From 6a05a88053cfeac46f3a999dc4d874872362938e Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <andrew@tridgell.net>
Date: Tue, 4 Aug 2026 17:29:11 +1000
Subject: [PATCH 1/6] websocket: reframe for streaming, not one MAVLink packet
 at a time

The implementation was written for MAVLink, where a message is at most
280 bytes and the peer always speaks first. Video moves megabytes a
second through the same code and broke every one of those assumptions.

Fixed: the handshake matched the literal "GET / HTTP/1.1", so any other
path was refused; the pending buffer was 1024 bytes, which dropped any
frame larger than ~1017; the payload was assembled in a variable-length
array sized from the wire, so the peer chose a stack allocation; a short
write returned 0, which the caller read as failure and tore the
connection down; and recv() silently discarded the remainder when the
caller's buffer was smaller than the frame.

Framing now happens once into a queue with a sent-offset, so a partial
write resumes instead of re-sending a header, and fragmentation, ping
and close are handled rather than assumed absent.
---
 tests/test_websocket_framing.py | 206 +++++++++++++
 websocket.cpp                   | 508 ++++++++++++++++++++++----------
 websocket.h                     |  46 ++-
 3 files changed, 592 insertions(+), 168 deletions(-)
 create mode 100644 tests/test_websocket_framing.py

diff --git a/tests/test_websocket_framing.py b/tests/test_websocket_framing.py
new file mode 100644
index 0000000..cdcca6f
--- /dev/null
+++ b/tests/test_websocket_framing.py
@@ -0,0 +1,206 @@
+"""WebSocket framing tests for the cases the MAVLink path never exercised.
+
+MAVLink frames are under 300 bytes and arrive one per segment, so the
+original implementation could get away with a fixed 1 KiB buffer, no
+fragmentation handling and no control-frame handling. Video traffic hits
+all three. These tests pin the corrected behaviour.
+
+Each test uses a ping/pong round trip as the liveness probe. That is a
+deliberately strong assertion: a pong only comes back if the proxy
+consumed *exactly* the right number of bytes for everything sent before
+it, so it detects framing desync as well as connection loss.
+"""
+import base64
+import os
+import socket
+import struct
+import time
+
+import pytest
+
+from test_config import TEST_PORT_ENGINEER
+from test_connections import BaseConnectionTest
+
+# Server->client frames are never masked, so a mask of zero is only used
+# on the client->server side here, where the RFC requires one.
+_ZERO_MASK = b"\x00\x00\x00\x00"
+
+
+def _ws_handshake(s, target="/"):
+    key = base64.b64encode(b"x" * 16).decode()
+    req = (
+        f"GET {target} HTTP/1.1\r\n"
+        "Host: localhost\r\n"
+        "Upgrade: websocket\r\n"
+        "Connection: Upgrade\r\n"
+        f"Sec-WebSocket-Key: {key}\r\n"
+        "Sec-WebSocket-Version: 13\r\n"
+        "\r\n"
+    ).encode()
+    s.sendall(req)
+    s.settimeout(5.0)
+    buf = b""
+    while b"\r\n\r\n" not in buf:
+        chunk = s.recv(4096)
+        if not chunk:
+            break
+        buf += chunk
+    assert b"101" in buf, f"no 101 Switching Protocols: {buf!r}"
+
+
+def _frame(opcode, payload=b"", fin=True, masked=True):
+    """Build a client->server frame with a zero mask (payload unchanged)."""
+    b0 = (0x80 if fin else 0x00) | opcode
+    n = len(payload)
+    mask_bit = 0x80 if masked else 0x00
+    if n <= 125:
+        hdr = bytes([b0, mask_bit | n])
+    elif n <= 0xFFFF:
+        hdr = bytes([b0, mask_bit | 126]) + struct.pack(">H", n)
+    else:
+        hdr = bytes([b0, mask_bit | 127]) + struct.pack(">Q", n)
+    if masked:
+        hdr += _ZERO_MASK
+    return hdr + payload
+
+
+def _read_frame(s, timeout=5.0):
+    """Read one server->client frame. Returns (opcode, payload) or None."""
+    s.settimeout(timeout)
+    buf = b""
+
+    def _need(k):
+        nonlocal buf
+        while len(buf) < k:
+            chunk = s.recv(4096)
+            if not chunk:
+                return False
+            buf += chunk
+        return True
+
+    if not _need(2):
+        return None
+    opcode = buf[0] & 0x0F
+    ln = buf[1] & 0x7F
+    pos = 2
+    if ln == 126:
+        if not _need(4):
+            return None
+        ln = struct.unpack(">H", buf[2:4])[0]
+        pos = 4
+    elif ln == 127:
+        if not _need(10):
+            return None
+        ln = struct.unpack(">Q", buf[2:10])[0]
+        pos = 10
+    # server->client frames must not be masked
+    assert (buf[1] & 0x80) == 0, "server masked a frame"
+    if not _need(pos + ln):
+        return None
+    return opcode, buf[pos:pos + ln]
+
+
+def _connect():
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.settimeout(5.0)
+    s.connect(("127.0.0.1", TEST_PORT_ENGINEER))
+    return s
+
+
+def _assert_alive(s, token):
+    """Ping/pong round trip: proves the link is up AND framing is in sync."""
+    s.sendall(_frame(0x9, token))
+    got = _read_frame(s)
+    assert got is not None, "no pong: connection closed"
+    assert got[0] == 0xA, f"expected pong (0xA), got opcode 0x{got[0]:x}"
+    assert got[1] == token, f"pong payload mismatch: {got[1]!r} != {token!r}"
+
+
+class TestWebSocketFraming(BaseConnectionTest):
+
+    def test_ping_gets_pong(self, test_server):
+        """Control frames are answered rather than passed to MAVLink."""
+        s = _connect()
+        try:
+            _ws_handshake(s)
+            _assert_alive(s, b"probe-1")
+        finally:
+            s.close()
+
+    @pytest.mark.parametrize("size", [2000, 16384, 65536],
+                             ids=["2k", "16k", "64k"])
+    def test_large_frame_does_not_kill_connection(self, test_server, size):
+        """Frames beyond the old 1 KiB pending[] used to fail the link.
+
+        The payload is not valid MAVLink -- it gets parsed and discarded.
+        What matters is that the connection survives and stays in sync.
+        """
+        s = _connect()
+        try:
+            _ws_handshake(s)
+            s.sendall(_frame(0x2, b"\x00" * size))
+            _assert_alive(s, b"after-large")
+        finally:
+            s.close()
+
+    def test_fragmented_message_reassembled(self, test_server):
+        """A message split across continuation frames must be consumed whole."""
+        s = _connect()
+        try:
+            _ws_handshake(s)
+            part = b"\x11" * 4096
+            s.sendall(_frame(0x2, part, fin=False))       # first fragment
+            s.sendall(_frame(0x0, part, fin=False))       # continuation
+            s.sendall(_frame(0x0, part, fin=True))        # final
+            _assert_alive(s, b"after-frag")
+        finally:
+            s.close()
+
+    def test_interleaved_ping_during_fragments(self, test_server):
+        """A control frame may arrive between fragments (RFC 6455 s5.4)."""
+        s = _connect()
+        try:
+            _ws_handshake(s)
+            s.sendall(_frame(0x2, b"\x22" * 1000, fin=False))
+            _assert_alive(s, b"mid-frag")
+            s.sendall(_frame(0x0, b"\x22" * 1000, fin=True))
+            _assert_alive(s, b"post-frag")
+        finally:
+            s.close()
+
+    def test_unmasked_client_frame_rejected(self, test_server):
+        """RFC 6455 s5.1 requires client->server frames to be masked."""
+        s = _connect()
+        try:
+            _ws_handshake(s)
+            s.sendall(_frame(0x2, b"unmasked payload", masked=False))
+            time.sleep(0.3)
+            # The proxy must drop us; a pong would mean it accepted it.
+            s.settimeout(3.0)
+            try:
+                data = s.recv(4096)
+            except socket.timeout:
+                pytest.fail("proxy neither closed nor responded to an "
+                            "unmasked frame")
+            assert data == b"", \
+                f"expected connection close, got {data!r}"
+        finally:
+            s.close()
+
+        self.assert_with_proxy_log(
+            test_server, test_server.proc.poll() is None,
+            "supportproxy died on an unmasked frame (should just drop the "
+            "connection)")
+
+    def test_handshake_accepts_path_and_query(self, test_server):
+        """detect()/handshake must not require the literal 'GET / HTTP/1.1'.
+
+        Video viewers connect to targets like /v1?token=... -- the old
+        exact-prefix match rejected those outright.
+        """
+        s = _connect()
+        try:
+            _ws_handshake(s, target="/v1?token=abc123")
+            _assert_alive(s, b"pathy")
+        finally:
+            s.close()
diff --git a/websocket.cpp b/websocket.cpp
index 3fc7c94..6e9fc48 100644
--- a/websocket.cpp
+++ b/websocket.cpp
@@ -19,18 +19,34 @@
 #define SSL_CERT_DIR "./"
 #endif
 
-static const char *ws_prefix = "GET / HTTP/1.1";
+// Only the method token is matched, not a whole request line: the target
+// may be any path/query ("/", "/v1?token=..."), and matching a literal
+// "GET / HTTP/1.1" would reject those. "GET " is still unambiguous against
+// the alternatives on this port -- a raw MAVLink2 frame starts 0xFD (v1
+// 0xFE) and a TLS ClientHello 0x16.
+static const char *ws_prefix = "GET ";
 static uint8_t wss_prefix[] { 0x16, 0x03, 0x01 };
 
+// WebSocket opcodes (RFC 6455 s5.2)
+#define WS_OP_CONT  0x0
+#define WS_OP_TEXT  0x1
+#define WS_OP_BIN   0x2
+#define WS_OP_CLOSE 0x8
+#define WS_OP_PING  0x9
+#define WS_OP_PONG  0xA
+
+// Read chunk when pulling from the socket.
+#define WS_READ_CHUNK 16384
+
 /*
   see if this could be a WebSocket connection by looking at the first
   packet
  */
 ws_detect_t WebSocket::detect(int fd)
 {
-    const size_t ws_len = strlen(ws_prefix);          // 14 ("GET / HTTP/1.1")
+    const size_t ws_len = strlen(ws_prefix);          // 4 ("GET ")
     const size_t wss_len = sizeof(wss_prefix);        // 3 (TLS ClientHello)
-    uint8_t peekbuf[14] {};
+    uint8_t peekbuf[8] {};
 
     ssize_t peekn = ::recv(fd, peekbuf, sizeof(peekbuf), MSG_PEEK);
     if (peekn <= 0) {
@@ -47,12 +63,12 @@ ws_detect_t WebSocket::detect(int fd)
 	return WS_MORE;   // matches so far, need more to be sure
     }
 
-    // HTTP upgrade (ws). NOTE: ws_prefix is a char*, so its length is
-    // strlen(), not sizeof() — the old sizeof() admitted an 8-byte
-    // prefix and then strncmp'd 14 bytes against a half-filled buffer,
-    // misclassifying a fragmented "GET / HTTP/1.1" as raw MAVLink.
+    // HTTP upgrade (ws). ws_prefix is a char*, so its length is strlen(),
+    // not sizeof() -- the old sizeof() admitted an 8-byte prefix and then
+    // compared against a half-filled buffer, misclassifying a fragmented
+    // request as raw MAVLink.
     const size_t ws_cmp = n < ws_len ? n : ws_len;
-    if (strncmp(ws_prefix, (const char *)peekbuf, ws_cmp) == 0) {
+    if (memcmp(ws_prefix, peekbuf, ws_cmp) == 0) {
 	if (n >= ws_len) {
 	    return WS_YES;
 	}
@@ -68,10 +84,11 @@ ws_detect_t WebSocket::detect(int fd)
 /*
   constructor
  */
-WebSocket::WebSocket(int _fd)
+WebSocket::WebSocket(int _fd, size_t _max_message) :
+    max_message(_max_message)
 {
     fd = _fd;
-    uint8_t peekbuf[14] {};
+    uint8_t peekbuf[8] {};
 
     const ssize_t peekn = ::recv(fd, peekbuf, sizeof(peekbuf), MSG_PEEK);
     if (peekn >= ssize_t(sizeof(wss_prefix)) && memcmp(wss_prefix, peekbuf, sizeof(wss_prefix)) == 0) {
@@ -127,20 +144,48 @@ WebSocket::~WebSocket()
 
 void WebSocket::check_headers(void)
 {
-    auto len = strnlen((const char *)pending, npending);
+    // Headers end at the first blank line. Without waiting for the full
+    // terminator a fragmented request could be parsed with a truncated
+    // (or absent) key.
+    static const char terminator[] = "\r\n\r\n";
+    if (rx.size() < 4) {
+        return;
+    }
+    const uint8_t *end = nullptr;
+    for (size_t i = 0; i + 4 <= rx.size(); i++) {
+        if (memcmp(&rx[i], terminator, 4) == 0) {
+            end = &rx[i] + 4;
+            break;
+        }
+    }
+    if (end == nullptr) {
+        return;
+    }
+    const size_t header_bytes = size_t(end - rx.data());
+    std::string headers(reinterpret_cast<const char *>(rx.data()), header_bytes);
+
+    // Request target from "GET <target> HTTP/1.1", for path routing.
+    const size_t sp1 = headers.find(' ');
+    if (sp1 != std::string::npos) {
+        const size_t sp2 = headers.find(' ', sp1 + 1);
+        if (sp2 != std::string::npos) {
+            req_target = headers.substr(sp1 + 1, sp2 - sp1 - 1);
+        }
+    }
 
-    // parse Sec-WebSocket-Key from HTTP headers
-    std::string headers(reinterpret_cast<const char *>(pending), len);
     std::string key_marker = "Sec-WebSocket-Key: ";
     size_t key_pos = headers.find(key_marker);
     if (key_pos != std::string::npos) {
         key_pos += key_marker.length();
-        size_t end = headers.find("\r\n", key_pos);
-        if (end != std::string::npos) {
-            std::string sec_key = headers.substr(key_pos, end - key_pos);
+        size_t hend = headers.find("\r\n", key_pos);
+        if (hend != std::string::npos) {
+            std::string sec_key = headers.substr(key_pos, hend - key_pos);
             if (send_handshake(sec_key)) {
                 done_headers = true;
-                npending = 0;
+                // Drop only the header bytes: a client may pipeline its
+                // first frame into the same segment, and discarding the
+                // whole buffer would lose it.
+                rx.erase(rx.begin(), rx.begin() + header_bytes);
                 printf("WebSocket: done headers\n");
             }
         }
@@ -152,117 +197,198 @@ void WebSocket::check_headers(void)
  */
 void WebSocket::fill_pending(void)
 {
-    // ensure always null terminated
-    auto space = (sizeof(pending)-1) - npending;
-    if (fd >= 0 && space > 0) {
-        ssize_t n = 0;
-        if (ssl) {
-            if (!SSL_handshake_complete) {
-                auto res = SSL_accept(ssl);
-                if (res <= 0) {
-                    int err = SSL_get_error(ssl, res);
-                    if (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE) {
-                        // still pending
-                        return;
-                    }
-                    ERR_print_errors_fp(stdout);
-                    fd = -1;  // owner closes the socket
-                    return;
-                }
-                printf("SSL handshake completed\n");
-                SSL_handshake_complete = true;
-            }
-            n = SSL_read(ssl, &pending[npending], space);
-            if (n <= 0) {
-                int err = SSL_get_error(ssl, n);
+    if (fd < 0) {
+        return;
+    }
+    // Bound the raw buffer too: a peer that never completes a frame must
+    // not be able to make us grow without limit.
+    if (rx.size() > max_message + 64) {
+        printf("WebSocket: receive buffer overflow\n");
+        fd = -1;
+        return;
+    }
+    const size_t off = rx.size();
+    rx.resize(off + WS_READ_CHUNK);
+    ssize_t n = 0;
+    if (ssl) {
+        if (!SSL_handshake_complete) {
+            auto res = SSL_accept(ssl);
+            if (res <= 0) {
+                int err = SSL_get_error(ssl, res);
+                rx.resize(off);
                 if (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE) {
-                    return;
-                }
-                if (err == SSL_ERROR_ZERO_RETURN) {
-                    // orderly shutdown
-                    fd = -1;  // owner closes the socket
+                    // still pending
                     return;
                 }
                 ERR_print_errors_fp(stdout);
                 fd = -1;  // owner closes the socket
                 return;
             }
-        } else {
-            n = ::recv(fd, &pending[npending], space, 0);
-            if (n < 0) {
-                if (errno == EAGAIN || errno == EWOULDBLOCK) {
-                    return;
-                }
-                fd = -1;  // owner closes the socket
+            printf("SSL handshake completed\n");
+            SSL_handshake_complete = true;
+        }
+        n = SSL_read(ssl, &rx[off], WS_READ_CHUNK);
+        if (n <= 0) {
+            int err = SSL_get_error(ssl, n);
+            rx.resize(off);
+            if (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE) {
                 return;
             }
-            if (n == 0) {
-                // EOF
+            if (err == SSL_ERROR_ZERO_RETURN) {
+                // orderly shutdown
                 fd = -1;  // owner closes the socket
                 return;
             }
+            ERR_print_errors_fp(stdout);
+            fd = -1;  // owner closes the socket
+            return;
+        }
+    } else {
+        n = ::recv(fd, &rx[off], WS_READ_CHUNK, 0);
+        if (n < 0) {
+            rx.resize(off);
+            if (errno == EAGAIN || errno == EWOULDBLOCK) {
+                return;
+            }
+            fd = -1;  // owner closes the socket
+            return;
+        }
+        if (n == 0) {
+            // EOF
+            rx.resize(off);
+            fd = -1;  // owner closes the socket
+            return;
         }
-        npending += n;
     }
+    rx.resize(off + size_t(n));
 }
 
 /*
-  decode an incoming WebSocket packet and overwrite buf with the decoded data
-  return the number of decoded payload bytes, -1 if the frame is
-  incomplete (wait for more data), or -2 if the frame can never be
-  decoded (it doesn't fit in pending[]; the stream is unrecoverable)
+  Decode complete frames out of rx, appending payload to msg.
+
+  Handles fragmentation (continuation frames until FIN) and control
+  frames (ping is answered, close ends the stream, pong ignored) rather
+  than passing them to the caller as if they were data.
+
+  Returns false if the stream is unrecoverable and the connection must
+  be failed.
  */
-ssize_t WebSocket::decode(uint8_t *buf, size_t n, size_t &used)
+bool WebSocket::decode_frames(void)
 {
-    if (n < 2) return -1;
-
-    // NOTE: opcode currently unused, reserved for future handling of ping/close/etc.
-    [[maybe_unused]] uint8_t opcode = buf[0] & 0x0F;
-    bool masked = buf[1] & 0x80;
-    uint64_t payload_len = buf[1] & 0x7F;
-    size_t pos = 2;
-
-    if (payload_len == 126) {
-        if (n < 4) return -1;
-        payload_len = ntohs(*(uint16_t *)(buf + pos));
-        pos += 2;
-    } else if (payload_len == 127) {
-        if (n < 10) return -1;
-        payload_len = be64toh(*(uint64_t *)(buf + pos));
-        pos += 8;
-    }
-
-    // bound payload_len before the completeness checks below: pending[] is
-    // fixed-size, and an attacker-supplied payload_len near UINT64_MAX would
-    // wrap "pos + 4 + payload_len" to a small number, letting the check pass.
-    // fill_pending() keeps one byte for a NUL, so a frame needing more than
-    // sizeof(pending)-1 bytes can never complete: waiting for more data
-    // would wedge the connection forever, so fail it instead.
-    const size_t mask_bytes = masked ? 4 : 0;
-    if (payload_len > (sizeof(pending)-1) - pos - mask_bytes) {
-        return -2;
-    }
-
-    if (masked) {
-	if (n < pos + 4 + payload_len) {
-	    return -1;
-	}
-	uint8_t mask[4];
-	memcpy(mask, buf + pos, 4);
-	pos += 4;
-	for (size_t i = 0; i < payload_len; i++) {
-	    buf[i] = buf[pos + i] ^ mask[i % 4];
-	}
-    } else {
-	if (n < pos + payload_len) {
-	    return -1;
-	}
-        memmove(buf, buf + pos, payload_len);
-    }
+    size_t pos = 0;
+    for (;;) {
+        if (rx.size() - pos < 2) {
+            break;
+        }
+        const uint8_t *f = &rx[pos];
+        const bool fin = (f[0] & 0x80) != 0;
+        const uint8_t opcode = f[0] & 0x0F;
+        const bool masked = (f[1] & 0x80) != 0;
+        uint64_t payload_len = f[1] & 0x7F;
+        size_t hdr = 2;
+
+        if (payload_len == 126) {
+            if (rx.size() - pos < 4) break;
+            // assemble by hand: casting the buffer to uint16_t* is
+            // undefined for an unaligned address and trips -Wcast-align
+            payload_len = (uint64_t(f[2]) << 8) | uint64_t(f[3]);
+            hdr = 4;
+        } else if (payload_len == 127) {
+            if (rx.size() - pos < 10) break;
+            payload_len = 0;
+            for (int i = 0; i < 8; i++) {
+                payload_len = (payload_len << 8) | uint64_t(f[2 + i]);
+            }
+            hdr = 10;
+        }
+
+        // Bound before any addition: an attacker-supplied length near
+        // UINT64_MAX would otherwise wrap the completeness check below.
+        if (payload_len > max_message) {
+            printf("WebSocket: frame of %llu bytes exceeds limit\n",
+                   (unsigned long long)payload_len);
+            return false;
+        }
+        // RFC 6455 s5.1: client-to-server frames MUST be masked.
+        if (!masked) {
+            printf("WebSocket: unmasked client frame rejected\n");
+            return false;
+        }
+        // Control frames must be short and unfragmented (s5.5).
+        const bool is_control = (opcode & 0x8) != 0;
+        if (is_control && (payload_len > 125 || !fin)) {
+            printf("WebSocket: malformed control frame\n");
+            return false;
+        }
+
+        const size_t need = hdr + 4 + size_t(payload_len);
+        if (rx.size() - pos < need) {
+            break;   // incomplete; wait for more
+        }
+
+        uint8_t mask[4];
+        memcpy(mask, f + hdr, 4);
+        uint8_t *payload = &rx[pos + hdr + 4];
+        for (size_t i = 0; i < payload_len; i++) {
+            payload[i] ^= mask[i % 4];
+        }
+
+        switch (opcode) {
+        case WS_OP_CLOSE:
+            // Echo the close and stop; the owner closes the socket.
+            if (!sent_close) {
+                queue_frame(WS_OP_CLOSE, payload, size_t(payload_len));
+                sent_close = true;
+                flush();
+            }
+            return false;
+        case WS_OP_PING:
+            queue_frame(WS_OP_PONG, payload, size_t(payload_len));
+            flush();
+            break;
+        case WS_OP_PONG:
+            break;   // unsolicited pongs are legal and ignored
+        case WS_OP_CONT:
+            if (!in_fragment) {
+                printf("WebSocket: continuation with no message open\n");
+                return false;
+            }
+            if (msg.size() + payload_len > max_message) {
+                printf("WebSocket: fragmented message exceeds limit\n");
+                return false;
+            }
+            msg.insert(msg.end(), payload, payload + payload_len);
+            if (fin) {
+                in_fragment = false;
+            }
+            break;
+        case WS_OP_TEXT:
+        case WS_OP_BIN:
+            if (in_fragment) {
+                printf("WebSocket: new message while one is open\n");
+                return false;
+            }
+            if (msg.size() + payload_len > max_message) {
+                printf("WebSocket: message exceeds limit\n");
+                return false;
+            }
+            msg.insert(msg.end(), payload, payload + payload_len);
+            if (!fin) {
+                in_fragment = true;
+            }
+            break;
+        default:
+            printf("WebSocket: unknown opcode 0x%x\n", unsigned(opcode));
+            return false;
+        }
 
-    used = pos + payload_len;
+        pos += need;
+    }
 
-    return payload_len;
+    if (pos > 0) {
+        rx.erase(rx.begin(), rx.begin() + pos);
+    }
+    return true;
 }
 
 /*
@@ -344,67 +470,110 @@ bool WebSocket::send_handshake(const std::string &key)
 }
 
 /*
-  encode a packet onto a connected WebSocket
+  append a framed message to the output queue
  */
-ssize_t WebSocket::send(const void *buf, size_t n)
+void WebSocket::queue_frame(uint8_t opcode, const void *data, size_t n)
 {
-    if (!done_headers) {
-	// The HTTP upgrade response hasn't been sent yet. Writing a
-	// MAVLink frame onto the socket now would land *before* the
-	// "HTTP/1.1 101" line and corrupt the handshake (the peer's WS
-	// parser sees binary garbage as the status line). Drop the
-	// frame but report it as sent so the caller doesn't treat it as
-	// a dead link and tear the session down; the handshake
-	// completes on the next read and forwarding resumes.
-	return n;
-    }
     uint8_t header[10];
-    size_t header_len = 0;
-    header[0] = 0x82; // FIN + binary opcode
+    size_t header_len;
+    header[0] = uint8_t(0x80 | opcode);   // FIN + opcode
 
     if (n <= 125) {
-        header[1] = n;
+        header[1] = uint8_t(n);
         header_len = 2;
     } else if (n <= 65535) {
         header[1] = 126;
-        *(uint16_t *)(header + 2) = htons(n);
+        header[2] = uint8_t((n >> 8) & 0xFF);
+        header[3] = uint8_t(n & 0xFF);
         header_len = 4;
     } else {
         header[1] = 127;
-        *(uint64_t *)(header + 2) = htobe64(n);
+        for (int i = 0; i < 8; i++) {
+            header[2 + i] = uint8_t((uint64_t(n) >> (56 - 8*i)) & 0xFF);
+        }
         header_len = 10;
     }
 
-    uint8_t pkt[header_len + n];
-    memcpy(pkt, header, header_len);
-    memcpy(&pkt[header_len], buf, n);
+    // Drop the fully-flushed prefix first so tx doesn't grow forever on
+    // a long-lived link.
+    if (tx_sent > 0 && tx_sent == tx.size()) {
+        tx.clear();
+        tx_sent = 0;
+    }
+    tx.insert(tx.end(), header, header + header_len);
+    const uint8_t *p = static_cast<const uint8_t *>(data);
+    tx.insert(tx.end(), p, p + n);
+}
 
-    ssize_t sent;
-    if (_is_SSL && ssl) {
-        sent = SSL_write(ssl, pkt, sizeof(pkt));
-        if (sent <= 0) {
-            int err = SSL_get_error(ssl, sent);
-            if (err == SSL_ERROR_WANT_WRITE || err == SSL_ERROR_WANT_READ) {
-                return 0; // try again later
+/*
+  push queued output to the socket
+ */
+bool WebSocket::flush(void)
+{
+    while (tx_sent < tx.size()) {
+        const size_t remain = tx.size() - tx_sent;
+        ssize_t wret;
+        if (_is_SSL && ssl) {
+            wret = SSL_write(ssl, &tx[tx_sent], int(remain));
+            if (wret <= 0) {
+                int err = SSL_get_error(ssl, wret);
+                if (err == SSL_ERROR_WANT_WRITE || err == SSL_ERROR_WANT_READ) {
+                    return true;   // stays queued
+                }
+                ERR_print_errors_fp(stdout);
+                fd = -1;
+                return false;
             }
-            ERR_print_errors_fp(stdout);
-            fd = -1;  // owner closes the socket
-            return -1;
-        }
-    } else {
-        sent = ::send(fd, pkt, sizeof(pkt), 0);
-        if (sent < 0) {
-            if (errno == EAGAIN || errno == EWOULDBLOCK) {
-                return 0;
+        } else {
+            wret = ::send(fd, &tx[tx_sent], remain, 0);
+            if (wret < 0) {
+                if (errno == EAGAIN || errno == EWOULDBLOCK) {
+                    return true;   // stays queued
+                }
+                fd = -1;
+                return false;
             }
-            fd = -1;  // owner closes the socket
-            return -1;
         }
+        tx_sent += size_t(wret);
+    }
+    tx.clear();
+    tx_sent = 0;
+    return true;
+}
+
+/*
+  encode a packet onto a connected WebSocket
+ */
+ssize_t WebSocket::send(const void *buf, size_t n)
+{
+    if (!done_headers) {
+	// The HTTP upgrade response hasn't been sent yet. Writing a
+	// MAVLink frame onto the socket now would land *before* the
+	// "HTTP/1.1 101" line and corrupt the handshake (the peer's WS
+	// parser sees binary garbage as the status line). Drop the
+	// frame but report it as sent so the caller doesn't treat it as
+	// a dead link and tear the session down; the handshake
+	// completes on the next read and forwarding resumes.
+	return n;
+    }
+    if (fd < 0) {
+        return -1;
     }
-    if (sent < ssize_t(sizeof(pkt))) {
-        return 0; // partial; retry later
+    // Queue-then-flush rather than write-and-hope. Previously a short
+    // write returned 0, which send_message() reports as failure and the
+    // caller turns into a connection teardown -- so a momentarily full
+    // socket killed the session. Framing once into tx and tracking
+    // tx_sent means a partial write simply resumes where it left off.
+    if (tx.size() - tx_sent > WS_MAX_TX_QUEUE) {
+        printf("WebSocket: output queue full, dropping connection\n");
+        fd = -1;
+        return -1;
     }
-    return sizeof(pkt) - header_len;
+    queue_frame(WS_OP_BIN, buf, n);
+    if (!flush()) {
+        return -1;
+    }
+    return n;
 }
 
 /*
@@ -412,6 +581,21 @@ ssize_t WebSocket::send(const void *buf, size_t n)
  */
 ssize_t WebSocket::recv(void *buf, size_t n)
 {
+    // Hand back anything already decoded before reading more, so a
+    // caller with a small buffer drains a large message across calls
+    // instead of losing the remainder.
+    if (msg_taken < msg.size()) {
+        const size_t avail = msg.size() - msg_taken;
+        const size_t take = n < avail ? n : avail;
+        memcpy(buf, &msg[msg_taken], take);
+        msg_taken += take;
+        if (msg_taken == msg.size()) {
+            msg.clear();
+            msg_taken = 0;
+        }
+        return ssize_t(take);
+    }
+
     fill_pending();
     if (fd < 0) {
 	return -1;
@@ -425,22 +609,20 @@ ssize_t WebSocket::recv(void *buf, size_t n)
 	    return 0;
 	}
     }
-    size_t used;
-    auto decode_len = decode(pending, npending, used);
-    if (decode_len == -2) {
-	// unrecoverable frame; fail the connection so the owner closes it
-	fd = -1;  // owner closes the socket
-	return -1;
+    if (!decode_frames()) {
+        fd = -1;  // owner closes the socket
+        return -1;
     }
-    if (decode_len == -1) {
-	return 0;
+    // A message still being assembled from fragments isn't deliverable yet.
+    if (in_fragment || msg.empty()) {
+        return 0;
     }
-    if (ssize_t(n) > decode_len) {
-	n = decode_len;
+    const size_t take = n < msg.size() ? n : msg.size();
+    memcpy(buf, msg.data(), take);
+    msg_taken = take;
+    if (msg_taken == msg.size()) {
+        msg.clear();
+        msg_taken = 0;
     }
-
-    memcpy(buf, pending, n);
-    memmove(pending, &pending[used], npending-used);
-    npending -= used;
-    return n;
+    return ssize_t(take);
 }
diff --git a/websocket.h b/websocket.h
index f4b7e93..c8dd70f 100644
--- a/websocket.h
+++ b/websocket.h
@@ -7,6 +7,7 @@
 #include <stdint.h>
 #include <unistd.h>
 #include <string>
+#include <vector>
 #include <openssl/ssl.h>
 
 // Result of peeking at a new TCP stream's first bytes.
@@ -18,9 +19,18 @@
 //             misclassifies a fragmented handshake as raw MAVLink)
 enum ws_detect_t { WS_NO, WS_YES, WS_MORE };
 
+// Largest single WebSocket message we will reassemble. MAVLink frames are
+// <300 bytes; video sends 8-64 KiB. A message larger than this fails the
+// connection rather than being buffered without bound.
+#define WS_DEFAULT_MAX_MESSAGE (256*1024)
+
+// Cap on framed-but-unwritten output. A peer that stops reading must not
+// make us buffer without bound; past this we fail the connection.
+#define WS_MAX_TX_QUEUE (1024*1024)
+
 class WebSocket {
 public:
-    WebSocket(int fd);
+    explicit WebSocket(int fd, size_t max_message = WS_DEFAULT_MAX_MESSAGE);
     ~WebSocket();
 
     static ws_detect_t detect(int fd);
@@ -30,23 +40,49 @@ class WebSocket {
 	return _is_SSL;
     }
 
+    // Request target from the HTTP upgrade line ("/", "/v1?token=..."),
+    // empty until the handshake completes. Lets a caller route on path.
+    const std::string &request_target(void) const {
+        return req_target;
+    }
+
+    // Push queued output. Callers driving a write-ready event loop use
+    // this; send() also flushes opportunistically. False = link is dead.
+    bool flush(void);
+    bool has_pending_output(void) const {
+        return tx_sent < tx.size();
+    }
+
 private:
     int fd = -1;
     bool _is_SSL = false;
     bool SSL_handshake_complete = false;
-    uint8_t pending[1024] {};
-    uint32_t npending = 0;
     SSL *ssl = nullptr;
     SSL_CTX *ctx = nullptr;
     bool done_headers = false;
+    bool sent_close = false;
+
+    const size_t max_message;
+
+    std::vector<uint8_t> rx;        // raw bytes read off the socket
+    std::vector<uint8_t> msg;       // decoded payload not yet handed to caller
+    size_t msg_taken = 0;           // how much of msg the caller has consumed
+    bool in_fragment = false;       // mid multi-frame message
+
+    std::vector<uint8_t> tx;        // framed output
+    size_t tx_sent = 0;             // how much of tx has reached the socket
+
+    std::string req_target;
 
     char handshake_buf[512] {};
     size_t handshake_len = 0;
     size_t handshake_sent = 0;
 
-    
     void fill_pending(void);
     bool send_handshake(const std::string &key);
     void check_headers(void);
-    ssize_t decode(uint8_t *buf, size_t n, size_t &used);
+    // Pull complete frames out of rx into msg. Returns false if the
+    // stream is unrecoverable and the connection must be failed.
+    bool decode_frames(void);
+    void queue_frame(uint8_t opcode, const void *data, size_t n);
 };

From 8c89eb108b9b81c05a575464f815846ed8a7fc68 Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <andrew@tridgell.net>
Date: Tue, 4 Aug 2026 17:29:11 +1000
Subject: [PATCH 2/6] keydb/conntdb: video record fields, layout asserts and
 CLI

Grows KeyEntry 168 -> 344 bytes for the video settings: up to three
ports, per-slot options, viewer and publish keys, a disk budget, the
MAVLink grace window and a per-slot RTMP path. The append-only contract
holds in both directions -- readers zero-extend a short record, writers
preserve a tail they do not understand -- so old and new binaries
interoperate.

The layout was an unchecked ABI shared with keydb_lib.py's PACK_FORMAT.
It is now asserted: sizeof, every offset, and that int and float are
four bytes. Writing that revealed the same hazard in ConnEntry, where a
naively appended field lands at offset 60 inside padding that older
Python writers zero, with sizeof unchanged and no size check to catch
it -- so the padding is named and the video fields start at 64.

Cleanup gains a second budget rather than one shared pool. Video and
telemetry are deleted under the same retention but from separate
quotas, so a busy camera can never evict a user's tlogs.
---
 cleanup.cpp                | 157 +++++++++++--
 cleanup.h                  |  33 +++
 conntdb.cpp                |  50 ++++
 conntdb.h                  | 101 ++++++++
 conntdb_lib.py             |  67 +++++-
 keydb.h                    | 111 ++++++++-
 keydb.py                   | 140 +++++++++++
 keydb_lib.py               | 464 +++++++++++++++++++++++++++++++++++--
 session.cpp                |  24 +-
 tests/test_keydb_log.py    |  32 ++-
 tests/test_video_ports.py  | 300 ++++++++++++++++++++++++
 tests/test_video_schema.py | 202 ++++++++++++++++
 12 files changed, 1617 insertions(+), 64 deletions(-)
 create mode 100644 tests/test_video_ports.py
 create mode 100644 tests/test_video_schema.py

diff --git a/cleanup.cpp b/cleanup.cpp
index 9ad73a5..0230ca0 100644
--- a/cleanup.cpp
+++ b/cleanup.cpp
@@ -12,6 +12,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
+#include <sys/statvfs.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <time.h>
@@ -46,6 +47,50 @@ off_t port2_quota_bytes(void)
     return cached;
 }
 
+static off_t parse_quota_env(const char *name, off_t dflt)
+{
+    const char *env = getenv(name);
+    if (env == nullptr || *env == '\0') {
+        return dflt;
+    }
+    // strict: plain positive bytes only. A prefix parse would turn a
+    // well-meant "1GB" into a 1-byte quota and let the cleanup pass
+    // delete nearly the whole log tree.
+    char *endp = nullptr;
+    errno = 0;
+    long long v = strtoll(env, &endp, 10);
+    if (errno == 0 && endp != env && *endp == '\0' && v > 0) {
+        return off_t(v);
+    }
+    ::printf("ignoring invalid %s '%s' (want plain bytes); using %lld\n",
+             name, env, (long long)dflt);
+    return dflt;
+}
+
+off_t port2_video_quota_bytes(void)
+{
+    static off_t cached = -1;
+    if (cached < 0) {
+        cached = parse_quota_env("SUPPORTPROXY_PORT2_VIDEO_QUOTA_BYTES",
+                                 off_t(4) * 1024 * 1024 * 1024);
+    }
+    return cached;
+}
+
+bool video_have_free_space(const char *base_dir)
+{
+    struct statvfs vfs;
+    if (statvfs(base_dir, &vfs) != 0) {
+        return true;    // can't tell; don't block recording on it
+    }
+    const uint64_t free_bytes = uint64_t(vfs.f_bavail) * vfs.f_frsize;
+    const uint64_t total = uint64_t(vfs.f_blocks) * vfs.f_frsize;
+    const uint64_t floor_abs = uint64_t(2) * 1024 * 1024 * 1024;
+    const uint64_t floor_pct = total / 20;      // 5%
+    const uint64_t want = floor_abs > floor_pct ? floor_abs : floor_pct;
+    return free_bytes > want;
+}
+
 namespace {
 
 struct PassCtx {
@@ -54,16 +99,41 @@ struct PassCtx {
 };
 
 /*
-  Predicate for "this is a session file we should age out under
-  log_retention_days". Covers both .tlog (raw MAVLink frames) and
-  .bin (ArduPilot dataflash logs) so the retention rule is uniform —
-  per spec, both file types share the entry's retention setting.
+  What kind of session file this is.
+
+  Retention treats both kinds identically -- one per-entry setting
+  covers everything -- but the quota does not: video and telemetry get
+  independent budgets, because a shared pool sorted by mtime would let
+  a few minutes of video evict a whole flight's telemetry.
  */
+enum session_kind {
+    SESSION_NONE = 0,
+    SESSION_TELEM,      // .tlog, .bin
+    SESSION_VIDEO,      // .vN.ts
+};
+
+static session_kind session_file_kind(const char *name)
+{
+    const size_t n = strlen(name);
+    if (n > 5 && strcmp(name + n - 5, ".tlog") == 0) {
+        return SESSION_TELEM;
+    }
+    if (n > 4 && strcmp(name + n - 4, ".bin") == 0) {
+        return SESSION_TELEM;
+    }
+    // "<session>.v<slot>.ts" -- the slot is part of the name so the
+    // three slots of one entry never collide.
+    if (n > 6 && strcmp(name + n - 3, ".ts") == 0
+        && name[n - 6] == '.' && name[n - 5] == 'v'
+        && name[n - 4] >= '1' && name[n - 4] <= '9') {
+        return SESSION_VIDEO;
+    }
+    return SESSION_NONE;
+}
+
 static bool is_session_file(const char *name)
 {
-    size_t n = strlen(name);
-    return (n > 5 && strcmp(name + n - 5, ".tlog") == 0) ||
-           (n > 4 && strcmp(name + n - 4, ".bin")  == 0);
+    return session_file_kind(name) != SESSION_NONE;
 }
 
 /*
@@ -86,10 +156,31 @@ static bool is_session_file(const char *name)
 // still be unlinked, and a just-closed session is protected slightly
 // longer than needed. Both are acceptable: a healthy binlog/tlog
 // writes many times per second.
-static constexpr time_t ACTIVE_FILE_GRACE_S = 60;
+// Overridable for tests: with the default 60s, every segment a short
+// test writes is still "live" and none is evictable, so the quota pass
+// correctly frees nothing and the behaviour cannot be observed at all.
+static time_t active_file_grace_s(void)
+{
+    static time_t cached = -1;
+    if (cached >= 0) {
+        return cached;
+    }
+    cached = 60;
+    const char *env = getenv("SUPPORTPROXY_ACTIVE_FILE_GRACE");
+    if (env != nullptr && *env != '\0') {
+        char *endp = nullptr;
+        errno = 0;
+        long v = strtol(env, &endp, 10);
+        if (errno == 0 && endp != env && *endp == '\0' && v >= 0) {
+            cached = time_t(v);
+        }
+    }
+    return cached;
+}
 
-static void enforce_port2_quota(uint32_t port2, const char *base_dir,
-                                off_t needed = 0)
+static void enforce_quota(uint32_t port2, const char *base_dir,
+                          session_kind kind, off_t quota,
+                          off_t needed)
 {
     char port_dir[768];
     snprintf(port_dir, sizeof(port_dir), "%s/%u", base_dir, port2);
@@ -124,7 +215,8 @@ static void enforce_port2_quota(uint32_t port2, const char *base_dir,
         }
         struct dirent *fent;
         while ((fent = readdir(dd)) != nullptr) {
-            if (fent->d_name[0] == '.' || !is_session_file(fent->d_name)) {
+            if (fent->d_name[0] == '.'
+                || session_file_kind(fent->d_name) != kind) {
                 continue;
             }
             char fpath[1280];
@@ -137,7 +229,7 @@ static void enforce_port2_quota(uint32_t port2, const char *base_dir,
             // st_size wildly overstates what they cost on disk
             const off_t alloc = off_t(fst.st_blocks) * 512;
             total += alloc;
-            if (time(nullptr) - fst.st_mtime < ACTIVE_FILE_GRACE_S) {
+            if (time(nullptr) - fst.st_mtime < active_file_grace_s()) {
                 // live session file: count it, never delete it
                 continue;
             }
@@ -151,7 +243,6 @@ static void enforce_port2_quota(uint32_t port2, const char *base_dir,
     // can happen with total still at or just under the quota, and
     // without accounting for it here the pass would free nothing and
     // the caller's write would be dropped forever.
-    const off_t quota = port2_quota_bytes();
     if (total + needed <= quota) {
         return;
     }
@@ -168,9 +259,11 @@ static void enforce_port2_quota(uint32_t port2, const char *base_dir,
             break;
         }
         if (unlink(it.path.c_str()) == 0) {
-            ::printf("log cleanup: removed %s for quota "
+            ::printf("log cleanup: removed %s for %s quota "
                      "(port2=%u total %lld > %lld)\n",
-                     it.path.c_str(), unsigned(port2),
+                     it.path.c_str(),
+                     kind == SESSION_VIDEO ? "video" : "telemetry",
+                     unsigned(port2),
                      (long long)total, (long long)quota);
             total -= it.size;
             // Try rmdir on the date dir in case this was its last file;
@@ -247,17 +340,23 @@ static void retention_pass(uint32_t port2, double retention_days,
 }
 
 static void cleanup_for_port2(uint32_t port2, double retention_days,
+                              uint32_t video_quota_mb,
                               const char *base_dir, time_t now)
 {
-    // Two passes per port2:
+    // Passes per port2:
     //   1. retention_pass: per-entry "delete files older than the
-    //      configured retention". Skipped when retention=0 (keep
-    //      forever).
-    //   2. enforce_port2_quota: hard 1 GiB cap. Runs even if
-    //      retention=0, so even a "keep forever" entry can't fill
-    //      the disk.
+    //      configured retention", covering both kinds. Skipped when
+    //      retention=0 (keep forever).
+    //   2. one quota pass per kind, with independent budgets. Both run
+    //      even if retention=0, so even a "keep forever" entry cannot
+    //      fill the disk -- and video can never evict telemetry,
+    //      because it is never a candidate in the telemetry pass.
     retention_pass(port2, retention_days, base_dir, now);
-    enforce_port2_quota(port2, base_dir);
+    enforce_quota(port2, base_dir, SESSION_TELEM, port2_quota_bytes(), 0);
+    const off_t vquota = video_quota_mb != 0
+        ? off_t(video_quota_mb) * 1024 * 1024
+        : port2_video_quota_bytes();
+    enforce_quota(port2, base_dir, SESSION_VIDEO, vquota, 0);
 }
 
 static int traverse_cb(struct tdb_context *db, TDB_DATA key, TDB_DATA data, void *ptr)
@@ -279,7 +378,7 @@ static int traverse_cb(struct tdb_context *db, TDB_DATA key, TDB_DATA data, void
         return 0;
     }
     cleanup_for_port2(uint32_t(port2), double(k.log_retention_days),
-                      ctx->base_dir, ctx->now);
+                      k.video_quota_mb, ctx->base_dir, ctx->now);
     return 0;
 }
 
@@ -312,7 +411,17 @@ static void sleep_seconds(double s)
 void log_cleanup_port2_quota(unsigned port2, const char *base_dir,
                              off_t needed)
 {
-    enforce_port2_quota(port2, base_dir, needed);
+    // binlog's write-time gate: telemetry budget only. Freeing video
+    // here would let a .bin write delete a recording, which is exactly
+    // the cross-eviction the split budgets exist to prevent.
+    enforce_quota(port2, base_dir, SESSION_TELEM, port2_quota_bytes(), needed);
+}
+
+void log_cleanup_port2_video_quota(unsigned port2, const char *base_dir,
+                                   off_t quota, off_t needed)
+{
+    enforce_quota(port2, base_dir, SESSION_VIDEO,
+                  quota > 0 ? quota : port2_video_quota_bytes(), needed);
 }
 
 void log_cleanup_once(const char *base_dir)
diff --git a/cleanup.h b/cleanup.h
index f37b662..b95cd0d 100644
--- a/cleanup.h
+++ b/cleanup.h
@@ -13,6 +13,39 @@
  */
 off_t port2_quota_bytes(void);
 
+/*
+  Per-port-pair on-disk quota (bytes) for video segments. Separate from
+  the telemetry budget on purpose: video is orders of magnitude larger
+  per second than a tlog, and a single shared pool sorted by mtime would
+  let a few minutes of video evict a flight's telemetry. The two are
+  enforced independently so that cannot happen.
+
+  Default 4 GiB; override with SUPPORTPROXY_PORT2_VIDEO_QUOTA_BYTES.
+  A non-zero KeyEntry.video_quota_mb overrides both, per entry.
+
+  Sizing rule: the quota pass cannot delete the segment currently being
+  written (see ACTIVE_FILE_GRACE_S), so with segment duration S, grace G
+  and aggregate bitrate B the un-evictable working set is (S+G)*B, and
+  the budget needs to clear that with room to spare:
+      quota >= (S + G) * B / 0.8
+ */
+off_t port2_video_quota_bytes(void);
+
+/*
+  Refuse to start a new segment when the filesystem holding base_dir has
+  less than max(2 GiB, 5%) free. Per-entry quotas bound one entry; they
+  do nothing about N entries x 3 slots filling a disk between them.
+ */
+bool video_have_free_space(const char *base_dir);
+
+/*
+  Video equivalent of log_cleanup_port2_quota: free video segments for
+  this entry ahead of a write of `needed` bytes. `quota` of 0 means the
+  server default.
+ */
+void log_cleanup_port2_video_quota(unsigned port2, const char *base_dir,
+                                   off_t quota, off_t needed);
+
 /*
   Run forever: every SUPPORTPROXY_CLEANUP_INTERVAL seconds (default 3600,
   env var override accepts a float for tests), traverse keys.tdb and
diff --git a/conntdb.cpp b/conntdb.cpp
index 0d3a39f..0c1970b 100644
--- a/conntdb.cpp
+++ b/conntdb.cpp
@@ -196,6 +196,46 @@ int conn_delete_for_port2(TDB_CONTEXT *db, int port2)
     return n;
 }
 
+int conn_delete_index_range(TDB_CONTEXT *db, int port2, int lo, int hi)
+{
+    struct port2_filter f { port2, {} };
+    tdb_traverse(db, collect_port2, &f);
+    int n = 0;
+    for (auto &k : f.matches) {
+        if (k.conn_index < lo || k.conn_index > hi) {
+            continue;
+        }
+        TDB_DATA kd;
+        kd.dptr = (uint8_t *)&k;
+        kd.dsize = sizeof(k);
+        if (tdb_delete(db, kd) == 0) {
+            n++;
+        }
+    }
+    return n;
+}
+
+bool conn_get_user(TDB_CONTEXT *db, int port2, struct ConnEntry &out)
+{
+    struct ConnKey k;
+    auto kd = make_key(k, port2, 0);
+    auto d = tdb_fetch(db, kd);
+    if (d.dptr == nullptr) {
+        return false;
+    }
+    bool ok = false;
+    if (d.dsize >= CONNENTRY_MIN_SIZE) {
+        // zero-extend a record written by older code: `authenticated`
+        // then reads 0, which fails closed for bidi entries
+        memset(&out, 0, sizeof(out));
+        size_t copy = d.dsize < sizeof(out) ? d.dsize : sizeof(out);
+        memcpy(&out, d.dptr, copy);
+        ok = (out.magic == CONN_MAGIC && out.is_user != 0);
+    }
+    free(d.dptr);
+    return ok;
+}
+
 void conn_recreate_empty(void)
 {
     // Easiest way to nuke all records is to remove the file. tdb_open
@@ -218,3 +258,13 @@ void conn_remove_port2(int port2)
     conn_delete_for_port2(db, port2);
     conn_db_close_commit(db);
 }
+
+void conn_remove_video(int port2)
+{
+    auto *db = conn_db_open_transaction();
+    if (db == nullptr) {
+        return;
+    }
+    conn_delete_index_range(db, port2, VIDEO_CONN_INDEX_BASE, INT32_MAX);
+    conn_db_close_commit(db);
+}
diff --git a/conntdb.h b/conntdb.h
index b973121..15308ea 100644
--- a/conntdb.h
+++ b/conntdb.h
@@ -46,6 +46,30 @@
 //   matching slot, and deletes the record.
 #define CONN_FLAG_DROP_REQUESTED (1u << 0)
 
+// ConnEntry.role
+#define CONN_ROLE_MAVLINK   0
+#define CONN_ROLE_VIDEO_PUB 1
+#define CONN_ROLE_VIDEO_SUB 2
+
+// ConnEntry.app_proto — the application protocol on top of .transport
+#define CONN_APP_MAVLINK 0
+#define CONN_APP_MPEGTS  1
+#define CONN_APP_RTSP    2
+#define CONN_APP_HTTP    3
+#define CONN_APP_SRT     4
+#define CONN_APP_RTMP    5
+
+/*
+  Video rows live in a conn_index range disjoint from the MAVLink ones
+  (0 = user, 1..MAX_COMM2_LINKS = engineer slots), because the two
+  writers snapshot independently: each deletes and rewrites only its own
+  range, so neither erases the other's rows.
+ */
+#define VIDEO_CONN_INDEX_BASE 1000
+#define VIDEO_CONN_STRIDE     256
+#define VIDEO_PUB_INDEX(slot)      (VIDEO_CONN_INDEX_BASE + (slot)*VIDEO_CONN_STRIDE)
+#define VIDEO_SUB_INDEX(slot, i)   (VIDEO_PUB_INDEX(slot) + 1 + (i))
+
 struct ConnEntry {
     uint64_t magic;            // CONN_MAGIC
     uint64_t connected_at;     // unix seconds
@@ -61,13 +85,77 @@ struct ConnEntry {
     uint8_t  is_user;          // 1 if this is mav1, 0 if engineer-side
     uint32_t flags;            // reserved (forward-compat)
     uint32_t _pad;             // keep total a multiple of 8
+    uint32_t _pad2;            // was implicit tail padding; see below
+    // Fields below are the video extension. They start at offset 64,
+    // after _pad2, for the reason spelled out in the comment below.
+    uint8_t  role;             // CONN_ROLE_*
+    uint8_t  stream_idx;       // video slot 0..KEY_MAX_VIDEO_PORTS-1
+    uint8_t  app_proto;        // CONN_APP_*
+    uint8_t  authenticated;    // 1 = MAVLink signature validated. Only the
+                               // session child ever sets this; the video
+                               // child requires it on bidi entries.
+    uint32_t _pad3;
 };
 
+/*
+  ABI shared with conntdb_lib.py's PACK_FORMAT ("<QQQiiIIIIHBBII4x").
+
+  _pad2 covers bytes 60..63, which used to be *implicit* tail padding
+  (the struct is 8-aligned, so sizeof was already 64) and which the
+  Python format spells out as its trailing "4x". Naming it matters:
+  while it was implicit, appending a field in C++ silently placed that
+  field at offset 60 without changing sizeof, so no size assert could
+  catch it — yet an older Python writer zeroes those bytes on every
+  rewrite. Now any appended field pushes sizeof past 64 and trips the
+  assert below. New fields go after _pad2, at offset 64.
+
+  Both sides agree these bytes are zero: Python emits "4x", and every
+  C++ construction site value-initialises (ConnEntry e {}).
+ */
+static_assert(sizeof(int) == 4, "ConnEntry ABI assumes 32-bit int");
+static_assert(sizeof(struct ConnEntry) == 72, "ConnEntry size changed");
+static_assert(offsetof(struct ConnEntry, magic) == 0, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, connected_at) == 8, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, last_update) == 16, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, port2) == 24, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, conn_index) == 28, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, pid) == 32, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, rx_msgs) == 36, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, tx_msgs) == 40, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, peer_ip_be) == 44, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, peer_port_be) == 48, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, transport) == 50, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, is_user) == 51, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, flags) == 52, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, _pad) == 56, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, _pad2) == 60, "ConnEntry layout");
+// The video extension starts here. It had to begin at 64 rather than 60:
+// while bytes 60..63 were implicit tail padding, a field placed there did
+// not change sizeof (so no size assert could catch it) yet an older
+// Python writer zeroes them on every rewrite via its trailing "4x".
+static_assert(offsetof(struct ConnEntry, role) == 64, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, stream_idx) == 65, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, app_proto) == 66, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, authenticated) == 67, "ConnEntry layout");
+static_assert(offsetof(struct ConnEntry, _pad3) == 68, "ConnEntry layout");
+// No implicit tail padding, so appending a field trips the size assert.
+static_assert(offsetof(struct ConnEntry, _pad3) + sizeof(uint32_t)
+              == sizeof(struct ConnEntry),
+              "ConnEntry must have no implicit tail padding");
+// Old records are 64 bytes; readers zero-extend them, which leaves
+// authenticated == 0 and so fails closed for bidi entries.
+static_assert(CONNENTRY_MIN_SIZE == 64,
+              "CONNENTRY_MIN_SIZE is the pre-video record size");
+
 struct ConnKey {
     int port2;
     int conn_index;
 };
 
+// Keyed lookups depend on this being a bare 8-byte pair with no padding.
+static_assert(sizeof(struct ConnKey) == 8, "ConnKey layout");
+static_assert(offsetof(struct ConnKey, conn_index) == 4, "ConnKey layout");
+
 TDB_CONTEXT *conn_db_open(void);
 TDB_CONTEXT *conn_db_open_transaction(void);
 void conn_db_close(TDB_CONTEXT *db);
@@ -87,6 +175,19 @@ int conn_delete_for_port2(TDB_CONTEXT *db, int port2);
 // delete+rewrite can't wipe a drop request that raced it.
 uint32_t conn_drop_mask(TDB_CONTEXT *db, int port2);
 
+// Fetch the user-side record (conn_index 0) for this port2. Returns
+// false if there is none. Used by the video child to decide whether a
+// publisher's address matches a recent MAVLink session.
+bool conn_get_user(TDB_CONTEXT *db, int port2, struct ConnEntry &out);
+
+// Delete every record for this port2 whose conn_index is in [lo,hi].
+// The MAVLink child and the video child snapshot independently, so each
+// must only clear its own range or they erase each other's rows.
+// Returns the number removed.
+int conn_delete_index_range(TDB_CONTEXT *db, int port2, int lo, int hi);
+
 // One-shot helpers used by the parent (open + transaction internally).
 void conn_recreate_empty(void);
 void conn_remove_port2(int port2);
+// Remove only the video rows for this port2 (index >= VIDEO_CONN_INDEX_BASE).
+void conn_remove_video(int port2);
diff --git a/conntdb_lib.py b/conntdb_lib.py
index 2fe9e67..d526dbc 100644
--- a/conntdb_lib.py
+++ b/conntdb_lib.py
@@ -44,12 +44,49 @@
 #   HBB   peer_port_be, transport, is_user            ( 4)
 #   I     flags                                       ( 4)
 #   I     _pad                                        ( 4)
-# Raw: 60 bytes. C++ rounds sizeof() up to 64 to align the next
-# instance at an 8-byte boundary (alignof(uint64_t)). Add 4 explicit
-# pad bytes here so the on-disk size matches.
-PACK_FORMAT = "<QQQiiIIIIHBBII4x"
+#   4x    _pad2 (was implicit C++ tail padding)       ( 4)  -> 64
+#   BBBB  role, stream_idx, app_proto, authenticated  ( 4)
+#   4x    _pad3                                       ( 4)  -> 72
+#
+# The video fields start at 64, not 60. Bytes 60..63 were implicit tail
+# padding in C++ (the struct is 8-aligned) which this format spells out
+# as "4x" -- so a field placed there would be zeroed by any writer using
+# the older format, while sizeof() stayed 64 and no size check caught it.
+PACK_FORMAT = "<QQQiiIIIIHBBII4xBBBB4x"
 CONNENTRY_CURRENT_SIZE = struct.calcsize(PACK_FORMAT)
-assert CONNENTRY_CURRENT_SIZE == 64, CONNENTRY_CURRENT_SIZE
+assert CONNENTRY_CURRENT_SIZE == 72, CONNENTRY_CURRENT_SIZE
+
+# ConnEntry.role / .app_proto — keep in sync with conntdb.h.
+CONN_ROLE_MAVLINK = 0
+CONN_ROLE_VIDEO_PUB = 1
+CONN_ROLE_VIDEO_SUB = 2
+
+ROLE_NAMES = {
+    CONN_ROLE_MAVLINK: 'mavlink',
+    CONN_ROLE_VIDEO_PUB: 'video-pub',
+    CONN_ROLE_VIDEO_SUB: 'video-sub',
+}
+
+CONN_APP_MAVLINK = 0
+CONN_APP_MPEGTS = 1
+CONN_APP_RTSP = 2
+CONN_APP_HTTP = 3
+CONN_APP_SRT = 4
+CONN_APP_RTMP = 5
+
+APP_NAMES = {
+    CONN_APP_MAVLINK: 'mavlink',
+    CONN_APP_MPEGTS: 'mpegts',
+    CONN_APP_RTSP: 'rtsp',
+    CONN_APP_HTTP: 'http',
+    CONN_APP_SRT: 'srt',
+    CONN_APP_RTMP: 'rtmp',
+}
+
+# Video rows occupy a conn_index range disjoint from the MAVLink ones so
+# the two writers can snapshot independently.
+VIDEO_CONN_INDEX_BASE = 1000
+VIDEO_CONN_STRIDE = 256
 
 # struct ConnKey { int port2; int conn_index; }
 KEY_FORMAT = "<ii"
@@ -67,7 +104,8 @@ class ConnEntry:
                  'port2', 'conn_index', 'pid',
                  'rx_msgs', 'tx_msgs',
                  'peer_ip_be', 'peer_port_be',
-                 'transport', 'is_user', 'flags')
+                 'transport', 'is_user', 'flags',
+                 'role', 'stream_idx', 'app_proto', 'authenticated')
 
     def __init__(self):
         for s in self.__slots__:
@@ -86,13 +124,27 @@ def unpack(cls, data):
          ce.rx_msgs, ce.tx_msgs,
          ce.peer_ip_be, ce.peer_port_be,
          ce.transport, ce.is_user,
-         ce.flags, _pad) = struct.unpack(PACK_FORMAT, body)
+         ce.flags, _pad,
+         ce.role, ce.stream_idx, ce.app_proto,
+         ce.authenticated) = struct.unpack(PACK_FORMAT, body)
         return ce
 
     @property
     def transport_name(self):
         return TRANSPORT_NAMES.get(self.transport, str(self.transport))
 
+    @property
+    def role_name(self):
+        return ROLE_NAMES.get(self.role, str(self.role))
+
+    @property
+    def app_name(self):
+        return APP_NAMES.get(self.app_proto, str(self.app_proto))
+
+    @property
+    def is_video(self):
+        return self.role in (CONN_ROLE_VIDEO_PUB, CONN_ROLE_VIDEO_SUB)
+
     @property
     def peer_ip(self):
         return socket.inet_ntoa(struct.pack("<I", self.peer_ip_be))
@@ -209,6 +261,7 @@ def _flip_drop_flag(path, port2, conn_index):
                 ce.peer_ip_be, ce.peer_port_be,
                 ce.transport, ce.is_user,
                 ce.flags, 0,  # _pad
+                ce.role, ce.stream_idx, ce.app_proto, ce.authenticated,
             )
             import tdb as _tdb
             db.store(key, new_body + tail, _tdb.REPLACE)
diff --git a/keydb.h b/keydb.h
index e75ccd0..0b12579 100644
--- a/keydb.h
+++ b/keydb.h
@@ -34,6 +34,53 @@
 #define KEY_FLAG_TLOG      (1u << 2)  // record per-connection MAVProxy-format tlogs
 #define KEY_FLAG_BINLOG    (1u << 3)  // record ArduPilot bin logs over MAVLink
 #define KEY_FLAG_USE_TZ    (1u << 4)  // name logs with tz_offset_hours; else server local
+#define KEY_FLAG_VIDEO     (1u << 5)  // video proxying enabled for this entry
+
+#define KEY_MAX_VIDEO_PORTS 3
+
+/*
+  KeyEntry.video_flags: one byte of options per video slot, plus a
+  byte of entry-wide options. A byte per slot (rather than packing bits
+  tightly) keeps the shift arithmetic obvious and leaves room to grow
+  without another schema change.
+
+    bits  0-7   slot 0
+    bits  8-15  slot 1
+    bits 16-23  slot 2
+    bits 24-31  entry-wide
+ */
+#define VIDEO_SLOT_BITS 8
+#define VIDEO_SLOT_SHIFT(slot) ((slot) * VIDEO_SLOT_BITS)
+
+// per-slot bits
+#define VIDEO_SLOT_SRT     (1u << 0)  // UDP side speaks SRT, not plain MPEG-TS
+#define VIDEO_SLOT_RECORD  (1u << 1)  // write .ts segments under logs/
+#define VIDEO_SLOT_RAW_TCP (1u << 2)  // allow raw-TCP viewers (no credential)
+
+// entry-wide bits, stored in the top byte
+#define VIDEO_OPT_SHIFT 24
+#define VIDEO_OPT_AUDIO (1u << 0)     // carry audio from RTSP ingest as AAC.
+                                      // Default off: audio is rarely useful
+                                      // from an aircraft, and dropping it
+                                      // keeps the muxed TS video-only.
+
+static inline uint32_t video_slot_opts(uint32_t video_flags, unsigned slot)
+{
+    if (slot >= KEY_MAX_VIDEO_PORTS) {
+        return 0;
+    }
+    return (video_flags >> VIDEO_SLOT_SHIFT(slot)) & 0xFFu;
+}
+
+static inline uint32_t video_entry_opts(uint32_t video_flags)
+{
+    return (video_flags >> VIDEO_OPT_SHIFT) & 0xFFu;
+}
+
+// A publisher with no credential is accepted when a MAVLink session for
+// the same entry was seen from the same address within this window, so
+// video rides through a MAVLink dropout instead of being revoked.
+#define VIDEO_MAV_GRACE_DEFAULT_S 60u
 
 struct KeyEntry {
     uint64_t magic;
@@ -48,9 +95,71 @@ struct KeyEntry {
     float    log_retention_days;    // tlog + bin; 0.0 = forever; fractional values allowed for tests
     uint32_t fc_sysid;              // 0 = match any; otherwise only monitor packets from this MAVLink sysid (binlog reboot detection)
     float    tz_offset_hours;       // log naming: GMT offset in hours (fractional allowed), used only when KEY_FLAG_USE_TZ is set
-    uint32_t reserved[14];
+    uint32_t video_ports[KEY_MAX_VIDEO_PORTS];  // 0 = slot unused
+    uint32_t video_flags;           // VIDEO_SLOT_* / VIDEO_OPT_*, see above
+    uint8_t  video_viewer_key[32];  // sha256(viewer password); all-zero = open
+    uint8_t  video_publish_key[32]; // sha256(publish password); all-zero = the
+                                    // MAVLink-session check is the only gate
+    uint32_t video_quota_mb;        // per-entry video disk budget; 0 = default
+    uint32_t video_mav_grace_s;     // publisher grace after MAVLink drops;
+                                    // 0 = VIDEO_MAV_GRACE_DEFAULT_S
+    /*
+      RTMP publish path for each slot, "app/stream" as configured on the
+      camera, e.g. "PhoenixFPV/FPV". Empty = accept whatever is
+      published.
+
+      Optional, and an access control rather than a requirement: RTMP is
+      parsed here now (videortmp.cpp), so the app and stream are read off
+      the wire. Set, only that path is admitted on the slot.
+     */
+    char video_rtmp_path[KEY_MAX_VIDEO_PORTS][32];
+    uint32_t reserved[12];
 };
 
+/*
+  The on-disk layout is an ABI shared with keydb_lib.py's PACK_FORMAT
+  ("<QQ32siIII32sIfIf3II32s32sII32s32s32s12I"). Nothing enforced that
+  agreement until these asserts: a padding change or a differently-sized
+  int/float would silently produce records the Python side misparses.
+
+  The record grew 168 -> 248 -> 344 as video fields were added. That is
+  allowed by the append-only contract at the top of this file: readers
+  zero-extend a short record and writers preserve any tail they don't
+  understand, so old and new binaries interoperate in both directions.
+ */
+static_assert(sizeof(int) == 4, "KeyEntry ABI assumes 32-bit int");
+static_assert(sizeof(float) == 4, "KeyEntry ABI assumes 32-bit float");
+static_assert(sizeof(struct KeyEntry) == 344, "KeyEntry size changed");
+static_assert(offsetof(struct KeyEntry, magic) == 0, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, timestamp) == 8, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, secret_key) == 16, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, port1) == 48, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, connections) == 52, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, count1) == 56, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, count2) == 60, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, name) == 64, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, flags) == 96, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, log_retention_days) == 100, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, fc_sysid) == 104, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, tz_offset_hours) == 108, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, video_ports) == 112, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, video_flags) == 124, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, video_viewer_key) == 128, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, video_publish_key) == 160, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, video_quota_mb) == 192, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, video_mav_grace_s) == 196, "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, video_rtmp_path) == 200,
+              "KeyEntry layout");
+static_assert(sizeof(((struct KeyEntry *)nullptr)->video_rtmp_path) == 96,
+              "KeyEntry layout");
+static_assert(offsetof(struct KeyEntry, reserved) == 296, "KeyEntry layout");
+// No implicit tail padding, so appending a field trips the size assert.
+static_assert(offsetof(struct KeyEntry, reserved) + 12*sizeof(uint32_t)
+              == sizeof(struct KeyEntry), "KeyEntry must have no tail padding");
+// KEYENTRY_MIN_SIZE is the pre-flags layout: everything through name[].
+static_assert(KEYENTRY_MIN_SIZE == offsetof(struct KeyEntry, flags),
+              "KEYENTRY_MIN_SIZE must be the offset of the first post-legacy field");
+
 /*
   open DB with or without a transaction
  */
diff --git a/keydb.py b/keydb.py
index bb2c7f7..11800f3 100755
--- a/keydb.py
+++ b/keydb.py
@@ -28,6 +28,10 @@ def main():
                                  'setretention',
                                  'setsysid',
                                  'settz',
+                                 'setvideo', 'videoflag', 'videoopt', 'setrtmp',
+                                 'setviewerpass', 'setpublishpass',
+                                 'setvideoquota', 'setvideograce',
+                                 'video',
                                  'stats'],
                         help="action to perform")
     parser.add_argument("args", default=[], nargs=argparse.REMAINDER)
@@ -121,6 +125,142 @@ def main():
             else:
                 print("Set log retention=%.4g days for %s" % (days, ke))
 
+        elif args.action == "setvideo":
+            if not args.args:
+                raise CLIError(
+                    "Usage: keydb.py setvideo PORT2 [VPORT ...]  "
+                    "(up to %d ports; none clears them all)"
+                    % keydb_lib.MAX_VIDEO_PORTS)
+            port2 = int(args.args[0])
+            try:
+                vports = [int(a) for a in args.args[1:]]
+            except ValueError:
+                raise CLIError("video ports must be integers, got %r"
+                               % (args.args[1:],))
+            ke = keydb_lib.set_video_ports(db, port2, vports)
+            if any(ke.video_ports):
+                print("Set video ports %s for %s"
+                      % (','.join(str(p) for p in ke.video_ports if p), ke))
+            else:
+                print("Cleared video ports for %s" % ke)
+
+        elif args.action == "setrtmp":
+            # setrtmp PORT2 SLOT [app/stream]   -- omit to clear
+            if len(args.args) not in (2, 3):
+                raise CLIError(
+                    "Usage: keydb.py setrtmp PORT2 SLOT [app/stream]  "
+                    "(omit the path to clear)")
+            port2 = int(args.args[0])
+            slot = int(args.args[1])
+            path = args.args[2] if len(args.args) == 3 else ''
+            ke = keydb_lib.set_video_rtmp_path(db, port2, slot, path)
+            got = ke.rtmp_path(slot)
+            print("Set slot %d RTMP path to %s for %s"
+                  % (slot, repr(got) if got else "(cleared)", ke))
+
+        elif args.action in ("videoflag", "videoopt"):
+            # videoflag PORT2 SLOT NAME [on|off]   -- per-slot option
+            # videoopt  PORT2 NAME [on|off]        -- entry-wide option
+            per_slot = args.action == "videoflag"
+            usage = ("keydb.py videoflag PORT2 SLOT NAME [on|off]  (NAME: %s)"
+                     % ', '.join(sorted(keydb_lib.VIDEO_SLOT_FLAG_NAMES))
+                     if per_slot else
+                     "keydb.py videoopt PORT2 NAME [on|off]  (NAME: %s)"
+                     % ', '.join(sorted(keydb_lib.VIDEO_OPT_FLAG_NAMES)))
+            nargs = 3 if per_slot else 2
+            if len(args.args) not in (nargs, nargs + 1):
+                raise CLIError("Usage: %s" % usage)
+            state = args.args[nargs].lower() if len(args.args) > nargs else "on"
+            if state not in ("on", "off"):
+                raise CLIError("state must be 'on' or 'off', got %r" % state)
+            on = state == "on"
+            port2 = int(args.args[0])
+            if per_slot:
+                slot = int(args.args[1])
+                ke = keydb_lib.set_video_slot_flag(db, port2, slot,
+                                                   args.args[2], on)
+                print("Set slot %d %s=%s for %s"
+                      % (slot, args.args[2], state, ke))
+            else:
+                ke = keydb_lib.set_video_entry_flag(db, port2,
+                                                    args.args[1], on)
+                print("Set video %s=%s for %s" % (args.args[1], state, ke))
+
+        elif args.action in ("setviewerpass", "setpublishpass"):
+            which = ("viewer" if args.action == "setviewerpass" else "publish")
+            if len(args.args) not in (1, 2):
+                raise CLIError(
+                    "Usage: keydb.py %s PORT2 [PASSPHRASE]  "
+                    "(omit PASSPHRASE to clear)" % args.action)
+            port2 = int(args.args[0])
+            phrase = args.args[1] if len(args.args) == 2 else ''
+            fn = (keydb_lib.set_video_viewer_pass
+                  if which == "viewer" else keydb_lib.set_video_publish_pass)
+            ke = fn(db, port2, phrase)
+            if phrase:
+                print("Set video %s password for %s" % (which, ke))
+            else:
+                print("Cleared video %s password for %s" % (which, ke))
+
+        elif args.action == "setvideoquota":
+            _expect(args.args, 2,
+                    "keydb.py setvideoquota PORT2 MB  (0 = server default)")
+            try:
+                mb = int(args.args[1])
+            except ValueError:
+                raise CLIError("MB must be an integer, got %r" % args.args[1])
+            ke = keydb_lib.set_video_quota(db, int(args.args[0]), mb)
+            if mb == 0:
+                print("Cleared video quota (server default) for %s" % ke)
+            else:
+                print("Set video quota=%d MB for %s" % (mb, ke))
+
+        elif args.action == "setvideograce":
+            _expect(args.args, 2,
+                    "keydb.py setvideograce PORT2 SECONDS  (0 = default %d)"
+                    % keydb_lib.VIDEO_MAV_GRACE_DEFAULT_S)
+            try:
+                secs = int(args.args[1])
+            except ValueError:
+                raise CLIError("SECONDS must be an integer, got %r"
+                               % args.args[1])
+            ke = keydb_lib.set_video_grace(db, int(args.args[0]), secs)
+            print("Set video MAVLink grace=%ds for %s"
+                  % (ke.mav_grace_seconds(), ke))
+
+        elif args.action == "video":
+            _expect(args.args, 1, "keydb.py video PORT2")
+            port2 = int(args.args[0])
+            ke = keydb_lib.KeyEntry(port2)
+            if not ke.fetch(db):
+                raise CLIError("No entry for port2 %d" % port2)
+            print("video: %s" % ("enabled" if ke.video_enabled()
+                                 else "disabled (set the 'video' flag)"))
+            active = ke.active_video_ports()
+            if not active:
+                print("  no video ports configured")
+            for slot, port in active:
+                opts = ke.slot_opt_names(slot)
+                print("  slot %d: port %d  %s%s"
+                      % (slot, port,
+                         "srt" if 'srt' in opts else "mpegts",
+                         ''.join(' +' + o for o in sorted(opts)
+                                 if o != 'srt')))
+                rp = ke.rtmp_path(slot)
+                print("           RTMP path: %s"
+                      % (rp if rp else "(any)"))
+            eopts = ke.entry_opt_names()
+            print("  options: %s" % (','.join(sorted(eopts)) if eopts
+                                     else '(none)'))
+            print("  viewer password: %s"
+                  % ("set" if ke.video_viewer_pass_set() else "not set (open)"))
+            print("  publish password: %s"
+                  % ("set" if ke.video_publish_pass_set()
+                     else "not set (MAVLink session required)"))
+            print("  mavlink grace: %ds" % ke.mav_grace_seconds())
+            print("  quota: %s" % ("%d MB" % ke.video_quota_mb
+                                   if ke.video_quota_mb else "server default"))
+
         elif args.action == "setsysid":
             _expect(args.args, 2,
                     "keydb.py setsysid PORT2 SYSID  "
diff --git a/keydb_lib.py b/keydb_lib.py
index e43ad82..b09c150 100644
--- a/keydb_lib.py
+++ b/keydb_lib.py
@@ -24,10 +24,11 @@
 # Pre-flags layout was 96 bytes. Anything smaller is invalid; anything bigger
 # is acceptable (extra trailing bytes belong to a newer schema we ignore).
 #
-# The current C++ struct ends with `uint32_t flags`, `float log_retention_days`,
-# `uint32_t fc_sysid`, `float tz_offset_hours`, and `uint32_t reserved[14]`. All
-# are 4-byte aligned and slot in cleanly after the existing fields, so the
-# struct is 168 bytes with no trailing pad. When a future field is added, claim
+# The current C++ struct ends with the video fields -- ports, flags, the
+# viewer and publish keys, the quota, the MAVLink grace window, the per-slot
+# RTMP paths -- and `uint32_t reserved[12]`. All are 4-byte aligned and slot in
+# cleanly after the existing fields, so the struct is 344 bytes with no
+# trailing pad. When a future field is added, claim
 # another `reserved[]` slot (renumber: shrink reserved by 1, add a named field)
 # so the on-disk byte layout stays compatible — the zero-init paths in
 # db_load_key (C++) and unpack() (Python) handle older records transparently.
@@ -36,8 +37,12 @@
 # server-local naming (the flag, not the value, decides whether the offset
 # is used), needing no conversion.
 KEYENTRY_MIN_SIZE = 96
-PACK_FORMAT = "<QQ32siIII32sIfIf14I"
-KEYENTRY_CURRENT_SIZE = struct.calcsize(PACK_FORMAT)  # 168
+PACK_FORMAT = "<QQ32siIII32sIfIf3II32s32sII32s32s32s12I"
+KEYENTRY_CURRENT_SIZE = struct.calcsize(PACK_FORMAT)
+# The C++ side asserts sizeof(KeyEntry) == 344 in keydb.h. Assert the same
+# here so a PACK_FORMAT edit that drifts from the struct fails at import
+# rather than by writing records the C++ reader misparses.
+assert KEYENTRY_CURRENT_SIZE == 344, KEYENTRY_CURRENT_SIZE
 
 # Flag bits — keep in sync with KEY_FLAG_* in keydb.h.
 FLAG_ADMIN     = 1 << 0
@@ -45,6 +50,7 @@
 FLAG_TLOG      = 1 << 2   # record per-connection MAVProxy-format tlogs
 FLAG_BINLOG    = 1 << 3   # record ArduPilot bin logs over MAVLink
 FLAG_USE_TZ    = 1 << 4   # name logs with tz_offset_hours; else server local
+FLAG_VIDEO     = 1 << 5   # video proxying enabled for this entry
 
 FLAG_NAMES = {
     "admin":     FLAG_ADMIN,
@@ -52,10 +58,75 @@
     "tlog":      FLAG_TLOG,
     "binlog":    FLAG_BINLOG,
     "use_tz":    FLAG_USE_TZ,
+    "video":     FLAG_VIDEO,
 }
 
 DEFAULT_LOG_RETENTION_DAYS = 7.0
-RESERVED_WORDS = 14
+RESERVED_WORDS = 12
+
+# Video. Keep in sync with the KEY_MAX_VIDEO_PORTS / VIDEO_* block in keydb.h.
+MAX_VIDEO_PORTS = 3
+
+# video_flags carries one byte of options per slot plus a byte of
+# entry-wide options:
+#   bits 0-7 slot 0, 8-15 slot 1, 16-23 slot 2, 24-31 entry-wide
+VIDEO_SLOT_BITS = 8
+VIDEO_SLOT_SRT     = 1 << 0   # UDP side speaks SRT, not plain MPEG-TS
+VIDEO_SLOT_RECORD  = 1 << 1   # write .ts segments under logs/
+VIDEO_SLOT_RAW_TCP = 1 << 2   # allow raw-TCP viewers (no credential)
+
+VIDEO_SLOT_FLAG_NAMES = {
+    "srt":     VIDEO_SLOT_SRT,
+    "record":  VIDEO_SLOT_RECORD,
+    "raw_tcp": VIDEO_SLOT_RAW_TCP,
+}
+
+VIDEO_OPT_SHIFT = 24
+VIDEO_OPT_AUDIO = 1 << 0      # carry audio from RTSP ingest as AAC (default off)
+
+VIDEO_OPT_FLAG_NAMES = {
+    "audio": VIDEO_OPT_AUDIO,
+}
+
+# Publisher grace after the MAVLink session drops, so video rides through
+# an outage instead of being revoked. 0 in the record means this default.
+VIDEO_MAV_GRACE_DEFAULT_S = 60
+VIDEO_MAV_GRACE_MAX_S = 3600
+
+# Video ports use the same range the web UI allows for port1/port2.
+VIDEO_PORT_MIN = 1024
+VIDEO_PORT_MAX = 65535
+
+# Where automatic video port allocation starts. Deliberately well clear
+# of the 10000/11000/20000/21000 blocks the MAVLink port pairs use, so a
+# suggested video port never sits in the middle of a run of port1/port2
+# and a whole entry's ports stay recognisable at a glance.
+VIDEO_PORT_BASE = 40001
+
+
+def video_slot_opts(video_flags, slot):
+    """The option byte for one slot."""
+    if not 0 <= slot < MAX_VIDEO_PORTS:
+        return 0
+    return (video_flags >> (slot * VIDEO_SLOT_BITS)) & 0xFF
+
+
+def video_set_slot_opts(video_flags, slot, opts):
+    """Return video_flags with slot's option byte replaced."""
+    if not 0 <= slot < MAX_VIDEO_PORTS:
+        raise ValueError("slot out of range: %r" % (slot,))
+    shift = slot * VIDEO_SLOT_BITS
+    return (video_flags & ~(0xFF << shift)) | ((opts & 0xFF) << shift)
+
+
+def video_entry_opts(video_flags):
+    """The entry-wide option byte."""
+    return (video_flags >> VIDEO_OPT_SHIFT) & 0xFF
+
+
+def video_set_entry_opts(video_flags, opts):
+    return ((video_flags & ~(0xFF << VIDEO_OPT_SHIFT))
+            | ((opts & 0xFF) << VIDEO_OPT_SHIFT))
 
 
 # Timezone offset is a plain GMT offset in hours (fractional allowed, e.g.
@@ -88,6 +159,31 @@ class CLIError(Exception):
     """Raised by helpers below when input is invalid or the entry is missing."""
 
