python-aidot-cameras 0.17.0__tar.gz → 0.17.2__tar.gz

{python_aidot_cameras-0.17.0/python_aidot_cameras.egg-info → python_aidot_cameras-0.17.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 0.17.0
+Version: 0.17.2
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT
@@ -178,6 +178,9 @@ audio, idle release, the sprop cache path) are documented in
 | `AIDOT_DTLS_FAST_LIVEPLAY` | The DTLS (A000088) analogue: skip the `livePlayReq`-echo and `livePlayResp` waits (the dominant LAN cold-start cost) while keeping the full ICE/TURN/DTLS handshake, so remote/relay viewing is unaffected. **On by default**; set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_PERSISTENT_MQTT` | Reuse ONE account-level persistent MQTT connection for commands, attribute fetches, and stream-open signaling (matching the official app) instead of connecting per operation. **On by default** (live soaks cut SDES NO_MEDIA from ~57% to ~11-19%); set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_SERVE_RELAY` | Hold the public stream port via an internal relay that proxies to ffmpeg, so the first (cold) view connects instead of failing while ffmpeg can't pre-bind the port. Set to `0` to serve ffmpeg directly. | `1` (enabled) |
+| `AIDOT_LOGIN_RETRY_LIMIT` | Consecutive failed LAN logins after which a device is left alone (it is retried again the next time something asks for it). Applies to every device, camera or not - the devices that hit this are lights. | `6` |
+| `AIDOT_LOGIN_RETRY_CAP_S` | Ceiling on the exponential delay between those retries. | `60` |
+| `AIDOT_LOGIN_CONNECT_TIMEOUT_S` | Ceiling on one LAN connect+login attempt. A device that completes the TCP handshake and then stops answering is abandoned and its socket closed rather than parking the attempt forever. | `20` |
 | `AIDOT_LIVESTREAM_PARAM` | **No-op (ignored).** Formerly requested the cloud `liveStreamParam` pre-connect for battery cameras. That call provisions the camera toward AWS KVS, so it sends its media there instead of to this library and the live view negotiates and then shows nothing - and battery cameras were the only ones it applied to. Setting it (or `start_keepalive(live_stream_param=True)`) logs one warning and changes nothing. | ignored |
 
 ### Security hardening

{python_aidot_cameras-0.17.0 → python_aidot_cameras-0.17.2}/README.md

@@ -147,6 +147,9 @@ audio, idle release, the sprop cache path) are documented in
 | `AIDOT_DTLS_FAST_LIVEPLAY` | The DTLS (A000088) analogue: skip the `livePlayReq`-echo and `livePlayResp` waits (the dominant LAN cold-start cost) while keeping the full ICE/TURN/DTLS handshake, so remote/relay viewing is unaffected. **On by default**; set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_PERSISTENT_MQTT` | Reuse ONE account-level persistent MQTT connection for commands, attribute fetches, and stream-open signaling (matching the official app) instead of connecting per operation. **On by default** (live soaks cut SDES NO_MEDIA from ~57% to ~11-19%); set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_SERVE_RELAY` | Hold the public stream port via an internal relay that proxies to ffmpeg, so the first (cold) view connects instead of failing while ffmpeg can't pre-bind the port. Set to `0` to serve ffmpeg directly. | `1` (enabled) |
+| `AIDOT_LOGIN_RETRY_LIMIT` | Consecutive failed LAN logins after which a device is left alone (it is retried again the next time something asks for it). Applies to every device, camera or not - the devices that hit this are lights. | `6` |
+| `AIDOT_LOGIN_RETRY_CAP_S` | Ceiling on the exponential delay between those retries. | `60` |
+| `AIDOT_LOGIN_CONNECT_TIMEOUT_S` | Ceiling on one LAN connect+login attempt. A device that completes the TCP handshake and then stops answering is abandoned and its socket closed rather than parking the attempt forever. | `20` |
 | `AIDOT_LIVESTREAM_PARAM` | **No-op (ignored).** Formerly requested the cloud `liveStreamParam` pre-connect for battery cameras. That call provisions the camera toward AWS KVS, so it sends its media there instead of to this library and the live view negotiates and then shows nothing - and battery cameras were the only ones it applied to. Setting it (or `start_keepalive(live_stream_param=True)`) logs one warning and changes nothing. | ignored |
 
 ### Security hardening

{python_aidot_cameras-0.17.0 → python_aidot_cameras-0.17.2}/aidot_cameras/camera/client.py

@@ -388,6 +388,32 @@ _SERVE_MAX_DELAY_US = int(os.environ.get("AIDOT_SERVE_MAX_DELAY_US", "500000"))
 #: has none free, and on a battery model risks a wake-then-sleep loop.
 _BUSY_BACKOFF_S = float(os.environ.get("AIDOT_BUSY_BACKOFF_S", "20"))
 
