESP_CMD, timeout=_SETSTREAMCTRL_ACK_S,
         )
-        return ok
+        if reply is None:
+            _LOGGER.debug(
+                "set resolution %s (quality=%d): sent, no ack within %.1fs",
+                quality, q, _SETSTREAMCTRL_ACK_S,
+            )
+        else:
+            _LOGGER.debug(
+                "set resolution %s (quality=%d): camera acked %d payload=%s",
+                quality, q, reply.command, reply.payload.hex() or "<empty>",
+            )
+        return True
 
     def _apply_pending_resolution(self) -> None:
         """Re-send the remembered resolution now that a session exists.

{python_aidot_cameras-0.16.0 → python_aidot_cameras-0.17.1}/aidot_cameras/camera/protocol.py

@@ -235,6 +235,14 @@ def _parse_alarm_event(msg: dict):
     return {"device_id": dev, "type": kind, "alarm_type": code}
 
 
+def _section_of(lines: list) -> str:
+    """The m-section the given emitted lines currently end inside, or ""."""
+    for ln in reversed(lines):
+        if ln.startswith("m="):
+            return ln.split(" ")[0]
+    return ""
+
+
 def _compress_sdp_for_camera(sdp: str) -> str:
     """Selective SDP filter matching official Java client's g.b() behaviour.
 
@@ -258,6 +266,14 @@ def _compress_sdp_for_camera(sdp: str) -> str:
     seen: dict = {}
     media_type = ""
     before_m = True
+    # Payload types that survived narrowing. rtcp-fb is kept for these and only
+    # these: feedback describing a codec we dropped is bytes spent on something
+    # that will never be sent, in an offer whose size is why this function
+    # exists.
+    _kept_pts: set = set()
+    # rtcp-fb lines are buffered because they can appear before the rtpmap that
+    # decides whether their payload type survives.
+    _fb_lines: list = []
 
     def keep(ln: str, key: str = "") -> None:
         out.append(ln + "\r\n")
@@ -283,6 +299,11 @@ def _compress_sdp_for_camera(sdp: str) -> str:
         if ln.startswith("a=mid:"):
             keep(ln)
             continue
+        if ln.startswith("a=rtcp-fb:"):
+            # Buffered, not decided here: an rtcp-fb line can precede the
+            # rtpmap that determines whether its payload type survives.
+            _fb_lines.append((media_type, ln))
+            continue
         if ln.startswith("a=ssrc") and "cname" in ln:
             if seen.get(f"ssrc-cname-{media_type}") is None:
                 keep(ln, f"ssrc-cname-{media_type}")
@@ -303,17 +324,26 @@ def _compress_sdp_for_camera(sdp: str) -> str:
             if media_type == "m=audio":
                 if any(c in ln for c in ("opus", "PCMU", "PCMA", "AAC")):
                     keep(ln)
+                    # Remember the payload type so its rtcp-fb can be kept too.
+                    if ln.startswith("a=rtpmap:"):
+                        try:
+                            _kept_pts.add(ln.split(":")[1].split(" ")[0])
+                        except Exception:
+                            _LOGGER.debug("swallowed exception in %s", 'keep',
+                                          exc_info=True)
             elif media_type == "m=video":
                 if "H264/90000" in ln and seen.get("H264/90000") is None:
                     keep(ln, "H264/90000")
                     try:
                         seen["H264/90000_pt"] = ln.split(":")[1].split(" ")[0]
+                        _kept_pts.add(seen["H264/90000_pt"])
                     except Exception:
                         _LOGGER.debug("swallowed exception in %s", 'keep', exc_info=True)
                 elif "H265/90000" in ln and seen.get("H265/90000") is None:
                     keep(ln, "H265/90000")
                     try:
                         seen["H265/90000_pt"] = ln.split(":")[1].split(" ")[0]
+                        _kept_pts.add(seen["H265/90000_pt"])
                     except Exception:
                         _LOGGER.debug("swallowed exception in %s", 'keep', exc_info=True)
                 elif "apt=" in ln:
@@ -332,6 +362,22 @@ def _compress_sdp_for_camera(sdp: str) -> str:
             elif media_type == "m=application":
                 if "sctp-port" in ln:
                     keep(ln)
+    # Re-insert the surviving feedback at the end of its own media section, so
+    # the offer stays well-formed. Kept only for payload types that survived
+    # narrowing - see _kept_pts.
+    if _fb_lines:
+        kept_fb = [(mt, ln) for mt, ln in _fb_lines
+                   if ln.split(":", 1)[1].split(" ")[0] in _kept_pts]
+        if kept_fb:
+            rebuilt: list = []
+            for line in out:
+                if line.startswith("m=") and rebuilt:
+                    prev = _section_of(rebuilt)
+                    rebuilt.extend(l + "\r\n" for mt, l in kept_fb if mt == prev)
+                rebuilt.append(line)
+            prev = _section_of(rebuilt)
+            rebuilt.extend(l + "\r\n" for mt, l in kept_fb if mt == prev)
+            out = rebuilt
     return "".join(out)
 