 
+def _video_key(passphrase):
+    """sha256 of a video password; all-zero when unset.
+
+    All-zero is the 'no password' sentinel, so an empty passphrase must
+    hash to zeros rather than to sha256(b'') -- otherwise clearing a
+    password would set one that the empty string matches.
+    """
+    if not passphrase:
+        return bytearray(32)
+    if isinstance(passphrase, str):
+        passphrase = passphrase.encode('utf-8')
+    return bytearray(hashlib.sha256(passphrase).digest())
+
+
+def _video_key_matches(stored, passphrase):
+    if not any(stored):
+        return False        # no password set: callers decide what that means
+    if not passphrase:
+        return False
+    if isinstance(passphrase, str):
+        passphrase = passphrase.encode('utf-8')
+    return hmac.compare_digest(bytes(stored),
+                               hashlib.sha256(passphrase).digest())
+
+
 class KeyEntry:
     def __init__(self, port2):
         self.magic = KEY_MAGIC
@@ -102,6 +198,13 @@ def __init__(self, port2):
         self.log_retention_days = 0.0
         self.fc_sysid = 0
         self.tz_offset_hours = 0.0
+        self.video_ports = [0] * MAX_VIDEO_PORTS
+        self.video_flags = 0
+        self.video_viewer_key = bytearray(32)
+        self.video_publish_key = bytearray(32)
+        self.video_quota_mb = 0
+        self.video_mav_grace_s = 0
+        self.video_rtmp_path = [''] * MAX_VIDEO_PORTS
         self.reserved = [0] * RESERVED_WORDS
         self.port2 = port2
         # opaque trailing bytes from a record written by a future schema
@@ -110,6 +213,7 @@ def __init__(self, port2):
     def pack(self):
         name = self.name.encode('UTF-8').ljust(32, b'\x00')[:32]
         reserved = list(self.reserved) + [0] * (RESERVED_WORDS - len(self.reserved))
+        vports = list(self.video_ports) + [0] * (MAX_VIDEO_PORTS - len(self.video_ports))
         body = struct.pack(PACK_FORMAT,
                            self.magic, self.timestamp, bytes(self.secret_key),
                            self.port1, self.connections, self.count1,
@@ -117,6 +221,14 @@ def pack(self):
                            self.log_retention_days,
                            self.fc_sysid,
                            self.tz_offset_hours,
+                           *vports[:MAX_VIDEO_PORTS],
+                           self.video_flags,
+                           bytes(self.video_viewer_key),
+                           bytes(self.video_publish_key),
+                           self.video_quota_mb,
+                           self.video_mav_grace_s,
+                           *[self._rtmp_bytes(i)
+                             for i in range(MAX_VIDEO_PORTS)],
                            *reserved[:RESERVED_WORDS])
         return body + self._tail
 
@@ -135,7 +247,19 @@ def unpack(self, data):
          self.connections, self.count1, self.count2, name,
          self.flags, self.log_retention_days,
          self.fc_sysid, self.tz_offset_hours) = unpacked[:12]
-        self.reserved = list(unpacked[12:12 + RESERVED_WORDS])
+        n = 12
+        self.video_ports = list(unpacked[n:n + MAX_VIDEO_PORTS])
+        n += MAX_VIDEO_PORTS
+        (self.video_flags, viewer_key, publish_key,
+         self.video_quota_mb, self.video_mav_grace_s) = unpacked[n:n + 5]
+        n += 5
+        self.video_rtmp_path = [
+            b.decode('utf-8', errors='ignore').rstrip('\0')
+            for b in unpacked[n:n + MAX_VIDEO_PORTS]]
+        n += MAX_VIDEO_PORTS
+        self.reserved = list(unpacked[n:n + RESERVED_WORDS])
+        self.video_viewer_key = bytearray(viewer_key)
+        self.video_publish_key = bytearray(publish_key)
         self.secret_key = bytearray(secret_key)
         self.name = name.decode('utf-8', errors='ignore').rstrip('\0')
 
@@ -171,6 +295,101 @@ def passphrase_matches(self, passphrase):
     def is_admin(self):
         return bool(self.flags & FLAG_ADMIN)
 
+    # --- video ---------------------------------------------------------
+
+    def video_enabled(self):
+        return bool(self.flags & FLAG_VIDEO)
+
+    def active_video_ports(self):
+        """(slot, port) for each configured slot, in slot order."""
+        return [(i, p) for i, p in enumerate(self.video_ports[:MAX_VIDEO_PORTS])
+                if p]
+
+    def video_port_count(self):
+        """How many video slots this entry uses.
+
+        Derived from the ports rather than stored, so there is no second
+        source of truth to disagree with them. It is the highest
+        allocated slot, not the number allocated, so an entry with a gap
+        still accounts for every port it owns. Never 0: an entry with no
+        ports yet is presented as wanting one.
+        """
+        highest = 0
+        for slot in range(MAX_VIDEO_PORTS):
+            if self.video_ports[slot]:
+                highest = slot + 1
+        return highest or 1
+
+    def _rtmp_bytes(self, slot):
+        """One slot's path as a fixed 32-byte field."""
+        paths = list(self.video_rtmp_path) + [''] * MAX_VIDEO_PORTS
+        return paths[slot].encode('utf-8')[:31]
+
+    def rtmp_path(self, slot):
+        paths = list(self.video_rtmp_path) + [''] * MAX_VIDEO_PORTS
+        return paths[slot] if 0 <= slot < MAX_VIDEO_PORTS else ''
+
+    def set_rtmp_path(self, slot, path):
+        """Set (or clear) the RTMP app/stream for one slot.
+
+        Stored as the camera spells it -- "PhoenixFPV/FPV" -- because
+        that is the form it is compared against when a publisher names
+        its app and stream.
+        """
+        if not 0 <= slot < MAX_VIDEO_PORTS:
+            raise CLIError("slot must be 0..%d" % (MAX_VIDEO_PORTS - 1))
+        path = (path or '').strip().strip('/')
+        if len(path.encode('utf-8')) > 31:
+            raise CLIError("RTMP path too long (max 31 bytes): %r" % path)
+        # A path is pasted from a camera's config page, so reject the
+        # characters that would change the URL's meaning rather than
+        # silently building a different one.
+        bad = set(path) & set(' ?#@\\"\'<>')
+        if bad:
+            raise CLIError("RTMP path may not contain %s"
+                           % ' '.join(sorted(bad)))
+        paths = list(self.video_rtmp_path) + [''] * MAX_VIDEO_PORTS
+        paths[slot] = path
+        self.video_rtmp_path = paths[:MAX_VIDEO_PORTS]
+
+    def slot_opts(self, slot):
+        return video_slot_opts(self.video_flags, slot)
+
+    def set_slot_opts(self, slot, opts):
+        self.video_flags = video_set_slot_opts(self.video_flags, slot, opts)
+
+    def slot_opt_names(self, slot):
+        opts = self.slot_opts(slot)
+        return [n for n, b in VIDEO_SLOT_FLAG_NAMES.items() if opts & b]
+
+    def entry_opt_names(self):
+        opts = video_entry_opts(self.video_flags)
+        return [n for n, b in VIDEO_OPT_FLAG_NAMES.items() if opts & b]
+
+    def set_video_viewer_pass(self, passphrase):
+        """Empty/None clears the password (open viewing)."""
+        self.video_viewer_key = _video_key(passphrase)
+
+    def set_video_publish_pass(self, passphrase):
+        """Empty/None clears it, leaving the MAVLink check as the only gate."""
+        self.video_publish_key = _video_key(passphrase)
+
+    def video_viewer_pass_set(self):
+        return any(self.video_viewer_key)
+
+    def video_publish_pass_set(self):
+        return any(self.video_publish_key)
+
+    def video_viewer_pass_matches(self, passphrase):
+        return _video_key_matches(self.video_viewer_key, passphrase)
+
+    def video_publish_pass_matches(self, passphrase):
+        return _video_key_matches(self.video_publish_key, passphrase)
+
+    def mav_grace_seconds(self):
+        """Effective grace window; 0 in the record means the default."""
+        return self.video_mav_grace_s or VIDEO_MAV_GRACE_DEFAULT_S
+
     def flag_names(self):
         on = [n for n, b in FLAG_NAMES.items() if self.flags & b]
         unknown = self.flags & ~sum(FLAG_NAMES.values())
@@ -256,12 +475,77 @@ def list_entries(db):
 
 
 def get_port_sets(db):
+    """(port1s, port2s, video_ports) across every entry.
+
+    Video ports share the same listening-port namespace as port1/port2,
+    so every uniqueness check has to consider all three sets. Prefer
+    ports_in_use() for new code; this stays for callers that need the
+    split.
+    """
     ports1 = set()
     ports2 = set()
+    portsv = set()
     for e in list_entries(db):
         ports1.add(e.port1)
         ports2.add(e.port2)
-    return ports1, ports2
+        portsv.update(p for p in e.video_ports[:MAX_VIDEO_PORTS] if p)
+    return ports1, ports2, portsv
+
+
+def ports_in_use(db, exclude_port2=None):
+    """Every port bound by any entry, as one set.
+
+    exclude_port2 drops that entry's own ports, so an edit doesn't
+    collide with itself.
+    """
+    used = set()
+    for e in list_entries(db):
+        if exclude_port2 is not None and e.port2 == exclude_port2:
+            continue
+        used.add(e.port1)
+        used.add(e.port2)
+        used.update(p for p in e.video_ports[:MAX_VIDEO_PORTS] if p)
+    used.discard(0)
+    return used
+
+
+def suggest_video_ports(db, ke, count, keep=None):
+    """Pick `count` free video ports for `ke`, counting up from
+    VIDEO_PORT_BASE.
+
+    `keep` is the entry's current ports; an already-allocated slot keeps
+    its port rather than being renumbered, so opening the edit page and
+    saving it does not silently move a running stream to a new port.
+    Returns a MAX_VIDEO_PORTS-long list, 0 for slots beyond `count`.
+    """
+    keep = list(keep or [])
+    keep += [0] * (MAX_VIDEO_PORTS - len(keep))
+
+    used = ports_in_use(db, exclude_port2=ke.port2)
+    used.update(p for p in (ke.port1, ke.port2) if p)
+    # A kept port must not be handed to another slot as well.
+    used.update(p for p in keep[:count] if p)
+
+    out = []
+    nxt = VIDEO_PORT_BASE
+    for slot in range(MAX_VIDEO_PORTS):
+        if slot >= count:
+            out.append(0)
+            continue
+        if keep[slot]:
+            out.append(keep[slot])
+            continue
+        while nxt in used and nxt <= VIDEO_PORT_MAX:
+            nxt += 1
+        if nxt > VIDEO_PORT_MAX:
+            # Nothing free above the base. Leave it for the operator to
+            # fill in rather than suggesting a port that cannot be used.
+            out.append(0)
+            continue
+        out.append(nxt)
+        used.add(nxt)
+        nxt += 1
+    return out
 
 
 def find_by_port(db, port):
@@ -287,11 +571,13 @@ def count_admins(db):
 # caller's responsibility so multiple mutations can share one transaction.
 
 def add_entry(db, port1, port2, name, passphrase):
-    ports1, ports2 = get_port_sets(db)
-    if port1 in ports1 or port1 in ports2:
-        raise CLIError("Entry already exists for port1 %d" % port1)
-    if port2 in ports2 or port2 in ports1:
-        raise CLIError("Entry already exists for port2 %d" % port2)
+    used = ports_in_use(db)
+    if port1 in used:
+        raise CLIError("Port %d is already in use" % port1)
+    if port2 in used:
+        raise CLIError("Port %d is already in use" % port2)
+    if port1 == port2:
+        raise CLIError("port1 and port2 must differ")
     ke = KeyEntry(port2)
     ke.port1 = port1
     ke.name = name
@@ -424,6 +710,156 @@ def set_fc_sysid(db, port2, sysid):
     return ke
 
 
+def validate_video_ports(db, ke, ports):
+    """Normalise `ports` to a MAX_VIDEO_PORTS-long list, or raise CLIError.
+
+    Video ports share the listening-port namespace with port1/port2, so
+    each is checked against every port any *other* entry binds, against
+    this entry's own port1/port2, and against the others in this list.
+
+    Split out from set_video_ports() so the web UI can validate against
+    an entry it has already fetched and is about to store itself, rather
+    than going through a second fetch/store.
+    """
+    if len(ports) > MAX_VIDEO_PORTS:
+        raise CLIError("at most %d video ports (got %d)"
+                       % (MAX_VIDEO_PORTS, len(ports)))
+
+    vports = [int(p or 0) for p in ports]
+    vports += [0] * (MAX_VIDEO_PORTS - len(vports))
+    used = ports_in_use(db, exclude_port2=ke.port2)
+    seen = set()
+    for p in vports:
+        if p == 0:
+            continue
+        if p < VIDEO_PORT_MIN or p > VIDEO_PORT_MAX:
+            raise CLIError("video port %d out of range %d..%d"
+                           % (p, VIDEO_PORT_MIN, VIDEO_PORT_MAX))
+        if p in (ke.port1, ke.port2):
+            raise CLIError("video port %d collides with this entry's "
+                           "own port1/port2" % p)
+        if p in seen:
+            raise CLIError("video port %d is listed twice" % p)
+        if p in used:
+            raise CLIError("Port %d is already in use" % p)
+        seen.add(p)
+    return vports
+
+
+def set_video_ports(db, port2, ports):
+    """Set this entry's video ports. `ports` is a list of up to 3 ints;
+    0 (or a short list) leaves the remaining slots unused."""
+    ke = KeyEntry(port2)
+    if not ke.fetch(db):
+        raise CLIError("No entry for port2 %d" % port2)
+    ke.video_ports = validate_video_ports(db, ke, ports)
+    ke.store(db)
+    return ke
+
+
+def set_video_rtmp_path(db, port2, slot, path):
+    """Set the RTMP app/stream a slot accepts, e.g. 'PhoenixFPV/FPV'.
+
+    Optional, and an access control rather than a requirement: the
+    publisher's app and stream are read off the wire, so a blank path
+    accepts whatever the camera publishes.
+    """
+    ke = KeyEntry(port2)
+    if not ke.fetch(db):
+        raise CLIError("No entry for port2 %d" % port2)
+    if not 0 <= slot < MAX_VIDEO_PORTS:
+        raise CLIError("video slot must be 0..%d (got %r)"
+                       % (MAX_VIDEO_PORTS - 1, slot))
+    ke.set_rtmp_path(slot, path)
+    ke.store(db)
+    return ke
+
+
+def set_video_slot_flag(db, port2, slot, flag_name, on=True):
+    """Set or clear one per-slot video option (srt / record / raw_tcp)."""
+    ke = KeyEntry(port2)
+    if not ke.fetch(db):
+        raise CLIError("No entry for port2 %d" % port2)
+    if not 0 <= slot < MAX_VIDEO_PORTS:
+        raise CLIError("video slot must be 0..%d (got %r)"
+                       % (MAX_VIDEO_PORTS - 1, slot))
+    bit = VIDEO_SLOT_FLAG_NAMES.get(flag_name)
+    if bit is None:
+        raise CLIError("unknown video slot flag '%s' (known: %s)"
+                       % (flag_name, ', '.join(sorted(VIDEO_SLOT_FLAG_NAMES))))
+    opts = ke.slot_opts(slot)
+    ke.set_slot_opts(slot, (opts | bit) if on else (opts & ~bit))
+    ke.store(db)
+    return ke
+
+
+def set_video_entry_flag(db, port2, flag_name, on=True):
+    """Set or clear one entry-wide video option (audio)."""
+    ke = KeyEntry(port2)
+    if not ke.fetch(db):
+        raise CLIError("No entry for port2 %d" % port2)
+    bit = VIDEO_OPT_FLAG_NAMES.get(flag_name)
+    if bit is None:
+        raise CLIError("unknown video option '%s' (known: %s)"
+                       % (flag_name, ', '.join(sorted(VIDEO_OPT_FLAG_NAMES))))
+    opts = video_entry_opts(ke.video_flags)
+    ke.video_flags = video_set_entry_opts(
+        ke.video_flags, (opts | bit) if on else (opts & ~bit))
+    ke.store(db)
+    return ke
+
+
+def set_video_viewer_pass(db, port2, passphrase):
+    """Set (or clear, with an empty passphrase) the video viewer password."""
+    ke = KeyEntry(port2)
+    if not ke.fetch(db):
+        raise CLIError("No entry for port2 %d" % port2)
+    ke.set_video_viewer_pass(passphrase)
+    ke.store(db)
+    return ke
+
+
+def set_video_publish_pass(db, port2, passphrase):
+    """Set (or clear) the video publish password.
+
+    Cleared is the normal case: publish is then gated only by a MAVLink
+    session from the same address within the grace window.
+    """
+    ke = KeyEntry(port2)
+    if not ke.fetch(db):
+        raise CLIError("No entry for port2 %d" % port2)
+    ke.set_video_publish_pass(passphrase)
+    ke.store(db)
+    return ke
+
+
+def set_video_quota(db, port2, quota_mb):
+    """Per-entry video disk budget in MB. 0 = use the server default."""
+    ke = KeyEntry(port2)
+    if not ke.fetch(db):
+        raise CLIError("No entry for port2 %d" % port2)
+    q = int(quota_mb)
+    if q < 0:
+        raise CLIError("video quota must be >= 0 (got %r)" % quota_mb)
+    ke.video_quota_mb = q
+    ke.store(db)
+    return ke
+
+
+def set_video_grace(db, port2, seconds):
+    """Publisher grace after the MAVLink session drops. 0 = default."""
+    ke = KeyEntry(port2)
+    if not ke.fetch(db):
+        raise CLIError("No entry for port2 %d" % port2)
+    s = int(seconds)
+    if s < 0 or s > VIDEO_MAV_GRACE_MAX_S:
+        raise CLIError("video grace must be 0..%d seconds (got %r)"
+                       % (VIDEO_MAV_GRACE_MAX_S, seconds))
+    ke.video_mav_grace_s = s
+    ke.store(db)
+    return ke
+
+
 def convert_db(db):
     """Convert legacy 48-byte records to the current layout."""
     count = 0
diff --git a/session.cpp b/session.cpp
index 3bfaa90..aa05ac6 100644
--- a/session.cpp
+++ b/session.cpp
@@ -68,14 +68,26 @@ void session_time_strings(time_t utc, bool use_offset, double tz_offset_hours,
              tm.tm_hour, tm.tm_min, tm.tm_sec);
 }
 
-// True if neither <dir>/<candidate>.tlog nor <dir>/<candidate>.bin exists.
+// Every extension a session can produce. A basename is only free if
+// none of them is taken: the files of one session share a name, so
+// handing back a name that any of them already occupies would append
+// into (or truncate) another session's log.
+static const char *SESSION_EXTS[] = {
+    ".tlog", ".bin", ".v1.ts", ".v2.ts", ".v3.ts",
+};
+
+// True if no session file of any kind exists under this basename.
 static bool basename_free(const char *dir, const char *candidate)
 {
-    char p_tlog[2048], p_bin[2048];
-    snprintf(p_tlog, sizeof(p_tlog), "%s/%s.tlog", dir, candidate);
-    snprintf(p_bin, sizeof(p_bin), "%s/%s.bin", dir, candidate);
-    struct stat st;
-    return stat(p_tlog, &st) != 0 && stat(p_bin, &st) != 0;
+    for (const char *ext : SESSION_EXTS) {
+        char p[2048];
+        snprintf(p, sizeof(p), "%s/%s%s", dir, candidate, ext);
+        struct stat st;
+        if (stat(p, &st) == 0) {
+            return false;
+        }
+    }
+    return true;
 }
 
 void session_unique_basename(const char *base_dir, uint32_t port2,
diff --git a/tests/test_keydb_log.py b/tests/test_keydb_log.py
index 894db89..76eceab 100644
--- a/tests/test_keydb_log.py
+++ b/tests/test_keydb_log.py
@@ -20,11 +20,14 @@
 KEYDB_PY = os.path.join(_REPO_ROOT, 'keydb.py')
 
 
-def test_pack_format_size_is_168():
-    """The on-disk record is 168 bytes after appending log_retention_days
-    + reserved[16]."""
-    assert struct.calcsize(keydb_lib.PACK_FORMAT) == 168
-    assert keydb_lib.KEYENTRY_CURRENT_SIZE == 168
+def test_pack_format_size_is_248():
+    """The on-disk record is 248 bytes after appending the video fields.
+
+    keydb.h carries a matching static_assert, so this catches either side
+    drifting from the other.
+    """
+    assert struct.calcsize(keydb_lib.PACK_FORMAT) == 344
+    assert keydb_lib.KEYENTRY_CURRENT_SIZE == 344
 
 
 def test_pack_unpack_roundtrip():
@@ -35,7 +38,7 @@ def test_pack_unpack_roundtrip():
     e.flags = keydb_lib.FLAG_TLOG | keydb_lib.FLAG_ADMIN
     e.log_retention_days = 0.0001
     data = e.pack()
-    assert len(data) == 168
+    assert len(data) == 344
 
     e2 = keydb_lib.KeyEntry(0)
     e2.unpack(data)
@@ -45,7 +48,7 @@ def test_pack_unpack_roundtrip():
     # float32 quantisation: tolerate ~1e-7 relative error
     assert abs(e2.log_retention_days - 0.0001) < 1e-7
     assert e2.tz_offset_hours == 0.0
-    assert e2.reserved == [0] * 14
+    assert e2.reserved == [0] * keydb_lib.RESERVED_WORDS
 
 
 def test_legacy_104byte_record_zero_extends():
@@ -71,11 +74,16 @@ def test_legacy_104byte_record_zero_extends():
     assert decoded.log_retention_days == 0.0
     assert decoded.fc_sysid == 0
     assert decoded.tz_offset_hours == 0.0
-    assert decoded.reserved == [0] * 14
+    assert decoded.reserved == [0] * keydb_lib.RESERVED_WORDS
+
+    # video fields default to unset
+    assert decoded.video_ports == [0] * keydb_lib.MAX_VIDEO_PORTS
+    assert decoded.video_flags == 0
+    assert not decoded.video_viewer_pass_set()
 
-    # Re-pack: should emit the full 168-byte modern layout.
+    # Re-pack: should emit the full 248-byte modern layout.
     re = decoded.pack()
-    assert len(re) == 168
+    assert len(re) == 344
 
 
 def test_forward_compat_tail_is_preserved():
@@ -94,7 +102,7 @@ def test_forward_compat_tail_is_preserved():
     assert decoded._tail == extra
     re = decoded.pack()
     assert re.endswith(extra)
-    assert len(re) == 168 + len(extra)
+    assert len(re) == 344 + len(extra)
 
 
 def test_flag_names_includes_tlog():
@@ -318,7 +326,7 @@ def test_tz_offset_round_trip():
     e2 = keydb_lib.KeyEntry(0)
     e2.unpack(e.pack())
     assert abs(e2.tz_offset_hours - 5.5) < 1e-6
-    assert e2.reserved == [0] * 14
+    assert e2.reserved == [0] * keydb_lib.RESERVED_WORDS
 
 
 def test_format_tz_offset():
diff --git a/tests/test_video_ports.py b/tests/test_video_ports.py
new file mode 100644
index 0000000..1ce4c91
--- /dev/null
+++ b/tests/test_video_ports.py
@@ -0,0 +1,300 @@
+"""Video port allocation, option setters, and the keydb.py CLI actions.
+
+Video ports share the listening-port namespace with port1/port2, so the
+uniqueness rule has to be bidirectional: a video port must not take a
+port some other entry already binds, *and* a new entry must not take a
+port already used for video. Both directions are tested here.
+"""
+import os
+import subprocess
+import sys
+
+import pytest
+
+_REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+import keydb_lib  # noqa: E402
+from keydb_lib import CLIError  # noqa: E402
+
+KEYDB_PY = os.path.join(_REPO_ROOT, 'keydb.py')
+
+PORT1, PORT2 = 20001, 20002
+OTHER1, OTHER2 = 30001, 30002
+
+
+@pytest.fixture
+def db(tmp_path):
+    """A keys.tdb with two entries, inside an open transaction."""
+    d = keydb_lib.init_db(str(tmp_path / 'keys.tdb'))
+    d.transaction_start()
+    keydb_lib.add_entry(d, PORT1, PORT2, 'vid', 'pw')
+    keydb_lib.add_entry(d, OTHER1, OTHER2, 'other', 'pw2')
+    yield d
+    try:
+        d.transaction_cancel()
+    except Exception:
+        pass
+    d.close()
+
+
+def _ports(d, port2=PORT2):
+    ke = keydb_lib.KeyEntry(port2)
+    assert ke.fetch(d)
+    return ke.video_ports
+
+
+def test_set_and_clear_video_ports(db):
+    keydb_lib.set_video_ports(db, PORT2, [21001, 21002])
+    assert _ports(db) == [21001, 21002, 0]
+    keydb_lib.set_video_ports(db, PORT2, [])
+    assert _ports(db) == [0, 0, 0]
+
+
+@pytest.mark.parametrize('bad,msg', [
+    ([OTHER1], 'already in use'),          # another entry's port1
+    ([OTHER2], 'already in use'),          # another entry's port2
+    ([PORT1], 'own port1/port2'),          # our own port1
+    ([PORT2], 'own port1/port2'),          # our own port2
+    ([22000, 22000], 'listed twice'),      # duplicate in one call
+    ([80000], 'out of range'),             # above the port range
+    ([80], 'out of range'),                # below VIDEO_PORT_MIN
+    ([1, 2, 3, 4], 'at most 3'),           # too many
+])
+def test_video_port_collisions_rejected(db, bad, msg):
+    with pytest.raises(CLIError) as ei:
+        keydb_lib.set_video_ports(db, PORT2, bad)
+    assert msg in str(ei.value)
+    # a rejected call must not have partially applied
+    assert _ports(db) == [0, 0, 0]
+
+
+def test_video_port_blocks_a_later_add(db):
+    """The check is bidirectional: a new entry can't take a video port."""
+    keydb_lib.set_video_ports(db, PORT2, [21001])
+    with pytest.raises(CLIError) as ei:
+        keydb_lib.add_entry(db, 21001, 40002, 'clash', 'pw')
+    assert 'already in use' in str(ei.value)
+
+
+def test_video_port_can_be_reassigned_to_itself(db):
+    """Re-setting the same ports must not collide with the entry's own."""
+    keydb_lib.set_video_ports(db, PORT2, [21001, 21002])
+    keydb_lib.set_video_ports(db, PORT2, [21001, 21002])
+    assert _ports(db) == [21001, 21002, 0]
+    # and reordering is fine
+    keydb_lib.set_video_ports(db, PORT2, [21002, 21001])
+    assert _ports(db) == [21002, 21001, 0]
+
+
+def test_ports_in_use_excludes_named_entry(db):
+    keydb_lib.set_video_ports(db, PORT2, [21001])
+    all_used = keydb_lib.ports_in_use(db)
+    assert {PORT1, PORT2, OTHER1, OTHER2, 21001} <= all_used
+    mine_excluded = keydb_lib.ports_in_use(db, exclude_port2=PORT2)
+    assert {OTHER1, OTHER2} <= mine_excluded
+    assert not ({PORT1, PORT2, 21001} & mine_excluded)
+
+
+def test_get_port_sets_returns_three_sets(db):
+    keydb_lib.set_video_ports(db, PORT2, [21001])
+    p1, p2, pv = keydb_lib.get_port_sets(db)
+    assert PORT1 in p1 and OTHER1 in p1
+    assert PORT2 in p2 and OTHER2 in p2
+    assert pv == {21001}
+
+
+def test_slot_and_entry_flags(db):
+    keydb_lib.set_video_slot_flag(db, PORT2, 0, 'record')
+    keydb_lib.set_video_slot_flag(db, PORT2, 1, 'srt')
+    keydb_lib.set_video_entry_flag(db, PORT2, 'audio')
+    ke = keydb_lib.KeyEntry(PORT2)
+    assert ke.fetch(db)
+    assert ke.slot_opt_names(0) == ['record']
+    assert ke.slot_opt_names(1) == ['srt']
+    assert ke.entry_opt_names() == ['audio']
+
+    keydb_lib.set_video_slot_flag(db, PORT2, 0, 'record', on=False)
+    ke.fetch(db)
+    assert ke.slot_opt_names(0) == []
+    assert ke.slot_opt_names(1) == ['srt']    # untouched
+
+
+def test_unknown_flag_names_rejected(db):
+    with pytest.raises(CLIError):
+        keydb_lib.set_video_slot_flag(db, PORT2, 0, 'nosuchflag')
+    with pytest.raises(CLIError):
+        keydb_lib.set_video_entry_flag(db, PORT2, 'nosuchopt')
+    with pytest.raises(CLIError):
+        keydb_lib.set_video_slot_flag(db, PORT2, 9, 'record')
+
+
+def test_quota_and_grace_bounds(db):
+    keydb_lib.set_video_quota(db, PORT2, 4096)
+    keydb_lib.set_video_grace(db, PORT2, 90)
+    ke = keydb_lib.KeyEntry(PORT2)
+    assert ke.fetch(db)
+    assert ke.video_quota_mb == 4096 and ke.mav_grace_seconds() == 90
+
+    with pytest.raises(CLIError):
+        keydb_lib.set_video_quota(db, PORT2, -1)
+    with pytest.raises(CLIError):
+        keydb_lib.set_video_grace(db, PORT2, -1)
+    with pytest.raises(CLIError):
+        keydb_lib.set_video_grace(db, PORT2,
+                                  keydb_lib.VIDEO_MAV_GRACE_MAX_S + 1)
+
+    # 0 means "use the default", not "no grace"
+    keydb_lib.set_video_grace(db, PORT2, 0)
+    ke.fetch(db)
+    assert ke.mav_grace_seconds() == keydb_lib.VIDEO_MAV_GRACE_DEFAULT_S
+
+
+def test_video_passwords_via_setters(db):
+    keydb_lib.set_video_viewer_pass(db, PORT2, 'viewpw')
+    keydb_lib.set_video_publish_pass(db, PORT2, 'pubpw')
+    ke = keydb_lib.KeyEntry(PORT2)
+    assert ke.fetch(db)
+    assert ke.video_viewer_pass_matches('viewpw')
+    assert ke.video_publish_pass_matches('pubpw')
+    assert ke.passphrase_matches('pw')       # MAVLink passphrase untouched
+
+    keydb_lib.set_video_viewer_pass(db, PORT2, '')
+    ke.fetch(db)
+    assert not ke.video_viewer_pass_set()
+    assert ke.video_publish_pass_set()       # independent
+
+
+# --- CLI -----------------------------------------------------------------
+
+def _cli(workdir, *argv):
+    return subprocess.run(
+        [sys.executable, KEYDB_PY] + list(argv),
+        cwd=str(workdir), capture_output=True, text=True)
+
+
+@pytest.fixture
+def cli_db(tmp_path):
+    _cli(tmp_path, 'initialise')
+    _cli(tmp_path, 'add', str(PORT1), str(PORT2), 'vid', 'pw')
+    return tmp_path
+
+
+def test_cli_setvideo_and_video_summary(cli_db):
+    assert _cli(cli_db, 'setflag', str(PORT2), 'video').returncode == 0
+    r = _cli(cli_db, 'setvideo', str(PORT2), '21001', '21002')
+    assert r.returncode == 0, r.stderr
+    assert '21001,21002' in r.stdout
+
+    assert _cli(cli_db, 'videoflag', str(PORT2), '0', 'record').returncode == 0
+    assert _cli(cli_db, 'videoflag', str(PORT2), '1', 'srt').returncode == 0
+    assert _cli(cli_db, 'videoopt', str(PORT2), 'audio').returncode == 0
+    assert _cli(cli_db, 'setviewerpass', str(PORT2), 'vp').returncode == 0
+
+    out = _cli(cli_db, 'video', str(PORT2)).stdout
+    assert 'video: enabled' in out
+    assert 'slot 0: port 21001  mpegts +record' in out
+    assert 'slot 1: port 21002  srt' in out
+    assert 'options: audio' in out
+    assert 'viewer password: set' in out
+    assert 'publish password: not set' in out
+
+
+def test_cli_rejects_colliding_video_port(cli_db):
+    _cli(cli_db, 'add', str(OTHER1), str(OTHER2), 'other', 'pw2')
+    r = _cli(cli_db, 'setvideo', str(PORT2), str(OTHER1))
+    assert r.returncode == 1
+    assert 'already in use' in r.stdout + r.stderr
+
+
+def test_cli_clears_ports_and_passwords(cli_db):
+    _cli(cli_db, 'setvideo', str(PORT2), '21001')
+    _cli(cli_db, 'setviewerpass', str(PORT2), 'vp')
+
+    assert _cli(cli_db, 'setvideo', str(PORT2)).returncode == 0
+    assert _cli(cli_db, 'setviewerpass', str(PORT2)).returncode == 0
+
+    out = _cli(cli_db, 'video', str(PORT2)).stdout
+    assert 'no video ports configured' in out
+    assert 'viewer password: not set' in out
+
+
+def test_cli_videoflag_off(cli_db):
+    _cli(cli_db, 'setvideo', str(PORT2), '21001')
+    _cli(cli_db, 'videoflag', str(PORT2), '0', 'record')
+    assert 'record' in _cli(cli_db, 'video', str(PORT2)).stdout
+    r = _cli(cli_db, 'videoflag', str(PORT2), '0', 'record', 'off')
+    assert r.returncode == 0
+    assert '+record' not in _cli(cli_db, 'video', str(PORT2)).stdout
+
+
+class TestSuggestVideoPorts:
+    """Automatic allocation counts up from VIDEO_PORT_BASE."""
+
+    def test_starts_at_the_base(self, db):
+        ke = keydb_lib.add_entry(db, 10001, 10002, 'a', 'p')
+        got = keydb_lib.suggest_video_ports(db, ke, 1)
+        assert got[0] == keydb_lib.VIDEO_PORT_BASE
+        assert got[1:] == [0, 0]
+
+    def test_consecutive_within_one_entry(self, db):
+        ke = keydb_lib.add_entry(db, 10001, 10002, 'a', 'p')
+        assert keydb_lib.suggest_video_ports(db, ke, 3) == [
+            keydb_lib.VIDEO_PORT_BASE,
+            keydb_lib.VIDEO_PORT_BASE + 1,
+            keydb_lib.VIDEO_PORT_BASE + 2]
+
+    def test_skips_ports_another_entry_holds(self, db):
+        base = keydb_lib.VIDEO_PORT_BASE
+        other = keydb_lib.add_entry(db, 10001, 10002, 'a', 'p')
+        other.video_ports = [base, base + 2, 0]
+        other.store(db)
+        ke = keydb_lib.add_entry(db, 10003, 10004, 'b', 'p')
+        assert keydb_lib.suggest_video_ports(db, ke, 2) == [base + 1,
+                                                           base + 3, 0]
+
+    def test_skips_port1_and_port2(self, db):
+        base = keydb_lib.VIDEO_PORT_BASE
+        ke = keydb_lib.add_entry(db, base, base + 1, 'a', 'p')
+        assert keydb_lib.suggest_video_ports(db, ke, 1) == [base + 2, 0, 0]
+
+    def test_keeps_an_already_allocated_port(self, db):
+        """An entry that is already streaming on a port must not be
+        renumbered just because its edit page was opened."""
+        base = keydb_lib.VIDEO_PORT_BASE
+        ke = keydb_lib.add_entry(db, 10001, 10002, 'a', 'p')
+        ke.video_ports = [50000, 0, 0]
+        got = keydb_lib.suggest_video_ports(db, ke, 2, keep=ke.video_ports)
+        assert got == [50000, base, 0]
+
+    def test_kept_port_is_not_reused_for_another_slot(self, db):
+        base = keydb_lib.VIDEO_PORT_BASE
+        ke = keydb_lib.add_entry(db, 10001, 10002, 'a', 'p')
+        ke.video_ports = [0, base, 0]
+        got = keydb_lib.suggest_video_ports(db, ke, 2, keep=ke.video_ports)
+        assert got == [base + 1, base, 0]
+        assert len(set(p for p in got if p)) == 2
+
+    def test_suggestions_validate(self, db):
+        """What the page offers must be storable, or the admin gets an
+        error on a form they did not edit."""
+        ke = keydb_lib.add_entry(db, 10001, 10002, 'a', 'p')
+        got = keydb_lib.suggest_video_ports(db, ke, 3)
+        assert keydb_lib.validate_video_ports(db, ke, got) == got
+
+
+class TestVideoPortCount:
+    def test_no_ports_reads_as_one(self, db):
+        ke = keydb_lib.add_entry(db, 10001, 10002, 'a', 'p')
+        assert ke.video_port_count() == 1
+
+    def test_counts_the_highest_slot_not_the_total(self, db):
+        ke = keydb_lib.add_entry(db, 10001, 10002, 'a', 'p')
+        ke.video_ports = [40001, 0, 40003]
+        assert ke.video_port_count() == 3
+
+    def test_two(self, db):
+        ke = keydb_lib.add_entry(db, 10001, 10002, 'a', 'p')
+        ke.video_ports = [40001, 40002, 0]
+        assert ke.video_port_count() == 2
diff --git a/tests/test_video_schema.py b/tests/test_video_schema.py
new file mode 100644
index 0000000..c4ae28e
--- /dev/null
+++ b/tests/test_video_schema.py
@@ -0,0 +1,202 @@
+"""Schema tests for the video fields in keys.tdb and connections.tdb.
+
+Both records are an ABI shared with C++ (keydb.h / conntdb.h carry
+matching static_asserts). These tests cover the Python half and, more
+importantly, the forward/backward-compatibility contract: a record
+written by an older build must read back with the video fields unset,
+and a record written by a newer build must survive a read-modify-write
+here without losing its tail.
+"""
+import struct
+import sys
+import os
+
+_REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+import conntdb_lib  # noqa: E402
+import keydb_lib  # noqa: E402
+
+# The record layout as the pre-video schema wrote it.
+PREVIDEO_KEY_FMT = "<QQ32siIII32sIfIf14I"
+PREVIDEO_CONN_FMT = "<QQQiiIIIIHBBII4x"
+
+
+def _entry(port2=11001):
+    e = keydb_lib.KeyEntry(port2)
+    e.port1 = port2 - 1
+    e.name = 'vid'
+    e.set_passphrase('pw')
+    return e
+
+
+def test_keyentry_video_roundtrip():
+    e = _entry()
+    e.video_ports = [20001, 20002, 0]
+    e.set_slot_opts(0, keydb_lib.VIDEO_SLOT_SRT | keydb_lib.VIDEO_SLOT_RECORD)
+    e.set_slot_opts(1, keydb_lib.VIDEO_SLOT_RAW_TCP)
+    e.video_flags = keydb_lib.video_set_entry_opts(
+        e.video_flags, keydb_lib.VIDEO_OPT_AUDIO)
+    e.set_video_viewer_pass('viewpw')
+    e.set_video_publish_pass('pubpw')
+    e.video_quota_mb = 4096
+    e.video_mav_grace_s = 90
+
+    blob = e.pack()
+    assert len(blob) == 344
+
+    d = keydb_lib.KeyEntry(0)
+    d.unpack(blob)
+    assert d.video_ports == [20001, 20002, 0]
+    assert d.active_video_ports() == [(0, 20001), (1, 20002)]
+    assert set(d.slot_opt_names(0)) == {'srt', 'record'}
+    assert set(d.slot_opt_names(1)) == {'raw_tcp'}
+    assert d.slot_opt_names(2) == []
+    assert d.entry_opt_names() == ['audio']
+    assert d.video_quota_mb == 4096
+    assert d.mav_grace_seconds() == 90
+
+
+def test_slot_opts_are_independent():
+    """Each slot owns its own byte; setting one must not disturb another."""
+    e = _entry()
+    e.set_slot_opts(0, keydb_lib.VIDEO_SLOT_SRT)
+    e.set_slot_opts(1, keydb_lib.VIDEO_SLOT_RECORD)
+    e.set_slot_opts(2, keydb_lib.VIDEO_SLOT_RAW_TCP)
+    e.video_flags = keydb_lib.video_set_entry_opts(
+        e.video_flags, keydb_lib.VIDEO_OPT_AUDIO)
+
+    assert e.slot_opts(0) == keydb_lib.VIDEO_SLOT_SRT
+    assert e.slot_opts(1) == keydb_lib.VIDEO_SLOT_RECORD
+    assert e.slot_opts(2) == keydb_lib.VIDEO_SLOT_RAW_TCP
+    assert keydb_lib.video_entry_opts(e.video_flags) == keydb_lib.VIDEO_OPT_AUDIO
+
+    # rewriting slot 1 leaves the others (and the entry byte) alone
+    e.set_slot_opts(1, 0)
+    assert e.slot_opts(0) == keydb_lib.VIDEO_SLOT_SRT
+    assert e.slot_opts(1) == 0
+    assert e.slot_opts(2) == keydb_lib.VIDEO_SLOT_RAW_TCP
+    assert keydb_lib.video_entry_opts(e.video_flags) == keydb_lib.VIDEO_OPT_AUDIO
+
+
+def test_video_passwords_are_independent_and_clearable():
+    e = _entry()
+    assert not e.video_viewer_pass_set()
+    assert not e.video_publish_pass_set()
+
+    e.set_video_viewer_pass('viewer')
+    e.set_video_publish_pass('publish')
+    assert e.video_viewer_pass_matches('viewer')
+    assert not e.video_viewer_pass_matches('publish')
+    assert e.video_publish_pass_matches('publish')
+    assert not e.video_publish_pass_matches('viewer')
+
+    # The MAVLink passphrase must be untouched by either.
+    assert e.passphrase_matches('pw')
+
+    # Clearing must not leave a password that the empty string satisfies.
+    e.set_video_viewer_pass('')
+    assert not e.video_viewer_pass_set()
+    assert not e.video_viewer_pass_matches('')
+    assert not e.video_viewer_pass_matches('viewer')
+    assert e.video_publish_pass_set()
+
+
+def test_grace_zero_means_default():
+    e = _entry()
+    assert e.video_mav_grace_s == 0
+    assert e.mav_grace_seconds() == keydb_lib.VIDEO_MAV_GRACE_DEFAULT_S
+    e.video_mav_grace_s = 120
+    assert e.mav_grace_seconds() == 120
+
+
+def test_prevideo_keyentry_zero_extends():
+    """A 168-byte record from the previous schema reads with video unset."""
+    e = _entry(12002)
+    name = e.name.encode('UTF-8').ljust(32, b'\x00')[:32]
+    old = struct.pack(PREVIDEO_KEY_FMT,
+                      e.magic, 7, bytes(e.secret_key), e.port1,
+                      3, 4, 5, name, keydb_lib.FLAG_TLOG, 7.0, 42, 10.0,
+                      *([0] * 14))
+    assert len(old) == 168
+
+    d = keydb_lib.KeyEntry(0)
+    d.unpack(old)
+    # pre-video fields survive
+    assert d.port1 == e.port1 and d.name == 'vid'
+    assert d.flags == keydb_lib.FLAG_TLOG
+    assert d.fc_sysid == 42 and d.tz_offset_hours == 10.0
+    # video fields default off
+    assert d.video_ports == [0] * keydb_lib.MAX_VIDEO_PORTS
+    assert d.video_flags == 0
+    assert d.video_quota_mb == 0
+    assert not d.video_viewer_pass_set()
+    assert not d.video_publish_pass_set()
+    assert d.mav_grace_seconds() == keydb_lib.VIDEO_MAV_GRACE_DEFAULT_S
+    # and re-packing upgrades it in place without losing anything
+    assert len(d.pack()) == 344
+
+
+def test_keyentry_future_tail_preserved():
+    """A newer build's extra bytes must survive read-modify-write here."""
+    e = _entry()
+    e.video_ports = [20001, 0, 0]
+    future = e.pack() + b'\xAB' * 16
+    d = keydb_lib.KeyEntry(0)
+    d.unpack(future)
+    assert d._tail == b'\xAB' * 16
+    assert d.pack() == future
+
+
+def test_connentry_video_fields_roundtrip():
+    rec = struct.pack(
+        conntdb_lib.PACK_FORMAT,
+        conntdb_lib.CONN_MAGIC, 1, 2, 11001,
+        conntdb_lib.VIDEO_CONN_INDEX_BASE, 99, 0, 0,
+        0x0100007f, 0x3930, 1, 0, 0, 0,
+        conntdb_lib.CONN_ROLE_VIDEO_PUB, 2, conntdb_lib.CONN_APP_MPEGTS, 1)
+    assert len(rec) == 72
+
+    ce = conntdb_lib.ConnEntry.unpack(rec)
+    assert ce.role == conntdb_lib.CONN_ROLE_VIDEO_PUB
+    assert ce.role_name == 'video-pub'
+    assert ce.stream_idx == 2
+    assert ce.app_name == 'mpegts'
+    assert ce.authenticated == 1
+    assert ce.is_video
+
+
+def test_prevideo_connentry_fails_closed():
+    """A 64-byte record must zero-extend, leaving authenticated == 0.
+
+    That direction matters: authenticated gates video publish on bidi
+    entries, so an old record must not read as authenticated.
+    """
+    old = struct.pack(PREVIDEO_CONN_FMT,
+                      conntdb_lib.CONN_MAGIC, 100, 200, 11001, 0, 4242,
+                      7, 8, 0x0100007f, 0x3930, 1, 1, 0, 0)
+    assert len(old) == 64
+
+    ce = conntdb_lib.ConnEntry.unpack(old)
+    assert ce.pid == 4242 and ce.is_user == 1
+    assert ce.role == conntdb_lib.CONN_ROLE_MAVLINK
+    assert ce.authenticated == 0
+    assert not ce.is_video
+
+
+def test_video_conn_index_range_is_disjoint():
+    """Video rows must not collide with MAVLink conn_index values.
+
+    MAVLink uses 0 (user) and 1..MAX_COMM2_LINKS (engineer slots), which
+    is 100 in mavlink_msgs.h.
+    """
+    assert conntdb_lib.VIDEO_CONN_INDEX_BASE > 100 + 1
+    for slot in range(keydb_lib.MAX_VIDEO_PORTS):
+        pub = (conntdb_lib.VIDEO_CONN_INDEX_BASE
+               + slot * conntdb_lib.VIDEO_CONN_STRIDE)
+        assert pub > 100
+        # viewers for one slot must not run into the next slot's publisher
+        last_sub = pub + conntdb_lib.VIDEO_CONN_STRIDE - 1
+        next_pub = pub + conntdb_lib.VIDEO_CONN_STRIDE
+        assert last_sub < next_pub

From cace83bac6a22db5b21dad69ac3ec795bf235c6e Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <andrew@tridgell.net>
Date: Tue, 4 Aug 2026 17:29:39 +1000
Subject: [PATCH 3/6] video: per-entry video child with UDP, RTSP and native
 RTMP ingest

Brings video into the machinery that already solves NAT traversal,
per-entry credentials and log retention for MAVLink, so recordings sit
beside the tlogs under the same rules and mediamtx -- which ran with no
authentication, no supervision and no retention -- can be switched off.

Video runs in a long-lived child of the parent, not of the MAVLink
session child. The session child idles out after 10 s, which would take
video with it, and a password holder must be able to publish with no
MAVLink at all. Admission has two independent paths: a publish password
standalone, or a MAVLink session from the same address within a grace
window, which is what lets video ride through a telemetry dropout.

Ingest is MPEG-TS over UDP, RTSP, or RTMP. RTSP is spliced to a loopback
ffmpeg untouched from its first byte: the protocol is request/response,
so classifying before ANNOUNCE deadlocks, and answering OPTIONS makes
ffmpeg's listener reject the following request for being CSeq 2.

RTMP could not use that splice. ffmpeg's listener answers FCPublish with
a bare "onFCPublish" -- the command name alone, no transaction id, no
null, no status object. Measured against the Phoenix camera: the
exchange completes as far as createStream, ffmpeg grants stream id 1,
and the camera then waits 5 s and hangs up without ever sending publish
or a frame. Replaying its bytes at a local ffmpeg produced
byte-identical responses, and the same camera published 74 MB to a
server that answers properly. So RTMP is spoken here -- handshake, chunk
demux, and the commands a publisher uses -- and the media converted to
FLV, which ffmpeg is happy to demux from a pipe. That also drops the
loopback port, and gives RTMP somewhere to carry a publish password.

Fan-out is a memcpy from a per-slot ring: the publisher never inspects
viewer state, never blocks and never allocates, so one slow viewer
cannot stall the stream or the others. Viewers join at a validated
PAT/PMT/random-access point so the stream is decodable from the first
byte they see.

Two things a camera needed that a synthetic publisher never showed.
ffmpeg's AVCC to Annex-B conversion emits a zero-length NAL unit ahead
of every access unit for this camera -- 8362 of 25254 on a clean capture
-- which is invalid H.264 that Chrome refuses outright and Firefox plays
regardless, so -bsf:v h264_metadata rewrites them out. And the muxer
buffered a 32 KiB AVIO block before writing, most of a second at this
bitrate, so the live flags the design called for are now actually
passed.

An unauthenticated peer drives the RTMP parser, since admission needs
the credential out of publish, so the exposure is bounded throughout. A
handshake owns nothing: several negotiate side by side in a pending pool
and the slot is awarded on publish, after admission -- if a pending
handshake held the slot, one byte from anywhere would deny publishing,
and letting a newcomer evict the incumbent only makes that
last-arrival-wins. The pre-publish phase is capped in bytes and seconds,
every length from the wire is checked against what is buffered, chunk
state is committed only once a whole chunk is present (otherwise
ordinary TCP segmentation makes a header parse twice and apply its
timestamp delta again), only fmt 3 may continue a message, and assembly
is bounded across the session rather than per chunk stream.

Acknowledgements and ping replies are sent: a publisher that sets a
window and never sees a type-3 back is entitled to stop, which presents
as a camera that streams for a while and then stalls.

Credentials are redacted before anything is logged. A viewer may
authenticate with ?pw=, which unlike the 60-second view token is
long-lived, and the log is kept on disk and rendered into the admin UI.
---
 Makefile                         |   13 +-
 httpreq.cpp                      |  243 +++++
 httpreq.h                        |   76 ++
 supportproxy.cpp                 |  236 ++++-
 tests/rtmp_client.py             |  173 ++++
 tests/test_bidi_video_preauth.py |  173 ++++
 tests/test_video_child.py        |  490 +++++++++
 tests/test_video_ingest.py       |  254 +++++
 tests/test_video_record.py       |  275 ++++++
 tests/test_video_rtsp.py         | 1008 +++++++++++++++++++
 tests/test_video_view.py         |  820 ++++++++++++++++
 tests/tsgen.py                   |  176 ++++
 video.cpp                        | 1583 ++++++++++++++++++++++++++++++
 video.h                          |   39 +
 videoauth.cpp                    |  200 ++++
 videoauth.h                      |  119 +++
 videorec.cpp                     |  262 +++++
 videorec.h                       |   97 ++
 videortmp.cpp                    | 1008 +++++++++++++++++++
 videortmp.h                      |  239 +++++
 videortsp.cpp                    |  372 +++++++
 videortsp.h                      |  108 ++
 videostream.cpp                  |  178 ++++
 videostream.h                    |   66 ++
 videots.cpp                      |  842 ++++++++++++++++
 videots.h                        |  165 ++++
 videoview.cpp                    |  494 ++++++++++
 videoview.h                      |  179 ++++
 28 files changed, 9876 insertions(+), 12 deletions(-)
 create mode 100644 httpreq.cpp
 create mode 100644 httpreq.h
 create mode 100644 tests/rtmp_client.py
 create mode 100644 tests/test_bidi_video_preauth.py
 create mode 100644 tests/test_video_child.py
 create mode 100644 tests/test_video_ingest.py
 create mode 100644 tests/test_video_record.py
 create mode 100644 tests/test_video_rtsp.py
 create mode 100644 tests/test_video_view.py
 create mode 100644 tests/tsgen.py
 create mode 100644 video.cpp
 create mode 100644 video.h
 create mode 100644 videoauth.cpp
 create mode 100644 videoauth.h
 create mode 100644 videorec.cpp
 create mode 100644 videorec.h
 create mode 100644 videortmp.cpp
 create mode 100644 videortmp.h
 create mode 100644 videortsp.cpp
 create mode 100644 videortsp.h
 create mode 100644 videostream.cpp
 create mode 100644 videostream.h
 create mode 100644 videots.cpp
 create mode 100644 videots.h
 create mode 100644 videoview.cpp
 create mode 100644 videoview.h

diff --git a/Makefile b/Makefile
index 36e1624..5b324a8 100644
--- a/Makefile
+++ b/Makefile
@@ -12,7 +12,7 @@ CXXFLAGS := $(CXXFLAGS) -DMAVLINK_SIGNING_TIMESTAMP_LIMIT=600
 LIBS := -ltdb -lssl -lcrypto
 
 # Source files
-SOURCES := supportproxy.cpp mavlink.cpp util.cpp keydb.cpp conntdb.cpp tlog.cpp session.cpp binlog.cpp cleanup.cpp websocket.cpp
+SOURCES := supportproxy.cpp mavlink.cpp util.cpp keydb.cpp conntdb.cpp tlog.cpp session.cpp binlog.cpp cleanup.cpp websocket.cpp video.cpp videoauth.cpp videots.cpp videostream.cpp videorec.cpp videoview.cpp httpreq.cpp videortsp.cpp videortmp.cpp
 OBJECTS := $(SOURCES:.cpp=.o)
 TARGET := supportproxy
 
@@ -73,7 +73,7 @@ mavlink.o: mavlink.cpp mavlink.h $(MAVLINK_DIR)/protocol.h
 
 # Dependencies. mavlink.h includes keydb.h, so any object that pulls in
 # mavlink.h transitively depends on keydb.h too.
-supportproxy.o: supportproxy.cpp mavlink.h util.h keydb.h conntdb.h tlog.h binlog.h session.h cleanup.h websocket.h
+supportproxy.o: supportproxy.cpp mavlink.h util.h keydb.h conntdb.h tlog.h binlog.h session.h cleanup.h websocket.h video.h videots.h
 mavlink.o: mavlink.cpp mavlink.h keydb.h $(MAVLINK_DIR)/protocol.h
 util.o: util.cpp util.h
 keydb.o: keydb.cpp keydb.h
@@ -83,6 +83,15 @@ session.o: session.cpp session.h
 binlog.o: binlog.cpp binlog.h session.h mavlink.h util.h cleanup.h $(MAVLINK_DIR)/protocol.h
 cleanup.o: cleanup.cpp cleanup.h keydb.h
 websocket.o: websocket.cpp websocket.h util.h
+video.o: video.cpp video.h videoauth.h videots.h videostream.h videorec.h videoview.h httpreq.h videortsp.h videortmp.h conntdb.h keydb.h util.h
+videoauth.o: videoauth.cpp videoauth.h conntdb.h keydb.h
+videots.o: videots.cpp videots.h
+videostream.o: videostream.cpp videostream.h
+videorec.o: videorec.cpp videorec.h session.h cleanup.h
+videoview.o: videoview.cpp videoview.h httpreq.h videostream.h videots.h videoauth.h keydb.h
+httpreq.o: httpreq.cpp httpreq.h
+videortsp.o: videortsp.cpp videortsp.h
+videortmp.o: videortmp.cpp videortmp.h httpreq.h
 
 # Testing
 test: $(TARGET)
diff --git a/httpreq.cpp b/httpreq.cpp
new file mode 100644
index 0000000..e844208
--- /dev/null
+++ b/httpreq.cpp
@@ -0,0 +1,243 @@
+/*
+  Minimal HTTP request parsing for the video port. See httpreq.h.
+ */
+#include "httpreq.h"
+
+#include <ctype.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <openssl/bio.h>
+#include <openssl/buffer.h>
+#include <openssl/evp.h>
+
+int HttpRequest::feed(const uint8_t *buf, size_t n)
+{
+    if (buf_.size() + n > HTTP_MAX_REQUEST) {
+        return -1;
+    }
+    buf_.append(reinterpret_cast<const char *>(buf), n);
+    const size_t end = buf_.find("\r\n\r\n");
+    if (end == std::string::npos) {
+        // Tolerate bare-LF headers from hand-rolled clients.
+        const size_t end2 = buf_.find("\n\n");
+        if (end2 == std::string::npos) {
+            return 0;
+        }
+    }
+    return parse() ? 1 : -1;
+}
+
+bool HttpRequest::parse(void)
+{
+    size_t hdr_end = buf_.find("\r\n\r\n");
+    size_t sep = 4;
+    if (hdr_end == std::string::npos) {
+        hdr_end = buf_.find("\n\n");
+        sep = 2;
+        if (hdr_end == std::string::npos) {
+            return false;
+        }
+    }
+    leftover_ = buf_.substr(hdr_end + sep);
+    const std::string head = buf_.substr(0, hdr_end);
+
+    size_t line_end = head.find('\n');
+    if (line_end == std::string::npos) {
+        return false;
+    }
+    std::string line = head.substr(0, line_end);
+    if (!line.empty() && line.back() == '\r') {
+        line.pop_back();
+    }
+    headers_ = head.substr(line_end + 1);
+
+    const size_t sp1 = line.find(' ');
+    if (sp1 == std::string::npos) {
+        return false;
+    }
+    const size_t sp2 = line.find(' ', sp1 + 1);
+    if (sp2 == std::string::npos) {
+        return false;
+    }
+    method_ = line.substr(0, sp1);
+    target_ = line.substr(sp1 + 1, sp2 - sp1 - 1);
+
+    const size_t q = target_.find('?');
+    if (q == std::string::npos) {
+        path_ = target_;
+        query_.clear();
+    } else {
+        path_ = target_.substr(0, q);
+        query_ = target_.substr(q + 1);
+    }
+    return !method_.empty() && !path_.empty();
+}
+
+static std::string lower(const std::string &s)
+{
+    std::string o = s;
+    for (auto &c : o) {
+        c = char(tolower(static_cast<unsigned char>(c)));
+    }
+    return o;
+}
+
+std::string HttpRequest::header(const char *name) const
+{
+    const std::string want = lower(name) + ":";
+    size_t pos = 0;
+    while (pos < headers_.size()) {
+        size_t eol = headers_.find('\n', pos);
+        if (eol == std::string::npos) {
+            eol = headers_.size();
+        }
+        std::string line = headers_.substr(pos, eol - pos);
+        if (!line.empty() && line.back() == '\r') {
+            line.pop_back();
+        }
+        if (lower(line).compare(0, want.size(), want) == 0) {
+            std::string v = line.substr(want.size());
+            size_t b = v.find_first_not_of(" \t");
+            if (b == std::string::npos) {
+                return "";
+            }
+            size_t e = v.find_last_not_of(" \t");
+            return v.substr(b, e - b + 1);
+        }
+        pos = eol + 1;
+    }
+    return "";
+}
+
+std::string HttpRequest::query(const char *name) const
+{
+    const std::string want = name;
+    size_t pos = 0;
+    while (pos <= query_.size()) {
+        size_t amp = query_.find('&', pos);
+        if (amp == std::string::npos) {
+            amp = query_.size();
+        }
+        const std::string kv = query_.substr(pos, amp - pos);
+        const size_t eq = kv.find('=');
+        if (eq != std::string::npos && kv.compare(0, eq, want) == 0) {
+            return http_url_decode(kv.substr(eq + 1));
+        }
+        if (amp == query_.size()) {
+            break;
+        }
+        pos = amp + 1;
+    }
+    return "";
+}
+
+std::string http_url_decode(const std::string &s)
+{
+    std::string o;
+    o.reserve(s.size());
+    for (size_t i = 0; i < s.size(); i++) {
+        if (s[i] == '+') {
+            o += ' ';
+        } else if (s[i] == '%' && i + 2 < s.size()
+                   && isxdigit(static_cast<unsigned char>(s[i + 1]))
+                   && isxdigit(static_cast<unsigned char>(s[i + 2]))) {
+            const std::string hex = s.substr(i + 1, 2);
+            o += char(strtol(hex.c_str(), nullptr, 16));
+            i += 2;
+        } else {
+            o += s[i];
+        }
+    }
+    return o;
+}
+
+std::string http_basic_password(const std::string &authorization)
+{
+    const std::string prefix = "Basic ";
+    if (authorization.size() <= prefix.size()
+        || lower(authorization).compare(0, prefix.size(),
+                                        lower(prefix)) != 0) {
+        return "";
+    }
+    const std::string b64 = authorization.substr(prefix.size());
+
+    // base64-decode; the result is "user:password" and we want the pass
+    std::string out(b64.size(), '\0');
+    BIO *b = BIO_new_mem_buf(b64.data(), int(b64.size()));
+    BIO *d = BIO_new(BIO_f_base64());
+    BIO_set_flags(d, BIO_FLAGS_BASE64_NO_NL);
+    b = BIO_push(d, b);
+    const int n = BIO_read(b, &out[0], int(out.size()));
+    BIO_free_all(b);
+    if (n <= 0) {
+        return "";
+    }
+    out.resize(size_t(n));
+    const size_t colon = out.find(':');
+    if (colon == std::string::npos) {
+        return "";
+    }
+    return out.substr(colon + 1);
+}
+
+std::string http_simple_response(int code, const char *reason,
+                                 const char *content_type,
+                                 const std::string &text)
+{
+    char head[512];
+    snprintf(head, sizeof(head),
+             "HTTP/1.1 %d %s\r\n"
+             "Content-Type: %s\r\n"
+             "Content-Length: %zu\r\n"
+             "Cache-Control: no-store\r\n"
+             "Connection: close\r\n"
+             "\r\n",
+             code, reason, content_type, text.size());
+    return std::string(head) + text;
+}
+
+
+std::string http_redact_target(const std::string &target)
+{
+    static const char *secret_keys[] = { "pw", "password", "t", "key" };
+    const size_t q = target.find('?');
+    if (q == std::string::npos) {
+        return target;
+    }
+    std::string out = target.substr(0, q + 1);
+    size_t at = q + 1;
+    bool first = true;
+    while (at <= target.size()) {
+        size_t end = target.find('&', at);
+        if (end == std::string::npos) {
+            end = target.size();
+        }
+        const std::string kv = target.substr(at, end - at);
+        const size_t eq = kv.find('=');
+        if (!first) {
+            out += '&';
+        }
+        first = false;
+        if (eq == std::string::npos) {
+            out += kv;
+        } else {
+            const std::string k = kv.substr(0, eq);
+            bool secret = false;
+            for (const char *s : secret_keys) {
+                if (k == s) {
+                    secret = true;
+                    break;
+                }
+            }
+            out += k;
+            out += '=';
+            out += secret ? "<redacted>" : kv.substr(eq + 1);
+        }
+        if (end == target.size()) {
+            break;
+        }
+        at = end + 1;
+    }
+    return out;
+}
diff --git a/httpreq.h b/httpreq.h
new file mode 100644
index 0000000..712b506
--- /dev/null
+++ b/httpreq.h
@@ -0,0 +1,76 @@
+/*
+  Minimal HTTP request parsing for the video port.
+
+  Only what a viewer connection needs: the request line, a handful of
+  headers, and a query string. Deliberately not a general HTTP server --
+  the video port serves one thing.
+ */
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+// Longest request we will buffer before giving up on a peer. A viewer
+// request is a few hundred bytes; anything much larger is a client
+// doing something we do not serve.
+#define HTTP_MAX_REQUEST 8192
+
+class HttpRequest {
+public:
+    // Feed bytes as they arrive. Returns:
+    //   1  complete request parsed
+    //   0  incomplete, feed more
+    //  -1  malformed or too large
+    int feed(const uint8_t *buf, size_t n);
+
+    const std::string &method(void) const { return method_; }
+    const std::string &target(void) const { return target_; }
+    const std::string &path(void) const { return path_; }
+
+    // Header lookup, case-insensitive. Empty string when absent.
+    std::string header(const char *name) const;
+
+    // Query parameter from the request target. Empty when absent.
+    std::string query(const char *name) const;
+
+    // Bytes left over after the request (a pipelined body, normally
+    // none). The caller owns what it does with them.
+    const std::string &leftover(void) const { return leftover_; }
+
+private:
+    std::string buf_;
+    std::string method_;
+    std::string target_;
+    std::string path_;
+    std::string query_;
+    std::string headers_;      // raw block, searched case-insensitively
+    std::string leftover_;
+
+    bool parse(void);
+};
+
+// Percent-decode, in place semantics (returns a new string). Invalid
+// escapes are left as-is rather than silently dropped.
+std::string http_url_decode(const std::string &s);
+
+/*
+  A request target with credential query values replaced.
+
+  Anything logged has to go through this. A viewer may authenticate with
+  ?pw=, and unlike the 60-second view token that is a long-lived
+  credential -- writing it to proxy.log puts it on disk for the life of
+  the file and into every operator's browser through the server page.
+  Redacting at the point of display is too late for the copy on disk.
+ */
+std::string http_redact_target(const std::string &target);
+
+// Decode a "Basic base64(user:pass)" credential. Returns the password
+// part, or an empty string if the header is not Basic or is malformed.
+std::string http_basic_password(const std::string &authorization);
+
+// Build a simple response with no body beyond `text`.
+std::string http_simple_response(int code, const char *reason,
+                                 const char *content_type,
+                                 const std::string &text);
diff --git a/supportproxy.cpp b/supportproxy.cpp
index c0eecab..3613bdc 100644
--- a/supportproxy.cpp
+++ b/supportproxy.cpp
@@ -43,6 +43,9 @@
 #include "session.h"
 #include "cleanup.h"
 #include "websocket.h"
+#include "video.h"
+#include "videots.h"
+#include "videostream.h"
 
 #include <vector>
 
@@ -79,6 +82,14 @@ struct listen_port {
     int sock1_udp, sock2_udp;
     int sock1_tcp, sock2_listen;
     pid_t pid;
+    // Long-lived video child. Independent of `pid`: video must survive
+    // a MAVLink session ending, and must run with no session at all
+    // when the entry has a publish password.
+    pid_t video_pid;
+    time_t video_respawn_after;   // backoff so a child that dies at once
+                                  // can't be re-forked in a tight loop
+    uint32_t video_ports[KEY_MAX_VIDEO_PORTS];
+    uint32_t video_flags;
     uint32_t flags;
     uint8_t  fc_sysid;     // 0 = match any; otherwise the FC's MAVLink
                            // sysid for binlog reboot detection
@@ -135,12 +146,56 @@ static void close_sockets(struct listen_port *p);
   Used both at startup and on each reload; reload_ports() handles the
   flip side (entries that were in keys.tdb last time and aren't now).
  */
+/*
+  Video config that requires a rebind: the enable bit, the ports, and
+  the per-slot options (SRT vs plain MPEG-TS changes how the UDP socket
+  is used). A change here re-forks the video child. Policy that does not
+  need a rebind -- credentials, grace, quota -- is re-read by the child
+  itself on its tick, so those take effect without dropping a publisher.
+ */
+static bool video_cfg_differs(const struct listen_port *p, uint32_t flags,
+                              const uint32_t *video_ports,
+                              uint32_t video_flags)
+{
+    if ((p->flags & KEY_FLAG_VIDEO) != (flags & KEY_FLAG_VIDEO)) {
+        return true;
+    }
+    if (p->video_flags != video_flags) {
+        return true;
+    }
+    for (int i = 0; i < KEY_MAX_VIDEO_PORTS; i++) {
+        if (p->video_ports[i] != video_ports[i]) {
+            return true;
+        }
+    }
+    return false;
+}
+
+static void video_stop_child(struct listen_port *p, const char *why)
+{
+    if (p->video_pid == 0) {
+        return;
+    }
+    printf("[%d] video child %d stopping (%s)\n",
+           p->port2, int(p->video_pid), why);
+    kill(p->video_pid, SIGTERM);
+}
+
 static void upsert_port(int port1, int port2, uint32_t flags, uint8_t fc_sysid,
-                        float tz_offset_hours)
+                        float tz_offset_hours, const uint32_t *video_ports,
+                        uint32_t video_flags)
 {
     for (auto *p = ports; p; p=p->next) {
         if (p->port2 == port2) {
             p->seen = true;
+            if (video_cfg_differs(p, flags, video_ports, video_flags)) {
+                // Ports/enable/slot options changed: the running child
+                // still binds the old set, so stop it and let
+                // check_children() re-fork with the new config.
+                video_stop_child(p, "video config changed");
+            }
+            memcpy(p->video_ports, video_ports, sizeof(p->video_ports));
+            p->video_flags = video_flags;
             if (p->removed) {
                 // came back: re-add as a fresh listener
                 printf("[%d] re-added (port1=%d)\n", port2, port1);
@@ -185,6 +240,10 @@ static void upsert_port(int port1, int port2, uint32_t flags, uint8_t fc_sysid,
     p->sock1_tcp = -1;
     p->sock2_listen = -1;
     p->pid = 0;
+    p->video_pid = 0;
+    p->video_respawn_after = 0;
+    memcpy(p->video_ports, video_ports, sizeof(p->video_ports));
+    p->video_flags = video_flags;
     p->flags = flags;
     p->fc_sysid = fc_sysid;
     p->tz_offset_hours = tz_offset_hours;
@@ -211,7 +270,7 @@ static int handle_record(struct tdb_context *db, TDB_DATA key, TDB_DATA data, vo
     // a MAVLink sysid (0..255), so truncate to uint8 once it crosses the
     // C++/binlog boundary. The CLI / web UI already cap at 255.
     upsert_port(k.port1, port2, k.flags, uint8_t(k.fc_sysid),
-                k.tz_offset_hours);
+                k.tz_offset_hours, k.video_ports, k.video_flags);
     return 0;
 }
 
@@ -331,6 +390,12 @@ static void main_loop(struct listen_port *p)
     // polluted by log traffic. Engineer→user direction is unchanged.
     BinlogWriter binlog;
     const bool binlog_enabled = (p->flags & KEY_FLAG_BINLOG) != 0;
+
+    // Video counts as a downstream consumer of user-side packets even
+    // though nothing here writes video: with bidi signing, the video
+    // side needs this session to reach an authenticated state, and on
+    // the TCP path that only happens inside the parse block below.
+    const bool video_enabled = (p->flags & KEY_FLAG_VIDEO) != 0;
     if (binlog_enabled) {
         // Per-entry sysid filter for SYSTEM_TIME-based reboot
         // detection. 0 (default) accepts any sysid.
@@ -613,10 +678,11 @@ static void main_loop(struct listen_port *p)
             }
             mavlink_message_t msg {};
 	    // Parse user-side bytes whenever there's anywhere for them to
-	    // go: a connected engineer (forward), tlog recording, or
-	    // binlog recording. Without one of those, the bytes are read
-	    // off the socket but discarded.
-	    if (conn2_count > 0 || binlog_enabled || tlog_enabled) {
+	    // go: a connected engineer (forward), tlog recording, binlog
+	    // recording, or video (which needs the session to authenticate).
+	    // Without one of those, the bytes are read off the socket but
+	    // discarded.
+	    if (conn2_count > 0 || binlog_enabled || tlog_enabled || video_enabled) {
 		uint8_t *buf0 = buf;
 		while (n > 0 && mav1.receive_message(buf0, n, msg)) {
 		    mav1_rx_msgs++;
@@ -807,8 +873,18 @@ static void main_loop(struct listen_port *p)
             count1++;
 	    mavlink_message_t msg {};
 	    // Parse whenever a downstream consumer needs it (engineer
-	    // forward, tlog, or binlog). Otherwise just discard.
-	    if (conn2_count > 0 || binlog_enabled || tlog_enabled) {
+	    // forward, tlog, binlog, or video). Otherwise just discard.
+	    //
+	    // video_enabled is load-bearing here, not just symmetry. On
+	    // this TCP path conn1 latches at accept(), before any
+	    // signature check, and receive_message() below is the only
+	    // thing that ever sets is_authenticated(). A bidi entry with
+	    // video but no engineer/tlog/binlog would therefore never
+	    // authenticate, and the CONN1_BIDI_PREAUTH_SECONDS check
+	    // would kill the session. (The UDP path differs: it
+	    // validates inside its latch block, so it authenticates
+	    // regardless of this gate.)
+	    if (conn2_count > 0 || binlog_enabled || tlog_enabled || video_enabled) {
 		uint8_t *buf0 = buf;
 		while (n > 0 && mav1.receive_message(buf0, n, msg)) {
 		    mav1_rx_msgs++;
@@ -1126,6 +1202,101 @@ static void open_sockets(struct listen_port *p)
     }
 }
 
+/*
+  Fork the long-lived video child for one entry.
+
+  Unlike handle_connection()'s per-pair child this is forked from
+  reload_ports() rather than on traffic, and it outlives any MAVLink
+  session. The parent owns it directly, which is what makes shutdown
+  ordering knowable: check_children() reaps it and clears video_pid.
+ */
+static void fork_video_child(struct listen_port *p)
+{
+    int ready[2] = { -1, -1 };
+    if (pipe(ready) != 0) {
+        printf("[%d] video: pipe failed - %s\n", p->port2, strerror(errno));
+        return;
+    }
+
+    pid_t pid = fork();
+    if (pid < 0) {
+        printf("[%d] video: fork failed - %s\n", p->port2, strerror(errno));
+        close(ready[0]);
+        close(ready[1]);
+        return;
+    }
+    if (pid == 0) {
+        close(ready[0]);
+        // Die with the parent. PDEATHSIG only fires for a parent that
+        // was alive when it was armed, hence the getppid() recheck.
+        prctl(PR_SET_PDEATHSIG, SIGTERM);
+        if (getppid() == 1) {
+            _exit(0);
+        }
+        // The session children set SIGCHLD to SIG_IGN, which makes
+        // waitpid() fail with ECHILD. We are not descended from them,
+        // but be explicit: this child supervises its own subprocesses
+        // in later phases and needs real exit statuses.
+        signal(SIGCHLD, SIG_DFL);
+        signal(SIGUSR1, SIG_DFL);
+
+        // fd sanitation. Being a child of the *parent* rather than of a
+        // session child, we never inherit conn1, the accepted engineer
+        // sockets, SSL state or the open tlog/binlog fds -- only the
+        // listeners and the epoll instance, which all go here.
+        if (g_epfd != -1) {
+            close(g_epfd);
+            g_epfd = -1;
+        }
+        for (auto *p2 = ports; p2; p2 = p2->next) {
+            close_sockets(p2);
+        }
+        video_child_main(p->port2, ready[1]);
+        // video_child_main is noreturn and _exit()s: never fall back
+        // into the parent's code with copied destructors that would
+        // close fd numbers we have since reused.
+    }
+
+    close(ready[1]);
+    p->video_pid = pid;
+
+    // Read the readiness byte. The child writes it right after binding,
+    // and closes the fd on any exit path, so this cannot hang.
+    uint8_t st = 0;
+    ssize_t n = read(ready[0], &st, 1);
+    close(ready[0]);
+    if (n == 1 && st != 0) {
+        printf("[%d] video child %d started but a port failed to bind - %s\n",
+               p->port2, int(pid), strerror(int(st)));
+    } else if (n == 1) {
+        printf("[%d] video child %d ready\n", p->port2, int(pid));
+    } else {
+        printf("[%d] video child %d exited before signalling ready\n",
+               p->port2, int(pid));
+    }
+}
+
+/*
+  Start or stop video children so the running set matches keys.tdb.
+
+  Called from main() as well as reload_ports(): without the startup
+  call, an entry with video enabled would sit with its ports unbound
+  until the first 5 s reload, which looks like the feature is broken.
+ */
+static void reconcile_video_children(void)
+{
+    const time_t now = time(nullptr);
+    for (auto *p = ports; p; p=p->next) {
+        const bool want = !p->removed
+            && video_entry_wants_child(p->flags, p->video_ports);
+        if (want && p->video_pid == 0 && now >= p->video_respawn_after) {
+            fork_video_child(p);
+        } else if (!want && p->video_pid != 0) {
+            video_stop_child(p, "video disabled");
+        }
+    }
+}
+
 /*
   check for child exit. Returns true if a per-port-pair child was
   reaped (the caller should refresh the epoll set so the reopened
@@ -1148,11 +1319,34 @@ static bool check_children(void)
         }
         bool found_child = false;
         for (auto *p = ports; p; p=p->next) {
+            if (p->video_pid == pid) {
+                // Video children are long-lived, so an exit is either a
+                // config change we asked for or a crash. Either way the
+                // backoff keeps a child that dies immediately from being
+                // re-forked in a tight loop; reload_ports() re-forks it.
+                printf("[%d] video child %d exited (status %d)\n",
+                       p->port2, int(pid),
+                       WIFEXITED(wstatus) ? WEXITSTATUS(wstatus) : -1);
+                p->video_pid = 0;
+                p->video_respawn_after = time(nullptr) + 2;
+                conn_remove_video(p->port2);
+                found_child = true;
+                break;
+            }
             if (p->pid == pid) {
                 printf("[%d] Child %d exited\n", p->port2, int(pid));
                 p->pid = 0;
-		// drop any live-connection records the child wrote
-		conn_remove_port2(p->port2);
+		// Drop the records this child wrote -- but only its own
+		// index range. A video child for the same entry may still
+		// be running, and whole-port2 delete would erase its rows.
+		{
+		    auto *cdb = conn_db_open_transaction();
+		    if (cdb != nullptr) {
+			conn_delete_index_range(cdb, p->port2, 0,
+						VIDEO_CONN_INDEX_BASE - 1);
+			conn_db_close_commit(cdb);
+		    }
+		}
 		found_child = true;
 		reaped = true;
 		// Don't reopen listening sockets for an entry that was
@@ -1293,6 +1487,7 @@ static void reload_ports(void)
             if (p->pid != 0) {
                 kill(p->pid, SIGTERM);
             }
+            video_stop_child(p, "entry removed");
             conn_remove_port2(p->port2);
         }
     }
@@ -1303,6 +1498,8 @@ static void reload_ports(void)
 	    open_sockets(p);
 	}
     }
+
+    reconcile_video_children();
 }
 
 /*
@@ -1402,6 +1599,24 @@ static void wait_connection(void)
 int main(int argc, char *argv[])
 {
     setvbuf(stdout, nullptr, _IOLBF, 4096);
+    // Unit checks for the TS scanner's bit twiddling. End-to-end tests
+    // find that class of bug only intermittently, so it gets a direct
+    // entry point that the suite invokes.
+    if (argc > 1 && strcmp(argv[1], "--selftest-video") == 0) {
+        int rc = videots_selftest();
+        if (rc == 0) {
+            rc = videostream_selftest();
+        }
+        if (rc == 0) {
+            // A short deterministic fuzz run on every invocation, so a
+            // regression in the PSI parsing shows up in the normal
+            // suite rather than only in a dedicated campaign.
+            const unsigned iters = argc > 2 ? unsigned(atoi(argv[2])) : 2000;
+            const uint32_t seed = argc > 3 ? uint32_t(atoi(argv[3])) : 1;
+            rc = videots_fuzz(iters, seed);
+        }
+        return rc;
+    }
     // a peer-closed TCP/WS/SSL connection must fail the write with
     // EPIPE, not kill the child (and its whole session) with SIGPIPE
     signal(SIGPIPE, SIG_IGN);
@@ -1420,6 +1635,7 @@ int main(int argc, char *argv[])
     printf("Added %u ports\n", unsigned(count_ports()));
     db_close_cancel(db);
 