+#: Consecutive background sessions that deliver NO media before the keepalive
+#: stops reopening a battery camera. Observed 2026-08-07 on an A001513: 22 opens
+#: across ~8 hours, none of them delivering media, because the loop escalated
+#: its backoff but had no condition under which it ever stopped. On a mains
+#: camera that is wasteful; on a battery one it spends charge, and a unit has
+#: already been drained to 5% that way.
+#: 0 disables the ceiling entirely.
+_FUTILE_KEEPALIVE_LIMIT = int(os.environ.get("AIDOT_FUTILE_KEEPALIVE_LIMIT", "5"))
+
+
+def _should_abandon_keepalive(no_media_streak: int, *, is_battery: bool,
+                              limit: int = _FUTILE_KEEPALIVE_LIMIT) -> bool:
+    """Should the background keepalive stop reopening this camera?
+
+    Only for battery cameras. A mains camera has no charge to protect, and the
+    same persistence is what recovers a stream after a router reboot or a
+    power-cycle - there the loop is the feature.
+
+    Scoped to the BACKGROUND loop. A view still opens a session on demand: the
+    user asking to see the camera is new information, and a retry ceiling should
+    not decide on their behalf that it cannot work.
+    """
+    if not is_battery or limit <= 0:
+        return False
+    return no_media_streak >= limit
+
 
 def _build_sdes_serve_cmd(
     *,
@@ -3357,6 +3383,7 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
         # camera (or a fleet reconnecting at once) isn't hammered into further
         # degradation / cloud rate-limiting; resets after a session that delivered
         # media (see end of loop).
+        _no_media_streak = 0
         _pacer = ReconnectPacer(_MIN_DELAY, _MAX_DELAY)
 
         # Adaptive fast-with-fallback (default on): the first open tries the fast
@@ -3579,6 +3606,35 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                 _loop_peer_id = self.generate_webrtc_peer_id(
                     live_type=2, stream_id=0, sdes=True)
                 _peer_reuses = 0
+                _no_media_streak = 0
+            else:
+                _no_media_streak += 1
+                if _should_abandon_keepalive(
+                        _no_media_streak, is_battery=self.is_battery_camera):
+                    # Every open so far has cost the camera a wake and returned
+                    # nothing. Continuing spends charge to learn the same thing
+                    # again; a view will still open a session on demand.
+                    _LOGGER.warning(
+                        "camera %s: %d consecutive keepalive sessions delivered no "
+                        "media - stopping the background keepalive to stop waking "
+                        "it. A live view will still open a session; set "
+                        "AIDOT_FUTILE_KEEPALIVE_LIMIT=0 to keep retrying.",
+                        self.device_id, _no_media_streak,
+                    )
+                    self._streaming_active = False
+                    # Same teardown the idle-release exit does. Leaving the
+                    # go2rtc stream registered points it at a serve port with
+                    # nothing listening, so a viewer attaching to a dormant
+                    # camera gets "connection refused" instead of a clean miss -
+                    # exactly what the idle-release path exists to avoid.
+                    self._cancel_keepalive_renew()
+                    try:
+                        await self._deregister_go2rtc()
+                    except Exception:
+                        _LOGGER.debug("camera %s: go2rtc deregister after "
+                                      "abandon failed", self.device_id,
+                                      exc_info=True)
+                    return
             if _use_fast and not _healthy and not _fast_failed:
                 _LOGGER.info(
                     "SDES adaptive[%s]: fast attempt delivered no media - "

{python_aidot_cameras-0.17.0 → python_aidot_cameras-0.17.2}/aidot_cameras/camera/constants.py

@@ -131,9 +131,13 @@ _PTZ_DIR_CODES: dict = {
     "zoom_in": 23, "zoom_out": 24,
 }
 
-# Live-stream resolution (AVIOCTRL_QUALITY_*).  The official app's HD/SD toggle
-# switches between MAX(1) and MIDDLE(5) (f0.java g3() / LiveFragment d6); we
-# mirror those two.  Sent as SETSTREAMCTRL (cmd 800) over the active session,
+# Live-stream resolution (AVIOCTRL_QUALITY_*).  The official app's picker has
+# THREE arms, not two: MAX(1), MIDDLE(5), and 0x10 = 16, whose label is
+# _auto_resulution (HorLiveController.smali:629-631).  16 is deliberately absent
+# here: it is outside AVIOCTRL_QUALITY, and measured 2026-08-07 it behaves like
+# every other value - acked, and the encode unchanged in that session and the
+# next.  Adding it would offer a control that does nothing.  The two arms below
+# are the ones with enum names, kept for parity with the command the app sends.  Sent as SETSTREAMCTRL (cmd 800) over the active session,
 # payload <IB3x> = channel(0) + quality byte (SMsgAVIoctrlSetStreamCtrlReq).
 SETSTREAMCTRL_CMD = 800
 GETSTREAMCTRL_CMD = 802