 
@@ -2337,6 +2383,87 @@ class AvioResponseRouter:
                 self._waiting.pop(waiter._command, None)
 
 
+#: What we ask the camera to send, in bits per second. Zero disables sending
+#: REMB at all, which is the default.
+#:
+#: OFF by default because it was measured and did not work. An A001064 was A/B'd
+#: with REMB transmitting at 500 Kbps and correctly naming the video SSRC -
+#: receipts per session, interleaved arms against a control - and its bitrate
+#: did not fall. The one clean like-for-like pair had the REMB arm HIGHER than
+#: its control (3859 vs 3355 Kbps). No effect was demonstrated on the only model
+#: tested.
+#:
+#: That alone would argue for opt-in. The stronger argument is the models NOT
+#: tested: an A000088 or A001513 that does honour REMB would have had its
+#: picture capped at 500 Kbps fleet-wide, by default, on the strength of a
+#: measurement taken elsewhere that showed no benefit. Shipping a bitrate cap
+#: enabled by default, validated on one camera that ignores it, risks degrading
+#: precisely the cameras nobody measured.
+#:
+#: The negotiation, the encoder and the decoder are all kept and tested: the
+#: camera does advertise goog-remb in its answer, so this is a working
+#: instrument for anyone who wants to measure their own hardware. Set
+#: AIDOT_REMB_TARGET_BPS to a bitrate to turn it on.
+REMB_TARGET_BPS = int(os.environ.get("AIDOT_REMB_TARGET_BPS", "0"))
+
+
+def build_remb(sender_ssrc: int, media_ssrcs: "list", bitrate_bps: int) -> bytes:
+    """An RTCP REMB packet asking the sender for at most ``bitrate_bps``.
+
+    Format is the Google draft (draft-alvestrand-rmcat-remb) carried as a
+    Payload-Specific Feedback message: FMT 15, PT 206, the ASCII identifier
+    ``REMB``, then a count of SSRCs and the bitrate as a 6-bit exponent with an
+    18-bit mantissa, then the SSRCs themselves.
+
+    The camera negotiates ``goog-remb`` in its answer (confirmed live on an
+    A001064 over SDES), which means it will accept this. It has no effect until
+    one is actually sent - negotiation alone changes nothing, which is why this
+    is a separate step from keeping the attribute in the offer.
+    """
+    if bitrate_bps <= 0:
+        raise ValueError("REMB bitrate must be positive - zero would ask the "
+                         "camera to stop sending entirely")
+    if not media_ssrcs:
+        raise ValueError("REMB must name at least one stream")
+
+    # 18-bit mantissa, 6-bit exponent: shift right until the value fits.
+    exp = 0
+    mantissa = int(bitrate_bps)
+    while mantissa > 0x3FFFF:
+        mantissa >>= 1
+        exp += 1
+        if exp > 63:
+            raise ValueError("REMB bitrate too large to encode")
+
+    header = struct.pack(
+        "!BBH",
+        0x80 | 15,          # V=2, P=0, FMT=15
+        206,                # PT: payload-specific feedback
+        0,                  # length, filled in below
+    )
+    body = (struct.pack("!II", sender_ssrc & 0xFFFFFFFF, 0)
+            + b"REMB"
+            + struct.pack("!BBBB",
+                          len(media_ssrcs) & 0xFF,
+                          ((exp << 2) | (mantissa >> 16)) & 0xFF,
+                          (mantissa >> 8) & 0xFF,
+                          mantissa & 0xFF)
+            + b"".join(struct.pack("!I", s & 0xFFFFFFFF) for s in media_ssrcs))
+    pkt = header + body
+    # RTCP length is in 32-bit words, minus one.
+    return pkt[:2] + struct.pack("!H", len(pkt) // 4 - 1) + pkt[4:]
+
+
+def decode_remb_bitrate(pkt: bytes) -> int:
+    """The bitrate a REMB packet asks for. For tests and diagnostics."""
+    # Layout: 0-3 header, 4-7 sender SSRC, 8-11 media SSRC, 12-15 "REMB",
+    # 16 num-SSRC, 17-19 exponent+mantissa, 20+ the SSRCs.
+    b = pkt[17]
+    exp = b >> 2
+    mantissa = ((b & 0x03) << 16) | (pkt[18] << 8) | pkt[19]
+    return mantissa << exp
+
+
 def _avio_cmd_id(frame: bytes) -> "Optional[int]":
     """The command id of an AVIO frame, or None if it does not look like one.
 