+    reconcile_video_children();
     fork_cleanup_child();
 
     wait_connection();
diff --git a/tests/rtmp_client.py b/tests/rtmp_client.py
new file mode 100644
index 0000000..cc1f928
--- /dev/null
+++ b/tests/rtmp_client.py
@@ -0,0 +1,173 @@
+"""A minimal RTMP publisher, for the cases ffmpeg's client never sends.
+
+ffmpeg publishes politely: it waits for onStatus before streaming, and
+its writes happen to align with chunk boundaries. Two defects in our
+server were invisible to it -- media pipelined into the same segment as
+publish, and a chunk header split from its payload -- so the tests need
+a client that can be told to do both.
+
+It replays the tags of a real FLV file rather than synthesising H.264,
+so the bitstream, the avcC and the frame types are genuine.
+"""
+import os
+import socket
+import struct
+
+
+def _amf_str(s):
+    b = s.encode()
+    return b'\x02' + struct.pack('>H', len(b)) + b
+
+
+def _amf_num(v):
+    return b'\x00' + struct.pack('>d', v)
+
+
+def _amf_null():
+    return b'\x05'
+
+
+def _amf_obj(d):
+    out = b'\x03'
+    for k, v in d.items():
+        kb = k.encode()
+        out += struct.pack('>H', len(kb)) + kb
+        out += _amf_str(v) if isinstance(v, str) else _amf_num(v)
+    return out + b'\x00\x00\x09'
+
+
+def read_flv_tags(path):
+    """[(tag_type, timestamp, payload)] for audio/video/script tags."""
+    d = open(path, 'rb').read()
+    i = 9 + 4                      # header + PreviousTagSize0
+    tags = []
+    while i + 11 <= len(d):
+        ttype = d[i] & 0x1f
+        sz = int.from_bytes(d[i + 1:i + 4], 'big')
+        ts = int.from_bytes(d[i + 4:i + 7], 'big') | (d[i + 7] << 24)
+        body = d[i + 11:i + 11 + sz]
+        if len(body) < sz:
+            break
+        if ttype in (8, 9, 18):
+            tags.append((ttype, ts, body))
+        i += 11 + sz + 4
+    return tags
+
+
+class RtmpPublisher:
+    """Publishes to a SupportProxy video port, byte layout under test control."""
+
+    def __init__(self, host, port, app='PhoenixFPV', stream='FPV',
+                 timeout=10):
+        self.s = socket.create_connection((host, port), timeout)
+        self.s.settimeout(timeout)
+        self.app = app
+        self.stream = stream
+        self.out_chunk = 4096
+
+    # -- framing ---------------------------------------------------
+
+    def _chunk(self, csid, mtype, sid, ts, payload, fmt=0):
+        if fmt == 0:
+            hdr = (bytes([csid]) + ts.to_bytes(3, 'big')
+                   + len(payload).to_bytes(3, 'big') + bytes([mtype])
+                   + struct.pack('<I', sid))
+        elif fmt == 1:
+            hdr = (bytes([0x40 | csid]) + ts.to_bytes(3, 'big')
+                   + len(payload).to_bytes(3, 'big') + bytes([mtype]))
+        else:
+            raise ValueError('fmt %d not needed here' % fmt)
+        out = bytearray(hdr)
+        at = 0
+        while at < len(payload):
+            if at:
+                out += bytes([0xc0 | csid])
+            out += payload[at:at + self.out_chunk]
+            at += self.out_chunk
+        return bytes(out)
+
+    def _command(self, payload):
+        return self._chunk(3, 20, 0, 0, payload)
+
+    def _drain(self, seconds=0.4):
+        self.s.settimeout(seconds)
+        got = b''
+        try:
+            while True:
+                b = self.s.recv(65536)
+                if not b:
+                    break
+                got += b
+        except socket.timeout:
+            pass
+        self.s.settimeout(10)
+        return got
+
+    # -- protocol --------------------------------------------------
+
+    def handshake(self):
+        self.s.sendall(b'\x03' + bytes(1536))       # C0 + C1
+        want = 1 + 1536 + 1536
+        got = b''
+        while len(got) < want:
+            b = self.s.recv(want - len(got))
+            if not b:
+                raise AssertionError('server closed during handshake')
+            got += b
+        self.s.sendall(got[1:1537])                 # C2 echoes S1
+        return got
+
+    def connect(self, password=None):
+        stream = self.stream
+        if password:
+            stream = '%s?pw=%s' % (stream, password)
+        tc = 'rtmp://127.0.0.1/%s' % self.app
+        # Announce our outbound chunk size before sending anything that
+        # needs splitting; the peer assumes the 128-byte default until
+        # told otherwise.
+        self.s.sendall(self._chunk(2, 1, 0, 0,
+                                   self.out_chunk.to_bytes(4, 'big')))
+        self.s.sendall(self._command(
+            _amf_str('connect') + _amf_num(1) +
+            _amf_obj({'app': self.app, 'tcUrl': tc, 'flashVer': 'test'})))
+        self._drain()
+        self.s.sendall(self._command(
+            _amf_str('createStream') + _amf_num(2) + _amf_null()))
+        self._drain()
+        self._publish_cmd = (self._command(
+            _amf_str('publish') + _amf_num(3) + _amf_null() +
+            _amf_str(stream) + _amf_str('live')))
+
+    def publish(self, first_tags=(), pipeline=False):
+        """Send publish. With pipeline, media rides the same write.
+
+        Pipelining is what a publisher that does not wait for onStatus
+        does, and it is where the sequence header used to be dropped.
+        """
+        buf = self._publish_cmd
+        for ttype, ts, body in first_tags:
+            buf += self._chunk(6, ttype, 1, ts, body)
+        self.s.sendall(buf)
+        if not pipeline:
+            self._drain()
+
+    def send_tag(self, ttype, ts, body, fmt=0, split=False):
+        """One media message. split writes header and payload separately.
+
+        That is the shape that made the parser apply a chunk's timestamp
+        delta twice: the header arrives, the payload does not, and the
+        header is re-parsed on the next read.
+        """
+        frame = self._chunk(6, ttype, 1, ts, body, fmt=fmt)
+        if split:
+            head = 8 if fmt == 1 else 12
+            self.s.sendall(frame[:head])
+            self.s.sendall(frame[head:])
+        else:
+            self.s.sendall(frame)
+
+    def close(self):
+        try:
+            self.s.close()
+        except OSError:
+            pass
diff --git a/tests/test_bidi_video_preauth.py b/tests/test_bidi_video_preauth.py
new file mode 100644
index 0000000..8e7030a
--- /dev/null
+++ b/tests/test_bidi_video_preauth.py
@@ -0,0 +1,173 @@
+"""Regression tests for the bidi pre-auth gate when video is the only consumer.
+
+conn1 bytes are only parsed when a downstream consumer exists (engineer
+forward, tlog, binlog, or -- now -- video). On the TCP path conn1 latches
+at accept(), *before* any signature check, and that parse block is the only
+thing that ever calls receive_message() and so the only thing that can set
+is_authenticated(). A bidi entry whose sole consumer is video therefore
+never authenticated, and CONN1_BIDI_PREAUTH_SECONDS killed the session.
+
+The two tests here are a matched pair: with video enabled the session must
+survive, and with no consumer at all it must still time out. The second is
+what proves the gate is the mechanism rather than something incidental.
+
+(The UDP path validates inside its own latch block, so it authenticates
+regardless of the gate -- only TCP was affected.)
+"""
+import os
+import subprocess
+import sys
+import threading
+import time
+
+import pytest
+
+_REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+import keydb_lib  # noqa: E402
+
+SUPPORTPROXY_BIN = os.path.join(_REPO_ROOT, 'supportproxy')
+
+_w = os.environ.get('PYTEST_XDIST_WORKER', 'gw0')
+_W = int(_w[2:]) if _w.startswith('gw') else 0
+# 18100 base: 17500/17600/17700/17800/17900/18000 are taken by other
+# test modules, and files sharing a base collide when they run in the
+# same phase on the same xdist worker.
+PORT_USER = 18100 + _W * 4
+PORT_ENG = 18101 + _W * 4
+
+PASSPHRASE = 'bidi_video_pw'
+
+os.environ.setdefault('MAVLINK_DIALECT', 'all')
+os.environ.setdefault('MAVLINK20', '1')
+
+# Must exceed CONN1_BIDI_PREAUTH_SECONDS (5) by enough to be unambiguous
+# without making the test slow.
+OBSERVE_SECONDS = 9.0
+
+
+def _key(passphrase):
+    import hashlib
+    return hashlib.sha256(passphrase.encode('ascii')).digest()
+
+
+def _make_workdir(tmp_path, flags):
+    p = tmp_path / 'work'
+    p.mkdir()
+    db = keydb_lib.init_db(str(p / 'keys.tdb'))
+    db.transaction_start()
+    keydb_lib.add_entry(db, PORT_USER, PORT_ENG, 'bidi_video', PASSPHRASE)
+    for f in flags:
+        keydb_lib.set_flag(db, PORT_ENG, f)
+    db.transaction_prepare_commit()
+    db.transaction_commit()
+    db.close()
+    return p
+
+
+def _start_proxy(workdir):
+    proc = subprocess.Popen(
+        [SUPPORTPROXY_BIN], cwd=str(workdir), env=os.environ.copy(),
+        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, bufsize=1, text=True)
+    proc._lines = []
+    proc._ready = threading.Event()
+
+    def _drain():
+        # Draining matters: a full stdout pipe blocks the child inside
+        # printf() and stalls main_loop.
+        for line in iter(proc.stdout.readline, ''):
+            proc._lines.append(line)
+            if 'Added port %d/%d' % (PORT_USER, PORT_ENG) in line:
+                proc._ready.set()
+        proc.stdout.close()
+
+    proc._thread = threading.Thread(target=_drain, daemon=True)
+    proc._thread.start()
+    if not proc._ready.wait(timeout=10):
+        proc.kill()
+        raise RuntimeError('proxy did not start: %r' % (proc._lines,))
+    return proc
+
+
+def _stop(proc):
+    proc.terminate()
+    try:
+        proc.wait(timeout=5)
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        proc.wait(timeout=5)
+    proc._thread.join(timeout=2)
+
+
+def _drive_signed_user_tcp(seconds):
+    """Hold a signed MAVLink2 TCP user connection open, sending heartbeats.
+
+    Returns once `seconds` have elapsed. Heartbeats keep last_pkt1 fresh so
+    the ordinary 10 s idle timeout can't be confused with the pre-auth kill.
+    """
+    from pymavlink import mavutil
+    conn = mavutil.mavlink_connection(
+        'tcp:localhost:%d' % PORT_USER, source_system=1,
+        source_component=1, use_native=False)
+    try:
+        conn.setup_signing(_key(PASSPHRASE), sign_outgoing=True)
+        deadline = time.time() + seconds
+        while time.time() < deadline:
+            conn.mav.heartbeat_send(
+                mavutil.mavlink.MAV_TYPE_QUADROTOR,
+                mavutil.mavlink.MAV_AUTOPILOT_ARDUPILOTMEGA, 0, 0,
+                mavutil.mavlink.MAV_STATE_ACTIVE)
+            time.sleep(0.4)
+    finally:
+        try:
+            conn.close()
+        except Exception:
+            pass
+
+
+def _log(proc):
+    return ''.join(proc._lines)
+
+
+@pytest.mark.integration
+def test_bidi_video_only_authenticates(tmp_path):
+    """bidi + video, no engineer/tlog/binlog: the session must survive."""
+    workdir = _make_workdir(tmp_path, ['bidi_sign', 'video'])
+    proc = _start_proxy(workdir)
+    try:
+        _drive_signed_user_tcp(OBSERVE_SECONDS)
+        time.sleep(0.5)
+        out = _log(proc)
+    finally:
+        _stop(proc)
+
+    assert 'have TCP conn1' in out, \
+        'user side never latched; test drove nothing:\n%s' % out
+    assert 'pre-auth timeout' not in out, (
+        'bidi+video session was killed by the pre-auth deadline -- the parse '
+        'gate is not treating video as a consumer:\n%s' % out)
+
+
+@pytest.mark.integration
+def test_bidi_without_any_consumer_still_times_out(tmp_path):
+    """Control: bidi with no consumer at all must still hit the deadline.
+
+    Without this, the test above could pass for reasons unrelated to the
+    gate (e.g. if something else started authenticating conn1).
+    """
+    workdir = _make_workdir(tmp_path, ['bidi_sign'])
+    proc = _start_proxy(workdir)
+    try:
+        _drive_signed_user_tcp(OBSERVE_SECONDS)
+        time.sleep(0.5)
+        out = _log(proc)
+    finally:
+        _stop(proc)
+
+    assert 'have TCP conn1' in out, \
+        'user side never latched; test drove nothing:\n%s' % out
+    assert 'pre-auth timeout' in out, (
+        'expected the pre-auth deadline to fire with no consumer '
+        'configured:\n%s' % out)
diff --git a/tests/test_video_child.py b/tests/test_video_child.py
new file mode 100644
index 0000000..3a649aa
--- /dev/null
+++ b/tests/test_video_child.py
@@ -0,0 +1,490 @@
+"""The independent video child: lifecycle and publisher admission.
+
+The defining property is independence from the MAVLink process tree.
+The MAVLink child idles out after 10 s, and video has to survive that;
+and with a publish password video has to work with no MAVLink session
+at all. So the video child is a long-lived direct child of the parent,
+and it -- not the parent -- binds the video ports, which makes "video
+only exists when enabled" structural rather than a policy check.
+
+Phase 1 has no media path: bytes are admitted, counted and discarded.
+These tests are about the process model and the admission decision.
+"""
+import os
+import re
+import socket
+import subprocess
+import sys
+import threading
+import time
+
+import pytest
+
+_REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+import conntdb_lib  # noqa: E402
+import keydb_lib  # noqa: E402
+
+SUPPORTPROXY_BIN = os.path.join(_REPO_ROOT, 'supportproxy')
+
+_w = os.environ.get('PYTEST_XDIST_WORKER', 'gw0')
+_W = int(_w[2:]) if _w.startswith('gw') else 0
+PORT_USER = 18200 + _W * 8
+PORT_ENG = 18201 + _W * 8
+VPORT = 18202 + _W * 8
+VPORT2 = 18203 + _W * 8
+
+PASSPHRASE = 'vidchild'
+
+os.environ.setdefault('MAVLINK_DIALECT', 'all')
+os.environ.setdefault('MAVLINK20', '1')
+
+
+def _make_workdir(tmp_path, flags=('video',), vports=(VPORT,), **kw):
+    p = tmp_path / 'work'
+    p.mkdir()
+    db = keydb_lib.init_db(str(p / 'keys.tdb'))
+    db.transaction_start()
+    keydb_lib.add_entry(db, PORT_USER, PORT_ENG, 'vid', PASSPHRASE)
+    for f in flags:
+        keydb_lib.set_flag(db, PORT_ENG, f)
+    if vports:
+        keydb_lib.set_video_ports(db, PORT_ENG, list(vports))
+    if kw.get('publish_pass'):
+        keydb_lib.set_video_publish_pass(db, PORT_ENG, kw['publish_pass'])
+    if kw.get('grace') is not None:
+        keydb_lib.set_video_grace(db, PORT_ENG, kw['grace'])
+    db.transaction_prepare_commit()
+    db.transaction_commit()
+    db.close()
+    return p
+
+
+class Proxy:
+    def __init__(self, workdir):
+        self.workdir = workdir
+        self.proc = subprocess.Popen(
+            [SUPPORTPROXY_BIN], cwd=str(workdir), env=os.environ.copy(),
+            stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+            bufsize=1, text=True)
+        self.lines = []
+        self._ready = threading.Event()
+        self._t = threading.Thread(target=self._drain, daemon=True)
+        self._t.start()
+        if not self._ready.wait(timeout=10):
+            self.stop()
+            raise RuntimeError('proxy did not start: %r' % (self.lines,))
+
+    def _drain(self):
+        for line in iter(self.proc.stdout.readline, ''):
+            self.lines.append(line)
+            if 'Added port %d/%d' % (PORT_USER, PORT_ENG) in line:
+                self._ready.set()
+        self.proc.stdout.close()
+
+    @property
+    def log(self):
+        return ''.join(self.lines)
+
+    def wait_for(self, pattern, timeout=15):
+        deadline = time.time() + timeout
+        while time.time() < deadline:
+            if re.search(pattern, self.log):
+                return True
+            time.sleep(0.2)
+        return False
+
+    def children(self):
+        out = subprocess.run(['pgrep', '-P', str(self.proc.pid)],
+                             capture_output=True, text=True).stdout
+        return [int(x) for x in out.split()]
+
+    def video_pid(self):
+        """The child holding the video port, identified by its fd count."""
+        for pid in self.children():
+            try:
+                links = os.listdir('/proc/%d/fd' % pid)
+            except OSError:
+                continue
+            socks = 0
+            for fd in links:
+                try:
+                    if 'socket' in os.readlink('/proc/%d/fd/%s' % (pid, fd)):
+                        socks += 1
+                except OSError:
+                    pass
+            # the cleanup child closes every socket; the video child
+            # holds two per configured slot
+            if socks > 0:
+                return pid
+        return None
+
+    def stop(self):
+        self.proc.terminate()
+        try:
+            self.proc.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            self.proc.kill()
+            self.proc.wait(timeout=5)
+        self._t.join(timeout=2)
+
+
+@pytest.fixture
+def proxy(tmp_path):
+    made = {}
+
+    def _make(**kw):
+        wd = _make_workdir(tmp_path, **kw)
+        made['p'] = Proxy(wd)
+        made['wd'] = wd
+        return made['p']
+
+    yield _make
+    if 'p' in made:
+        made['p'].stop()
+
+
+def _port_bound(port, proto='udp'):
+    """True if anything is listening on `port`, read from /proc/net."""
+    path = '/proc/net/' + ('udp' if proto == 'udp' else 'tcp')
+    want = '%04X' % port
+    with open(path) as f:
+        next(f)
+        for line in f:
+            local = line.split()[1]
+            if local.split(':')[1].upper() == want:
+                return True
+    return False
+
+
+class Publisher:
+    """A UDP publisher on ONE socket.
+
+    Reusing the socket matters: the proxy latches a publisher by
+    (address, port), so a fresh socket per burst would present a new
+    source port each time and never take the established-publisher fast
+    path -- which is not how a real publisher behaves.
+    """
+
+    def __init__(self, port):
+        self.port = port
+        self.sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+
+    def send(self, n=3):
+        for _ in range(n):
+            self.sock.sendto(b'\x47' + b'\x00' * 187, ('127.0.0.1', self.port))
+            time.sleep(0.05)
+
+    def close(self):
+        self.sock.close()
+
+
+def _send_ts(port, n=3):
+    pub = Publisher(port)
+    try:
+        pub.send(n)
+    finally:
+        pub.close()
+
+
+class _Mav:
+    """A MAVLink user-side session on port1, driven in a thread."""
+
+    def __init__(self, signed=False):
+        from pymavlink import mavutil
+        self.mavutil = mavutil
+        self.conn = mavutil.mavlink_connection(
+            'udpout:127.0.0.1:%d' % PORT_USER, source_system=1,
+            source_component=1, use_native=False)
+        if signed:
+            import hashlib
+            self.conn.setup_signing(
+                hashlib.sha256(PASSPHRASE.encode()).digest(),
+                sign_outgoing=True)
+        self._stop = threading.Event()
+        self._t = threading.Thread(target=self._run, daemon=True)
+        self._t.start()
+
+    def _run(self):
+        m = self.mavutil.mavlink
+        while not self._stop.is_set():
+            try:
+                self.conn.mav.heartbeat_send(
+                    m.MAV_TYPE_QUADROTOR, m.MAV_AUTOPILOT_ARDUPILOTMEGA,
+                    0, 0, m.MAV_STATE_ACTIVE)
+            except Exception:
+                pass
+            time.sleep(0.3)
+
+    def stop(self):
+        self._stop.set()
+        self._t.join(timeout=2)
+        try:
+            self.conn.close()
+        except Exception:
+            pass
+
+
+def _video_rows(workdir):
+    path = conntdb_lib.conn_path_for(str(workdir / 'keys.tdb'))
+    return [c for c in conntdb_lib.list_active(path, max_age_s=3600)
+            if c.is_video]
+
+
+def _mav_rows(workdir):
+    path = conntdb_lib.conn_path_for(str(workdir / 'keys.tdb'))
+    return [c for c in conntdb_lib.list_active(path, max_age_s=3600)
+            if not c.is_video]
+
+
+@pytest.mark.integration
+class TestVideoChildLifecycle:
+    def test_port_bound_with_no_mavlink_session(self, proxy):
+        """The headline property: video does not wait on MAVLink."""
+        p = proxy()
+        assert p.wait_for(r'video slot 0 listening'), p.log
+        assert _port_bound(VPORT, 'udp'), 'video UDP port not bound'
+        assert _port_bound(VPORT, 'tcp'), 'video TCP port not bound'
+
+    def test_video_child_holds_no_mavlink_fds(self, proxy):
+        """Being a child of the parent, it never inherits session fds."""
+        p = proxy(vports=(VPORT,))
+        assert p.wait_for(r'video child \d+ ready'), p.log
+        vpid = p.video_pid()
+        assert vpid is not None, p.log
+        socks = [os.readlink('/proc/%d/fd/%s' % (vpid, fd))
+                 for fd in os.listdir('/proc/%d/fd' % vpid)]
+        n_socks = len([s for s in socks if 'socket' in s])
+        # exactly one UDP + one TCP listener for the single slot
+        assert n_socks == 2, 'expected 2 sockets, got %d: %r' % (n_socks, socks)
+
+    def test_disable_video_stops_child_and_frees_port(self, proxy, tmp_path):
+        p = proxy()
+        assert p.wait_for(r'video child \d+ ready'), p.log
+        assert _port_bound(VPORT, 'udp')
+
+        db = keydb_lib.open_db(str(tmp_path / 'work' / 'keys.tdb'))
+        db.transaction_start()
+        keydb_lib.clear_flag(db, PORT_ENG, 'video')
+        db.transaction_prepare_commit(); db.transaction_commit(); db.close()
+
+        assert p.wait_for(r'video child \d+ stopping \(video disabled\)'), p.log
+        deadline = time.time() + 10
+        while time.time() < deadline and _port_bound(VPORT, 'udp'):
+            time.sleep(0.2)
+        assert not _port_bound(VPORT, 'udp'), 'port still bound after disable'
+
+    def test_killed_video_child_is_respawned(self, proxy):
+        p = proxy()
+        assert p.wait_for(r'video child \d+ ready'), p.log
+        first = p.video_pid()
+        assert first is not None
+        os.kill(first, 9)
+        assert p.wait_for(r'video child %d exited' % first), p.log
+        deadline = time.time() + 20
+        second = None
+        while time.time() < deadline:
+            second = p.video_pid()
+            if second is not None and second != first:
+                break
+            time.sleep(0.3)
+        assert second is not None and second != first, \
+            'video child not respawned:\n%s' % p.log
+
+    def test_parent_exit_leaves_no_orphan(self, proxy):
+        p = proxy()
+        assert p.wait_for(r'video child \d+ ready'), p.log
+        vpid = p.video_pid()
+        p.stop()
+        deadline = time.time() + 10
+        while time.time() < deadline and os.path.exists('/proc/%d' % vpid):
+            time.sleep(0.2)
+        assert not os.path.exists('/proc/%d' % vpid), \
+            'video child %d outlived the parent' % vpid
+
+    def test_port_change_rebinds(self, proxy, tmp_path):
+        p = proxy(vports=(VPORT,))
+        assert p.wait_for(r'video child \d+ ready'), p.log
+
+        db = keydb_lib.open_db(str(tmp_path / 'work' / 'keys.tdb'))
+        db.transaction_start()
+        keydb_lib.set_video_ports(db, PORT_ENG, [VPORT2])
+        db.transaction_prepare_commit(); db.transaction_commit(); db.close()
+
+        assert p.wait_for(r'video config changed'), p.log
+        deadline = time.time() + 20
+        while time.time() < deadline:
+            if _port_bound(VPORT2, 'udp') and not _port_bound(VPORT, 'udp'):
+                break
+            time.sleep(0.3)
+        assert _port_bound(VPORT2, 'udp'), 'new port not bound:\n%s' % p.log
+        assert not _port_bound(VPORT, 'udp'), 'old port still bound'
+
+
+@pytest.mark.integration
+class TestVideoAdmission:
+    def test_publish_rejected_without_mavlink(self, proxy):
+        p = proxy()
+        assert p.wait_for(r'video slot 0 listening'), p.log
+        _send_ts(VPORT)
+        assert p.wait_for(r'rejected .*no MAVLink session'), p.log
+
+    def test_publish_accepted_with_mavlink_from_same_ip(self, proxy):
+        p = proxy()
+        assert p.wait_for(r'video slot 0 listening'), p.log
+        mav = _Mav()
+        try:
+            assert p.wait_for(r'have UDP conn1'), p.log
+            time.sleep(1.0)          # let the session's ConnEntry land
+            for _ in range(10):
+                _send_ts(VPORT, n=2)
+                if re.search(r'video slot 0 publisher', p.log):
+                    break
+                time.sleep(0.5)
+            assert re.search(r'video slot 0 publisher', p.log), p.log
+        finally:
+            mav.stop()
+
+    def test_video_survives_mavlink_going_away(self, proxy):
+        """The whole point of decoupling: a telemetry dropout must not
+        revoke a publisher that is already streaming."""
+        p = proxy(grace=60)
+        assert p.wait_for(r'video slot 0 listening'), p.log
+        pub = Publisher(VPORT)
+        mav = _Mav()
+        try:
+            assert p.wait_for(r'have UDP conn1'), p.log
+            time.sleep(1.0)
+            for _ in range(10):
+                pub.send(2)
+                if re.search(r'video slot 0 publisher', p.log):
+                    break
+                time.sleep(0.5)
+            assert re.search(r'video slot 0 publisher', p.log), p.log
+        finally:
+            mav.stop()
+
+        # MAVLink is gone. Keep publishing across the session child's
+        # 10 s idle-out -- a real publisher does not stop just because
+        # telemetry dropped, and going silent here would trip the
+        # separate publisher-idle release and test the wrong thing.
+        try:
+            marker = len(p.lines)
+            deadline = time.time() + 16
+            while time.time() < deadline:
+                pub.send(2)
+                time.sleep(0.4)
+
+            assert p.video_pid() is not None, \
+                'video child died with the MAVLink session:\n%s' % p.log
+            later = ''.join(p.lines[marker:])
+            assert 'rejected' not in later, \
+                'publisher revoked after MAVLink went away:\n%s' % later
+        finally:
+            pub.close()
+
+    def test_publisher_can_start_during_a_mavlink_outage(self, proxy):
+        """Within the grace window, a publisher may start with the
+        MAVLink session already gone.
+
+        This is what the grace window is for, and it only works because
+        the last-known-good session outlives its connections.tdb row --
+        the row is deleted as soon as the session child exits.
+        """
+        p = proxy(grace=120)
+        assert p.wait_for(r'video slot 0 listening'), p.log
+        mav = _Mav()
+        try:
+            assert p.wait_for(r'have UDP conn1'), p.log
+            time.sleep(1.5)      # let the session's ConnEntry be written
+        finally:
+            mav.stop()
+
+        # Wait out the session child so its row is gone entirely.
+        assert p.wait_for(r'Child \d+ exited', timeout=25), p.log
+        time.sleep(1.0)
+
+        marker = len(p.lines)
+        for _ in range(10):
+            _send_ts(VPORT, n=2)
+            if re.search(r'video slot 0 publisher', ''.join(p.lines[marker:])):
+                break
+            time.sleep(0.5)
+        later = ''.join(p.lines[marker:])
+        assert 'video slot 0 publisher' in later, \
+            'publisher refused inside the grace window:\n%s' % later
+
+    def test_publish_password_cannot_be_met_over_plain_udp(self, proxy):
+        """Path A takes precedence, and plain MPEG-TS/UDP carries no
+        credential -- so a passworded entry refuses UDP publish even
+        with a live MAVLink session from the same address."""
+        p = proxy(publish_pass='pubpw')
+        assert p.wait_for(r'video slot 0 listening'), p.log
+        mav = _Mav()
+        try:
+            assert p.wait_for(r'have UDP conn1'), p.log
+            time.sleep(1.0)
+            _send_ts(VPORT, n=4)
+            # The reason is specifically "this transport cannot carry a
+            # password", not "wrong password" -- a udpsink never sent
+            # one, and saying "wrong" would send an operator looking for
+            # a typo that isn't there.
+            assert p.wait_for(r'rejected .*cannot carry one'), p.log
+            assert 'video slot 0 publisher' not in p.log
+        finally:
+            mav.stop()
+
+    def test_bidi_entry_requires_authenticated_session(self, proxy):
+        """An unsigned session on a bidi entry must not authorise video."""
+        p = proxy(flags=('video', 'bidi_sign'))
+        assert p.wait_for(r'video slot 0 listening'), p.log
+        mav = _Mav(signed=False)      # unsigned: never authenticates
+        try:
+            time.sleep(2.0)
+            _send_ts(VPORT, n=4)
+            assert p.wait_for(r'rejected'), p.log
+            assert 'video slot 0 publisher' not in p.log, \
+                'unsigned session authorised video on a bidi entry:\n%s' % p.log
+        finally:
+            mav.stop()
+
+
+@pytest.mark.integration
+class TestVideoConnRows:
+    def test_publisher_row_written_in_video_index_range(self, proxy, tmp_path):
+        p = proxy()
+        assert p.wait_for(r'video slot 0 listening'), p.log
+        mav = _Mav()
+        try:
+            assert p.wait_for(r'have UDP conn1'), p.log
+            time.sleep(1.0)
+            for _ in range(10):
+                _send_ts(VPORT, n=2)
+                if re.search(r'video slot 0 publisher', p.log):
+                    break
+                time.sleep(0.5)
+            assert re.search(r'video slot 0 publisher', p.log), p.log
+
+            wd = tmp_path / 'work'
+            deadline = time.time() + 15
+            rows = []
+            while time.time() < deadline:
+                rows = _video_rows(wd)
+                if rows:
+                    break
+                time.sleep(0.5)
+            assert rows, 'no video ConnEntry written:\n%s' % p.log
+            r = rows[0]
+            assert r.conn_index >= conntdb_lib.VIDEO_CONN_INDEX_BASE
+            assert r.role == conntdb_lib.CONN_ROLE_VIDEO_PUB
+            assert r.stream_idx == 0
+            assert r.port2 == PORT_ENG
+
+            # and the MAVLink row must still be there: the two writers
+            # each clear only their own index range
+            assert _mav_rows(wd), \
+                'video snapshot erased the MAVLink rows:\n%s' % p.log
+        finally:
+            mav.stop()
diff --git a/tests/test_video_ingest.py b/tests/test_video_ingest.py
new file mode 100644
index 0000000..57b04db
--- /dev/null
+++ b/tests/test_video_ingest.py
@@ -0,0 +1,254 @@
+"""MPEG-TS/UDP ingest and the join-point scanner, end to end.
+
+Phase 2 has no viewers yet, so the scanner's conclusions are observed
+through the per-tick stats line. What matters here is that a real
+datagram stream is accepted, parsed into a program, and reaches the
+point where a viewer *could* join -- and that malformed input is
+counted and dropped rather than half-parsed.
+"""
+import os
+import re
+import subprocess
+import sys
+import time
+
+import pytest
+
+_REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import tsgen  # noqa: E402
+from test_video_child import (Proxy, Publisher, _Mav, _make_workdir,  # noqa: E402
+                              _port_bound, VPORT)
+
+SUPPORTPROXY_BIN = os.path.join(_REPO_ROOT, 'supportproxy')
+
+STATS_RE = re.compile(
+    r'video slot (\d+) stats: (\d+) KiB, (\d+) pkts, pat=(\d+) pmt=(\d+) '
+    r'rai=(\d+) cc_err=(\d+) crc_err=(\d+) bad_dgram=(\d+) '
+    r'vpid=0x([0-9a-f]+) stype=0x([0-9a-f]+) join=(\w+)')
+
+
+def last_stats(proxy):
+    """Parse the most recent stats line, or None."""
+    m = None
+    for line in proxy.lines:
+        found = STATS_RE.search(line)
+        if found:
+            m = found
+    if m is None:
+        return None
+    return {
+        'slot': int(m.group(1)), 'kib': int(m.group(2)),
+        'packets': int(m.group(3)), 'pat': int(m.group(4)),
+        'pmt': int(m.group(5)), 'rai': int(m.group(6)),
+        'cc_err': int(m.group(7)), 'crc_err': int(m.group(8)),
+        'bad_dgram': int(m.group(9)), 'vpid': int(m.group(10), 16),
+        'stype': int(m.group(11), 16), 'join': m.group(12),
+    }
+
+
+def wait_stats(proxy, predicate, timeout=20):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        st = last_stats(proxy)
+        if st is not None and predicate(st):
+            return st
+        time.sleep(0.5)
+    return last_stats(proxy)
+
+
+@pytest.fixture
+def running(tmp_path):
+    """A proxy with video enabled and an authorised publisher."""
+    made = {}
+
+    def _start(**kw):
+        wd = _make_workdir(tmp_path, **kw)
+        p = Proxy(wd)
+        made['p'] = p
+        assert p.wait_for(r'video slot 0 listening'), p.log
+        mav = _Mav()
+        made['mav'] = mav
+        assert p.wait_for(r'have UDP conn1'), p.log
+        time.sleep(1.2)          # let the session's ConnEntry land
+        return p
+
+    yield _start
+    if 'mav' in made:
+        made['mav'].stop()
+    if 'p' in made:
+        made['p'].stop()
+
+
+def _publish(port, data, chunk_pause=0.004):
+    """Send a stream as 1316-byte datagrams from one socket."""
+    pub = Publisher(port)
+    try:
+        for dg in tsgen.TSGen().datagrams(data):
+            pub.sock.sendto(dg, ('127.0.0.1', port))
+            time.sleep(chunk_pause)
+    finally:
+        pub.close()
+    return pub
+
+
+@pytest.mark.integration
+class TestTSIngest:
+    def test_stream_is_parsed_and_joinable(self, running):
+        p = running()
+        g = tsgen.TSGen()
+        data = g.stream(400, gop=10, psi_every=20)
+        _publish(VPORT, data)
+
+        st = wait_stats(p, lambda s: s['join'] == 'ready')
+        assert st is not None, 'no stats line at all:\n%s' % p.log
+        assert st['join'] == 'ready', \
+            'scanner never reached a joinable state: %r\n%s' % (st, p.log)
+        assert st['pat'] > 0 and st['pmt'] > 0, st
+        assert st['rai'] > 0, st
+        assert st['vpid'] == tsgen.DEFAULT_VIDEO_PID, st
+        assert st['stype'] == tsgen.STREAM_H264, st
+        assert st['crc_err'] == 0, 'CRC errors on a clean stream: %r' % (st,)
+        assert st['bad_dgram'] == 0, 'good datagrams rejected: %r' % (st,)
+
+    def test_hevc_stream_type_is_reported(self, running):
+        """The scanner must identify HEVC, which the browser path can't
+        play -- that distinction drives the viewer fallback later."""
+        p = running()
+        g = tsgen.TSGen(stream_type=tsgen.STREAM_HEVC)
+        _publish(VPORT, g.stream(300, gop=10, psi_every=20))
+        st = wait_stats(p, lambda s: s['join'] == 'ready')
+        assert st is not None and st['stype'] == tsgen.STREAM_HEVC, \
+            '%r\n%s' % (st, p.log)
+
+    def test_no_keyframes_means_not_joinable(self, running):
+        """PSI alone is not enough: without a random access point there
+        is nowhere a decoder could start."""
+        p = running()
+        g = tsgen.TSGen()
+        out = bytearray()
+        for i in range(300):
+            if i % 20 == 0:
+                out += g.pat()
+                out += g.pmt()
+            out += g.video(key=False)
+        _publish(VPORT, bytes(out))
+
+        st = wait_stats(p, lambda s: s['pmt'] > 0)
+        assert st is not None, p.log
+        assert st['pat'] > 0 and st['pmt'] > 0, st
+        assert st['rai'] == 0, 'no keyframes were sent: %r' % (st,)
+        assert st['join'] == 'waiting', \
+            'claimed joinable with no random access point: %r' % (st,)
+
+    def test_misaligned_datagrams_are_counted_and_dropped(self, running):
+        """Junk from the *established* publisher must be dropped.
+
+        The same socket throughout: a fresh one would present a new
+        source port and be refused as a second publisher, which is a
+        different rule and would not exercise the ingest validation.
+        """
+        p = running()
+        g = tsgen.TSGen()
+        dgs = g.datagrams(g.stream(100, gop=10, psi_every=20))
+        expect_packets = len(dgs) * tsgen.PACKETS_PER_DATAGRAM
+        n_junk = 10
+
+        pub = Publisher(VPORT)
+        try:
+            for dg in dgs:
+                pub.sock.sendto(dg, ('127.0.0.1', VPORT))
+                time.sleep(0.004)
+            for _ in range(n_junk):
+                # 201 bytes: not a multiple of 188, so not TS
+                pub.sock.sendto(b'\x47' + b'\x11' * 200, ('127.0.0.1', VPORT))
+                time.sleep(0.02)
+
+            st = wait_stats(p, lambda s: s['bad_dgram'] >= n_junk)
+            assert st is not None and st['bad_dgram'] == n_junk, \
+                'misaligned datagrams not counted: %r\n%s' % (st, p.log)
+            # Compare against what was sent, not against an earlier stats
+            # line -- those are emitted on a timer and can be sampled
+            # mid-stream.
+            assert st['packets'] == expect_packets, \
+                'junk reached the scanner: %d packets, expected %d' \
+                % (st['packets'], expect_packets)
+            assert st['crc_err'] == 0, \
+                'garbage reached the PSI parser: %r' % (st,)
+        finally:
+            pub.close()
+
+    def test_second_publisher_is_refused_with_its_own_reason(self, running):
+        """A second sender is refused because the slot is taken -- not
+        because its address failed the MAVLink check, which it passed."""
+        p = running()
+        g = tsgen.TSGen()
+        first = Publisher(VPORT)
+        try:
+            for dg in g.datagrams(g.stream(60, gop=10, psi_every=20)):
+                first.sock.sendto(dg, ('127.0.0.1', VPORT))
+                time.sleep(0.004)
+            assert p.wait_for(r'video slot 0 publisher'), p.log
+
+            second = Publisher(VPORT)
+            try:
+                for dg in g.datagrams(g.stream(30, gop=10, psi_every=20)):
+                    second.sock.sendto(dg, ('127.0.0.1', VPORT))
+                    time.sleep(0.004)
+            finally:
+                second.close()
+
+            assert p.wait_for(r'another publisher holds this slot'), \
+                'second publisher not refused with a slot-busy reason:\n%s' \
+                % p.log
+            assert 'address does not match' not in p.log, \
+                'refusal blamed the address, which was fine:\n%s' % p.log
+        finally:
+            first.close()
+
+    def test_recovers_after_a_gap(self, running):
+        """A publisher that pauses and resumes must keep parsing.
+
+        Datagram loss is normal on a lossy link; the scanner has to pick
+        the program back up rather than wedge.
+        """
+        p = running()
+        g = tsgen.TSGen()
+        _publish(VPORT, g.stream(120, gop=10, psi_every=20))
+        st = wait_stats(p, lambda s: s['join'] == 'ready')
+        assert st is not None and st['join'] == 'ready', p.log
+        first_rai = st['rai']
+
+        time.sleep(2.0)
+        _publish(VPORT, g.stream(120, gop=10, psi_every=20))
+        st2 = wait_stats(p, lambda s: s['rai'] > first_rai)
+        assert st2 is not None and st2['rai'] > first_rai, \
+            'scanner stopped after a gap: %r -> %r\n%s' % (st, st2, p.log)
+        assert st2['join'] == 'ready', st2
+
+
+@pytest.mark.integration
+class TestScannerSelftest:
+    def test_selftest_and_fuzz_pass(self):
+        """The in-process unit checks and a short fuzz run.
+
+        Kept in the normal suite so a regression in the PSI parsing --
+        lengths and CRCs taken straight off the wire -- fails here
+        rather than only in a dedicated campaign.
+        """
+        r = subprocess.run([SUPPORTPROXY_BIN, '--selftest-video'],
+                           capture_output=True, text=True, timeout=120)
+        assert r.returncode == 0, r.stdout + r.stderr
+        assert 'videots selftest: OK' in r.stdout
+        assert 'videostream selftest: OK' in r.stdout
+        assert 'videots fuzz: OK' in r.stdout
+
+    @pytest.mark.parametrize('seed', [2, 3, 42])
+    def test_fuzz_other_seeds(self, seed):
+        r = subprocess.run(
+            [SUPPORTPROXY_BIN, '--selftest-video', '4000', str(seed)],
+            capture_output=True, text=True, timeout=120)
+        assert r.returncode == 0, r.stdout + r.stderr
diff --git a/tests/test_video_record.py b/tests/test_video_record.py
new file mode 100644
index 0000000..edf49f1
--- /dev/null
+++ b/tests/test_video_record.py
@@ -0,0 +1,275 @@
+"""Video segment recording and the partitioned disk quotas.
+
+The guarantee worth testing hardest is that video can never evict
+telemetry. Video is orders of magnitude larger per second than a tlog,
+so a single mtime-sorted pool would let a few minutes of recording
+delete a whole flight's telemetry. The two budgets are enforced
+independently, and this file pins that down from both directions.
+"""
+import os
+import re
+import subprocess
+import sys
+import time
+
+import pytest
+
+_REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import keydb_lib  # noqa: E402
+import tsgen  # noqa: E402
+from test_video_child import (Proxy, Publisher, _Mav, PORT_ENG,  # noqa: E402
+                              PORT_USER, PASSPHRASE, VPORT)
+
+
+def _workdir(tmp_path, record=True, quota_mb=0, env=None):
+    p = tmp_path / 'work'
+    p.mkdir()
+    db = keydb_lib.init_db(str(p / 'keys.tdb'))
+    db.transaction_start()
+    keydb_lib.add_entry(db, PORT_USER, PORT_ENG, 'vid', PASSPHRASE)
+    keydb_lib.set_flag(db, PORT_ENG, 'video')
+    keydb_lib.set_video_ports(db, PORT_ENG, [VPORT])
+    if record:
+        keydb_lib.set_video_slot_flag(db, PORT_ENG, 0, 'record')
+    if quota_mb:
+        keydb_lib.set_video_quota(db, PORT_ENG, quota_mb)
+    db.transaction_prepare_commit()
+    db.transaction_commit()
+    db.close()
+    return p
+
+
+def _today_dir(workdir):
+    d = workdir / 'logs' / str(PORT_ENG) / time.strftime('%Y-%m-%d',
+                                                         time.localtime())
+    return d
+
+
+def _segments(workdir):
+    d = _today_dir(workdir)
+    if not d.is_dir():
+        return []
+    return sorted([f for f in d.iterdir() if f.name.endswith('.ts')],
+                  key=lambda f: f.name)
+
+
+def _telem(workdir):
+    d = _today_dir(workdir)
+    if not d.is_dir():
+        return []
+    return sorted([f for f in d.iterdir()
+                   if f.suffix in ('.tlog', '.bin')], key=lambda f: f.name)
+
+
+class Session:
+    """A proxy with a MAVLink session and an authorised video publisher."""
+
+    def __init__(self, workdir, env=None):
+        self.workdir = workdir
+        environ = os.environ.copy()
+        if env:
+            environ.update(env)
+        self._env_backup = os.environ.copy()
+        os.environ.update(env or {})
+        try:
+            self.proxy = Proxy(workdir)
+        finally:
+            os.environ.clear()
+            os.environ.update(self._env_backup)
+        assert self.proxy.wait_for(r'video slot 0 listening'), self.proxy.log
+        self.mav = _Mav()
+        assert self.proxy.wait_for(r'have UDP conn1'), self.proxy.log
+        time.sleep(1.2)
+        self.pub = Publisher(VPORT)
+
+    def publish(self, data, pause=0.003):
+        for dg in tsgen.TSGen().datagrams(data):
+            self.pub.sock.sendto(dg, ('127.0.0.1', VPORT))
+            time.sleep(pause)
+
+    def stop(self):
+        try:
+            self.pub.close()
+        except Exception:
+            pass
+        self.mav.stop()
+        self.proxy.stop()
+
+
+@pytest.fixture
+def session(tmp_path):
+    made = {}
+
+    def _start(env=None, **kw):
+        wd = _workdir(tmp_path, **kw)
+        made['s'] = Session(wd, env=env)
+        return made['s']
+
+    yield _start
+    if 's' in made:
+        made['s'].stop()
+
+
+@pytest.mark.integration
+class TestRecording:
+    def test_segment_is_written_and_byte_exact(self, session):
+        """The recording must be the publisher's own bytes.
+
+        Not merely 'a valid TS file': fan-out and recording both promise
+        the original stream, so the file has to appear verbatim in what
+        was sent.
+        """
+        s = session()
+        g = tsgen.TSGen()
+        data = g.stream(400, gop=10, psi_every=20)
+        sent = b''.join(g.datagrams(data))
+        s.publish(data)
+
+        deadline = time.time() + 20
+        while time.time() < deadline and not _segments(s.workdir):
+            time.sleep(0.5)
+        segs = _segments(s.workdir)
+        assert segs, 'no segment written:\n%s' % s.proxy.log
+
+        # let the writer flush, then compare
+        time.sleep(2)
+        blob = segs[0].read_bytes()
+        assert len(blob) > 0
+        assert blob[0] == 0x47, 'segment does not start with a sync byte'
+        assert len(blob) % 188 == 0, 'segment is not a whole number of packets'
+        assert blob in sent, \
+            'recording is not a verbatim span of what was published'
+
+    def test_segment_name_and_slot(self, session):
+        s = session()
+        s.publish(tsgen.TSGen().stream(150, gop=10, psi_every=20))
+        deadline = time.time() + 20
+        while time.time() < deadline and not _segments(s.workdir):
+            time.sleep(0.5)
+        segs = _segments(s.workdir)
+        assert segs, s.proxy.log
+        assert re.match(r'^\d{4}_\d{2}_\d{2}_\d{2}:\d{2}:\d{2}(-\d+)?\.v1\.ts$',
+                        segs[0].name), segs[0].name
+
+    def test_no_recording_when_slot_flag_is_off(self, session):
+        s = session(record=False)
+        s.publish(tsgen.TSGen().stream(150, gop=10, psi_every=20))
+        time.sleep(3)
+        assert not _segments(s.workdir), \
+            'recorded with the record flag off: %r' % (_segments(s.workdir),)
+
+    def test_rotation_produces_multiple_segments(self, session):
+        s = session(env={'SUPPORTPROXY_VIDEO_SEGMENT_SECONDS': '2'})
+        g = tsgen.TSGen()
+        for _ in range(6):
+            s.publish(g.stream(120, gop=10, psi_every=20), pause=0.01)
+            time.sleep(0.5)
+
+        deadline = time.time() + 20
+        while time.time() < deadline and len(_segments(s.workdir)) < 2:
+            time.sleep(0.5)
+        segs = _segments(s.workdir)
+        assert len(segs) >= 2, \
+            'expected rotation into several segments, got %r\n%s' \
+            % ([f.name for f in segs], s.proxy.log)
+        # every segment must be independently usable
+        for f in segs:
+            blob = f.read_bytes()
+            if not blob:
+                continue
+            assert blob[0] == 0x47, '%s does not start at a packet' % f.name
+            assert len(blob) % 188 == 0, '%s is not packet-aligned' % f.name
+
+    def test_stream_without_keyframes_still_rotates(self, session):
+        """A muxer that never signals a random access point must not
+        produce an unbounded segment -- the quota pass can never evict
+        the file currently being written."""
+        s = session(env={'SUPPORTPROXY_VIDEO_SEGMENT_SECONDS': '2'})
+        g = tsgen.TSGen()
+        out = bytearray()
+        for i in range(600):
+            if i % 20 == 0:
+                out += g.pat()
+                out += g.pmt()
+            out += g.video(key=False)      # never a keyframe
+        data = bytes(out)
+        deadline = time.time() + 60
+        while time.time() < deadline and len(_segments(s.workdir)) < 2:
+            s.publish(data, pause=0.004)
+            time.sleep(0.5)
+        segs = _segments(s.workdir)
+        assert len(segs) >= 2, \
+            'no rotation without keyframes (forced cut missing):\n%s' \
+            % s.proxy.log
+        assert 'forced cut' in s.proxy.log, \
+            'expected a forced cut to be logged:\n%s' % s.proxy.log
+
+
+@pytest.mark.integration
+class TestQuotaPartition:
+    def test_video_quota_never_evicts_telemetry(self, session, tmp_path):
+        """The headline guarantee.
+
+        A tiny video budget plus a fast cleanup interval must delete old
+        .ts segments and leave seeded .tlog/.bin files completely alone,
+        however old they are.
+        """
+        s = session(env={
+            'SUPPORTPROXY_PORT2_VIDEO_QUOTA_BYTES': str(256 * 1024),
+            'SUPPORTPROXY_VIDEO_SEGMENT_SECONDS': '1',
+            'SUPPORTPROXY_CLEANUP_INTERVAL': '0.5',
+            # Without shrinking the grace, every segment a short test
+            # writes is still "live" and none is evictable -- the quota
+            # pass would correctly free nothing.
+            'SUPPORTPROXY_ACTIVE_FILE_GRACE': '1',
+        })
+        # seed telemetry files that are old enough to be quota candidates
+        d = _today_dir(s.workdir)
+        d.mkdir(parents=True, exist_ok=True)
+        old = time.time() - 3600
+        seeded = []
+        for name in ('2020_01_01_00:00:00.tlog', '2020_01_01_00:00:00.bin'):
+            f = d / name
+            f.write_bytes(b'\x00' * 4096)
+            os.utime(f, (old, old))
+            seeded.append(f)
+
+        g = tsgen.TSGen()
+        deadline = time.time() + 45
+        while time.time() < deadline:
+            s.publish(g.stream(300, gop=10, psi_every=20), pause=0.002)
+            time.sleep(0.5)
+            if re.search(r'removed .* for video quota', s.proxy.log):
+                break
+
+        assert re.search(r'removed .* for video quota', s.proxy.log), \
+            'video quota never fired:\n%s' % s.proxy.log[-4000:]
+        for f in seeded:
+            assert f.exists(), \
+                '%s was evicted by the video quota:\n%s' % (f.name,
+                                                            s.proxy.log[-4000:])
+        assert 'for telemetry quota' not in s.proxy.log, \
+            'telemetry quota pass ran on video pressure:\n%s' % s.proxy.log
+
+    def test_per_entry_quota_overrides_the_default(self, session, tmp_path):
+        """KeyEntry.video_quota_mb must win over the server default."""
+        s = session(quota_mb=1, env={          # 1 MB
+            'SUPPORTPROXY_PORT2_VIDEO_QUOTA_BYTES': str(4 * 1024 * 1024 * 1024),
+            'SUPPORTPROXY_VIDEO_SEGMENT_SECONDS': '1',
+            'SUPPORTPROXY_CLEANUP_INTERVAL': '0.5',
+            'SUPPORTPROXY_ACTIVE_FILE_GRACE': '1',
+        })
+        g = tsgen.TSGen()
+        deadline = time.time() + 45
+        while time.time() < deadline:
+            s.publish(g.stream(300, gop=10, psi_every=20), pause=0.002)
+            time.sleep(0.5)
+            if re.search(r'removed .* for video quota', s.proxy.log):
+                break
+        assert re.search(r'removed .* for video quota', s.proxy.log), \
+            'per-entry quota did not override the larger default:\n%s' \
+            % s.proxy.log[-4000:]
diff --git a/tests/test_video_rtsp.py b/tests/test_video_rtsp.py
new file mode 100644
index 0000000..855ae31
--- /dev/null
+++ b/tests/test_video_rtsp.py
@@ -0,0 +1,1008 @@
+"""RTSP ingest, spliced to a loopback ffmpeg.
+
+SupportProxy parses no RTSP: it keeps the public port, authorises the
+source address, and hands the connection untouched to an ffmpeg on
+loopback. The spike established why -- waiting to classify deadlocks
+(RTSP is request/response), and answering OPTIONS ourselves makes
+ffmpeg reject the following ANNOUNCE because its listener wants the
+first request it sees to be CSeq 1.
+
+These need a real ffmpeg, so they skip without one.
+"""
+import os
+import re
+import shutil
+import socket
+import subprocess
+import sys
+import time
+
+import pytest
+
+_REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import keydb_lib  # noqa: E402
+import rtmp_client  # noqa: E402
+from test_video_child import (Proxy, _Mav, PORT_ENG, PORT_USER,  # noqa: E402
+                              PASSPHRASE, VPORT)
+
+pytestmark = pytest.mark.skipif(shutil.which('ffmpeg') is None,
+                                reason='RTSP ingest needs ffmpeg')
+
+# A short clip generated once per session: enough to carry a couple of
+# keyframes so the stream becomes joinable.
+_CLIP = None
+
+
+@pytest.fixture(scope='session')
+def clip(tmp_path_factory):
+    """A real H.264 clip, so the backend does real work.
+
+    Synthetic TS is right for the scanner tests, but this path hands
+    bytes to ffmpeg's RTSP demuxer and H.264 parser -- those need a
+    genuine elementary stream.
+    """
+    d = tmp_path_factory.mktemp('clip')
+    path = str(d / 'clip.mp4')
+    subprocess.run([
+        'ffmpeg', '-hide_banner', '-loglevel', 'error', '-y',
+        '-f', 'lavfi', '-i', 'testsrc=size=320x240:rate=15:duration=12',
+        '-c:v', 'libx264', '-preset', 'ultrafast', '-g', '15',
+        '-pix_fmt', 'yuv420p', path,
+    ], check=True, capture_output=True)
+    return path
+
+
+def _workdir(tmp_path, record=True, publish_pass=None,
+             rtmp_path=None):
+    p = tmp_path / 'work'
+    p.mkdir()
+    db = keydb_lib.init_db(str(p / 'keys.tdb'))
+    db.transaction_start()
+    keydb_lib.add_entry(db, PORT_USER, PORT_ENG, 'rtsp', PASSPHRASE)
+    keydb_lib.set_flag(db, PORT_ENG, 'video')
+    keydb_lib.set_video_ports(db, PORT_ENG, [VPORT])
+    if record:
+        keydb_lib.set_video_slot_flag(db, PORT_ENG, 0, 'record')
+    if publish_pass:
+        keydb_lib.set_video_publish_pass(db, PORT_ENG, publish_pass)
+    if rtmp_path:
+        keydb_lib.set_video_rtmp_path(db, PORT_ENG, 0, rtmp_path)
+    db.transaction_prepare_commit()
+    db.transaction_commit()
+    db.close()
+    return p
+
+
+class RtspSession:
+    def __init__(self, workdir, with_mav=True):
+        self.workdir = workdir
+        self.proxy = Proxy(workdir)
+        assert self.proxy.wait_for(r'video slot 0 listening'), self.proxy.log
+        self.mav = None
+        if with_mav:
+            self.mav = _Mav()
+            assert self.proxy.wait_for(r'have UDP conn1'), self.proxy.log
+            time.sleep(1.2)
+        self.pub = None
+
+    def publish(self, clip, loop=True):
+        argv = ['ffmpeg', '-hide_banner', '-loglevel', 'error', '-re']
+        if loop:
+            argv += ['-stream_loop', '-1']
+        argv += ['-i', clip, '-c:v', 'copy', '-an',
+                 '-f', 'rtsp', '-rtsp_transport', 'tcp',
+                 'rtsp://127.0.0.1:%d/cam' % VPORT]
+        self.pub = subprocess.Popen(argv, stdout=subprocess.DEVNULL,
+                                    stderr=subprocess.PIPE)
+        return self.pub
+
+    def publish_rtmp_burst(self, clip, path='PhoenixFPV/FPV', port=None):
+        """Publish as fast as the link allows -- no -re pacing.
+
+        This is the case the paced publisher never exercised: a burst
+        fills the socket to the backend, and the old relay slept inside
+        the event loop retrying that write, which stopped it draining
+        ffmpeg's stdout and deadlocked the pair.
+        """
+        argv = ['ffmpeg', '-hide_banner', '-loglevel', 'error',
+                '-stream_loop', '-1', '-i', clip, '-c:v', 'copy', '-an',
+                '-f', 'flv',
+                'rtmp://127.0.0.1:%d/%s' % (port or VPORT, path)]
+        self.pub = subprocess.Popen(argv, stdout=subprocess.DEVNULL,
+                                    stderr=subprocess.PIPE)
+        return self.pub
+
+    def publish_rtmp(self, clip, path='PhoenixFPV/FPV', loop=True,
+                     port=None):
+        """Publish over RTMP, the way the camera does.
+
+        The app and stream in the URL are what the proxy reads off the
+        wire, so this is also how a test picks the path and, with a
+        query on the stream name, the publish credential.
+        """
+        argv = ['ffmpeg', '-hide_banner', '-loglevel', 'error', '-re']
+        if loop:
+            argv += ['-stream_loop', '-1']
+        argv += ['-i', clip, '-c:v', 'copy', '-an',
+                 '-f', 'flv',
+                 'rtmp://127.0.0.1:%d/%s' % (port or VPORT, path)]
+        self.pub = subprocess.Popen(argv, stdout=subprocess.DEVNULL,
+                                    stderr=subprocess.PIPE)
+        return self.pub
+
+    def stop_publisher(self):
+        if self.pub and self.pub.poll() is None:
+            self.pub.terminate()
+            try:
+                self.pub.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                self.pub.kill()
+                self.pub.wait(timeout=5)
+        self.pub = None
+
+    def stop(self):
+        self.stop_publisher()
+        if self.mav:
+            self.mav.stop()
+        self.proxy.stop()
+
+
+def _no_stray_ffmpeg():
+    """No ffmpeg still pointed at our video port.
+
+    A publisher started with -stream_loop -1 keeps retrying, so a
+    leftover from the previous test would otherwise take the slot the
+    next test is trying to publish into.
+    """
+    out = subprocess.run(['pgrep', '-a', '-x', 'ffmpeg'],
+                         capture_output=True, text=True).stdout
+    return not any(':%d/' % VPORT in ln for ln in out.splitlines())
+
+
+def _settle(timeout=45):
+    # 45s not 25: the backpressure tests run an unpaced -stream_loop -1
+    # publisher, which under a loaded -j16 run takes longer to die than
+    # the paced ones this was sized for.
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        if (_no_stray_ffmpeg() and _port_free(VPORT)
+                and _port_free(PORT_USER) and _port_free(PORT_ENG)):
+            return True
+        time.sleep(0.3)
+    return False
+
+
+def _settle_state():
+    """What is still held, for an assertion message worth reading."""
+    held = [name for name, port in (('video', VPORT), ('user', PORT_USER),
+                                    ('eng', PORT_ENG)) if not _port_free(port)]
+    out = subprocess.run(['pgrep', '-a', '-x', 'ffmpeg'],
+                         capture_output=True, text=True).stdout
+    return 'ports held: %s; ffmpeg: %r' % (held or 'none', out.splitlines())
+
+
+def _port_free(port):
+    """True when nothing holds `port` (read from /proc/net/tcp).
+
+    TIME_WAIT does not count. An accepted connection's local port *is*
+    the listening port, so refusing a publisher leaves the video port in
+    TIME_WAIT for 60 s -- longer than this waits -- while the proxy
+    (SO_REUSEADDR) can rebind it immediately. Counting it made the next
+    test fail for something that was never in its way.
+    """
+    want = '%04X' % port
+    for proto in ('tcp', 'udp'):
+        try:
+            with open('/proc/net/' + proto) as f:
+                next(f)
+                for line in f:
+                    f_ = line.split()
+                    if f_[1].split(':')[1].upper() != want:
+                        continue
+                    if proto == 'tcp' and f_[3] == '06':   # TIME_WAIT
+                        continue
+                    return False
+        except OSError:
+            pass
+    return True
+
+
+@pytest.fixture
+def session(tmp_path):
+    """One proxy per test.
+
+    These tests share a port set and, unlike the other video files,
+    also leave ffmpeg subprocesses behind. Waiting for the video port
+    to be released before yielding keeps a slow teardown from failing
+    the next test rather than its own.
+    """
+    _settle()
+
+    made = {}
+
+    def _start(**kw):
+        made['s'] = RtspSession(_workdir(tmp_path, **{
+            k: v for k, v in kw.items()
+            if k in ('record', 'publish_pass')}),
+            with_mav=kw.get('with_mav', True))
+        return made['s']
+
+    yield _start
+    if 's' in made:
+        made['s'].stop()
+    _settle()
+
+
+def _ffmpeg_children(proxy):
+    """ffmpeg processes descended from this proxy."""
+    out = subprocess.run(['pgrep', '-a', '-x', 'ffmpeg'],
+                         capture_output=True, text=True).stdout
+    return [ln for ln in out.splitlines() if 'rtsp://127.0.0.1' in ln]
+
+
+@pytest.mark.integration
+class TestRtspIngest:
+    def test_publish_is_accepted_and_becomes_joinable(self, session, clip):
+        s = session()
+        s.publish(clip)
+        assert s.proxy.wait_for(r'RTSP backend pid \d+', timeout=20), s.proxy.log
+        assert s.proxy.wait_for(r'RTSP publisher', timeout=20), s.proxy.log
+        assert s.proxy.wait_for(r'join=ready', timeout=40), s.proxy.log
+
+        st = re.findall(r'stats: (\d+) KiB, (\d+) pkts, pat=(\d+) pmt=(\d+) '
+                        r'rai=(\d+)', s.proxy.log)
+        assert st, s.proxy.log
+        kib, pkts, pat, pmt, rai = (int(x) for x in st[-1])
+        assert pkts > 0 and pat > 0 and pmt > 0 and rai > 0, st[-1]
+
+    def test_recording_is_written(self, session, clip):
+        s = session()
+        s.publish(clip)
+        assert s.proxy.wait_for(r'recording to .*\.v1\.ts', timeout=30), \
+            s.proxy.log
+        d = (s.workdir / 'logs' / str(PORT_ENG)
+             / time.strftime('%Y-%m-%d', time.localtime()))
+        deadline = time.time() + 20
+        segs = []
+        while time.time() < deadline:
+            segs = [f for f in d.iterdir() if f.name.endswith('.v1.ts')] \
+                if d.is_dir() else []
+            if segs and segs[0].stat().st_size > 10000:
+                break
+            time.sleep(0.5)
+        assert segs and segs[0].stat().st_size > 10000, \
+            'no usable recording from an RTSP publish:\n%s' % s.proxy.log
+        blob = segs[0].read_bytes()
+        assert blob[0] == 0x47 and len(blob) % 188 == 0
+
+    def test_viewer_gets_the_rtsp_stream(self, session, clip):
+        """The whole point: an RTSP publisher feeds the same fan-out as
+        a UDP one."""
+        import socket
+        s = session()
+        s.publish(clip)
+        assert s.proxy.wait_for(r'join=ready', timeout=40), s.proxy.log
+
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        sock.settimeout(10)
+        sock.connect(('127.0.0.1', VPORT))
+        try:
+            sock.sendall(b'GET /v1.ts HTTP/1.1\r\nHost: x\r\n\r\n')
+            got = b''
+            deadline = time.time() + 8
+            while time.time() < deadline and len(got) < 40000:
+                try:
+                    c = sock.recv(65536)
+                except socket.timeout:
+                    continue
+                if not c:
+                    break
+                got += c
+        finally:
+            sock.close()
+        assert b'200 OK' in got, got[:200]
+        body = got.split(b'\r\n\r\n', 1)[1]
+        assert len(body) > 10000, len(body)
+        assert body[0] == 0x47, 'viewer stream does not start at a packet'
+
+    def test_publish_rejected_without_a_mavlink_session(self, session, clip):
+        s = session(with_mav=False)
+        s.publish(clip, loop=False)
+        assert s.proxy.wait_for(r'rejected .*no MAVLink session', timeout=20), \
+            s.proxy.log
+        assert 'RTSP backend pid' not in s.proxy.log, \
+            'a backend was started for an unauthorised publisher'
+
+    def test_second_publisher_is_refused(self, session, clip):
+        s = session()
+        s.publish(clip)
+        assert s.proxy.wait_for(r'RTSP publisher', timeout=20), s.proxy.log
+        second = subprocess.Popen(
+            ['ffmpeg', '-hide_banner', '-loglevel', 'error', '-re',
+             '-i', clip, '-c:v', 'copy', '-an', '-f', 'rtsp',
+             '-rtsp_transport', 'tcp', 'rtsp://127.0.0.1:%d/cam2' % VPORT],
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        try:
+            assert s.proxy.wait_for(r'another publisher holds this slot',
+                                    timeout=20), s.proxy.log
+        finally:
+            second.terminate()
+            second.wait(timeout=5)
+
+    def test_no_orphan_backend_after_the_publisher_leaves(self, session, clip):
+        s = session()
+        s.publish(clip)
+        assert s.proxy.wait_for(r'RTSP backend pid \d+', timeout=20), s.proxy.log
+        assert _ffmpeg_children(s.proxy), 'no backend running while publishing'
+
+        s.stop_publisher()
+        assert s.proxy.wait_for(r'RTSP publisher gone', timeout=25), s.proxy.log
+        deadline = time.time() + 15
+        while time.time() < deadline and _ffmpeg_children(s.proxy):
+            time.sleep(0.5)
+        assert not _ffmpeg_children(s.proxy), \
+            'backend outlived the publisher: %r' % _ffmpeg_children(s.proxy)
+
+    def test_backend_dies_with_the_proxy(self, session, clip):
+        s = session()
+        s.publish(clip)
+        assert s.proxy.wait_for(r'RTSP backend pid \d+', timeout=20), s.proxy.log
+        assert _ffmpeg_children(s.proxy)
+        s.stop_publisher()
+        s.proxy.stop()
+        deadline = time.time() + 15
+        while time.time() < deadline and _ffmpeg_children(s.proxy):
+            time.sleep(0.5)
+        assert not _ffmpeg_children(s.proxy), \
+            'backend outlived the proxy: %r' % _ffmpeg_children(s.proxy)
+
+
+def _publish_with(url_suffix, clip, seconds=6):
+    return subprocess.Popen(
+        ['ffmpeg', '-hide_banner', '-loglevel', 'error', '-re',
+         '-stream_loop', '-1', '-i', clip, '-c:v', 'copy', '-an',
+         '-f', 'rtsp', '-rtsp_transport', 'tcp',
+         'rtsp://127.0.0.1:%d/cam%s' % (VPORT, url_suffix)],
+        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+
+@pytest.mark.integration
+class TestPublishPassword:
+    """Path A: a publish password, with no MAVLink session anywhere.
+
+    This is the path for CGNAT, for video on a different link from
+    telemetry, and for anyone who does not want address matching to be
+    the gate at all. The password replaces the MAVLink check rather
+    than adding to it.
+
+    RTSP carries it in the request-line URI. That is the only place it
+    can go without us answering anything: Basic auth would mean
+    replying 401 and renumbering CSeq, which is exactly what makes the
+    opaque splice work.
+    """
+
+    def test_accepted_with_no_mavlink_session_at_all(self, session, clip):
+        s = session(with_mav=False, publish_pass='pubsecret')
+        s.pub = _publish_with('?pw=pubsecret', clip)
+        assert s.proxy.wait_for(r'RTSP publisher', timeout=25), s.proxy.log
+        assert s.proxy.wait_for(r'join=ready', timeout=40), s.proxy.log
+        assert 'no MAVLink session' not in s.proxy.log
+
+    def test_wrong_password_refused(self, session, clip):
+        s = session(with_mav=False, publish_pass='pubsecret')
+        s.pub = _publish_with('?pw=wrong', clip)
+        assert s.proxy.wait_for(r'wrong publish password', timeout=25), \
+            s.proxy.log
+        assert 'RTSP publisher' not in s.proxy.log
+
+    def test_missing_password_says_so_precisely(self, session, clip):
+        """Distinct from 'wrong', and distinct from 'this transport
+        cannot carry one' -- an operator debugging this needs to know
+        which of the three it is."""
+        s = session(with_mav=False, publish_pass='pubsecret')
+        s.pub = _publish_with('', clip)
+        assert s.proxy.wait_for(r'none was supplied', timeout=25), s.proxy.log
+
+    def test_udp_says_it_cannot_carry_a_password(self, session, clip):
+        import socket
+        sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+        import tsgen
+        s = session(with_mav=False, publish_pass='pubsecret')
+        g = tsgen.TSGen()
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        try:
+            for dg in g.datagrams(g.stream(60, gop=10, psi_every=20)):
+                sock.sendto(dg, ('127.0.0.1', VPORT))
+                time.sleep(0.003)
+        finally:
+            sock.close()
+        assert s.proxy.wait_for(r'cannot carry one', timeout=20), s.proxy.log
+
+    def test_password_replaces_the_mavlink_check(self, session, clip):
+        """With a password set, a valid MAVLink session is not enough on
+        its own -- otherwise setting one would not actually tighten
+        anything for a transport that can carry it."""
+        s = session(with_mav=True,          # a session IS present
+                    publish_pass='pubsecret')
+        s.pub = _publish_with('?pw=wrong', clip)
+        assert s.proxy.wait_for(r'wrong publish password', timeout=25), \
+            s.proxy.log
+        assert 'RTSP publisher' not in s.proxy.log
+
+
+class TestRtspPublisherRestart:
+    """Restarting an RTSP publisher, which is the case that mattered.
+
+    A publish password forces RTSP -- plain MPEG-TS/UDP cannot carry a
+    credential -- so this is the transport a passworded entry actually
+    uses. The publisher-gone handling was added to the UDP idle-release
+    path only, and every test for it used a UDP publisher, so RTSP kept
+    the original bug: viewers stayed attached across a restart and were
+    fed a second stream's timestamps, which stalls a browser player for
+    good and then shows up as the viewer being lapped.
+    """
+
+    def test_viewer_is_ended_when_the_rtsp_publisher_goes(self, tmp_path,
+                                                          clip):
+        s = RtspSession(_workdir(tmp_path))
+        try:
+            s.publish(clip)
+            assert s.proxy.wait_for(r'RTSP publisher', timeout=25), s.proxy.log
+            assert s.proxy.wait_for(r'join=ready', timeout=30), s.proxy.log
+
+            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            sock.settimeout(10)
+            sock.connect(('127.0.0.1', VPORT))
+            sock.sendall(b'GET /v1.ts HTTP/1.1\r\nHost: x\r\n\r\n')
+            got = sock.recv(65536)
+            assert b'200' in got, got[:200]
+
+            s.stop_publisher()
+            assert s.proxy.wait_for(r'RTSP publisher gone', timeout=25), \
+                s.proxy.log
+
+            # The viewer must be closed, not left attached to a stream
+            # that has ended.
+            closed = False
+            deadline = time.time() + 15
+            while time.time() < deadline:
+                try:
+                    if sock.recv(65536) == b'':
+                        closed = True
+                        break
+                except socket.timeout:
+                    break
+                except OSError:
+                    closed = True
+                    break
+            sock.close()
+            assert closed, 'viewer survived the RTSP publisher going away'
+        finally:
+            s.stop()
+
+    def test_reason_is_logged_for_rtsp(self, tmp_path, clip):
+        s = RtspSession(_workdir(tmp_path))
+        try:
+            s.publish(clip)
+            assert s.proxy.wait_for(r'join=ready', timeout=30), s.proxy.log
+            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            sock.settimeout(10)
+            sock.connect(('127.0.0.1', VPORT))
+            sock.sendall(b'GET /v1.ts HTTP/1.1\r\nHost: x\r\n\r\n')
+            sock.recv(65536)
+            s.stop_publisher()
+            # Match the viewer's drop line, not close_rtsp's own
+            # "RTSP publisher gone" -- that one is logged either way and
+            # so proves nothing about the viewer being ended.
+            assert s.proxy.wait_for(
+                r'viewer disconnected .*\(publisher gone\)', timeout=25), \
+                s.proxy.log
+            sock.close()
+        finally:
+            s.stop()
+
+
+class TestRtmpIngest:
+    """RTMP publish, with the protocol spoken here rather than spliced.
+
+    ffmpeg's RTMP listener answers FCPublish with a bare command name
+    and publish with nothing, which a real camera waits out and then
+    hangs up on, so this path terminates RTMP itself and hands the
+    backend FLV. The camera can publish over RTMP but not RTSP -- its
+    RTSP OPTIONS offers no ANNOUNCE -- so this is the transport the
+    direct camera stream actually uses.
+    """
+
+    def test_rtmp_publisher_is_ingested(self, tmp_path, clip):
+        s = RtspSession(_workdir(tmp_path, rtmp_path='PhoenixFPV/FPV'))
+        try:
+            s.publish_rtmp(clip)
+            assert s.proxy.wait_for(r'RTMP publisher', timeout=25), s.proxy.log
+            assert s.proxy.wait_for(r'join=ready', timeout=40), s.proxy.log
+        finally:
+            s.stop()
+
+    def test_it_is_not_mistaken_for_a_viewer(self, tmp_path, clip):
+        """An RTMP connection arrives in a viewer slot, because
+        classification only happens once bytes arrive. It must be
+        handed to the ingest splice, not answered as a viewer."""
+        s = RtspSession(_workdir(tmp_path, rtmp_path='PhoenixFPV/FPV'))
+        try:
+            s.publish_rtmp(clip)
+            assert s.proxy.wait_for(r'RTMP publisher', timeout=25), s.proxy.log
+            assert 'viewer disconnected' not in s.proxy.log
+        finally:
+            s.stop()
+
+    def test_unconfigured_slot_takes_any_path(self, tmp_path, clip):
+        """With the protocol parsed here, the app and stream are read
+        off the wire rather than declared in advance, so a blank path
+        is no longer a misconfiguration -- the slot takes whatever the
+        camera publishes."""
+        s = RtspSession(_workdir(tmp_path))     # no rtmp_path
+        try:
+            s.publish_rtmp(clip, path='whatever/stream')
+            assert s.proxy.wait_for(r'RTMP publishing whatever/stream',
+                                    timeout=25), s.proxy.log
+            assert s.proxy.wait_for(r'join=ready', timeout=40), s.proxy.log
+        finally:
+            s.stop()
+
+    def test_a_configured_path_still_restricts(self, tmp_path, clip):
+        """Set, it is an access control: a publisher on another path is
+        refused rather than quietly taking the slot."""
+        s = RtspSession(_workdir(tmp_path, rtmp_path='PhoenixFPV/FPV'))
+        try:
+            s.publish_rtmp(clip, path='someone/else')
+            assert s.proxy.wait_for(r'slot expects PhoenixFPV/FPV',
+                                    timeout=25), s.proxy.log
+            assert 'join=ready' not in s.proxy.log
+        finally:
+            s.stop()
+
+    def test_the_stream_is_recorded(self, tmp_path, clip):
+        wd = _workdir(tmp_path, record=True, rtmp_path='PhoenixFPV/FPV')
+        s = RtspSession(wd)
+        try:
+            s.publish_rtmp(clip)
+            assert s.proxy.wait_for(r'recording to', timeout=40), s.proxy.log
+            s.stop_publisher()
+            time.sleep(2)
+            segs = list((wd / 'logs' / str(PORT_ENG)).rglob('*.v1.ts'))
+            assert segs, 'no recording written'
+            assert segs[0].stat().st_size > 10000
+        finally:
+            s.stop()
+
+    def test_squatters_cannot_deny_publishing(self, tmp_path, clip):
+        """An unauthenticated handshake must not own the publisher slot.
+
+        One 0x03 byte classifies a connection as RTMP. If that reserved
+        the slot, a peer could take it, wait out the deadline and
+        reconnect for ever -- and letting a newcomer evict the incumbent
+        only makes it last-arrival-wins, which denies the camera just as
+        effectively. Handshakes negotiate side by side instead and the
+        slot is awarded on publish, after admission.
+
+        The squatters are kept connected for the whole test, and keep
+        arriving after the publisher does, which is what the earlier
+        version of this test failed to do.
+        """
+        wd = _workdir(tmp_path, record=True)
+        s = RtspSession(wd)
+        squatters = []
+        try:
+            for _ in range(3):
+                c = socket.create_connection(('127.0.0.1', VPORT), 5)
+                c.sendall(b'\x03')
+                squatters.append(c)
+            time.sleep(1.0)
+            s.publish_rtmp(clip)
+            # Keep squatting while the real publisher negotiates.
+            for _ in range(3):
+                try:
+                    c = socket.create_connection(('127.0.0.1', VPORT), 5)
+                    c.sendall(b'\x03')
+                    squatters.append(c)
+                except OSError:
+                    pass
+                time.sleep(0.3)
+            assert s.proxy.wait_for(r'RTMP publishing', timeout=30), \
+                s.proxy.log
+            assert s.proxy.wait_for(r'join=ready', timeout=40), s.proxy.log
+        finally:
+            for c in squatters:
+                try:
+                    c.close()
+                except OSError:
+                    pass
+            s.stop()
+
+    def test_a_squatter_cannot_evict_a_live_publisher(self, tmp_path, clip):
+        """Once publishing, the slot is held against new handshakes."""
+        wd = _workdir(tmp_path, record=True)
+        s = RtspSession(wd)
+        squatters = []
+        try:
+            s.publish_rtmp(clip)
+            assert s.proxy.wait_for(r'join=ready', timeout=40), s.proxy.log
+            for _ in range(4):
+                c = socket.create_connection(('127.0.0.1', VPORT), 5)
+                c.sendall(b'\x03')
+                squatters.append(c)
+            time.sleep(3)
+            assert 'publisher gone' not in s.proxy.log, s.proxy.log
+        finally:
+            for c in squatters:
+                try:
+                    c.close()
+                except OSError:
+                    pass
+            s.stop()
+
+    def test_a_silent_flood_does_not_block_classification(self, tmp_path,
+                                                          clip):
+        """Sockets that never speak must not fill the viewer table.
+
+        A publisher is classified from a viewer slot, so a flood of
+        silent connections used to stop one being recognised at all.
+        What bounds it is a per-source-address cap, not a reserve: a
+        publisher is indistinguishable at accept time, since any
+        credential it carries arrives later. Several addresses can still
+        fill the table between them -- see the per-IP cap in video.cpp.
+        """
+        wd = _workdir(tmp_path, record=True)
+        s = RtspSession(wd)
+        flood = []
+        try:
+            # From another address: 127/8 is all loopback, so this is a
+            # different source to the publisher's 127.0.0.1, which is
+            # what the per-address cap keys on.
+            for _ in range(40):          # more than the 32-entry table
+                try:
+                    c = socket.socket()
+                    c.bind(('127.0.0.2', 0))
+                    c.settimeout(5)
+                    c.connect(('127.0.0.1', VPORT))
+                    flood.append(c)
+                except OSError:
+                    break
+            time.sleep(1.5)
+            s.publish_rtmp(clip)
+            assert s.proxy.wait_for(r'RTMP publishing', timeout=30), \
+                s.proxy.log
+        finally:
+            for c in flood:
+                try:
+                    c.close()
+                except OSError:
+                    pass
+            s.stop()
+
+    def test_publisher_row_reports_its_real_transport(self, tmp_path, clip):
+        """connections.tdb must not call an RTMP publisher UDP/MPEG-TS."""
+        import conntdb_lib
+        wd = _workdir(tmp_path, record=True)
+        s = RtspSession(wd)
+        try:
+            s.publish_rtmp(clip)
+            assert s.proxy.wait_for(r'join=ready', timeout=40), s.proxy.log
+            time.sleep(6)                # let a tick write the rows
+            rows = conntdb_lib.list_active(
+                str(wd / conntdb_lib.CONN_FILE), max_age_s=60)
+            pub = [r for r in rows
+                   if r.role == conntdb_lib.CONN_ROLE_VIDEO_PUB]
+            assert pub, 'no video publisher row: %r' % (rows,)
+            assert pub[0].transport_name == 'tcp', pub[0].transport_name
+            assert pub[0].app_proto == conntdb_lib.CONN_APP_RTMP
+        finally:
+            s.stop()
+
+    def _flv_of(self, clip, tmp_path):
+        """The clip as FLV, so its tags can be replayed over RTMP."""
+        out = str(tmp_path / 'src.flv')
+        subprocess.run(['ffmpeg', '-v', 'error', '-i', clip, '-c:v', 'copy',
+                        '-an', '-f', 'flv', out, '-y'],
+                       check=True, capture_output=True)
+        return rtmp_client.read_flv_tags(out)
+
+    def test_media_pipelined_with_publish_is_kept(self, tmp_path, clip):
+        """A publisher that does not wait for onStatus must still work.
+
+        feed() drains everything buffered, so media in the same segment
+        as publish was parsed while publishing_ was still false and
+        dropped -- taking the AVC sequence header, and with it the
+        parameter sets, so the backend could not open the stream. ffmpeg
+        never sends this shape because it waits for onStatus first.
+        """
+        tags = self._flv_of(clip, tmp_path)
+        wd = _workdir(tmp_path, record=True)
+        s = RtspSession(wd)
+        pub = None
+        try:
+            pub = rtmp_client.RtmpPublisher('127.0.0.1', VPORT)
+            pub.handshake()
+            pub.connect()
+            # publish + the sequence header + the first frames, one write
+            pub.publish(first_tags=tags[:3], pipeline=True)
+            for ttype, ts, body in tags[3:]:
+                pub.send_tag(ttype, ts, body)
+                time.sleep(0.004)
+            assert s.proxy.wait_for(r'join=ready', timeout=40), s.proxy.log
+        finally:
+            if pub:
+                pub.close()
+            s.stop()
+
+    def test_a_split_chunk_does_not_inflate_timestamps(self, tmp_path, clip):
+        """A chunk header split from its payload must not double its delta.
+
+        The parser committed the header before checking the payload was
+        buffered, so a short read re-parsed it and applied the timestamp
+        delta again. Ordinary TCP segmentation is enough; the effect is
+        a recording longer than the media it contains.
+        """
+        tags = [t for t in self._flv_of(clip, tmp_path) if t[0] == 9]
+        wd = _workdir(tmp_path, record=True)
+        s = RtspSession(wd)
+        pub = None
+        try:
+            pub = rtmp_client.RtmpPublisher('127.0.0.1', VPORT)
+            pub.handshake()
+            pub.connect()
+            pub.publish(first_tags=tags[:1])
+            prev = tags[0][1]
+            sent = 0
+            # All of them: ffmpeg's default -analyzeduration is 5 s of
+            # media, so a shorter burst produces no output at all and
+            # the test would fail for the wrong reason.
+            for ttype, ts, body in tags[1:]:
+                # fmt 1 carries a delta, and every other one is split
+                pub.send_tag(ttype, ts - prev, body, fmt=1,
+                             split=(sent % 2 == 1))
+                prev = ts
+                sent += 1
+                time.sleep(0.01)
+            expected = (prev - tags[0][1]) / 1000.0
+            assert s.proxy.wait_for(r'recording to', timeout=40), s.proxy.log
+            time.sleep(2)
+        finally:
+            if pub:
+                pub.close()
+            s.stop()
+
+        segs = list((wd / 'logs' / str(PORT_ENG)).rglob('*.v1.ts'))
+        assert segs, 'no recording written'
+        out = subprocess.run(
+            ['ffprobe', '-v', 'error', '-select_streams', 'v:0',
+             '-show_entries', 'packet=pts_time', '-of', 'csv=p=0',
+             str(segs[0])], capture_output=True, text=True).stdout
+        pts = [float(r.rstrip(',')) for r in out.strip().splitlines()
+               if r.rstrip(',')]
+        assert len(pts) > 10, 'too few packets to judge: %d' % len(pts)
+        span = pts[-1] - pts[0]
+        # Doubling the deltas on every other frame would put the span
+        # about 50% over; allow generous slack for the last frame.
+        assert span < expected * 1.25 + 0.3, (
+            'timestamp span %.2f s for %.2f s of media -- deltas applied '
+            'more than once' % (span, expected))
+
+    def test_h264_publisher_gets_the_nal_rewriting_filter(self, tmp_path,
+                                                          clip):
+        """H.264 over RTMP must go through h264_metadata.
+
+        ffmpeg's own AVCC to Annex-B conversion emits a zero-length NAL
+        ahead of every access unit for the real camera's stream, which
+        is invalid H.264: Chrome's MP4 parser refuses the sample
+        ("Failed to prepare video sample for decode") while Firefox
+        plays it regardless. h264_metadata rewrites the units and
+        removes them -- measured on camera capture, 8362 empty units to
+        none -- but it is codec-specific, so it must be chosen from the
+        codec the FLV names rather than applied blind.
+
+        This asserts the choice, not the byte-level outcome: an ffmpeg
+        publisher does not reproduce whatever the camera does, so the
+        empty units simply do not appear in a synthetic stream (see