{python_aidot_cameras-0.17.0 → python_aidot_cameras-0.17.2}/aidot_cameras/camera/controls.py

@@ -172,9 +172,17 @@ class _CameraControlsMixin:
                 "will be applied when a session next starts", quality)
             return True
         # Ask, and read what comes back.  The camera acks with 801 in
-        # 0.01-0.03s (measured 2026-08-07 on an A000088) and reports the new
-        # value through GETSTREAMCTRL afterwards, so the command is genuinely
-        # accepted - it simply does not change the encode.
+        # 0.01-0.19s and reports the new value through GETSTREAMCTRL afterwards
+        # (where it implements 802), so the command is genuinely accepted - it
+        # simply does not change the encode.
+        #
+        # Settled 2026-08-07 across both transports and every value the enum
+        # defines, not just hd/sd: an A001064 was swept over all six
+        # AVIOCTRL_QUALITY values, each followed by a session that sent nothing
+        # to catch a setting that applies only to the NEXT session. Twelve
+        # sessions, twelve times h264 1280x720, no dimension change in any of
+        # them. Four of those values had never been sent to any camera here.
+        # See docs/APP-PARITY-STATUS.md for the table.
         #
         # The RETURN value deliberately still means "the command went out". An
         # A001064 answers SPEAKERSTART but does not implement GETSTREAMCTRL at

{python_aidot_cameras-0.17.0 → python_aidot_cameras-0.17.2}/aidot_cameras/camera/protocol.py

@@ -235,6 +235,14 @@ def _parse_alarm_event(msg: dict):
     return {"device_id": dev, "type": kind, "alarm_type": code}
 
 
+def _section_of(lines: list) -> str:
+    """The m-section the given emitted lines currently end inside, or ""."""
+    for ln in reversed(lines):
+        if ln.startswith("m="):
+            return ln.split(" ")[0]
+    return ""
+
+
 def _compress_sdp_for_camera(sdp: str) -> str:
     """Selective SDP filter matching official Java client's g.b() behaviour.
 
@@ -258,6 +266,14 @@ def _compress_sdp_for_camera(sdp: str) -> str:
     seen: dict = {}
     media_type = ""
     before_m = True
+    # Payload types that survived narrowing. rtcp-fb is kept for these and only
+    # these: feedback describing a codec we dropped is bytes spent on something
+    # that will never be sent, in an offer whose size is why this function
+    # exists.
+    _kept_pts: set = set()
+    # rtcp-fb lines are buffered because they can appear before the rtpmap that
+    # decides whether their payload type survives.
+    _fb_lines: list = []
 
     def keep(ln: str, key: str = "") -> None:
         out.append(ln + "\r\n")
@@ -283,6 +299,11 @@ def _compress_sdp_for_camera(sdp: str) -> str:
         if ln.startswith("a=mid:"):
             keep(ln)
             continue
+        if ln.startswith("a=rtcp-fb:"):
+            # Buffered, not decided here: an rtcp-fb line can precede the
+            # rtpmap that determines whether its payload type survives.
+            _fb_lines.append((media_type, ln))
+            continue
         if ln.startswith("a=ssrc") and "cname" in ln:
             if seen.get(f"ssrc-cname-{media_type}") is None:
                 keep(ln, f"ssrc-cname-{media_type}")
@@ -303,17 +324,26 @@ def _compress_sdp_for_camera(sdp: str) -> str:
             if media_type == "m=audio":
                 if any(c in ln for c in ("opus", "PCMU", "PCMA", "AAC")):
                     keep(ln)
+                    # Remember the payload type so its rtcp-fb can be kept too.
+                    if ln.startswith("a=rtpmap:"):
+                        try:
+                            _kept_pts.add(ln.split(":")[1].split(" ")[0])
+                        except Exception:
+                            _LOGGER.debug("swallowed exception in %s", 'keep',
+                                          exc_info=True)
             elif media_type == "m=video":
                 if "H264/90000" in ln and seen.get("H264/90000") is None:
                     keep(ln, "H264/90000")
                     try:
                         seen["H264/90000_pt"] = ln.split(":")[1].split(" ")[0]
+                        _kept_pts.add(seen["H264/90000_pt"])
                     except Exception:
                         _LOGGER.debug("swallowed exception in %s", 'keep', exc_info=True)
                 elif "H265/90000" in ln and seen.get("H265/90000") is None:
                     keep(ln, "H265/90000")
                     try:
                         seen["H265/90000_pt"] = ln.split(":")[1].split(" ")[0]
+                        _kept_pts.add(seen["H265/90000_pt"])
                     except Exception:
                         _LOGGER.debug("swallowed exception in %s", 'keep', exc_info=True)
                 elif "apt=" in ln:
@@ -332,6 +362,22 @@ def _compress_sdp_for_camera(sdp: str) -> str:
             elif media_type == "m=application":
                 if "sctp-port" in ln:
                     keep(ln)
+    # Re-insert the surviving feedback at the end of its own media section, so
+    # the offer stays well-formed. Kept only for payload types that survived
+    # narrowing - see _kept_pts.
+    if _fb_lines:
+        kept_fb = [(mt, ln) for mt, ln in _fb_lines
+                   if ln.split(":", 1)[1].split(" ")[0] in _kept_pts]
+        if kept_fb:
+            rebuilt: list = []
+            for line in out:
+                if line.startswith("m=") and rebuilt:
+                    prev = _section_of(rebuilt)
+                    rebuilt.extend(l + "\r\n" for mt, l in kept_fb if mt == prev)
+                rebuilt.append(line)
+            prev = _section_of(rebuilt)
+            rebuilt.extend(l + "\r\n" for mt, l in kept_fb if mt == prev)
+            out = rebuilt
     return "".join(out)
 