@@ -2356,6 +2483,69 @@ def _avio_cmd_id(frame: bytes) -> "Optional[int]":
 AVIO_RESPONSE_TIMEOUT_S = 2.0
 
 
+#: How long to wait for the camera's SPEAKERSTART ack before opening the mic
+#: anyway.  Measured 0.01-0.86s across both transports; this is generous enough
+#: to cover a slow SDES open without making a press-to-talk feel stuck.
+SPEAKER_ACK_TIMEOUT_S = 2.0
+
+#: Ack payloads observed for SPEAKERSTART, all of them on speakers that opened:
+#: 0x0064 (M3 Pro / DTLS, PTZ / SDES, and an L2) and 0x00c8 (the same L2, on the
+#: very next session). One camera returning both across consecutive successful
+#: opens is what settles it - the payload is not a verdict, so there is nothing
+#: here to read as a refusal.
+_SPEAKER_ACKS_SEEN = (b"\x00\x64", b"\x00\xc8")
+
+
+async def _speaker_opened(session, cmd: int, resp_cmd: int, timeout: float) -> bool:
+    """Send SPEAKERSTART and decide whether the camera opened its speaker.
+
+    Everything currently counts as success, and that is the honest position
+    rather than a placeholder. Silence does, because an A001064 answers 848 but
+    does not implement 802 at all - a firmware with no response for a command is
+    a real and common state, and failing on it would remove two-way audio from
+    every camera quieter than the one measured. And any ack does, because no
+    refusal has ever been observed: the payload varies across models AND across
+    consecutive sessions on one camera, so it carries no verdict to read.
+
+    An earlier version treated 0x0064 as "the" success value and any other
+    two-byte payload as a refusal. That was a discriminator invented from a
+    single sample, and it would have disabled talk outright on an L2, which
+    answers 0x00c8 about half the time. The payload is logged instead, so a
+    genuine refusal can be recognised from evidence when one appears.
+    """
+    waiter = session._avio_responses.expect(resp_cmd)
+    try:
+        sent = session._avio_cmd(cmd, b"\x00" * 8)
+    except Exception:
+        sent = False
+    if not sent:
+        waiter.cancel()
+        return True  # no channel to refuse on; unchanged from before
+    return await _speaker_ack_accepted(waiter, timeout)
+
+
+async def _speaker_ack_accepted(waiter, timeout: float) -> bool:
+    """Read a SPEAKERSTART ack, defaulting to acceptance on anything unfamiliar.
+
+    Shared by both transports because the decision is the same, even though the
+    send is not: on SDES the command leaves from the bridge thread and this only
+    ever waits.
+    """
+    reply = await waiter.result(timeout)
+    if reply is None:
+        _LOGGER.debug("SPEAKERSTART: no ack within %.1fs - treating as opened", timeout)
+        return True
+    if reply.payload not in _SPEAKER_ACKS_SEEN:
+        _LOGGER.info(
+            "SPEAKERSTART acked with an unrecorded payload %s - treating the "
+            "speaker as open. Please report this: the payloads seen so far all "
+            "belong to speakers that opened, so a genuine refusal has never "
+            "been identified and this may be the first",
+            reply.payload.hex() or "<empty>",
+        )
+    return True
+
+
 class AvioRequestMixin:
     """Ask an AVIO command and wait for the camera's reply.
 