+        test_no_zero_length_nal_units, which is a general invariant
+        rather than a regression guard for this bug).
+        """
+        s = RtspSession(_workdir(tmp_path))
+        try:
+            s.publish_rtmp(clip)
+            assert s.proxy.wait_for(r'bsf h264_metadata', timeout=25), \
+                s.proxy.log
+        finally:
+            s.stop()
+
+    def test_no_zero_length_nal_units(self, tmp_path, clip):
+        """Ingested video must contain no empty NAL units.
+
+        A general invariant, not a regression guard: an ffmpeg publisher
+        does not reproduce the camera stream shape that made ffmpeg emit
+        them, so this passes with or without the filter that fixes it.
+        Kept because empty NAL units are invalid H.264 whatever produces
+        them, and only a byte check finds them -- Firefox plays them
+        happily and ffprobe reports no error.
+        """
+        wd = _workdir(tmp_path, record=True)
+        s = RtspSession(wd)
+        try:
+            s.publish_rtmp(clip)
+            assert s.proxy.wait_for(r'recording to', timeout=40), s.proxy.log
+            assert s.proxy.wait_for(r'join=ready', timeout=40), s.proxy.log
+            s.stop_publisher()
+            time.sleep(2)
+            segs = list((wd / 'logs' / str(PORT_ENG)).rglob('*.v1.ts'))
+            assert segs, 'no recording written'
+        finally:
+            s.stop()
+
+        es = str(tmp_path / 'es.264')
+        subprocess.run(['ffmpeg', '-v', 'error', '-i', str(segs[0]),
+                        '-c', 'copy', '-f', 'h264', es, '-y'],
+                       check=True, capture_output=True)
+        data = open(es, 'rb').read()
+        starts = []
+        i = 0
+        while i < len(data) - 3:
+            if data[i] == 0 and data[i + 1] == 0:
+                if data[i + 2] == 1:
+                    starts.append((i, 3))
+                    i += 3
+                    continue
+                if data[i + 2] == 0 and data[i + 3] == 1:
+                    starts.append((i, 4))
+                    i += 4
+                    continue
+            i += 1
+        empty = 0
+        for k, (p, ln) in enumerate(starts):
+            end = starts[k + 1][0] if k + 1 < len(starts) else len(data)
+            if end - (p + ln) == 0:
+                empty += 1
+        assert starts, 'no NAL units found'
+        assert empty == 0, ('%d of %d NAL units are zero-length'
+                            % (empty, len(starts)))
+
+    def test_publish_password_in_the_stream_key(self, tmp_path, clip):
+        """Parsing the protocol gives RTMP somewhere to carry a
+        credential: a query on the stream name, which is the single
+        "stream key" field a camera or OBS offers.
+        """
+        s = RtspSession(_workdir(tmp_path, publish_pass='secret'),
+                        with_mav=False)
+        try:
+            s.publish_rtmp(clip, path='PhoenixFPV/FPV?pw=secret')
+            assert s.proxy.wait_for(r'RTMP publishing PhoenixFPV/FPV',
+                                    timeout=25), s.proxy.log
+            assert s.proxy.wait_for(r'join=ready', timeout=40), s.proxy.log
+        finally:
+            s.stop()
+
+    def test_publish_password_refuses_the_wrong_one(self, tmp_path, clip):
+        s = RtspSession(_workdir(tmp_path, publish_pass='secret'),
+                        with_mav=False)
+        try:
+            s.publish_rtmp(clip, path='PhoenixFPV/FPV?pw=wrong')
+            assert s.proxy.wait_for(r'rejected', timeout=25), s.proxy.log
+            assert 'RTMP publishing' not in s.proxy.log
+        finally:
+            s.stop()
+
+    def test_publish_password_refuses_when_absent(self, tmp_path, clip):
+        """No credential at all, with one required: still refused, and
+        with the reason that says one was missing rather than wrong."""
+        s = RtspSession(_workdir(tmp_path, publish_pass='secret'),
+                        with_mav=False)
+        try:
+            s.publish_rtmp(clip)
+            assert s.proxy.wait_for(r'rejected', timeout=25), s.proxy.log
+            assert 'RTMP publishing' not in s.proxy.log
+        finally:
+            s.stop()
+
+    def test_no_orphan_backend_after_the_rtmp_publisher_leaves(
+            self, tmp_path, clip):
+        s = RtspSession(_workdir(tmp_path, rtmp_path='PhoenixFPV/FPV'))
+        try:
+            s.publish_rtmp(clip)
+            assert s.proxy.wait_for(r'RTMP publisher', timeout=25), s.proxy.log
+            s.stop_publisher()
+            assert s.proxy.wait_for(r'publisher gone', timeout=30), s.proxy.log
+        finally:
+            s.stop()
+        assert _settle(), ('a backend ffmpeg outlived the session -- %s'
+                           % _settle_state())
+
+    def test_restart_ends_the_stream_for_viewers(self, tmp_path, clip):
+        """Same contract as RTSP: a new publisher is a new stream, so
+        viewers are ended rather than spliced onto it."""
+        s = RtspSession(_workdir(tmp_path, rtmp_path='PhoenixFPV/FPV'))
+        try:
+            s.publish_rtmp(clip)
+            assert s.proxy.wait_for(r'join=ready', timeout=40), s.proxy.log
+            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            sock.settimeout(10)
+            sock.connect(('127.0.0.1', VPORT))
+            sock.sendall(b'GET /v1.ts HTTP/1.1\r\nHost: x\r\n\r\n')
+            assert b'200' in sock.recv(65536)
+            s.stop_publisher()
+            assert s.proxy.wait_for(
+                r'viewer disconnected .*\(publisher gone\)', timeout=30), \
+                s.proxy.log
+            sock.close()
+        finally:
+            s.stop()
+
+
+class TestSpliceBackpressure:
+    """The relay must never wait inside the event loop.
+
+    It is the only thread: it also drains ffmpeg's stdout, so sleeping
+    on a short write to the backend stops that draining, ffmpeg's stdout
+    pipe fills, ffmpeg stops reading its input, and neither side moves
+    again. Only an unpaced publisher reaches that state.
+    """
+
+    def test_unpaced_publisher_still_produces_media(self, tmp_path, clip):
+        s = RtspSession(_workdir(tmp_path, rtmp_path='PhoenixFPV/FPV'))
+        try:
+            s.publish_rtmp_burst(clip)
+            assert s.proxy.wait_for(r'RTMP publisher', timeout=25), s.proxy.log
+            assert s.proxy.wait_for(r'join=ready', timeout=60), s.proxy.log
+        finally:
+            s.stop()
+
+    def test_unpaced_publisher_keeps_flowing(self, tmp_path, clip):
+        """join=ready once is not enough -- a deadlock can set in after
+        the first burst. Require the byte count to keep climbing."""
+        s = RtspSession(_workdir(tmp_path, rtmp_path='PhoenixFPV/FPV'))
+        try:
+            s.publish_rtmp_burst(clip)
+            assert s.proxy.wait_for(r'join=ready', timeout=60), s.proxy.log
+            first = _last_kib(s.proxy.log)
+            deadline = time.time() + 30
+            while time.time() < deadline:
+                time.sleep(2)
+                if _last_kib(s.proxy.log) > first:
+                    return
+            raise AssertionError(
+                'ingest stalled at %d KiB -- the splice is wedged' % first)
+        finally:
+            s.stop()
+
+    def test_a_viewer_that_never_reads_does_not_wedge_ingest(self, tmp_path,
+                                                             clip):
+        """The other direction of the same hazard."""
+        s = RtspSession(_workdir(tmp_path, rtmp_path='PhoenixFPV/FPV'))
+        sock = None
+        try:
+            s.publish_rtmp_burst(clip)
+            assert s.proxy.wait_for(r'join=ready', timeout=60), s.proxy.log
+            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            sock.settimeout(10)
+            sock.connect(('127.0.0.1', VPORT))
+            sock.sendall(b'GET /v1.ts HTTP/1.1\r\nHost: x\r\n\r\n')
+            sock.recv(4096)          # then deliberately stop reading
+            first = _last_kib(s.proxy.log)
+            deadline = time.time() + 30
+            while time.time() < deadline:
+                time.sleep(2)
+                if _last_kib(s.proxy.log) > first:
+                    return
+            raise AssertionError(
+                'ingest stalled at %d KiB behind a silent viewer' % first)
+        finally:
+            if sock:
+                sock.close()
+            s.stop()
+
+
+def _last_kib(log):
+    """KiB from the most recent stats line, or 0."""
+    hits = re.findall(r'stats: (\d+) KiB', log)
+    return int(hits[-1]) if hits else 0
diff --git a/tests/test_video_view.py b/tests/test_video_view.py
new file mode 100644
index 0000000..26f2feb
--- /dev/null
+++ b/tests/test_video_view.py
@@ -0,0 +1,820 @@
+"""Video viewers: fan-out, join point, credentials and the drop policy.
+
+The two properties worth testing hardest:
+
+  * fan-out is byte-exact. Both recording and viewing promise the
+    publisher's own bytes, so a viewer's stream has to appear verbatim
+    in what was published -- not merely "be valid MPEG-TS".
+
+  * one slow viewer cannot hurt anyone else. That is meant to be true
+    by construction (the publisher never inspects viewer state), so the
+    test drives a viewer that never reads until it is lapped and checks
+    the others are untouched.
+"""
+import os
+import socket
+import subprocess
+import sys
+import threading
+import time
+
+import pytest
+
+_REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import keydb_lib  # noqa: E402
+import tsgen  # noqa: E402
+from test_video_child import (Proxy, Publisher, _Mav, PORT_ENG,  # noqa: E402
+                              PORT_USER, PASSPHRASE, VPORT)
+
+
+def _workdir(tmp_path, raw_tcp=False, viewer_pass=None):
+    p = tmp_path / 'work'
+    p.mkdir()
+    db = keydb_lib.init_db(str(p / 'keys.tdb'))
+    db.transaction_start()
+    keydb_lib.add_entry(db, PORT_USER, PORT_ENG, 'vid', PASSPHRASE)
+    keydb_lib.set_flag(db, PORT_ENG, 'video')
+    keydb_lib.set_video_ports(db, PORT_ENG, [VPORT])
+    if raw_tcp:
+        keydb_lib.set_video_slot_flag(db, PORT_ENG, 0, 'raw_tcp')
+    if viewer_pass:
+        keydb_lib.set_video_viewer_pass(db, PORT_ENG, viewer_pass)
+    db.transaction_prepare_commit()
+    db.transaction_commit()
+    db.close()
+    return p
+
+
+class Feed:
+    """Publishes continuously in the background, recording every byte sent."""
+
+    def __init__(self, port, gen=None):
+        self.port = port
+        self.gen = gen or tsgen.TSGen()
+        self.pub = Publisher(port)
+        self.sent = bytearray()
+        self._lock = threading.Lock()
+        self._stop = threading.Event()
+        self._t = None
+
+    def burst(self, packets=200):
+        data = self.gen.stream(packets, gop=10, psi_every=20)
+        for dg in self.gen.datagrams(data):
+            self.pub.sock.sendto(dg, ('127.0.0.1', self.port))
+            with self._lock:
+                self.sent += dg
+            time.sleep(0.002)
+
+    def start(self, packets=200, pause=0.05):
+        def _run():
+            while not self._stop.is_set():
+                self.burst(packets)
+                time.sleep(pause)
+        self._t = threading.Thread(target=_run, daemon=True)
+        self._t.start()
+
+    def snapshot(self):
+        with self._lock:
+            return bytes(self.sent)
+
+    def stop(self):
+        self._stop.set()
+        if self._t:
+            self._t.join(timeout=5)
+        self.pub.close()
+
+
+class Session:
+    def __init__(self, workdir, env=None):
+        self.workdir = workdir
+        backup = os.environ.copy()
+        os.environ.update(env or {})
+        try:
+            self.proxy = Proxy(workdir)
+        finally:
+            os.environ.clear()
+            os.environ.update(backup)
+        assert self.proxy.wait_for(r'video slot 0 listening'), self.proxy.log
+        self.mav = _Mav()
+        assert self.proxy.wait_for(r'have UDP conn1'), self.proxy.log
+        time.sleep(1.2)
+        self.feed = Feed(VPORT)
+
+    def wait_ready(self, timeout=25):
+        """Wait until the scanner reports a joinable stream."""
+        deadline = time.time() + timeout
+        while time.time() < deadline:
+            self.feed.burst(120)
+            if 'join=ready' in self.proxy.log:
+                return True
+            time.sleep(0.3)
+        return 'join=ready' in self.proxy.log
+
+    def stop(self):
+        try:
+            self.feed.stop()
+        except Exception:
+            pass
+        self.mav.stop()
+        self.proxy.stop()
+
+
+@pytest.fixture
+def session(tmp_path):
+    made = {}
+
+    def _start(env=None, **kw):
+        wd = _workdir(tmp_path, **kw)
+        made['s'] = Session(wd, env=env)
+        return made['s']
+
+    yield _start
+    if 's' in made:
+        made['s'].stop()
+
+
+def http_get(port, path='/v1.ts', headers='', timeout=5.0):
+    """Open an HTTP viewer and return (socket, response_head)."""
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.settimeout(timeout)
+    s.connect(('127.0.0.1', port))
+    s.sendall(('GET %s HTTP/1.1\r\nHost: localhost\r\n%s\r\n'
+               % (path, headers)).encode())
+    head = b''
+    while b'\r\n\r\n' not in head:
+        chunk = s.recv(4096)
+        if not chunk:
+            break
+        head += chunk
+    sep = head.find(b'\r\n\r\n')
+    body = head[sep + 4:] if sep >= 0 else b''
+    return s, head[:sep if sep >= 0 else len(head)], body
+
+
+def read_for(sock, seconds, initial=b''):
+    """Drain a socket for a while and return what arrived."""
+    out = bytearray(initial)
+    deadline = time.time() + seconds
+    sock.settimeout(0.5)
+    while time.time() < deadline:
+        try:
+            chunk = sock.recv(65536)
+        except socket.timeout:
+            continue
+        except OSError:
+            break
+        if not chunk:
+            break
+        out += chunk
+    return bytes(out)
+
+
+@pytest.mark.integration
+class TestHttpViewer:
+    def test_stream_is_served_and_byte_exact(self, session):
+        s = session()
+        assert s.wait_ready(), s.proxy.log
+        s.feed.start()
+        sock, head, body = http_get(VPORT)
+        try:
+            assert b'200 OK' in head, head
+            assert b'video/mp2t' in head, head
+            data = read_for(sock, 4, body)
+        finally:
+            sock.close()
+        assert len(data) > 10000, 'viewer got almost nothing: %d' % len(data)
+        assert data[0] == 0x47, 'viewer stream does not start at a packet'
+        sent = s.feed.snapshot()
+        assert data in sent, \
+            'viewer stream is not a verbatim span of what was published'
+
+    def test_join_starts_at_a_decodable_point(self, session):
+        """First bytes must be a PAT, with a PMT before any video payload.
+
+        Serving from an arbitrary point looks exactly like a broken
+        stream to the client, so this is the property that decides
+        whether the feature seems to work at all.
+        """
+        s = session()
+        assert s.wait_ready(), s.proxy.log
+        s.feed.start()
+        sock, head, body = http_get(VPORT)
+        try:
+            data = read_for(sock, 3, body)
+        finally:
+            sock.close()
+        assert len(data) >= 188 * 4, len(data)
+
+        def pid_of(pkt):
+            return ((pkt[1] & 0x1F) << 8) | pkt[2]
+
+        pkts = [data[i:i + 188] for i in range(0, len(data) - 187, 188)]
+        assert pkts[0][0] == 0x47
+        assert pid_of(pkts[0]) == 0, \
+            'first packet is PID 0x%x, expected the PAT' % pid_of(pkts[0])
+
+        saw_pmt = False
+        for pkt in pkts[:40]:
+            pid = pid_of(pkt)
+            if pid == tsgen.DEFAULT_PMT_PID:
+                saw_pmt = True
+            if pid == tsgen.DEFAULT_VIDEO_PID:
+                assert saw_pmt, 'video payload arrived before any PMT'
+                break
+        assert saw_pmt, 'no PMT near the start of the viewer stream'
+
+    def test_two_viewers_agree_on_overlapping_bytes(self, session):
+        s = session()
+        assert s.wait_ready(), s.proxy.log
+        s.feed.start()
+        a, _, abody = http_get(VPORT)
+        time.sleep(0.5)
+        b, _, bbody = http_get(VPORT)
+        try:
+            da = read_for(a, 4, abody)
+            db = read_for(b, 4, bbody)
+        finally:
+            a.close()
+            b.close()
+        assert len(da) > 5000 and len(db) > 5000, (len(da), len(db))
+        # b joined no earlier than a, so b's opening run must appear
+        # verbatim somewhere in a
+        probe = db[:4096]
+        assert probe in da or da[:4096] in db, \
+            'the two viewers disagree on the same stream'
+
+    def test_404_for_a_wrong_path(self, session):
+        s = session()
+        assert s.wait_ready(), s.proxy.log
+        sock, head, _ = http_get(VPORT, path='/nope')
+        sock.close()
+        assert b'404' in head, head
+
+    def test_503_before_the_stream_is_joinable(self, session):
+        """No keyframe yet means no decodable start point; say so."""
+        s = session()
+        g = tsgen.TSGen()
+        out = bytearray()
+        for i in range(80):
+            if i % 20 == 0:
+                out += g.pat()
+                out += g.pmt()
+            out += g.video(key=False)
+        for dg in g.datagrams(bytes(out)):
+            s.feed.pub.sock.sendto(dg, ('127.0.0.1', VPORT))
+            time.sleep(0.003)
+        time.sleep(1.0)
+        sock, head, _ = http_get(VPORT)
+        sock.close()
+        assert b'503' in head, head
+
+
+@pytest.mark.integration
+class TestViewerCredentials:
+    def test_password_required_when_set(self, session):
+        s = session(viewer_pass='watchme')
+        assert s.wait_ready(), s.proxy.log
+        sock, head, _ = http_get(VPORT)
+        sock.close()
+        assert b'401' in head, head
+
+    def test_password_accepted_in_query(self, session):
+        s = session(viewer_pass='watchme')
+        assert s.wait_ready(), s.proxy.log
+        sock, head, _ = http_get(VPORT, path='/v1.ts?pw=watchme')
+        sock.close()
+        assert b'200 OK' in head, head
+
+    def test_password_accepted_via_basic_auth(self, session):
+        import base64
+        s = session(viewer_pass='watchme')
+        assert s.wait_ready(), s.proxy.log
+        cred = base64.b64encode(b'viewer:watchme').decode()
+        sock, head, _ = http_get(VPORT,
+                                 headers='Authorization: Basic %s\r\n' % cred)
+        sock.close()
+        assert b'200 OK' in head, head
+
+    def test_wrong_password_refused(self, session):
+        s = session(viewer_pass='watchme')
+        assert s.wait_ready(), s.proxy.log
+        sock, head, _ = http_get(VPORT, path='/v1.ts?pw=nope')
+        sock.close()
+        assert b'401' in head, head
+
+
+@pytest.mark.integration
+class TestRawTcpViewer:
+    def test_raw_viewer_served_when_enabled(self, session):
+        s = session(raw_tcp=True)
+        assert s.wait_ready(), s.proxy.log
+        s.feed.start()
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        sock.settimeout(8)
+        sock.connect(('127.0.0.1', VPORT))
+        try:
+            data = read_for(sock, 6)      # says nothing; detected on silence
+        finally:
+            sock.close()
+        assert len(data) > 5000, 'raw viewer got %d bytes' % len(data)
+        assert data[0] == 0x47
+        assert data in s.feed.snapshot(), 'raw stream is not verbatim'
+
+    def test_raw_viewer_refused_when_flag_off(self, session):
+        s = session(raw_tcp=False)
+        assert s.wait_ready(), s.proxy.log
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        sock.settimeout(8)
+        sock.connect(('127.0.0.1', VPORT))
+        try:
+            data = read_for(sock, 5)
+        finally:
+            sock.close()
+        assert data == b'', 'raw viewer served with the flag off'
+        # wait for the line rather than reading the log straight away:
+        # the proxy's stdout is drained by a separate thread
+        assert s.proxy.wait_for(r'raw-TCP viewers not enabled'), s.proxy.log
+
+    def test_raw_viewer_refused_when_a_password_is_set(self, session):
+        """Raw TCP has nowhere to carry a credential, so it must not be
+        a way around the viewer password."""
+        s = session(raw_tcp=True, viewer_pass='watchme')
+        assert s.wait_ready(), s.proxy.log
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        sock.settimeout(8)
+        sock.connect(('127.0.0.1', VPORT))
+        try:
+            data = read_for(sock, 5)
+        finally:
+            sock.close()
+        assert data == b'', 'raw viewer bypassed the viewer password'
+        assert s.proxy.wait_for(r'cannot carry the viewer password'), \
+            s.proxy.log
+
+
+@pytest.mark.integration
+class TestSlowViewer:
+    def test_slow_viewer_dropped_without_disturbing_others(self, session):
+        """A viewer that never reads must be dropped, and must not cost
+        the other viewers a single byte.
+
+        The ring is shrunk so lapping is reachable without pushing tens
+        of megabytes through the test.
+        """
+        s = session(env={'SUPPORTPROXY_VIDEO_RING_BYTES': str(256 * 1024)})
+        assert s.wait_ready(), s.proxy.log
+
+        # A: connects, never reads.
+        slow, _, _ = http_get(VPORT)
+        # B: connects and reads continuously.
+        fast, _, fbody = http_get(VPORT)
+
+        got = bytearray(fbody)
+        stop = threading.Event()
+
+        def drain():
+            fast.settimeout(0.5)
+            while not stop.is_set():
+                try:
+                    c = fast.recv(65536)
+                except socket.timeout:
+                    continue
+                except OSError:
+                    break
+                if not c:
+                    break
+                got.extend(c)
+
+        t = threading.Thread(target=drain, daemon=True)
+        t.start()
+        try:
+            # push well past the ring so the idle viewer is lapped
+            deadline = time.time() + 30
+            while time.time() < deadline:
+                s.feed.burst(300)
+                if 'lapped' in s.proxy.log or 'chronically behind' in s.proxy.log:
+                    break
+            time.sleep(1.0)
+        finally:
+            stop.set()
+            t.join(timeout=5)
+            slow.close()
+            fast.close()
+
+        assert ('lapped' in s.proxy.log
+                or 'chronically behind' in s.proxy.log), \
+            'the idle viewer was never dropped:\n%s' % s.proxy.log[-3000:]
+
+        data = bytes(got)
+        assert len(data) > 50000, 'the healthy viewer got %d bytes' % len(data)
+        # the surviving viewer's stream must still be a contiguous,
+        # verbatim run -- no hole where the other viewer was dropped
+        sent = s.feed.snapshot()
+        assert data in sent, \
+            "the healthy viewer's stream has a gap or reordering"
+
+    def test_viewer_cap_is_enforced(self, session):
+        s = session()
+        assert s.wait_ready(), s.proxy.log
+        socks = []
+        try:
+            refused = None
+            for _ in range(40):
+                sk = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                sk.settimeout(5)
+                try:
+                    sk.connect(('127.0.0.1', VPORT))
+                except OSError:
+                    sk.close()
+                    break
+                sk.sendall(b'GET /v1.ts HTTP/1.1\r\nHost: x\r\n\r\n')
+                socks.append(sk)
+            time.sleep(1.5)
+            for sk in socks:
+                sk.settimeout(1.0)
+                try:
+                    head = sk.recv(256)
+                except (socket.timeout, OSError):
+                    continue
+                if b'503' in head and b'too many' in head.lower():
+                    refused = True
+                    break
+            assert refused, \
+                'no viewer was refused past the cap:\n%s' % s.proxy.log[-2000:]
+        finally:
+            for sk in socks:
+                sk.close()
+
+
+@pytest.mark.integration
+class TestViewerCpu:
+    def test_idle_viewer_does_not_busy_spin(self, session):
+        """A caught-up viewer on a quiet stream must cost no CPU.
+
+        EPOLLOUT armed permanently makes epoll_wait return immediately
+        for any writable socket. Measured before this was fixed: one
+        idle viewer burned a full core, which on a single-core VPS is
+        the whole machine.
+        """
+        s = session()
+        assert s.wait_ready(), s.proxy.log
+        vpid = s.proxy.video_pid()
+        assert vpid is not None, s.proxy.log
+
+        def ticks():
+            with open('/proc/%d/stat' % vpid) as f:
+                parts = f.read().split()
+            return int(parts[13]) + int(parts[14])   # utime + stime
+
+        sock, head, _ = http_get(VPORT)
+        assert b'200 OK' in head, head
+        try:
+            time.sleep(2)          # let it settle and catch up
+            t0 = ticks()
+            time.sleep(4)          # publisher is quiet throughout
+            t1 = ticks()
+        finally:
+            sock.close()
+
+        # 400 ticks would be a full core over 4s; anything above a small
+        # fraction of that means we are spinning rather than sleeping.
+        used = t1 - t0
+        assert used < 40, \
+            'idle viewer burned %d ticks in 4s (400 = one core)' % used
+
+
+def ws_connect(port, target, timeout=8.0):
+    """Minimal WebSocket client: handshake, then read binary frames."""
+    import base64
+    key = base64.b64encode(b'v' * 16).decode()
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.settimeout(timeout)
+    s.connect(('127.0.0.1', port))
+    s.sendall((
+        'GET %s HTTP/1.1\r\n'
+        'Host: localhost\r\n'
+        'Upgrade: websocket\r\n'
+        'Connection: Upgrade\r\n'
+        'Sec-WebSocket-Key: %s\r\n'
+        'Sec-WebSocket-Version: 13\r\n\r\n' % (target, key)).encode())
+    head = b''
+    try:
+        while b'\r\n\r\n' not in head:
+            c = s.recv(4096)
+            if not c:
+                break
+            head += c
+    except socket.timeout:
+        pass
+    sep = head.find(b'\r\n\r\n')
+    rest = head[sep + 4:] if sep >= 0 else b''
+    return s, head[:sep if sep >= 0 else len(head)], rest
+
+
+def ws_read_payload(sock, seconds, initial=b''):
+    """Read server->client frames and return the concatenated payload."""
+    buf = bytearray(initial)
+    out = bytearray()
+    deadline = time.time() + seconds
+    sock.settimeout(0.5)
+    while time.time() < deadline:
+        try:
+            c = sock.recv(65536)
+            if not c:
+                break
+            buf += c
+        except socket.timeout:
+            pass
+        # decode as many complete frames as we have
+        while len(buf) >= 2:
+            ln = buf[1] & 0x7F
+            pos = 2
+            if ln == 126:
+                if len(buf) < 4:
+                    break
+                ln = int.from_bytes(buf[2:4], 'big')
+                pos = 4
+            elif ln == 127:
+                if len(buf) < 10:
+                    break
+                ln = int.from_bytes(buf[2:10], 'big')
+                pos = 10
+            if (buf[1] & 0x80) != 0:
+                raise AssertionError('server masked a frame')
+            if len(buf) < pos + ln:
+                break
+            opcode = buf[0] & 0x0F
+            if opcode == 0x2:            # binary: stream data
+                out += buf[pos:pos + ln]
+            del buf[:pos + ln]
+    return bytes(out)
+
+
+def mint_token(workdir, port2, slot):
+    import sys as _sys
+    if _REPO_ROOT not in _sys.path:
+        _sys.path.insert(0, _REPO_ROOT)
+    from webadmin import videotoken
+    db = keydb_lib.open_db(str(workdir / 'keys.tdb'))
+    db.transaction_start()
+    try:
+        ke = keydb_lib.KeyEntry(port2)
+        assert ke.fetch(db)
+        return videotoken.mint(ke.secret_key, port2, slot)
+    finally:
+        db.transaction_cancel()
+        db.close()
+
+
+@pytest.mark.integration
+class TestWebSocketViewer:
+    def test_ws_viewer_receives_the_stream(self, session):
+        s = session()
+        assert s.wait_ready(), s.proxy.log
+        s.feed.start()
+        tok = mint_token(s.workdir, PORT_ENG, 0)
+        sock, head, rest = ws_connect(VPORT, '/v1?t=%s' % tok)
+        try:
+            assert b'101' in head, head
+            data = ws_read_payload(sock, 5, rest)
+        finally:
+            sock.close()
+        assert len(data) > 10000, 'ws viewer got %d bytes' % len(data)
+        assert data[0] == 0x47, 'ws payload does not start at a TS packet'
+        assert data in s.feed.snapshot(), \
+            'ws payload is not a verbatim span of what was published'
+
+    def test_ws_requires_a_credential_when_a_password_is_set(self, session):
+        s = session(viewer_pass='watchme')
+        assert s.wait_ready(), s.proxy.log
+        sock, head, _ = ws_connect(VPORT, '/v1')
+        sock.close()
+        assert b'101' not in head, \
+            'websocket upgraded without a credential: %r' % head
+        assert b'401' in head, head
+
+    def test_ws_accepts_a_valid_token(self, session):
+        s = session(viewer_pass='watchme')
+        assert s.wait_ready(), s.proxy.log
+        tok = mint_token(s.workdir, PORT_ENG, 0)
+        sock, head, _ = ws_connect(VPORT, '/v1?t=%s' % tok)
+        sock.close()
+        assert b'101' in head, head
+
+    def test_ws_rejects_a_tampered_token(self, session):
+        s = session(viewer_pass='watchme')
+        assert s.wait_ready(), s.proxy.log
+        tok = mint_token(s.workdir, PORT_ENG, 0)
+        bad = tok[:-1] + ('0' if tok[-1] != '0' else '1')
+        sock, head, _ = ws_connect(VPORT, '/v1?t=%s' % bad)
+        sock.close()
+        assert b'101' not in head, 'tampered token was accepted'
+
+    def test_ws_accepts_the_viewer_password_too(self, session):
+        s = session(viewer_pass='watchme')
+        assert s.wait_ready(), s.proxy.log
+        sock, head, _ = ws_connect(VPORT, '/v1?pw=watchme')
+        sock.close()
+        assert b'101' in head, head
+
+
+def _make_cert(workdir):
+    """Self-signed cert the proxy picks up from its cwd for TLS."""
+    subprocess.run([
+        'openssl', 'req', '-x509', '-newkey', 'rsa:2048', '-nodes',
+        '-keyout', 'privkey.pem', '-out', 'fullchain.pem',
+        '-days', '2', '-subj', '/CN=localhost',
+    ], cwd=str(workdir), check=True, capture_output=True)
+
+
+@pytest.mark.integration
+class TestSecureWebSocketViewer:
+    def test_wss_viewer_receives_the_stream(self, tmp_path):
+        """A browser on an HTTPS admin page can only open wss://, so the
+        TLS path has to work, not just ws://."""
+        import ssl
+        wd = _workdir(tmp_path)
+        _make_cert(wd)
+        s = Session(wd)
+        try:
+            assert s.wait_ready(), s.proxy.log
+            s.feed.start()
+            tok = mint_token(wd, PORT_ENG, 0)
+
+            ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+            ctx.check_hostname = False
+            ctx.verify_mode = ssl.CERT_NONE
+            raw = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            raw.settimeout(10)
+            raw.connect(('127.0.0.1', VPORT))
+            sock = ctx.wrap_socket(raw, server_hostname='localhost')
+            try:
+                import base64
+                key = base64.b64encode(b'w' * 16).decode()
+                sock.sendall((
+                    'GET /v1?t=%s HTTP/1.1\r\n'
+                    'Host: localhost\r\n'
+                    'Upgrade: websocket\r\n'
+                    'Connection: Upgrade\r\n'
+                    'Sec-WebSocket-Key: %s\r\n'
+                    'Sec-WebSocket-Version: 13\r\n\r\n' % (tok, key)).encode())
+                head = b''
+                deadline = time.time() + 8
+                while b'\r\n\r\n' not in head and time.time() < deadline:
+                    try:
+                        c = sock.recv(4096)
+                    except (socket.timeout, ssl.SSLWantReadError):
+                        continue
+                    if not c:
+                        break
+                    head += c
+                assert b'101' in head, head
+                sep = head.find(b'\r\n\r\n')
+                data = ws_read_payload(sock, 5, head[sep + 4:])
+            except Exception:
+                raise AssertionError('wss failed; proxy log:\n%s' % s.proxy.log)
+            finally:
+                sock.close()
+            assert len(data) > 5000, \
+                'wss viewer got %d bytes; proxy log:\n%s' % (len(data),
+                                                             s.proxy.log)
+            assert data[0] == 0x47
+            assert data in s.feed.snapshot(), 'wss payload not verbatim'
+        finally:
+            s.stop()
+
+
+@pytest.mark.integration
+class TestFragmentedRequest:
+    def test_http_request_split_across_packets(self, session):
+        """A viewer request may arrive in pieces; the parser has to
+        wait for the rest rather than give up or re-classify."""
+        s = session()
+        assert s.wait_ready(), s.proxy.log
+        s.feed.start()
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        sock.settimeout(8)
+        sock.connect(('127.0.0.1', VPORT))
+        try:
+            req = b'GET /v1.ts HTTP/1.1\r\nHost: localhost\r\n\r\n'
+            for i in range(0, len(req), 7):     # dribble it out
+                sock.sendall(req[i:i + 7])
+                time.sleep(0.05)
+            head = b''
+            deadline = time.time() + 6
+            while b'\r\n\r\n' not in head and time.time() < deadline:
+                try:
+                    c = sock.recv(4096)
+                except socket.timeout:
+                    continue
+                if not c:
+                    break
+                head += c
+            assert b'200 OK' in head, \
+                'fragmented request not served: %r\n%s' % (head[:200],
+                                                           s.proxy.log)
+        finally:
+            sock.close()
+
+
+@pytest.mark.integration
+class TestPublisherRestart:
+    """Killing and restarting the publisher.
+
+    Reported from a real session: the browser showed a gap and then
+    never resumed. A new publisher is a new stream -- PSI, continuity
+    counters and PTS all restart -- so appending its bytes to what a
+    viewer has already been given makes time jump backwards, and a
+    Media Source player stalls permanently rather than recovering. The
+    stream has to be *ended* so the client reconnects and rejoins.
+    """
+
+    def test_viewer_is_ended_when_the_publisher_goes(self, session):
+        s = session()
+        assert s.wait_ready(), s.proxy.log
+        sock, head, body = http_get(VPORT)
+        assert b'200' in head, head
+        assert read_for(sock, 1.5, body), 'viewer got no bytes at all'
+
+        s.feed.stop()
+        # The slot releases after VIDEO_PUB_IDLE_S (10s); allow the tick.
+        assert s.proxy.wait_for(r'publisher idle, releasing', timeout=25), \
+            s.proxy.log
+
+        # A clean end of stream: recv returns b'' rather than hanging or
+        # silently continuing into the next publisher's bytes.
+        sock.settimeout(10)
+        deadline = time.time() + 10
+        closed = False
+        while time.time() < deadline:
+            try:
+                if sock.recv(65536) == b'':
+                    closed = True
+                    break
+            except socket.timeout:
+                break
+            except OSError:
+                closed = True
+                break
+        sock.close()
+        assert closed, 'viewer was left attached to a stream that ended'
+
+    def test_the_reason_is_logged(self, session):
+        s = session()
+        assert s.wait_ready(), s.proxy.log
+        sock, head, body = http_get(VPORT)
+        read_for(sock, 1.0, body)
+        s.feed.stop()
+        assert s.proxy.wait_for(r'publisher gone', timeout=25), s.proxy.log
+        sock.close()
+
+    def test_a_new_viewer_can_join_the_restarted_stream(self, session):
+        """The point of the whole thing: after a restart, watching
+        works again."""
+        s = session()
+        assert s.wait_ready(), s.proxy.log
+        first, head, body = http_get(VPORT)
+        read_for(first, 1.0, body)
+
+        s.feed.stop()
+        assert s.proxy.wait_for(r'publisher idle, releasing', timeout=25), \
+            s.proxy.log
+        first.close()
+
+        # Restart the publisher exactly as a user re-running the tool
+        # would: a fresh socket, a fresh stream.
+        s.feed = Feed(VPORT)
+        assert s.wait_ready(), s.proxy.log
+        second, head2, body2 = http_get(VPORT)
+        assert b'200' in head2, head2
+        got = read_for(second, 3.0, body2)
+        second.close()
+        assert got, 'no bytes from the restarted stream'
+        assert got[0] == 0x47, 'restarted stream did not begin on a TS packet'
+
+    def test_restarted_stream_is_not_spliced_onto_the_old_one(self, session):
+        """The ring restarts with the stream, so a viewer joining after
+        a restart must not be served bytes from before it."""
+        s = session()
+        assert s.wait_ready(), s.proxy.log
+        before = s.feed.snapshot()
+        assert before
+
+        s.feed.stop()
+        assert s.proxy.wait_for(r'publisher idle, releasing', timeout=25), \
+            s.proxy.log
+
+        s.feed = Feed(VPORT)
+        assert s.wait_ready(), s.proxy.log
+        sock, head, body = http_get(VPORT)
+        got = read_for(sock, 3.0, body)
+        sock.close()
+        assert got
+        # Everything served must come from the new publisher's bytes.
+        new_bytes = s.feed.snapshot()
+        assert got in new_bytes, \
+            'served bytes are not a span of the restarted stream'
diff --git a/tests/tsgen.py b/tests/tsgen.py
new file mode 100644
index 0000000..46eb9ce
--- /dev/null
+++ b/tests/tsgen.py
@@ -0,0 +1,176 @@
+"""Synthetic MPEG-TS generator for the video tests.
+
+Nothing in SupportProxy decodes video -- the scanner only reads PSI and
+adaptation fields -- so a generator with filler payload is enough for
+every scanner and fan-out assertion, and it gives byte-exact control
+over where the join anchors are. That is worth more than a recorded
+sample here: with a real file you cannot say "put a keyframe exactly
+here" and then assert a viewer started exactly there.
+
+Real-codec checks (does the recording actually decode?) use a real
+fixture instead; see the phase 3 tests.
+"""
+import struct
+
+PACKET_SIZE = 188
+SYNC = 0x47
+
+PAT_PID = 0x0000
+DEFAULT_PMT_PID = 0x1000
+DEFAULT_VIDEO_PID = 0x0100
+
+STREAM_H264 = 0x1B
+STREAM_HEVC = 0x24
+
+# A datagram of 7 packets is what every MPEG-TS/UDP sender produces.
+PACKETS_PER_DATAGRAM = 7
+DATAGRAM_SIZE = PACKET_SIZE * PACKETS_PER_DATAGRAM
+
+
+def crc32_mpeg(data):
+    """MPEG-2 section CRC: poly 0x04C11DB7, MSB-first, init 0xFFFFFFFF."""
+    crc = 0xFFFFFFFF
+    for b in data:
+        crc ^= b << 24
+        for _ in range(8):
+            crc = ((crc << 1) ^ 0x04C11DB7) & 0xFFFFFFFF if crc & 0x80000000 \
+                else (crc << 1) & 0xFFFFFFFF
+    return crc
+
+
+class TSGen:
+    def __init__(self, pmt_pid=DEFAULT_PMT_PID, video_pid=DEFAULT_VIDEO_PID,
+                 stream_type=STREAM_H264):
+        self.pmt_pid = pmt_pid
+        self.video_pid = video_pid
+        self.stream_type = stream_type
+        self._cc = {}
+
+    def _next_cc(self, pid):
+        c = self._cc.get(pid, 0)
+        self._cc[pid] = (c + 1) & 0x0F
+        return c
+
+    def _packet(self, pid, payload, pusi=False, rai=False):
+        """One 188-byte packet. Payload is padded with an adaptation
+        field so it always lands at the end of the packet."""
+        assert len(payload) <= PACKET_SIZE - 4
+        hdr = bytearray(4)
+        hdr[0] = SYNC
+        hdr[1] = ((0x40 if pusi else 0) | ((pid >> 8) & 0x1F))
+        hdr[2] = pid & 0xFF
+        cc = self._next_cc(pid)
+
+        stuff = PACKET_SIZE - 4 - len(payload)
+        if rai or stuff > 0:
+            # adaptation field present, plus payload
+            hdr[3] = 0x30 | cc
+            af_len = stuff - 1
+            if af_len < 0:
+                raise ValueError('payload too long for an adaptation field')
+            af = bytearray([af_len])
+            if af_len > 0:
+                af.append(0x40 if rai else 0x00)     # flags
+                af.extend(b'\xff' * (af_len - 1))
+            return bytes(hdr) + bytes(af) + bytes(payload)
+        hdr[3] = 0x10 | cc
+        return bytes(hdr) + bytes(payload)
+
+    def _section_packet(self, pid, section):
+        """Wrap a complete PSI section in a single packet.
+
+        PSI packets are padded with trailing 0xFF after the section, not
+        with an adaptation field -- that is what real muxers emit, and a
+        fixture that used an adaptation field here would be testing a
+        packet layout nothing actually sends.
+        """
+        payload = b'\x00' + section            # pointer_field
+        payload += b'\xff' * (PACKET_SIZE - 4 - len(payload))
+        hdr = bytearray(4)
+        hdr[0] = SYNC
+        hdr[1] = 0x40 | ((pid >> 8) & 0x1F)    # PUSI
+        hdr[2] = pid & 0xFF
+        hdr[3] = 0x10 | self._next_cc(pid)     # payload only, no AF
+        return bytes(hdr) + payload
+
+    def pat(self, version=0):
+        body = bytearray()
+        body += b'\x00'                                    # table_id
+        body += b'\x00\x00'                                # length, patched
+        body += b'\x00\x01'                                # ts id
+        body += bytes([0xC1 | (version << 1)])
+        body += b'\x00\x00'                                # section numbers
+        body += b'\x00\x01'                                # program 1
+        body += bytes([0xE0 | ((self.pmt_pid >> 8) & 0x1F),
+                       self.pmt_pid & 0xFF])
+        return self._section_packet(PAT_PID, self._finish(body))
+
+    def pmt(self, version=0, extra_streams=()):
+        body = bytearray()
+        body += b'\x02'
+        body += b'\x00\x00'
+        body += b'\x00\x01'
+        body += bytes([0xC1 | (version << 1)])
+        body += b'\x00\x00'
+        body += bytes([0xE0 | ((self.video_pid >> 8) & 0x1F),
+                       self.video_pid & 0xFF])              # PCR PID
+        body += b'\xF0\x00'                                 # program_info_len
+        body += bytes([self.stream_type,
+                       0xE0 | ((self.video_pid >> 8) & 0x1F),
+                       self.video_pid & 0xFF,
+                       0xF0, 0x00])
+        for stype, pid in extra_streams:
+            body += bytes([stype, 0xE0 | ((pid >> 8) & 0x1F), pid & 0xFF,
+                           0xF0, 0x00])
+        return self._section_packet(self.pmt_pid, self._finish(body))
+
+    @staticmethod
+    def _finish(body):
+        """Patch section_length and append the CRC."""
+        section_length = len(body) - 3 + 4
+        body[1] = 0xB0 | ((section_length >> 8) & 0x0F)
+        body[2] = section_length & 0xFF
+        return bytes(body) + struct.pack('>I', crc32_mpeg(bytes(body)))
+
+    def video(self, key=False, size=160):
+        """One video packet. `key` sets both a keyframe payload and the
+        adaptation field's random_access_indicator."""
+        pes = bytearray()
+        pes += b'\x00\x00\x01\xe0'          # PES start, video stream id
+        pes += b'\x00\x00'                  # unbounded length
+        pes += b'\x80\x00\x00'              # flags, no PTS
+        if self.stream_type == STREAM_HEVC:
+            # HEVC NAL header is 2 bytes, type is bits 6..1
+            pes += b'\x00\x00\x01' + bytes([(35 if key else 1) << 1, 0x01])
+        else:
+            pes += b'\x00\x00\x01' + bytes([0x09 if key else 0x41])
+        pes += b'\x10'
+        pes += b'\xAA' * max(0, size - len(pes))
+        return self._packet(self.video_pid, bytes(pes[:size]),
+                            pusi=True, rai=key)
+
+    def stream(self, packets, gop=10, psi_every=20):
+        """A run of `packets` video packets with PSI interleaved.
+
+        Returns the whole stream as bytes. Every `gop`-th video packet
+        is a keyframe, and PAT+PMT are emitted every `psi_every`
+        packets, mirroring what real muxers do.
+        """
+        out = bytearray()
+        for i in range(packets):
+            if i % psi_every == 0:
+                out += self.pat()
+                out += self.pmt()
+            out += self.video(key=(i % gop == 0))
+        return bytes(out)
+
+    def datagrams(self, data):
+        """Split a stream into 1316-byte datagrams, as udpsink would.
+
+        Any trailing partial datagram is dropped rather than sent short:
+        a real sender emits whole 7-packet groups, and the ingest path
+        rejects anything that is not a multiple of 188 anyway.
+        """
+        n = len(data) // DATAGRAM_SIZE
+        return [data[i * DATAGRAM_SIZE:(i + 1) * DATAGRAM_SIZE]
+                for i in range(n)]
diff --git a/video.cpp b/video.cpp
new file mode 100644
index 0000000..cb09a28
--- /dev/null
+++ b/video.cpp
@@ -0,0 +1,1583 @@
+/*
+  The per-entry video child. See video.h for why it is independent of
+  the MAVLink session.
+
+  Phase 1 scope: process lifecycle, port binding, publisher admission
+  and connections.tdb rows. There is no media path yet -- accepted
+  bytes are counted and discarded -- so the process-model risk lands
+  and can be tested on its own.
+ */
+#include "video.h"
+
+#include <initializer_list>
+#include <memory>
+#include <vector>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <arpa/inet.h>
+#include <netinet/in.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/epoll.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+#include "conntdb.h"
+#include "util.h"
+#include "videoauth.h"
+#include "videostream.h"
+#include "videorec.h"
+#include "videots.h"
+#include "videortmp.h"
+#include "videortsp.h"
+#include "videoview.h"
+
+#define VIDEO_MAX_EPOLL_EVENTS 64
+
+// A publisher that goes quiet for this long releases its slot, so a
+// replacement can take over after a genuine disconnect.
+#define VIDEO_PUB_IDLE_S 10
+
+/*
+  Viewer table entries one source address may hold. Publishers are
+  classified from a viewer slot, so without a cap a flood from one host
+  fills the table and denies publishing outright. An operator watching
+  three slots with a reconnect in flight needs a handful.
+ */
+#define VIDEO_MAX_VIEWERS_PER_IP 8
+
+/*
+  Concurrent RTMP handshakes per slot. More than one so a squatter
+  cannot lock the camera out, few enough that the parser work an
+  unauthenticated peer can start is bounded.
+ */
+#define VIDEO_MAX_PENDING_RTMP 4
+
+// How often the child re-reads its own keys.tdb record and re-writes
+// its connections.tdb rows. Matches the MAVLink child's cadence.
+#define VIDEO_TICK_S 5
+
+// Rate limit for "rejected" logging, so a flood of unauthorised packets
+// can't turn into a flood of stdout writes (which would block the child
+// once the pipe fills).
+#define VIDEO_LOG_MIN_INTERVAL_S 1
+
+bool video_entry_wants_child(uint32_t flags, const uint32_t *video_ports)
+{
+    if ((flags & KEY_FLAG_VIDEO) == 0) {
+        return false;
+    }
+    for (int i = 0; i < KEY_MAX_VIDEO_PORTS; i++) {
+        if (video_ports[i] != 0) {
+            return true;
+        }
+    }
+    return false;
+}
+
+namespace {
+
+/*
+  One direction of the splice.
+
+  The relay used to retry a short write by sleeping inside the event
+  loop. That loop is the only thread: it also drains ffmpeg's stdout, so
+  sleeping there deadlocks -- the publisher fills the socket to ffmpeg,
+  we stop servicing epoll, ffmpeg's stdout pipe fills, ffmpeg stops
+  reading its input, and the socket never drains. A paced publisher
+  (ffmpeg -re, as the tests use) never triggers it; a real camera bursts.
+ */
+struct SpliceQueue {
+    std::vector<uint8_t> buf;
+    size_t sent = 0;
+    bool armed = false;          // EPOLLOUT currently armed on the sink
+
+    size_t pending(void) const { return buf.size() - sent; }
+    void clear(void) { buf.clear(); sent = 0; armed = false; }
+    void compact(void)
+    {
+        if (sent == buf.size()) {
+            buf.clear();
+            sent = 0;
+        } else if (sent > 65536) {
+            buf.erase(buf.begin(), buf.begin() + long(sent));
+            sent = 0;
+        }
+    }
+};
+
+// Stop reading a direction once this much is already queued for it, so
+// the backlog is bounded and TCP applies the backpressure upstream
+// instead of this process buffering without limit.
+#define SPLICE_QUEUE_MAX (1u * 1024 * 1024)
+
+/*
+  One RTMP handshake that has not published yet.
+
+  It owns nothing but its socket: no slot, no backend, no ring. Only
+  when publish arrives and passes admission is one of these promoted.
+ */
+struct PendingRtmp {
+    int fd = -1;
+    std::unique_ptr<RtmpSession> sess;
+    SpliceQueue out;            // responses owed to this peer
+    time_t since = 0;
+    uint32_t ip_be = 0;
+    uint16_t port_be = 0;
+
+    bool active(void) const { return fd >= 0; }
+};
+
+struct Slot {
+    uint32_t port = 0;
+    int udp_fd = -1;
+    int tcp_fd = -1;
+
+    // current publisher, if any
+    bool has_pub = false;
+    uint32_t pub_ip_be = 0;
+    uint16_t pub_port_be = 0;
+    time_t pub_since = 0;
+    time_t pub_last = 0;
+    uint64_t pub_bytes = 0;
+
+    // rate-limited rejection logging
+    time_t last_reject_log = 0;
+    uint32_t rejects = 0;
+
+    // RTSP or RTMP publisher, while one holds the slot
+    RtspBackend rtsp;
+    int rtsp_client_fd = -1;
+    SpliceQueue to_backend;   // bytes read from the client, owed to ffmpeg
+    SpliceQueue to_client;    // and the other way
+    /*
+      The RTMP session that owns the slot, once one has published and
+      been admitted. Null until then.
+     */
+    std::unique_ptr<RtmpSession> rtmp;
+
+    /*
+      Handshakes in progress. These deliberately do NOT hold the slot.
+
+      Classification costs one byte, so if a pending handshake owned the
+      slot an unauthenticated peer could take it, wait out its deadline
+      and reconnect, denying publishing indefinitely -- and letting a
+      newcomer evict the incumbent only turns that into last-arrival
+      wins, which is the same denial. Several negotiate side by side
+      instead, and the slot is awarded on publish, after admission.
+     */
+    PendingRtmp pending[VIDEO_MAX_PENDING_RTMP];
+
+    // media
+    VideoRing ring;
+    TSScanner scanner;
+    VideoWriter rec;
+    VideoViewer viewers[VIDEO_MAX_VIEWERS];
+    bool viewer_out_armed[VIDEO_MAX_VIEWERS] {};
+    uint32_t viewers_seen = 0;
+    uint32_t viewers_dropped = 0;
+    bool recording = false;
+    uint64_t last_anchor = 0;
+    bool had_anchor = false;
+    uint64_t bad_datagrams = 0;
+    bool warned_204 = false;
+};
+
+class VideoChild {
+public:
+    VideoChild(int port2, int ready_fd) :
+        port2_(port2), ready_fd_(ready_fd), auth_(port2) {}
+
+    void run(void) __attribute__((noreturn));
+
+private:
+    int port2_;
+    int ready_fd_;
+    VideoAuth auth_;
+    struct KeyEntry ke_ {};
+    Slot slots_[KEY_MAX_VIDEO_PORTS];
+    int epfd_ = -1;
+    time_t last_tick_ = 0;
+
+    bool load_entry(void);
+    int bind_slots(void);
+    void signal_ready(int err);
+    void handle_udp(Slot &s, int idx);
+    void handle_tcp(Slot &s, int idx);
+    void tick(time_t now);
+    void write_conn_rows(time_t now);
+    void log_reject(Slot &s, int idx, uint32_t ip_be, video_admit_t r,
+                    time_t now);
+    void ingest(Slot &s, int idx, const uint8_t *buf, size_t n);
+    void ingest_stream(Slot &s, int idx, const uint8_t *buf, size_t n);
+    void handle_rtsp(Slot &s, int idx, int fd,
+                     struct sockaddr_in &from, time_t now,
+                     splice_proto_t proto);
+    void close_rtsp(Slot &s, int idx, const char *why);
+    bool pump_rtsp(Slot &s, int idx, int fd, time_t now);
+    bool pump_rtmp(Slot &s, int idx, int fd, time_t now);
+    bool rtmp_start_backend(Slot &s, int idx);
+    bool rtmp_drain_owner(Slot &s, int idx, bool alive);
+    void close_pending(Slot &s, int idx, PendingRtmp &p, const char *why);
+    bool pump_pending(Slot &s, int idx, PendingRtmp &p, time_t now);
+    bool promote_pending(Slot &s, int idx, PendingRtmp &p, time_t now);
+    void latch_publisher(Slot &s, int idx, time_t now);
+    bool splice_flush(int to_fd, SpliceQueue &q);
+    void splice_arm(int to_fd, SpliceQueue &q);
+    void epoll_add_viewer(VideoViewer &v);
+    void epoll_sync_viewer(VideoViewer &v, bool &armed);
+    void drop_viewer(Slot &s, int idx, VideoViewer &v);
+    void end_stream(Slot &s, int idx, const char *why);
+    void pump_viewers(Slot &s, int idx, time_t now);
+};
+
+bool VideoChild::load_entry(void)
+{
+    auto *db = db_open();
+    if (db == nullptr) {
+        return false;
+    }
+    struct KeyEntry k {};
+    bool ok = db_load_key(db, port2_, k);
+    db_close(db);
+    if (ok) {
+        ke_ = k;
+    }
+    return ok;
+}
+
+void VideoChild::signal_ready(int err)
+{
+    if (ready_fd_ < 0) {
+        return;
+    }
+    uint8_t b = uint8_t(err > 255 ? 255 : err);
+    ssize_t n = ::write(ready_fd_, &b, 1);
+    (void)n;
+    close(ready_fd_);
+    ready_fd_ = -1;
+}
+
+int VideoChild::bind_slots(void)
+{
+    int first_err = 0;
+    for (int i = 0; i < KEY_MAX_VIDEO_PORTS; i++) {
+        const uint32_t port = ke_.video_ports[i];
+        if (port == 0) {
+            continue;
+        }
+        slots_[i].port = port;
+        slots_[i].udp_fd = open_socket_in_udp(int(port));
+        if (slots_[i].udp_fd == -1 && first_err == 0) {
+            first_err = errno ? errno : EADDRINUSE;
+        }
+        slots_[i].tcp_fd = open_socket_in_tcp(int(port));
+        if (slots_[i].tcp_fd == -1 && first_err == 0) {
+            first_err = errno ? errno : EADDRINUSE;
+        }
+        if (slots_[i].udp_fd != -1 || slots_[i].tcp_fd != -1) {
+            printf("[%d] video slot %d listening on %u%s\n",
+                   port2_, i, unsigned(port),
+                   (slots_[i].udp_fd == -1 || slots_[i].tcp_fd == -1)
+                   ? " (partially)" : "");
+        } else {
+            printf("[%d] video slot %d failed to bind %u - %s\n",
+                   port2_, i, unsigned(port), strerror(errno));
+        }
+    }
+    return first_err;
+}
+
+void VideoChild::log_reject(Slot &s, int idx, uint32_t ip_be,
+                            video_admit_t r, time_t now)
+{
+    s.rejects++;
+    if (now - s.last_reject_log < VIDEO_LOG_MIN_INTERVAL_S) {
+        return;
+    }
+    s.last_reject_log = now;
+    struct in_addr a {};
+    a.s_addr = ip_be;
+    printf("[%d] video slot %d rejected %s: %s (%u so far)\n",
+           port2_, idx, inet_ntoa(a), video_admit_str(r), unsigned(s.rejects));
+}
+
+/*
+  Accept one datagram's worth of publisher bytes.
+
+  A datagram must be a whole number of 188-byte TS packets starting with
+  the sync byte -- that is what every MPEG-TS/UDP sender produces (7
+  packets, 1316 bytes, is the norm). Anything else is dropped and
+  counted rather than fed to the scanner, so a misconfigured sender
+  shows up as a clear count instead of a stream that half works.
+ */
+void VideoChild::ingest(Slot &s, int idx, const uint8_t *buf, size_t n)
+{
+    if (n < TS_PACKET_SIZE || buf[0] != TS_SYNC_BYTE
+        || (n % TS_PACKET_SIZE) != 0
+        || (n > TS_PACKET_SIZE && buf[TS_PACKET_SIZE] != TS_SYNC_BYTE)) {
+        // 204-byte packets are DVB's TS-with-Reed-Solomon. Feeding them
+        // to a 188-byte parser produces nonsense, so say so once.
+        if (!s.warned_204 && (n % 204) == 0 && n >= 204
+            && buf[0] == TS_SYNC_BYTE) {
+            s.warned_204 = true;
+            printf("[%d] video slot %d: 204-byte (DVB) packets are not "
+                   "supported; send 188-byte MPEG-TS\n", port2_, idx);
+        }
+        s.bad_datagrams++;
+        return;
+    }
+    s.pub_bytes += n;
+    // Scanner first: it needs the offset this data will occupy, and the
+    // ring write is what makes that offset meaningful.
+    const uint64_t before = s.ring.write_pos();
+    s.scanner.feed(buf, n, before);
+    s.ring.write(buf, n);
+
+    if (!s.recording || s.rec.stopped()) {
+        return;
+    }
+    const time_t now = time(nullptr);
+
+    /*
+      Cut segments at a join boundary so every segment is playable from
+      its first byte. The anchor only moves when a new random access
+      point arrives, so "the anchor advanced into this datagram" is the
+      signal that we are standing on one.
+
+      A stream whose muxer never signals one must still rotate, hence
+      the overshoot fallback -- otherwise the segment grows forever and
+      the quota pass can never evict it.
+     */
+    if (s.rec.rotation_due(now)) {
+        uint64_t anchor = 0;
+        const bool have = s.scanner.join_offset(anchor);
+        const bool at_boundary = have && s.had_anchor && anchor > s.last_anchor
+            && anchor >= before;
+        if (at_boundary || s.rec.rotation_overdue(now)) {
+            s.rec.rotate(now, at_boundary);
+        }
+    }
+    uint64_t anchor_now = 0;
+    if (s.scanner.join_offset(anchor_now)) {
+        s.last_anchor = anchor_now;
+        s.had_anchor = true;
+    }
+    s.rec.write(buf, n, now);
+}
+
+/*
+  Byte-stream ingest, for a source that is not datagram-framed (the
+  RTSP backend's stdout). The 188-alignment rule that guards the UDP
+  path does not apply -- packets straddle reads by nature -- and the
+  scanner and ring already carry partial packets across calls.
+ */
+void VideoChild::ingest_stream(Slot &s, int idx, const uint8_t *buf, size_t n)
+{
+    s.pub_bytes += n;
+    const uint64_t before = s.ring.write_pos();
+    s.scanner.feed(buf, n, before);
+    s.ring.write(buf, n);
+
+    if (!s.recording || s.rec.stopped()) {
+        return;
+    }
+    const time_t now = time(nullptr);
+    if (s.rec.rotation_due(now)) {
+        uint64_t anchor = 0;
+        const bool have = s.scanner.join_offset(anchor);
+        const bool at_boundary = have && s.had_anchor && anchor > s.last_anchor
+            && anchor >= before;
+        if (at_boundary || s.rec.rotation_overdue(now)) {
+            s.rec.rotate(now, at_boundary);
+        }
+    }
+    uint64_t anchor_now = 0;
+    if (s.scanner.join_offset(anchor_now)) {
+        s.last_anchor = anchor_now;
+        s.had_anchor = true;
+    }
+    s.rec.write(buf, n, now);
+    (void)idx;
+}
+
+void VideoChild::handle_udp(Slot &s, int idx)
+{
+    uint8_t buf[2048];
+    struct sockaddr_in from {};
+    socklen_t fromlen = sizeof(from);
+    ssize_t n = recvfrom(s.udp_fd, buf, sizeof(buf), 0,
+                         (struct sockaddr *)&from, &fromlen);
+    if (n <= 0) {
+        return;
+    }
+    const time_t now = time(nullptr);
+
+    // A datagram from the established publisher needs no re-check: the
+    // admission decision was made when the tuple latched.
+    if (s.has_pub && s.pub_ip_be == uint32_t(from.sin_addr.s_addr)
+        && s.pub_port_be == from.sin_port) {
+        s.pub_last = now;
+        ingest(s, idx, buf, size_t(n));
+        return;
+    }
+
+    // Plain MPEG-TS over UDP carries no credential, so path A can't
+    // apply here; admit() falls through to the MAVLink-session check
+    // unless a publish password is set, in which case UDP can't satisfy
+    // it and the datagram is refused.
+    video_admit_t r = auth_.admit(ke_, uint32_t(from.sin_addr.s_addr),
+                                  nullptr, now);
+    if (r != VIDEO_ADMIT_OK) {
+        log_reject(s, idx, uint32_t(from.sin_addr.s_addr), r, now);
+        return;
+    }
+    if ((s.has_pub && now - s.pub_last <= VIDEO_PUB_IDLE_S)
+        || s.rtsp.running() || s.rtsp_client_fd >= 0) {
+        // One publisher at a time: a second sender behind the same NAT
+        // must not be able to interleave into the stream. This is not
+        // an authorisation failure -- the sender may be perfectly
+        // entitled to publish -- so it gets its own reason rather than
+        // borrowing one that would send an operator hunting an address
+        // mismatch that isn't there.
+        //
+        // The connection tests are part of it, not just has_pub: a
+        // spliced or RTMP publisher owns the slot for as long as its
+        // connection lives, and testing has_pub alone let a UDP sender
+        // latch on top of a live one and mix two streams into one ring.
+        // rtsp_client_fd covers an RTMP handshake still in progress,
+        // which has no backend and no latched publisher yet.
+        log_reject(s, idx, uint32_t(from.sin_addr.s_addr),
+                   VIDEO_ADMIT_SLOT_BUSY, now);
+        return;
+    }
+    s.has_pub = true;
+    s.pub_ip_be = uint32_t(from.sin_addr.s_addr);
+    s.pub_port_be = from.sin_port;
+    s.pub_since = now;
+    s.pub_last = now;
+    s.pub_bytes = 0;
+    s.ring.init(video_ring_bytes());
+    s.scanner = TSScanner();
+    s.had_anchor = false;
+    s.recording = (video_slot_opts(ke_.video_flags, unsigned(idx))
+                   & VIDEO_SLOT_RECORD) != 0;
+    if (s.recording) {
+        s.rec.configure(uint32_t(port2_), idx,
+                        (ke_.flags & KEY_FLAG_USE_TZ) != 0,
+                        ke_.tz_offset_hours, "logs", ke_.video_quota_mb);
+    }
+    printf("[%d] video slot %d publisher %s\n",
+           port2_, idx, addr_to_str(from));
+    ingest(s, idx, buf, size_t(n));
+    last_tick_ = 0;   // snapshot connections.tdb promptly
+}
+
+void VideoChild::handle_tcp(Slot &s, int idx)
+{
+    struct sockaddr_in from {};
+    socklen_t fromlen = sizeof(from);
+    int fd = accept(s.tcp_fd, (struct sockaddr *)&from, &fromlen);
+    if (fd == -1) {
+        return;
+    }
+    const time_t now = time(nullptr);
+
+    /*
+      A TCP connection here is a viewer. Viewers are not publishers and
+      are not subject to the publisher admission check: they present a
+      viewer password (or the slot is open), and in either case they can
+      only ever reach a stream that an authorised publisher is feeding.
+     */
+    /*
+      A publisher arrives through this table too -- RTSP and RTMP are
+      only recognised once bytes arrive, so the connection has to be
+      held somewhere first. That means a flood of connections can fill
+      the table and stop a publisher from even being classified.
+
+      Cap how many one address may hold. It cannot be a reserve for
+      "probable publishers": a publisher is indistinguishable at accept
+      time, since the credential it might carry arrives later. A per
+      address cap needs none of that, and one host can no longer take
+      the table on its own.
+     */
+    int free_slot = -1;
+    int from_this_ip = 0;
+    for (int v = 0; v < VIDEO_MAX_VIEWERS; v++) {
+        if (s.viewers[v].active()
+            && s.viewers[v].peer_ip_be() == uint32_t(from.sin_addr.s_addr)) {
+            from_this_ip++;
+        }
+    }
+    if (from_this_ip < VIDEO_MAX_VIEWERS_PER_IP) {
+        for (int v = 0; v < VIDEO_MAX_VIEWERS; v++) {
+            if (!s.viewers[v].active()) {
+                free_slot = v;
+                break;
+            }
+        }
+    }
+    if (free_slot < 0) {
+        // Say why rather than dropping silently; a viewer that just
+        // disconnects with no explanation is impossible to diagnose.
+        const std::string body = http_simple_response(
+            503, "too many viewers", "text/plain",
+            "This stream already has the maximum number of viewers.\n");
+        (void)::send(fd, body.data(), body.size(), MSG_NOSIGNAL);
+        close(fd);
+        printf("[%d] video slot %d viewer from %s refused: slot full\n",
+               port2_, idx, addr_to_str(from));
+        return;
+    }
+    s.viewers[free_slot].start(fd, port2_, uint32_t(from.sin_addr.s_addr),
+                               from.sin_port, now);
+    s.viewer_out_armed[free_slot] = false;
+    s.viewers_seen++;
+    epoll_add_viewer(s.viewers[free_slot]);
+    printf("[%d] video slot %d viewer from %s connected\n",
+           port2_, idx, addr_to_str(from));
+}
+
+/*
+  Take a slot for a publisher whose media arrives on the backend's
+  stdout rather than as datagrams. Everything downstream -- the ring,
+  the scanner, the recorder, the ConnEntry row -- is the same.
+ */
+void VideoChild::latch_publisher(Slot &s, int idx, time_t now)
+{
+    s.has_pub = true;
+    s.pub_since = now;
+    s.pub_last = now;
+    s.pub_bytes = 0;
+    s.ring.init(video_ring_bytes());
+    s.scanner = TSScanner();
+    s.had_anchor = false;
+    s.recording = (video_slot_opts(ke_.video_flags, unsigned(idx))
+                   & VIDEO_SLOT_RECORD) != 0;
+    if (s.recording) {
+        s.rec.configure(uint32_t(port2_), idx,
+                        (ke_.flags & KEY_FLAG_USE_TZ) != 0,
+                        ke_.tz_offset_hours, "logs", ke_.video_quota_mb);
+    }
+    last_tick_ = 0;
+}
+
+void VideoChild::handle_rtsp(Slot &s, int idx, int fd,
+                             struct sockaddr_in &from, time_t now,
+                             splice_proto_t proto)
+{
+    /*
+      RTMP is not spliced: we speak it ourselves, and the credential
+      only arrives with publish. So the connection is parked in the
+      pending pool, which owns no part of the slot, and admission
+      happens later.
+     */
+    if (proto == SPLICE_RTMP) {
+        int free_i = -1;
+        int oldest_i = -1;
+        for (int i = 0; i < VIDEO_MAX_PENDING_RTMP; i++) {
+            if (!s.pending[i].active()) {
+                free_i = i;
+                break;
+            }
+            if (oldest_i < 0 || s.pending[i].since < s.pending[oldest_i].since) {
+                oldest_i = i;
+            }
+        }
+        if (free_i < 0) {
+            // Pool full: drop the oldest, which has had the longest to
+            // publish and has not. Bounded either way, and a squatter
+            // cannot pin every entry against a camera that retries.
+            close_pending(s, idx, s.pending[oldest_i], "pending pool full");
+            free_i = oldest_i;
+        }
+        PendingRtmp &p = s.pending[free_i];
+        fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) | O_NONBLOCK);
+        p.fd = fd;
+        p.sess.reset(new RtmpSession());
+        p.out.clear();
+        p.since = now;
+        p.ip_be = uint32_t(from.sin_addr.s_addr);
+        p.port_be = from.sin_port;
+        printf("[%d] video slot %d RTMP publisher %s connecting\n",
+               port2_, idx, addr_to_str(from));
+        struct epoll_event ev {};
+        ev.events = EPOLLIN | EPOLLRDHUP;
+        ev.data.fd = fd;
+        epoll_ctl(epfd_, EPOLL_CTL_ADD, fd, &ev);
+        return;
+    }
+
+    /*
+      Read a publish password out of the request-line URI, if there is
+      one, e.g. rtsp://host:port/cam?pw=secret. Peek only -- the splice
+      must still see the exchange from byte zero.
+
+      This is the one place RTSP can carry a credential without us
+      answering anything: proper Basic auth would mean replying 401 and
+      renumbering CSeq, which is exactly what makes the opaque splice
+      work. ffmpeg passes the query through untouched (verified) and
+      its own listener ignores it.
+
+      A password in a URL is normally a bad idea, but this URL is
+      configured on an aircraft rather than typed into a browser, so it
+      does not end up in history or a Referer header.
+     */
+    uint8_t line[512] {};
+    std::string pw;
+    const ssize_t ln = ::recv(fd, line, sizeof(line) - 1, MSG_PEEK);
+    if (ln > 0) {
+        const std::string req(reinterpret_cast<char *>(line), size_t(ln));
+        const size_t eol = req.find('\r');
+        const std::string first = req.substr(0, eol == std::string::npos
+                                             ? req.size() : eol);
+        const size_t q = first.find("?pw=");
+        if (q != std::string::npos) {
+            size_t end = first.find_first_of(" &", q + 4);
+            if (end == std::string::npos) {
+                end = first.size();
+            }
+            pw = http_url_decode(first.substr(q + 4, end - (q + 4)));
+        }
+    }
+
+    // Publishers are authorised; viewers are not, and on this port an
+    // RTSP connection is a publisher (we do not parse enough to tell
+    // them apart -- see videortsp.h).
+    const video_admit_t r = auth_.admit(ke_, uint32_t(from.sin_addr.s_addr),
+                                        pw.c_str(), now);
+    if (r != VIDEO_ADMIT_OK) {
+        log_reject(s, idx, uint32_t(from.sin_addr.s_addr), r, now);
+        close(fd);
+        return;
+    }
+    if (s.rtsp.running() || s.rtsp_client_fd >= 0
+        || (s.has_pub && now - s.pub_last <= VIDEO_PUB_IDLE_S)) {
+        log_reject(s, idx, uint32_t(from.sin_addr.s_addr),
+                   VIDEO_ADMIT_SLOT_BUSY, now);
+        close(fd);
+        return;
+    }
+
+    const bool want_audio =
+        (video_entry_opts(ke_.video_flags) & VIDEO_OPT_AUDIO) != 0;
+    if (!s.rtsp.start(port2_, idx, want_audio, proto)) {
+        close(fd);
+        return;
+    }
+    fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) | O_NONBLOCK);
+    s.rtsp_client_fd = fd;
+    s.pub_ip_be = uint32_t(from.sin_addr.s_addr);
+    s.pub_port_be = from.sin_port;
+    latch_publisher(s, idx, now);
+    printf("[%d] video slot %d %s publisher %s\n",
+           port2_, idx, splice_proto_name(proto), addr_to_str(from));
+
+    for (int watch : { s.rtsp_client_fd, s.rtsp.backend_fd(),
+                       s.rtsp.media_fd() }) {
+        if (watch < 0) {
+            continue;
+        }
+        struct epoll_event ev {};
+        ev.events = EPOLLIN | EPOLLRDHUP;
+        ev.data.fd = watch;
+        epoll_ctl(epfd_, EPOLL_CTL_ADD, watch, &ev);
+    }
+    last_tick_ = 0;
+}
+
+void VideoChild::close_rtsp(Slot &s, int idx, const char *why)
+{
+    if (!s.rtsp.running() && s.rtsp_client_fd < 0 && !s.rtmp) {
+        return;
+    }
+    // The backend's proto is only meaningful once it started, and an
+    // RTMP session can end before that -- during the handshake, or on a
+    // refused publish.
+    printf("[%d] video slot %d %s publisher gone (%s)\n",
+           port2_, idx,
+           s.rtmp ? "RTMP" : splice_proto_name(s.rtsp.proto()), why);
+    for (int watch : { s.rtsp_client_fd, s.rtsp.backend_fd(),
+                       s.rtsp.media_fd() }) {
+        if (watch >= 0) {
+            epoll_ctl(epfd_, EPOLL_CTL_DEL, watch, nullptr);
+        }
+    }
+    if (s.rtsp_client_fd >= 0) {
+        close(s.rtsp_client_fd);
+        s.rtsp_client_fd = -1;
+    }
+    s.rtmp.reset();
+    s.to_backend.clear();
+    s.to_client.clear();
+    s.rtsp.stop();
+    s.rec.close_segment();
+    s.recording = false;
+    s.has_pub = false;
+    // Same reasoning as the UDP idle-release path: the next publisher
+    // is a different stream, so viewers have to be ended rather than
+    // spliced onto it. Missing it here left RTSP -- the transport a
+    // publish password forces you onto -- with the original bug.
+    end_stream(s, idx, "publisher gone");
+}
+
+/*
+  Move bytes between the publisher and the backend, and pull muxed
+  MPEG-TS off the backend's stdout into the normal ingest path.
+  Returns false when the session is over.
+ */
+/*
+  Push whatever is queued for one direction. Never waits: a short write
+  leaves the remainder queued and EPOLLOUT armed.
+ */
+bool VideoChild::splice_flush(int to_fd, SpliceQueue &q)
+{
+    while (q.pending() > 0) {
+        const ssize_t w = ::send(to_fd, q.buf.data() + q.sent, q.pending(),
+                                 MSG_NOSIGNAL);
+        if (w > 0) {
+            q.sent += size_t(w);
+            continue;
+        }
+        if (w < 0 && errno == EINTR) {
+            continue;
+        }
+        if (w < 0 && (errno == EAGAIN || errno == EWOULDBLOCK)) {
+            break;              // still owed; EPOLLOUT will bring us back
+        }
+        // A zero return is not progress either -- looping on it spun
+        // forever in the previous version, because the offset never
+        // advanced.
+        return false;
+    }
+    q.compact();
+    return true;
+}
+
+// EPOLLOUT only while something is queued. Armed unconditionally it
+// would make epoll_wait return immediately for ever on an idle splice,
+// which is the same idle-viewer CPU burn measured earlier.
+void VideoChild::splice_arm(int to_fd, SpliceQueue &q)
+{
+    const bool want = q.pending() > 0;
+    if (want == q.armed || to_fd < 0) {
+        return;
+    }
+    struct epoll_event ev {};
+    ev.events = uint32_t(EPOLLIN | EPOLLRDHUP)
+        | (want ? uint32_t(EPOLLOUT) : 0u);
+    ev.data.fd = to_fd;
+    if (epoll_ctl(epfd_, EPOLL_CTL_MOD, to_fd, &ev) == 0) {
+        q.armed = want;
+    }
+}
+
+/*
+  Close one pending handshake and forget it. It owns no slot state, so
+  there is nothing else to unwind.
+ */
+void VideoChild::close_pending(Slot &s, int idx, PendingRtmp &p,
+                               const char *why)
+{
+    (void)s;
+    if (!p.active()) {
+        return;
+    }
+    struct in_addr a {};
+    a.s_addr = p.ip_be;
+    printf("[%d] video slot %d RTMP handshake from %s ended (%s)\n",
+           port2_, idx, inet_ntoa(a), why);
+    epoll_ctl(epfd_, EPOLL_CTL_DEL, p.fd, nullptr);
+    close(p.fd);
+    p.fd = -1;
+    p.sess.reset();
+    p.out.clear();
+    p.since = 0;
+}
+
+/*
+  A pending handshake has published. Authorise it and, if the slot is
+  free, hand it over.
+
+  Returns false if this connection is finished either way.
+ */
+bool VideoChild::promote_pending(Slot &s, int idx, PendingRtmp &p,
+                                 time_t now)
+{
+    RtmpSession &r = *p.sess;
+
+    const video_admit_t a = auth_.admit(ke_, p.ip_be, r.password().c_str(),
+                                        now);
+    if (a != VIDEO_ADMIT_OK) {
+        log_reject(s, idx, p.ip_be, a, now);
+        r.reject_publish("NetStream.Publish.Denied", video_admit_str(a));
+        return false;
+    }
+
+    /*
+      An RTMP path on the slot is an optional restriction: we read the
+      app and stream off the wire rather than telling ffmpeg what to
+      expect. Left blank the slot takes whatever is published.
+     */
+    char want[sizeof(ke_.video_rtmp_path[0]) + 1] {};
+    memcpy(want, ke_.video_rtmp_path[idx], sizeof(ke_.video_rtmp_path[idx]));
+    want[sizeof(want) - 1] = '\0';
+    if (want[0] != '\0' && r.path() != want) {
+        printf("[%d] video slot %d RTMP publisher refused: published %s, "
+               "slot expects %s\n", port2_, idx, r.path().c_str(), want);
+        r.reject_publish("NetStream.Publish.Denied",
+                         "stream path does not match this slot");
+        return false;
+    }
+
+    // Authorised -- but the slot may have been taken while this one was
+    // still negotiating.
+    if (s.rtsp.running() || s.rtsp_client_fd >= 0
+        || (s.has_pub && now - s.pub_last <= VIDEO_PUB_IDLE_S)) {
+        log_reject(s, idx, p.ip_be, VIDEO_ADMIT_SLOT_BUSY, now);
+        r.reject_publish("NetStream.Publish.Denied",
+                         "another publisher holds this slot");
+        return false;
+    }
+
+    // Hand the socket and the session to the slot.
+    s.rtsp_client_fd = p.fd;
+    s.rtmp = std::move(p.sess);
+    s.to_client = std::move(p.out);
+    s.to_backend.clear();
+    p.fd = -1;
+    p.out.clear();
+    p.since = 0;
+
+    s.pub_ip_be = p.ip_be;
+    s.pub_port_be = p.port_be;
+    s.rtmp->accept_publish();
+    latch_publisher(s, idx, now);
+    printf("[%d] video slot %d RTMP publishing %s\n",
+           port2_, idx, s.rtmp->path().c_str());
+    /*
+      Parsing stopped at publish so this authorisation could happen in
+      order. Whatever the publisher pipelined behind it -- for a client
+      that does not wait for onStatus, that includes the sequence header
+      and its parameter sets -- is still buffered, so pick it up now
+      rather than waiting for a read that may never come.
+     */
+    if (!rtmp_drain_owner(s, idx, s.rtmp->resume())) {
+        close_rtsp(s, idx, "RTMP session ended during promotion");
+        return true;
+    }
+    /*
+      Push the responses out. accept_publish() queued the
+      NetStream.Publish.Start the client is waiting on, and nothing else
+      runs until the next epoll event -- which a publisher that waits
+      for onStatus before sending anything will never cause. Leaving it
+      queued is exactly the stall this whole path exists to fix.
+     */
+    if (!splice_flush(s.rtsp_client_fd, s.to_client)) {
+        close_rtsp(s, idx, "connection closed");
+        return true;
+    }
+    splice_arm(s.rtsp_client_fd, s.to_client);
+    return true;
+}
+
+/*
+  Drive one pending handshake. Returns false when it is finished.
+ */
+bool VideoChild::pump_pending(Slot &s, int idx, PendingRtmp &p, time_t now)
+{
+    if (!splice_flush(p.fd, p.out)) {
+        return false;
+    }
+    uint8_t buf[8192];
+    const ssize_t n = ::recv(p.fd, buf, sizeof(buf), 0);
+    if (n == 0) {
+        return false;
+    }
+    if (n < 0) {
+        if (!(errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR)) {
+            return false;
+        }
+        splice_arm(p.fd, p.out);
+        return true;
+    }
+
+    RtmpSession &r = *p.sess;
+    bool alive = r.feed(buf, size_t(n), now);
+    bool promoted = false;
+    if (r.publish_pending()) {
+        promoted = promote_pending(s, idx, p, now);
+        if (promoted) {
+            return false;   // the slot owns it now; stop pumping as pending
+        }
+        alive = false;      // refused: flush the status, then close
+    }
+    if (!r.to_peer().empty()) {
+        p.out.buf.insert(p.out.buf.end(), r.to_peer().begin(),
+                         r.to_peer().end());
+        r.to_peer().clear();
+    }
+    // Media before publish is not ours to keep, and the session drops it.
+    r.to_flv().clear();
+    if (!splice_flush(p.fd, p.out)) {
+        return false;
+    }
+    if (!alive) {
+        if (r.error()[0] != '\0') {
+            printf("[%d] video slot %d RTMP: %s\n", port2_, idx, r.error());
+        }
+        return false;
+    }
+    splice_arm(p.fd, p.out);
+    return true;
+}
+
+/*
+  Start the backend now that the publisher's codec is known. Returns
+  false if it could not be started.
+ */
+bool VideoChild::rtmp_start_backend(Slot &s, int idx)
+{
+    /*
+      h264_metadata rewrites the NAL units, which drops the zero-length
+      one ffmpeg's own AVCC to Annex-B conversion puts ahead of every
+      access unit for this camera. Chrome's MP4 parser refuses a sample
+      containing it ("Failed to prepare video sample for decode");
+      Firefox plays it. It is H.264-only, hence the codec test.
+     */
+    const char *vbsf = s.rtmp->video_codec() == RTMP_VCODEC_H264
+        ? "h264_metadata" : nullptr;
+    const bool want_audio =
+        (video_entry_opts(ke_.video_flags) & VIDEO_OPT_AUDIO) != 0;
+    if (!s.rtsp.start(port2_, idx, want_audio, SPLICE_RTMP, vbsf)) {
+        return false;
+    }
+    for (int watch : { s.rtsp.backend_fd(), s.rtsp.media_fd() }) {
+        if (watch < 0) {
+            continue;
+        }
+        struct epoll_event ev {};
+        ev.events = EPOLLIN | EPOLLRDHUP;
+        ev.data.fd = watch;
+        epoll_ctl(epfd_, EPOLL_CTL_ADD, watch, &ev);
+    }
+    return true;
+}
+
+/*
+  Drive a native RTMP publisher: client bytes in, responses out, FLV to
+  the backend. Returns false when the session is over.
+ */
+/*
+  Move what the owning session produced into the queues, and start the
+  backend once the stream has named its codec.
+
+  `alive` is what feed()/resume() returned. Shared with promotion,
+  which has to run exactly this after accepting a publish: the client
+  may have pipelined its sequence header into the same segment, and
+  parsing stops at publish so authorisation can happen in order.
+ */
+bool VideoChild::rtmp_drain_owner(Slot &s, int idx, bool alive)
+{
+    RtmpSession &r = *s.rtmp;
+    // A second publish on the owning connection is a protocol error the
+    // session rejects; there is nothing to authorise here, because
+    // promotion did that before this session reached the slot.
+    const bool refused = r.publish_pending();
+
+    if (!r.to_peer().empty()) {
+        s.to_client.buf.insert(s.to_client.buf.end(),
+                               r.to_peer().begin(), r.to_peer().end());
+        r.to_peer().clear();
+    }
+    /*
+      Queue unconditionally. The backend may not exist yet -- it waits
+      for the codec -- and the FLV header and sequence header arrive
+      before it does; dropping them left the backend with a stream it
+      could not open. Reads are gated on SPLICE_QUEUE_MAX, so this stays
+      bounded.
+     */
+    if (!r.to_flv().empty()) {
+        s.to_backend.buf.insert(s.to_backend.buf.end(),
+                                r.to_flv().begin(), r.to_flv().end());
+        r.to_flv().clear();
+    }
+    if (r.publishing() && !s.rtsp.running()
+        && r.video_codec() != RTMP_VCODEC_NONE
+        && !rtmp_start_backend(s, idx)) {
+        return false;
+    }
+    if (refused || !alive) {
+        splice_flush(s.rtsp_client_fd, s.to_client);
+        if (r.error()[0] != '\0') {
+            printf("[%d] video slot %d RTMP: %s\n", port2_, idx, r.error());
+        }
+        return false;
+    }
+    return true;
+}
+
+bool VideoChild::pump_rtmp(Slot &s, int idx, int fd, time_t now)
+{
+    uint8_t buf[16384];
+    if (fd == s.rtsp.media_fd()) {
+        const ssize_t n = ::read(fd, buf, sizeof(buf));
+        if (n == 0) {
+            return false;
+        }
+        if (n < 0) {
+            return errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR;
+        }
+        s.pub_last = now;
+        ingest_stream(s, idx, buf, size_t(n));
+        return true;
+    }
+
+    // The backend's stdin: write-only, so an event here is either room
+    // to write or the backend having gone away.
+    if (fd == s.rtsp.backend_fd()) {
+        if (!splice_flush(fd, s.to_backend)) {
+            return false;
+        }
+        splice_arm(fd, s.to_backend);
+        return true;
+    }
+
+    if (fd != s.rtsp_client_fd || !s.rtmp) {
+        return true;
+    }
+
+    if (!splice_flush(fd, s.to_client)) {
+        return false;
+    }
+    if (s.rtsp.running() && !splice_flush(s.rtsp.backend_fd(), s.to_backend)) {
+        return false;
+    }
+
+    /*
+      Read only while both queues have room. Gating on the backend alone
+      let a peer that stops reading its responses keep sending commands,
+      turning its own bounded input into an unbounded to_client.
+     */
+    if (s.to_backend.pending() < SPLICE_QUEUE_MAX
+        && s.to_client.pending() < SPLICE_QUEUE_MAX) {
+        const ssize_t n = ::recv(fd, buf, sizeof(buf), 0);
+        if (n == 0) {
+            return false;
+        }
+        if (n < 0 && !(errno == EAGAIN || errno == EWOULDBLOCK
+                       || errno == EINTR)) {
+            return false;
+        }
+        if (n > 0) {
+            s.pub_last = now;
+            if (!rtmp_drain_owner(s, idx, s.rtmp->feed(buf, size_t(n), now))) {
+                return false;
+            }
+        }
+    }
+
+    if (!splice_flush(fd, s.to_client)) {
+        return false;
+    }
+    if (s.rtsp.running()) {
+        if (!splice_flush(s.rtsp.backend_fd(), s.to_backend)) {
+            return false;
+        }
+        splice_arm(s.rtsp.backend_fd(), s.to_backend);
+    }
+    splice_arm(fd, s.to_client);
+    return true;
+}
+
+bool VideoChild::pump_rtsp(Slot &s, int idx, int fd, time_t now)
+{
+    if (s.rtmp) {
+        return pump_rtmp(s, idx, fd, now);
+    }
+    uint8_t buf[16384];
+    if (fd == s.rtsp_client_fd || fd == s.rtsp.backend_fd()) {
+        const int from_fd = fd;
+        const int to_fd = (fd == s.rtsp_client_fd) ? s.rtsp.backend_fd()