 
@@ -2337,6 +2383,87 @@ class AvioResponseRouter:
                 self._waiting.pop(waiter._command, None)
 
 
+#: What we ask the camera to send, in bits per second. Zero disables sending
+#: REMB at all, which is the default.
+#:
+#: OFF by default because it was measured and did not work. An A001064 was A/B'd
+#: with REMB transmitting at 500 Kbps and correctly naming the video SSRC -
+#: receipts per session, interleaved arms against a control - and its bitrate
+#: did not fall. The one clean like-for-like pair had the REMB arm HIGHER than
+#: its control (3859 vs 3355 Kbps). No effect was demonstrated on the only model
+#: tested.
+#:
+#: That alone would argue for opt-in. The stronger argument is the models NOT
+#: tested: an A000088 or A001513 that does honour REMB would have had its
+#: picture capped at 500 Kbps fleet-wide, by default, on the strength of a
+#: measurement taken elsewhere that showed no benefit. Shipping a bitrate cap
+#: enabled by default, validated on one camera that ignores it, risks degrading
+#: precisely the cameras nobody measured.
+#:
+#: The negotiation, the encoder and the decoder are all kept and tested: the
+#: camera does advertise goog-remb in its answer, so this is a working
+#: instrument for anyone who wants to measure their own hardware. Set
+#: AIDOT_REMB_TARGET_BPS to a bitrate to turn it on.
+REMB_TARGET_BPS = int(os.environ.get("AIDOT_REMB_TARGET_BPS", "0"))
+
+
+def build_remb(sender_ssrc: int, media_ssrcs: "list", bitrate_bps: int) -> bytes:
+    """An RTCP REMB packet asking the sender for at most ``bitrate_bps``.
+
+    Format is the Google draft (draft-alvestrand-rmcat-remb) carried as a
+    Payload-Specific Feedback message: FMT 15, PT 206, the ASCII identifier
+    ``REMB``, then a count of SSRCs and the bitrate as a 6-bit exponent with an
+    18-bit mantissa, then the SSRCs themselves.
+
+    The camera negotiates ``goog-remb`` in its answer (confirmed live on an
+    A001064 over SDES), which means it will accept this. It has no effect until
+    one is actually sent - negotiation alone changes nothing, which is why this
+    is a separate step from keeping the attribute in the offer.
+    """
+    if bitrate_bps <= 0:
+        raise ValueError("REMB bitrate must be positive - zero would ask the "
+                         "camera to stop sending entirely")
+    if not media_ssrcs:
+        raise ValueError("REMB must name at least one stream")
+
+    # 18-bit mantissa, 6-bit exponent: shift right until the value fits.
+    exp = 0
+    mantissa = int(bitrate_bps)
+    while mantissa > 0x3FFFF:
+        mantissa >>= 1
+        exp += 1
+        if exp > 63:
+            raise ValueError("REMB bitrate too large to encode")
+
+    header = struct.pack(
+        "!BBH",
+        0x80 | 15,          # V=2, P=0, FMT=15
+        206,                # PT: payload-specific feedback
+        0,                  # length, filled in below
+    )
+    body = (struct.pack("!II", sender_ssrc & 0xFFFFFFFF, 0)
+            + b"REMB"
+            + struct.pack("!BBBB",
+                          len(media_ssrcs) & 0xFF,
+                          ((exp << 2) | (mantissa >> 16)) & 0xFF,
+                          (mantissa >> 8) & 0xFF,
+                          mantissa & 0xFF)
+            + b"".join(struct.pack("!I", s & 0xFFFFFFFF) for s in media_ssrcs))
+    pkt = header + body
+    # RTCP length is in 32-bit words, minus one.
+    return pkt[:2] + struct.pack("!H", len(pkt) // 4 - 1) + pkt[4:]
+
+
+def decode_remb_bitrate(pkt: bytes) -> int:
+    """The bitrate a REMB packet asks for. For tests and diagnostics."""
+    # Layout: 0-3 header, 4-7 sender SSRC, 8-11 media SSRC, 12-15 "REMB",
+    # 16 num-SSRC, 17-19 exponent+mantissa, 20+ the SSRCs.
+    b = pkt[17]
+    exp = b >> 2
+    mantissa = ((b & 0x03) << 16) | (pkt[18] << 8) | pkt[19]
+    return mantissa << exp
+
+
 def _avio_cmd_id(frame: bytes) -> "Optional[int]":
     """The command id of an AVIO frame, or None if it does not look like one.
 