{python_aidot_cameras-0.16.0 → python_aidot_cameras-0.17.1}/aidot_cameras/camera/sdes.py

@@ -9,11 +9,25 @@ import asyncio
 import logging
 from typing import Callable, Optional
 
-from .constants import SDES_TALK_PUMP_IDLE_TICK
-from .protocol import AvioRequestMixin, AvioResponseRouter
+from .constants import SDES_SPEAKERSTART_DELAY, SDES_TALK_PUMP_IDLE_TICK
+from .protocol import (
+    SPEAKER_ACK_TIMEOUT_S,
+    AvioRequestMixin,
+    AvioResponseRouter,
+    _speaker_ack_accepted,
+)
 
 _LOGGER = logging.getLogger(__name__)
 
+#: The bridge does not send SPEAKERSTART the moment talk starts - it waits
+#: SDES_SPEAKERSTART_DELAY after the command channel is up, because a
+#: SPEAKERSTART sent too early is ignored and never acked.  The ack budget
+#: has to cover that delay as well as the round trip, or the wait expires
+#: before the command has even left and every press-to-talk pays the full
+#: timeout for no verdict.
+SDES_SPEAKER_ACK_TIMEOUT_S = SDES_SPEAKERSTART_DELAY + SPEAKER_ACK_TIMEOUT_S
+
+
 
 class SdesSession(AvioRequestMixin):
     """Active SDES-SRTP stream session managed by an ffmpeg subprocess.
@@ -41,6 +55,7 @@ class SdesSession(AvioRequestMixin):
         first_audio_pt=None,
         device_id=None,
         responses=None,
+        abort_chan=None,
     ) -> None:
         # Which camera this session belongs to, for logging only.  Optional so
         # an existing caller that does not pass it still works; the logs then
@@ -87,6 +102,12 @@ class SdesSession(AvioRequestMixin):
         self._avio_responses = (
             responses if responses is not None else AvioResponseRouter()
         )
+        # Mutable one-element list the bridge fills with a callable that sends
+        # an SCTP ABORT.  Unlike SPEAKERSTART this is safe to call from here:
+        # ABORT carries no TSN, so there is nothing for it to race, and it is
+        # the last thing the association ever sees.  None when the caller
+        # supplied no holder - teardown then behaves exactly as it did before.
+        self._abort_chan = abort_chan if abort_chan is not None else [None]
         # Shared talk state (dict) for outbound two-way audio, or None when the
         # session was not opened talk-capable (offer stayed recvonly).  Populated
         # by the bridge (camera audio addr) and by async_start_talk (provider).
@@ -138,13 +159,24 @@ class SdesSession(AvioRequestMixin):
         # SPEAKERSTART(848) is sent by the BRIDGE thread (not here) once the SCTP
         # command channel is up - all SCTP DATA must stay on one thread or the
         # command races the heartbeat's TSN and the camera drops it.
+        # Register interest BEFORE the pump starts, so the ack cannot arrive
+        # while nothing is listening.  Note this does NOT send 848 - the bridge
+        # thread does, once want_speaker is set.  Moving the send here would put
+        # SCTP DATA on a second thread, racing the heartbeat's TSN.
+        waiter = self._avio_responses.expect(851)
         if self._talk_thread is None or not self._talk_thread.is_alive():
             import threading
             self._talk_thread = threading.Thread(
                 target=_run_sdes_talk_pump, args=(self._talk_state,), daemon=True
             )
             self._talk_thread.start()
-        return True
+        if await _speaker_ack_accepted(waiter, SDES_SPEAKER_ACK_TIMEOUT_S):
+            return True
+        # The camera refused. Stop the microphone rather than stream viewer
+        # audio at a speaker that never opened.
+        self._talk_state["want_speaker"] = False
+        self._talk_state["provider"] = None
+        return False
 
     async def async_stop_talk(self) -> bool:
         """End two-way audio: close the camera speaker and stop sending audio."""
@@ -279,6 +311,23 @@ class SdesSession(AvioRequestMixin):
                 await asyncio.sleep(0.3)
             self._talk_state["stop"] = True
             self._talk_state["provider"] = None
+        # Close the SCTP association BEFORE anything else, while the bridge
+        # loop that sends it is still running - it dies with ffmpeg.  Measured
+        # 2026-08-07: reopening 2s after a close is refused with -50002 while 8s
+        # is fine, because the camera holds the session until it works out we
+        # have gone.  We were the only one of the three implementations that
+        # never said so; the official app disposes its data channel and our own
+        # DTLS path sends this same chunk.
+        _abort = self._abort_chan[0]
+        if _abort is not None:
+            try:
+                if _abort():
+                    _LOGGER.debug("camera %s: sent SCTP ABORT at teardown",
+                                  self._device_id)
+            except Exception:
+                # Never let closing politely stop us closing at all.
+                _LOGGER.debug("camera %s: swallowed exception in %s",
+                              self._device_id, 'stop', exc_info=True)
         # Flag this as a locally-initiated teardown BEFORE signalling ffmpeg, so
         # the bridge thread's observe loop never races a look at a stale False
         # if it polls the exit code immediately after terminate()/kill().