+                                                   : s.rtsp_client_fd;
+        if (to_fd < 0) {
+            return false;
+        }
+        SpliceQueue &out = (fd == s.rtsp_client_fd) ? s.to_backend
+                                                    : s.to_client;
+        SpliceQueue &in = (fd == s.rtsp_client_fd) ? s.to_client
+                                                   : s.to_backend;
+
+        // Drain anything owed in both directions first: this fd may have
+        // woken us for EPOLLOUT rather than EPOLLIN.
+        if (!splice_flush(to_fd, out)) {
+            return false;
+        }
+        if (!splice_flush(from_fd, in)) {
+            return false;
+        }
+
+        // Only read while the sink has room. Leaving bytes in the socket
+        // is what pushes back on the publisher, instead of buffering
+        // without limit here.
+        if (out.pending() < SPLICE_QUEUE_MAX) {
+            const ssize_t n = ::recv(from_fd, buf, sizeof(buf), 0);
+            if (n == 0) {
+                return false;
+            }
+            if (n < 0 && !(errno == EAGAIN || errno == EWOULDBLOCK
+                           || errno == EINTR)) {
+                return false;
+            }
+            if (n > 0) {
+                out.buf.insert(out.buf.end(), buf, buf + n);
+                if (!splice_flush(to_fd, out)) {
+                    return false;
+                }
+                s.pub_last = now;
+            }
+        }
+
+        splice_arm(to_fd, out);
+        splice_arm(from_fd, in);
+        return true;
+    }
+    if (fd == s.rtsp.media_fd()) {
+        const ssize_t n = ::read(fd, buf, sizeof(buf));
+        if (n == 0) {
+            return false;
+        }
+        if (n < 0) {
+            return errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR;
+        }
+        s.pub_last = now;
+        // The backend writes a byte stream, not datagrams, so packets
+        // straddle reads -- which the scanner and ring already handle.
+        ingest_stream(s, idx, buf, size_t(n));
+        return true;
+    }
+    return true;
+}
+
+void VideoChild::epoll_add_viewer(VideoViewer &v)
+{
+    struct epoll_event ev {};
+    ev.events = EPOLLIN | EPOLLRDHUP;
+    ev.data.fd = v.fd();
+    epoll_ctl(epfd_, EPOLL_CTL_ADD, v.fd(), &ev);
+}
+
+// Arm or disarm EPOLLOUT to match whether this viewer is blocked.
+// Leaving it armed permanently makes epoll_wait return immediately for
+// any writable socket, which burns a core per idle viewer.
+void VideoChild::epoll_sync_viewer(VideoViewer &v, bool &armed)
+{
+    const bool want = v.wants_write();
+    if (want == armed) {
+        return;
+    }
+    struct epoll_event ev {};
+    ev.events = uint32_t(EPOLLIN | EPOLLRDHUP)
+        | (want ? uint32_t(EPOLLOUT) : 0u);
+    ev.data.fd = v.fd();
+    if (epoll_ctl(epfd_, EPOLL_CTL_MOD, v.fd(), &ev) == 0) {
+        armed = want;
+    }
+}
+
+void VideoChild::drop_viewer(Slot &s, int idx, VideoViewer &v)
+{
+    if (!v.active()) {
+        return;
+    }
+    printf("[%d] video slot %d viewer disconnected after %llu KiB (%s)\n",
+           port2_, idx, (unsigned long long)(v.bytes_sent() / 1024),
+           v.drop_reason()[0] ? v.drop_reason() : "closed");
+    epoll_ctl(epfd_, EPOLL_CTL_DEL, v.fd(), nullptr);
+    v.close();
+    s.viewers_dropped++;
+    last_tick_ = 0;
+}
+
+/*
+  End the current stream on a slot.
+
+  A publisher going away ends the stream its viewers are watching. The
+  next publisher is a *different* stream: PSI, continuity counters and
+  PTS/PCR all restart, so its bytes cannot simply be appended to what
+  the viewers have already been given. A player fed that sees time jump
+  backwards and stalls for good -- which looks exactly like "the video
+  never came back" rather than like a disconnect.
+
+  So viewers are closed here and get a clean end of stream. A client
+  that wants to keep watching reconnects and joins the new stream at its
+  own first keyframe. The ring and scanner are reset with them, so no
+  stale anchor from the old stream can be handed to whoever joins next.
+ */
+void VideoChild::end_stream(Slot &s, int idx, const char *why)
+{
+    for (int v = 0; v < VIDEO_MAX_VIEWERS; v++) {
+        VideoViewer &vw = s.viewers[v];
+        if (vw.active()) {
+            vw.set_drop_reason(why);
+            drop_viewer(s, idx, vw);
+        }
+    }
+    s.ring.reset();
+    s.scanner.reset();
+    s.last_anchor = 0;
+    s.had_anchor = false;
+    s.bad_datagrams = 0;
+    s.warned_204 = false;
+    s.pub_bytes = 0;
+}
+
+// Push ring bytes to every viewer on this slot. Called after ingest and
+// on every loop iteration, so a viewer whose socket drained between
+// epoll wakeups still makes progress.
+void VideoChild::pump_viewers(Slot &s, int idx, time_t now)
+{
+    for (int v = 0; v < VIDEO_MAX_VIEWERS; v++) {
+        VideoViewer &vw = s.viewers[v];
+        if (!vw.active()) {
+            continue;
+        }
+        if (vw.kind() == VVK_RTSP || vw.kind() == VVK_RTMP) {
+            // A publisher, not a viewer. Take the socket -- untouched,
+            // since the detect phase only ever peeked -- and splice it.
+            struct sockaddr_in from {};
+            from.sin_family = AF_INET;
+            from.sin_addr.s_addr = vw.peer_ip_be();
+            from.sin_port = vw.peer_port_be();
+            const splice_proto_t proto = vw.kind() == VVK_RTMP
+                ? SPLICE_RTMP : SPLICE_RTSP;
+            const int fd = vw.release_fd();
+            epoll_ctl(epfd_, EPOLL_CTL_DEL, fd, nullptr);
+            s.viewer_out_armed[v] = false;
+            handle_rtsp(s, idx, fd, from, now, proto);
+            continue;
+        }
+        if (vw.state() == VV_DETECT && vw.kind() == VVK_WS) {
+            if (!vw.begin_ws_pump(ke_, idx, s.ring, s.scanner, now)) {
+                drop_viewer(s, idx, vw);
+            }
+            continue;
+        }
+        if (vw.state() == VV_DETECT) {
+            if (now - vw.connected_at() >= VIDEO_DETECT_SILENCE_S) {
+                if (!vw.detect_timeout(ke_, idx, s.ring, s.scanner, now)) {
+                    drop_viewer(s, idx, vw);
+                    continue;
+                }
+            } else {
+                continue;
+            }
+        }
+        if (!vw.on_writable(s.ring, now)) {
+            drop_viewer(s, idx, vw);
+            continue;
+        }
+        epoll_sync_viewer(vw, s.viewer_out_armed[v]);
+    }
+}
+
+void VideoChild::write_conn_rows(time_t now)
+{
+    auto *db = conn_db_open_transaction();
+    if (db == nullptr) {
+        return;
+    }
+    // Only our own index range: the MAVLink child snapshots 0..999 the
+    // same way, and whole-port2 deletes here would erase its rows.
+    conn_delete_index_range(db, port2_, VIDEO_CONN_INDEX_BASE, INT32_MAX);
+    for (int i = 0; i < KEY_MAX_VIDEO_PORTS; i++) {
+        Slot &s = slots_[i];
+        if (!s.has_pub) {
+            continue;
+        }
+        struct ConnEntry e {};
+        e.magic = CONN_MAGIC;
+        e.connected_at = uint64_t(s.pub_since);
+        e.last_update = uint64_t(now);
+        e.port2 = port2_;
+        e.conn_index = VIDEO_PUB_INDEX(i);
+        e.pid = uint32_t(getpid());
+        e.rx_msgs = uint32_t(s.pub_bytes / 1024);   // KiB for video rows
+        e.peer_ip_be = s.pub_ip_be;
+        e.peer_port_be = s.pub_port_be;
+        /*
+          Report what the publisher actually is. Every video row used to
+          say UDP/MPEG-TS, which is only true of the datagram path -- an
+          operator looking at a stuck RTSP or RTMP publisher was told it
+          was something it was not.
+         */
+        const bool tcp_pub = s.rtmp || s.rtsp.running() ||
+                             s.rtsp_client_fd >= 0;
+        e.transport = tcp_pub ? CONN_TRANSPORT_TCP : CONN_TRANSPORT_UDP;
+        e.is_user = 0;
+        e.role = CONN_ROLE_VIDEO_PUB;
+        e.stream_idx = uint8_t(i);
+        e.app_proto = s.rtmp ? CONN_APP_RTMP
+                    : (tcp_pub ? CONN_APP_RTSP : CONN_APP_MPEGTS);
+        conn_write(db, e);
+    }
+    conn_db_close_commit(db);
+}
+
+void VideoChild::tick(time_t now)
+{
+    // Policy that doesn't need a rebind (credentials, grace, quota) is
+    // picked up here. Anything that changes binding -- the enable bit,
+    // the ports, the slot options -- makes the parent re-fork us
+    // instead, so we never have to rebind under our own feet.
+    if (load_entry()) {
+        auth_.invalidate();
+    }
+    // Sample the MAVLink session while it is alive, so the grace window
+    // still has a last-known-good to age out once the session child
+    // exits and its connections.tdb row disappears.
+    auth_.observe(now);
+    for (int i = 0; i < KEY_MAX_VIDEO_PORTS; i++) {
+        Slot &s = slots_[i];
+        if (s.rtsp.running() && s.rtsp.reap()) {
+            close_rtsp(s, i, "backend exited");
+        }
+        /*
+          Time out handshakes that never publish. The session bounds
+          itself once bytes arrive; this covers the peer that connects
+          and then says nothing at all.
+         */
+        for (int k = 0; k < VIDEO_MAX_PENDING_RTMP; k++) {
+            PendingRtmp &p = s.pending[k];
+            if (p.active() && p.since != 0
+                && now - p.since > RTMP_PREPUBLISH_MAX_S) {
+                close_pending(s, i, p, "handshake timed out");
+            }
+        }
+        /*
+          Accepted, but never said what it is sending. There is no
+          backend and no media, yet its control messages keep refreshing
+          the idle timer, so nothing else would ever reclaim the slot.
+         */
+        if (s.rtmp && s.rtmp->publishing() && !s.rtsp.running()
+            && s.rtmp->publishing_since() != 0
+            && now - s.rtmp->publishing_since() > RTMP_CODEC_DEADLINE_S) {
+            close_rtsp(s, i, "no video codec after publish");
+            continue;
+        }
+        if (s.has_pub && now - s.pub_last > VIDEO_PUB_IDLE_S) {
+            printf("[%d] video slot %d publisher idle, releasing\n",
+                   port2_, i);
+            /*
+              A spliced publisher has to be torn down, not just
+              forgotten. Clearing has_pub alone left the client socket,
+              the backend socket and the ffmpeg all alive, so
+              rtsp.running() went on refusing every replacement as
+              slot-busy until the child was killed by hand -- and UDP
+              admission, which tests only has_pub, could meanwhile claim
+              the slot underneath a splice that was still feeding it.
+             */
+            if (s.rtsp.running() || s.rtsp_client_fd >= 0) {
+                close_rtsp(s, i, "publisher idle");
+                continue;    // close_rtsp does the rest, including
+                             // end_stream and the recorder
+            }
+            s.has_pub = false;
+            // Close the segment on disconnect rather than leaving it
+            // open: the file is complete, and an open file is not
+            // evictable by the quota pass.
+            s.rec.close_segment();
+            s.recording = false;
+            end_stream(s, i, "publisher gone");
+        }
+    }
+    // One line per active publisher. This is the only window onto the
+    // scanner until viewers exist, so it carries what a operator (and
+    // the tests) need: whether a viewer could join, and why not.
+    for (int i = 0; i < KEY_MAX_VIDEO_PORTS; i++) {
+        Slot &s = slots_[i];
+        if (!s.has_pub) {
+            continue;
+        }
+        const TSStats &st = s.scanner.stats();
+        uint64_t join = 0;
+        const bool can_join = s.scanner.join_offset(join);
+        printf("[%d] video slot %d stats: %llu KiB, %llu pkts, pat=%llu "
+               "pmt=%llu rai=%llu cc_err=%llu crc_err=%llu bad_dgram=%llu "
+               "vpid=0x%x stype=0x%02x join=%s\n",
+               port2_, i,
+               (unsigned long long)(s.pub_bytes / 1024),
+               (unsigned long long)st.packets,
+               (unsigned long long)st.pat_seen,
+               (unsigned long long)st.pmt_seen,
+               (unsigned long long)st.rai_seen,
+               (unsigned long long)st.cc_errors,
+               (unsigned long long)st.crc_errors,
+               (unsigned long long)s.bad_datagrams,
+               unsigned(s.scanner.video_pid()),
+               unsigned(s.scanner.video_stream_type()),
+               can_join ? "ready" : "waiting");
+    }
+    write_conn_rows(now);
+    last_tick_ = now;
+}
+
+void VideoChild::run(void)
+{
+    if (!load_entry()) {
+        printf("[%d] video: no keys.tdb entry\n", port2_);
+        signal_ready(ENOENT);
+        _exit(1);
+    }
+
+    int err = bind_slots();
+    signal_ready(err);
+
+    epfd_ = epoll_create1(0);
+    if (epfd_ == -1) {
+        printf("[%d] video: epoll_create1 failed - %s\n",
+               port2_, strerror(errno));
+        _exit(1);
+    }
+    for (int i = 0; i < KEY_MAX_VIDEO_PORTS; i++) {
+        for (int fd : { slots_[i].udp_fd, slots_[i].tcp_fd }) {
+            if (fd == -1) {
+                continue;
+            }
+            struct epoll_event ev {};
+            ev.events = EPOLLIN;
+            ev.data.fd = fd;
+            epoll_ctl(epfd_, EPOLL_CTL_ADD, fd, &ev);
+        }
+    }
+
+    while (true) {
+        struct epoll_event events[VIDEO_MAX_EPOLL_EVENTS];
+        int nev = epoll_wait(epfd_, events, VIDEO_MAX_EPOLL_EVENTS, 1000);
+        if (nev == -1 && errno != EINTR) {
+            printf("[%d] video: epoll_wait failed - %s\n",
+                   port2_, strerror(errno));
+            break;
+        }
+        const time_t evnow = time(nullptr);
+        for (int e = 0; e < nev; e++) {
+            const int fd = events[e].data.fd;
+            bool matched = false;
+            for (int i = 0; i < KEY_MAX_VIDEO_PORTS && !matched; i++) {
+                if (slots_[i].udp_fd == fd) {
+                    handle_udp(slots_[i], i);
+                    matched = true;
+                } else if (slots_[i].tcp_fd == fd) {
+                    handle_tcp(slots_[i], i);
+                    matched = true;
+                }
+            }
+            if (matched) {
+                continue;
+            }
+            // a pending RTMP handshake: owns no slot state, so it is
+            // matched before the splice fds and closed on its own.
+            for (int i = 0; i < KEY_MAX_VIDEO_PORTS && !matched; i++) {
+                Slot &s = slots_[i];
+                for (int k = 0; k < VIDEO_MAX_PENDING_RTMP; k++) {
+                    PendingRtmp &p = s.pending[k];
+                    if (!p.active() || p.fd != fd) {
+                        continue;
+                    }
+                    matched = true;
+                    if ((events[e].events & (EPOLLHUP | EPOLLERR))
+                        || !pump_pending(s, i, p, evnow)) {
+                        // Promotion moves the fd out and clears p, so an
+                        // entry that is no longer active was handed on
+                        // rather than dropped.
+                        if (p.active()) {
+                            close_pending(s, i, p, "connection closed");
+                        }
+                    }
+                    break;
+                }
+            }
+            if (matched) {
+                continue;
+            }
+            // an RTSP splice fd
+            for (int i = 0; i < KEY_MAX_VIDEO_PORTS && !matched; i++) {
+                Slot &s = slots_[i];
+                if (fd != s.rtsp_client_fd && fd != s.rtsp.backend_fd()
+                    && fd != s.rtsp.media_fd()) {
+                    continue;
+                }
+                matched = true;
+                if ((events[e].events & (EPOLLHUP | EPOLLERR))
+                    || !pump_rtsp(s, i, fd, evnow)) {
+                    close_rtsp(s, i, "connection closed");
+                }
+            }
+            if (matched) {
+                continue;
+            }
+            // a viewer socket
+            for (int i = 0; i < KEY_MAX_VIDEO_PORTS && !matched; i++) {
+                Slot &s = slots_[i];
+                for (int v = 0; v < VIDEO_MAX_VIEWERS; v++) {
+                    VideoViewer &vw = s.viewers[v];
+                    if (!vw.active() || vw.fd() != fd) {
+                        continue;
+                    }
+                    matched = true;
+                    bool ok = true;
+                    if (events[e].events & (EPOLLHUP | EPOLLERR)) {
+                        ok = false;
+                    } else {
+                        if (events[e].events & (EPOLLIN | EPOLLRDHUP)) {
+                            ok = vw.on_readable(ke_, i, s.ring, s.scanner,
+                                                evnow);
+                        }
+                        if (ok && (events[e].events & EPOLLOUT)) {
+                            ok = vw.on_writable(s.ring, evnow);
+                        }
+                    }
+                    if (!ok) {
+                        drop_viewer(s, i, vw);
+                    }
+                    break;
+                }
+            }
+        }
+
+        // Push to viewers every iteration, not only on EPOLLOUT: new
+        // ring data has no fd event of its own, and a viewer whose
+        // socket had room all along would otherwise never be fed.
+        const time_t now = time(nullptr);
+        for (int i = 0; i < KEY_MAX_VIDEO_PORTS; i++) {
+            if (slots_[i].udp_fd != -1 || slots_[i].tcp_fd != -1) {
+                pump_viewers(slots_[i], i, now);
+            }
+        }
+        if (now - last_tick_ >= VIDEO_TICK_S) {
+            tick(now);
+        }
+        // The parent may have died between our PDEATHSIG being armed
+        // and now; PDEATHSIG only fires on a parent that was alive when
+        // it was set.
+        if (getppid() == 1) {
+            break;
+        }
+    }
+
+    conn_remove_video(port2_);
+    _exit(0);
+}
+
+}  // namespace
+
+void video_child_main(int port2, int ready_fd)
+{
+    VideoChild child(port2, ready_fd);
+    child.run();
+}
diff --git a/video.h b/video.h
new file mode 100644
index 0000000..dbc6692
--- /dev/null
+++ b/video.h
@@ -0,0 +1,39 @@
+/*
+  The per-entry video child.
+
+  Unlike the per-port-pair MAVLink child, this is a long-lived direct
+  child of the parent, forked from reload_ports() and respawned by
+  check_children(). Its lifetime is deliberately independent of any
+  MAVLink session: the MAVLink child idles out after 10 s, and video has
+  to survive that, and has to work with no MAVLink session at all when
+  the entry has a publish password.
+
+  Because the *child* binds the video ports, a video port simply does not
+  exist unless the entry has video enabled -- the enable is structural
+  rather than a policy check somewhere in a packet path.
+ */
+#pragma once
+
+#include <stdint.h>
+#include <sys/types.h>
+
+#include "keydb.h"
+
+// Number of listening fds a video child opens per configured slot
+// (one UDP, one TCP).
+#define VIDEO_FDS_PER_SLOT 2
+
+/*
+  Entry point for the video child. Called after the caller has done fd
+  sanitation in the forked child. Never returns: it _exit()s.
+
+  ready_fd is the write end of a pipe the parent reads once to learn
+  whether every configured port bound. A single byte is written: 0 for
+  success, or errno for the first failure. The fd is closed either way,
+  so the parent's read never blocks if the child dies first.
+ */
+void video_child_main(int port2, int ready_fd) __attribute__((noreturn));
+
+// True if this entry should have a video child: video enabled and at
+// least one port configured.
+bool video_entry_wants_child(uint32_t flags, const uint32_t *video_ports);
diff --git a/videoauth.cpp b/videoauth.cpp
new file mode 100644
index 0000000..b101960
--- /dev/null
+++ b/videoauth.cpp
@@ -0,0 +1,200 @@
+/*
+  Video publisher admission. See videoauth.h for the model.
+ */
+#include "videoauth.h"
+
+#include <string.h>
+#include <stdio.h>
+#include <openssl/sha.h>
+#include <errno.h>
+#include <openssl/crypto.h>
+#include <openssl/hmac.h>
+#include <stdlib.h>
+
+#include "conntdb.h"
+
+// How long a cached connections.tdb read stays usable. Short enough that
+// a session appearing or moving is noticed promptly, long enough that a
+// datagram burst doesn't turn into a burst of tdb opens.
+#define VIDEO_AUTH_CACHE_S 2
+
+const char *video_admit_str(video_admit_t r)
+{
+    switch (r) {
+    case VIDEO_ADMIT_OK:            return "ok";
+    case VIDEO_ADMIT_NO_SESSION:    return "no MAVLink session";
+    case VIDEO_ADMIT_STALE_SESSION: return "MAVLink session too old";
+    case VIDEO_ADMIT_WRONG_IP:      return "address does not match the MAVLink session";
+    case VIDEO_ADMIT_UNAUTH:        return "MAVLink session not signature-validated";
+    case VIDEO_ADMIT_BAD_PASSWORD:  return "wrong publish password";
+    case VIDEO_ADMIT_SLOT_BUSY:     return "another publisher holds this slot";
+    case VIDEO_ADMIT_NO_CREDENTIAL:
+        return "a publish password is set, and plain MPEG-TS/UDP cannot carry "
+               "one -- publish over RTSP, or clear the password";
+    case VIDEO_ADMIT_MISSING_PASSWORD:
+        return "a publish password is set but none was supplied -- add "
+               "?pw=... to the RTSP URL";
+    }
+    return "unknown";
+}
+
+bool video_password_matches(const uint8_t stored[32], const char *candidate)
+{
+    // An all-zero key is the "unset" sentinel, never a hash to match.
+    bool any = false;
+    for (int i = 0; i < 32; i++) {
+        any |= stored[i] != 0;
+    }
+    if (!any || candidate == nullptr || *candidate == '\0') {
+        return false;
+    }
+    uint8_t want[SHA256_DIGEST_LENGTH];
+    SHA256((const unsigned char *)candidate, strlen(candidate), want);
+    return CRYPTO_memcmp(want, stored, sizeof(want)) == 0;
+}
+
+bool VideoAuth::refresh(time_t now)
+{
+    auto *db = conn_db_open();
+    if (db == nullptr) {
+        // Can't read: leave whatever we had and let the caller decide.
+        // Failing closed here would drop a live publisher every time the
+        // file is briefly locked.
+        fetched_at_ = now;
+        return false;
+    }
+    struct ConnEntry e {};
+    if (conn_get_user(db, port2_, e)) {
+        have_ = true;
+        peer_ip_be_ = e.peer_ip_be;
+        authenticated_ = e.authenticated != 0;
+        seen_at_ = now;
+    }
+    // No row: do NOT forget what we last saw. The row disappears when
+    // the session child exits, which is exactly when the grace window
+    // is supposed to keep video alive. check_session() ages seen_at_
+    // out instead.
+    conn_db_close(db);
+    fetched_at_ = now;
+    return true;
+}
+
+video_admit_t VideoAuth::check_session(const struct KeyEntry &ke,
+                                       uint32_t peer_ip_be, time_t now) const
+{
+    if (!have_) {
+        return VIDEO_ADMIT_NO_SESSION;
+    }
+    if (peer_ip_be_ != peer_ip_be) {
+        return VIDEO_ADMIT_WRONG_IP;
+    }
+    const uint32_t grace = ke.video_mav_grace_s ? ke.video_mav_grace_s
+                                                : VIDEO_MAV_GRACE_DEFAULT_S;
+    // Measured from when we last saw the session live, not from a field
+    // in a record that no longer exists. This is what lets a publisher
+    // start (or restart) during a telemetry outage.
+    if (now > seen_at_ + time_t(grace)) {
+        return VIDEO_ADMIT_STALE_SESSION;
+    }
+    if ((ke.flags & KEY_FLAG_BIDI_SIGN) != 0 && !authenticated_) {
+        return VIDEO_ADMIT_UNAUTH;
+    }
+    return VIDEO_ADMIT_OK;
+}
+
+video_admit_t VideoAuth::admit(const struct KeyEntry &ke, uint32_t peer_ip_be,
+                               const char *password, time_t now)
+{
+    // Path A: a publish password, when set, is sufficient on its own.
+    bool have_pw = false;
+    for (int i = 0; i < 32; i++) {
+        have_pw |= ke.video_publish_key[i] != 0;
+    }
+    if (have_pw) {
+        /*
+          The password replaces the MAVLink-session check rather than
+          adding to it: an operator sets one precisely because they do
+          not want address matching to be the gate.
+
+          Say so clearly when the transport had no way to present it.
+          "wrong publish password" is true but useless to someone whose
+          udpsink never sent one.
+         */
+        if (password == nullptr) {
+            return VIDEO_ADMIT_NO_CREDENTIAL;
+        }
+        if (*password == '\0') {
+            return VIDEO_ADMIT_MISSING_PASSWORD;
+        }
+        return video_password_matches(ke.video_publish_key, password)
+            ? VIDEO_ADMIT_OK : VIDEO_ADMIT_BAD_PASSWORD;
+    }
+
+    // Path B: match a recent MAVLink session.
+    if (fetched_at_ == 0 || now - fetched_at_ >= VIDEO_AUTH_CACHE_S) {
+        refresh(now);
+    }
+    video_admit_t r = check_session(ke, peer_ip_be, now);
+    if (r != VIDEO_ADMIT_OK) {
+        // The cache may simply predate a session that just came up.
+        // Re-read once before rejecting, but only if the cached copy
+        // isn't already fresh -- otherwise a stream of unauthorised
+        // packets would drive one tdb open each.
+        if (now - fetched_at_ > 0 && refresh(now)) {
+            r = check_session(ke, peer_ip_be, now);
+        }
+    }
+    return r;
+}
+
+bool video_token_valid(const struct KeyEntry &ke, int port2, int slot,
+                       const char *token, time_t now)
+{
+    if (token == nullptr || *token == '\0') {
+        return false;
+    }
+    const char *dot = strchr(token, '.');
+    if (dot == nullptr) {
+        return false;
+    }
+    char *endp = nullptr;
+    errno = 0;
+    const long long expiry = strtoll(token, &endp, 10);
+    if (errno != 0 || endp != dot || expiry <= 0) {
+        return false;
+    }
+    if (now > time_t(expiry)) {
+        return false;
+    }
+    const char *mac_hex = dot + 1;
+    if (strlen(mac_hex) != 64) {
+        return false;
+    }
+
+    char msg[128];
+    const int mlen = snprintf(msg, sizeof(msg), "video-view|%d|%d|%lld",
+                              port2, slot, expiry);
+    if (mlen <= 0 || size_t(mlen) >= sizeof(msg)) {
+        return false;
+    }
+
+    uint8_t want[32];
+    unsigned int want_len = 0;
+    if (HMAC(EVP_sha256(), ke.secret_key, int(sizeof(ke.secret_key)),
+             reinterpret_cast<const unsigned char *>(msg), size_t(mlen),
+             want, &want_len) == nullptr || want_len != sizeof(want)) {
+        return false;
+    }
+
+    uint8_t got[32];
+    for (int i = 0; i < 32; i++) {
+        char pair[3] = { mac_hex[i * 2], mac_hex[i * 2 + 1], 0 };
+        char *e2 = nullptr;
+        const long v = strtol(pair, &e2, 16);
+        if (e2 != pair + 2) {
+            return false;
+        }
+        got[i] = uint8_t(v);
+    }
+    return CRYPTO_memcmp(want, got, sizeof(want)) == 0;
+}
diff --git a/videoauth.h b/videoauth.h
new file mode 100644
index 0000000..6e06d34
--- /dev/null
+++ b/videoauth.h
@@ -0,0 +1,119 @@
+/*
+  Video publisher admission.
+
+  Two independent paths, neither tied to the MAVLink process tree:
+
+    A. publish password  -- accepted standalone, no MAVLink needed. For
+       CGNAT, split-egress (video on a second link) and video-only use.
+
+    B. MAVLink session    -- with no publish password set, a publisher is
+       accepted when a MAVLink session for this entry was seen from the
+       same IPv4 address within the entry's grace window. The grace is
+       what lets video ride through a telemetry dropout instead of being
+       revoked by a link flap. On a bidi entry the session must also have
+       been signature-validated.
+
+  Path B reads connections.tdb, which makes that file an authorisation
+  input. It sits alongside keys.tdb in the proxy's working directory and
+  both are 0600, so anyone who can forge one can forge the other; but
+  peer_ip_be / authenticated must only ever be written by the session
+  child.
+ */
+#pragma once
+
+#include <stdint.h>
+#include <time.h>
+
+#include "keydb.h"
+
+enum video_admit_t {
+    VIDEO_ADMIT_OK = 0,
+    VIDEO_ADMIT_NO_SESSION,     // no MAVLink session record at all
+    VIDEO_ADMIT_STALE_SESSION,  // last seen longer ago than the grace window
+    VIDEO_ADMIT_WRONG_IP,       // session exists, but from another address
+    VIDEO_ADMIT_UNAUTH,         // bidi entry whose session never authenticated
+    VIDEO_ADMIT_BAD_PASSWORD,   // publish password set and wrong/absent
+    VIDEO_ADMIT_SLOT_BUSY,      // another publisher already holds the slot
+    VIDEO_ADMIT_NO_CREDENTIAL,  // a publish password is set, but this
+                                // transport cannot carry one at all
+    VIDEO_ADMIT_MISSING_PASSWORD,  // transport could carry one; none given
+};
+
+const char *video_admit_str(video_admit_t r);
+
+/*
+  Cached view of the entry's MAVLink session.
+
+  Re-reading connections.tdb per packet is not an option: a per-packet
+  tdb open under load is what caused the lock-contention stall that
+  commit 6fea59a fixed on the MAVLink side. So the state is cached and
+  refreshed on a timer, with one forced refresh allowed when a decision
+  would otherwise be a rejection -- so a publisher that starts moments
+  after its MAVLink session does not have to wait out the timer.
+ */
+class VideoAuth {
+public:
+    explicit VideoAuth(int port2) : port2_(port2) {}
+
+    /*
+      Decide whether `peer_ip_be` may publish.
+
+      `password` distinguishes three cases, and the difference is what
+      the operator sees in the log:
+        nullptr  the transport cannot carry a credential at all (UDP)
+        ""       it could, but none was supplied (RTSP with no ?pw=)
+        "..."    a credential to check
+     */
+    video_admit_t admit(const struct KeyEntry &ke, uint32_t peer_ip_be,
+                        const char *password, time_t now);
+
+    // Force the next lookup to re-read, e.g. after a config change.
+    void invalidate(void) { fetched_at_ = 0; }
+
+    // Sample the MAVLink session state even when no video traffic is
+    // flowing. Without this the child only ever looks on a packet, so a
+    // session that comes and goes between publishes is never observed
+    // and the grace window has nothing to work from.
+    void observe(time_t now) { refresh(now); }
+
+private:
+    int port2_;
+    /*
+      Last-known-good session, which deliberately OUTLIVES the record.
+
+      connections.tdb only holds a row while the session child is alive;
+      when it idles out the row is deleted. If the absence of a row meant
+      "no session", the grace window could never apply -- the case it
+      exists for is precisely a MAVLink session that has gone away. So we
+      remember what we last saw and age it out ourselves.
+     */
+    bool have_ = false;         // have we ever seen a session?
+    uint32_t peer_ip_be_ = 0;
+    bool authenticated_ = false;
+    time_t seen_at_ = 0;        // when the session was last observed live
+    time_t fetched_at_ = 0;     // when connections.tdb was last read
+
+    bool refresh(time_t now);
+    video_admit_t check_session(const struct KeyEntry &ke,
+                                uint32_t peer_ip_be, time_t now) const;
+};
+
+// Constant-time compare of a candidate password against a stored
+// sha256. Returns false when the stored key is all-zero (unset).
+bool video_password_matches(const uint8_t stored[32], const char *candidate);
+
+/*
+  Verify a short-lived viewer token minted by the web admin.
+
+  Format: "<expiry>.<hex hmac-sha256>", the MAC taken over
+  "video-view|<port2>|<slot>|<expiry>" with the entry's MAVLink secret
+  key. That key is already shared between the web admin and this
+  process, so browser playback needs no new secret, no new state and
+  no new file -- and the browser never sees the key itself.
+
+  The token exists because the alternative is putting the viewer
+  password in a browser URL, where it lands in history, logs and
+  Referer headers.
+ */
+bool video_token_valid(const struct KeyEntry &ke, int port2, int slot,
+                       const char *token, time_t now);
diff --git a/videorec.cpp b/videorec.cpp
new file mode 100644
index 0000000..b1be74a
--- /dev/null
+++ b/videorec.cpp
@@ -0,0 +1,262 @@
+/*
+  Video segment recording. See videorec.h.
+ */
+#include "videorec.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include "cleanup.h"
+#include "session.h"
+
+// Drop written pages from the page cache after this much. A few GB of
+// video would otherwise evict everything useful on a small VPS.
+#define VIDEO_FADVISE_CHUNK (8u * 1024 * 1024)
+
+uint32_t video_segment_seconds(void)
+{
+    static uint32_t cached = 0;
+    if (cached == 0) {
+        cached = VIDEO_SEGMENT_SECONDS_DEFAULT;
+        const char *env = getenv("SUPPORTPROXY_VIDEO_SEGMENT_SECONDS");
+        if (env != nullptr && *env != '\0') {
+            char *endp = nullptr;
+            errno = 0;
+            long v = strtol(env, &endp, 10);
+            if (errno == 0 && endp != env && *endp == '\0' && v > 0) {
+                cached = uint32_t(v);
+            }
+        }
+    }
+    return cached;
+}
+
+uint64_t video_segment_bytes(void)
+{
+    static uint64_t cached = 0;
+    if (cached == 0) {
+        cached = VIDEO_SEGMENT_BYTES_DEFAULT;
+        const char *env = getenv("SUPPORTPROXY_VIDEO_SEGMENT_BYTES");
+        if (env != nullptr && *env != '\0') {
+            char *endp = nullptr;
+            errno = 0;
+            long long v = strtoll(env, &endp, 10);
+            if (errno == 0 && endp != env && *endp == '\0' && v > 0) {
+                cached = uint64_t(v);
+            }
+        }
+    }
+    return cached;
+}
+
+VideoWriter::~VideoWriter(void)
+{
+    close_segment();
+}
+
+void VideoWriter::configure(uint32_t port2, int slot, bool use_tz,
+                            float tz_offset, const char *base_dir,
+                            uint32_t quota_mb)
+{
+    port2_ = port2;
+    slot_ = slot;
+    use_tz_ = use_tz;
+    tz_offset_ = tz_offset;
+    base_dir_ = base_dir != nullptr ? base_dir : "logs";
+    quota_mb_ = quota_mb;
+}
+
+bool VideoWriter::open_segment(time_t now)
+{
+    if (stopped_) {
+        return false;
+    }
+    if (!video_have_free_space(base_dir_.c_str())) {
+        printf("[%u] video slot %d: filesystem too full, recording stopped\n",
+               unsigned(port2_), slot_);
+        stopped_ = true;
+        return false;
+    }
+
+    // Make room before writing rather than after: the quota pass would
+    // otherwise only notice on its hourly tick, by which point the
+    // budget has been exceeded for most of an hour.
+    log_cleanup_port2_video_quota(port2_, base_dir_.c_str(),
+                                  quota_mb_ != 0
+                                  ? off_t(quota_mb_) * 1024 * 1024 : 0,
+                                  off_t(video_segment_bytes()));
+
+    char datedir[16];
+    char name[64];
+    session_time_strings(now, use_tz_, tz_offset_,
+                         datedir, sizeof(datedir), name, sizeof(name));
+
+    char dir[1024];
+    snprintf(dir, sizeof(dir), "%s/%u/%s", base_dir_.c_str(),
+             unsigned(port2_), datedir);
+    // mkpath_0700 returns 0 on success and -1 on failure, like mkdir --
+    // not a bool. The other callers all test "< 0".
+    if (mkpath_0700(dir) < 0) {
+        printf("[%u] video slot %d: cannot create %s - %s\n",
+               unsigned(port2_), slot_, dir, strerror(errno));
+        return false;
+    }
+
+    /*
+      session_unique_basename() picks a free name, but it checks with
+      stat() and then hands the name back -- and after exhausting its
+      fallbacks it returns the plain base, occupied or not. Neither is
+      safe here, so the name is only a starting point: the open is
+      O_EXCL and a collision just tries again.
+     */
+    for (int attempt = 0; attempt < 8; attempt++) {
+        char base[64];
+        snprintf(base, sizeof(base), "%s", name);
+        session_unique_basename(base_dir_.c_str(), port2_, datedir,
+                                base, sizeof(base));
+        char path[1200];
+        snprintf(path, sizeof(path), "%s/%s.v%d.ts", dir, base, slot_ + 1);
+        const int fd = open(path, O_WRONLY | O_CREAT | O_EXCL, 0600);
+        if (fd >= 0) {
+            fd_ = fd;
+            path_ = path;
+            date_dir_ = dir;
+            seg_start_ = now;
+            seg_bytes_ = 0;
+            fadvise_mark_ = 0;
+            rotate_wanted_ = 0;
+            segments_++;
+            printf("[%u] video slot %d recording to %s\n",
+                   unsigned(port2_), slot_, path);
+            return true;
+        }
+        if (errno != EEXIST) {
+            printf("[%u] video slot %d: cannot open %s - %s\n",
+                   unsigned(port2_), slot_, path, strerror(errno));
+            if (errno == ENOSPC || errno == EDQUOT) {
+                stopped_ = true;
+            }
+            return false;
+        }
+        // Someone took the name between the check and the open. Nudge
+        // the timestamp so the next candidate differs.
+        now++;
+        session_time_strings(now, use_tz_, tz_offset_,
+                             datedir, sizeof(datedir), name, sizeof(name));
+    }
+    printf("[%u] video slot %d: no free segment name\n",
+           unsigned(port2_), slot_);
+    return false;
+}
+
+bool VideoWriter::write(const uint8_t *buf, size_t n, time_t now)
+{
+    if (stopped_) {
+        return false;
+    }
+    if (fd_ < 0 && !open_segment(now)) {
+        return false;
+    }
+
+    size_t off = 0;
+    while (off < n) {
+        const ssize_t w = ::write(fd_, buf + off, n - off);
+        if (w < 0) {
+            if (errno == EINTR) {
+                continue;
+            }
+            printf("[%u] video slot %d: write failed - %s; "
+                   "recording stopped (the live stream is unaffected)\n",
+                   unsigned(port2_), slot_, strerror(errno));
+            // A full disk must not take the stream down with it: stop
+            // recording, keep relaying.
+            close_segment();
+            stopped_ = true;
+            return false;
+        }
+        off += size_t(w);
+    }
+    seg_bytes_ += n;
+    total_bytes_ += n;
+
+    if (seg_bytes_ - fadvise_mark_ >= VIDEO_FADVISE_CHUNK) {
+        // Written data is never read back here, so let the kernel drop
+        // it rather than evict everything else on a small box.
+        posix_fadvise(fd_, off_t(fadvise_mark_),
+                      off_t(seg_bytes_ - fadvise_mark_), POSIX_FADV_DONTNEED);
+        fadvise_mark_ = seg_bytes_;
+    }
+    return true;
+}
+
+bool VideoWriter::rotation_due(time_t now)
+{
+    if (fd_ < 0) {
+        return false;
+    }
+    const bool due = (now - seg_start_) >= time_t(video_segment_seconds())
+        || seg_bytes_ >= video_segment_bytes();
+    if (due && rotate_wanted_ == 0) {
+        // Remember when we first wanted to cut. Without this the
+        // overshoot fallback never fires, and a stream whose muxer
+        // never signals a random access point grows one segment
+        // without bound -- which the quota pass can never evict,
+        // because it is the file being written.
+        rotate_wanted_ = now;
+    }
+    return due;
+}
+
+bool VideoWriter::rotation_overdue(time_t now) const
+{
+    return rotate_wanted_ != 0
+        && (now - rotate_wanted_) >= VIDEO_ROTATE_OVERSHOOT_S;
+}
+
+void VideoWriter::rotate(time_t now, bool clean)
+{
+    if (fd_ < 0) {
+        return;
+    }
+    printf("[%u] video slot %d rotating after %llu bytes (%s cut)\n",
+           unsigned(port2_), slot_, (unsigned long long)seg_bytes_,
+           clean ? "clean" : "forced");
+    close_segment();
+    rotate_wanted_ = 0;
+    (void)now;
+}
+
+void VideoWriter::close_segment(void)
+{
+    if (fd_ < 0) {
+        return;
+    }
+    const int fd = fd_;
+    fd_ = -1;
+
+    /*
+      fsync off the event loop. A 512 MiB segment can take a long time
+      to flush, and doing it inline would stall every stream and viewer
+      in this process. The fd is shared with the child across fork, so
+      the child's fsync covers our writes; we close our copy at once.
+     */
+    const pid_t pid = fork();
+    if (pid == 0) {
+        fsync(fd);
+        close(fd);
+        _exit(0);
+    }
+    if (pid < 0) {
+        // Couldn't fork: better a stall than an unflushed segment.
+        fsync(fd);
+    }
+    close(fd);
+}
diff --git a/videorec.h b/videorec.h
new file mode 100644
index 0000000..046b862
--- /dev/null
+++ b/videorec.h
@@ -0,0 +1,97 @@
+/*
+  Video segment recording.
+
+  Segments are written raw: the publisher's own bytes, byte for byte,
+  into logs/<port2>/<date>/<session>.v<slot>.ts. That makes a recording
+  a file VLC and ffplay open by double-click, append-only, and
+  truncation-tolerant -- a killed process leaves a playable file with
+  no finalisation step, which fragmented MP4 does not.
+
+  Each segment is its own timestamped file rather than a part of a
+  numbered set, so retention, natural sorting and the download route in
+  the web UI all work on it unmodified.
+
+  Why segments at all: the quota pass cannot delete the file currently
+  being written (mtime within ACTIVE_FILE_GRACE_S), so one long file
+  per session would make the whole session un-evictable and the quota
+  pass would find nothing to free. Ten-minute segments bound the
+  un-evictable working set at (segment + grace) * bitrate.
+ */
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+#include <sys/types.h>
+#include <time.h>
+
+#include <string>
+
+// Cut a segment after this long, or this many bytes, whichever first.
+#define VIDEO_SEGMENT_SECONDS_DEFAULT 600
+#define VIDEO_SEGMENT_BYTES_DEFAULT (512u * 1024 * 1024)
+
+// Once a rotation is due, wait this long for a clean cut point before
+// cutting anyway. A stream whose muxer never signals a random access
+// point must still rotate, or the segment grows without bound.
+#define VIDEO_ROTATE_OVERSHOOT_S 30
+
+class VideoWriter {
+public:
+    ~VideoWriter(void);
+
+    void configure(uint32_t port2, int slot, bool use_tz, float tz_offset,
+                   const char *base_dir, uint32_t quota_mb);
+
+    bool is_open(void) const { return fd_ >= 0; }
+
+    // Append. Returns false if recording has stopped (disk full); the
+    // caller keeps streaming regardless -- losing the recording must
+    // never take the live stream with it.
+    bool write(const uint8_t *buf, size_t n, time_t now);
+
+    // True when this segment has run long enough or grown big enough.
+    // Not const: it records *when* rotation first became due, which is
+    // what the overshoot fallback below measures against.
+    bool rotation_due(time_t now);
+
+    // True once we have waited long enough that the next write should
+    // cut whether or not it is a clean boundary.
+    bool rotation_overdue(time_t now) const;
+
+    // Close the current segment and start a new one on the next write.
+    // `clean` records whether the cut landed on a join boundary.
+    void rotate(time_t now, bool clean);
+
+    void close_segment(void);
+
+    const std::string &path(void) const { return path_; }
+    uint64_t segment_bytes(void) const { return seg_bytes_; }
+    uint64_t total_bytes(void) const { return total_bytes_; }
+    uint32_t segments(void) const { return segments_; }
+    bool stopped(void) const { return stopped_; }
+
+private:
+    uint32_t port2_ = 0;
+    int slot_ = 0;
+    bool use_tz_ = false;
+    float tz_offset_ = 0;
+    std::string base_dir_ = "logs";
+    uint32_t quota_mb_ = 0;
+
+    int fd_ = -1;
+    std::string path_;
+    std::string date_dir_;
+    time_t seg_start_ = 0;
+    time_t rotate_wanted_ = 0;   // when rotation first became due
+    uint64_t seg_bytes_ = 0;
+    uint64_t total_bytes_ = 0;
+    uint32_t segments_ = 0;
+    uint64_t fadvise_mark_ = 0;
+    bool stopped_ = false;       // disk full; no further segments
+
+    bool open_segment(time_t now);
+};
+
+// Segment limits, overridable for tests.
+uint32_t video_segment_seconds(void);
+uint64_t video_segment_bytes(void);
diff --git a/videortmp.cpp b/videortmp.cpp
new file mode 100644
index 0000000..4cc9577
--- /dev/null
+++ b/videortmp.cpp
@@ -0,0 +1,1008 @@
+/*
+  Native RTMP publish ingest. See videortmp.h.
+ */
+#include "videortmp.h"
+
+#include <stdio.h>
+#include <string.h>
+
+#include "httpreq.h"
+
+namespace {
+
+// ---------------------------------------------------------------- AMF0
+
+enum {
+    AMF_NUMBER = 0x00,
+    AMF_BOOLEAN = 0x01,
+    AMF_STRING = 0x02,
+    AMF_OBJECT = 0x03,
+    AMF_NULL = 0x05,
+    AMF_UNDEFINED = 0x06,
+    AMF_REFERENCE = 0x07,
+    AMF_ECMA_ARRAY = 0x08,
+    AMF_OBJECT_END = 0x09,
+    AMF_STRICT_ARRAY = 0x0a,
+    AMF_DATE = 0x0b,
+    AMF_LONG_STRING = 0x0c,
+};
+
+double be_double(const uint8_t *p)
+{
+    uint64_t v = 0;
+    for (int i = 0; i < 8; i++) {
+        v = (v << 8) | p[i];
+    }
+    double d;
+    memcpy(&d, &v, sizeof(d));
+    return d;
+}
+
+void put_be_double(std::vector<uint8_t> &b, double d)
+{
+    uint64_t v;
+    memcpy(&v, &d, sizeof(v));
+    for (int i = 7; i >= 0; i--) {
+        b.push_back(uint8_t((v >> (i * 8)) & 0xff));
+    }
+}
+
+void amf_num(std::vector<uint8_t> &b, double d)
+{
+    b.push_back(AMF_NUMBER);
+    put_be_double(b, d);
+}
+
+void amf_str(std::vector<uint8_t> &b, const char *s)
+{
+    const size_t n = strlen(s);
+    b.push_back(AMF_STRING);
+    b.push_back(uint8_t((n >> 8) & 0xff));
+    b.push_back(uint8_t(n & 0xff));
+    b.insert(b.end(), s, s + n);
+}
+
+void amf_key(std::vector<uint8_t> &b, const char *s)
+{
+    const size_t n = strlen(s);
+    b.push_back(uint8_t((n >> 8) & 0xff));
+    b.push_back(uint8_t(n & 0xff));
+    b.insert(b.end(), s, s + n);
+}
+
+void amf_null(std::vector<uint8_t> &b) { b.push_back(AMF_NULL); }
+
+void amf_obj_end(std::vector<uint8_t> &b)
+{
+    b.push_back(0);
+    b.push_back(0);
+    b.push_back(AMF_OBJECT_END);
+}
+
+/*
+  Skip one AMF0 value. Returns false on anything malformed or truncated,
+  which is what stops a hostile peer steering us past the buffer.
+ */
+bool amf_skip(const uint8_t *p, size_t n, size_t &i, int depth = 0);
+
+bool amf_skip_object_body(const uint8_t *p, size_t n, size_t &i, int depth)
+{
+    while (true) {
+        if (i + 2 > n) {
+            return false;
+        }
+        const size_t klen = (size_t(p[i]) << 8) | p[i + 1];
+        i += 2;
+        if (klen == 0) {
+            if (i >= n || p[i] != AMF_OBJECT_END) {
+                return false;
+            }
+            i++;
+            return true;
+        }
+        if (i + klen > n) {
+            return false;
+        }
+        i += klen;
+        if (!amf_skip(p, n, i, depth + 1)) {
+            return false;
+        }
+    }
+}
+
+bool amf_skip(const uint8_t *p, size_t n, size_t &i, int depth)
+{
+    if (depth > 8 || i >= n) {
+        return false;
+    }
+    const uint8_t m = p[i++];
+    switch (m) {
+    case AMF_NUMBER:
+        i += 8;
+        return i <= n;
+    case AMF_BOOLEAN:
+        i += 1;
+        return i <= n;
+    case AMF_STRING: {
+        if (i + 2 > n) {
+            return false;
+        }
+        const size_t len = (size_t(p[i]) << 8) | p[i + 1];
+        i += 2 + len;
+        return i <= n;
+    }
+    case AMF_LONG_STRING: {
+        if (i + 4 > n) {
+            return false;
+        }
+        size_t len = 0;
+        for (int k = 0; k < 4; k++) {
+            len = (len << 8) | p[i + k];
+        }
+        i += 4 + len;
+        return i <= n;
+    }
+    case AMF_NULL:
+    case AMF_UNDEFINED:
+        return true;
+    case AMF_REFERENCE:
+        i += 2;
+        return i <= n;
+    case AMF_DATE:
+        i += 10;
+        return i <= n;
+    case AMF_OBJECT:
+        return amf_skip_object_body(p, n, i, depth);
+    case AMF_ECMA_ARRAY:
+        i += 4;
+        if (i > n) {
+            return false;
+        }
+        return amf_skip_object_body(p, n, i, depth);
+    case AMF_STRICT_ARRAY: {
+        if (i + 4 > n) {
+            return false;
+        }
+        size_t cnt = 0;
+        for (int k = 0; k < 4; k++) {
+            cnt = (cnt << 8) | p[i + k];
+        }
+        i += 4;
+        if (cnt > n) {
+            return false;       // more elements than bytes left
+        }
+        for (size_t k = 0; k < cnt; k++) {
+            if (!amf_skip(p, n, i, depth + 1)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    case AMF_OBJECT_END:
+        return true;
+    default:
+        return false;
+    }
+}
+
+bool amf_read_string(const uint8_t *p, size_t n, size_t &i, std::string &out)
+{
+    if (i >= n || p[i] != AMF_STRING) {
+        return false;
+    }
+    i++;
+    if (i + 2 > n) {
+        return false;
+    }
+    const size_t len = (size_t(p[i]) << 8) | p[i + 1];
+    i += 2;
+    if (i + len > n) {
+        return false;
+    }
+    out.assign(reinterpret_cast<const char *>(p + i), len);
+    i += len;
+    return true;
+}
+
+bool amf_read_number(const uint8_t *p, size_t n, size_t &i, double &out)
+{
+    if (i >= n || p[i] != AMF_NUMBER) {
+        return false;
+    }
+    if (i + 9 > n) {
+        return false;
+    }
+    out = be_double(p + i + 1);
+    i += 9;
+    return true;
+}
+
+/*
+  Pull named string members out of an AMF0 object or ECMA array. Only
+  string values are of interest (app, tcUrl); everything else is skipped.
+ */
+bool amf_object_strings(const uint8_t *p, size_t n, size_t &i,
+                        const char *k1, std::string &v1,
+                        const char *k2, std::string &v2)
+{
+    if (i >= n) {
+        return false;
+    }
+    const uint8_t m = p[i++];
+    if (m == AMF_ECMA_ARRAY) {
+        i += 4;
+    } else if (m != AMF_OBJECT) {
+        i--;
+        return amf_skip(p, n, i);
+    }
+    while (true) {
+        if (i + 2 > n) {
+            return false;
+        }
+        const size_t klen = (size_t(p[i]) << 8) | p[i + 1];
+        i += 2;
+        if (klen == 0) {
+            if (i >= n || p[i] != AMF_OBJECT_END) {
+                return false;
+            }
+            i++;
+            return true;
+        }
+        if (i + klen > n) {
+            return false;
+        }
+        const std::string key(reinterpret_cast<const char *>(p + i), klen);
+        i += klen;
+        std::string sv;
+        const size_t save = i;
+        if (i < n && p[i] == AMF_STRING && amf_read_string(p, n, i, sv)) {
+            if (key == k1) {
+                v1 = sv;
+            } else if (key == k2) {
+                v2 = sv;
+            }
+            continue;
+        }
+        i = save;
+        if (!amf_skip(p, n, i)) {
+            return false;
+        }
+    }
+}
+
+/*
+  Split "name?pw=secret" (or "&password=") into the bare name and the
+  credential. Cameras put the stream key in a single field, so a query on
+  the stream name is the only place RTMP has to carry one.
+ */
+void split_credential(std::string &name, std::string &pw)
+{
+    const size_t q = name.find_first_of("?&");
+    if (q == std::string::npos) {
+        return;
+    }
+    const std::string query = name.substr(q + 1);
+    name.resize(q);
+    size_t at = 0;
+    while (at < query.size()) {
+        size_t end = query.find('&', at);
+        if (end == std::string::npos) {
+            end = query.size();
+        }
+        const std::string kv = query.substr(at, end - at);
+        const size_t eq = kv.find('=');
+        if (eq != std::string::npos) {
+            const std::string k = kv.substr(0, eq);
+            if (k == "pw" || k == "password" || k == "key") {
+                pw = http_url_decode(kv.substr(eq + 1));
+            }
+        }
+        at = end + 1;
+    }
+}
+
+}  // namespace
+
+// ------------------------------------------------------------- session
+
+bool RtmpSession::fail(const char *why)
+{
+    error_ = why;
+    state_ = RTMP_DEAD;
+    return false;
+}
+
+void RtmpSession::compact(void)
+{
+    if (in_pos_ == in_.size()) {
+        in_.clear();
+        in_pos_ = 0;
+    } else if (in_pos_ > 65536) {
+        in_.erase(in_.begin(), in_.begin() + long(in_pos_));
+        in_pos_ = 0;
+    }
+}
+
+std::string RtmpSession::path(void) const
+{
+    if (app_.empty()) {
+        return stream_;
+    }
+    if (stream_.empty()) {
+        return app_;
+    }
+    return app_ + "/" + stream_;
+}
+
+bool RtmpSession::feed(const uint8_t *buf, size_t n, time_t now)
+{
+    if (state_ == RTMP_DEAD) {
+        return false;
+    }
+    if (started_ == 0) {
+        started_ = now;
+    }
+    now_ = now;
+    total_in_ += n;
+    if (!publishing_
+        && (total_in_ > RTMP_PREPUBLISH_MAX_BYTES
+            || now - started_ > RTMP_PREPUBLISH_MAX_S)) {
+        return fail("did not publish in time");
+    }
+    if (n > 0) {
+        in_.insert(in_.end(), buf, buf + n);
+    }
+    return run_parser();
+}
+
+/*
+  Continue on bytes already buffered. Needed because parsing stops at
+  publish so the caller can authorise in order: whatever the publisher
+  pipelined behind it is still sitting in the input buffer, and without
+  this it would wait for a read that may never come.
+ */
+bool RtmpSession::resume(void)
+{
+    if (state_ == RTMP_DEAD) {
+        return false;
+    }
+    return run_parser();
+}
+
+bool RtmpSession::run_parser(void)
+{
+    while (true) {
+        const size_t before = in_pos_;
+        if (state_ == RTMP_WANT_C0C1 || state_ == RTMP_WANT_C2) {
+            if (!do_handshake()) {
+                return state_ != RTMP_DEAD;
+            }
+        } else if (state_ == RTMP_CHUNKS) {
+            if (!parse_chunks()) {
+                return state_ != RTMP_DEAD;
+            }
+        } else {
+            return false;
+        }
+        /*
+          Stop on publish. Media in the same read -- which a publisher
+          that does not wait for onStatus sends -- would otherwise be
+          parsed while publishing_ is still false and dropped by
+          on_media(), losing the sequence header and its parameter sets.
+         */
+        if (publish_pending_) {
+            break;
+        }
+        if (in_pos_ == before) {
+            break;              // no progress: need more bytes
+        }
+    }
+    compact();
+    return true;
+}
+
+/*
+  The simple handshake: S1 is a timestamp, a zero word and filler, and S2
+  echoes C1. No digest, because nothing here plays back to Flash.
+ */
+bool RtmpSession::do_handshake(void)
+{
+    if (state_ == RTMP_WANT_C0C1) {
+        if (avail() < 1537) {
+            return false;
+        }
+        const uint8_t *p = cur();
+        if (p[0] != 3) {
+            return fail("unsupported RTMP version");
+        }
+        std::vector<uint8_t> s;
+        s.reserve(1 + 1536 + 1536);
+        s.push_back(3);
+        // S1: zero time, zero, then filler. The peer only echoes it.
+        s.insert(s.end(), 1536, 0);
+        for (size_t i = 8; i < 1536; i++) {
+            s[1 + i] = uint8_t(i & 0xff);
+        }
+        s.insert(s.end(), p + 1, p + 1537);      // S2 echoes C1
+        to_peer_.insert(to_peer_.end(), s.begin(), s.end());
+        in_pos_ += 1537;
+        saw_c0c1_ = true;
+        state_ = RTMP_WANT_C2;
+        return true;
+    }
+    if (avail() < 1536) {
+        return false;
+    }
+    in_pos_ += 1536;            // C2, not validated
+    state_ = RTMP_CHUNKS;
+    return true;
+}
+
+bool RtmpSession::parse_chunks(void)
+{
+    const size_t start = in_pos_;
+    const uint8_t *p = in_.data();
+    size_t i = in_pos_;
+    const size_t end = in_.size();
+
+    if (i >= end) {
+        return false;
+    }
+    const uint8_t b0 = p[i];
+    const uint8_t fmt = uint8_t(b0 >> 6);
+    uint32_t csid = b0 & 0x3f;
+    size_t hdr = 1;
+    if (csid == 0) {
+        if (i + 2 > end) {
+            return false;
+        }
+        csid = 64 + p[i + 1];
+        hdr = 2;
+    } else if (csid == 1) {
+        if (i + 3 > end) {
+            return false;
+        }
+        csid = 64u + p[i + 1] + 256u * p[i + 2];
+        hdr = 3;
+    }
+    if (csid > RTMP_MAX_CHUNK_STREAM) {
+        return fail("chunk stream id out of range");
+    }
+    if (cs_.size() <= csid) {
+        cs_.resize(csid + 1);
+    }
+    ChunkStream &c = cs_[csid];
+
+    static const size_t mh[4] = { 11, 7, 3, 0 };
+    if (i + hdr + mh[fmt] > end) {
+        return false;
+    }
+    const uint8_t *h = p + i + hdr;
+
+    /*
+      Decode into locals and commit only once the whole chunk is here.
+
+      Committing as we go looked harmless because an incomplete chunk
+      leaves in_pos_ at the header and simply returns for more bytes --
+      but that means the next feed() re-parses the same header and
+      applies its timestamp delta a second time. Ordinary TCP
+      segmentation is enough to trigger it, no malformed input needed.
+     */
+    uint32_t new_ts = c.ts;
+    uint32_t new_delta = c.delta;
+    uint32_t new_len = c.len;
+    uint8_t new_type = c.type;
+    uint32_t new_sid = c.sid;
+    bool new_ext_ts = c.ext_ts;
+
+    uint32_t ts_field = c.ts;
+    if (fmt <= 2) {
+        ts_field = (uint32_t(h[0]) << 16) | (uint32_t(h[1]) << 8) | h[2];
+    }
+    if (fmt == 0) {
+        new_len = (uint32_t(h[3]) << 16) | (uint32_t(h[4]) << 8) | h[5];
+        new_type = h[6];
+        new_sid = uint32_t(h[7]) | (uint32_t(h[8]) << 8)
+                | (uint32_t(h[9]) << 16) | (uint32_t(h[10]) << 24);
+    } else if (fmt == 1) {
+        new_len = (uint32_t(h[3]) << 16) | (uint32_t(h[4]) << 8) | h[5];
+        new_type = h[6];
+    }
+    size_t pos = i + hdr + mh[fmt];
+
+    /*
+      An extended timestamp follows the header when the 24-bit field is
+      saturated. fmt 3 has no field of its own, so it repeats the
+      extension whenever the message it continues used one -- the usual
+      interop trap, and the reason ext_ts is remembered per chunk stream.
+     */
+    const bool want_ext = (fmt <= 2 && ts_field == 0xffffff)
+                       || (fmt == 3 && c.ext_ts);
+    uint32_t ext = 0;
+    if (want_ext) {
+        if (pos + 4 > end) {
+            return false;
+        }
+        ext = (uint32_t(p[pos]) << 24) | (uint32_t(p[pos + 1]) << 16)
+            | (uint32_t(p[pos + 2]) << 8) | p[pos + 3];
+        pos += 4;
+    }
+    if (fmt <= 2) {
+        new_ext_ts = (ts_field == 0xffffff);
+        const uint32_t t = new_ext_ts ? ext : ts_field;
+        if (fmt == 0) {
+            new_ts = t;
+            new_delta = 0;
+        } else {
+            new_delta = t;
+            new_ts = c.ts + t;
+        }
+    } else if (c.acc.empty()) {
+        // A fresh message on a fmt-3 header repeats the last delta.
+        new_ts = c.ts + c.delta;
+    }
+
+    if (new_len > RTMP_MAX_MESSAGE_BYTES) {
+        return fail("message too large");
+    }
+    /*
+      Only fmt 3 may continue a message. Anything else while this chunk
+      stream still owes bytes is a protocol violation -- and accepting
+      it silently spliced two wire messages into one, because the
+      length and type were replaced while the old payload stayed in the
+      accumulator. Abort Message is how a peer legitimately discards a
+      partial message; it is handled in on_message().
+     */
+    if (fmt != 3 && !c.acc.empty()) {
+        return fail("header restarts a message already in progress");
+    }
+    const size_t remaining = new_len - c.acc.size();
+    const size_t take = remaining < in_chunk_ ? remaining : in_chunk_;
+    if (pos + take > end) {
+        return false;           // wait for the rest of this chunk
+    }
+
+    if (assembly_bytes_ + take > RTMP_MAX_ASSEMBLY_BYTES) {
+        return fail("too many partial messages");
+    }
+
+    /*
+      Acknowledge once per window. A publisher that asked for a window
+      and never sees one is entitled to stop sending -- which presents
+      as a stream that runs for a while and then stalls, with nothing in
+      the log to say why.
+     */
+    bytes_in_ += (pos - i) + take;
+    if (ack_window_ != 0 && bytes_in_ - acked_ >= ack_window_) {
+        acked_ = bytes_in_;
+        const uint32_t seq = uint32_t(acked_ & 0xffffffffu);
+        const uint8_t ack[4] = {
+            uint8_t((seq >> 24) & 0xff), uint8_t((seq >> 16) & 0xff),
+            uint8_t((seq >> 8) & 0xff), uint8_t(seq & 0xff),
+        };
+        send_msg(2, 3, 0, ack, sizeof(ack));
+    }
+
+    // Whole chunk is buffered: now it is safe to advance the state.
+    c.ts = new_ts;
+    c.delta = new_delta;
+    c.len = new_len;
+    c.type = new_type;
+    c.sid = new_sid;
+    c.ext_ts = new_ext_ts;
+    c.acc.insert(c.acc.end(), p + pos, p + pos + take);
+    assembly_bytes_ += take;
+    pos += take;
+    in_pos_ = pos;
+
+    if (c.acc.size() >= c.len) {
+        std::vector<uint8_t> msg;
+        msg.swap(c.acc);
+        assembly_bytes_ -= msg.size();
+        if (!on_message(c, msg.data(), msg.size())) {
+            return false;
+        }
+    }
+    if (to_peer_.size() > RTMP_MAX_OUT_BYTES) {
+        return fail("peer is not reading its responses");
+    }
+    return in_pos_ > start;
+}
+
+bool RtmpSession::on_message(ChunkStream &c, const uint8_t *p, size_t n)
+{
+    switch (c.type) {
+    case 1:                     // Set Chunk Size
+        if (n < 4) {
+            return fail("short SetChunkSize");
+        }
+        {
+            const uint32_t v = ((uint32_t(p[0]) << 24) | (uint32_t(p[1]) << 16)
+                                | (uint32_t(p[2]) << 8) | p[3]) & 0x7fffffff;
+            if (v == 0 || v > RTMP_MAX_CHUNK_SIZE) {
+                return fail("bad chunk size");
+            }
+            in_chunk_ = v;
+        }
+        return true;
+    case 2:                     // Abort Message
+        /*
+          The peer discarding a partial message on a chunk stream. The
+          spec's way out of the state the check in parse_chunks()
+          otherwise treats as fatal.
+         */
+        if (n >= 4) {
+            const uint32_t id = (uint32_t(p[0]) << 24) | (uint32_t(p[1]) << 16)
+                              | (uint32_t(p[2]) << 8) | p[3];
+            if (id < cs_.size()) {
+                assembly_bytes_ -= cs_[id].acc.size();
+                cs_[id].acc.clear();
+            }
+        }
+        return true;
+    case 3:                     // Acknowledgement from the peer
+        return true;
+    case 5:                     // Window Acknowledgement Size
+        if (n >= 4) {
+            ack_window_ = (uint32_t(p[0]) << 24) | (uint32_t(p[1]) << 16)
+                        | (uint32_t(p[2]) << 8) | p[3];
+        }
+        return true;
+    case 6:                     // Set Peer Bandwidth
+        // Carries a window plus a limit type; the window is what we owe
+        // acknowledgements against.
+        if (n >= 4) {
+            ack_window_ = (uint32_t(p[0]) << 24) | (uint32_t(p[1]) << 16)
+                        | (uint32_t(p[2]) << 8) | p[3];
+        }
+        return true;
+    case 4:                     // User Control
+        if (n >= 2) {
+            const uint32_t ev = (uint32_t(p[0]) << 8) | p[1];
+            if (ev == 6 && n >= 6) {        // PingRequest
+                uint8_t pong[6] = { 0, 7, p[2], p[3], p[4], p[5] };
+                send_msg(2, 4, 0, pong, sizeof(pong));
+            }
+        }
+        return true;
+    case 8:                     // audio
+    case 9:                     // video
+    case 18:                    // AMF0 data (metadata)
+        on_media(c.type, c.ts, p, n);
+        return true;
+    case 20:                    // AMF0 command
+        return on_command(c, p, n);
+    case 17:                    // AMF3 command
+        return true;            // ignored; publishers use AMF0
+    default:
+        return true;
+    }
+}
+
+void RtmpSession::send_msg(uint8_t csid, uint8_t type, uint32_t sid,
+                           const uint8_t *p, size_t n, uint32_t ts)
+{
+    std::vector<uint8_t> &o = to_peer_;
+    o.push_back(csid);                     // fmt 0
+    o.push_back(uint8_t((ts >> 16) & 0xff));
+    o.push_back(uint8_t((ts >> 8) & 0xff));
+    o.push_back(uint8_t(ts & 0xff));
+    o.push_back(uint8_t((n >> 16) & 0xff));
+    o.push_back(uint8_t((n >> 8) & 0xff));
+    o.push_back(uint8_t(n & 0xff));
+    o.push_back(type);
+    o.push_back(uint8_t(sid & 0xff));
+    o.push_back(uint8_t((sid >> 8) & 0xff));
+    o.push_back(uint8_t((sid >> 16) & 0xff));
+    o.push_back(uint8_t((sid >> 24) & 0xff));
+    size_t at = 0;
+    while (at < n) {
+        if (at != 0) {
+            o.push_back(uint8_t(0xc0 | csid));
+        }
+        const size_t take = (n - at) < RTMP_OUT_CHUNK_SIZE
+            ? (n - at) : RTMP_OUT_CHUNK_SIZE;
+        o.insert(o.end(), p + at, p + at + take);
+        at += take;
+    }
+}
+
+void RtmpSession::send_amf(uint8_t csid, uint32_t sid,
+                           const std::vector<uint8_t> &b)
+{
+    send_msg(csid, 20, sid, b.data(), b.size());
+}
+
+bool RtmpSession::on_command(ChunkStream &c, const uint8_t *p, size_t n)
+{
+    size_t i = 0;
+    std::string cmd;
+    if (!amf_read_string(p, n, i, cmd)) {
+        return fail("unparseable command");
+    }
+    double txn = 0;
+    amf_read_number(p, n, i, txn);
+
+    if (cmd == "connect") {
+        /*
+          Once only. Repeating it is not a legal phase transition and
+          each one costs several responses, which is free amplification
+          for a peer that never reads them.
+         */
+        if (connected_) {
+            return fail("repeated connect");
+        }
+        connected_ = true;
+        std::string tc_url;
+        amf_object_strings(p, n, i, "app", app_, "tcUrl", tc_url);
+        split_credential(app_, password_);
+        if (password_.empty() && !tc_url.empty()) {
+            std::string ignored = tc_url;
+            std::string pw;
+            split_credential(ignored, pw);
+            password_ = pw;
+        }
+        // Window Ack Size, Set Peer Bandwidth, Stream Begin, chunk size.
+        const uint8_t win[4] = { 0x00, 0x26, 0x25, 0xa0 };
+        send_msg(2, 5, 0, win, sizeof(win));
+        const uint8_t bw[5] = { 0x00, 0x26, 0x25, 0xa0, 0x02 };
+        send_msg(2, 6, 0, bw, sizeof(bw));
+        const uint8_t begin[6] = { 0, 0, 0, 0, 0, 0 };
+        send_msg(2, 4, 0, begin, sizeof(begin));
+        const uint8_t cs[4] = {
+            uint8_t((RTMP_OUT_CHUNK_SIZE >> 24) & 0xff),
+            uint8_t((RTMP_OUT_CHUNK_SIZE >> 16) & 0xff),
+            uint8_t((RTMP_OUT_CHUNK_SIZE >> 8) & 0xff),
+            uint8_t(RTMP_OUT_CHUNK_SIZE & 0xff),
+        };
+        send_msg(2, 1, 0, cs, sizeof(cs));
+
+        std::vector<uint8_t> b;
+        amf_str(b, "_result");
+        amf_num(b, txn);
+        b.push_back(AMF_OBJECT);
+        amf_key(b, "fmsVer");
+        amf_str(b, "FMS/3,0,1,123");
+        amf_key(b, "capabilities");
+        amf_num(b, 31);
+        amf_obj_end(b);
+        b.push_back(AMF_OBJECT);
+        amf_key(b, "level");
+        amf_str(b, "status");
+        amf_key(b, "code");
+        amf_str(b, "NetConnection.Connect.Success");
+        amf_key(b, "description");
+        amf_str(b, "Connection succeeded.");
+        amf_key(b, "objectEncoding");
+        amf_num(b, 0);
+        amf_obj_end(b);
+        send_amf(3, 0, b);
+
+        std::vector<uint8_t> d;
+        amf_str(d, "onBWDone");
+        amf_num(d, 0);
+        amf_null(d);
+        amf_num(d, 8192);
+        send_amf(3, 0, d);
+        return true;
+    }
+
+    if (cmd == "releaseStream" || cmd == "FCUnpublish"
+        || cmd == "deleteStream" || cmd == "closeStream") {
+        if (cmd == "releaseStream") {
+            std::vector<uint8_t> b;
+            amf_str(b, "_result");
+            amf_num(b, txn);
+            amf_null(b);
+            send_amf(3, 0, b);
+            return true;
+        }
+        // A publisher tearing down: let the caller notice the close.
+        if (publishing_ && (cmd == "deleteStream" || cmd == "FCUnpublish")) {
+            return fail("publisher unpublished");
+        }
+        return true;
+    }
+
+    if (cmd == "FCPublish") {
+        std::string name;
+        size_t j = i;
+        amf_skip(p, n, j);              // command object, usually null
+        amf_read_string(p, n, j, name);
+        /*
+          The response ffmpeg gets wrong: it writes the command name and
+          stops. A camera that waits for the status object here simply
+          never publishes, which is the whole reason this file exists.
+         */
+        std::vector<uint8_t> b;
+        amf_str(b, "onFCPublish");
+        amf_num(b, 0);
+        amf_null(b);
+        b.push_back(AMF_OBJECT);
+        amf_key(b, "level");
+        amf_str(b, "status");
+        amf_key(b, "code");
+        amf_str(b, "NetStream.Publish.Start");
+        amf_key(b, "description");
+        amf_str(b, name.empty() ? "Publishing." : name.c_str());
+        amf_obj_end(b);
+        send_amf(3, 0, b);
+        return true;
+    }
+
+    if (cmd == "createStream") {
+        std::vector<uint8_t> b;
+        amf_str(b, "_result");
+        amf_num(b, txn);
+        amf_null(b);
+        amf_num(b, publish_sid_);
+        send_amf(3, 0, b);
+        return true;
+    }
+
+    if (cmd == "publish") {
+        if (publishing_ || publish_pending_) {
+            return fail("second publish on one connection");
+        }
+        if (!connected_) {
+            return fail("publish before connect");
+        }
+        std::string name;
+        size_t j = i;
+        amf_skip(p, n, j);              // command object
+        if (!amf_read_string(p, n, j, name)) {
+            return fail("publish without a stream name");
+        }
+        stream_ = name;
+        std::string pw;
+        split_credential(stream_, pw);
+        if (!pw.empty()) {
+            password_ = pw;
+        }
+        publish_txn_ = txn;
+        publish_sid_ = c.sid != 0 ? c.sid : 1;
+        publish_pending_ = true;
+        return true;            // the caller authorises, then answers
+    }
+
+    if (cmd == "play" || cmd == "play2") {
+        return fail("this port accepts publishers only");
+    }
+    return true;                // unknown commands are ignored
+}
+
+void RtmpSession::accept_publish(void)
+{
+    if (!publish_pending_) {
+        return;
+    }
+    publish_pending_ = false;
+    publishing_ = true;
+    publishing_since_ = now_ != 0 ? now_ : started_;
+
+    // Stream Begin for the publishing stream, then the status the
+    // client is waiting on.
+    uint8_t begin[6] = { 0, 0, 0, 0, 0, 0 };
+    begin[2] = uint8_t((publish_sid_ >> 24) & 0xff);
+    begin[3] = uint8_t((publish_sid_ >> 16) & 0xff);
+    begin[4] = uint8_t((publish_sid_ >> 8) & 0xff);
+    begin[5] = uint8_t(publish_sid_ & 0xff);
+    send_msg(2, 4, 0, begin, sizeof(begin));
+
+    std::vector<uint8_t> b;
+    amf_str(b, "onStatus");
+    amf_num(b, 0);
+    amf_null(b);
+    b.push_back(AMF_OBJECT);
+    amf_key(b, "level");
+    amf_str(b, "status");
+    amf_key(b, "code");
+    amf_str(b, "NetStream.Publish.Start");
+    amf_key(b, "description");
+    amf_str(b, stream_.empty() ? "Publishing."
+                               : (stream_ + " is now published.").c_str());
+    amf_key(b, "clientid");
+    amf_num(b, 1);
+    amf_obj_end(b);
+    send_msg(5, 20, publish_sid_, b.data(), b.size());
+
+    write_flv_header();
+}
+
+void RtmpSession::reject_publish(const char *code, const char *description)
+{
+    publish_pending_ = false;
+    std::vector<uint8_t> b;
+    amf_str(b, "onStatus");
+    amf_num(b, publish_txn_);
+    amf_null(b);
+    b.push_back(AMF_OBJECT);
+    amf_key(b, "level");
+    amf_str(b, "error");
+    amf_key(b, "code");
+    amf_str(b, code);
+    amf_key(b, "description");
+    amf_str(b, description);
+    amf_obj_end(b);
+    send_msg(5, 20, publish_sid_, b.data(), b.size());
+    error_ = description;
+    state_ = RTMP_DEAD;
+}
+
+// ----------------------------------------------------------------- FLV
+
+void RtmpSession::write_flv_header(void)
+{
+    if (flv_header_written_) {
+        return;
+    }
+    flv_header_written_ = true;
+    // "FLV", version 1, audio+video present, 9-byte header, then the
+    // zero PreviousTagSize the first tag follows.
+    static const uint8_t h[13] = {
+        'F', 'L', 'V', 0x01, 0x05, 0x00, 0x00, 0x00, 0x09,
+        0x00, 0x00, 0x00, 0x00,
+    };
+    to_flv_.insert(to_flv_.end(), h, h + sizeof(h));
+}
+
+void RtmpSession::write_flv_tag(uint8_t type, uint32_t ts,
+                                const uint8_t *p, size_t n)
+{
+    const size_t at = to_flv_.size();
+    to_flv_.push_back(type);
+    to_flv_.push_back(uint8_t((n >> 16) & 0xff));
+    to_flv_.push_back(uint8_t((n >> 8) & 0xff));
+    to_flv_.push_back(uint8_t(n & 0xff));
+    to_flv_.push_back(uint8_t((ts >> 16) & 0xff));
+    to_flv_.push_back(uint8_t((ts >> 8) & 0xff));
+    to_flv_.push_back(uint8_t(ts & 0xff));
+    to_flv_.push_back(uint8_t((ts >> 24) & 0xff));   // extended byte
+    to_flv_.push_back(0);
+    to_flv_.push_back(0);
+    to_flv_.push_back(0);
+    to_flv_.insert(to_flv_.end(), p, p + n);
+    const uint32_t tagsz = uint32_t(to_flv_.size() - at);
+    to_flv_.push_back(uint8_t((tagsz >> 24) & 0xff));
+    to_flv_.push_back(uint8_t((tagsz >> 16) & 0xff));
+    to_flv_.push_back(uint8_t((tagsz >> 8) & 0xff));
+    to_flv_.push_back(uint8_t(tagsz & 0xff));
+}
+
+void RtmpSession::on_media(uint8_t type, uint32_t ts,
+                           const uint8_t *p, size_t n)
+{
+    if (!publishing_ || n == 0) {
+        return;                 // pre-publish media is not ours to keep
+    }
+    if (type == 9 && vcodec_ == RTMP_VCODEC_NONE) {
+        /*
+          Legacy tag header: codec id in the low nibble, 7 being AVC.
+          Enhanced RTMP sets the high bit and carries a FourCC instead,
+          which is how HEVC arrives.
+         */
+        if ((p[0] & 0x80) == 0) {
+            vcodec_ = (p[0] & 0x0f) == 7 ? RTMP_VCODEC_H264
+                                         : RTMP_VCODEC_OTHER;
+        } else if (n >= 5) {
+            vcodec_ = memcmp(p + 1, "avc1", 4) == 0 ? RTMP_VCODEC_H264
+                                                    : RTMP_VCODEC_OTHER;
+        }
+    }
+    if (type == 18) {
+        /*
+          RTMP sends metadata as @setDataFrame("onMetaData", {...}); FLV
+          wants the onMetaData call on its own, so drop the wrapper.
+         */
+        static const char tag[] = "@setDataFrame";
+        const size_t skip = 3 + sizeof(tag) - 1;
+        if (n > skip && p[0] == AMF_STRING
+            && p[1] == 0 && p[2] == uint8_t(sizeof(tag) - 1)
+            && memcmp(p + 3, tag, sizeof(tag) - 1) == 0) {
+            p += skip;
+            n -= skip;
+        }
+    }
+    media_bytes_ += n;
+    write_flv_tag(type, ts, p, n);
+}
diff --git a/videortmp.h b/videortmp.h
new file mode 100644
index 0000000..7b0488c
--- /dev/null
+++ b/videortmp.h
@@ -0,0 +1,239 @@
+/*
+  Native RTMP publish ingest.
+
+  ffmpeg cannot be the RTMP server for real cameras. Its listener exists
+  to talk to its own client, so it answers FCPublish with a bare
+  "onFCPublish" -- the command name and nothing else, no transaction id,
+  no null, no status object -- and answers publish with nothing at all.
+  Measured against the Phoenix camera: the negotiation completes, ffmpeg
+  grants stream id 1, and the camera then waits 5 s for a response it can
+  parse and hangs up without sending a frame. A byte-identical exchange
+  reproduced against a local ffmpeg, and the same camera published 74 MB
+  to a server that answers properly, so the fault is not in the relay.
+
+  Linking libavformat instead of forking ffmpeg would not help: that is
+  the same rtmpproto.c on the wire.
+
+  So we speak RTMP ourselves -- handshake, chunk demux, and the six
+  commands a publisher uses -- and convert the media messages to FLV,
+  which ffmpeg is happy to demux from a pipe. That drops the loopback
+  port the splice needed, and with it the connect race and the TOCTOU
+  window on a multi-user host.
+
+  Only the publish direction is implemented. This is not an RTMP server:
+  it never plays, seeks or pauses, and a client that asks to is dropped.
+
+  An unauthorised peer drives this parser -- admission needs the password
+  out of connect/publish, which arrive after the handshake -- so the
+  pre-publish phase is bounded in both bytes and seconds, every length
+  from the wire is checked against what is actually buffered, and message
+  assembly is capped.
+ */
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+#include <time.h>
+
+#include <string>
+#include <vector>
+
+// What we announce, and the largest outbound chunk we write. Every
+// message we send is smaller, so outbound messages are single-chunk.
+#define RTMP_OUT_CHUNK_SIZE 4096
+
+// The protocol default until a peer says otherwise.
+#define RTMP_DEFAULT_CHUNK_SIZE 128
+
+// A publisher that has not reached publish inside these bounds is
+// dropped: until then it is unauthenticated.
+#define RTMP_PREPUBLISH_MAX_BYTES (256u * 1024)
+#define RTMP_PREPUBLISH_MAX_S 20
+
+// Largest single RTMP message we will assemble.
+#define RTMP_MAX_MESSAGE_BYTES (4u * 1024 * 1024)
+
+/*
+  Refuse a peer-announced chunk size above this. The spec allows up to
+  2^31-1, but a chunk has to be buffered whole before it can be parsed,
+  so honouring that would let three bytes from an unauthenticated peer
+  set the size of our input buffer. Real senders use 4 KiB (ffmpeg,
+  OBS) to 64 KiB.
+ */
+#define RTMP_MAX_CHUNK_SIZE (1u * 1024 * 1024)
+
+/*
+  Highest chunk stream id we keep state for. The 2-byte form can express
+  65599, and each one costs a ChunkStream, so the cap is what stops a
+  3-byte header allocating megabytes. Publishers use single digits.
+ */
+#define RTMP_MAX_CHUNK_STREAM 255
+
+/*
+  Total bytes held in partial messages across every chunk stream.
+
+  RTMP_MAX_MESSAGE_BYTES is per chunk stream, so without this a peer can
+  open one partial message on each of them and hold the product -- and
+  none of it completes, so the backend queue stays empty and nothing
+  downstream notices. Before publish the cumulative input limit covers
+  it; after publish only this does.
+ */
+#define RTMP_MAX_ASSEMBLY_BYTES (8u * 1024 * 1024)
+
+/*
+  Cap on responses owed to the peer. A client that stops reading while
+  still sending commands would otherwise turn its own bounded input into
+  unbounded memory here.
+ */
+#define RTMP_MAX_OUT_BYTES (256u * 1024)
+
+/*
+  A publisher that has been accepted but has not said what codec it is
+  sending by now is not going to. Until it does there is no backend and
+  no media, but it holds the slot -- and control messages alone keep
+  refreshing the idle timer.
+ */
+#define RTMP_CODEC_DEADLINE_S 15
+
+/*
+  Which video codec the publisher is sending, once a video tag has said
+  so. The backend needs this before it starts: ffmpeg's own AVCC to
+  Annex-B conversion emits a zero-length NAL unit ahead of each access
+  unit for this camera's stream shape (one NAL per frame, parameter sets
+  only in the sequence header). Chrome's MP4 parser rejects that --
+  "Failed to prepare video sample for decode" -- while Firefox tolerates
+  it. -bsf:v h264_metadata rewrites the units and removes them, but it
+  is H.264-only, so it must not be applied blind.
+ */
+enum rtmp_vcodec_t {
+    RTMP_VCODEC_NONE = 0,   // no video tag seen yet
+    RTMP_VCODEC_H264,
+    RTMP_VCODEC_OTHER,      // HEVC and friends, via enhanced RTMP
+};
+
+enum rtmp_state {
+    RTMP_WANT_C0C1 = 0,
+    RTMP_WANT_C2,
+    RTMP_CHUNKS,
+    RTMP_DEAD,
+};
+
+/*
+  One publisher's connection state.
+
+  feed() takes bytes off the socket and appends to two output buffers the
+  caller drains: to_peer() for RTMP responses, to_flv() for media. The
+  session never writes to a descriptor itself, so the caller keeps all
+  the backpressure and epoll logic it already has for the RTSP splice.
+ */
+class RtmpSession {
+public:
+    // Consume client bytes. False means the session is over.
+    bool feed(const uint8_t *buf, size_t n, time_t now);
+
+    /*
+      Continue on already-buffered bytes. feed() stops as soon as publish
+      arrives so the caller can authorise in order; call this once it
+      has, or anything the publisher pipelined behind publish sits
+      unparsed until the next read.
+     */
+    bool resume(void);
+
+    // True once the client has issued publish and been accepted.
+    bool publishing(void) const { return publishing_; }
+
+    /*
+      Set once publish arrives, before publishing() goes true: the caller
+      authorises the stream and then calls accept_publish() or reject().
+     */
+    bool publish_pending(void) const { return publish_pending_; }
+    const std::string &app(void) const { return app_; }
+    const std::string &stream(void) const { return stream_; }
+    const std::string &password(void) const { return password_; }
+
+    // "app/stream", for matching against a configured path.
+    std::string path(void) const;
+
+    void accept_publish(void);
+    void reject_publish(const char *code, const char *description);
+
+    std::vector<uint8_t> &to_peer(void) { return to_peer_; }
+    std::vector<uint8_t> &to_flv(void) { return to_flv_; }
+
+    uint64_t media_bytes(void) const { return media_bytes_; }
+    const char *error(void) const { return error_; }
+
+    // Set once the first video tag names a codec.
+    rtmp_vcodec_t video_codec(void) const { return vcodec_; }
+
+    // When publish was accepted, for the codec deadline. 0 until then.
+    time_t publishing_since(void) const { return publishing_since_; }
+
+private:
+    struct ChunkStream {
+        uint32_t ts = 0;            // absolute, after applying deltas
+        uint32_t delta = 0;         // last delta, reused by fmt 3
+        uint32_t len = 0;
+        uint8_t type = 0;
+        uint32_t sid = 0;
+        bool ext_ts = false;        // header carried an extended timestamp
+        std::vector<uint8_t> acc;   // partial message
+    };
+
+    rtmp_state state_ = RTMP_WANT_C0C1;
+    std::vector<uint8_t> in_;
+    size_t in_pos_ = 0;
+    std::vector<uint8_t> to_peer_;
+    std::vector<uint8_t> to_flv_;
+
+    uint32_t in_chunk_ = RTMP_DEFAULT_CHUNK_SIZE;
+    /*
+      Acknowledgement window the peer asked for, and how much we have
+      taken since the last acknowledgement we sent. A publisher that
+      sets a window and never sees a type-3 back is entitled to stop
+      sending, which shows up as a camera that streams for a while and
+      then stalls.
+     */
+    uint32_t ack_window_ = 0;
+    uint64_t bytes_in_ = 0;
+    uint64_t acked_ = 0;
+    std::vector<ChunkStream> cs_;   // indexed by chunk stream id
+
+    std::string app_;
+    std::string stream_;
+    std::string password_;
+    double publish_txn_ = 0;
+    uint32_t publish_sid_ = 1;
+    bool publishing_ = false;
+    bool publish_pending_ = false;
+    bool connected_ = false;        // connect already answered
+    time_t publishing_since_ = 0;
+    size_t assembly_bytes_ = 0;     // sum of every chunk stream's acc
+    rtmp_vcodec_t vcodec_ = RTMP_VCODEC_NONE;
+    bool flv_header_written_ = false;
+    bool saw_c0c1_ = false;
+    time_t started_ = 0;
+    time_t now_ = 0;            // last time seen by feed()
+    uint64_t total_in_ = 0;
+    uint64_t media_bytes_ = 0;
+    const char *error_ = "";
+
+    bool run_parser(void);
+    bool fail(const char *why);
+    void compact(void);
+    size_t avail(void) const { return in_.size() - in_pos_; }
+    const uint8_t *cur(void) const { return in_.data() + in_pos_; }
+
+    bool do_handshake(void);
+    bool parse_chunks(void);
+    bool on_message(ChunkStream &c, const uint8_t *p, size_t n);
+    bool on_command(ChunkStream &c, const uint8_t *p, size_t n);
+    void on_media(uint8_t type, uint32_t ts, const uint8_t *p, size_t n);
+
+    void send_msg(uint8_t csid, uint8_t type, uint32_t sid,
+                  const uint8_t *p, size_t n, uint32_t ts = 0);
+    void send_amf(uint8_t csid, uint32_t sid, const std::vector<uint8_t> &b);
+    void write_flv_header(void);