{python_aidot_cameras-0.17.0 → python_aidot_cameras-0.17.2}/aidot_cameras/camera/sdes_open.py

@@ -25,7 +25,9 @@ from .models import VideoFrame  # noqa: F401 - forward-ref annotation
 from .sdes import SdesSession
 from .protocol import (
     AVIO_HDR_LEN,
+    REMB_TARGET_BPS,
     AvioResponseRouter,
+    build_remb,
     _build_sprop,
     parse_avio_response,
     _build_stun_binding_success_response,
@@ -174,6 +176,33 @@ _SDP_AUDIO_PTS = (0, 8)
 # even when the camera numbers that codec differently on the wire - it is our own
 # SDP being rewritten, not the camera's.
 _SDP_VIDEO_PT_BY_CODEC = {"H264": 96, "H265": 97}
+_SDP_CODEC_BY_VIDEO_PT = {pt: codec for codec, pt in _SDP_VIDEO_PT_BY_CODEC.items()}
+
+
+def describe_video_profile(pt) -> str:
+    """Name the video profile a session negotiated, for the log.
+
+    An A001064 was measured serving two profiles for identical requests - H264
+    1280x720 at 2.5-4.0 Mbps and H265 2560x1440 at ~1.1 Mbps - varying per
+    session with nothing on our side asking for either.  What selects it is
+    unknown, and it is unknown because nothing recorded it: bitrate figures
+    gathered before 2026-08-07 cannot be compared, since the codec that produced
+    each one was never written down.
+
+    Instrumentation, not a fix.  It asserts no cause.
+
+    Deliberately limited to the payload type and its codec name, which is what
+    the bridge knows when the first video packet lands.  Frame dimensions would
+    mean parsing H264/H265 parameter sets out of the stream - far more than the
+    question needs, and on the camera measured codec and resolution moved
+    together in 11 of 11 sessions, so the codec stratifies it today.
+
+    Never raises: this runs on the media path, and nothing here may be able to
+    break an otherwise healthy stream.  An unmapped payload type is reported as
+    ``unknown``, which is a finding worth having rather than a reason to skip
+    the record.
+    """
+    return f"pt={pt} codec={_SDP_CODEC_BY_VIDEO_PT.get(pt) or 'unknown'}"
 
 # How long to wait for the FIRST media of a session before launching the serve.
 # Nothing useful can happen before then: the payload types are unknown, so the SDP
@@ -245,6 +274,77 @@ def video_pt_from_answer_sdp(sdp_text: str) -> Optional[int]:
     return None
 