+    void write_flv_tag(uint8_t type, uint32_t ts,
+                       const uint8_t *p, size_t n);
+};
diff --git a/videortsp.cpp b/videortsp.cpp
new file mode 100644
index 0000000..248c2de
--- /dev/null
+++ b/videortsp.cpp
@@ -0,0 +1,372 @@
+/*
+  RTSP ingest by splicing to a loopback ffmpeg. See videortsp.h.
+ */
+#include "videortsp.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/prctl.h>
+#include <sys/resource.h>
+#include <sys/syscall.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+RtspBackend::~RtspBackend(void)
+{
+    stop();
+}
+
+int RtspBackend::pick_loopback_port(void)
+{
+    const int s = socket(AF_INET, SOCK_STREAM, 0);
+    if (s < 0) {
+        return -1;
+    }
+    struct sockaddr_in a {};
+    a.sin_family = AF_INET;
+    a.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+    a.sin_port = 0;
+    if (bind(s, (struct sockaddr *)&a, sizeof(a)) != 0) {
+        ::close(s);
+        return -1;
+    }
+    socklen_t alen = sizeof(a);
+    if (getsockname(s, (struct sockaddr *)&a, &alen) != 0) {
+        ::close(s);
+        return -1;
+    }
+    const int port = ntohs(a.sin_port);
+    ::close(s);
+    return port;
+}
+
+const char *splice_proto_name(splice_proto_t p)
+{
+    return p == SPLICE_RTMP ? "RTMP" : "RTSP";
+}
+
+bool RtspBackend::start(int port2, int slot, bool want_audio,
+                        splice_proto_t proto, const char *vbsf)
+{
+    port2_ = port2;
+    slot_ = slot;
+    proto_ = proto;
+
+    // RTSP splices into a loopback listener; RTMP is fed FLV on stdin.
+    int lport = 0;
+    if (proto == SPLICE_RTSP) {
+        lport = pick_loopback_port();
+        if (lport <= 0) {
+            printf("[%d] video slot %d: no loopback port for the RTSP "
+                   "backend\n", port2_, slot_);
+            return false;
+        }
+    }
+
+    int media[2] = { -1, -1 };
+    if (pipe(media) != 0) {
+        printf("[%d] video slot %d: pipe failed - %s\n",
+               port2_, slot_, strerror(errno));
+        return false;
+    }
+    /*
+      A socketpair rather than a pipe: the caller pushes FLV through the
+      same queue it uses for the RTSP splice, and that writes with
+      send(MSG_NOSIGNAL), which fails ENOTSOCK on a pipe. The child sees
+      it as fd 0 either way.
+     */
+    int feed[2] = { -1, -1 };
+    if (proto == SPLICE_RTMP
+        && socketpair(AF_UNIX, SOCK_STREAM, 0, feed) != 0) {
+        ::close(media[0]);
+        ::close(media[1]);
+        printf("[%d] video slot %d: socketpair failed - %s\n",
+               port2_, slot_, strerror(errno));
+        return false;
+    }
+
+    char url[128];
+    if (proto == SPLICE_RTMP) {
+        snprintf(url, sizeof(url), "pipe:0");
+    } else {
+        snprintf(url, sizeof(url), "rtsp://127.0.0.1:%d/", lport);
+    }
+
+    const pid_t pid = fork();
+    if (pid < 0) {
+        ::close(media[0]);
+        ::close(media[1]);
+        if (feed[0] >= 0) {
+            ::close(feed[0]);
+            ::close(feed[1]);
+        }
+        printf("[%d] video slot %d: fork failed - %s\n",
+               port2_, slot_, strerror(errno));
+        return false;
+    }
+    if (pid == 0) {
+        // die with us rather than lingering on a crash
+        prctl(PR_SET_PDEATHSIG, SIGTERM);
+        if (getppid() == 1) {
+            _exit(0);
+        }
+        /*
+          The backend parses SDP, RTP and codec bitstreams from a peer
+          we have only address-authorised. Fixed argv stops shell
+          injection; these stop a parser bug from becoming worse.
+         */
+        prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        struct rlimit rl {};
+        rl.rlim_cur = rl.rlim_max = RTSP_BACKEND_MEM_BYTES;
+        setrlimit(RLIMIT_AS, &rl);
+        rl.rlim_cur = rl.rlim_max = RTSP_BACKEND_CPU_SECONDS;
+        setrlimit(RLIMIT_CPU, &rl);
+        /*
+          Deliberately no RLIMIT_NPROC. It bounds processes and threads
+          per *UID*, not per process, so a small value is instantly
+          exceeded by whatever else the account is already running --
+          ffmpeg then fails at pthread_create and produces no output at
+          all. It is the wrong tool for sandboxing one child.
+         */
+
+        /*
+          Unchecked, a failed dup2 would leave the child running with
+          our stdout -- writing MPEG-TS into the proxy's log. Die
+          instead; the parent sees the exit and reports it.
+         */
+        ::close(media[0]);
+        if (dup2(media[1], STDOUT_FILENO) == -1) {
+            _exit(126);
+        }
+        ::close(media[1]);
+        if (proto == SPLICE_RTMP) {
+            ::close(feed[1]);
+            if (dup2(feed[0], STDIN_FILENO) == -1) {
+                _exit(126);
+            }
+            ::close(feed[0]);
+        } else {
+            const int devnull = open("/dev/null", O_RDONLY);
+            if (devnull >= 0) {
+                if (dup2(devnull, STDIN_FILENO) == -1) {
+                    _exit(126);
+                }
+                ::close(devnull);
+            }
+        }
+
+        /*
+          Drop every other inherited descriptor.
+
+          Without this the backend keeps the accepted publisher socket
+          open -- visible in ss as ffmpeg and supportproxy both holding
+          the same public connection. The damage is not the leak itself
+          but that the socket never fully closes, so ffmpeg never sees
+          the end of its input, never exits, and running() stays true --
+          which refuses every later publisher on that slot as slot-busy
+          until the child is killed by hand.
+         */
+#ifdef SYS_close_range
+        if (syscall(SYS_close_range, 3, ~0U, 0) != 0)
+#endif
+        {
+            /*
+              Close up to the real limit, not 4096. The old bound only
+              applied when RLIMIT_NOFILE was under 65536, so on a host
+              with a high limit every descriptor above 4095 survived --
+              which is the case this loop exists to cover.
+             */
+            struct rlimit nof {};
+            long maxfd = 4096;
+            if (getrlimit(RLIMIT_NOFILE, &nof) == 0
+                && nof.rlim_cur != RLIM_INFINITY) {
+                maxfd = long(nof.rlim_cur);
+            } else {
+                const long n = sysconf(_SC_OPEN_MAX);
+                maxfd = (n > 0) ? n : 65536;
+            }
+            for (int f = 3; f < maxfd; f++) {
+                ::close(f);
+            }
+        }
+
+        /*
+          -an by default: audio is rarely useful from an aircraft, and
+          dropping it keeps the muxed stream video-only. With audio on,
+          it must be re-encoded -- pcm_s16be cannot be carried in
+          MPEG-TS at all (ffmpeg emits it as private data that probes
+          back as bin_data), so "copy" would silently destroy it.
+         */
+        const char *audio1 = want_audio ? "-c:a" : "-an";
+        const char *audio2 = want_audio ? "aac" : nullptr;
+
+        const char *argv[40];
+        int n = 0;
+        argv[n++] = "ffmpeg";
+        argv[n++] = "-hide_banner";
+        argv[n++] = "-nostdin";
+        argv[n++] = "-loglevel";
+        argv[n++] = "warning";
+        if (proto == SPLICE_RTMP) {
+            // live_flv rather than flv: the stream never ends, and the
+            // plain flv demuxer waits for a file it will never see.
+            // No -timeout: that is a socket option, and this is a pipe.
+            argv[n++] = "-protocol_whitelist";
+            argv[n++] = "file,pipe";
+            argv[n++] = "-f";
+            argv[n++] = "live_flv";
+        } else {
+            argv[n++] = "-protocol_whitelist";
+            argv[n++] = "file,rtp,udp,tcp";
+            argv[n++] = "-rtsp_flags";
+            argv[n++] = "listen";
+            argv[n++] = "-rtsp_transport";
+            argv[n++] = "tcp";
+            argv[n++] = "-timeout";
+            argv[n++] = "10000000";
+        }
+        argv[n++] = "-i";
+        argv[n++] = url;
+        argv[n++] = "-map";
+        argv[n++] = "0";
+        argv[n++] = "-c:v";
+        argv[n++] = "copy";
+        if (vbsf != nullptr && vbsf[0] != '\0') {
+            argv[n++] = "-bsf:v";
+            argv[n++] = vbsf;
+        }
+        argv[n++] = audio1;
+        if (audio2 != nullptr) {
+            argv[n++] = audio2;
+        }
+        /*
+          Live output, so do not let the muxer sit on data. The default
+          32 KiB AVIO buffer is most of a second at this camera's ~0.4
+          Mbit/s, and muxdelay/muxpreload add their own offset on top.
+          Measured as part of the join-to-live delay.
+         */
+        argv[n++] = "-muxdelay";
+        argv[n++] = "0";
+        argv[n++] = "-muxpreload";
+        argv[n++] = "0";
+        argv[n++] = "-flush_packets";
+        argv[n++] = "1";
+        argv[n++] = "-f";
+        argv[n++] = "mpegts";
+        argv[n++] = "pipe:1";
+        argv[n] = nullptr;
+
+        execvp("ffmpeg", const_cast<char *const *>(argv));
+        // Only reached if ffmpeg is missing.
+        _exit(127);
+    }
+
+    ::close(media[1]);
+    pid_ = pid;
+    media_fd_ = media[0];
+    fcntl(media_fd_, F_SETFL, fcntl(media_fd_, F_GETFL, 0) | O_NONBLOCK);
+
+    if (proto == SPLICE_RTMP) {
+        ::close(feed[0]);
+        backend_fd_ = feed[1];
+        fcntl(backend_fd_, F_SETFL,
+              fcntl(backend_fd_, F_GETFL, 0) | O_NONBLOCK);
+        printf("[%d] video slot %d RTMP backend pid %d (FLV on stdin, "
+               "bsf %s)\n", port2_, slot_, int(pid_),
+               (vbsf != nullptr && vbsf[0] != '\0') ? vbsf : "none");
+        return true;
+    }
+
+    // Retry-connect until the backend's listener is up. It bound the
+    // port after we picked it, so a short race is expected.
+    const int step_ms = 20;
+    for (int waited = 0; waited < RTSP_BACKEND_READY_MS; waited += step_ms) {
+        const int s = socket(AF_INET, SOCK_STREAM, 0);
+        if (s < 0) {
+            break;
+        }
+        struct sockaddr_in a {};
+        a.sin_family = AF_INET;
+        a.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+        a.sin_port = htons(uint16_t(lport));
+        if (connect(s, (struct sockaddr *)&a, sizeof(a)) == 0) {
+            int one = 1;
+            setsockopt(s, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one));
+            fcntl(s, F_SETFL, fcntl(s, F_GETFL, 0) | O_NONBLOCK);
+            backend_fd_ = s;
+            printf("[%d] video slot %d RTSP backend pid %d on 127.0.0.1:%d\n",
+                   port2_, slot_, int(pid_), lport);
+            return true;
+        }
+        ::close(s);
+        if (reap()) {
+            printf("[%d] video slot %d: RTSP backend exited before it "
+                   "listened (is ffmpeg installed?)\n", port2_, slot_);
+            stop();
+            return false;
+        }
+        struct timespec ts { 0, step_ms * 1000000L };
+        nanosleep(&ts, nullptr);
+    }
+    printf("[%d] video slot %d: RTSP backend never became connectable\n",
+           port2_, slot_);
+    stop();
+    return false;
+}
+
+bool RtspBackend::reap(void)
+{
+    if (pid_ <= 0) {
+        return true;
+    }
+    int status = 0;
+    const pid_t r = waitpid(pid_, &status, WNOHANG);
+    if (r == pid_) {
+        if (WIFEXITED(status) && WEXITSTATUS(status) == 127) {
+            printf("[%d] video slot %d: ffmpeg not found; RTSP ingest needs "
+                   "it installed\n", port2_, slot_);
+        }
+        pid_ = -1;
+        return true;
+    }
+    if (r < 0 && errno == ECHILD) {
+        pid_ = -1;
+        return true;
+    }
+    return false;
+}
+
+void RtspBackend::stop(void)
+{
+    if (backend_fd_ >= 0) {
+        ::close(backend_fd_);
+        backend_fd_ = -1;
+    }
+    if (media_fd_ >= 0) {
+        ::close(media_fd_);
+        media_fd_ = -1;
+    }
+    if (pid_ > 0) {
+        kill(pid_, SIGTERM);
+        // Give it a moment to go on its own, then insist.
+        for (int i = 0; i < 50; i++) {
+            if (reap()) {
+                return;
+            }
+            struct timespec ts { 0, 10 * 1000000L };
+            nanosleep(&ts, nullptr);
+        }
+        kill(pid_, SIGKILL);
+        int status = 0;
+        waitpid(pid_, &status, 0);
+        pid_ = -1;
+    }
+}
diff --git a/videortsp.h b/videortsp.h
new file mode 100644
index 0000000..2ee8bd2
--- /dev/null
+++ b/videortsp.h
@@ -0,0 +1,108 @@
+/*
+  RTSP and RTMP ingest, by splicing to a loopback ffmpeg.
+
+  SupportProxy parses no RTSP at all. It keeps the public port, does the
+  admission check on the source address, then hands the connection --
+  untouched, from its very first byte -- to an ffmpeg bound on
+  127.0.0.1, and reads MPEG-TS back from its stdout.
+
+  The spike established why it has to work this way. RTSP is
+  request/response, so waiting to see ANNOUNCE before classifying
+  deadlocks: the publisher sends OPTIONS and waits for a reply that
+  never comes. Answering OPTIONS ourselves fails differently -- ffmpeg's
+  listener requires the first request it sees to be CSeq 1, so it
+  rejects an ANNOUNCE numbered 2. Splicing from byte zero sidesteps
+  both: ffmpeg sees the whole exchange, starting at CSeq 1.
+
+  Consequence, and the reason RTSP *egress* is a separate phase: with no
+  RTSP parsing we cannot tell a publisher from a viewer, so an RTSP
+  connection to a video port is treated as a publisher.
+
+  A native RTP depacketiser plus TS muxer was measured at ~2300-3000
+  lines against ~150 for this, would still not carry the PCM audio the
+  Phoenix camera sends, and an H.264-only cut would not even cover the
+  workload (one of the two real streams is HEVC).
+
+  RTMP does not splice. ffmpeg's RTMP listener answers a real camera
+  badly enough that it never sends a frame (see videortmp.h), so
+  SupportProxy speaks RTMP itself and hands the backend FLV on stdin.
+  The backend is still an ffmpeg child with the same sandbox; only the
+  input side differs, and RTMP needs no loopback port at all.
+ */
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+#include <sys/types.h>
+#include <time.h>
+
+#include <string>
+
+// Give up if the backend has not become connectable in this long.
+#define RTSP_BACKEND_READY_MS 3000
+
+// Resource limits applied to the backend: it parses untrusted SDP, RTP
+// and codec bitstreams, and fixed argv only stops shell injection, not
+// a bug in those parsers. Note RLIMIT_NPROC is *not* among them -- it
+// is per-UID rather than per-process, so it breaks the child without
+// bounding anything useful.
+#define RTSP_BACKEND_MEM_BYTES (512u * 1024 * 1024)
+#define RTSP_BACKEND_CPU_SECONDS 3600
+
+enum splice_proto_t {
+    SPLICE_RTSP = 0,
+    SPLICE_RTMP,
+};
+
+const char *splice_proto_name(splice_proto_t p);
+
+class RtspBackend {
+public:
+    ~RtspBackend(void);
+
+    /*
+      Launch ffmpeg. For RTSP it also connects to the backend's loopback
+      listener; for RTMP the backend reads FLV from a pipe we own, so
+      there is nothing to connect to. Returns false if it could not be
+      started.
+     */
+    /*
+      `vbsf`, when set, is a video bitstream filter applied on the way
+      through -- h264_metadata for RTMP H.264, which rewrites the NAL
+      units and drops the zero-length one ffmpeg's own AVCC to Annex-B
+      conversion emits for some cameras. It is codec-specific, so the
+      caller must know the codec before passing it.
+     */
+    bool start(int port2, int slot, bool want_audio,
+               splice_proto_t proto = SPLICE_RTSP,
+               const char *vbsf = nullptr);
+
+    splice_proto_t proto(void) const { return proto_; }
+
+    bool running(void) const { return pid_ > 0; }
+
+    /*
+      Where the publisher's bytes go: a socket spliced with the client
+      for RTSP, the write end of the backend's stdin for RTMP. Only the
+      RTSP one is readable.
+     */
+    int backend_fd(void) const { return backend_fd_; }
+    bool backend_readable(void) const { return proto_ == SPLICE_RTSP; }
+    int media_fd(void) const { return media_fd_; }
+    pid_t pid(void) const { return pid_; }
+
+    // Reap if the child has exited. Returns true if it is now gone.
+    bool reap(void);
+
+    void stop(void);
+
+private:
+    pid_t pid_ = -1;
+    int backend_fd_ = -1;   // RTSP control/data, spliced with the client
+    int media_fd_ = -1;     // ffmpeg stdout: MPEG-TS
+    int port2_ = 0;
+    int slot_ = 0;
+    splice_proto_t proto_ = SPLICE_RTSP;
+
+    static int pick_loopback_port(void);
+};
diff --git a/videostream.cpp b/videostream.cpp
new file mode 100644
index 0000000..7644208
--- /dev/null
+++ b/videostream.cpp
@@ -0,0 +1,178 @@
+/*
+  Per-slot stream buffering. See videostream.h.
+ */
+#include "videostream.h"
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+size_t video_ring_bytes(void)
+{
+    static size_t cached = 0;
+    if (cached == 0) {
+        cached = VIDEO_RING_DEFAULT;
+        const char *env = getenv("SUPPORTPROXY_VIDEO_RING_BYTES");
+        if (env != nullptr && *env != '\0') {
+            char *endp = nullptr;
+            errno = 0;
+            long long v = strtoll(env, &endp, 10);
+            if (errno == 0 && endp != env && *endp == '\0' && v > 0) {
+                cached = size_t(v);
+            }
+        }
+    }
+    return cached;
+}
+
+bool VideoRing::init(size_t bytes)
+{
+    if (bytes < 4096) {
+        bytes = 4096;
+    }
+    buf_.assign(bytes, 0);
+    write_pos_ = 0;
+    return true;
+}
+
+void VideoRing::write(const uint8_t *buf, size_t n)
+{
+    const size_t cap = buf_.size();
+    if (cap == 0 || n == 0) {
+        return;
+    }
+    if (n >= cap) {
+        // Only the tail can survive; skip the part that would be
+        // overwritten before this call even returned.
+        buf += n - cap;
+        write_pos_ += n - cap;
+        n = cap;
+    }
+    const size_t start = size_t(write_pos_ % cap);
+    const size_t first = (cap - start) < n ? (cap - start) : n;
+    memcpy(&buf_[start], buf, first);
+    if (n > first) {
+        memcpy(&buf_[0], buf + first, n - first);
+    }
+    write_pos_ += n;
+}
+
+uint64_t VideoRing::oldest(void) const
+{
+    const size_t cap = buf_.size();
+    return write_pos_ > cap ? write_pos_ - cap : 0;
+}
+
+bool VideoRing::resident(uint64_t pos) const
+{
+    return pos >= oldest() && pos <= write_pos_;
+}
+
+size_t VideoRing::read_at(uint64_t pos, uint8_t *out, size_t n) const
+{
+    const size_t cap = buf_.size();
+    if (cap == 0 || !resident(pos)) {
+        return 0;
+    }
+    const uint64_t avail64 = write_pos_ - pos;
+    const size_t avail = avail64 > n ? n : size_t(avail64);
+    if (avail == 0) {
+        return 0;
+    }
+    const size_t start = size_t(pos % cap);
+    const size_t first = (cap - start) < avail ? (cap - start) : avail;
+    memcpy(out, &buf_[start], first);
+    if (avail > first) {
+        memcpy(out + first, &buf_[0], avail - first);
+    }
+    return avail;
+}
+
+// ----------------------------------------------------------- selftest
+
+#define RCHECK(cond, msg) do {                                  \
+        if (!(cond)) {                                          \
+            printf("videostream selftest FAIL: %s\n", msg);     \
+            return 1;                                           \
+        }                                                       \
+    } while (0)
+
+int videostream_selftest(void)
+{
+    // basic append and read-back
+    {
+        VideoRing r;
+        r.init(4096);
+        uint8_t in[300];
+        for (size_t i = 0; i < sizeof(in); i++) {
+            in[i] = uint8_t(i);
+        }
+        r.write(in, sizeof(in));
+        RCHECK(r.write_pos() == 300, "write_pos advanced");
+        RCHECK(r.oldest() == 0, "nothing evicted yet");
+        uint8_t out[300] {};
+        RCHECK(r.read_at(0, out, sizeof(out)) == 300, "read back all");
+        RCHECK(memcmp(in, out, sizeof(in)) == 0, "bytes match");
+        // a partial read from the middle
+        RCHECK(r.read_at(100, out, 50) == 50, "partial read");
+        RCHECK(memcmp(out, in + 100, 50) == 0, "partial bytes match");
+    }
+
+    // wrap: the ring must stay byte-exact across the seam
+    {
+        VideoRing r;
+        r.init(4096);
+        uint8_t chunk[1000];
+        for (int pass = 0; pass < 10; pass++) {
+            for (size_t i = 0; i < sizeof(chunk); i++) {
+                chunk[i] = uint8_t(pass * 31 + i);
+            }
+            r.write(chunk, sizeof(chunk));
+        }
+        RCHECK(r.write_pos() == 10000, "wrapped write_pos");
+        RCHECK(r.oldest() == 10000 - 4096, "oldest tracks eviction");
+        RCHECK(!r.resident(0), "evicted offset is not resident");
+        RCHECK(r.resident(r.oldest()), "oldest is resident");
+
+        // the last chunk must read back exactly, spanning the seam
+        uint8_t out[1000] {};
+        RCHECK(r.read_at(9000, out, 1000) == 1000, "read last chunk");
+        for (size_t i = 0; i < sizeof(out); i++) {
+            RCHECK(out[i] == uint8_t(9 * 31 + i), "wrapped bytes match");
+        }
+    }
+
+    // a write larger than the ring keeps the tail, not the head
+    {
+        VideoRing r;
+        r.init(4096);
+        std::vector<uint8_t> big(10000);
+        for (size_t i = 0; i < big.size(); i++) {
+            big[i] = uint8_t(i);
+        }
+        r.write(big.data(), big.size());
+        RCHECK(r.write_pos() == 10000, "oversized write advances fully");
+        RCHECK(r.oldest() == 10000 - 4096, "oversized write evicts");
+        uint8_t out[16] {};
+        RCHECK(r.read_at(10000 - 16, out, 16) == 16, "tail readable");
+        for (size_t i = 0; i < 16; i++) {
+            RCHECK(out[i] == uint8_t(10000 - 16 + i), "tail bytes are the tail");
+        }
+    }
+
+    // reading an evicted position must fail rather than return garbage
+    {
+        VideoRing r;
+        r.init(4096);
+        uint8_t chunk[5000] {};
+        r.write(chunk, sizeof(chunk));
+        uint8_t out[16] {};
+        RCHECK(r.read_at(0, out, sizeof(out)) == 0, "evicted read returns 0");
+        RCHECK(r.read_at(r.write_pos() + 1, out, sizeof(out)) == 0,
+               "future read returns 0");
+    }
+
+    printf("videostream selftest: OK\n");
+    return 0;
+}
diff --git a/videostream.h b/videostream.h
new file mode 100644
index 0000000..b8a38f1
--- /dev/null
+++ b/videostream.h
@@ -0,0 +1,66 @@
+/*
+  Per-slot stream buffering.
+
+  The publisher's bytes go into a ring and nothing else happens to them:
+  fan-out and recording both hand out the original bytes, so the write
+  path must never block, allocate, or look at viewer state. That is what
+  makes "one slow viewer cannot stall the publisher or the others" true
+  by construction rather than by care.
+
+  Positions are absolute stream offsets, not indices, so a viewer that
+  falls behind is detected by arithmetic (write_pos - read_pos > size)
+  rather than by trying to reason about wrap.
+ */
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+#include <vector>
+
+// Default ring size. The rule that matters is
+//   ring >= 2 * GOP_seconds * bitrate
+// or a late viewer has no random access point to start from. Measured
+// on the Phoenix camera: ~4 s GOP at ~2.45 Mbit/s, so 8 MiB holds about
+// 26 s -- roughly six GOPs. A higher-bitrate publisher with a long GOP
+// needs the rule applied, not this constant.
+#define VIDEO_RING_DEFAULT (8u * 1024 * 1024)
+
+// Ring size actually used, honouring SUPPORTPROXY_VIDEO_RING_BYTES.
+// Overridable because lapping a viewer is otherwise only reachable by
+// pushing megabytes through a test.
+size_t video_ring_bytes(void);
+
+class VideoRing {
+public:
+    bool init(size_t bytes);
+
+    // Append. Never blocks and never fails; the oldest bytes are simply
+    // overwritten. A write larger than the ring keeps only its tail.
+    void write(const uint8_t *buf, size_t n);
+
+    uint64_t write_pos(void) const { return write_pos_; }
+    size_t capacity(void) const { return buf_.size(); }
+
+    // Earliest offset still held.
+    uint64_t oldest(void) const;
+
+    // True if `pos` is still resident (and not in the future).
+    bool resident(uint64_t pos) const;
+
+    // Copy up to `n` bytes from `pos`. Returns how many were copied,
+    // which is 0 if `pos` has already been overwritten.
+    size_t read_at(uint64_t pos, uint8_t *out, size_t n) const;
+
+    // Drop everything held and restart the offset space at 0.
+    //
+    // Only safe with no viewers attached: they hold absolute offsets,
+    // and rewinding write_pos_ under one would make its position look
+    // like the far future. The caller drops viewers first.
+    void reset(void) { write_pos_ = 0; }
+
+private:
+    std::vector<uint8_t> buf_;
+    uint64_t write_pos_ = 0;
+};
+
+int videostream_selftest(void);
diff --git a/videots.cpp b/videots.cpp
new file mode 100644
index 0000000..00e27d6
--- /dev/null
+++ b/videots.cpp
@@ -0,0 +1,842 @@
+/*
+  MPEG-TS scanner. See videots.h for what it is for.
+
+  Every multi-byte field is assembled a byte at a time. Casting a packet
+  buffer to a wider integer is undefined for an unaligned address and
+  trips -Wcast-align, and packet buffers are never aligned in general.
+ */
+#include "videots.h"
+
+#include <string.h>
+#include <vector>
+
+// ---------------------------------------------------------------- CRC
+
+static uint32_t crc_table[256];
+static bool crc_table_built = false;
+
+static void build_crc_table(void)
+{
+    for (uint32_t i = 0; i < 256; i++) {
+        uint32_t c = i << 24;
+        for (int k = 0; k < 8; k++) {
+            c = (c & 0x80000000u) ? ((c << 1) ^ 0x04C11DB7u) : (c << 1);
+        }
+        crc_table[i] = c;
+    }
+    crc_table_built = true;
+}
+
+uint32_t ts_crc32(const uint8_t *data, size_t n)
+{
+    if (!crc_table_built) {
+        build_crc_table();
+    }
+    uint32_t crc = 0xFFFFFFFFu;
+    for (size_t i = 0; i < n; i++) {
+        crc = (crc << 8) ^ crc_table[((crc >> 24) ^ data[i]) & 0xFF];
+    }
+    return crc;
+}
+
+// ------------------------------------------------------- PSIAssembler
+
+const uint8_t *PSIAssembler::feed(const uint8_t *payload, size_t n, bool pusi,
+                                  size_t &out_len, uint64_t &crc_errors)
+{
+    if (n == 0) {
+        return nullptr;
+    }
+    if (pusi) {
+        // A unit start carries a pointer_field: the number of bytes of
+        // the *previous* section still to come before this one starts.
+        const uint8_t ptr = payload[0];
+        if (size_t(ptr) + 1 > n) {
+            reset();
+            return nullptr;
+        }
+        payload += 1 + ptr;
+        n -= 1 + ptr;
+        len_ = 0;
+        active_ = true;
+        want_ = 0;
+    } else if (!active_) {
+        // Continuation with no section open: nothing to append to.
+        return nullptr;
+    }
+
+    if (n == 0) {
+        return nullptr;
+    }
+    const size_t space = sizeof(buf_) - len_;
+    const size_t take = n < space ? n : space;
+    memcpy(buf_ + len_, payload, take);
+    len_ += take;
+
+    if (want_ == 0) {
+        if (len_ < 3) {
+            return nullptr;
+        }
+        // section_length is 12 bits and excludes the 3 bytes before it
+        want_ = (size_t(buf_[1] & 0x0F) << 8 | buf_[2]) + 3;
+        if (want_ > sizeof(buf_) || want_ < 4) {
+            reset();
+            return nullptr;
+        }
+    }
+    if (len_ < want_) {
+        return nullptr;
+    }
+
+    const size_t seclen = want_;
+    active_ = false;
+    len_ = 0;
+    want_ = 0;
+
+    // The trailing 4 bytes are the CRC, and it covers everything before
+    // them. A section that fails is dropped: acting on a corrupt PMT
+    // would point the scanner at the wrong PID.
+    if (ts_crc32(buf_, seclen) != 0) {
+        crc_errors++;
+        return nullptr;
+    }
+    out_len = seclen;
+    return buf_;
+}
+
+// ------------------------------------------------------ random access
+
+bool ts_payload_is_random_access(const uint8_t *p, size_t n,
+                                 uint8_t stream_type)
+{
+    if (stream_type != TS_STREAM_H264 && stream_type != TS_STREAM_HEVC) {
+        // Only H.264/HEVC are inspected; for anything else fall back to
+        // trusting the RAI bit.
+        return true;
+    }
+    // Walk Annex-B start codes. The payload here begins with a PES
+    // header, so scan rather than assuming an offset.
+    for (size_t i = 0; i + 4 < n; i++) {
+        if (p[i] != 0 || p[i + 1] != 0 || p[i + 2] != 1) {
+            continue;
+        }
+        const uint8_t b = p[i + 3];
+        if (stream_type == TS_STREAM_H264) {
+            const uint8_t nal = b & 0x1F;
+            // 9 = access unit delimiter, 7 = SPS, 8 = PPS, 5 = IDR
+            if (nal == 9 || nal == 7 || nal == 8 || nal == 5) {
+                return true;
+            }
+        } else {
+            const uint8_t nal = (b >> 1) & 0x3F;
+            // 35 = AUD, 32/33/34 = VPS/SPS/PPS, 16..21 = IRAP slices
+            if (nal == 35 || (nal >= 32 && nal <= 34)
+                || (nal >= 16 && nal <= 21)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+void TSScanner::reset(void)
+{
+    stats_ = TSStats();
+    pat_asm_.reset();
+    pmt_asm_.reset();
+    pmt_pid_ = 0;
+    have_pat_ = false;
+    have_pmt_ = false;
+    pat_version_ = 0xFF;
+    pmt_version_ = 0xFF;
+    video_pid_ = 0;
+    video_stream_type_ = 0;
+    last_pat_off_ = 0;
+    last_pmt_off_ = 0;
+    have_pat_off_ = false;
+    have_pmt_off_ = false;
+    anchor_ = 0;
+    have_anchor_ = false;
+    memset(cc_, 0, sizeof(cc_));
+    memset(cc_seen_, 0, sizeof(cc_seen_));
+    partial_len_ = 0;
+    partial_off_ = 0;
+    synced_ = false;
+}
+
+bool TSScanner::stream_type_playable(uint8_t st)
+{
+    // What a browser MSE player can make use of. HEVC is deliberately
+    // excluded: mpegts.js can demux it but MSE support is absent on
+    // most desktops.
+    return st == TS_STREAM_H264 || st == TS_STREAM_AAC_ADTS
+        || st == TS_STREAM_AAC_LATM;
+}
+
+// ----------------------------------------------------------- scanning
+
+void TSScanner::parse_pat(const uint8_t *sec, size_t n, uint64_t off)
+{
+    if (n < 12 || sec[0] != 0x00) {
+        return;
+    }
+    const uint8_t version = (sec[5] >> 1) & 0x1F;
+    const bool current = (sec[5] & 1) != 0;
+    if (!current) {
+        return;
+    }
+    stats_.pat_seen++;
+    last_pat_off_ = off;
+    have_pat_off_ = true;
+
+    if (have_pat_ && version == pat_version_) {
+        return;   // unchanged; nothing to re-parse
+    }
+    pat_version_ = version;
+
+    // program entries run from byte 8 to the CRC
+    const size_t end = n - 4;
+    for (size_t i = 8; i + 4 <= end; i += 4) {
+        const uint16_t prog = uint16_t(sec[i]) << 8 | sec[i + 1];
+        const uint16_t pid = (uint16_t(sec[i + 2] & 0x1F) << 8) | sec[i + 3];
+        if (prog != 0) {
+            if (pmt_pid_ != pid) {
+                // program moved: the old PMT no longer describes us
+                have_pmt_ = false;
+                pmt_version_ = 0xFF;
+                pmt_asm_.reset();
+            }
+            pmt_pid_ = pid;
+            have_pat_ = true;
+            return;   // single-program streams only, which is what we get
+        }
+    }
+}
+
+void TSScanner::parse_pmt(const uint8_t *sec, size_t n, uint64_t off)
+{
+    if (n < 16 || sec[0] != 0x02) {
+        return;
+    }
+    const uint8_t version = (sec[5] >> 1) & 0x1F;
+    const bool current = (sec[5] & 1) != 0;
+    if (!current) {
+        return;
+    }
+    stats_.pmt_seen++;
+    last_pmt_off_ = off;
+    have_pmt_off_ = true;
+
+    if (have_pmt_ && version == pmt_version_) {
+        return;
+    }
+    pmt_version_ = version;
+
+    const size_t prog_info_len = (size_t(sec[10] & 0x0F) << 8) | sec[11];
+    size_t i = 12 + prog_info_len;
+    const size_t end = n - 4;
+    uint16_t vpid = 0;
+    uint8_t vst = 0;
+    while (i + 5 <= end) {
+        const uint8_t st = sec[i];
+        const uint16_t pid = (uint16_t(sec[i + 1] & 0x1F) << 8) | sec[i + 2];
+        const size_t es_len = (size_t(sec[i + 3] & 0x0F) << 8) | sec[i + 4];
+        if (vpid == 0 && (st == TS_STREAM_H264 || st == TS_STREAM_HEVC
+                          || st == TS_STREAM_MPEG2_VIDEO)) {
+            vpid = pid;
+            vst = st;
+        }
+        i += 5 + es_len;
+    }
+    if (vpid != 0) {
+        video_pid_ = vpid;
+        video_stream_type_ = vst;
+        have_pmt_ = true;
+    }
+}
+
+void TSScanner::packet(const uint8_t *p, uint64_t off)
+{
+    stats_.packets++;
+    if (p[0] != TS_SYNC_BYTE) {
+        stats_.bad_sync++;
+        synced_ = false;
+        return;
+    }
+    const bool pusi = (p[1] & 0x40) != 0;
+    const uint16_t pid = (uint16_t(p[1] & 0x1F) << 8) | p[2];
+    const uint8_t afc = (p[3] >> 4) & 0x03;
+    const uint8_t cc = p[3] & 0x0F;
+
+    if (afc == 0 || afc == 2) {
+        // no payload; CC does not advance
+    } else {
+        if (cc_seen_[pid] && cc != uint8_t((cc_[pid] + 1) & 0x0F)) {
+            stats_.cc_errors++;
+        }
+        cc_[pid] = cc;
+        cc_seen_[pid] = true;
+    }
+
+    size_t off_in = 4;
+    bool rai = false;
+    if (afc == 2 || afc == 3) {
+        const uint8_t af_len = p[4];
+        if (af_len > 0 && 5 + size_t(af_len) <= TS_PACKET_SIZE) {
+            rai = (p[5] & 0x40) != 0;
+        }
+        off_in = 5 + size_t(af_len);
+        if (off_in > TS_PACKET_SIZE) {
+            return;
+        }
+    }
+    if (afc == 0 || afc == 2 || off_in >= TS_PACKET_SIZE) {
+        return;   // no payload
+    }
+    const uint8_t *payload = p + off_in;
+    const size_t plen = TS_PACKET_SIZE - off_in;
+
+    if (pid == 0) {
+        size_t seclen = 0;
+        const uint8_t *sec = pat_asm_.feed(payload, plen, pusi, seclen,
+                                           stats_.crc_errors);
+        if (sec != nullptr) {
+            parse_pat(sec, seclen, off);
+        }
+        return;
+    }
+    if (have_pat_ && pid == pmt_pid_) {
+        size_t seclen = 0;
+        const uint8_t *sec = pmt_asm_.feed(payload, plen, pusi, seclen,
+                                           stats_.crc_errors);
+        if (sec != nullptr) {
+            parse_pmt(sec, seclen, off);
+        }
+        return;
+    }
+    if (have_pmt_ && pid == video_pid_ && rai) {
+        // Confirm the RAI bit against the payload. A muxer may set it
+        // inaccurately, and serving a viewer from a point the decoder
+        // cannot start at looks exactly like a broken stream.
+        if (!pusi || ts_payload_is_random_access(payload, plen,
+                                                 video_stream_type_)) {
+            stats_.rai_seen++;
+            if (have_pat_off_ && have_pmt_off_
+                && last_pat_off_ <= off && last_pmt_off_ <= off) {
+                // Start at whichever of the two came first, so the
+                // viewer sees PAT and PMT before the access point.
+                anchor_ = last_pat_off_ < last_pmt_off_ ? last_pat_off_
+                                                        : last_pmt_off_;
+                have_anchor_ = true;
+            }
+        }
+    }
+}
+
+void TSScanner::feed(const uint8_t *buf, size_t n, uint64_t base)
+{
+    stats_.bytes += n;
+    size_t i = 0;
+
+    // finish a packet split across feed() calls
+    if (partial_len_ > 0) {
+        const size_t need = TS_PACKET_SIZE - partial_len_;
+        const size_t take = n < need ? n : need;
+        memcpy(partial_ + partial_len_, buf, take);
+        partial_len_ += take;
+        i += take;
+        if (partial_len_ < TS_PACKET_SIZE) {
+            return;
+        }
+        packet(partial_, partial_off_);
+        partial_len_ = 0;
+    }
+
+    while (i < n) {
+        if (!synced_) {
+            // Hunt for a sync byte that is followed by another one a
+            // packet later, so a 0x47 inside a payload doesn't fool us.
+            size_t j = i;
+            bool found = false;
+            while (j < n) {
+                if (buf[j] == TS_SYNC_BYTE) {
+                    const size_t next = j + TS_PACKET_SIZE;
+                    if (next >= n || buf[next] == TS_SYNC_BYTE) {
+                        found = true;
+                        break;
+                    }
+                }
+                j++;
+            }
+            if (!found) {
+                return;   // no plausible start in this chunk
+            }
+            if (j != i) {
+                stats_.resyncs++;
+            }
+            i = j;
+            synced_ = true;
+        }
+        const size_t avail = n - i;
+        if (avail < TS_PACKET_SIZE) {
+            memcpy(partial_, buf + i, avail);
+            partial_len_ = avail;
+            partial_off_ = base + i;
+            return;
+        }
+        packet(buf + i, base + i);
+        i += TS_PACKET_SIZE;
+    }
+}
+
+bool TSScanner::join_offset(uint64_t &out) const
+{
+    if (!have_anchor_ || !have_pmt_) {
+        return false;
+    }
+    out = anchor_;
+    return true;
+}
+
+// ----------------------------------------------------------- selftest
+
+#include <stdio.h>
+
+namespace {
+
+struct TSBuilder {
+    uint8_t cc[8192] {};
+
+    // Append one 188-byte packet.
+    void pkt(uint8_t *out, uint16_t pid, bool pusi, const uint8_t *payload,
+             size_t plen, bool rai)
+    {
+        memset(out, 0xFF, TS_PACKET_SIZE);
+        out[0] = TS_SYNC_BYTE;
+        out[1] = uint8_t((pusi ? 0x40 : 0) | ((pid >> 8) & 0x1F));
+        out[2] = uint8_t(pid & 0xFF);
+        size_t body = 4;
+        if (rai) {
+            out[3] = uint8_t(0x30 | (cc[pid] & 0x0F));   // AF + payload
+            const size_t af_len = TS_PACKET_SIZE - 5 - plen;
+            out[4] = uint8_t(af_len);
+            out[5] = 0x40;                               // RAI
+            for (size_t i = 6; i < 5 + af_len; i++) {
+                out[i] = 0xFF;
+            }
+            body = 5 + af_len;
+        } else {
+            out[3] = uint8_t(0x10 | (cc[pid] & 0x0F));   // payload only
+        }
+        cc[pid] = uint8_t((cc[pid] + 1) & 0x0F);
+        if (payload != nullptr && plen > 0) {
+            memcpy(out + body, payload, plen);
+        }
+    }
+
+    static void finish_section(uint8_t *sec, size_t body_len)
+    {
+        // body_len counts from table_id through the last byte before CRC
+        const uint32_t crc = ts_crc32(sec, body_len);
+        sec[body_len + 0] = uint8_t(crc >> 24);
+        sec[body_len + 1] = uint8_t(crc >> 16);
+        sec[body_len + 2] = uint8_t(crc >> 8);
+        sec[body_len + 3] = uint8_t(crc);
+    }
+
+    void pat(uint8_t *out, uint16_t pmt_pid, uint8_t version)
+    {
+        uint8_t sec[64] {};
+        sec[0] = 0x00;                       // table_id
+        const size_t body = 12;              // through the program entry
+        sec[1] = uint8_t(0xB0 | (((body + 4 - 3) >> 8) & 0x0F));
+        sec[2] = uint8_t((body + 4 - 3) & 0xFF);
+        sec[3] = 0x00; sec[4] = 0x01;        // transport_stream_id
+        sec[5] = uint8_t(0xC1 | (version << 1));
+        sec[6] = 0x00; sec[7] = 0x00;
+        sec[8] = 0x00; sec[9] = 0x01;        // program_number 1
+        sec[10] = uint8_t(0xE0 | ((pmt_pid >> 8) & 0x1F));
+        sec[11] = uint8_t(pmt_pid & 0xFF);
+        finish_section(sec, body);
+        uint8_t payload[TS_PACKET_SIZE] {};
+        payload[0] = 0x00;                   // pointer_field
+        memcpy(payload + 1, sec, body + 4);
+        pkt(out, 0, true, payload, body + 4 + 1, false);
+    }
+
+    void pmt(uint8_t *out, uint16_t pmt_pid, uint16_t vpid, uint8_t stype,
+             uint8_t version)
+    {
+        uint8_t sec[64] {};
+        sec[0] = 0x02;
+        const size_t body = 17;              // through the one ES entry
+        sec[1] = uint8_t(0xB0 | (((body + 4 - 3) >> 8) & 0x0F));
+        sec[2] = uint8_t((body + 4 - 3) & 0xFF);
+        sec[3] = 0x00; sec[4] = 0x01;
+        sec[5] = uint8_t(0xC1 | (version << 1));
+        sec[6] = 0x00; sec[7] = 0x00;
+        sec[8] = uint8_t(0xE0 | ((vpid >> 8) & 0x1F));
+        sec[9] = uint8_t(vpid & 0xFF);       // PCR PID
+        sec[10] = 0xF0; sec[11] = 0x00;      // program_info_length 0
+        sec[12] = stype;
+        sec[13] = uint8_t(0xE0 | ((vpid >> 8) & 0x1F));
+        sec[14] = uint8_t(vpid & 0xFF);
+        sec[15] = 0xF0; sec[16] = 0x00;      // ES_info_length 0
+        finish_section(sec, body);
+        uint8_t payload[TS_PACKET_SIZE] {};
+        payload[0] = 0x00;
+        memcpy(payload + 1, sec, body + 4);
+        pkt(out, pmt_pid, true, payload, body + 4 + 1, false);
+    }
+
+    // `key` picks the payload (keyframe NAL vs a plain slice); `rai`
+    // controls the adaptation field's random_access_indicator. They are
+    // separate so a stream that lies -- RAI set on a non-keyframe --
+    // can be built.
+    /*
+      A PMT with `n_es` elementary streams, split across as many packets
+      as it needs: one PUSI packet then continuation packets. Without
+      this, every section fits in one packet and the multi-packet
+      reassembly path is never exercised at all.
+
+      Returns how many packets were written.
+     */
+    size_t pmt_split(uint8_t *out, uint16_t pmt_pid, uint16_t vpid,
+                     uint8_t stype, uint8_t version, size_t n_es,
+                     size_t max_packets)
+    {
+        if (max_packets == 0) {
+            return 0;
+        }
+        uint8_t sec[TS_MAX_SECTION] {};
+        size_t k = 0;
+        sec[k++] = 0x02;
+        k += 2;                                   // length, patched below
+        sec[k++] = 0x00; sec[k++] = 0x01;
+        sec[k++] = uint8_t(0xC1 | (version << 1));
+        sec[k++] = 0x00; sec[k++] = 0x00;
+        sec[k++] = uint8_t(0xE0 | ((vpid >> 8) & 0x1F));
+        sec[k++] = uint8_t(vpid & 0xFF);
+        sec[k++] = 0xF0; sec[k++] = 0x00;
+        // first ES entry is the video one
+        sec[k++] = stype;
+        sec[k++] = uint8_t(0xE0 | ((vpid >> 8) & 0x1F));
+        sec[k++] = uint8_t(vpid & 0xFF);
+        sec[k++] = 0xF0; sec[k++] = 0x00;
+        for (size_t e = 1; e < n_es && k + 5 + 4 < sizeof(sec); e++) {
+            const uint16_t pid = uint16_t(0x200 + e);
+            sec[k++] = TS_STREAM_PRIVATE;
+            sec[k++] = uint8_t(0xE0 | ((pid >> 8) & 0x1F));
+            sec[k++] = uint8_t(pid & 0xFF);
+            sec[k++] = 0xF0; sec[k++] = 0x00;
+        }
+        const size_t body = k;
+        const size_t section_length = body + 4 - 3;
+        sec[1] = uint8_t(0xB0 | ((section_length >> 8) & 0x0F));
+        sec[2] = uint8_t(section_length & 0xFF);
+        finish_section(sec, body);
+        const size_t total = body + 4;
+
+        // first packet carries the pointer_field, the rest are
+        // continuations with no pointer field and PUSI clear
+        size_t written = 0;
+        size_t off = 0;
+        bool first = true;
+        while (off < total && written < max_packets) {
+            uint8_t payload[TS_PACKET_SIZE] {};
+            size_t plen = 0;
+            if (first) {
+                payload[plen++] = 0x00;           // pointer_field
+            }
+            const size_t room = (TS_PACKET_SIZE - 4) - plen;
+            const size_t take = (total - off) < room ? (total - off) : room;
+            memcpy(payload + plen, sec + off, take);
+            plen += take;
+            off += take;
+            pkt(out + written * TS_PACKET_SIZE, pmt_pid, first,
+                payload, plen, false);
+            written++;
+            first = false;
+        }
+        return written;
+    }
+
+    void video(uint8_t *out, uint16_t vpid, bool key,
+               uint8_t stype = TS_STREAM_H264, int rai = -1)
+    {
+        // A PES header followed by an access-unit delimiter, so the
+        // RAI confirmation has something real to find.
+        uint8_t payload[32] {};
+        size_t n = 0;
+        payload[n++] = 0x00; payload[n++] = 0x00; payload[n++] = 0x01;
+        payload[n++] = 0xE0;                         // PES video stream id
+        payload[n++] = 0x00; payload[n++] = 0x00;    // PES length (unbounded)
+        payload[n++] = 0x80; payload[n++] = 0x00; payload[n++] = 0x00;
+        payload[n++] = 0x00; payload[n++] = 0x00; payload[n++] = 0x01;
+        if (stype == TS_STREAM_HEVC) {
+            // HEVC NAL header is two bytes and the type is bits 6..1:
+            // 35 = AUD, 1 = TRAIL_R. An H.264 AUD byte here would
+            // decode as type 4 and be rejected, which is the point of
+            // confirming the RAI bit against the payload at all.
+            payload[n++] = key ? uint8_t(35 << 1) : uint8_t(1 << 1);
+            payload[n++] = 0x01;
+        } else {
+            payload[n++] = key ? 0x09 : 0x41;        // AUD / non-IDR slice
+        }
+        payload[n++] = 0x10;
+        pkt(out, vpid, true, payload, n, rai < 0 ? key : rai != 0);
+    }
+};
+
+#define CHECK(cond, msg) do {                                   \
+        if (!(cond)) {                                          \
+            printf("videots selftest FAIL: %s\n", msg);         \
+            return 1;                                           \
+        }                                                       \
+    } while (0)
+
+}  // namespace
+
+int videots_selftest(void)
+{
+    // CRC over a known-good section must come out zero when the CRC
+    // itself is included -- that is how a receiver validates it.
+    {
+        uint8_t sec[16] {};
+        sec[0] = 0x00; sec[1] = 0xB0; sec[2] = 0x0D;
+        TSBuilder::finish_section(sec, 12);
+        CHECK(ts_crc32(sec, 16) == 0, "CRC self-check");
+    }
+
+    // A stream of PAT, PMT, non-key, key must yield an anchor at the PAT.
+    {
+        TSBuilder b;
+        uint8_t s[TS_PACKET_SIZE * 4] {};
+        b.pat(s + 0 * TS_PACKET_SIZE, 0x100, 0);
+        b.pmt(s + 1 * TS_PACKET_SIZE, 0x100, 0x101, TS_STREAM_H264, 0);
+        b.video(s + 2 * TS_PACKET_SIZE, 0x101, false);
+        b.video(s + 3 * TS_PACKET_SIZE, 0x101, true);
+
+        TSScanner sc;
+        sc.feed(s, sizeof(s), 0);
+        CHECK(sc.have_program(), "PAT+PMT parsed");
+        CHECK(sc.video_pid() == 0x101, "video PID");
+        CHECK(sc.video_stream_type() == TS_STREAM_H264, "stream type");
+        CHECK(sc.stats().pat_seen == 1, "one PAT");
+        CHECK(sc.stats().pmt_seen == 1, "one PMT");
+        CHECK(sc.stats().rai_seen == 1, "one RAI");
+        CHECK(sc.stats().cc_errors == 0, "no CC errors");
+        CHECK(sc.stats().crc_errors == 0, "no CRC errors");
+        uint64_t off = 1;
+        CHECK(sc.join_offset(off), "anchor found");
+        CHECK(off == 0, "anchor is the PAT offset");
+    }
+
+    // A keyframe before any PSI must NOT produce an anchor: the viewer
+    // would have no PMT and so no idea which PID carries video.
+    {
+        TSBuilder b;
+        uint8_t s[TS_PACKET_SIZE * 2] {};
+        b.video(s + 0, 0x101, true);
+        b.video(s + TS_PACKET_SIZE, 0x101, true);
+        TSScanner sc;
+        sc.feed(s, sizeof(s), 0);
+        uint64_t off = 0;
+        CHECK(!sc.join_offset(off), "no anchor without PSI");
+    }
+
+    // Feeding one byte at a time must give the same result as one go:
+    // packets split across reads are the normal case on TCP.
+    {
+        TSBuilder b;
+        uint8_t s[TS_PACKET_SIZE * 4] {};
+        b.pat(s + 0 * TS_PACKET_SIZE, 0x100, 0);
+        b.pmt(s + 1 * TS_PACKET_SIZE, 0x100, 0x101, TS_STREAM_H264, 0);
+        b.video(s + 2 * TS_PACKET_SIZE, 0x101, false);
+        b.video(s + 3 * TS_PACKET_SIZE, 0x101, true);
+        TSScanner sc;
+        for (size_t i = 0; i < sizeof(s); i++) {
+            sc.feed(s + i, 1, i);
+        }
+        CHECK(sc.have_program(), "byte-at-a-time PSI");
+        CHECK(sc.stats().rai_seen == 1, "byte-at-a-time RAI");
+        uint64_t off = 1;
+        CHECK(sc.join_offset(off) && off == 0, "byte-at-a-time anchor");
+    }
+
+    // A corrupt PMT must be rejected rather than believed.
+    {
+        TSBuilder b;
+        uint8_t s[TS_PACKET_SIZE * 2] {};
+        b.pat(s, 0x100, 0);
+        b.pmt(s + TS_PACKET_SIZE, 0x100, 0x101, TS_STREAM_H264, 0);
+        s[TS_PACKET_SIZE + 20] ^= 0xFF;          // flip a payload byte
+        TSScanner sc;
+        sc.feed(s, sizeof(s), 0);
+        CHECK(!sc.have_program(), "corrupt PMT rejected");
+        CHECK(sc.stats().crc_errors == 1, "CRC error counted");
+    }
+
+    // Garbage before the stream must be resynced past, not misparsed.
+    {
+        TSBuilder b;
+        uint8_t s[64 + TS_PACKET_SIZE * 4] {};
+        memset(s, 0x47, 64);                     // sync bytes that aren't
+        b.pat(s + 64 + 0 * TS_PACKET_SIZE, 0x100, 0);
+        b.pmt(s + 64 + 1 * TS_PACKET_SIZE, 0x100, 0x101, TS_STREAM_H264, 0);
+        b.video(s + 64 + 2 * TS_PACKET_SIZE, 0x101, false);
+        b.video(s + 64 + 3 * TS_PACKET_SIZE, 0x101, true);
+        TSScanner sc;
+        sc.feed(s, sizeof(s), 0);
+        CHECK(sc.have_program(), "resync found the program");
+        uint64_t off = 0;
+        CHECK(sc.join_offset(off) && off == 64, "anchor after resync");
+    }
+
+    // A PMT version change that moves the video PID must be followed.
+    {
+        TSBuilder b;
+        uint8_t s[TS_PACKET_SIZE * 4] {};
+        b.pat(s + 0, 0x100, 0);
+        b.pmt(s + TS_PACKET_SIZE, 0x100, 0x101, TS_STREAM_H264, 0);
+        b.pmt(s + 2 * TS_PACKET_SIZE, 0x100, 0x102, TS_STREAM_HEVC, 1);
+        b.video(s + 3 * TS_PACKET_SIZE, 0x102, true, TS_STREAM_HEVC);
+        TSScanner sc;
+        sc.feed(s, sizeof(s), 0);
+        CHECK(sc.video_pid() == 0x102, "PMT version change followed");
+        CHECK(sc.video_stream_type() == TS_STREAM_HEVC, "new stream type");
+        CHECK(sc.stats().rai_seen == 1, "RAI on the new PID");
+    }
+
+    // A muxer that sets RAI on a non-keyframe must not fool us: the
+    // bit is a hint, and serving a viewer from a point the decoder
+    // cannot start at is indistinguishable from a broken stream.
+    {
+        TSBuilder b;
+        uint8_t s[TS_PACKET_SIZE * 3] {};
+        b.pat(s + 0, 0x100, 0);
+        b.pmt(s + TS_PACKET_SIZE, 0x100, 0x101, TS_STREAM_H264, 0);
+        // non-keyframe payload, but the RAI bit set: a well-formed
+        // packet that lies about being a random access point.
+        b.video(s + 2 * TS_PACKET_SIZE, 0x101, false, TS_STREAM_H264, 1);
+        TSScanner sc;
+        sc.feed(s, sizeof(s), 0);
+        CHECK(sc.have_program(), "false-RAI case parsed PSI");
+        uint64_t off = 0;
+        CHECK(!sc.join_offset(off), "false RAI must not produce an anchor");
+    }
+
+    printf("videots selftest: OK\n");
+    return 0;
+}
+
+// --------------------------------------------------------------- fuzz
+
+namespace {
+
+// xorshift32: tiny, deterministic, and no dependency on the platform's
+// rand() so a failing seed reproduces anywhere.
+struct Rng {
+    uint32_t s;
+    explicit Rng(uint32_t seed) : s(seed ? seed : 1) {}
+    uint32_t next(void)
+    {
+        s ^= s << 13;
+        s ^= s >> 17;
+        s ^= s << 5;
+        return s;
+    }
+    uint32_t below(uint32_t n) { return n ? next() % n : 0; }
+};
+
+}  // namespace
+
+int videots_fuzz(unsigned iterations, uint32_t seed)
+{
+    for (unsigned it = 0; it < iterations; it++) {
+        Rng rng(seed + it);
+
+        // Build a valid stream, then corrupt it.
+        TSBuilder b;
+        const size_t npkt = 8 + rng.below(24);
+        std::vector<uint8_t> s(npkt * TS_PACKET_SIZE);
+        for (size_t i = 0; i < npkt; i++) {
+            uint8_t *p = &s[i * TS_PACKET_SIZE];
+            switch (i % 4) {
+            case 0: b.pat(p, 0x100, uint8_t(rng.below(32))); break;
+            case 1:
+                if (rng.below(2) == 0) {
+                    // a PMT big enough to span several packets, so the
+                    // reassembly path is fuzzed too
+                    const size_t used = b.pmt_split(
+                        p, 0x100, 0x101, TS_STREAM_H264,
+                        uint8_t(rng.below(32)), 4 + rng.below(240),
+                        npkt - i);
+                    i += used > 0 ? used - 1 : 0;
+                } else {
+                    b.pmt(p, 0x100, 0x101, TS_STREAM_H264,
+                          uint8_t(rng.below(32)));
+                }
+                break;
+            default: b.video(p, 0x101, (i % 8) == 3); break;
+            }
+        }
+
+        const unsigned mutations = rng.below(24);
+        for (unsigned m = 0; m < mutations; m++) {
+            const size_t off = rng.below(uint32_t(s.size()));
+            switch (rng.below(4)) {
+            case 0: s[off] ^= uint8_t(1u << rng.below(8)); break;  // bit flip
+            case 1: s[off] = uint8_t(rng.next()); break;           // byte set
+            case 2: s[off] = TS_SYNC_BYTE; break;   // spurious sync byte
+            case 3: s[off] = 0xFF; break;           // saturate a length field
+            }
+        }
+        if (rng.below(4) == 0) {
+            s.resize(1 + rng.below(uint32_t(s.size())));   // truncate
+        }
+
+        // Feed in irregular chunks: a packet split across reads is the
+        // normal case, and it is where an assembler most easily breaks.
+        TSScanner sc;
+        size_t i = 0;
+        while (i < s.size()) {
+            size_t chunk = 1 + rng.below(400);
+            if (i + chunk > s.size()) {
+                chunk = s.size() - i;
+            }
+            sc.feed(&s[i], chunk, i);
+            i += chunk;
+        }
+
+        // Invariants that must hold whatever the input was.
+        uint64_t off = 0;
+        if (sc.join_offset(off)) {
+            if (!sc.have_program()) {
+                printf("videots fuzz FAIL (seed %u, iter %u): anchor without "
+                       "a program\n", seed, it);
+                return 1;
+            }
+            if (off >= s.size()) {
+                printf("videots fuzz FAIL (seed %u, iter %u): anchor %llu "
+                       "past end %zu\n", seed, it,
+                       (unsigned long long)off, s.size());
+                return 1;
+            }
+        }
+        if (sc.have_program() && sc.video_pid() == 0) {
+            printf("videots fuzz FAIL (seed %u, iter %u): program with no "
+                   "video PID\n", seed, it);
+            return 1;
+        }
+        const TSStats &st = sc.stats();
+        if (st.packets * TS_PACKET_SIZE > st.bytes + TS_PACKET_SIZE) {
+            printf("videots fuzz FAIL (seed %u, iter %u): counted more "
+                   "packets than bytes fed\n", seed, it);
+            return 1;
+        }
+    }
+    printf("videots fuzz: OK (%u iterations from seed %u)\n",
+           iterations, seed);
+    return 0;
+}
diff --git a/videots.h b/videots.h
new file mode 100644
index 0000000..79c8ec8
--- /dev/null
+++ b/videots.h
@@ -0,0 +1,165 @@
+/*
+  MPEG-TS scanner.
+
+  Watches a transport stream going past and works out where a late
+  viewer may safely start. It never modifies the stream: fan-out and
+  recording hand out the publisher's bytes verbatim, so everything here
+  is observation only.
+
+  A viewer cannot just start at "now". It needs, in order:
+
+    PAT   to learn which PID carries the program map
+    PMT   to learn which PID carries video, and its codec
+    a random access point, so the decoder has a frame to start from
+
+  Measured against both real publishers (a Phoenix camera via RTSP and
+  a gstreamer mpegtsmux/udpsink pipeline): PAT repeats about every
+  0.1 s, and the adaptation field's random_access_indicator is set on
+  exactly the keyframes. Parameter sets (SPS/PPS) repeat at every IDR
+  in both, so a viewer starting at PAT->PMT->RAI has everything it
+  needs. That is not guaranteed by the spec, so the RAI is confirmed by
+  looking for an access-unit delimiter or parameter set in the payload
+  rather than trusted on its own.
+ */
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define TS_PACKET_SIZE 188
+#define TS_SYNC_BYTE 0x47
+
+// PSI section sizes: section_length is 12 bits, and the 3 bytes before
+// it are not counted, so a section is at most 1024+3 bytes.
+#define TS_MAX_SECTION 1027
+
+// MPEG-2 stream_type values we care about telling apart.
+#define TS_STREAM_MPEG2_VIDEO 0x02
+#define TS_STREAM_PRIVATE     0x06
+#define TS_STREAM_AAC_ADTS    0x0F
+#define TS_STREAM_AAC_LATM    0x11
+#define TS_STREAM_H264        0x1B
+#define TS_STREAM_HEVC        0x24
+
+struct TSStats {
+    uint64_t bytes = 0;
+    uint64_t packets = 0;
+    uint64_t bad_sync = 0;      // packets that did not start with 0x47
+    uint64_t resyncs = 0;       // times we had to hunt for the sync byte
+    uint64_t cc_errors = 0;     // continuity counter discontinuities
+    uint64_t pat_seen = 0;
+    uint64_t pmt_seen = 0;
+    uint64_t rai_seen = 0;      // random access points on the video PID
+    uint64_t crc_errors = 0;    // PSI sections that failed CRC
+};
+
+/*
+  Reassembles one PSI section spread across TS packets. A PAT or a small
+  PMT usually fits in a single packet, but nothing guarantees it, and a
+  scanner that assumed so would silently misparse a larger PMT.
+ */
+class PSIAssembler {
+public:
+    void reset(void) { len_ = 0; want_ = 0; active_ = false; }
+    // Feed one packet's PSI payload. Returns a complete, CRC-checked
+    // section (and its length) or nullptr.
+    const uint8_t *feed(const uint8_t *payload, size_t n, bool pusi,
+                        size_t &out_len, uint64_t &crc_errors);
+
+private:
+    uint8_t buf_[TS_MAX_SECTION] {};
+    size_t len_ = 0;
+    size_t want_ = 0;
+    bool active_ = false;
+};
+
+class TSScanner {
+public:
+    // Feed a contiguous run of stream bytes. `base` is the absolute
+    // stream offset of buf[0] -- the same coordinate the ring uses, so
+    // a join offset can be handed straight to a viewer.
+    void feed(const uint8_t *buf, size_t n, uint64_t base);
+
+    // True once a PAT and a matching PMT have been parsed.
+    bool have_program(void) const { return have_pmt_; }
+
+    // Absolute offset a late viewer should start at. False when no
+    // usable anchor has been seen (yet, or ever).
+    bool join_offset(uint64_t &out) const;
+
+    uint16_t video_pid(void) const { return video_pid_; }
+    uint8_t video_stream_type(void) const { return video_stream_type_; }
+    uint16_t pmt_pid(void) const { return pmt_pid_; }
+    const TSStats &stats(void) const { return stats_; }
+
+    // True if this stream_type is one a browser MSE player can use.
+    static bool stream_type_playable(uint8_t st);
+
+    // Forget everything about the current stream.
+    //
+    // A new publisher is a new stream: its PSI, continuity counters and
+    // timestamps all restart. Carrying the old state over would hand a
+    // joiner an anchor pointing into the previous stream's bytes, and
+    // would count every counter restart as a continuity error.
+    void reset(void);
+
+private:
+    TSStats stats_;
+    PSIAssembler pat_asm_;
+    PSIAssembler pmt_asm_;
+
+    uint16_t pmt_pid_ = 0;
+    bool have_pat_ = false;
+    bool have_pmt_ = false;
+    uint8_t pat_version_ = 0xFF;
+    uint8_t pmt_version_ = 0xFF;
+
+    uint16_t video_pid_ = 0;
+    uint8_t video_stream_type_ = 0;
+
+    // Offsets of the most recent PAT and PMT packets, and the anchor
+    // computed when a random access point follows both.
+    uint64_t last_pat_off_ = 0;
+    uint64_t last_pmt_off_ = 0;
+    bool have_pat_off_ = false;
+    bool have_pmt_off_ = false;
+    uint64_t anchor_ = 0;
+    bool have_anchor_ = false;
+
+    // continuity counters, indexed by PID
+    uint8_t cc_[8192] {};
+    bool cc_seen_[8192] {};
+
+    // partial packet carried across feed() calls
+    uint8_t partial_[TS_PACKET_SIZE] {};
+    size_t partial_len_ = 0;
+    uint64_t partial_off_ = 0;
+    bool synced_ = false;
+
+    void packet(const uint8_t *p, uint64_t off);
+    void parse_pat(const uint8_t *sec, size_t n, uint64_t off);
+    void parse_pmt(const uint8_t *sec, size_t n, uint64_t off);
+};
+
+// MPEG-2 section CRC32 (poly 0x04C11DB7, MSB-first, init 0xFFFFFFFF).
+uint32_t ts_crc32(const uint8_t *data, size_t n);
+
+// True if a video-PID payload starting at `p` looks like a real random
+// access point: an access-unit delimiter, a parameter set, or an IRAP
+// slice. Used to confirm the adaptation field's RAI bit.
+bool ts_payload_is_random_access(const uint8_t *p, size_t n,
+                                 uint8_t stream_type);
+
+// Run the in-process scanner self-checks. Returns 0 on success.
+int videots_selftest(void);
+
+/*
+  Mutation fuzz over the scanner. Builds a valid stream, corrupts it in
+  a seeded, reproducible way, feeds it in randomly-sized chunks and
+  checks the scanner neither crashes nor reports an anchor it cannot
+  back up. PSI parsing with lengths and CRCs taken from the wire is
+  exactly the code where a hand-written happy-path test proves least.
+
+  Returns 0 if every iteration held.
+ */
+int videots_fuzz(unsigned iterations, uint32_t seed);
diff --git a/videoview.cpp b/videoview.cpp
new file mode 100644
index 0000000..caa615e
--- /dev/null
+++ b/videoview.cpp
@@ -0,0 +1,494 @@
+/*
+  Video viewers. See videoview.h.
+ */
+#include "videoview.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <unistd.h>
+
+#include "videoauth.h"
+
+bool video_viewer_authorised(const struct KeyEntry &ke,
+                             const std::string &password)
+{
+    bool has_pw = false;
+    for (int i = 0; i < 32; i++) {
+        has_pw |= ke.video_viewer_key[i] != 0;
+    }
+    if (!has_pw) {
+        return true;   // open viewing
+    }
+    return video_password_matches(ke.video_viewer_key, password.c_str());
+}
+
+void VideoViewer::start(int fd, int port2, uint32_t peer_ip_be,
+                        uint16_t peer_port_be, time_t now)
+{
+    fd_ = fd;
+    port2_ = port2;
+    state_ = VV_DETECT;
+    kind_ = VVK_UNKNOWN;
+    peer_ip_be_ = peer_ip_be;
+    peer_port_be_ = peer_port_be;
+    connected_at_ = now;
+    last_progress_ = now;
+    behind_since_ = 0;
+    out_.clear();
+    out_sent_ = 0;
+    read_pos_ = 0;
+    streaming_ = false;
+    bytes_sent_ = 0;
+    blocked_ = false;
+    ws_ = nullptr;
+    ws_ready_ = false;
+    drop_reason_ = "";
+
+    int one = 1;
+    setsockopt(fd_, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one));
+    // Deliberately modest: a large kernel buffer hides backpressure and
+    // we would not notice a viewer falling behind until much later.
+    int snd = 256 * 1024;
+    setsockopt(fd_, SOL_SOCKET, SO_SNDBUF, &snd, sizeof(snd));
+    fcntl(fd_, F_SETFL, fcntl(fd_, F_GETFL, 0) | O_NONBLOCK);
+}
+
+void VideoViewer::close(void)
+{
+    if (ws_ != nullptr) {
+        delete ws_;          // frees SSL objects; the fd is ours to close
+        ws_ = nullptr;
+    }
+    if (fd_ >= 0) {
+        ::close(fd_);
+        fd_ = -1;
+    }
+    state_ = VV_CLOSING;
+}
+
+void VideoViewer::fail(int code, const char *reason, const char *text)
+{
+    if (kind_ == VVK_HTTP) {
+        out_ = http_simple_response(code, reason, "text/plain",
+                                    std::string(text) + "\n");
+    }
+    drop_reason_ = reason;
+    out_sent_ = 0;
+    state_ = VV_RESPONDING;
+    streaming_ = false;
+}
+
+bool VideoViewer::begin_stream(const struct KeyEntry &ke, int slot,
+                               const VideoRing &ring, const TSScanner &scanner,
+                               bool http, time_t now)
+{
+    uint64_t anchor = 0;
+    if (!scanner.join_offset(anchor)) {
+        // Refusing beats serving from an arbitrary point: without a
+        // PAT, a PMT and a random access point ahead of it, the client
+        // decodes garbage and the stream looks broken rather than
+        // not-ready-yet.
+        fail(503, "stream not ready",
+             "No decodable start point yet. The publisher has not sent a "
+             "keyframe with program information.");
+        return true;
+    }
+    if (!ring.resident(anchor)) {
+        anchor = ring.oldest();
+    }
+    read_pos_ = anchor;
+    streaming_ = true;
+    last_progress_ = now;
+    behind_since_ = 0;
+
+    if (http) {
+        // No Content-Length: the stream is unbounded and ends when the
+        // connection does.
+        out_ = "HTTP/1.1 200 OK\r\n"
+               "Content-Type: video/mp2t\r\n"
+               "Cache-Control: no-store\r\n"
+               "Connection: close\r\n"
+               "\r\n";
+        out_sent_ = 0;
+        state_ = VV_RESPONDING;
+    } else {
+        out_.clear();
+        out_sent_ = 0;
+        state_ = VV_STREAMING;
+    }
+    (void)ke;
+    (void)slot;
+    return true;
+}
+
+bool VideoViewer::on_readable(const struct KeyEntry &ke, int slot,
+                              const VideoRing &ring, const TSScanner &scanner,
+                              time_t now)
+{
+    if (state_ != VV_DETECT) {
+        if (kind_ == VVK_WS) {
+            // Let the WebSocket consume control frames (ping/close).
+            uint8_t sink[2048];
+            const ssize_t got = ws_->recv(sink, sizeof(sink));
+            if (got < 0) {
+                drop_reason_ = "websocket closed";
+                return false;
+            }
+            return true;
+        }
+        // A streaming viewer has nothing to say; drain and ignore rather
+        // than letting it steer us.
+        uint8_t sink[2048];
+        const ssize_t got = ::recv(fd_, sink, sizeof(sink), 0);
+        if (got == 0) {
+            drop_reason_ = "peer closed";
+            return false;
+        }
+        return true;
+    }
+
+    /*
+      Classify once. A WebSocket viewer stays in VV_DETECT for the whole
+      handshake, so the state check above is not enough on its own: a
+      later read would see a mid-handshake TLS record (0x17...) rather
+      than the ClientHello, fail the TLS test, and re-classify the
+      connection as HTTP. The WebSocket then never gets driven and the
+      viewer is dropped by the silence timeout.
+     */
+    if (kind_ == VVK_WS) {
+        // Already handed to WebSocket; it drives itself from the pump.
+        // Note this must NOT short-circuit an HTTP viewer: its request
+        // may arrive fragmented, and the parse below has to see the
+        // rest of it.
+        return true;
+    }
+
+    /*
+      Peek, do not consume. A WebSocket upgrade has to stay in the
+      socket: the WebSocket class reads and answers the handshake
+      itself. Only a plain-HTTP request is read off, once we know that
+      is what it is.
+     */
+    uint8_t buf[2048];
+    const ssize_t n = ::recv(fd_, buf, sizeof(buf), MSG_PEEK);
+    if (n == 0) {
+        drop_reason_ = "peer closed";
+        return false;
+    }
+    if (n < 0) {
+        if (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR) {
+            return true;
+        }
+        drop_reason_ = "read error";
+        return false;
+    }
+
+    /*
+      An RTSP request line means this is a publisher, not a viewer.
+      It has to be recognised here rather than at accept(): a publisher
+      connects and only then sends OPTIONS, so at accept there is
+      usually nothing to look at, and classifying on an empty peek
+      misfiled publishers as viewers -- which then answered their
+      OPTIONS with "405 method not allowed".
+     */
+    static const char *rtsp_methods[] = {
+        "OPTIONS ", "ANNOUNCE ", "DESCRIBE ", "SETUP ", "PLAY ",
+        "RECORD ", "TEARDOWN ", "GET_PARAMETER ", "SET_PARAMETER ",
+    };
+    for (const char *m : rtsp_methods) {
+        const size_t len = strlen(m);
+        if (size_t(n) >= len && memcmp(buf, m, len) == 0) {
+            kind_ = VVK_RTSP;
+            return true;   // the child takes the socket from here
+        }
+    }
+
+    /*
+      RTMP publish. The client speaks first with handshake C0, a single
+      version byte, effectively always 0x03. One byte is enough to be
+      unambiguous here: MPEG-TS starts 0x47, every RTSP and HTTP method
+      is an ASCII letter, and a TLS ClientHello starts 0x16 (its 0x03 is
+      the *second* byte, not the first).
+     */
+    if (n >= 1 && buf[0] == 0x03) {
+        kind_ = VVK_RTMP;
+        return true;   // the child takes the socket from here
+    }
+
+    // TLS ClientHello: WebSocket handles the whole thing from here.
+    static const uint8_t tls_hello[3] = { 0x16, 0x03, 0x01 };
+    if (n >= 3 && memcmp(buf, tls_hello, 3) == 0) {
+        kind_ = VVK_WS;
+        return true;   // begin_ws() runs from the pump once bytes arrive
+    }
+
+    kind_ = VVK_HTTP;
+    HttpRequest peek;
+    const int r = peek.feed(buf, size_t(n));
+    if (r < 0) {
+        fail(400, "bad request", "Malformed request.");
+        (void)::recv(fd_, buf, size_t(n), 0);
+        return true;
+    }
+    if (r == 0) {
+        return true;   // wait for the rest, still unconsumed
+    }
+
+    // A WebSocket upgrade: hand the untouched socket to WebSocket.
+    if (!peek.header("Upgrade").empty()
+        && peek.header("Upgrade").find("ebsocket") != std::string::npos) {
+        if (!ws_authorise(ke, slot, peek)) {
+            // No handshake, no upgrade: an unauthorised browser gets a
+            // plain HTTP error it can actually display.
+            (void)::recv(fd_, buf, size_t(n), 0);
+            kind_ = VVK_HTTP;
+            fail(401, "unauthorized", "A viewer token or password is required.");
+            return true;
+        }
+        kind_ = VVK_WS;
+        return true;
+    }
+
+    // Plain HTTP from here: now it is safe to consume the request.
+    (void)::recv(fd_, buf, size_t(n), 0);
+    req_ = peek;
+
+    if (req_.method() != "GET") {
+        fail(405, "method not allowed", "Only GET is served here.");
+        return true;
+    }
+
+    // Path selects the slot: /v1.ts .. /v3.ts. The connection already
+    // arrived on this slot's port, so the path only has to agree.
+    char want[32];
+    snprintf(want, sizeof(want), "/v%d.ts", slot + 1);
+    if (req_.path() != want && req_.path() != "/" && req_.path() != "/stream.ts") {
+        fail(404, "not found", "Try /v1.ts on this port.");
+        return true;
+    }
+
+    std::string pw = req_.query("pw");
+    if (pw.empty()) {
+        pw = http_basic_password(req_.header("Authorization"));
+    }
+    if (!video_viewer_authorised(ke, pw)) {
+        fail(401, "unauthorized", "A viewer password is required.");
+        return true;
+    }
+    return begin_stream(ke, slot, ring, scanner, true, now);
+}
+
+bool VideoViewer::detect_timeout(const struct KeyEntry &ke, int slot,
+                                 const VideoRing &ring,
+                                 const TSScanner &scanner, time_t now)
+{
+    if (state_ != VV_DETECT) {
+        return true;
+    }
+    // Silence means a raw client: ffplay tcp://host:port connects and
+    // waits. There is nowhere in an opaque byte stream to carry a
+    // credential, so this is only offered when the slot allows it and
+    // no viewer password is set.
+    kind_ = VVK_RAW;
+    const uint32_t opts = video_slot_opts(ke.video_flags, unsigned(slot));
+    if ((opts & VIDEO_SLOT_RAW_TCP) == 0) {
+        drop_reason_ = "raw-TCP viewers not enabled on this slot";
+        return false;
+    }
+    bool has_pw = false;
+    for (int i = 0; i < 32; i++) {
+        has_pw |= ke.video_viewer_key[i] != 0;
+    }
+    if (has_pw) {
+        drop_reason_ = "raw TCP cannot carry the viewer password";
+        return false;
+    }
+    return begin_stream(ke, slot, ring, scanner, false, now);
+}
+
+bool VideoViewer::flush(time_t now)
+{
+    while (out_sent_ < out_.size()) {
+        const ssize_t w = ::send(fd_, out_.data() + out_sent_,
+                                 out_.size() - out_sent_, MSG_NOSIGNAL);
+        if (w < 0) {
+            if (errno == EAGAIN || errno == EWOULDBLOCK) {
+                blocked_ = true;
+                return true;
+            }
+            if (errno == EINTR) {
+                continue;
+            }
+            drop_reason_ = "write error";
+            return false;
+        }
+        out_sent_ += size_t(w);
+        last_progress_ = now;
+    }
+    out_.clear();
+    out_sent_ = 0;
+    blocked_ = false;
+    return true;
+}
+
+bool VideoViewer::on_writable(const VideoRing &ring, time_t now)
+{
+    if (!flush(now)) {
+        return false;
+    }
+    if (state_ == VV_RESPONDING) {
+        if (out_.empty()) {
+            if (streaming_) {
+                state_ = VV_STREAMING;
+            } else {
+                // an error response has gone out; we are done
+                return false;
+            }
+        } else {
+            return true;
+        }
+    }
+    if (state_ != VV_STREAMING) {
+        return true;
+    }
+
+    // Lapped: the bytes this viewer still needs have been overwritten.
+    // Resyncing in place would leave a silent gap, which is worse than
+    // a clean disconnect -- every client reconnects, none recovers from
+    // a hole it was not told about.
+    if (!ring.resident(read_pos_)) {
+        drop_reason_ = "fell too far behind (lapped)";
+        return false;
+    }
+
+    size_t budget = VIDEO_VIEWER_WRITE_CHUNK;
+    while (budget > 0 && read_pos_ < ring.write_pos()) {
+        uint8_t chunk[16384];
+        const size_t want = budget < sizeof(chunk) ? budget : sizeof(chunk);
+        const size_t got = ring.read_at(read_pos_, chunk, want);
+        if (got == 0) {
+            break;
+        }
+        const ssize_t w = ws_ != nullptr
+            ? ws_->send(chunk, got)
+            : ::send(fd_, chunk, got, MSG_NOSIGNAL);
+        if (w == 0 && ws_ != nullptr) {
+            blocked_ = true;
+            break;      // queued inside the WebSocket, retry later
+        }
+        if (w < 0) {
+            if (errno == EAGAIN || errno == EWOULDBLOCK) {
+                blocked_ = true;
+                break;
+            }
+            if (errno == EINTR) {
+                continue;
+            }
+            drop_reason_ = "write error";
+            return false;
+        }
+        read_pos_ += uint64_t(w);
+        bytes_sent_ += uint64_t(w);
+        budget -= size_t(w);
+        last_progress_ = now;
+        if (size_t(w) < got) {
+            blocked_ = true;
+            break;   // socket full
+        }
+        blocked_ = false;
+    }
+    if (read_pos_ >= ring.write_pos()) {
+        blocked_ = false;   // caught up: nothing is waiting on the socket
+    }
+
+    const uint64_t lag = ring.write_pos() - read_pos_;
+    if (lag > ring.capacity() / 2) {
+        if (behind_since_ == 0) {
+            behind_since_ = now;
+        } else if (now - behind_since_ > 5) {
+            // Chronically behind: drop it before it is lapped, so the
+            // disconnect is clean rather than mid-gap.
+            drop_reason_ = "chronically behind";
+            return false;
+        }
+    } else {
+        behind_since_ = 0;
+    }
+    if (lag > 0 && now - last_progress_ > VIDEO_VIEWER_STUCK_S) {
+        drop_reason_ = "stalled";
+        return false;
+    }
+    return true;
+}
+
+bool VideoViewer::wants_write(void) const
+{
+    return blocked_ || out_sent_ < out_.size();
+}
+
+bool VideoViewer::ws_authorise(const struct KeyEntry &ke, int slot,
+                               const HttpRequest &req)
+{
+    // A token is the normal path for the browser player: it keeps the
+    // viewer password out of a URL that lands in history and logs.
+    const std::string tok = req.query("t");
+    if (!tok.empty()
+        && video_token_valid(ke, port2_, slot, tok.c_str(), time(nullptr))) {
+        return true;
+    }
+    std::string pw = req.query("pw");
+    if (pw.empty()) {
+        pw = http_basic_password(req.header("Authorization"));
+    }
+    return video_viewer_authorised(ke, pw);
+}
+
+bool VideoViewer::begin_ws(const struct KeyEntry &ke, int slot,
+                           const VideoRing &ring, const TSScanner &scanner,
+                           time_t now)
+{
+    if (ws_ == nullptr) {
+        // WebSocket reads and answers the handshake off the socket
+        // itself, which is why the detect phase only peeked.
+        ws_ = new WebSocket(fd_);
+    }
+    if (!ws_ready_) {
+        // Pump the handshake along. recv() returning < 0 means the
+        // link failed; 0 just means "not finished yet".
+        uint8_t sink[512];
+        const ssize_t r = ws_->recv(sink, sizeof(sink));
+        if (r < 0) {
+            drop_reason_ = "websocket handshake failed";
+            return false;
+        }
+        if (ws_->request_target().empty()) {
+            return true;   // handshake still in progress
+        }
+        ws_ready_ = true;
+        // Redacted: a viewer may authenticate with ?pw=, which is a
+        // long-lived credential, and the log is both kept on disk and
+        // rendered into the admin server page.
+        printf("video: websocket viewer on %s%s\n",
+               http_redact_target(ws_->request_target()).c_str(),
+               ws_->is_SSL() ? " (TLS)" : "");
+    }
+    uint64_t anchor = 0;
+    if (!scanner.join_offset(anchor)) {
+        return true;    // wait for a decodable start point
+    }
+    if (!ring.resident(anchor)) {
+        anchor = ring.oldest();
+    }
+    read_pos_ = anchor;
+    streaming_ = true;
+    state_ = VV_STREAMING;
+    last_progress_ = now;
+    (void)ke;
+    (void)slot;
+    return true;
+}
diff --git a/videoview.h b/videoview.h
new file mode 100644
index 0000000..80b100a
--- /dev/null
+++ b/videoview.h
@@ -0,0 +1,179 @@
+/*
+  Video viewers.
+
+  A viewer receives the publisher's bytes verbatim. It starts at the
+  join anchor the scanner computed -- the PAT before the most recent
+  confirmed random access point -- so the stream is decodable from the
+  first byte it sees rather than from wherever "now" happens to be.
+
+  The publisher never waits on a viewer. Each viewer holds an absolute
+  position into the ring and is dropped if it falls far enough behind
+  that its data has been overwritten. That is the whole reason the ring
+  uses absolute offsets: "you have been lapped" is arithmetic, not a
+  guess about wrap.
+ */
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+#include <time.h>
+
+#include <string>
+
+#include "httpreq.h"
+#include "websocket.h"
+#include "keydb.h"
+#include "videostream.h"
+#include "videots.h"
+
+// Per-slot viewer cap. The limit that bites first is egress bandwidth,
+// not CPU: 32 viewers of an 8 Mbit/s stream is 256 Mbit/s.
+#define VIDEO_MAX_VIEWERS 32
+
+// How much to hand one viewer per loop iteration. Bounds the latency
+// every other viewer and the publisher see.
+#define VIDEO_VIEWER_WRITE_CHUNK 65536
+
+// Queue past which a viewer is considered wedged rather than slow.
+#define VIDEO_VIEWER_STUCK_S 10
+
+// A connection that says nothing at all for this long is a raw viewer:
+// ffplay tcp://... connects and waits. Every other client we serve
+// speaks first.
+#define VIDEO_DETECT_SILENCE_S 2
+
+enum viewer_state {
+    VV_DETECT = 0,      // deciding what this connection is
+    VV_RESPONDING,      // sending an HTTP response header or an error
+    VV_STREAMING,       // handing out ring bytes
+    VV_CLOSING,         // flush what is queued, then close
+};
+
+enum viewer_kind {
+    VVK_UNKNOWN = 0,
+    VVK_HTTP,           // GET /vN.ts
+    VVK_RAW,            // raw TCP, no framing
+    VVK_WS,             // WebSocket (or WSS), binary frames
+    VVK_RTSP,           // RTSP: handed to the ingest splice, not served
+    VVK_RTMP,           // RTMP publish: same, a different backend
+};
+
+class VideoViewer {
+public:
+    void start(int fd, int port2, uint32_t peer_ip_be,
+               uint16_t peer_port_be, time_t now);
+    void close(void);
+    ~VideoViewer(void) { close(); }
+
+    /*
+      Give up the socket without closing it. Used when the connection
+      turns out to be an RTSP publisher: classification only happens
+      once bytes arrive, so it necessarily starts life in a viewer slot.
+     */
+    int release_fd(void)
+    {
+        const int fd = fd_;
+        fd_ = -1;
+        state_ = VV_CLOSING;
+        return fd;
+    }
+    bool active(void) const { return fd_ >= 0; }
+    int fd(void) const { return fd_; }
+
+    // Readable: consume the request. Returns false if the viewer should
+    // be dropped.
+    bool on_readable(const struct KeyEntry &ke, int slot,
+                     const VideoRing &ring, const TSScanner &scanner,
+                     time_t now);
+
+    // Writable (or just a poll tick): push bytes. Returns false when the
+    // viewer should be dropped.
+    bool on_writable(const VideoRing &ring, time_t now);
+
+    // Called when the detect deadline passes with nothing received.
+    bool detect_timeout(const struct KeyEntry &ke, int slot,
+                        const VideoRing &ring, const TSScanner &scanner,
+                        time_t now);
+
+    /*
+      True only when we have bytes we could not push -- i.e. the socket
+      applied backpressure. EPOLLOUT must not be armed simply because a
+      viewer exists: a caught-up viewer on a quiet stream would then
+      make epoll_wait return immediately for ever, which measured as a
+      full CPU core burned by one idle viewer.
+
+      New ring data needs no EPOLLOUT of its own: the ingest socket
+      wakes the loop, and the pump runs on every iteration.
+     */
+    // Drive a WebSocket viewer's handshake and start of stream.
+    bool begin_ws_pump(const struct KeyEntry &ke, int slot,
+                       const VideoRing &ring, const TSScanner &scanner,
+                       time_t now)
+    {
+        return begin_ws(ke, slot, ring, scanner, now);
+    }
+
+    bool wants_write(void) const;
+    viewer_state state(void) const { return state_; }
+    viewer_kind kind(void) const { return kind_; }
+    uint32_t peer_ip_be(void) const { return peer_ip_be_; }
+    uint16_t peer_port_be(void) const { return peer_port_be_; }
+    time_t connected_at(void) const { return connected_at_; }
+    uint64_t bytes_sent(void) const { return bytes_sent_; }
+    const char *drop_reason(void) const { return drop_reason_; }
+
+    // Only ever a string literal: the field is a borrowed pointer and
+    // outlives nothing.
+    void set_drop_reason(const char *why) { drop_reason_ = why; }
+
+private:
+    int fd_ = -1;
+    int port2_ = 0;
+    viewer_state state_ = VV_DETECT;
+    viewer_kind kind_ = VVK_UNKNOWN;
+    uint32_t peer_ip_be_ = 0;
+    uint16_t peer_port_be_ = 0;
+    time_t connected_at_ = 0;
+    time_t last_progress_ = 0;
+    time_t behind_since_ = 0;
+
+    HttpRequest req_;
+    std::string out_;          // pending response bytes
+    size_t out_sent_ = 0;
+
+    uint64_t read_pos_ = 0;
+    bool streaming_ = false;
+    uint64_t bytes_sent_ = 0;
+    bool blocked_ = false;   // last send hit EAGAIN
+    /*
+      Set for a WebSocket viewer. The handshake is left in the socket
+      for WebSocket to consume: it reads and answers the upgrade
+      itself, so the detect phase peeks rather than consuming, and
+      only a plain-HTTP viewer's request is actually read off.
+     */
+    WebSocket *ws_ = nullptr;
+    bool ws_ready_ = false;
+    const char *drop_reason_ = "";
+
+    bool begin_stream(const struct KeyEntry &ke, int slot,
+                      const VideoRing &ring, const TSScanner &scanner,
+                      bool http, time_t now);
+    void fail(int code, const char *reason, const char *text);
+    bool flush(time_t now);
+    // A WS viewer must present a token (or the viewer password) before
+    // we complete the upgrade.
+    bool ws_authorise(const struct KeyEntry &ke, int slot,
+                      const HttpRequest &req);
+    bool begin_ws(const struct KeyEntry &ke, int slot, const VideoRing &ring,
+                  const TSScanner &scanner, time_t now);
+};
+
+/*
+  Is this viewer credential acceptable for the entry?
+
+  An unset viewer password means open viewing -- but note that a viewer
+  still cannot reach a stream that has no publisher, and a publisher
+  still had to be authorised, so "open" is narrower than it sounds.
+ */
+bool video_viewer_authorised(const struct KeyEntry &ke,
+                             const std::string &password);