 
+#: Video payload types the SDES answer template advertises (H264, H265).
+_SDES_ANSWER_VIDEO_PTS = (96, 97)
+
+
+def _should_capture_sprop(kind, decrypted: bool, sprop_done: bool) -> bool:
+    """May this packet's payload be mined for SPS/PPS and cached to disk?
+
+    ``decrypted`` is the load-bearing term and it used to be missing.  The
+    bridge's ``_fwd_pkt`` starts as the raw inbound packet and is rebound only
+    when ``unprotect`` succeeds, so it stays ciphertext whenever there is no
+    SRTP receive session - pylibsrtp is in the optional ``webrtc`` extra, so a
+    base install never has one - or when ``unprotect`` raised, since that
+    handler logs a few lines and falls through.
+
+    SRTP leaves the RTP header in clear, so the payload offset comes out right
+    and random ciphertext reaches the NAL demux; ``payload[0] & 0x1F`` draws 7
+    and 8 at about 1/32 each, and on a 30 fps stream both appear within seconds.
+
+    The result is written to ``~/.config/aidot/sprop/<devid>.sprop`` and injected
+    as ``sprop-parameter-sets=`` by every later session, so a poisoned cache
+    outlives the session that created it: installing pylibsrtp afterwards does
+    not clear the file, and the first correct capture then differs from it and
+    trips the ``.unstable`` marker, disabling injection for that camera for good.
+    A bad frame is cheap; a bad file is not.
+
+    Returning False for a packet nobody decrypted is right even where ffmpeg
+    does its own decryption: what we hold is still ciphertext, so anything mined
+    from it would be noise either way.
+    """
+    return bool(kind == "video" and decrypted and not sprop_done)
+
+
+def _resolve_sdes_video_pt() -> Optional[int]:
+    """EXPERIMENTAL (opt-in, default off): pin the OFFER to one video codec.
+
+    The offer sent in webrtcReq advertises BOTH 96 (H264) and 97 (H265) and
+    expresses no preference, so the camera chooses which to send in its answer.
+    Measured on an A001064 across eleven sessions in one afternoon it chose H264
+    nine times and H265 twice for an otherwise identical request, and the codec
+    it chose determined the resolution (H264 -> 1280x720, H265 -> 2560x1440, 11
+    of 11).  A consumer that cannot decode a sudden 2560x1440 H265 stream, or
+    cannot absorb the bitrate change either way, has no means today of
+    preventing the flip.  Pinning removes the choice: measured 2026-08-07, an
+    offer pinned to 96 produced h264 1280x720 in 4 of 4 sessions.
+
+    It is the OFFER that matters, not the answer.  Traced live with every status
+    line printed: this path sends webrtcReq carrying our offer and then reports
+    "Using camera's video SRTP key from answer" - the camera answers, we do not.
+    An earlier version of this pinned the answer builder instead and changed
+    nothing at all, while the arms still came out looking like it had worked.
+
+    **Do not set this to 97.**  An H265-only offer returned NO VIDEO - audio
+    only, no video stream in the recording - in 3 of 3 interleaved rounds
+    against 3 of 3 successes for 96 in the same run.  The efficient H265 profile
+    is real and reproducible, but only when BOTH codecs are offered; narrowing
+    to it removes the option rather than selecting it.
+
+    Left unset this returns None and the offer is byte-identical to today.  The
+    SDES offer path is shared by every SDES camera, and this project's CHANGELOG
+    records fleet-wide blackouts caused by changes to shared paths, so the
+    default has to be inert.  Anything unparseable, or a payload type the
+    template does not advertise, also returns None: narrowing to a payload type
+    the camera was never offered would leave it nothing to send.
+    """
+    raw = (os.environ.get("AIDOT_SDES_VIDEO_PT", "") or "").strip()
+    if not raw.isdigit():
+        return None
+    pt = int(raw)
+    return pt if pt in _SDES_ANSWER_VIDEO_PTS else None
+
+
 def narrow_sdp_payload_types(sdp_text: str, keep_video=None, keep_audio=None) -> str:
     """Rewrite an SDP to advertise a single payload type per media line.
 
@@ -1086,6 +1186,23 @@ class _SdesOpenMixin:
             )
         )
 