From ee89c97f61e07f3727fcc8e1a8196dcdd634d30f Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <andrew@tridgell.net>
Date: Tue, 4 Aug 2026 17:30:12 +1000
Subject: [PATCH 4/6] webadmin: video settings, playback, log management and a
 server page

Video settings on the owner and admin forms, with ports allocated by an
admin -- they share one listening-port namespace, so letting every owner
pick invites collisions -- and everything else owner-controlled.

Browser playback is WebSocket to mpegts.js, vendored rather than loaded
from a CDN so an external script cannot change what runs in an
operator's browser. It authenticates with a short-lived token signed
with the entry's existing MAVLink key, minted on demand: a token
rendered once at page load is refused by every reconnect after the first
minute, which presents as "it only works if I reload".

The player's failure handling took several passes, each of which looked
right. A publisher going away is a clean close, reported as
LOADING_COMPLETE, so listening only for ERROR missed the one case
reconnect exists for. The video element is kept across reconnects,
because replacing it drops Picture-in-Picture. Only an unsupported codec
is permanent -- treating every MEDIA_ERROR that way gave up on the first
transient append failure, which Chrome raises far more readily than
Firefox, so an H.264 stream Firefox was playing reported "cannot decode,
probably HEVC" in Chrome and latched. And progress comes from the
element's own events, not MEDIA_INFO: that only fires once
MediaInfo.isComplete(), which requires hasAudio to be exactly true or
false, and it starts null and is set only when audio metadata arrives --
so a video-only stream never fires it, leaving the status stuck and the
error counter never reset.

Recordings can be deleted, one at a time or a whole day. An owner
deletes from their own entry and an admin from any, using the same auth
decorators and path grammar as the listing: the owner routes take no
port2, so there is nothing there to tamper with, and only names
SESSION_RE accepts are ever unlinked. Each directory component is opened
O_NOFOLLOW and the unlink is relative to that descriptor, so a symlink
swapped in along the path cannot redirect it. A file the daemon still
has open is refused -- asked of the kernel through /proc, not guessed
from mtime, because a quiet session's log can go untouched for longer
than any grace window while still being written, and unlinking it would
not stop the write.

Adds a server page: the daemon's log tailing live, and a restart. The
restart signals rather than shelling out, since the unit sets
Restart=always and runs as the same user as gunicorn, so systemctl and
the sudo it would need are avoided. Which process to signal is an
identity question, not a search: systemd's MainPID when it answers,
otherwise a supportproxy process with this installation's working
directory whose parent is not also supportproxy -- min(pid) alone would
pick up a second instance on the host or a reparented session child.
The signal goes through a pidfd where available, so the gap between
finding the pid and using it cannot land on a recycled number.

The tail is polled rather than streamed -- sync workers would be tied up
for as long as the page is open -- bounded at both ends, and it carries
the file identity so a rotation that truncates and regrows past the old
offset is reported rather than silently skipped. Credentials are
redacted again here, for logs written before the daemon learned to.

Row actions are icons -- download, delete, play -- as inline SVG rather
than an icon font or emoji, which the pages cannot fetch and which
render inconsistently; a bin glyph in particular is missing on plenty of
systems. Play is last because it is the only one not on every row, so
the others stay put. Each carries a title and an aria-label.
---
 tests/webadmin/test_connections.py         |   5 +-
 tests/webadmin/test_kill_connection.py     |   5 +-
 tests/webadmin/test_log_delete.py          | 178 ++++++++
 tests/webadmin/test_log_routes.py          |  56 +++
 tests/webadmin/test_log_video.py           | 367 ++++++++++++++++
 tests/webadmin/test_system.py              | 251 +++++++++++
 tests/webadmin/test_tooltips.py            | 205 +++++++++
 tests/webadmin/test_video_page.py          | 469 +++++++++++++++++++++
 tests/webadmin/test_video_ui.py            | 441 +++++++++++++++++++
 webadmin/__init__.py                       |   4 +
 webadmin/config.py                         |   6 +
 webadmin/connections.py                    |   9 +
 webadmin/forms.py                          | 339 ++++++++++++---
 webadmin/logs.py                           | 424 ++++++++++++++++++-
 webadmin/proxylog.py                       | 252 +++++++++++
 webadmin/routes_admin.py                   |  15 +-
 webadmin/routes_owner.py                   |   6 +
 webadmin/routes_system.py                  |  67 +++
 webadmin/routes_video.py                   | 115 +++++
 webadmin/static/style.css                  | 121 ++++++
 webadmin/static/vendor/mpegts.js/LICENSE   | 202 +++++++++
 webadmin/static/vendor/mpegts.js/VERSION   |  17 +
 webadmin/static/vendor/mpegts.js/mpegts.js |   9 +
 webadmin/static/video-toggle.js            |  78 ++++
 webadmin/templates/_macros.html            |  61 +++
 webadmin/templates/_video_fields.html      | 107 +++++
 webadmin/templates/admin_edit.html         |  28 +-
 webadmin/templates/admin_list.html         |  19 +-
 webadmin/templates/admin_logs.html         |  27 +-
 webadmin/templates/admin_system.html       |  90 ++++
 webadmin/templates/base.html               |   3 +
 webadmin/templates/log_play.html           |  55 +++
 webadmin/templates/login.html              |   5 +-
 webadmin/templates/owner.html              |  24 +-
 webadmin/templates/owner_logs.html         |  30 +-
 webadmin/templates/video.html              | 316 ++++++++++++++
 webadmin/videoform.py                      | 127 ++++++
 webadmin/videotoken.py                     |  51 +++
 38 files changed, 4469 insertions(+), 115 deletions(-)
 create mode 100644 tests/webadmin/test_log_delete.py
 create mode 100644 tests/webadmin/test_log_video.py
 create mode 100644 tests/webadmin/test_system.py
 create mode 100644 tests/webadmin/test_tooltips.py
 create mode 100644 tests/webadmin/test_video_page.py
 create mode 100644 tests/webadmin/test_video_ui.py
 create mode 100644 webadmin/proxylog.py
 create mode 100644 webadmin/routes_system.py
 create mode 100644 webadmin/routes_video.py
 create mode 100644 webadmin/static/vendor/mpegts.js/LICENSE
 create mode 100644 webadmin/static/vendor/mpegts.js/VERSION
 create mode 100644 webadmin/static/vendor/mpegts.js/mpegts.js
 create mode 100644 webadmin/static/video-toggle.js
 create mode 100644 webadmin/templates/_macros.html
 create mode 100644 webadmin/templates/_video_fields.html
 create mode 100644 webadmin/templates/admin_system.html
 create mode 100644 webadmin/templates/log_play.html
 create mode 100644 webadmin/templates/video.html
 create mode 100644 webadmin/videoform.py
 create mode 100644 webadmin/videotoken.py

diff --git a/tests/webadmin/test_connections.py b/tests/webadmin/test_connections.py
index 4fb0921..519a23b 100644
--- a/tests/webadmin/test_connections.py
+++ b/tests/webadmin/test_connections.py
@@ -22,7 +22,9 @@
 
 
 def _pack_entry(*, port2, conn_index, peer_ip, peer_port, transport,
-                is_user, connected_at, last_update, rx=0, tx=0, pid=12345):
+                is_user, connected_at, last_update, rx=0, tx=0, pid=12345,
+                role=conn_db.CONN_ROLE_MAVLINK, stream_idx=0,
+                app_proto=conn_db.CONN_APP_MAVLINK, authenticated=0):
     return struct.pack(
         conn_db.PACK_FORMAT,
         conn_db.CONN_MAGIC, connected_at, last_update,
@@ -32,6 +34,7 @@ def _pack_entry(*, port2, conn_index, peer_ip, peer_port, transport,
         socket.htons(peer_port),
         transport, 1 if is_user else 0,
         0, 0,  # flags + pad
+        role, stream_idx, app_proto, authenticated,
     )
 
 
diff --git a/tests/webadmin/test_kill_connection.py b/tests/webadmin/test_kill_connection.py
index 21c3637..e8cdc32 100644
--- a/tests/webadmin/test_kill_connection.py
+++ b/tests/webadmin/test_kill_connection.py
@@ -23,7 +23,9 @@
 
 def _pack_entry(*, port2, conn_index, peer_ip, peer_port, transport,
                 is_user, connected_at, last_update, rx=0, tx=0,
-                pid=12345, flags=0):
+                pid=12345, flags=0, role=conn_db.CONN_ROLE_MAVLINK,
+                stream_idx=0, app_proto=conn_db.CONN_APP_MAVLINK,
+                authenticated=0):
     return struct.pack(
         conn_db.PACK_FORMAT,
         conn_db.CONN_MAGIC, connected_at, last_update,
@@ -33,6 +35,7 @@ def _pack_entry(*, port2, conn_index, peer_ip, peer_port, transport,
         socket.htons(peer_port),
         transport, 1 if is_user else 0,
         flags, 0,  # flags, _pad
+        role, stream_idx, app_proto, authenticated,
     )
 
 
diff --git a/tests/webadmin/test_log_delete.py b/tests/webadmin/test_log_delete.py
new file mode 100644
index 0000000..4099ef4
--- /dev/null
+++ b/tests/webadmin/test_log_delete.py
@@ -0,0 +1,178 @@
+"""Deleting recordings from the web UI.
+
+Destructive and reachable by every owner, so the access boundary and the
+path handling matter more than the markup: an owner may only ever reach
+their own entry, and nothing outside the session-name grammar may be
+removed however the request is spelled.
+"""
+import os
+import time
+
+import pytest
+
+from webadmin import create_app
+
+from _test_helpers import (ALICE_PASS, ALICE_PORT1, ALICE_PORT2, BOB_PASS,
+                           BOB_PORT1, BOB_PORT2, login_as)
+
+DATE = '2026-08-03'
+NAME = '2026_08_03_10:00:00.tlog'
+VIDEO = '2026_08_03_10:00:00.v1.ts'
+
+
+@pytest.fixture
+def logs_app(keydb_path, tmp_path):
+    return create_app({
+        'TESTING': True,
+        'WTF_CSRF_ENABLED': False,
+        'SESSION_COOKIE_SECURE': False,
+        'KEYDB_PATH': keydb_path,
+        'LOGS_DIR': str(tmp_path / 'logs'),
+        'SECRET_KEY': 'test',
+    })
+
+
+@pytest.fixture
+def logs_client(logs_app):
+    return logs_app.test_client()
+
+
+def _seed(app, port2, names=(NAME, VIDEO), age_s=3600):
+    d = os.path.join(app.config['LOGS_DIR'], str(port2), DATE)
+    os.makedirs(d, exist_ok=True)
+    for n in names:
+        p = os.path.join(d, n)
+        with open(p, 'wb') as f:
+            f.write(b'x' * 128)
+        old = time.time() - age_s
+        os.utime(p, (old, old))
+    return d
+
+
+class TestOwnerDelete:
+    def test_owner_deletes_own_recording(self, logs_client, logs_app,
+                                         keydb_path):
+        d = _seed(logs_app, ALICE_PORT2)
+        login_as(logs_client, ALICE_PORT1, ALICE_PASS)
+        r = logs_client.post('/me/logs/%s/%s/delete' % (DATE, NAME),
+                             follow_redirects=True)
+        assert r.status_code == 200
+        assert not os.path.exists(os.path.join(d, NAME))
+        assert os.path.exists(os.path.join(d, VIDEO)), 'deleted too much'
+
+    def test_owner_deletes_a_video(self, logs_client, logs_app, keydb_path):
+        d = _seed(logs_app, ALICE_PORT2)
+        login_as(logs_client, ALICE_PORT1, ALICE_PASS)
+        logs_client.post('/me/logs/%s/%s/delete' % (DATE, VIDEO),
+                         follow_redirects=True)
+        assert not os.path.exists(os.path.join(d, VIDEO))
+
+    def test_owner_deletes_a_whole_day(self, logs_client, logs_app,
+                                       keydb_path):
+        d = _seed(logs_app, ALICE_PORT2)
+        login_as(logs_client, ALICE_PORT1, ALICE_PASS)
+        r = logs_client.post('/me/logs/%s/delete' % DATE,
+                             follow_redirects=True)
+        assert 'Deleted 2 files' in r.get_data(as_text=True)
+        assert not os.path.isdir(d), 'emptied date dir should be removed'
+
+    def test_owner_cannot_touch_another_entry(self, logs_client, logs_app,
+                                              keydb_path):
+        """The owner routes carry no port2, so there is nothing to
+        tamper with -- assert the other entry's files survive."""
+        other = _seed(logs_app, BOB_PORT2)
+        _seed(logs_app, ALICE_PORT2)
+        login_as(logs_client, ALICE_PORT1, ALICE_PASS)
+        logs_client.post('/me/logs/%s/delete' % DATE, follow_redirects=True)
+        assert os.path.exists(os.path.join(other, NAME))
+
+
+class TestAdminDelete:
+    def test_admin_deletes_any_entry(self, logs_client, logs_app, keydb_path):
+        d = _seed(logs_app, ALICE_PORT2)
+        login_as(logs_client, BOB_PORT1, BOB_PASS)      # bob is admin
+        logs_client.post('/admin/logs/%d/%s/%s/delete'
+                         % (ALICE_PORT2, DATE, NAME), follow_redirects=True)
+        assert not os.path.exists(os.path.join(d, NAME))
+
+    def test_non_admin_is_refused(self, logs_client, logs_app, keydb_path):
+        d = _seed(logs_app, BOB_PORT2)
+        login_as(logs_client, ALICE_PORT1, ALICE_PASS)  # alice is not admin
+        r = logs_client.post('/admin/logs/%d/%s/%s/delete'
+                             % (BOB_PORT2, DATE, NAME))
+        assert r.status_code == 403
+        assert os.path.exists(os.path.join(d, NAME))
+
+
+class TestRefusals:
+    def test_a_file_still_being_written_is_kept(self, logs_client, logs_app,
+                                                keydb_path):
+        """Unlinking a file the daemon still holds does not stop it
+        writing -- the space stays used and the file just disappears
+        from the listing."""
+        d = _seed(logs_app, ALICE_PORT2, names=(NAME,), age_s=0)
+        login_as(logs_client, ALICE_PORT1, ALICE_PASS)
+        r = logs_client.post('/me/logs/%s/%s/delete' % (DATE, NAME),
+                             follow_redirects=True)
+        assert 'still being written' in r.get_data(as_text=True)
+        assert os.path.exists(os.path.join(d, NAME))
+
+    def test_day_delete_keeps_active_files_and_says_so(self, logs_client,
+                                                       logs_app, keydb_path):
+        d = _seed(logs_app, ALICE_PORT2, names=(NAME,), age_s=3600)
+        _seed(logs_app, ALICE_PORT2, names=(VIDEO,), age_s=0)
+        login_as(logs_client, ALICE_PORT1, ALICE_PASS)
+        r = logs_client.post('/me/logs/%s/delete' % DATE,
+                             follow_redirects=True)
+        body = r.get_data(as_text=True)
+        assert 'Deleted 1 file' in body
+        assert '1 left in place' in body
+        assert os.path.exists(os.path.join(d, VIDEO))
+
+    def test_unrelated_files_are_never_removed(self, logs_client, logs_app,
+                                               keydb_path):
+        """Only names the session grammar accepts are touched, so a
+        whole-day delete cannot take anything else in the directory."""
+        d = _seed(logs_app, ALICE_PORT2)
+        keep = os.path.join(d, 'notes.txt')
+        with open(keep, 'w') as f:
+            f.write('keep me')
+        login_as(logs_client, ALICE_PORT1, ALICE_PASS)
+        logs_client.post('/me/logs/%s/delete' % DATE, follow_redirects=True)
+        assert os.path.exists(keep)
+        assert os.path.isdir(d), 'dir with survivors must not be removed'
+
+    @pytest.mark.parametrize('bad', [
+        '../../etc/passwd',
+        '..%2f..%2fetc%2fpasswd',
+        'session1.tlog/../../../x',
+    ])
+    def test_traversal_is_refused(self, logs_client, logs_app, keydb_path,
+                                  bad):
+        _seed(logs_app, ALICE_PORT2)
+        login_as(logs_client, ALICE_PORT1, ALICE_PASS)
+        r = logs_client.post('/me/logs/%s/%s/delete' % (DATE, bad))
+        assert r.status_code in (400, 404, 308)
+
+    def test_bad_date_is_refused(self, logs_client, logs_app, keydb_path):
+        login_as(logs_client, ALICE_PORT1, ALICE_PASS)
+        r = logs_client.post('/me/logs/..%2f..%2fetc/delete')
+        assert r.status_code in (400, 404, 308)
+
+
+class TestCsrf:
+    def test_delete_requires_a_token(self, keydb_path, tmp_path):
+        app = create_app({
+            'TESTING': True,
+            'WTF_CSRF_ENABLED': True,
+            'SESSION_COOKIE_SECURE': False,
+            'KEYDB_PATH': keydb_path,
+            'LOGS_DIR': str(tmp_path / 'logs'),
+            'SECRET_KEY': 'csrftest',
+        })
+        d = _seed(app, ALICE_PORT2)
+        c = app.test_client()
+        login_as(c, ALICE_PORT1, ALICE_PASS)
+        r = c.post('/me/logs/%s/%s/delete' % (DATE, NAME))
+        assert r.status_code == 400
+        assert os.path.exists(os.path.join(d, NAME))
diff --git a/tests/webadmin/test_log_routes.py b/tests/webadmin/test_log_routes.py
index bf3f072..9629651 100644
--- a/tests/webadmin/test_log_routes.py
+++ b/tests/webadmin/test_log_routes.py
@@ -542,3 +542,59 @@ def test_admin_routes_redirect_to_login(self, client):
         # require_admin aborts 403 for unauthenticated _refresh_role:
         # they're not logged in, so role check fails. Acceptable: 403.
         assert r.status_code == 403
+
+
+# ---------------------------------------------------------------------------
+# video segments in the log browser
+# ---------------------------------------------------------------------------
+
+class TestVideoSegments:
+    """Recordings live beside the tlogs and must be browsable the same way."""
+
+    def test_owner_sees_and_downloads_a_segment(self, client, logs_dir):
+        seed_session(logs_dir, ALICE_PORT2, '2026-08-01',
+                     '2026_08_01_10:00:00.v1.ts', b'\x47VIDEO')
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/me/logs/2026-08-01/').get_data(as_text=True)
+        assert '2026_08_01_10:00:00.v1.ts' in html
+
+        r = client.get('/me/logs/2026-08-01/2026_08_01_10:00:00.v1.ts')
+        assert r.status_code == 200
+        assert r.get_data() == b'\x47VIDEO'
+
+    def test_all_three_slots_are_listed(self, client, logs_dir):
+        for slot in (1, 2, 3):
+            seed_session(logs_dir, ALICE_PORT2, '2026-08-01',
+                         '2026_08_01_10:00:00.v%d.ts' % slot, b'\x47')
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/me/logs/2026-08-01/').get_data(as_text=True)
+        for slot in (1, 2, 3):
+            assert '2026_08_01_10:00:00.v%d.ts' % slot in html
+
+    def test_segments_sort_with_the_collision_suffix(self, client, logs_dir):
+        """The -N ordering fix must apply to the compound .vN.ts
+        extension too, not just .tlog/.bin."""
+        for name in ('2026_08_01_10:00:00-10.v1.ts',
+                     '2026_08_01_10:00:00.v1.ts',
+                     '2026_08_01_10:00:00-2.v1.ts'):
+            seed_session(logs_dir, ALICE_PORT2, '2026-08-01', name, b'\x47')
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/me/logs/2026-08-01/').get_data(as_text=True)
+        first = html.index('2026_08_01_10:00:00.v1.ts')
+        second = html.index('2026_08_01_10:00:00-2.v1.ts')
+        tenth = html.index('2026_08_01_10:00:00-10.v1.ts')
+        assert first < second < tenth, \
+            'video segments not in natural collision order'
+
+    @pytest.mark.parametrize('bad', [
+        '2026_08_01_10:00:00.v4.ts',     # slot out of range
+        '2026_08_01_10:00:00.ts',        # no slot
+        '2026_08_01_10:00:00.v1.tsx',    # not a segment
+        'evil.ts',
+    ])
+    def test_non_segment_names_are_refused(self, client, logs_dir, bad):
+        seed_session(logs_dir, ALICE_PORT2, '2026-08-01', bad, b'X')
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        r = client.get('/me/logs/2026-08-01/%s' % bad)
+        assert r.status_code == 404, \
+            '%s should not be servable' % bad
diff --git a/tests/webadmin/test_log_video.py b/tests/webadmin/test_log_video.py
new file mode 100644
index 0000000..fcd9e1d
--- /dev/null
+++ b/tests/webadmin/test_log_video.py
@@ -0,0 +1,367 @@
+"""Watching video from the logs view.
+
+A recorded segment is only useful if you can actually look at it, so the
+logs listing offers "watch" beside "download" for video files and a link
+to the live player for the entry. An admin reaches any entry's stream;
+an owner reaches only their own.
+"""
+import os
+import subprocess
+import time
+
+import pytest
+
+import keydb_lib
+
+from _test_helpers import (ALICE_PASS, ALICE_PORT1, ALICE_PORT2, BOB_PASS,
+                           BOB_PORT1, BOB_PORT2, login_as)
+
+from webadmin import create_app
+
+
+@pytest.fixture
+def logs_dir(tmp_path):
+    p = tmp_path / 'logs'
+    p.mkdir()
+    return p
+
+
+@pytest.fixture
+def app(keydb_path, logs_dir):
+    """Point LOGS_DIR at a per-test tmpdir.
+
+    The default fixture leaves it as the relative 'logs', which resolves
+    under the per-*worker* directory the root conftest chdirs into --
+    shared by every test in that worker, so seeded files leak between
+    them and a "this file is absent" assertion silently passes or fails
+    on whatever ran first.
+    """
+    return create_app({
+        'TESTING': True,
+        'WTF_CSRF_ENABLED': False,
+        'SESSION_COOKIE_SECURE': False,
+        'KEYDB_PATH': keydb_path,
+        'LOGS_DIR': str(logs_dir),
+        'SECRET_KEY': 'test',
+    })
+
+DATE = '2026-08-02'
+VIDEO = '2026_08_02_11:11:19.v1.ts'
+VIDEO2 = '2026_08_02_11:13:24-2.v1.ts'
+TLOG = '2026_08_02_11:09:10.tlog'
+VPORT = 40001
+
+# A tiny but structurally real MPEG-TS payload: sync byte, then filler.
+TS_BYTES = (bytes([0x47, 0x40, 0x00, 0x10]) + b'\xff' * 184) * 4
+
+
+def _seed_logs(app, port2, names=(VIDEO, TLOG)):
+    root = os.path.join(app.config['LOGS_DIR'], str(port2), DATE)
+    os.makedirs(root, exist_ok=True)
+    for n in names:
+        with open(os.path.join(root, n), 'wb') as f:
+            f.write(TS_BYTES if n.endswith('.ts') else b'\xfd' * 100)
+    return root
+
+
+def _seed_real_ts(app, port2):
+    """Seed a genuinely decodable segment, generated with ffmpeg.
+
+    The synthetic TS_BYTES above is structurally valid but contains no
+    actual video, so a remux of it produces nothing -- these tests need
+    a file ffmpeg can really read.
+    """
+    import shutil as _sh
+    if _sh.which('ffmpeg') is None:
+        return None
+    root = os.path.join(app.config['LOGS_DIR'], str(port2), DATE)
+    os.makedirs(root, exist_ok=True)
+    dest = os.path.join(root, VIDEO)
+    subprocess.run(
+        ['ffmpeg', '-hide_banner', '-loglevel', 'error', '-f', 'lavfi',
+         '-i', 'testsrc2=size=128x72:rate=10', '-t', '1',
+         '-c:v', 'libx264', '-preset', 'ultrafast', '-g', '10',
+         '-pix_fmt', 'yuv420p', '-f', 'mpegts', dest, '-y'],
+        check=True)
+    return root
+
+
+def _enable_video(keydb_path, port2, ports=(VPORT, 0, 0)):
+    db = keydb_lib.open_db(keydb_path)
+    db.transaction_start()
+    ke = keydb_lib.KeyEntry(port2)
+    ke.fetch(db)
+    ke.flags |= keydb_lib.FLAG_VIDEO
+    ke.video_ports = list(ports)
+    ke.store(db)
+    db.transaction_prepare_commit()
+    db.transaction_commit()
+    db.close()
+
+
+class TestWatchLinkInLogsView:
+    def test_video_file_offers_watch(self, client, app, keydb_path):
+        _seed_logs(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/logs/%d/%s/' % (ALICE_PORT2, DATE)) \
+            .get_data(as_text=True)
+        assert 'aria-label="Play"' in html
+        assert VIDEO in html
+
+    def test_tlog_offers_download_only(self, client, app, keydb_path):
+        """A .tlog has nothing to watch; offering a player would be a
+        dead link."""
+        _seed_logs(app, ALICE_PORT2, names=(TLOG,))
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/logs/%d/%s/' % (ALICE_PORT2, DATE)) \
+            .get_data(as_text=True)
+        assert 'aria-label="Download"' in html
+        assert 'aria-label="Play"' not in html
+
+    def test_owner_sees_watch_on_their_own(self, client, app, keydb_path):
+        _seed_logs(app, ALICE_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/me/logs/%s/' % DATE).get_data(as_text=True)
+        assert 'aria-label="Play"' in html
+
+    def test_collision_suffixed_video_is_recognised(self, client, app,
+                                                    keydb_path):
+        """<ts>-2.v1.ts is a real filename the recorder produces on a
+        same-second collision, and it must still be playable."""
+        _seed_logs(app, ALICE_PORT2, names=(VIDEO2,))
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/logs/%d/%s/' % (ALICE_PORT2, DATE)) \
+            .get_data(as_text=True)
+        assert 'aria-label="Play"' in html
+
+
+class TestWatchPage:
+    def test_admin_can_open_any_entry(self, client, app, keydb_path):
+        _seed_logs(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/admin/logs/%d/%s/%s/watch'
+                       % (ALICE_PORT2, DATE, VIDEO))
+        assert r.status_code == 200
+        html = r.get_data(as_text=True)
+        assert '<video' in html
+        # Native <video> on a remuxed MP4, not a JS player: this must
+        # keep working with JavaScript disabled.
+        assert 'play.mp4' in html
+
+    def test_owner_can_open_their_own(self, client, app, keydb_path):
+        _seed_logs(app, ALICE_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        r = client.get('/me/logs/%s/%s/watch' % (DATE, VIDEO))
+        assert r.status_code == 200
+
+    def test_watching_a_tlog_is_refused(self, client, app, keydb_path):
+        _seed_logs(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/admin/logs/%d/%s/%s/watch'
+                       % (ALICE_PORT2, DATE, TLOG))
+        assert r.status_code == 404
+
+    def test_traversal_is_refused(self, client, app, keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        for bad in ('..%2f..%2fevil.v1.ts', 'evil.v1.ts%00', '../evil.v1.ts'):
+            r = client.get('/admin/logs/%d/%s/%s/watch'
+                           % (ALICE_PORT2, DATE, bad))
+            assert r.status_code in (301, 308, 404), bad
+
+
+class TestStreamRoute:
+    def test_serves_inline_not_as_a_download(self, client, app, keydb_path):
+        """A player cannot use a Content-Disposition: attachment."""
+        _seed_logs(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/admin/logs/%d/%s/%s/stream'
+                       % (ALICE_PORT2, DATE, VIDEO))
+        assert r.status_code == 200
+        assert 'attachment' not in r.headers.get('Content-Disposition', '')
+        assert r.headers['Content-Type'].startswith('video/')
+        assert r.get_data() == TS_BYTES
+
+    def test_supports_range_so_seeking_works(self, client, app, keydb_path):
+        _seed_logs(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/admin/logs/%d/%s/%s/stream'
+                       % (ALICE_PORT2, DATE, VIDEO),
+                       headers={'Range': 'bytes=0-187'})
+        assert r.status_code == 206
+        assert len(r.get_data()) == 188
+
+    def test_recordings_are_not_cached(self, client, app, keydb_path):
+        _seed_logs(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/admin/logs/%d/%s/%s/stream'
+                       % (ALICE_PORT2, DATE, VIDEO))
+        assert 'no-store' in r.headers['Cache-Control']
+
+    def test_streaming_a_tlog_is_refused(self, client, app, keydb_path):
+        """Otherwise the inline path becomes a way to render raw
+        telemetry in a browser tab."""
+        _seed_logs(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/admin/logs/%d/%s/%s/stream'
+                       % (ALICE_PORT2, DATE, TLOG))
+        assert r.status_code == 404
+
+
+class TestAccessControl:
+    def test_owner_cannot_stream_another_entry(self, client, app,
+                                               keydb_path):
+        """The owner route resolves port2 from the session, so there is
+        no parameter to tamper with -- assert that stays true."""
+        _seed_logs(app, BOB_PORT2)
+        _seed_logs(app, ALICE_PORT2, names=())
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        r = client.get('/me/logs/%s/%s/stream' % (DATE, VIDEO))
+        assert r.status_code == 404
+
+    def test_owner_cannot_use_the_admin_route(self, client, app, keydb_path):
+        _seed_logs(app, BOB_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        r = client.get('/admin/logs/%d/%s/%s/stream'
+                       % (BOB_PORT2, DATE, VIDEO))
+        assert r.status_code in (302, 403)
+
+    def test_anonymous_is_refused(self, client, app, keydb_path):
+        _seed_logs(app, ALICE_PORT2)
+        for url in ('/admin/logs/%d/%s/%s/stream' % (ALICE_PORT2, DATE, VIDEO),
+                    '/me/logs/%s/%s/stream' % (DATE, VIDEO)):
+            r = client.get(url)
+            assert r.status_code in (302, 401, 403), url
+
+
+class TestLiveVideoLinks:
+    def test_admin_list_links_to_each_entry_with_video(self, client,
+                                                       keydb_path):
+        """The video page already accepted ?port2= for admins; nothing
+        linked to it, so reaching another entry's stream meant editing
+        the URL by hand."""
+        _enable_video(keydb_path, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/').get_data(as_text=True)
+        assert 'port2=%d' % ALICE_PORT2 in html
+
+    def test_no_video_link_for_an_entry_without_video(self, client,
+                                                      keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/').get_data(as_text=True)
+        assert '/video/?port2=' not in html
+
+    def test_logs_page_links_to_the_live_player(self, client, app,
+                                                keydb_path):
+        _enable_video(keydb_path, ALICE_PORT2)
+        _seed_logs(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/logs/%d/' % ALICE_PORT2) \
+            .get_data(as_text=True)
+        assert 'watch live video' in html
+
+    def test_no_live_link_when_no_port_is_allocated(self, client, app,
+                                                    keydb_path):
+        """Video enabled but no port bound means nothing to watch."""
+        _enable_video(keydb_path, ALICE_PORT2, ports=(0, 0, 0))
+        _seed_logs(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/logs/%d/' % ALICE_PORT2) \
+            .get_data(as_text=True)
+        assert 'watch live video' not in html
+
+    def test_admin_can_open_another_entrys_live_player(self, client,
+                                                       keydb_path):
+        _enable_video(keydb_path, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/video/?port2=%d' % ALICE_PORT2)
+        assert r.status_code == 200
+        assert str(VPORT) in r.get_data(as_text=True)
+
+    def test_owner_cannot_open_another_entrys_live_player(self, client,
+                                                          keydb_path):
+        _enable_video(keydb_path, BOB_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        assert client.get('/video/?port2=%d' % BOB_PORT2).status_code == 403
+
+
+class TestRemuxToMp4:
+    """Browsers cannot demux MPEG-TS, so the recording is remuxed to
+    fragmented MP4 on the way out. It is a stream copy, so this costs
+    no decoding."""
+
+    def _skip_without_ffmpeg(self):
+        import shutil
+        if shutil.which('ffmpeg') is None:
+            pytest.skip('ffmpeg not installed')
+
+    def test_serves_a_real_mp4(self, client, app, keydb_path, tmp_path):
+        self._skip_without_ffmpeg()
+        root = _seed_real_ts(app, ALICE_PORT2)
+        assert root
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/admin/logs/%d/%s/%s/play.mp4'
+                       % (ALICE_PORT2, DATE, VIDEO))
+        assert r.status_code == 200
+        assert r.headers['Content-Type'].startswith('video/mp4')
+        data = r.get_data()
+        # An MP4 starts with a box length then 'ftyp'.
+        assert data[4:8] == b'ftyp', data[:16]
+        assert len(data) > 1000
+
+    def test_inline_not_attachment(self, client, app, keydb_path):
+        self._skip_without_ffmpeg()
+        _seed_real_ts(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/admin/logs/%d/%s/%s/play.mp4'
+                       % (ALICE_PORT2, DATE, VIDEO))
+        assert 'attachment' not in r.headers.get('Content-Disposition', '')
+
+    def test_not_cached(self, client, app, keydb_path):
+        self._skip_without_ffmpeg()
+        _seed_real_ts(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/admin/logs/%d/%s/%s/play.mp4'
+                       % (ALICE_PORT2, DATE, VIDEO))
+        assert 'no-store' in r.headers['Cache-Control']
+
+    def test_tlog_is_refused(self, client, app, keydb_path):
+        _seed_logs(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/admin/logs/%d/%s/%s/play.mp4'
+                       % (ALICE_PORT2, DATE, TLOG))
+        assert r.status_code == 404
+
+    def test_missing_file_is_404_not_a_hanging_ffmpeg(self, client, app,
+                                                      keydb_path):
+        _seed_logs(app, ALICE_PORT2, names=())
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/admin/logs/%d/%s/%s/play.mp4'
+                       % (ALICE_PORT2, DATE, VIDEO))
+        assert r.status_code == 404
+
+    def test_owner_route_is_scoped_to_their_own_entry(self, client, app,
+                                                      keydb_path):
+        self._skip_without_ffmpeg()
+        _seed_real_ts(app, BOB_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        r = client.get('/me/logs/%s/%s/play.mp4' % (DATE, VIDEO))
+        assert r.status_code == 404
+
+    def test_no_ffmpeg_left_running_afterwards(self, client, app,
+                                               keydb_path):
+        """The generator kills ffmpeg in a finally, so a client that
+        disconnects mid-stream cannot leak one."""
+        self._skip_without_ffmpeg()
+        import subprocess as sp
+        _seed_real_ts(app, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        before = sp.run(['pgrep', '-c', '-x', 'ffmpeg'],
+                        capture_output=True, text=True).stdout.strip() or '0'
+        r = client.get('/admin/logs/%d/%s/%s/play.mp4'
+                       % (ALICE_PORT2, DATE, VIDEO))
+        r.get_data()
+        r.close()
+        time.sleep(0.5)
+        after = sp.run(['pgrep', '-c', '-x', 'ffmpeg'],
+                       capture_output=True, text=True).stdout.strip() or '0'
+        assert int(after) <= int(before)
diff --git a/tests/webadmin/test_system.py b/tests/webadmin/test_system.py
new file mode 100644
index 0000000..7972c1d
--- /dev/null
+++ b/tests/webadmin/test_system.py
@@ -0,0 +1,251 @@
+"""The server page: the daemon's own log, and restarting it.
+
+Both are admin-only and both are more dangerous than the rest of the
+UI -- the log carries whatever the daemon printed, and the restart drops
+every live session -- so the access checks matter more than the markup.
+"""
+import os
+
+import pytest
+
+from webadmin import proxylog
+
+from webadmin import create_app
+
+from _test_helpers import (ALICE_PASS, ALICE_PORT1, BOB_PASS, BOB_PORT1,
+                           login_as)
+
+
+@pytest.fixture
+def csrf_client(keydb_path):
+    """CSRF on, as production runs it."""
+    return create_app({
+        'TESTING': True,
+        'WTF_CSRF_ENABLED': True,
+        'SESSION_COOKIE_SECURE': False,
+        'KEYDB_PATH': keydb_path,
+        'SECRET_KEY': 'csrftest',
+    }).test_client()
+
+
+def _write_log(app, text):
+    path = proxylog.log_path(app)
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    with open(path, 'w') as f:
+        f.write(text)
+    return path
+
+
+class TestAccess:
+    def test_owner_cannot_see_the_server_page(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        assert client.get('/admin/system/').status_code == 403
+
+    def test_owner_cannot_read_the_log(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        assert client.get('/admin/system/log').status_code == 403
+
+    def test_owner_cannot_restart(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        assert client.post('/admin/system/restart').status_code == 403
+
+    def test_logged_out_is_refused(self, client, keydb_path):
+        r = client.get('/admin/system/')
+        assert r.status_code in (302, 403)
+
+    def test_admin_sees_the_page(self, client, keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/admin/system/')
+        assert r.status_code == 200
+        assert 'Restart proxy' in r.get_data(as_text=True)
+
+
+class TestLogTail:
+    def test_first_fetch_returns_the_tail(self, client, app, keydb_path):
+        _write_log(app, 'alpha\nbravo\ncharlie\n')
+        login_as(client, BOB_PORT1, BOB_PASS)
+        d = client.get('/admin/system/log').get_json()
+        assert 'charlie' in d['text']
+        assert d['offset'] > 0
+
+    def test_incremental_fetch_returns_only_new_bytes(self, client, app,
+                                                      keydb_path):
+        path = _write_log(app, 'one\n')
+        login_as(client, BOB_PORT1, BOB_PASS)
+        first = client.get('/admin/system/log').get_json()
+        with open(path, 'a') as f:
+            f.write('two\n')
+        second = client.get(
+            '/admin/system/log?offset=%d' % first['offset']).get_json()
+        assert second['text'] == 'two\n'
+        assert not second['restarted']
+
+    def test_rotation_is_reported_not_silently_appended(self, client, app,
+                                                        keydb_path):
+        """copytruncate leaves the file shorter than the reader's offset.
+
+        Without noticing, the page would append forever to an offset
+        past the end and quietly show nothing new.
+        """
+        path = _write_log(app, 'x' * 5000)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        first = client.get('/admin/system/log').get_json()
+        with open(path, 'w') as f:          # truncate, as logrotate does
+            f.write('after rotation\n')
+        d = client.get(
+            '/admin/system/log?offset=%d' % first['offset']).get_json()
+        assert d['restarted']
+        assert 'after rotation' in d['text']
+
+    def test_rotation_is_caught_even_if_the_log_regrows(self, client, app,
+                                                         keydb_path):
+        """Truncated in place, then grown past the reader's offset.
+
+        This is what copytruncate does, and neither size nor inode sees
+        it: the file is longer than the old offset again, and the inode
+        never changed. Only the contents did.
+        """
+        path = _write_log(app, 'x' * 200 + '\n')
+        login_as(client, BOB_PORT1, BOB_PASS)
+        first = client.get('/admin/system/log').get_json()
+        before = os.stat(path).st_ino
+        with open(path, 'w') as f:            # truncate in place
+            f.write('y' * 5000 + '\nnew generation\n')
+        assert os.stat(path).st_ino == before, 'meant to keep the inode'
+        d = client.get('/admin/system/log?offset=%d&ident=%s'
+                       % (first['offset'], first['ident'])).get_json()
+        assert d['restarted']
+        assert 'new generation' in d['text']
+
+    def test_rotation_is_caught_when_the_inode_is_reused(self, client, app,
+                                                         keydb_path):
+        """Replaced by a new file that happens to get the old inode.
+
+        Observed on CI: unlink-and-create handed the freed inode
+        straight back, so an identity built only from (dev, inode) saw
+        no change and the page appended the new generation to the old
+        as though it were contiguous.
+        """
+        path = _write_log(app, 'x' * 200 + '\n')
+        login_as(client, BOB_PORT1, BOB_PASS)
+        first = client.get('/admin/system/log').get_json()
+        os.unlink(path)
+        with open(path, 'w') as f:
+            f.write('z' * 5000 + '\nsecond generation\n')
+        d = client.get('/admin/system/log?offset=%d&ident=%s'
+                       % (first['offset'], first['ident'])).get_json()
+        assert d['restarted']
+        assert 'second generation' in d['text']
+
+    def test_a_viewer_password_is_redacted(self, client, app, keydb_path):
+        """Not just the 60-second token: ?pw= is a long-lived
+        credential, and the old pattern knew nothing about it."""
+        _write_log(app, 'video: websocket viewer on /v1?pw=hunter2 (TLS)\n')
+        login_as(client, BOB_PORT1, BOB_PASS)
+        d = client.get('/admin/system/log').get_json()
+        assert 'hunter2' not in d['text']
+        assert '<redacted>' in d['text']
+
+    def test_an_uppercase_token_is_redacted(self, client, app, keydb_path):
+        """The old pattern demanded lowercase hex after a literal dot."""
+        _write_log(app, 'viewer on /v1?t=1785664967.DEADBEEFCAFE0123\n')
+        login_as(client, BOB_PORT1, BOB_PASS)
+        d = client.get('/admin/system/log').get_json()
+        assert 'DEADBEEFCAFE0123' not in d['text']
+
+    def test_viewer_tokens_are_redacted(self, client, app, keydb_path):
+        _write_log(app, 'video: websocket viewer on /v1?t=1785664967.'
+                        'deadbeefcafe0123 (TLS)\n')
+        login_as(client, BOB_PORT1, BOB_PASS)
+        d = client.get('/admin/system/log').get_json()
+        assert 'deadbeefcafe0123' not in d['text']
+        assert '<redacted>' in d['text']
+
+    def test_missing_log_is_not_an_error(self, client, app, keydb_path):
+        path = proxylog.log_path(app)
+        if os.path.exists(path):
+            os.unlink(path)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        d = client.get('/admin/system/log').get_json()
+        assert d['text'] == ''
+
+
+class TestRestart:
+    def test_restart_requires_csrf(self, csrf_client, keydb_path):
+        login_as(csrf_client, BOB_PORT1, BOB_PASS)
+        r = csrf_client.post('/admin/system/restart', data={})
+        assert r.status_code == 400
+
+    def test_restart_reports_when_no_daemon_is_running(self, client,
+                                                       keydb_path,
+                                                       monkeypatch):
+        monkeypatch.setattr(proxylog, 'find_daemon', lambda w=None: None)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.post('/admin/system/restart', follow_redirects=True)
+        assert 'no running supportproxy process' in r.get_data(as_text=True)
+
+    def test_restart_signals_the_pid_it_found(self, client, keydb_path,
+                                              monkeypatch):
+        sent = {}
+        monkeypatch.setattr(proxylog, 'find_daemon', lambda w=None: 4242)
+        # Force the non-pidfd path so the fake kill is what runs.
+        monkeypatch.delattr(proxylog.os, 'pidfd_open', raising=False)
+        monkeypatch.setattr(proxylog, '_comm',
+                            lambda pid: proxylog.SUPPORTPROXY_COMM)
+        monkeypatch.setattr(proxylog.os, 'kill',
+                            lambda pid, sig: sent.update(pid=pid, sig=sig))
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.post('/admin/system/restart', follow_redirects=True)
+        assert sent == {'pid': 4242, 'sig': proxylog.signal.SIGTERM}
+        assert '4242' in r.get_data(as_text=True)
+
+
+class TestFindDaemon:
+    """Which process gets signalled.
+
+    min(pid) over everything named supportproxy is not an identity: it
+    picks up a second instance on the same host, and a session child
+    that was reparented when its own parent exited. Both mean the
+    restart hits the wrong process.
+    """
+
+    def _tree(self, monkeypatch, tree, cwds):
+        monkeypatch.setattr(proxylog, '_systemd_main_pid', lambda u=None: None)
+        monkeypatch.setattr(proxylog.os, 'listdir',
+                            lambda p: [str(k) for k in tree])
+        monkeypatch.setattr(proxylog, '_comm',
+                            lambda pid: tree.get(pid, (None, None))[0])
+        monkeypatch.setattr(proxylog, '_ppid',
+                            lambda pid: tree.get(pid, (None, None))[1])
+        monkeypatch.setattr(proxylog, '_cwd', lambda pid: cwds.get(pid))
+
+    def test_prefers_the_parent_over_its_children(self, monkeypatch):
+        tree = {100: (proxylog.SUPPORTPROXY_COMM, 1),
+                101: (proxylog.SUPPORTPROXY_COMM, 100),
+                102: (proxylog.SUPPORTPROXY_COMM, 100),
+                200: ('something-else', 1)}
+        self._tree(monkeypatch, tree, {p: '/srv/proxy' for p in tree})
+        assert proxylog.find_daemon('/srv/proxy') == 100
+
+    def test_ignores_another_instance(self, monkeypatch):
+        """A staging daemon with a lower pid must not be signalled."""
+        tree = {50: (proxylog.SUPPORTPROXY_COMM, 1),
+                100: (proxylog.SUPPORTPROXY_COMM, 1)}
+        self._tree(monkeypatch, tree,
+                   {50: '/srv/staging', 100: '/srv/proxy'})
+        assert proxylog.find_daemon('/srv/proxy') == 100
+
+    def test_ignores_a_reparented_child(self, monkeypatch):
+        """An orphaned session child has ppid 1 and the right cwd, so
+        only the comm of its parent distinguished it before -- and once
+        reparented there is no such parent. It must not win on pid."""
+        tree = {90: (proxylog.SUPPORTPROXY_COMM, 1),
+                100: (proxylog.SUPPORTPROXY_COMM, 1)}
+        self._tree(monkeypatch, tree, {90: '/other', 100: '/srv/proxy'})
+        assert proxylog.find_daemon('/srv/proxy') == 100
+
+    def test_systemd_is_authoritative(self, monkeypatch):
+        monkeypatch.setattr(proxylog, '_systemd_main_pid', lambda u=None: 777)
+        monkeypatch.setattr(proxylog, '_comm',
+                            lambda pid: proxylog.SUPPORTPROXY_COMM)
+        assert proxylog.find_daemon('/srv/proxy') == 777
diff --git a/tests/webadmin/test_tooltips.py b/tests/webadmin/test_tooltips.py
new file mode 100644
index 0000000..4db2416
--- /dev/null
+++ b/tests/webadmin/test_tooltips.py
@@ -0,0 +1,205 @@
+"""Per-field help tooltips.
+
+Every option that is not self-explanatory carries its explanation in the
+WTForms `description`, which templates/_macros.html renders as a tooltip
+beside the label. Two things are worth guarding: that the tooltips
+actually reach the page, and that a newly added option cannot quietly
+ship without one.
+"""
+import re
+
+from _test_helpers import (ALICE_PASS, ALICE_PORT1, ALICE_PORT2, BOB_PASS,
+                           BOB_PORT1, login_as)
+
+from webadmin import forms
+
+# Fields that legitimately have no `description`.
+#
+# The per-slot video booleans are documented by hand in
+# _video_fields.html instead: three slots x three options would mean nine
+# near-identical strings in forms.py, and the row is rendered by hand
+# there anyway.
+_NO_DESCRIPTION_NEEDED = {'submit', 'csrf_token'}
+
+
+def _documented(form_cls):
+    """(fields needing a description, fields having one)."""
+    form = form_cls(meta={'csrf': False})
+    need, have = set(), set()
+    for field in form:
+        name = field.name
+        if name in _NO_DESCRIPTION_NEEDED:
+            continue
+        if re.match(r'^video_(srt|record|rawtcp)_\d$', name):
+            continue
+        need.add(name)
+        if field.description:
+            have.add(name)
+    return need, have
+
+
+class TestEveryOptionIsDocumented:
+    """A new option must not ship without help text."""
+
+    def test_admin_edit_form(self, app):
+        with app.test_request_context():
+            need, have = _documented(forms.AdminEditForm)
+        assert need - have == set(), 'fields with no description'
+
+    def test_owner_edit_form(self, app):
+        with app.test_request_context():
+            need, have = _documented(forms.OwnerEditForm)
+        assert need - have == set(), 'fields with no description'
+
+    def test_admin_add_form(self, app):
+        with app.test_request_context():
+            need, have = _documented(forms.AdminAddForm)
+        assert need - have == set(), 'fields with no description'
+
+    def test_login_form(self, app):
+        with app.test_request_context():
+            need, have = _documented(forms.LoginForm)
+        assert need - have == set(), 'fields with no description'
+
+    def test_the_check_would_catch_a_missing_one(self, app):
+        """Guard the guard: a field with no description must be caught,
+        or these tests pass for the wrong reason."""
+        class Undocumented(forms.LoginForm):
+            pass
+        Undocumented.mystery = forms.BooleanField('Mystery option')
+        with app.test_request_context():
+            need, have = _documented(Undocumented)
+        assert 'mystery' in need - have
+
+
+class TestTooltipsRender:
+    def test_admin_edit_page_has_tooltips(self, client, keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        assert html.count('class="tip"') > 10
+
+    def test_owner_page_has_tooltips(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/me/').get_data(as_text=True)
+        assert html.count('class="tip"') > 8
+
+    def test_login_page_has_tooltips(self, client):
+        html = client.get('/login').get_data(as_text=True)
+        assert 'class="tip"' in html
+
+    def test_add_entry_form_has_tooltips(self, client, keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/').get_data(as_text=True)
+        assert 'class="tip"' in html
+
+    def test_specific_help_text_reaches_the_page(self, client, keydb_path):
+        """Spot-check that the detail that used to be in the label is
+        still shown, just moved into the tooltip."""
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        assert 'LOG_BACKEND_TYPE' in html          # binlog
+        assert 'keeps them forever' in html        # retention
+        assert 'replays' in html                   # reset timestamp
+
+    def test_the_whole_row_is_the_target_not_a_marker(self, client,
+                                                       keydb_path):
+        """Aiming at a one-em "?" to read a sentence is more work than
+        the sentence is worth."""
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        assert 'class="help"' not in html, 'the ? marker is gone'
+        assert '>?<' not in html
+
+    def test_reachable_without_a_pointer(self, client, keydb_path):
+        """Focusing the input is what shows it for keyboard users, and
+        aria-describedby ties the text to the control."""
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        assert 'aria-describedby=' in html
+        assert ':focus-within' in _css_rules(client)
+
+    def test_video_slot_options_are_documented_in_the_template(
+            self, client, keydb_path):
+        """These three are exempt from the forms.py check, so make sure
+        they really are documented where they are rendered."""
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        assert 'cannot share a port' in html       # SRT
+        assert 'timestamped .ts segments' in html  # record
+        assert 'ffplay tcp://' in html             # raw TCP viewers
+
+    def test_description_is_escaped(self, app):
+        """Descriptions are trusted text today, but they are rendered
+        into HTML, so the macro must not become an injection point if one
+        ever contains a bracket."""
+        from markupsafe import Markup
+        from flask import render_template_string
+
+        class F(forms.LoginForm):
+            pass
+        F.evil = forms.StringField('Evil',
+                                   description='<script>alert(1)</script>')
+        with app.test_request_context():
+            f = F(meta={'csrf': False})
+            out = render_template_string(
+                '{% from "_macros.html" import row %}{{ row(form.evil) }}',
+                form=f)
+        assert '<script>' not in out
+        assert '&lt;script&gt;' in out
+        assert isinstance(Markup(out), Markup)
+
+
+def _css_rules(client):
+    """The stylesheet with comments stripped.
+
+    The comments quote the selectors they explain, so a test looking for
+    a rule will happily match the prose about it instead."""
+    css = client.get('/static/style.css').get_data(as_text=True)
+    return re.sub(r'/\*.*?\*/', '', css, flags=re.S)
+
+
+class TestStylesheet:
+    def test_tip_rules_are_present(self, client):
+        css = _css_rules(client)
+        assert '.field:hover > .tip' in css
+        assert ':focus' in css, 'tooltip must open on keyboard focus'
+
+    def test_row_selector_is_direct_child_only(self, client):
+        """The per-slot video row holds three separately documented
+        checkboxes; a descendant selector would throw all three
+        tooltips up at once when the row is hovered."""
+        css = _css_rules(client)
+        assert '.field:hover > .tip' in css
+        assert '.field:hover .tip' not in css.replace('.field:hover > .tip', '')
+
+    def test_appearing_is_delayed(self, client):
+        """Without a delay, every row crossed on the way to the wanted
+        one flashes a tooltip."""
+        css = _css_rules(client)
+        m = re.search(r'\.field:hover > \.tip[^{]*\{([^}]*)\}', css)
+        assert m, 'no .field:hover > .tip rule'
+        assert 'transition' in m.group(1)
+        assert '0.4s' in m.group(1), 'no delay before the tooltip appears'
+
+    def test_tooltip_never_swallows_a_click(self, client):
+        css = _css_rules(client)
+        assert 'pointer-events: none' in css
+
+    def test_tip_is_anchored_to_the_field_not_the_marker(self, client):
+        """Anchoring to the marker puts the tip's left edge wherever the
+        label ends, so a marker in the right-hand part of a row pushes
+        its tip off the page on a narrow screen -- and CSS cannot measure
+        the space to flip it. Anchored to .field it is always within the
+        body's own width."""
+        css = _css_rules(client)
+        assert re.search(r'\.field\s*\{[^}]*position:\s*relative', css), \
+            '.field must be the containing block'
+        assert not re.search(r'\.help\s*\{[^}]*position:\s*relative', css), \
+            '.help must stay unpositioned or it becomes the anchor again'
+
+    def test_tip_width_is_capped_by_the_viewport(self, client):
+        """Body is max-width 960px with 1rem padding, so below that the
+        content width is exactly 100vw - 2rem. Capping the tip to the
+        same value is what keeps it on screen on a phone."""
+        css = client.get('/static/style.css').get_data(as_text=True)
+        assert '100vw' in css, 'tip width must be bounded by the viewport'
diff --git a/tests/webadmin/test_video_page.py b/tests/webadmin/test_video_page.py
new file mode 100644
index 0000000..5f73587
--- /dev/null
+++ b/tests/webadmin/test_video_page.py
@@ -0,0 +1,469 @@
+"""The browser playback page and its viewer tokens.
+
+The token exists so the viewer password never appears in a URL, where
+it would land in history, proxy logs and Referer headers. It is signed
+with the entry's existing MAVLink key, which the video child already
+loads -- so browser playback introduces no new shared secret.
+"""
+import time
+
+import pytest
+
+import keydb_lib
+from webadmin import videotoken
+
+from _test_helpers import (ALICE_PASS, ALICE_PORT1, ALICE_PORT2, BOB_PASS,
+                           BOB_PORT1, BOB_PORT2, fetch_entry, login_as)
+
+VPORT = 21001
+
+
+def _enable_video(keydb_path, port2, ports=(VPORT,), viewer_pass=None):
+    db = keydb_lib.open_db(keydb_path)
+    db.transaction_start()
+    keydb_lib.set_flag(db, port2, 'video')
+    keydb_lib.set_video_ports(db, port2, list(ports))
+    if viewer_pass:
+        keydb_lib.set_video_viewer_pass(db, port2, viewer_pass)
+    db.transaction_prepare_commit()
+    db.transaction_commit()
+    db.close()
+
+
+class TestVideoPage:
+    def test_page_lists_configured_slots(self, client, keydb_path):
+        _enable_video(keydb_path, ALICE_PORT2, ports=(VPORT, VPORT + 1))
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/video/').get_data(as_text=True)
+        assert 'Slot 1' in html and str(VPORT) in html
+        assert 'Slot 2' in html and str(VPORT + 1) in html
+        assert 'Slot 3' not in html, 'unallocated slot should not appear'
+
+    def test_page_explains_when_no_ports_allocated(self, client, keydb_path):
+        db = keydb_lib.open_db(keydb_path)
+        db.transaction_start()
+        keydb_lib.set_flag(db, ALICE_PORT2, 'video')
+        db.transaction_prepare_commit(); db.transaction_commit(); db.close()
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/video/').get_data(as_text=True)
+        assert 'No video ports have been allocated' in html
+
+    def test_page_says_when_video_is_disabled(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/video/').get_data(as_text=True)
+        assert 'not enabled' in html
+
+    def test_player_is_served_locally_not_from_a_cdn(self, client, keydb_path):
+        """A published page must be self-contained: an external script
+        tag is a third party able to change what runs in the operator's
+        browser."""
+        _enable_video(keydb_path, ALICE_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/video/').get_data(as_text=True)
+        assert 'vendor/mpegts.js/mpegts.js' in html
+        assert '//cdn' not in html and 'unpkg' not in html
+        r = client.get('/static/vendor/mpegts.js/mpegts.js')
+        assert r.status_code == 200 and len(r.get_data()) > 100000
+
+    def test_fallback_command_is_offered(self, client, keydb_path):
+        """HEVC cannot play in most browsers, so the page must always
+        offer a way to watch outside it."""
+        _enable_video(keydb_path, ALICE_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/video/').get_data(as_text=True)
+        # Matches the command, not its exact spelling: it carries
+        # low-latency flags between the binary and the URL.
+        assert 'ffplay' in html
+        assert 'http://' in html
+        assert '/v1.ts' in html
+
+    def test_fallback_mentions_the_password_when_one_is_set(self, client,
+                                                            keydb_path):
+        _enable_video(keydb_path, ALICE_PORT2, viewer_pass='watchme')
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/video/').get_data(as_text=True)
+        assert 'YOUR_VIEWER_PASSWORD' in html
+        # and never the password itself
+        assert 'watchme' not in html
+
+    def test_owner_cannot_view_another_entry(self, client, keydb_path):
+        _enable_video(keydb_path, BOB_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        r = client.get('/video/?port2=%d' % BOB_PORT2)
+        assert r.status_code == 403
+
+    def test_admin_can_view_another_entry(self, client, keydb_path):
+        _enable_video(keydb_path, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/video/?port2=%d' % ALICE_PORT2)
+        assert r.status_code == 200
+        assert 'Slot 1' in r.get_data(as_text=True)
+
+    def test_anonymous_is_redirected(self, client, keydb_path):
+        r = client.get('/video/')
+        assert r.status_code in (301, 302)
+
+
+class TestViewerToken:
+    def test_token_round_trips(self, keydb_path):
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        tok = videotoken.mint(ke.secret_key, ALICE_PORT2, 0)
+        assert videotoken.verify(ke.secret_key, ALICE_PORT2, 0, tok)
+
+    def test_token_is_bound_to_entry_and_slot(self, keydb_path):
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        tok = videotoken.mint(ke.secret_key, ALICE_PORT2, 0)
+        assert not videotoken.verify(ke.secret_key, ALICE_PORT2, 1, tok), \
+            'token accepted for a different slot'
+        assert not videotoken.verify(ke.secret_key, BOB_PORT2, 0, tok), \
+            'token accepted for a different entry'
+
+    def test_token_expires(self, keydb_path):
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        now = time.time()
+        tok = videotoken.mint(ke.secret_key, ALICE_PORT2, 0, ttl_s=10, now=now)
+        assert videotoken.verify(ke.secret_key, ALICE_PORT2, 0, tok, now=now)
+        assert not videotoken.verify(ke.secret_key, ALICE_PORT2, 0, tok,
+                                     now=now + 11)
+
+    def test_tampering_is_rejected(self, keydb_path):
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        tok = videotoken.mint(ke.secret_key, ALICE_PORT2, 0)
+        flipped = tok[:-1] + ('0' if tok[-1] != '0' else '1')
+        assert not videotoken.verify(ke.secret_key, ALICE_PORT2, 0, flipped)
+        for junk in ('', 'nope', '.', '123.', 'abc.def'):
+            assert not videotoken.verify(ke.secret_key, ALICE_PORT2, 0, junk)
+
+    def test_a_different_key_does_not_verify(self, keydb_path):
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        other = fetch_entry(keydb_path, BOB_PORT2)
+        tok = videotoken.mint(ke.secret_key, ALICE_PORT2, 0)
+        assert not videotoken.verify(other.secret_key, ALICE_PORT2, 0, tok)
+
+    def test_page_token_is_valid_for_its_slot(self, client, keydb_path):
+        """The token the page hands the player must actually work."""
+        import re
+        _enable_video(keydb_path, ALICE_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/video/').get_data(as_text=True)
+        m = re.search(r'"token":\s*"(\d+\.[0-9a-f]{64})"', html) \
+            or re.search(r'token:\s*"(\d+\.[0-9a-f]{64})"', html)
+        assert m, 'no token found in the page'
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert videotoken.verify(ke.secret_key, ALICE_PORT2, 0, m.group(1))
+
+    def test_page_never_leaks_the_secret_key(self, client, keydb_path):
+        _enable_video(keydb_path, ALICE_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/video/').get_data(as_text=True)
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert bytes(ke.secret_key).hex() not in html.lower()
+
+
+class TestTokenEndpoint:
+    """A player reconnects for as long as the page is open, but a token
+    lasts a minute -- so the page has to be able to mint fresh ones or
+    reconnecting stops working after the first minute. It mints a
+    credential, so who can ask for which entry matters."""
+
+    def _enable(self, keydb_path, port2, port=40001):
+        db = keydb_lib.open_db(keydb_path)
+        db.transaction_start()
+        ke = keydb_lib.KeyEntry(port2)
+        ke.fetch(db)
+        ke.flags |= keydb_lib.FLAG_VIDEO
+        ke.video_ports = [port, 0, 0]
+        ke.store(db)
+        db.transaction_prepare_commit()
+        db.transaction_commit()
+        db.close()
+
+    def test_owner_gets_a_valid_token_for_their_own_entry(self, client,
+                                                          keydb_path):
+        self._enable(keydb_path, ALICE_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        r = client.get('/video/token?slot=0')
+        assert r.status_code == 200
+        tok = r.get_json()['token']
+        db = keydb_lib.open_db(keydb_path)
+        db.transaction_start()
+        ke = keydb_lib.KeyEntry(ALICE_PORT2)
+        ke.fetch(db)
+        db.transaction_cancel()
+        db.close()
+        assert videotoken.verify(ke.secret_key, ALICE_PORT2, 0, tok)
+
+    def test_admin_can_mint_for_another_entry(self, client, keydb_path):
+        self._enable(keydb_path, ALICE_PORT2)
+        login_as(client, BOB_PORT1, BOB_PASS)
+        r = client.get('/video/token?port2=%d&slot=0' % ALICE_PORT2)
+        assert r.status_code == 200
+        assert r.get_json()['token']
+
+    def test_owner_cannot_mint_for_another_entry(self, client, keydb_path):
+        """Otherwise any owner could mint themselves into any stream."""
+        self._enable(keydb_path, BOB_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        r = client.get('/video/token?port2=%d&slot=0' % BOB_PORT2)
+        assert r.status_code == 403
+
+    def test_anonymous_is_refused(self, client, keydb_path):
+        self._enable(keydb_path, ALICE_PORT2)
+        r = client.get('/video/token?slot=0')
+        assert r.status_code in (302, 401, 403)
+
+    def test_slot_must_be_allocated(self, client, keydb_path):
+        self._enable(keydb_path, ALICE_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        assert client.get('/video/token?slot=1').status_code == 404
+
+    def test_slot_must_be_in_range(self, client, keydb_path):
+        self._enable(keydb_path, ALICE_PORT2)
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        for bad in ('-1', '3', '99', 'x', ''):
+            assert client.get('/video/token?slot=%s' % bad).status_code \
+                in (400, 404), bad
+
+    def test_refused_when_video_is_disabled(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        assert client.get('/video/token?slot=0').status_code == 404
+
+    def test_tokens_differ_between_slots(self, client, keydb_path):
+        db = keydb_lib.open_db(keydb_path)
+        db.transaction_start()
+        ke = keydb_lib.KeyEntry(ALICE_PORT2)
+        ke.fetch(db)
+        ke.flags |= keydb_lib.FLAG_VIDEO
+        ke.video_ports = [40001, 40002, 0]
+        ke.store(db)
+        db.transaction_prepare_commit()
+        db.transaction_commit()
+        db.close()
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        a = client.get('/video/token?slot=0').get_json()['token']
+        b = client.get('/video/token?slot=1').get_json()['token']
+        assert a != b, 'a slot-0 token must not open slot 1'
+
+
+class TestPlayerReconnect:
+    def test_page_fetches_fresh_tokens(self, client, keydb_path):
+        """The page carries the token URL, not just one minted token:
+        reusing the render-time token means reconnecting stops working
+        after its 60s lifetime, which presents as 'only works if I
+        reload'."""
+        db = keydb_lib.open_db(keydb_path)
+        db.transaction_start()
+        ke = keydb_lib.KeyEntry(ALICE_PORT2)
+        ke.fetch(db)
+        ke.flags |= keydb_lib.FLAG_VIDEO
+        ke.video_ports = [40001, 0, 0]
+        ke.store(db)
+        db.transaction_prepare_commit()
+        db.transaction_commit()
+        db.close()
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/video/').get_data(as_text=True)
+        assert '/video/token' in html
+        # And it must react to a clean close, not only to an error --
+        # the proxy ends the stream deliberately when a publisher goes.
+        assert 'LOADING_COMPLETE' in html
+
+
+class TestPlayerTeardown:
+    """The reconnect shipped twice without working. Both times the cause
+    was in this script, which no server-side test exercises, so the
+    contract it has to honour is asserted here directly."""
+
+    def _page(self, client, keydb_path):
+        db = keydb_lib.open_db(keydb_path)
+        db.transaction_start()
+        ke = keydb_lib.KeyEntry(ALICE_PORT2)
+        ke.fetch(db)
+        ke.flags |= keydb_lib.FLAG_VIDEO
+        ke.video_ports = [40001, 0, 0]
+        ke.store(db)
+        db.transaction_prepare_commit()
+        db.transaction_commit()
+        db.close()
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        return client.get('/video/').get_data(as_text=True)
+
+    def test_detaches_the_media_element_before_destroying(self, client,
+                                                          keydb_path):
+        """mpegts.js needs pause -> unload -> detachMediaElement ->
+        destroy. Skipping detachMediaElement leaves the <video> bound to
+        the old, ended MediaSource, so the next player cannot attach and
+        the reconnect silently does nothing until a page reload."""
+        html = self._page(client, keydb_path)
+        for call in ('pause()', 'unload()', 'detachMediaElement()',
+                     'destroy()'):
+            assert call in html, 'teardown is missing %s' % call
+        assert html.index('detachMediaElement()') < html.index('destroy()'), \
+            'detachMediaElement must come before destroy'
+
+    def test_reacts_to_a_clean_close_not_only_an_error(self, client,
+                                                       keydb_path):
+        html = self._page(client, keydb_path)
+        assert 'LOADING_COMPLETE' in html
+
+    def test_refreshes_the_token_per_connect(self, client, keydb_path):
+        html = self._page(client, keydb_path)
+        assert '/video/token' in html
+
+    def test_a_codec_failure_does_not_retry_forever(self, client,
+                                                    keydb_path):
+        html = self._page(client, keydb_path)
+        assert 'MEDIA_ERROR' in html
+        assert 'codecFailed' in html
+
+    def test_progress_comes_from_the_element_not_mpegts(self, client,
+                                                        keydb_path):
+        """The status and the error-counter reset must not hang on
+        MEDIA_INFO.
+
+        MediaInfo.isComplete() requires hasAudio to be exactly true or
+        false; it starts null and is only set when audio metadata
+        arrives, so a video-only stream -- the backend's default, -an --
+        never fires MEDIA_INFO at all. Resetting the media-error counter
+        only there let three transient errors over a page's lifetime
+        latch a stream that was playing fine.
+        """
+        html = self._page(client, keydb_path)
+        assert "addEventListener('playing'" in html
+        assert "addEventListener('loadedmetadata'" in html
+        # the reset must live in the element handler, not only MEDIA_INFO
+        playing = html.index("addEventListener('playing'")
+        assert 'mediaErrors = 0' in html[playing:playing + 400]
+
+    def test_only_an_unsupported_codec_is_permanent(self, client,
+                                                    keydb_path):
+        """A transient MEDIA_ERROR must retry, not latch.
+
+        Treating every MEDIA_ERROR as permanent gave up on the first
+        append failure -- which Chrome raises far more readily than
+        Firefox -- so an H.264 stream Firefox was playing reported
+        "cannot decode, probably HEVC" in Chrome and never retried.
+        """
+        html = self._page(client, keydb_path)
+        assert 'MEDIA_CODEC_UNSUPPORTED' in html
+        assert 'MEDIA_FORMAT_UNSUPPORTED' in html
+        # The permanent branch must be guarded by the detail, not by the
+        # error type alone.
+        assert 'ErrorDetails' in html
+
+    def test_reconnects_are_serialised(self, client, keydb_path):
+        """Several events fire for one disconnect; each must not start
+        its own player."""
+        html = self._page(client, keydb_path)
+        assert 'pending' in html
+
+    def test_retry_backs_off(self, client, keydb_path):
+        """Without a publisher there is nothing to connect to, so a
+        tight retry is a busy loop on both ends."""
+        html = self._page(client, keydb_path)
+        assert 'retryMs' in html and 'Math.min' in html
+
+
+class TestPictureInPictureSurvivesReconnect:
+    """Picture-in-Picture is bound to the <video> element.
+
+    Replacing the element on reconnect -- which an earlier version did,
+    defensively -- drops PIP back into the page in Firefox and leaves an
+    orphaned, frozen PIP window in Chrome. The element has to live for
+    the whole page; only the player is torn down, and detachMediaElement
+    is what makes the element reusable.
+    """
+
+    def _page(self, client, keydb_path):
+        db = keydb_lib.open_db(keydb_path)
+        db.transaction_start()
+        ke = keydb_lib.KeyEntry(ALICE_PORT2)
+        ke.fetch(db)
+        ke.flags |= keydb_lib.FLAG_VIDEO
+        ke.video_ports = [40001, 0, 0]
+        ke.store(db)
+        db.transaction_prepare_commit()
+        db.transaction_commit()
+        db.close()
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        return client.get('/video/').get_data(as_text=True)
+
+    def test_the_element_is_server_rendered_not_built_per_connect(
+            self, client, keydb_path):
+        html = self._page(client, keydb_path)
+        assert '<video id="player1"' in html
+        assert "createElement('video')" not in html, \
+            'building the element in JS means replacing it on reconnect'
+        assert 'replaceChildren' not in html
+
+    def test_teardown_does_not_touch_the_element(self, client, keydb_path):
+        """Clearing src ends playback on the element, and some browsers
+        exit PIP when that happens."""
+        html = self._page(client, keydb_path)
+        start = html.index('function teardown()')
+        end = html.index('function schedule()')
+        body = html[start:end]
+        assert 'detachMediaElement()' in body
+        assert 'removeAttribute' not in body, \
+            'teardown must not clear the element src'
+        assert 'video =' not in body, 'teardown must not swap the element'
+
+    def test_ended_handler_is_registered_once(self, client, keydb_path):
+        """The element outlives every player now, so registering this
+        per connection would stack up a handler per attempt."""
+        html = self._page(client, keydb_path)
+        assert html.count("addEventListener('ended'") == 1
+        # Slice start()'s own body: to its closing brace, which is the
+        # first line that is exactly four spaces and a brace. start() is
+        # the last function, so slicing to end-of-file would sweep in
+        # the once-registered handler that follows it.
+        i = html.index('function start(')
+        j = html.index('\n    }', i)
+        assert "addEventListener('ended'" not in html[i:j], \
+            'registered per connection rather than once'
+
+    def test_pip_is_not_disabled(self, client, keydb_path):
+        html = self._page(client, keydb_path)
+        assert 'disablePictureInPicture' not in html
+
+
+class TestFallbackCommandsAreLowLatency:
+    """ffplay's default probe is analyzeduration=5s and it spends all of
+    it before showing a frame. Measured against the live stream with the
+    clock burned into the picture: 5.0s behind with the defaults, under
+    a second with these flags. A command without them makes the proxy
+    look slow when it is not."""
+
+    def _page(self, client, keydb_path):
+        db = keydb_lib.open_db(keydb_path)
+        db.transaction_start()
+        ke = keydb_lib.KeyEntry(ALICE_PORT2)
+        ke.fetch(db)
+        ke.flags |= keydb_lib.FLAG_VIDEO
+        ke.video_ports = [40001, 0, 0]
+        ke.store(db)
+        db.transaction_prepare_commit()
+        db.transaction_commit()
+        db.close()
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        return client.get('/video/').get_data(as_text=True)
+
+    def test_ffplay_command_caps_the_probe(self, client, keydb_path):
+        html = self._page(client, keydb_path)
+        assert 'analyzeduration' in html, \
+            'without this the default 5s probe is the lag'
+        assert 'nobuffer' in html
+        assert 'low_delay' in html
+
+    def test_ffplay_still_probes_enough_to_find_the_stream(self, client,
+                                                          keydb_path):
+        """-analyzeduration 0 makes ffplay give up with 'not enough
+        frames to estimate rate', so the probe is shortened, not
+        removed."""
+        html = self._page(client, keydb_path)
+        assert 'analyzeduration 0' not in html
+        assert 'probesize' in html
+
+    def test_vlc_command_caps_its_cache(self, client, keydb_path):
+        html = self._page(client, keydb_path)
+        assert 'network-caching' in html
diff --git a/tests/webadmin/test_video_ui.py b/tests/webadmin/test_video_ui.py
new file mode 100644
index 0000000..b2422b1
--- /dev/null
+++ b/tests/webadmin/test_video_ui.py
@@ -0,0 +1,441 @@
+"""Video settings in the owner and admin edit forms.
+
+Video ports are admin-allocated, like port1: they share one global
+listening-port namespace, so owners must not be able to pick their own.
+Owners control everything else about their video. Both halves are tested
+here, along with the password set/clear semantics.
+"""
+import re
+
+import keydb_lib
+
+from _test_helpers import (ALICE_PASS, ALICE_PORT1, ALICE_PORT2, BOB_PASS,
+                           BOB_PORT1, BOB_PORT2, fetch_entry, login_as)
+
+VPORT_A = 21001
+VPORT_B = 21002
+
+
+def _owner_post(client, **over):
+    """Minimal valid owner form; video fields default to off."""
+    data = {'name': 'alice', 'submit': 'Save'}
+    data.update(over)
+    return client.post('/me/', data=data)
+
+
+def _admin_post(client, port2, **over):
+    data = {'name': 'entry', 'port1': ALICE_PORT1, 'submit': 'Save'}
+    data.update(over)
+    return client.post('/admin/%d' % port2, data=data)
+
+
+class TestOwnerVideo:
+    def test_owner_form_has_no_port_fields(self, client, keydb_path):
+        """Ports are admin-only; the owner page must not offer them."""
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/me/').get_data(as_text=True)
+        assert 'Video' in html
+        assert 'video_enabled' in html
+        assert 'name="video_port_1"' not in html
+        assert 'name="video_quota_mb"' not in html
+
+    def test_owner_can_enable_video_and_slot_options(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        resp = _owner_post(client, video_enabled='y', video_record_1='y',
+                           video_srt_2='y', video_rawtcp_3='y',
+                           video_audio='y', video_grace_s='120')
+        assert resp.status_code == 302
+
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.video_enabled()
+        assert ke.slot_opt_names(0) == ['record']
+        assert ke.slot_opt_names(1) == ['srt']
+        assert ke.slot_opt_names(2) == ['raw_tcp']
+        assert ke.entry_opt_names() == ['audio']
+        assert ke.mav_grace_seconds() == 120
+
+    def test_owner_can_disable_video_again(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        _owner_post(client, video_enabled='y', video_record_1='y')
+        assert fetch_entry(keydb_path, ALICE_PORT2).video_enabled()
+
+        _owner_post(client)          # everything unchecked
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert not ke.video_enabled()
+        assert ke.slot_opt_names(0) == []
+
+    def test_owner_cannot_set_ports_by_posting_them(self, client, keydb_path):
+        """Posting the admin-only field must not take effect."""
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        _owner_post(client, video_enabled='y', video_port_1=str(VPORT_A),
+                    video_quota_mb='9999')
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.video_ports == [0, 0, 0]
+        assert ke.video_quota_mb == 0
+
+    def test_owner_grace_out_of_range_rejected(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        resp = _owner_post(client, video_enabled='y', video_grace_s='99999')
+        assert resp.status_code == 200          # form re-renders
+        assert fetch_entry(keydb_path, ALICE_PORT2).video_mav_grace_s == 0
+
+
+class TestVideoPasswords:
+    def test_set_then_blank_keeps_password(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        _owner_post(client, video_enabled='y', video_viewer_pass='watchme')
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.video_viewer_pass_matches('watchme')
+
+        # A later save with the field blank must not wipe it.
+        _owner_post(client, video_enabled='y')
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.video_viewer_pass_matches('watchme')
+
+    def test_clear_checkbox_clears(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        _owner_post(client, video_enabled='y', video_viewer_pass='watchme')
+        _owner_post(client, video_enabled='y', video_viewer_pass_clear='y')
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert not ke.video_viewer_pass_set()
+        assert not ke.video_viewer_pass_matches('')
+
+    def test_set_and_clear_together_is_rejected(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        _owner_post(client, video_enabled='y', video_viewer_pass='first')
+        resp = _owner_post(client, video_enabled='y',
+                           video_viewer_pass='second',
+                           video_viewer_pass_clear='y')
+        assert resp.status_code == 302
+        # contradiction refused; the original password survives
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.video_viewer_pass_matches('first')
+
+    def test_viewer_and_publish_passwords_independent(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        _owner_post(client, video_enabled='y', video_viewer_pass='viewpw',
+                    video_publish_pass='pubpw')
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.video_viewer_pass_matches('viewpw')
+        assert ke.video_publish_pass_matches('pubpw')
+        # and neither disturbs the MAVLink passphrase
+        assert ke.passphrase_matches(ALICE_PASS)
+
+        _owner_post(client, video_enabled='y', video_viewer_pass_clear='y')
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert not ke.video_viewer_pass_set()
+        assert ke.video_publish_pass_matches('pubpw')
+
+
+class TestAdminVideo:
+    def test_admin_can_allocate_ports(self, client, keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        resp = _admin_post(client, ALICE_PORT2, video_enabled='y',
+                           video_port_1=str(VPORT_A),
+                           video_port_2=str(VPORT_B),
+                           video_quota_mb='4096')
+        assert resp.status_code == 302
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.video_ports == [VPORT_A, VPORT_B, 0]
+        assert ke.video_quota_mb == 4096
+        assert ke.active_video_ports() == [(0, VPORT_A), (1, VPORT_B)]
+
+    def test_admin_video_port_collision_is_refused(self, client, keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        # take a port that another entry already binds as its port1
+        resp = _admin_post(client, ALICE_PORT2, video_enabled='y',
+                           video_port_1=str(BOB_PORT1))
+        assert resp.status_code == 302
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.video_ports == [0, 0, 0], 'collision must not be stored'
+
+    def test_admin_video_port_cannot_take_own_port2(self, client, keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        resp = _admin_post(client, ALICE_PORT2, video_enabled='y',
+                           video_port_1=str(ALICE_PORT2))
+        assert resp.status_code == 302
+        assert fetch_entry(keydb_path, ALICE_PORT2).video_ports == [0, 0, 0]
+
+    def test_admin_can_clear_ports(self, client, keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        _admin_post(client, ALICE_PORT2, video_enabled='y',
+                    video_port_1=str(VPORT_A))
+        assert fetch_entry(keydb_path, ALICE_PORT2).video_ports[0] == VPORT_A
+        _admin_post(client, ALICE_PORT2, video_enabled='y', video_port_1='')
+        assert fetch_entry(keydb_path, ALICE_PORT2).video_ports == [0, 0, 0]
+
+    def test_allocated_port_blocks_a_later_port1_change(self, client,
+                                                        keydb_path):
+        """port1 uniqueness must consider video ports too."""
+        login_as(client, BOB_PORT1, BOB_PASS)
+        _admin_post(client, ALICE_PORT2, video_enabled='y',
+                    video_port_1=str(VPORT_A))
+        # now try to move BOB's port1 onto alice's video port
+        resp = client.post('/admin/%d' % BOB_PORT2,
+                           data={'name': 'bob', 'port1': str(VPORT_A),
+                                 'is_admin': 'y', 'submit': 'Save'})
+        assert resp.status_code == 302
+        ke = fetch_entry(keydb_path, BOB_PORT2)
+        assert ke.port1 == BOB_PORT1, 'port1 must not take a video port'
+
+    def test_admin_page_shows_video_fields(self, client, keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        assert 'name="video_port_1"' in html
+        assert 'name="video_quota_mb"' in html
+        assert 'name="video_record_1"' in html
+
+
+class TestVideoSlotRendering:
+    def _allocate(self, client, keydb_path, ports):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        data = {'name': 'alice', 'port1': ALICE_PORT1, 'submit': 'Save',
+                'video_enabled': 'y'}
+        for i, p in enumerate(ports, start=1):
+            data['video_port_%d' % i] = str(p) if p else ''
+        client.post('/admin/%d' % ALICE_PORT2, data=data)
+        client.get('/logout')
+
+    def test_owner_sees_no_options_for_unallocated_slot(self, client,
+                                                        keydb_path):
+        """Per-slot options for a port an owner can't allocate are noise."""
+        self._allocate(client, keydb_path, [VPORT_A, 0, 0])
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/me/').get_data(as_text=True)
+        assert 'name="video_record_1"' in html      # slot 1 allocated
+        assert 'name="video_record_2"' not in html  # slot 2 is not
+        assert 'not allocated' in html
+
+    def test_admin_always_sees_all_slots(self, client, keydb_path):
+        """An admin may allocate a port in the same save, so keep them."""
+        self._allocate(client, keydb_path, [VPORT_A, 0, 0])
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        for i in (1, 2, 3):
+            assert 'name="video_record_%d"' % i in html
+            assert 'name="video_port_%d"' % i in html
+
+
+class TestVideoOptionsCollapse:
+    """The settings block is hidden until video is enabled.
+
+    It is long -- three ports with per-slot options, two passwords, a
+    grace window and a disk budget -- and none of it means anything for
+    an entry that does not use video.
+    """
+
+    def test_all_settings_live_in_the_collapsible_panel(self, client,
+                                                        keydb_path):
+        import re
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        panel = html.index('id="video-options"')
+
+        def pos(name):
+            m = re.search(r'name="%s"' % re.escape(name), html)
+            return m.start() if m else None
+
+        names = {n for n in re.findall(r'name="(video_[a-z0-9_]+)"', html)}
+        outside = sorted(n for n in names if pos(n) < panel)
+        assert outside == ['video_enabled'], \
+            'these would stay visible on a disabled entry: %r' % outside
+        assert len(names) > 15, 'expected the whole settings block'
+
+    def test_toggle_script_is_loaded(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/me/').get_data(as_text=True)
+        assert 'video-toggle.js' in html
+        r = client.get('/static/video-toggle.js')
+        assert r.status_code == 200
+
+    def test_panel_ships_visible(self, client, keydb_path):
+        """Progressive enhancement: the script hides it, the markup does
+        not. A script failure must not strand an operator with settings
+        they cannot reach."""
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/me/').get_data(as_text=True)
+        m = re.search(r'<div id="video-options"([^>]*)>', html)
+        assert m, 'panel missing'
+        assert 'hidden' not in m.group(1), \
+            'panel is hidden in the markup; JS should do the hiding'
+
+    def test_panel_is_present_for_owners_too(self, client, keydb_path):
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/me/').get_data(as_text=True)
+        assert 'id="video-options"' in html
+
+
+class TestVideoPortCountSelector:
+    """The page shows as many port slots as the entry uses, not three."""
+
+    def test_selector_is_present_for_admins(self, client, keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        assert 'name="video_port_count"' in html
+        assert 'data-slot="1"' in html and 'data-slot="3"' in html
+
+    def test_owner_has_no_selector(self, client, keydb_path):
+        """Ports are an admin allocation; an owner cannot ask for more."""
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        html = client.get('/me/').get_data(as_text=True)
+        assert 'name="video_port_count"' not in html
+
+    def test_unused_slots_ship_hidden(self, client, keydb_path):
+        """No-JS and first paint: an entry with one port must not show
+        three rows even before the script runs."""
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        rows = re.findall(r'<div class="field video-slot" data-slot="(\d)"'
+                          r'\s*([^>]*)>', html)
+        assert len(rows) == 3
+        assert {int(s): ('hidden' in a) for s, a in rows} == {
+            1: False, 2: True, 3: True}
+
+    def test_ports_default_to_the_base(self, client, keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        m = re.search(r'id="video_port_1"[^>]*value="(\d+)"', html)
+        assert m, 'port 1 was not prefilled'
+        assert int(m.group(1)) == keydb_lib.VIDEO_PORT_BASE
+
+    def test_later_slots_are_prefilled_too(self, client, keydb_path):
+        """Raising the count must reveal a filled field, not a blank one."""
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        got = [int(re.search(r'id="video_port_%d"[^>]*value="(\d+)"'
+                             % i, html).group(1)) for i in (1, 2, 3)]
+        assert got == [keydb_lib.VIDEO_PORT_BASE,
+                       keydb_lib.VIDEO_PORT_BASE + 1,
+                       keydb_lib.VIDEO_PORT_BASE + 2]
+
+    def test_saving_a_disabled_entry_allocates_nothing(self, client,
+                                                       keydb_path):
+        """Every slot is prefilled with a suggestion. Saving an entry
+        that has video off must not turn those into a real allocation."""
+        resp = _admin_post(client_logged_in_as_admin(client), ALICE_PORT2,
+                           video_port_count='3', video_port_1='40001',
+                           video_port_2='40002', video_port_3='40003')
+        assert resp.status_code == 302
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.video_ports == [0, 0, 0]
+        assert not ke.video_enabled()
+
+    def test_count_bounds_what_is_stored(self, client, keydb_path):
+        """Slots past the count are dropped even though their hidden
+        fields still submit."""
+        resp = _admin_post(client_logged_in_as_admin(client), ALICE_PORT2,
+                           video_enabled='y', video_port_count='1',
+                           video_port_1=str(VPORT_A),
+                           video_port_2=str(VPORT_B))
+        assert resp.status_code == 302
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.video_ports == [VPORT_A, 0, 0]
+        assert ke.video_port_count() == 1
+
+    def test_count_two_stores_two(self, client, keydb_path):
+        resp = _admin_post(client_logged_in_as_admin(client), ALICE_PORT2,
+                           video_enabled='y', video_port_count='2',
+                           video_port_1=str(VPORT_A),
+                           video_port_2=str(VPORT_B))
+        assert resp.status_code == 302
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.video_ports == [VPORT_A, VPORT_B, 0]
+        assert ke.video_port_count() == 2
+
+    def test_a_submission_without_the_count_keeps_every_slot(self, client,
+                                                             keydb_path):
+        """The field is new. A caller that predates it must not have
+        slots 2 and 3 silently dropped onto the field default of 1."""
+        resp = _admin_post(client_logged_in_as_admin(client), ALICE_PORT2,
+                           video_enabled='y', video_port_1=str(VPORT_A),
+                           video_port_2=str(VPORT_B))
+        assert resp.status_code == 302
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.video_ports == [VPORT_A, VPORT_B, 0]
+
+    def test_allocated_ports_are_not_renumbered_on_reopen(self, client,
+                                                          keydb_path):
+        """Opening the edit page of a streaming entry must offer back the
+        port it is already on, not the next free one."""
+        _admin_post(client_logged_in_as_admin(client), ALICE_PORT2,
+                    video_enabled='y', video_port_count='1',
+                    video_port_1=str(VPORT_A))
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        m = re.search(r'id="video_port_1"[^>]*value="(\d+)"', html)
+        assert int(m.group(1)) == VPORT_A
+
+    def test_count_reflects_what_is_allocated_on_reopen(self, client,
+                                                        keydb_path):
+        _admin_post(client_logged_in_as_admin(client), ALICE_PORT2,
+                    video_enabled='y', video_port_count='2',
+                    video_port_1=str(VPORT_A), video_port_2=str(VPORT_B))
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        rows = re.findall(r'<div class="field video-slot" data-slot="(\d)"'
+                          r'\s*([^>]*)>', html)
+        assert {int(s): ('hidden' in a) for s, a in rows} == {
+            1: False, 2: False, 3: True}
+
+
+def client_logged_in_as_admin(client):
+    login_as(client, BOB_PORT1, BOB_PASS)
+    return client
+
+
+class TestRtmpPathField:
+    """RTMP publishing does nothing until the slot knows the camera's
+    app/stream, so it has to be settable here and not only from the CLI."""
+
+    def test_field_is_present_per_slot(self, client, keydb_path):
+        login_as(client, BOB_PORT1, BOB_PASS)
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        for n in (1, 2, 3):
+            assert 'name="video_rtmp_%d"' % n in html
+
+    def test_owner_can_set_it(self, client, keydb_path):
+        """It describes what the camera sends, not an allocation, so an
+        owner may change it like the other per-slot options."""
+        _owner_post(client_as_owner(client), video_enabled='y',
+                    video_rtmp_1='PhoenixFPV/FPV')
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.rtmp_path(0) == 'PhoenixFPV/FPV'
+
+    def test_round_trips_to_the_page(self, client, keydb_path):
+        """An owner only sees per-slot controls for an allocated slot,
+        so allocate one first -- otherwise this asserts nothing."""
+        login_as(client, BOB_PORT1, BOB_PASS)
+        _admin_post(client, ALICE_PORT2, video_enabled='y',
+                    video_port_1=str(VPORT_A), video_rtmp_1='PhoenixFPV/FPV')
+        html = client.get('/admin/%d' % ALICE_PORT2).get_data(as_text=True)
+        assert 'PhoenixFPV/FPV' in html
+        login_as(client, ALICE_PORT1, ALICE_PASS)
+        assert 'PhoenixFPV/FPV' in client.get('/me/').get_data(as_text=True)
+
+    def test_leading_and_trailing_slashes_are_normalised(self, client,
+                                                        keydb_path):
+        """The value is handed to the backend as a URL path, so it must
+        be stored the way the URL builder expects."""
+        _owner_post(client_as_owner(client), video_enabled='y',
+                    video_rtmp_1='/live/cam/')
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.rtmp_path(0) == 'live/cam'
+
+    def test_a_bad_path_is_refused_not_stored(self, client, keydb_path):
+        """A space would change the URL's meaning; say so rather than
+        building a different one."""
+        _owner_post(client_as_owner(client), video_enabled='y',
+                    video_rtmp_1='has space')
+        ke = fetch_entry(keydb_path, ALICE_PORT2)
+        assert ke.rtmp_path(0) == ''
+
+    def test_blank_clears_it(self, client, keydb_path):
+        _owner_post(client_as_owner(client), video_enabled='y',
+                    video_rtmp_1='PhoenixFPV/FPV')
+        assert fetch_entry(keydb_path, ALICE_PORT2).rtmp_path(0)
+        _owner_post(client_as_owner(client), video_enabled='y',
+                    video_rtmp_1='')
+        assert fetch_entry(keydb_path, ALICE_PORT2).rtmp_path(0) == ''
+
+
+def client_as_owner(client):
+    login_as(client, ALICE_PORT1, ALICE_PASS)
+    return client
diff --git a/webadmin/__init__.py b/webadmin/__init__.py
index e4d918c..499ab2f 100644
--- a/webadmin/__init__.py
+++ b/webadmin/__init__.py
@@ -108,11 +108,15 @@ def create_app(test_config=None):
     from .routes_owner import bp as owner_bp
     from .routes_admin import bp as admin_bp
     from .logs import admin_bp as admin_logs_bp, owner_bp as owner_logs_bp
+    from .routes_video import bp as video_bp
+    from .routes_system import bp as system_bp
     app.register_blueprint(auth_bp)
     app.register_blueprint(owner_bp)
     app.register_blueprint(admin_bp)
     app.register_blueprint(admin_logs_bp)
     app.register_blueprint(owner_logs_bp)
+    app.register_blueprint(video_bp)
+    app.register_blueprint(system_bp)
 