+        # Opt-in: express a video-codec preference in the OFFER rather than
+        # advertising both 96/97 and letting the camera decide in its answer.
+        #
+        # The offer is the SDP that matters here.  Traced live 2026-08-07 with
+        # every status line printed: this path sends webrtcReq carrying OUR
+        # offer and then reports "Using camera's video SRTP key from answer" -
+        # the camera answers, we do not.  The answer builder further down runs
+        # only on the branch where the camera offers first, which this camera
+        # did not take, so pinning there changed nothing at all while the
+        # arms still came out looking like the pin had worked.  Inert unless set.
+        _pin_video_pt = _resolve_sdes_video_pt()
+        if _pin_video_pt is not None:
+            sdes_offer_sdp = narrow_sdp_payload_types(
+                sdes_offer_sdp, keep_video=_pin_video_pt)
+            if _status:
+                _status(f"SDES: offer pinned to video pt={_pin_video_pt}")
+
         _relay_str = (
             f"  relay-audio={_relay_addrs[_audio_sock][0]}:{_relay_addrs[_audio_sock][1]}"
             if _audio_sock in _relay_addrs else ""
@@ -1351,6 +1468,18 @@ class _SdesOpenMixin:
                 "dstAddr": device_id,
                 "encOffer": 1,
                 "liveMqtt": 1,
+                # powerType / p2pCache ride on the webrtcReq payload, alongside
+                # encOffer and liveMqtt - the same object the reference client
+                # puts them on (LDSMQTTClient.sendSdpOffer, smali :2967-2969,
+                # put at :3017/:3022).  They are STRINGS on the wire there: the
+                # app stringifies the ints it reads from the IPC device info,
+                # and its no-device-info fallback puts the literals "1" / "0".
+                # The DTLS webrtcReq has carried both for a long time
+                # (webrtc_open.py, per docs/official_camera_network_calls.md
+                # section 5.2) and sends them as ints; that path is fleet-proven,
+                # so it is deliberately left alone rather than churned to match.
+                "powerType": str(_live_power_type),
+                "p2pCache": str(_live_p2p_cache),
                 # wPayload: newer firmware parses wPayload for ICE credentials
                 # and PSK.  Fields match reference app o.java (signaling/tyrus).
                 "wPayload": {
@@ -3061,6 +3190,43 @@ class _SdesOpenMixin:
                         except ValueError:
                             _pli_gaps = (0.0, 1.5, 2.0, 3.0)
                         _bridge_fn._pli_gaps = _pli_gaps
+                    # REMB names the VIDEO stream, which is the one to
+                    # limit. An earlier version rode the audio Receiver Report
+                    # and so named the audio SSRC - it asked the camera to keep
+                    # PCMA under the target, which it already was, and left the
+                    # video untouched. Measured no change, correctly.
+                    #
+                    # Own cadence: the PLI timer backs off to 30s once the
+                    # stream is up, which is too slow to hold a rate.
+                    if (REMB_TARGET_BPS > 0
+                            and hasattr(_bridge_fn, '_cam_video_ssrc')
+                            and hasattr(_bridge_fn, '_cam_srtp_sock')
+                            and _time_br.time() - getattr(
+                                _bridge_fn, '_last_remb_ts', 0.0) >= 1.0):
+                        _bridge_fn._last_remb_ts = _time_br.time()
+                        try:
+                            _remb_raw = build_remb(
+                                0xAB12CD34,
+                                [_bridge_fn._cam_video_ssrc],
+                                REMB_TARGET_BPS)
+                            _remb_sess = getattr(_bridge_fn, '_pli_tx_sess', None)
+                            _bridge_fn._cam_srtp_sock.sendto(
+                                _remb_sess.protect_rtcp(_remb_raw)
+                                if _remb_sess is not None else _remb_raw,
+                                _bridge_fn._cam_srtp_src,
+                            )
+                            if not getattr(_bridge_fn, '_remb_logged', False):
+                                _bridge_fn._remb_logged = True
+                                _status(
+                                    f"SDES: sent REMB {REMB_TARGET_BPS // 1000} kbps"
+                                    f" for video SSRC"
+                                    f" 0x{_bridge_fn._cam_video_ssrc:08x}")
+                        except Exception:
+                            _LOGGER.debug(
+                                "camera %s: swallowed exception in %s",
+                                getattr(self, "device_id", "?"), '_remb',
+                                exc_info=True)
+
                     _pli_done       = getattr(_bridge_fn, '_pli_count', 0)
                     _pli_interval   = (_pli_gaps[_pli_done]
                                        if _pli_done < len(_pli_gaps) else 30.0)
@@ -4123,6 +4289,14 @@ class _SdesOpenMixin:
                                 _br_first_video_logged = True
                                 _first_video_pt[0] = _pt
                                 _status(f"bridge: first video RTP pt={_pt}")
+                                # At INFO, not DEBUG: this is the one line that
+                                # makes a bitrate figure comparable to another
+                                # one, and it is emitted once per session.
+                                _LOGGER.info(
+                                    "camera %s: video profile %s",
+                                    getattr(self, "device_id", "?"),
+                                    describe_video_profile(_pt),
+                                )
                                 # Camera answers BUNDLE (all media on one 5-tuple),
                                 # so the talk destination is the same address as
                                 # video.  Capture it here too - the camera may send
@@ -4149,6 +4323,12 @@ class _SdesOpenMixin:
                             # from TUTK SFrames to standard SRTP, so we decrypt here
                             # before forwarding plain RTP to ffmpeg.
                             _fwd_pkt = _bpkt
+                            # Whether _fwd_pkt is plaintext by the time anything
+                            # below reads its PAYLOAD. False until something has
+                            # actually decrypted it: forwarding ciphertext is
+                            # inert (ffmpeg discards it), but MINING it is not -
+                            # see _should_capture_sprop.
+                            _decrypted = False
                             if _use_plain_rtp:
                                 if not hasattr(_bridge_fn, '_srtp_rx_sess'):
                                     _bridge_fn._srtp_rx_sess = None
@@ -4173,6 +4353,7 @@ class _SdesOpenMixin:
                                 if _bridge_fn._srtp_rx_sess is not None:
                                     try:
                                         _fwd_pkt = _bridge_fn._srtp_rx_sess.unprotect(_bpkt)
+                                        _decrypted = True
                                     except Exception as _srx_dec_e:
                                         _ec = getattr(
                                             _bridge_fn, '_decrypt_err_n', 0)
@@ -4195,8 +4376,9 @@ class _SdesOpenMixin:
                             # can inject sprop-parameter-sets (out-of-band decoder
                             # init, robust to in-band SPS loss).  Parses only until
                             # both are seen; then _sprop_done short-circuits.
-                            if (_kind == "video"
-                                    and not getattr(_bridge_fn, "_sprop_done", False)):
+                            if _should_capture_sprop(
+                                    _kind, _decrypted,
+                                    getattr(_bridge_fn, "_sprop_done", False)):
                                 _ps = _extract_param_sets_from_rtp(_fwd_pkt)
                                 if _ps:
                                     _psc = getattr(_bridge_fn, "_ps_cache", None)

{python_aidot_cameras-0.17.0 → python_aidot_cameras-0.17.2}/aidot_cameras/camera/webrtc_open.py

@@ -145,6 +145,43 @@ async def _wait_or_event(ev: "asyncio.Event", timeout: float) -> bool:
         return False
 
 
+def _is_camera_present_signal(topic, msg, device_id):
+    """Whether this inbound MQTT message releases the pre-offer wake wait.
+
+    Two of these clauses recognise the camera's own device-channel traffic and
+    were missing.  The client subscribes to iot/v1/cb/{device_id}/# but only
+    ever checked iot/v1/c/{device_id}/ ("c", no "b"), so no device-channel
+    topic matched; and wakeupStatus - the camera announcing it is awake -
+    carries no devId at top level or in payload, identifying itself only via
+    srcAddr ("2.{device_id}"), which nothing read.  Both additions are strictly
+    additive: they can only recognise more real camera traffic.
+
+    lowPowerActiveStateResp stays sufficient on its own, deliberately.  It is a
+    cloud ack, not the camera: published by the server (clientId "server-..."),
+    addressed to the user channel, carrying no devId, and arriving in ~60 ms
+    whatever the camera is doing.  Waiting for the camera instead was tried and
+    rejected - the official app does not do it.  In the decompiled client,
+    DeviceWakeUpRepos.wakeUpOrSleep fires the MQTT wake fire-and-forget (its
+    handler has no emitter at all) and completes the wake step from the HTTP
+    lowPowerActiveState response: DeviceWakeUpRepos$1.onSuccess calls
+    onNext + onComplete on BOTH the valid and invalid branches.  The string
+    "wakeupStatus" does not appear anywhere in the app.  So publishing the
+    offer on a cloud ack is app behaviour, and holding a battery camera back
+    for device evidence would be a new, unvalidated divergence on the shared
+    open path.
+    """
+    inner = msg.get("payload") or {}
+    return bool(
+        topic.startswith(f"iot/v1/cb/{device_id}/")
+        or topic.startswith(f"iot/v1/c/{device_id}/")
+        or topic.startswith(f"lds/v1/cb/{device_id}/")
+        or inner.get("devId") == device_id
+        or msg.get("devId") == device_id
+        or str(msg.get("srcAddr") or "").endswith(device_id)
+        or (msg.get("method") or "") == "lowPowerActiveStateResp"
+    )
+
+
 class _WebRTCOpenMixin:
     async def _async_open_webrtc_stream_impl(
         self,
@@ -668,17 +705,10 @@ class _WebRTCOpenMixin:
                 return
             method = msg.get("method") or ""
             inner  = msg.get("payload") or {}
-            # Fire camera_ready_ev the moment the camera appears on MQTT - either via its
-            # explicit wake-ACK (lowPowerActiveStateResp), any message on the device channel,
-            # OR any message on the user channel whose payload identifies our device.
-            # LK.IPC.A001064 (and similar) responds on the user channel (iot/v1/c/{userId}/...)
-            # rather than the device channel, so the old topic-prefix check never fired -
-            # causing the 17-second getIceConfigReq timeout overhead every session.
-            if (method == "lowPowerActiveStateResp"
-                    or topic.startswith(f"iot/v1/c/{device_id}/")
-                    or topic.startswith(f"lds/v1/cb/{device_id}/")
-                    or inner.get("devId") == device_id
-                    or msg.get("devId") == device_id):
+            # Fire camera_ready_ev the moment the camera appears on MQTT.  See
+            # _is_camera_present_signal for what counts as evidence and why the
+            # server's wake-ACK is not enough for a battery camera.
+            if _is_camera_present_signal(topic, msg, device_id):
                 loop.call_soon_threadsafe(camera_ready_ev.set)
             # livePlayResp: explicit camera ack/nack for start-play command.
             # The camera echoes our peer_id (verified live); its payload has NO