     @app.route('/')
     def index():
diff --git a/webadmin/config.py b/webadmin/config.py
index addec75..568ecde 100644
--- a/webadmin/config.py
+++ b/webadmin/config.py
@@ -32,6 +32,12 @@ class DefaultConfig:
     # started from. Tests override this to a tmpdir.
     LOGS_DIR = os.environ.get('WEBADMIN_LOGS_DIR', 'logs')
 
+    # A log file modified this recently is treated as still being
+    # written and is refused for deletion. Shares the daemon's env var
+    # so the two cannot disagree about what "active" means.
+    LOG_ACTIVE_GRACE_S = int(
+        os.environ.get('SUPPORTPROXY_ACTIVE_FILE_GRACE', '60'))
+
     # Cookie hardening. Set WEBADMIN_INSECURE_COOKIES=1 only for local HTTP dev.
     SESSION_COOKIE_SECURE = not _bool_env('WEBADMIN_INSECURE_COOKIES')
     SESSION_COOKIE_HTTPONLY = True
diff --git a/webadmin/connections.py b/webadmin/connections.py
index 5d585c6..7276ad0 100644
--- a/webadmin/connections.py
+++ b/webadmin/connections.py
@@ -17,6 +17,15 @@
 CONN_FILE = conntdb_lib.CONN_FILE
 CONNENTRY_MIN_SIZE = conntdb_lib.CONNENTRY_MIN_SIZE
 
+CONN_ROLE_MAVLINK = conntdb_lib.CONN_ROLE_MAVLINK
+CONN_ROLE_VIDEO_PUB = conntdb_lib.CONN_ROLE_VIDEO_PUB
+CONN_ROLE_VIDEO_SUB = conntdb_lib.CONN_ROLE_VIDEO_SUB
+CONN_APP_MAVLINK = conntdb_lib.CONN_APP_MAVLINK
+CONN_APP_MPEGTS = conntdb_lib.CONN_APP_MPEGTS
+CONN_APP_RTSP = conntdb_lib.CONN_APP_RTSP
+CONN_APP_HTTP = conntdb_lib.CONN_APP_HTTP
+CONN_APP_SRT = conntdb_lib.CONN_APP_SRT
+
 
 def _conn_path():
     return conntdb_lib.conn_path_for(current_app.config['KEYDB_PATH'])
diff --git a/webadmin/forms.py b/webadmin/forms.py
index 8efab84..291e538 100644
--- a/webadmin/forms.py
+++ b/webadmin/forms.py
@@ -1,7 +1,14 @@
-"""Flask-WTF forms. CSRF tokens are added automatically by FlaskForm."""
+"""Flask-WTF forms. CSRF tokens are added automatically by FlaskForm.
+
+Every field that is not self-explanatory carries a `description`. The
+templates render it as a hover/focus tooltip next to the label (see
+_macros.html and the .help rules in style.css), which keeps the labels
+short enough to scan while the detail stays one hover away. Put the
+explanation in `description`, not in the label.
+"""
 from flask_wtf import FlaskForm
 from wtforms import (BooleanField, FloatField, IntegerField, PasswordField,
-                     StringField, SubmitField)
+                     SelectField, StringField, SubmitField)
 from wtforms.validators import (DataRequired, Length, NumberRange, Optional,
                                 EqualTo)
 
@@ -21,94 +28,274 @@
                   'autocorrect': 'off', 'autocapitalize': 'off'}
 
 
+# Video ports are allocated by an admin, like port1 -- they share one
+# global listening-port namespace, so letting every owner pick their own
+# invites collisions and squatting. Owners control everything else about
+# their video.
+VIDEO_PORT_MIN = 1024
+VIDEO_PORT_MAX = 65535
+VIDEO_MAX_GRACE_S = 3600
+
+
+# Help text shared by the owner and admin edit forms, so the two copies
+# of each field cannot drift apart.
+_D_BIDI = ('Normally only the engineer side must sign. With this set the '
+           'proxy also requires MAVLink2 signing on the user side, using '
+           'the same passphrase, and drops packets that are unsigned or '
+           'signed with the wrong key. A session already running keeps '
+           'the old setting until it idles out.')
+_D_TLOG = ('Write a .tlog of the MAVLink stream to '
+           'logs/<port2>/<date>/. Browse and download them from the '
+           '"browse logs" link below.')
+_D_BINLOG = ('Pull the flight controller\'s dataflash .bin log over the '
+             'MAVLink link. The firmware must have the MAVLink bit set '
+             'in its LOG_BACKEND_TYPE parameter or nothing arrives.')
+_D_RETENTION = ('The cleanup pass deletes .tlog and .bin files older than '
+                'this. 0 keeps them forever. Fractional days are allowed. '
+                'Video recordings are covered by their own disk budget, '
+                'not by this.')
+_D_SYSID = ('Restricts flight-controller reboot detection -- which is what '
+            'starts a new .bin file -- to packets from this MAVLink system '
+            'ID. 0 accepts any sysid, which is usually right unless several '
+            'vehicles share one link.')
+_D_USE_TZ = ('By default log files are named in the server\'s local time. '
+             'Tick this to name them in the fixed offset set below instead, '
+             'so filenames match the timezone you fly in.')
+_D_TZ_OFFSET = ('Hours ahead of GMT, fractional allowed (e.g. 9.5 for '
+                'ACST, -7 for PDT). Only has any effect while the box '
+                'above is ticked.')
+_D_RESET_TS = ('Zero the stored MAVLink signing timestamp. Use this when '
+               'signed packets are being rejected as replays because the '
+               'stored timestamp has got ahead of the engineer\'s clock.')
+_D_NEW_PASS = ('Sets the shared MAVLink signing passphrase. Leave blank to '
+               'keep the current one. Everyone connecting to this entry '
+               'must use the new value, so tell them before you save.')
+
+
+class _VideoOwnerFields:
+    """Video settings an owner may change. Ports are admin-only."""
+    video_enabled = BooleanField(
+        'Enable video proxying for this entry',
+        description='Binds this entry\'s video ports and accepts a '
+                    'publisher on them. Video runs independently of '
+                    'MAVLink: it survives a telemetry dropout, and with a '
+                    'publish password it needs no MAVLink session at all.')
+    video_audio = BooleanField(
+        'Carry audio',
+        description='RTSP sources only. Off by default -- aircraft audio '
+                    'is rarely useful, and dropping it keeps the stream '
+                    'video-only and slightly cheaper to relay.')
+    video_viewer_pass = PasswordField(
+        'Viewer password',
+        description='Required to watch the stream. Leave blank to keep the '
+                    'current one; tick the box below to remove it and let '
+                    'anyone who can reach the port watch.',
+        validators=[Optional(), Length(min=4, max=256)],
+        render_kw=_NEW_PW_KW)
+    video_viewer_pass_clear = BooleanField(
+        'Clear the viewer password',
+        description='Removes it entirely, so viewing is open to anyone who '
+                    'can reach the video port.')
+    video_publish_pass = PasswordField(
+        'Publish password',
+        description='Lets a publisher in on the password alone, with no '
+                    'MAVLink session needed -- the answer for CGNAT, or '
+                    'video egressing from a different address than '
+                    'telemetry. Note it REPLACES the address check, and '
+                    'plain MPEG-TS over UDP cannot carry a password, so '
+                    'setting one means publishing over RTSP.',
+        validators=[Optional(), Length(min=4, max=256)],
+        render_kw=_NEW_PW_KW)
+    video_publish_pass_clear = BooleanField(
+        'Clear the publish password',
+        description='Publishing then requires a recent MAVLink session '
+                    'from the same IP address instead.')
+    video_grace_s = IntegerField(
+        'Publisher grace after MAVLink drops (seconds)',
+        description='How long a passwordless publisher stays authorised '
+                    'after its MAVLink session goes away, so video rides '
+                    'through a telemetry outage instead of being cut by a '
+                    'link flap. 0 uses the default of %d seconds.' % 60,
+        validators=[Optional(), NumberRange(min=0, max=VIDEO_MAX_GRACE_S)])
+    # Per-slot options. Flat fields rather than a FieldList to match the
+    # rest of this module and keep the templates simple.
+    # RTMP publish path per slot. Owner-settable like the other
+    # per-slot options: it describes what the camera is configured to
+    # send, not an allocation the admin controls.
+    video_rtmp_1 = StringField(
+        'Slot 1 RTMP path',
+        description='Optional. The App Name and Stream ID set on the '
+                    'camera, as "app/stream" -- e.g. PhoenixFPV/FPV. Set, '
+                    'only that path is accepted on this slot; left blank '
+                    'the slot takes whatever the camera publishes.',
+        validators=[Optional(), Length(max=31)])
+    video_rtmp_2 = StringField(
+        'Slot 2 RTMP path',
+        description='As above, for the second slot.',
+        validators=[Optional(), Length(max=31)])
+    video_rtmp_3 = StringField(
+        'Slot 3 RTMP path',
+        description='As above, for the third slot.',
+        validators=[Optional(), Length(max=31)])
+    video_srt_1 = BooleanField('Slot 1: UDP side speaks SRT (else MPEG-TS)')
+    video_record_1 = BooleanField('Slot 1: record to disk')
+    video_rawtcp_1 = BooleanField('Slot 1: allow raw-TCP viewers (no password)')
+    video_srt_2 = BooleanField('Slot 2: UDP side speaks SRT (else MPEG-TS)')
+    video_record_2 = BooleanField('Slot 2: record to disk')
+    video_rawtcp_2 = BooleanField('Slot 2: allow raw-TCP viewers (no password)')
+    video_srt_3 = BooleanField('Slot 3: UDP side speaks SRT (else MPEG-TS)')
+    video_record_3 = BooleanField('Slot 3: record to disk')
+    video_rawtcp_3 = BooleanField('Slot 3: allow raw-TCP viewers (no password)')
+
+
+class _VideoAdminFields(_VideoOwnerFields):
+    """Adds the port allocation and the disk budget."""
+    # How many of the three slots this entry uses. Most entries want one
+    # camera, so showing three sets of ports and per-slot options by
+    # default is noise; this drives which slots the page shows at all.
+    video_port_count = SelectField(
+        'Number of video ports',
+        description='One port carries one stream, so allocate one per '
+                    'camera. Slots you do not use are hidden.',
+        choices=[(n, str(n)) for n in range(1, 4)],
+        coerce=int, default=1)
+    video_port_1 = IntegerField(
+        'Video port 1',
+        description='Publish to this port and viewers connect to it. '
+                    'Suggested value is the next free port; it must not '
+                    'clash with any other entry\'s ports.',
+        validators=[Optional(), NumberRange(min=VIDEO_PORT_MIN,
+                                            max=VIDEO_PORT_MAX)])
+    video_port_2 = IntegerField(
+        'Video port 2',
+        description='Second camera. One port carries exactly one stream.',
+        validators=[Optional(), NumberRange(min=VIDEO_PORT_MIN,
+                                            max=VIDEO_PORT_MAX)])
+    video_port_3 = IntegerField(
+        'Video port 3',
+        description='Third camera. One port carries exactly one stream.',
+        validators=[Optional(), NumberRange(min=VIDEO_PORT_MIN,
+                                            max=VIDEO_PORT_MAX)])
+    video_quota_mb = IntegerField(
+        'Video disk budget (MB)',
+        description='Oldest recordings are deleted once this entry\'s '
+                    'video exceeds the budget. Kept separate from the '
+                    'tlog/bin budget so video can never evict telemetry. '
+                    '0 uses the server default.',
+        validators=[Optional(), NumberRange(min=0)])
+
+
 class LoginForm(FlaskForm):
-    port = IntegerField('Port (port1 or port2)',
-                        validators=[DataRequired(),
-                                    NumberRange(min=1, max=65535)])
-    passphrase = PasswordField('Passphrase',
-                               validators=[DataRequired(),
-                                           Length(min=1, max=256)],
-                               render_kw=_CURRENT_PW_KW)
+    port = IntegerField(
+        'Port (port1 or port2)',
+        description='Either side of your pair works. Log in on port2 and '
+                    'you get the engineer view; either way you reach the '
+                    'same entry.',
+        validators=[DataRequired(), NumberRange(min=1, max=65535)])
+    passphrase = PasswordField(
+        'Passphrase',
+        description='The shared MAVLink passphrase for this entry -- the '
+                    'same one set with keydb.py, not a separate web login.',
+        validators=[DataRequired(), Length(min=1, max=256)],
+        render_kw=_CURRENT_PW_KW)
     submit = SubmitField('Log in')
 
 
-class OwnerEditForm(FlaskForm):
+class OwnerEditForm(FlaskForm, _VideoOwnerFields):
     """Self-service form: name + optional new passphrase + flag toggles."""
-    name = StringField('Display name', validators=[Optional(), Length(max=31)])
+    name = StringField(
+        'Display name',
+        description='Free-text label shown in the entry list and the '
+                    'connections page. Cosmetic only.',
+        validators=[Optional(), Length(max=31)])
     new_passphrase = PasswordField(
         'New passphrase (leave blank to keep current)',
+        description=_D_NEW_PASS,
         validators=[Optional(), Length(min=4, max=256)],
         render_kw=_NEW_PW_KW)
     confirm_passphrase = PasswordField(
         'Confirm new passphrase',
+        description='Must match the field above. Guards against a typo '
+                    'locking everyone out of the entry.',
         validators=[Optional(), EqualTo('new_passphrase',
                                         message='Passphrases do not match.')],
         render_kw=_NEW_PW_KW)
     bidi_sign = BooleanField(
-        'Require MAVLink signing on the user side too (bi-directional signing)')
-    tlog_enabled = BooleanField('Record telemetry logs (.tlog) for this entry')
-    binlog_enabled = BooleanField(
-        'Record ArduPilot bin logs over MAVLink (.bin) — '
-        'firmware must have LOG_BACKEND_TYPE mavlink bit set')
+        'Require MAVLink signing on the user side too (bi-directional '
+        'signing)', description=_D_BIDI)
+    tlog_enabled = BooleanField('Record telemetry logs (.tlog)',
+                                description=_D_TLOG)
+    binlog_enabled = BooleanField('Record ArduPilot bin logs (.bin)',
+                                  description=_D_BINLOG)
     log_retention_days = FloatField(
-        'Log retention (days, 0 = keep forever, owners capped at 30) — '
-        'covers both .tlog and .bin files',
+        'Log retention (days, 0 = keep forever)',
+        description=_D_RETENTION + ' Owners are capped at %d days; ask an '
+                    'admin for longer.' % OWNER_MAX_LOG_RETENTION_DAYS,
         validators=[Optional(),
                     NumberRange(min=0.0, max=OWNER_MAX_LOG_RETENTION_DAYS)])
     fc_sysid = IntegerField(
-        'Flight-controller MAVLink sysid (0 = any) — restricts binlog '
-        'reboot detection to packets from this sysid',
+        'Flight-controller MAVLink sysid (0 = any)', description=_D_SYSID,
         validators=[Optional(), NumberRange(min=0, max=255)])
-    use_tz = BooleanField(
-        'Name logs in a fixed timezone (below) instead of the server\'s '
-        'local time')
+    use_tz = BooleanField('Name logs in a fixed timezone',
+                          description=_D_USE_TZ)
     tz_offset_hours = FloatField(
-        'Log timezone (GMT offset in hours, fractional ok; 0 = GMT) — '
-        'used only when the box above is ticked',
+        'Log timezone (GMT offset in hours)', description=_D_TZ_OFFSET,
         validators=[Optional(), NumberRange(min=-12.0, max=14.0)])
-    reset_timestamp = BooleanField('Reset signing timestamp (recover from clock skew)')
+    reset_timestamp = BooleanField('Reset signing timestamp',
+                                   description=_D_RESET_TS)
     submit = SubmitField('Save')
 
 
-class AdminEditForm(FlaskForm):
-    """Admin form: same as owner plus port1 and admin flag toggle."""
-    name = StringField('Display name', validators=[Optional(), Length(max=31)])
-    port1 = IntegerField('User-side port (port1)',
-                         validators=[DataRequired(),
-                                     NumberRange(min=1, max=65535)])
+class AdminEditForm(FlaskForm, _VideoAdminFields):
+    """Admin form: same as owner plus port1, video ports and admin flag."""
+    name = StringField(
+        'Display name',
+        description='Free-text label shown in the entry list and the '
+                    'connections page. Cosmetic only.',
+        validators=[Optional(), Length(max=31)])
+    port1 = IntegerField(
+        'User-side port (port1)',
+        description='The port the aircraft or ground station connects to. '
+                    'Changing it re-binds the listener within about 5 '
+                    'seconds and drops any session on the old port.',
+        validators=[DataRequired(), NumberRange(min=1, max=65535)])
     new_passphrase = PasswordField(
         'New passphrase (leave blank to keep current)',
+        description=_D_NEW_PASS,
         validators=[Optional(), Length(min=4, max=256)],
         render_kw=_NEW_PW_KW)
     confirm_passphrase = PasswordField(
         'Confirm new passphrase',
+        description='Must match the field above. Guards against a typo '
+                    'locking everyone out of the entry.',
         validators=[Optional(), EqualTo('new_passphrase',
                                         message='Passphrases do not match.')],
         render_kw=_NEW_PW_KW)
-    is_admin = BooleanField('Grant admin privilege (KEY_FLAG_ADMIN)')
+    is_admin = BooleanField(
+        'Grant admin privilege (KEY_FLAG_ADMIN)',
+        description='Lets whoever holds this entry\'s passphrase view and '
+                    'edit every entry on the server, not just their own.')
     bidi_sign = BooleanField(
-        'Require MAVLink signing on the user side too (bi-directional signing)')
-    tlog_enabled = BooleanField('Record telemetry logs (.tlog) for this entry')
-    binlog_enabled = BooleanField(
-        'Record ArduPilot bin logs over MAVLink (.bin) — '
-        'firmware must have LOG_BACKEND_TYPE mavlink bit set')
+        'Require MAVLink signing on the user side too (bi-directional '
+        'signing)', description=_D_BIDI)
+    tlog_enabled = BooleanField('Record telemetry logs (.tlog)',
+                                description=_D_TLOG)
+    binlog_enabled = BooleanField('Record ArduPilot bin logs (.bin)',
+                                  description=_D_BINLOG)
     log_retention_days = FloatField(
-        'Log retention (days, 0 = keep forever) — '
-        'covers both .tlog and .bin files',
+        'Log retention (days, 0 = keep forever)', description=_D_RETENTION,
         validators=[Optional(),
                     NumberRange(min=0.0, max=ADMIN_MAX_LOG_RETENTION_DAYS)])
     fc_sysid = IntegerField(
-        'Flight-controller MAVLink sysid (0 = any) — restricts binlog '
-        'reboot detection to packets from this sysid',
+        'Flight-controller MAVLink sysid (0 = any)', description=_D_SYSID,
         validators=[Optional(), NumberRange(min=0, max=255)])
-    use_tz = BooleanField(
-        'Name logs in a fixed timezone (below) instead of the server\'s '
-        'local time')
+    use_tz = BooleanField('Name logs in a fixed timezone',
+                          description=_D_USE_TZ)
     tz_offset_hours = FloatField(
-        'Log timezone (GMT offset in hours, fractional ok; 0 = GMT) — '
-        'used only when the box above is ticked',
+        'Log timezone (GMT offset in hours)', description=_D_TZ_OFFSET,
         validators=[Optional(), NumberRange(min=-12.0, max=14.0)])
-    reset_timestamp = BooleanField('Reset signing timestamp (recover from clock skew)')
+    reset_timestamp = BooleanField('Reset signing timestamp',
+                                   description=_D_RESET_TS)
     submit = SubmitField('Save')
 
 
@@ -130,22 +317,37 @@ class AdminAddForm(FlaskForm):
     # entry i (1-indexed): port1 = base + i - 1, port2 = port1 + 1000,
     # name = "<name><i>", all sharing one passphrase — matching the
     # old add_partner.sh script.
-    port1 = IntegerField('User-side base port (port1)',
-                         validators=[DataRequired(),
-                                     NumberRange(min=10000, max=60000)])
+    port1 = IntegerField(
+        'User-side base port (port1)',
+        description='The port the aircraft or ground station connects to. '
+                    'With count > 1 this is the first of a consecutive run.',
+        validators=[DataRequired(), NumberRange(min=10000, max=60000)])
     count = IntegerField(
-        'Count (consecutive IDs to create; port2 = port1+1000 for each)',
+        'Count (consecutive IDs to create)',
+        description='Create this many entries in one go: port1 counts up '
+                    'from the base, port2 is port1+1000 for each, and the '
+                    'display name gets an index suffix. All share one '
+                    'passphrase.',
         default=1,
         validators=[Optional(), NumberRange(min=1, max=MAX_ADD_COUNT)])
-    port2 = IntegerField('Engineer-side port (port2; used only when count=1)',
-                         validators=[DataRequired(),
-                                     NumberRange(min=10000, max=60000)])
-    name = StringField('Display name',
-                       validators=[DataRequired(), Length(max=31)])
-    passphrase = PasswordField('Passphrase',
-                               validators=[DataRequired(),
-                                           Length(min=4, max=256)],
-                               render_kw=_NEW_PW_KW)
+    port2 = IntegerField(
+        'Engineer-side port (port2)',
+        description='The port the support engineer connects to. Always '
+                    'requires MAVLink2 signing. Used only when count = 1; '
+                    'otherwise it is derived as port1+1000.',
+        validators=[DataRequired(), NumberRange(min=10000, max=60000)])
+    name = StringField(
+        'Display name',
+        description='Free-text label for the entry list. With count > 1 '
+                    'each entry gets a number appended.',
+        validators=[DataRequired(), Length(max=31)])
+    passphrase = PasswordField(
+        'Passphrase',
+        description='The shared MAVLink signing passphrase, and what both '
+                    'sides use to log in here. Use "Generate" for a strong '
+                    'one.',
+        validators=[DataRequired(), Length(min=4, max=256)],
+        render_kw=_NEW_PW_KW)
     submit = SubmitField('Add')
 
 
@@ -157,3 +359,18 @@ class DeleteForm(FlaskForm):
 class KillForm(FlaskForm):
     """Empty form just to carry a CSRF token for the kill-connection button."""
     submit = SubmitField('Kill')
+
+
+class RestartProxyForm(FlaskForm):
+    """CSRF carrier for the restart-daemon button.
+
+    Deliberately its own form rather than reusing KillForm: this one
+    drops every live session on the server, so a stray token from
+    another page should not be able to trigger it.
+    """
+    submit = SubmitField('Restart proxy')
+
+
+class DeleteLogForm(FlaskForm):
+    """CSRF carrier for deleting a recording, or a whole day of them."""
+    submit = SubmitField('Delete')
diff --git a/webadmin/logs.py b/webadmin/logs.py
index 2e3da2a..51f2759 100644
--- a/webadmin/logs.py
+++ b/webadmin/logs.py
@@ -19,14 +19,18 @@
 """
 import os
 import re
+import shutil
+import stat
+import subprocess
 import time
 
-from flask import (Blueprint, abort, current_app, render_template,
-                   send_from_directory)
+from flask import (Blueprint, Response, abort, current_app, flash, redirect,
+                   render_template, send_from_directory, url_for)
 
 import keydb_lib
 
 from .auth import current_owner, require_admin, require_login
+from .forms import DeleteLogForm
 from .db import tdb_readonly
 
 DATE_RE = re.compile(r'^\d{4}-\d{2}-\d{2}$')
@@ -36,7 +40,8 @@
 # changes. Accept the current YYYY_MM_DD_HH:MM:SS[-N] timestamp names
 # and the legacy sessionN names so old logs stay browsable.
 SESSION_RE = re.compile(
-    r'^(session\d+|\d{4}_\d{2}_\d{2}_\d{2}:\d{2}:\d{2}(-\d+)?)\.(tlog|bin)$')
+    r'^(session\d+|\d{4}_\d{2}_\d{2}_\d{2}:\d{2}:\d{2}(-\d+)?)'
+    r'\.(tlog|bin|v[1-3]\.ts)$')
 
 # Natural-sort key: treat embedded digit runs as numbers so that
 # session10.tlog sorts AFTER session2.tlog (not between session1 and
@@ -50,8 +55,20 @@
 # its "-N" siblings — but lexically "-" < ".", so "<ts>-2.bin" would
 # otherwise beat "<ts>.bin". Normalise the unsuffixed name to "-1" for
 # the sort key so the numeric suffix orders it correctly.
+# The extension group must allow a compound extension: a video segment
+# is "<ts>[-N].v1.ts", and a single (\.\w+) would not match it, which
+# would silently drop video files out of the -N ordering fix below.
 _TS_NAME_RE = re.compile(
-    r'^(\d{4}_\d{2}_\d{2}_\d{2}:\d{2}:\d{2})(-\d+)?(\.\w+)$')
+    r'^(\d{4}_\d{2}_\d{2}_\d{2}:\d{2}:\d{2})(-\d+)?((?:\.\w+)+)$')
+
+# Which session files are video, and so can be played rather than only
+# downloaded. Deliberately a separate pattern from SESSION_RE: that one
+# decides what may be served at all, this one only what gets a "watch"
+# link, and conflating them would let a widened SESSION_RE quietly make
+# new file types streamable.
+VIDEO_NAME_RE = re.compile(
+    r'^(session\d+|\d{4}_\d{2}_\d{2}_\d{2}:\d{2}:\d{2}(-\d+)?)'
+    r'\.v[1-3]\.ts$')
 
 
 def _natural_key(name):
@@ -77,6 +94,175 @@ def _safe_session(session_name):
         abort(404)
 
 
+def _open_by_a_daemon(path):
+    """True if some process has this file open.
+
+    Asked of the kernel rather than guessed from mtime. The webadmin
+    runs as the same user as the daemon, so its /proc/<pid>/fd entries
+    are readable; anything not readable is skipped, which only ever
+    makes this less certain, never wrongly certain.
+    """
+    try:
+        target = os.path.realpath(path)
+    except OSError:
+        return False
+    for name in os.listdir('/proc'):
+        if not name.isdigit():
+            continue
+        fddir = '/proc/%s/fd' % name
+        try:
+            entries = os.listdir(fddir)
+        except OSError:
+            continue            # not ours, or gone
+        for fd in entries:
+            try:
+                if os.readlink(os.path.join(fddir, fd)) == target:
+                    return True
+            except OSError:
+                continue
+    return False
+
+
+def _is_being_written(path):
+    """True if this file should not be deleted yet.
+
+    An mtime heuristic alone is not enough for an interactive delete.
+    The cleanup pass can live with one -- it runs on a timer and a
+    mistake only costs a retry -- but here a quiet session whose log has
+    not been appended to for a while would look idle, and unlinking it
+    does not stop the daemon writing: the inode stays alive, its space
+    unreclaimed, and the operator sees the file disappear while data is
+    still going into it.
+
+    So ask the kernel who has it open, and keep the mtime window as a
+    cheap first answer for the common case of a file written seconds
+    ago.
+    """
+    try:
+        st = os.stat(path)
+    except OSError:
+        return False
+    grace = current_app.config.get('LOG_ACTIVE_GRACE_S', 60)
+    if (time.time() - st.st_mtime) < grace:
+        return True
+    return _open_by_a_daemon(path)
+
+
+def _date_dir_fd(port2, date):
+    """An fd for logs/<port2>/<date>, refusing to follow symlinks.
+
+    Opening each component with O_NOFOLLOW and then working relative to
+    the descriptor means a symlink swapped in anywhere along the path --
+    which needs local access, not anything this app exposes -- cannot
+    redirect a delete outside the tree. The name checks alone only stop
+    traversal spelled in the request.
+    """
+    flags = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW
+    root = None
+    entry = None
+    try:
+        root = os.open(_logs_root(), os.O_RDONLY | os.O_DIRECTORY)
+        entry = os.open(str(port2), flags, dir_fd=root)
+        return os.open(date, flags, dir_fd=entry)
+    except OSError:
+        return None
+    finally:
+        for fd in (entry, root):
+            if fd is not None:
+                try:
+                    os.close(fd)
+                except OSError:
+                    pass
+
+
+def _delete_session(port2, date, session_name):
+    """Delete one recording. Returns an error string, or None."""
+    _safe_date(date)
+    _safe_session(session_name)
+    dirfd = _date_dir_fd(port2, date)
+    if dirfd is None:
+        return 'no such log'
+    try:
+        path = os.path.join(_logs_root(), str(port2), date, session_name)
+        try:
+            st = os.stat(session_name, dir_fd=dirfd,
+                         follow_symlinks=False)
+        except OSError:
+            return 'no such log'
+        if not stat.S_ISREG(st.st_mode):
+            return 'not a recording'
+        if _is_being_written(path):
+            return 'still being written -- it will be deletable once the ' \
+                   'session ends'
+        try:
+            os.unlink(session_name, dir_fd=dirfd)
+        except OSError as e:
+            return str(e)
+    finally:
+        os.close(dirfd)
+    return None
+
+
+def _delete_date(port2, date):
+    """Delete every recording for one date. Returns (deleted, skipped).
+
+    Only names SESSION_RE accepts are touched, so nothing else that
+    happens to be in the directory can be removed by this route.
+    """
+    _safe_date(date)
+    root = os.path.join(_logs_root(), str(port2), date)
+    dirfd = _date_dir_fd(port2, date)
+    if dirfd is None:
+        return (0, 0)
+    deleted = skipped = 0
+    try:
+        names = os.listdir(dirfd)
+    except OSError:
+        os.close(dirfd)
+        return (0, 0)
+    for name in names:
+        if not SESSION_RE.match(name):
+            continue
+        path = os.path.join(root, name)
+        try:
+            st = os.stat(name, dir_fd=dirfd, follow_symlinks=False)
+        except OSError:
+            continue
+        if not stat.S_ISREG(st.st_mode):
+            skipped += 1
+            continue
+        if _is_being_written(path):
+            skipped += 1
+            continue
+        try:
+            os.unlink(name, dir_fd=dirfd)
+            deleted += 1
+        except OSError:
+            skipped += 1
+    os.close(dirfd)
+    # Tidy the date directory away only if we emptied it. rmdir refuses
+    # a non-empty one, so anything we deliberately did not touch keeps
+    # it -- which is the behaviour we want.
+    try:
+        os.rmdir(root)
+    except OSError:
+        pass
+    return (deleted, skipped)
+
+
+def _flash_day(date, deleted, skipped):
+    """One message covering both what went and what stayed."""
+    if deleted == 0 and skipped == 0:
+        flash('Nothing to delete for %s.' % date, 'error')
+        return
+    msg = 'Deleted %d file%s from %s.' % (deleted,
+                                          '' if deleted == 1 else 's', date)
+    if skipped:
+        msg += (' %d left in place: still being written, or not removable.'
+                % skipped)
+    flash(msg, 'success' if deleted else 'error')
+
+
 def _entry_label(port2):
     """Read the entry's name (best-effort) for display in templates."""
     with tdb_readonly() as db:
@@ -123,6 +309,7 @@ def _list_sessions(port2, date):
             continue
         files.append({
             'name': name,
+            'is_video': _is_video(name),
             'size': st.st_size,
             'mtime': st.st_mtime,
             # ISO 8601 UTC for the <time datetime="..."> attr; the
@@ -142,6 +329,96 @@ def _list_sessions(port2, date):
     return files
 
 
+def _is_video(session_name):
+    return VIDEO_NAME_RE.match(session_name or '') is not None
+
+
+def _ffmpeg_bin():
+    """ffmpeg, if this host has it. The video feature already needs it
+    for RTSP ingest, so on a server carrying video it is present; the
+    web UI must still work without it."""
+    return shutil.which('ffmpeg')
+
+
+def _remux_response(port2, date, session_name):
+    """Serve a recording as fragmented MP4 for a plain <video> element.
+
+    Browsers cannot demux MPEG-TS, so the recording is remuxed on the
+    fly. It is a stream copy -- no decoding, no re-encoding -- which
+    measured at 0.12s of CPU for an 8 MB segment, so it is affordable
+    even on the single-core server.
+
+    The response has no Content-Length and so is not seekable: ffmpeg is
+    writing it as it goes. Scrubbing through a long segment means
+    downloading it, which is what the download link is for.
+    """
+    _safe_date(date)
+    _safe_session(session_name)
+    if not _is_video(session_name):
+        abort(404)
+    ff = _ffmpeg_bin()
+    if ff is None:
+        abort(501)
+    path = os.path.join(_logs_root(), str(port2), date, session_name)
+    if not os.path.isfile(path):
+        abort(404)
+
+    proc = subprocess.Popen(
+        [ff, '-hide_banner', '-loglevel', 'error', '-nostdin',
+         '-i', path, '-c', 'copy',
+         '-movflags', 'frag_keyframe+empty_moov+default_base_moof',
+         '-f', 'mp4', 'pipe:1'],
+        stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
+
+    def generate():
+        try:
+            while True:
+                chunk = proc.stdout.read(64 * 1024)
+                if not chunk:
+                    break
+                yield chunk
+        finally:
+            # The client closing the tab must not leave an ffmpeg
+            # behind: the generator is closed either way, so the kill
+            # belongs here rather than after the loop.
+            try:
+                proc.stdout.close()
+            except OSError:
+                pass
+            if proc.poll() is None:
+                proc.kill()
+            proc.wait()
+
+    resp = Response(generate(), mimetype='video/mp4')
+    resp.headers['Cache-Control'] = 'private, no-store'
+    resp.headers['Content-Disposition'] = 'inline'
+    return resp
+
+
+def _send_session_inline(port2, date, session_name):
+    """Serve a recorded video segment for playback rather than download.
+
+    Same validation as the download path; the differences are that it is
+    not an attachment, it carries the MPEG-TS content type so a player
+    recognises it, and it accepts range requests so seeking works.
+    Restricted to video: nothing else here is meaningful to stream, and
+    serving a .tlog inline just invites a browser to try rendering it.
+    """
+    _safe_date(date)
+    _safe_session(session_name)
+    if not _is_video(session_name):
+        abort(404)
+    directory = os.path.join(_logs_root(), str(port2), date)
+    if not os.path.isdir(directory):
+        abort(404)
+    resp = send_from_directory(directory, session_name,
+                               as_attachment=False, max_age=0,
+                               mimetype='video/mp2t',
+                               conditional=True)
+    resp.headers['Cache-Control'] = 'private, no-store'
+    return resp
+
+
 def _send_session_file(port2, date, session_name):
     """send_from_directory takes care of path-traversal safety; we still
     pre-validate the date and filename so a malformed URL bounces with a
@@ -180,7 +457,8 @@ def admin_dates(port2):
         abort(404)
     return render_template('admin_logs.html',
                            entry=entry, dates=_list_dates(port2),
-                           date=None, sessions=None)
+                           date=None, sessions=None,
+                           del_form=DeleteLogForm())
 
 
 @admin_bp.route('/<int:port2>/<date>/', methods=['GET'])
@@ -192,7 +470,8 @@ def admin_sessions(port2, date):
         abort(404)
     return render_template('admin_logs.html',
                            entry=entry, dates=_list_dates(port2),
-                           date=date, sessions=_list_sessions(port2, date))
+                           date=date, sessions=_list_sessions(port2, date),
+                           del_form=DeleteLogForm())
 
 
 @admin_bp.route('/<int:port2>/<date>/<session_name>', methods=['GET'])
@@ -201,6 +480,42 @@ def admin_download(port2, date, session_name):
     return _send_session_file(port2, date, session_name)
 
 
+@admin_bp.route('/<int:port2>/<date>/<session_name>/watch', methods=['GET'])
+@require_admin
+def admin_watch(port2, date, session_name):
+    _safe_date(date)
+    _safe_session(session_name)
+    if not _is_video(session_name):
+        abort(404)
+    entry = _entry_label(port2)
+    if entry is None:
+        abort(404)
+    return render_template(
+        'log_play.html', entry=entry, date=date, name=session_name,
+        stream_url=url_for('admin_logs.admin_stream', port2=port2,
+                           date=date, session_name=session_name),
+        mp4_url=url_for('admin_logs.admin_play_mp4', port2=port2,
+                        date=date, session_name=session_name),
+        have_ffmpeg=_ffmpeg_bin() is not None,
+        download_url=url_for('admin_logs.admin_download', port2=port2,
+                             date=date, session_name=session_name),
+        back_url=url_for('admin_logs.admin_sessions', port2=port2,
+                         date=date))
+
+
+@admin_bp.route('/<int:port2>/<date>/<session_name>/stream', methods=['GET'])
+@require_admin
+def admin_stream(port2, date, session_name):
+    return _send_session_inline(port2, date, session_name)
+
+
+@admin_bp.route('/<int:port2>/<date>/<session_name>/play.mp4',
+                methods=['GET'])
+@require_admin
+def admin_play_mp4(port2, date, session_name):
+    return _remux_response(port2, date, session_name)
+
+
 # ---------------------------------------------------------------------------
 # owner views: only their own port2
 # ---------------------------------------------------------------------------
@@ -217,7 +532,8 @@ def owner_dates():
         abort(404)
     return render_template('owner_logs.html',
                            entry=entry, dates=_list_dates(port2),
-                           date=None, sessions=None)
+                           date=None, sessions=None,
+                           del_form=DeleteLogForm())
 
 
 @owner_bp.route('/<date>/', methods=['GET'])
@@ -230,7 +546,8 @@ def owner_sessions(date):
         abort(404)
     return render_template('owner_logs.html',
                            entry=entry, dates=_list_dates(port2),
-                           date=date, sessions=_list_sessions(port2, date))
+                           date=date, sessions=_list_sessions(port2, date),
+                           del_form=DeleteLogForm())
 
 
 @owner_bp.route('/<date>/<session_name>', methods=['GET'])
@@ -238,3 +555,94 @@ def owner_sessions(date):
 def owner_download(date, session_name):
     port2 = current_owner()
     return _send_session_file(port2, date, session_name)
+
+
+@owner_bp.route('/<date>/<session_name>/watch', methods=['GET'])
+@require_login
+def owner_watch(date, session_name):
+    port2 = current_owner()
+    _safe_date(date)
+    _safe_session(session_name)
+    if not _is_video(session_name):
+        abort(404)
+    entry = _entry_label(port2)
+    if entry is None:
+        abort(404)
+    return render_template(
+        'log_play.html', entry=entry, date=date, name=session_name,
+        stream_url=url_for('owner_logs.owner_stream', date=date,
+                           session_name=session_name),
+        mp4_url=url_for('owner_logs.owner_play_mp4', date=date,
+                        session_name=session_name),
+        have_ffmpeg=_ffmpeg_bin() is not None,
+        download_url=url_for('owner_logs.owner_download', date=date,
+                             session_name=session_name),
+        back_url=url_for('owner_logs.owner_sessions', date=date))
+
+
+@owner_bp.route('/<date>/<session_name>/stream', methods=['GET'])
+@require_login
+def owner_stream(date, session_name):
+    port2 = current_owner()
+    return _send_session_inline(port2, date, session_name)
+
+
+@owner_bp.route('/<date>/<session_name>/play.mp4', methods=['GET'])
+@require_login
+def owner_play_mp4(date, session_name):
+    port2 = current_owner()
+    return _remux_response(port2, date, session_name)
+
+
+# ----------------------------------------------------------- deletion
+#
+# POST-only, CSRF-protected, and scoped by the same auth decorators as
+# the listing: an owner reaches only their own entry because the route
+# takes no port2 at all, and an admin any.
+
+
+@admin_bp.route('/<int:port2>/<date>/<session_name>/delete', methods=['POST'])
+@require_admin
+def admin_delete_session(port2, date, session_name):
+    if not DeleteLogForm().validate_on_submit():
+        abort(400)
+    err = _delete_session(port2, date, session_name)
+    if err:
+        flash('Could not delete %s: %s' % (session_name, err), 'error')
+    else:
+        flash('Deleted %s.' % session_name, 'success')
+    return redirect(url_for('admin_logs.admin_sessions',
+                            port2=port2, date=date))
+
+
+@admin_bp.route('/<int:port2>/<date>/delete', methods=['POST'])
+@require_admin
+def admin_delete_date(port2, date):
+    if not DeleteLogForm().validate_on_submit():
+        abort(400)
+    deleted, skipped = _delete_date(port2, date)
+    _flash_day(date, deleted, skipped)
+    return redirect(url_for('admin_logs.admin_dates', port2=port2))
+
+
+@owner_bp.route('/<date>/<session_name>/delete', methods=['POST'])
+@require_login
+def owner_delete_session(date, session_name):
+    if not DeleteLogForm().validate_on_submit():
+        abort(400)
+    err = _delete_session(current_owner(), date, session_name)
+    if err:
+        flash('Could not delete %s: %s' % (session_name, err), 'error')
+    else:
+        flash('Deleted %s.' % session_name, 'success')
+    return redirect(url_for('owner_logs.owner_sessions', date=date))
+
+
+@owner_bp.route('/<date>/delete', methods=['POST'])
+@require_login
+def owner_delete_date(date):
+    if not DeleteLogForm().validate_on_submit():
+        abort(400)
+    deleted, skipped = _delete_date(current_owner(), date)
+    _flash_day(date, deleted, skipped)
+    return redirect(url_for('owner_logs.owner_dates'))
diff --git a/webadmin/proxylog.py b/webadmin/proxylog.py
new file mode 100644
index 0000000..d980ab2
--- /dev/null
+++ b/webadmin/proxylog.py
@@ -0,0 +1,252 @@
+"""The daemon's own activity log, and control over the daemon itself.
+
+Distinct from logs.py, which serves per-entry session recordings. This
+is proxy.log -- what the running daemon prints -- plus the restart
+control, both admin-only.
+
+Restart works by signalling rather than by systemctl. supportproxy.service
+sets Restart=always and runs as the same user as this process, so a
+SIGTERM to the parent is enough: systemd respawns it. That needs no sudo
+and no privileged helper, and it degrades honestly without systemd --
+the daemon stops and the caller is told which pid was signalled.
+"""
+import hashlib
+import os
+import re
+import signal
+import subprocess
+
+SUPPORTPROXY_COMM = 'supportproxy'
+
+# How much of the tail to show on first load. Rotation bounds the file,
+# but it can still be large between rotations, so never read it whole.
+INITIAL_TAIL_BYTES = 64 * 1024
+
+# Ceiling on one incremental fetch, so a burst cannot make a single
+# response enormous.
+MAX_CHUNK_BYTES = 256 * 1024
+
+# Belt and braces. The daemon redacts credentials before it writes them
+# (http_redact_target), which is what keeps them off disk; this catches
+# anything already in an older log, and any path that forgets to.
+#
+# Matches the value of a credential query parameter up to the next
+# delimiter rather than a token's exact shape: the previous pattern
+# wanted lowercase hex after a literal dot, so an uppercase HMAC or a
+# %2E-encoded dot slipped straight through, and it knew nothing about
+# ?pw= at all.
+_SECRET_RE = re.compile(r'([?&](?:pw|password|t|key)=)[^&\s"\']+',
+                        re.IGNORECASE)
+
+
+def redact(text):
+    return _SECRET_RE.sub(r'\1<redacted>', text)
+
+
+def log_path(app):
+    """Absolute path of the daemon log.
+
+    Defaults beside keys.tdb: the daemon's working directory is where it
+    writes both, and the web admin is started from the same place.
+    """
+    configured = app.config.get('PROXY_LOG_PATH')
+    if configured:
+        return configured
+    return os.path.join(os.path.dirname(
+        os.path.abspath(app.config['KEYDB_PATH'])), 'proxy.log')
+
+
+def _head_tag(path, n=256):
+    """A short digest of the file's first bytes.
+
+    Cheap, and it changes whenever the log is truncated or replaced --
+    the two things an offset cannot survive.
+    """
+    try:
+        with open(path, 'rb') as f:
+            head = f.read(n)
+    except OSError:
+        return ''
+    return hashlib.sha256(head).hexdigest()[:16]
+
+
+def read_since(path, offset, ident=None):
+    """Return (text, next_offset, restarted, ident).
+
+    `restarted` says the caller's offset no longer refers to the same
+    content -- rotated, truncated or replaced under it -- so the view
+    should replace what it has rather than append to it.
+
+    `ident` is an opaque tag the caller passes back, covering both the
+    inode and a fingerprint of the file's first bytes.
+
+    Size alone is not enough: with copytruncate the log can be truncated
+    and grow past the old offset between two polls, and a size check
+    then seeks straight into the new generation, skipping its start and
+    reporting nothing unusual. Nor is the inode enough on its own --
+    copytruncate keeps it by design, and a rename-and-create rotation
+    can be handed the freed inode straight back. What does change either
+    way is the start of the file, so that is what is fingerprinted.
+    """
+    try:
+        st = os.stat(path)
+    except OSError:
+        return ('', 0, False, None)
+    size = st.st_size
+    now_ident = '%d:%d:%s' % (st.st_dev, st.st_ino, _head_tag(path))
+
+    restarted = False
+    if ident is not None and ident != now_ident:
+        # Replaced outright (rename-and-create rotation).
+        offset = None
+    if offset is None or offset < 0 or offset > size:
+        # First load, or the file shrank: show the tail.
+        offset = max(0, size - INITIAL_TAIL_BYTES)
+        restarted = True
+
+    if size - offset > MAX_CHUNK_BYTES:
+        # Fell too far behind to catch up in one response; skip ahead
+        # rather than serve a huge body, and say the view is not
+        # contiguous with what it had.
+        offset = size - MAX_CHUNK_BYTES
+        restarted = True
+
+    try:
+        with open(path, 'rb') as f:
+            f.seek(offset)
+            data = f.read(MAX_CHUNK_BYTES)
+    except OSError:
+        return ('', offset, restarted, now_ident)
+
+    next_offset = offset + len(data)
+    text = data.decode('utf-8', 'replace')
+    if restarted and offset > 0:
+        # A tail taken mid-file almost never starts on a line boundary.
+        # Only mid-file: from the start there is no partial line, and
+        # stripping there threw away the log's first line.
+        nl = text.find('\n')
+        if nl >= 0:
+            text = text[nl + 1:]
+    return (redact(text), next_offset, restarted, now_ident)
+
+
+def _comm(pid):
+    try:
+        with open('/proc/%d/comm' % pid) as f:
+            return f.read().strip()
+    except OSError:
+        return None
+
+
+def _ppid(pid):
+    try:
+        with open('/proc/%d/status' % pid) as f:
+            for line in f:
+                if line.startswith('PPid:'):
+                    return int(line.split()[1])
+    except (OSError, ValueError):
+        pass
+    return None
+
+
+def _cwd(pid):
+    try:
+        return os.readlink('/proc/%d/cwd' % pid)
+    except OSError:
+        return None
+
+
+def _systemd_main_pid(unit='supportproxy'):
+    """The unit's MainPID, or None if systemd cannot tell us.
+
+    Authoritative when it answers: it names the process systemd will
+    restart, which is exactly the one worth signalling.
+    """
+    try:
+        out = subprocess.run(
+            ['systemctl', 'show', '-p', 'MainPID', '--value', unit],
+            capture_output=True, text=True, timeout=5)
+    except (OSError, subprocess.SubprocessError):
+        return None
+    try:
+        pid = int(out.stdout.strip())
+    except ValueError:
+        return None
+    return pid if pid > 0 else None
+
+
+def find_daemon(workdir=None):
+    """The pid of the daemon this web admin belongs to, or None.
+
+    Identity matters here: min(pid) over every process named
+    supportproxy will happily pick a staging instance, or a session
+    child that was reparented when its own parent died, and the restart
+    then hits the wrong thing. So:
+
+      1. Ask systemd, which knows which process it supervises.
+      2. Otherwise require the same working directory as this web admin
+         -- the daemon writes keys.tdb there, and that is the one thing
+         tying a process to this configuration -- and that its parent is
+         not itself supportproxy, which excludes the session children.
+    """
+    pid = _systemd_main_pid()
+    if pid is not None and _comm(pid) == SUPPORTPROXY_COMM:
+        return pid
+
+    if workdir is None:
+        workdir = os.getcwd()
+    try:
+        workdir = os.path.realpath(workdir)
+    except OSError:
+        pass
+
+    best = None
+    for name in os.listdir('/proc'):
+        if not name.isdigit():
+            continue
+        p = int(name)
+        if _comm(p) != SUPPORTPROXY_COMM:
+            continue
+        if _comm(_ppid(p) or 0) == SUPPORTPROXY_COMM:
+            continue            # a session or video child
+        if _cwd(p) != workdir:
+            continue            # another instance entirely
+        if best is None or p < best:
+            best = p
+    return best
+
+
+def restart_daemon(workdir=None):
+    """SIGTERM the daemon so its supervisor respawns it.
+
+    Returns (pid, error). A caller that gets a pid should not assume the
+    daemon is back: that is up to the supervisor, and RestartSec delays
+    it.
+
+    Signalled through a pidfd where the kernel supports one. Between
+    finding a pid in /proc and killing it, the process can exit and the
+    number be reused by anything else this user runs -- a pidfd refers
+    to the process, not the number, so the race cannot land on a
+    stranger. The fallback re-checks identity immediately before the
+    kill, which narrows the window without closing it.
+    """
+    pid = find_daemon(workdir)
+    if pid is None:
+        return (None, 'no running supportproxy process found for this '
+                      'installation')
+    try:
+        opener = getattr(os, 'pidfd_open', None)
+        sender = getattr(signal, 'pidfd_send_signal', None)
+        if opener is not None and sender is not None:
+            fd = opener(pid, 0)
+            try:
+                sender(fd, signal.SIGTERM)
+            finally:
+                os.close(fd)
+        else:
+            if _comm(pid) != SUPPORTPROXY_COMM:
+                return (None, 'the daemon exited while we were looking at it')
+            os.kill(pid, signal.SIGTERM)
+    except OSError as e:
+        return (None, 'could not signal pid %d: %s' % (pid, e))
+    return (pid, None)
diff --git a/webadmin/routes_admin.py b/webadmin/routes_admin.py
index 97463b4..a326457 100644
--- a/webadmin/routes_admin.py
+++ b/webadmin/routes_admin.py
@@ -14,6 +14,7 @@
 from .auth import is_admin, require_admin
 from .db import tdb_readonly, tdb_transaction
 from .forms import AdminAddForm, AdminEditForm, DeleteForm, KillForm
+from . import videoform
 
 bp = Blueprint('admin', __name__, url_prefix='/admin')
 
@@ -164,11 +165,10 @@ def edit(port2):
 
             ke.name = form.name.data or ''
             if form.port1.data != ke.port1:
-                # check uniqueness of new port1 (must not collide with any
-                # other port1 or port2)
-                ports1, ports2 = keydb_lib.get_port_sets(db)
-                ports1.discard(ke.port1)  # our own old value is OK
-                if form.port1.data in ports1 or form.port1.data in ports2:
+                # New port1 must not collide with any port any other entry
+                # binds -- port1, port2 or a video port.
+                used = keydb_lib.ports_in_use(db, exclude_port2=port2)
+                if form.port1.data in used or form.port1.data == ke.port2:
                     flash('port1 %d is already in use.' % form.port1.data,
                           'error')
                     return redirect(url_for('admin.edit', port2=port2))
@@ -213,6 +213,10 @@ def edit(port2):
                 ke.flags &= ~keydb_lib.FLAG_USE_TZ
             if form.reset_timestamp.data:
                 ke.timestamp = 0
+            err = videoform.apply(form, ke, db)
+            if err:
+                flash(err, 'error')
+                return redirect(url_for('admin.edit', port2=port2))
             ke.store(db)
 
             # if the admin just demoted themselves, drop their session role
@@ -235,6 +239,7 @@ def edit(port2):
         form.fc_sysid.data = ke.fc_sysid
         form.tz_offset_hours.data = ke.tz_offset_hours
         form.use_tz.data = bool(ke.flags & keydb_lib.FLAG_USE_TZ)
+        videoform.populate(form, ke, db)
     return render_template('admin_edit.html', form=form, entry=ke,
                            delete_form=delete_form)
 
diff --git a/webadmin/routes_owner.py b/webadmin/routes_owner.py
index 028b3db..5727894 100644
--- a/webadmin/routes_owner.py
+++ b/webadmin/routes_owner.py
@@ -7,6 +7,7 @@
 from .auth import current_owner, require_login
 from .db import tdb_readonly, tdb_transaction
 from .forms import KillForm, OwnerEditForm
+from . import videoform
 
 bp = Blueprint('owner', __name__, url_prefix='/me')
 
@@ -89,6 +90,10 @@ def me():
                 ke.flags &= ~keydb_lib.FLAG_USE_TZ
             if form.reset_timestamp.data:
                 ke.timestamp = 0
+            err = videoform.apply(form, ke, db)
+            if err:
+                flash(err, 'error')
+                return redirect(url_for('owner.me'))
             ke.store(db)
         flash('Saved.', 'success')
         return redirect(url_for('owner.me'))
@@ -109,6 +114,7 @@ def me():
         form.fc_sysid.data = ke.fc_sysid
         form.tz_offset_hours.data = ke.tz_offset_hours
         form.use_tz.data = bool(ke.flags & keydb_lib.FLAG_USE_TZ)
+        videoform.populate(form, ke, db)
     active = conn_db.list_for_port2(port2)
     return render_template('owner.html', form=form, entry=ke, active=active,
                            kill_form=KillForm())
diff --git a/webadmin/routes_system.py b/webadmin/routes_system.py
new file mode 100644
index 0000000..7df2414
--- /dev/null
+++ b/webadmin/routes_system.py
@@ -0,0 +1,67 @@
+"""Admin view of the daemon: its activity log, and restarting it.
+
+Separate from routes_admin.py (entries) and logs.py (per-entry session
+recordings) because this is about the server itself rather than any
+one user's data.
+"""
+import os
+
+from flask import (Blueprint, current_app, flash, jsonify, redirect,
+                   render_template, request, url_for)
+
+from . import proxylog
+from .auth import require_admin
+from .forms import RestartProxyForm
+
+bp = Blueprint('system', __name__, url_prefix='/admin/system')
+
+
+@bp.route('/', methods=['GET'])
+@require_admin
+def index():
+    path = proxylog.log_path(current_app)
+    return render_template(
+        'admin_system.html', restart_form=RestartProxyForm(), log_path=path,
+        daemon_pid=proxylog.find_daemon(os.path.dirname(path)))
+
+
+@bp.route('/log', methods=['GET'])
+@require_admin
+def log_data():
+    """Bytes appended since `offset`, for the live tail.
+
+    Polled, not streamed: gunicorn here runs sync workers, so holding a
+    response open for a tail would occupy a worker for as long as the
+    page is left open.
+    """
+    try:
+        offset = int(request.args.get('offset', -1))
+    except ValueError:
+        offset = -1
+    text, next_offset, restarted, ident = proxylog.read_since(
+        proxylog.log_path(current_app), None if offset < 0 else offset,
+        request.args.get('ident') or None)
+    return jsonify({'text': text, 'offset': next_offset,
+                    'restarted': restarted, 'ident': ident})
+
+
+@bp.route('/restart', methods=['POST'])
+@require_admin
+def restart():
+    form = RestartProxyForm()
+    if not form.validate_on_submit():
+        flash('Restart not confirmed.', 'error')
+        return redirect(url_for('system.index'))
+    # Bound to this installation's working directory: the daemon
+    # writes keys.tdb there, which is what distinguishes it from
+    # another instance on the same host.
+    pid, err = proxylog.restart_daemon(
+        os.path.dirname(os.path.abspath(
+            current_app.config['KEYDB_PATH'])))
+    if err:
+        flash('Could not restart the proxy: %s' % err, 'error')
+    else:
+        flash('Signalled the proxy (pid %d). Live sessions have been '
+              'dropped; the supervisor restarts it within a few seconds.'
+              % pid, 'success')
+    return redirect(url_for('system.index'))
diff --git a/webadmin/routes_video.py b/webadmin/routes_video.py
new file mode 100644
index 0000000..cb50c46
--- /dev/null
+++ b/webadmin/routes_video.py
@@ -0,0 +1,115 @@
+"""Browser playback page.
+
+Serves a player per configured video slot, with a short-lived token so
+the viewer password never appears in a URL. The page is honest about
+what a browser can actually decode: of the streams this proxy carries,
+H.264 plays and HEVC generally does not, so an unplayable stream gets
+an explanation and a copyable ffplay/VLC command rather than a broken
+<video> element.
+"""
+from flask import (Blueprint, abort, current_app, jsonify,
+                   render_template, request, url_for)
+
+import keydb_lib
+
+from .auth import current_owner, is_admin, require_login
+from .db import tdb_readonly
+from . import videotoken
+
+bp = Blueprint('video', __name__, url_prefix='/video')
+
+# stream_type values, as they appear in a PMT. Keep in sync with
+# videots.h -- these decide what the page offers.
+STREAM_NAMES = {
+    0x02: 'MPEG-2',
+    0x1B: 'H.264',
+    0x24: 'HEVC',
+}
+
+# What a browser's Media Source Extensions can actually play. HEVC is
+# excluded deliberately: mpegts.js can demux it, but MSE support is
+# absent on most desktops, so offering a player would just show a black
+# rectangle.
+BROWSER_PLAYABLE = (0x1B,)
+
+
+def _viewer_host():
+    """Host the browser should open the video socket on.
+
+    The video port is served by the proxy itself, not through this app,
+    so the player connects directly to the same host on that port.
+    """
+    return request.host.split(':')[0]
+
+
+def _resolve_port2():
+    """Which entry this request is about. An admin may name any entry
+    with ?port2=; an owner only ever gets their own."""
+    port2 = current_owner()
+    want = request.args.get('port2', type=int)
+    if want is not None and want != port2:
+        if not is_admin():
+            abort(403)
+        port2 = want
+    return port2
+
+
+@bp.route('/token', methods=['GET'])
+@require_login
+def token():
+    """Mint a fresh viewer token.
+
+    Tokens last a minute by design, but a player reconnects for as long
+    as the page is open -- after a publisher restart, a network blip, or
+    a laptop waking up. A page that minted one token at render would
+    stop being able to reconnect after that minute, which presents as
+    "it only works if I reload".
+    """
+    port2 = _resolve_port2()
+    slot = request.args.get('slot', type=int)
+    if slot is None or slot < 0 or slot >= keydb_lib.MAX_VIDEO_PORTS:
+        abort(400)
+
+    with tdb_readonly() as db:
+        ke = keydb_lib.KeyEntry(port2)
+        if not ke.fetch(db):
+            abort(404)
+        if not ke.video_enabled() or not ke.video_ports[slot]:
+            abort(404)
+        return jsonify({'token': videotoken.mint(ke.secret_key, port2, slot)})
+
+
+@bp.route('/', methods=['GET'])
+@require_login
+def index():
+    port2 = _resolve_port2()
+
+    with tdb_readonly() as db:
+        ke = keydb_lib.KeyEntry(port2)
+        if not ke.fetch(db):
+            abort(404)
+
+        slots = []
+        for slot, port in ke.active_video_ports():
+            slots.append({
+                'slot': slot,
+                'number': slot + 1,
+                'port': port,
+                'opts': ke.slot_opt_names(slot),
+                'token': videotoken.mint(ke.secret_key, port2, slot),
+                'needs_password': ke.video_viewer_pass_set(),
+            })
+
+    return render_template(
+        'video.html',
+        entry=ke,
+        port2=port2,
+        slots=slots,
+        host=_viewer_host(),
+        enabled=ke.video_enabled(),
+        browser_playable=BROWSER_PLAYABLE,
+        stream_names=STREAM_NAMES,
+        # Carries ?port2= so an admin watching someone else's stream
+        # keeps refreshing tokens for *that* entry, not their own.
+        token_url=url_for('video.token', port2=port2),
+    )
diff --git a/webadmin/static/style.css b/webadmin/static/style.css
index 0a630b3..d9518e8 100644
--- a/webadmin/static/style.css
+++ b/webadmin/static/style.css
@@ -113,3 +113,124 @@ button.copy-partner-text {
 }
 
 p.hint { font-size: 0.9em; color: #555; max-width: 48em; }
+
+/* Per-field help tooltips (templates/_macros.html).
+
+   The whole .field row is the hover target. An earlier version put the
+   text behind a small "?" you had to aim at, which is more work than
+   reading the sentence is worth.
+
+   `.field:hover > .tip` is deliberately a direct-child selector: the
+   per-slot video row holds three separately documented checkboxes, and
+   a descendant selector would throw all three tooltips up together.
+   Those inner ones are triggered by their own .opt instead, while
+   still being positioned against the row so they cannot run off the
+   page.
+
+   Shown with opacity rather than display so appearing can be delayed.
+   Without the delay, every row you cross on the way to the one you want
+   flashes a tooltip at you. Hiding has no delay -- the delay is only
+   applied in the :hover rule. */
+.field { position: relative; }
+.field.has-tip > label,
+.opt { text-decoration: underline dotted #999; text-underline-offset: 3px; }
+/* The underline is the "there is help here" cue. On a slot row each
+   control is its own hover target, so the cue belongs on each of them
+   rather than on the row's label. */
+.opt input { text-decoration: none; }
+.tip {
+    position: absolute;
+    left: 0;
+    top: 100%;
+    margin-top: 0.2rem;
+    z-index: 20;
+    width: max-content;
+    max-width: min(42em, calc(100vw - 2rem));
+    padding: 0.5rem 0.7rem;
+    background: #2c2c2c;
+    color: #f2f2f2;
+    border-radius: 4px;
+    box-shadow: 0 2px 8px rgba(0, 0, 0, 0.3);
+    font-size: 0.85rem;
+    font-weight: 400;
+    line-height: 1.4;
+    text-align: left;
+    white-space: normal;
+    pointer-events: none;   /* never steal a click from the field */
+    opacity: 0;
+    visibility: hidden;
+    transition: opacity 0.12s linear, visibility 0s linear 0.12s;
+}
+.field:hover > .tip,
+.field:focus-within > .tip,
+.opt:hover .tip,
+.opt:focus-within .tip {
+    opacity: 1;
+    visibility: visible;
+    transition: opacity 0.12s linear 0.4s, visibility 0s linear 0.4s;
+}
+.tip code { color: #ffd9a0; }
+
+/* Per-slot video options. Each checkbox, its text and its help marker
+   are one unbreakable unit, or the marker wraps onto a line of its own
+   and reads as belonging to the next row. The group as a whole still
+   wraps between options on a narrow screen. */
+.video-slot-opts .opt { white-space: nowrap; margin-right: 0.7rem; }
+
+/* A port is five digits, so the global 18em minimum on inputs just
+   pushes the per-slot options onto a second line. */
+.video-slot input[type=number] { min-width: 7em; width: 7em; }
+
+/* Server page: the daemon's own log and controls. */
+.logview {
+    background: #111;
+    color: #ddd;
+    padding: 0.6em 0.8em;
+    border-radius: 4px;
+    max-height: 60vh;
+    overflow: auto;
+    white-space: pre-wrap;
+    word-break: break-word;
+    font-size: 0.85em;
+    line-height: 1.35;
+}
+.log-controls {
+    display: flex;
+    align-items: center;
+    gap: 1em;
+    margin: 0.4em 0;
+}
+.help-inline {
+    font-size: 0.85em;
+    opacity: 0.75;
+    margin-left: 0.6em;
+}
+
+/* Action icons in the log listings.
+
+   The cell holds a mix of links and a one-button form; without
+   inline-block on both, the form takes a line of its own and the
+   delete drops below the other actions. */
+.icon {
+    width: 1.15em;
+    height: 1.15em;
+    vertical-align: -0.2em;
+    fill: currentColor;
+}
+td.actions { white-space: nowrap; }
+td.actions > a,
+td.actions > form { display: inline-block; vertical-align: middle; }
+.iconbtn {
+    background: none;
+    border: none;
+    padding: 0.15em 0.35em;
+    font: inherit;
+    color: #1a4f8a;
+    cursor: pointer;
+    line-height: 1;
+    border-radius: 3px;
+}
+.iconbtn:hover { background: rgba(0, 0, 0, 0.07); }
+.iconbtn.danger-icon { color: #b03030; }
+button.danger .icon { vertical-align: -0.2em; margin-right: 0.2em; }
+form.day-delete { margin-top: 0.6em; }
diff --git a/webadmin/static/vendor/mpegts.js/LICENSE b/webadmin/static/vendor/mpegts.js/LICENSE
new file mode 100644
index 0000000..7a4a3ea
--- /dev/null
+++ b/webadmin/static/vendor/mpegts.js/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
\ No newline at end of file
diff --git a/webadmin/static/vendor/mpegts.js/VERSION b/webadmin/static/vendor/mpegts.js/VERSION
new file mode 100644
index 0000000..03bd908
--- /dev/null
+++ b/webadmin/static/vendor/mpegts.js/VERSION
@@ -0,0 +1,17 @@
+mpegts.js 1.8.0
+upstream: https://registry.npmjs.org/mpegts.js/-/mpegts.js-1.8.0.tgz
+file:     dist/mpegts.js
+sha256:   e998f7a6cec5fcab56ac14e8c22d61a42565c1ebf7174b3fda078343eda6cab0
+vendored: 2026-08-01
+licence:  Apache-2.0 (see LICENSE)
+
+Vendored rather than loaded from a CDN: published artifacts are served
+with a strict policy and must be self-contained, and an external script
+tag would be a third party able to change what runs in an operator's
+browser.
+
+To refresh:
+    npm pack mpegts.js
+    tar xzf mpegts.js-<ver>.tgz
+    cp package/dist/mpegts.js package/LICENSE .
+    sha256sum mpegts.js        # record it above
diff --git a/webadmin/static/vendor/mpegts.js/mpegts.js b/webadmin/static/vendor/mpegts.js/mpegts.js
new file mode 100644
index 0000000..f8b3cc6
--- /dev/null
+++ b/webadmin/static/vendor/mpegts.js/mpegts.js
@@ -0,0 +1,9 @@
+!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.mpegts=t():e.mpegts=t()}(window,(function(){return function(e){var t={};function i(n){if(t[n])return t[n].exports;var a=t[n]={i:n,l:!1,exports:{}};return e[n].call(a.exports,a,a.exports,i),a.l=!0,a.exports}return i.m=e,i.c=t,i.d=function(e,t,n){i.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:n})},i.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},i.t=function(e,t){if(1&t&&(e=i(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(i.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var a in e)i.d(n,a,function(t){return e[t]}.bind(null,a));return n},i.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return i.d(t,"a",t),t},i.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},i.p="",i(i.s=20)}([function(e,t,i){"use strict";var n=i(9),a=i.n(n),r=function(){function e(){}return e.e=function(t,i){t&&!e.FORCE_GLOBAL_TAG||(t=e.GLOBAL_TAG);var n="[".concat(t,"] > ").concat(i);e.ENABLE_CALLBACK&&e.emitter.emit("log","error",n),e.ENABLE_ERROR&&(console.error?console.error(n):console.warn?console.warn(n):console.log(n))},e.i=function(t,i){t&&!e.FORCE_GLOBAL_TAG||(t=e.GLOBAL_TAG);var n="[".concat(t,"] > ").concat(i);e.ENABLE_CALLBACK&&e.emitter.emit("log","info",n),e.ENABLE_INFO&&(console.info?console.info(n):console.log(n))},e.w=function(t,i){t&&!e.FORCE_GLOBAL_TAG||(t=e.GLOBAL_TAG);var n="[".concat(t,"] > ").concat(i);e.ENABLE_CALLBACK&&e.emitter.emit("log","warn",n),e.ENABLE_WARN&&(console.warn?console.warn(n):console.log(n))},e.d=function(t,i){t&&!e.FORCE_GLOBAL_TAG||(t=e.GLOBAL_TAG);var n="[".concat(t,"] > ").concat(i);e.ENABLE_CALLBACK&&e.emitter.emit("log","debug",n),e.ENABLE_DEBUG&&(console.debug?console.debug(n):console.log(n))},e.v=function(t,i){t&&!e.FORCE_GLOBAL_TAG||(t=e.GLOBAL_TAG);var n="[".concat(t,"] > ").concat(i);e.ENABLE_CALLBACK&&e.emitter.emit("log","verbose",n),e.ENABLE_VERBOSE&&console.log(n)},e}();r.GLOBAL_TAG="mpegts.js",r.FORCE_GLOBAL_TAG=!1,r.ENABLE_ERROR=!0,r.ENABLE_INFO=!0,r.ENABLE_WARN=!0,r.ENABLE_DEBUG=!0,r.ENABLE_VERBOSE=!0,r.ENABLE_CALLBACK=!1,r.emitter=new a.a,t.a=r},function(e,t,i){"use strict";var n;!function(e){e.IO_ERROR="io_error",e.DEMUX_ERROR="demux_error",e.INIT_SEGMENT="init_segment",e.MEDIA_SEGMENT="media_segment",e.LOADING_COMPLETE="loading_complete",e.RECOVERED_EARLY_EOF="recovered_early_eof",e.MEDIA_INFO="media_info",e.METADATA_ARRIVED="metadata_arrived",e.SCRIPTDATA_ARRIVED="scriptdata_arrived",e.TIMED_ID3_METADATA_ARRIVED="timed_id3_metadata_arrived",e.SYNCHRONOUS_KLV_METADATA_ARRIVED="synchronous_klv_metadata_arrived",e.ASYNCHRONOUS_KLV_METADATA_ARRIVED="asynchronous_klv_metadata_arrived",e.SMPTE2038_METADATA_ARRIVED="smpte2038_metadata_arrived",e.SCTE35_METADATA_ARRIVED="scte35_metadata_arrived",e.PES_PRIVATE_DATA_DESCRIPTOR="pes_private_data_descriptor",e.PES_PRIVATE_DATA_ARRIVED="pes_private_data_arrived",e.STATISTICS_INFO="statistics_info",e.RECOMMEND_SEEKPOINT="recommend_seekpoint"}(n||(n={})),t.a=n},function(e,t,i){"use strict";i.d(t,"c",(function(){return a})),i.d(t,"b",(function(){return r})),i.d(t,"a",(function(){return o}));var n=i(3),a={kIdle:0,kConnecting:1,kBuffering:2,kError:3,kComplete:4},r={OK:"OK",EXCEPTION:"Exception",HTTP_STATUS_CODE_INVALID:"HttpStatusCodeInvalid",CONNECTING_TIMEOUT:"ConnectingTimeout",EARLY_EOF:"EarlyEof",UNRECOVERABLE_EARLY_EOF:"UnrecoverableEarlyEof"},o=function(){function e(e){this._type=e||"undefined",this._status=a.kIdle,this._needStash=!1,this._onContentLengthKnown=null,this._onURLRedirect=null,this._onDataArrival=null,this._onError=null,this._onComplete=null}return e.prototype.destroy=function(){this._status=a.kIdle,this._onContentLengthKnown=null,this._onURLRedirect=null,this._onDataArrival=null,this._onError=null,this._onComplete=null},e.prototype.isWorking=function(){return this._status===a.kConnecting||this._status===a.kBuffering},Object.defineProperty(e.prototype,"type",{get:function(){return this._type},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"status",{get:function(){return this._status},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"needStashBuffer",{get:function(){return this._needStash},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onContentLengthKnown",{get:function(){return this._onContentLengthKnown},set:function(e){this._onContentLengthKnown=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onURLRedirect",{get:function(){return this._onURLRedirect},set:function(e){this._onURLRedirect=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onDataArrival",{get:function(){return this._onDataArrival},set:function(e){this._onDataArrival=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onError",{get:function(){return this._onError},set:function(e){this._onError=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onComplete",{get:function(){return this._onComplete},set:function(e){this._onComplete=e},enumerable:!1,configurable:!0}),e.prototype.open=function(e,t){throw new n.c("Unimplemented abstract function!")},e.prototype.abort=function(){throw new n.c("Unimplemented abstract function!")},e}()},function(e,t,i){"use strict";i.d(t,"d",(function(){return r})),i.d(t,"a",(function(){return o})),i.d(t,"b",(function(){return s})),i.d(t,"c",(function(){return d}));var n,a=(n=function(e,t){return(n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var i in t)Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i])})(e,t)},function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function i(){this.constructor=e}n(e,t),e.prototype=null===t?Object.create(t):(i.prototype=t.prototype,new i)}),r=function(){function e(e){this._message=e}return Object.defineProperty(e.prototype,"name",{get:function(){return"RuntimeException"},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"message",{get:function(){return this._message},enumerable:!1,configurable:!0}),e.prototype.toString=function(){return this.name+": "+this.message},e}(),o=function(e){function t(t){return e.call(this,t)||this}return a(t,e),Object.defineProperty(t.prototype,"name",{get:function(){return"IllegalStateException"},enumerable:!1,configurable:!0}),t}(r),s=function(e){function t(t){return e.call(this,t)||this}return a(t,e),Object.defineProperty(t.prototype,"name",{get:function(){return"InvalidArgumentException"},enumerable:!1,configurable:!0}),t}(r),d=function(e){function t(t){return e.call(this,t)||this}return a(t,e),Object.defineProperty(t.prototype,"name",{get:function(){return"NotImplementedException"},enumerable:!1,configurable:!0}),t}(r)},function(e,t,i){"use strict";var n;!function(e){e.ERROR="error",e.LOADING_COMPLETE="loading_complete",e.RECOVERED_EARLY_EOF="recovered_early_eof",e.MEDIA_INFO="media_info",e.METADATA_ARRIVED="metadata_arrived",e.SCRIPTDATA_ARRIVED="scriptdata_arrived",e.TIMED_ID3_METADATA_ARRIVED="timed_id3_metadata_arrived",e.SYNCHRONOUS_KLV_METADATA_ARRIVED="synchronous_klv_metadata_arrived",e.ASYNCHRONOUS_KLV_METADATA_ARRIVED="asynchronous_klv_metadata_arrived",e.SMPTE2038_METADATA_ARRIVED="smpte2038_metadata_arrived",e.SCTE35_METADATA_ARRIVED="scte35_metadata_arrived",e.PES_PRIVATE_DATA_DESCRIPTOR="pes_private_data_descriptor",e.PES_PRIVATE_DATA_ARRIVED="pes_private_data_arrived",e.STATISTICS_INFO="statistics_info",e.DESTROYING="destroying"}(n||(n={})),t.a=n},function(e,t,i){"use strict";var n={};!function(){var e=self.navigator.userAgent.toLowerCase(),t=/(edge)\/([\w.]+)/.exec(e)||/(opr)[\/]([\w.]+)/.exec(e)||/(chrome)[ \/]([\w.]+)/.exec(e)||/(iemobile)[\/]([\w.]+)/.exec(e)||/(version)(applewebkit)[ \/]([\w.]+).*(safari)[ \/]([\w.]+)/.exec(e)||/(webkit)[ \/]([\w.]+).*(version)[ \/]([\w.]+).*(safari)[ \/]([\w.]+)/.exec(e)||/(webkit)[ \/]([\w.]+)/.exec(e)||/(opera)(?:.*version|)[ \/]([\w.]+)/.exec(e)||/(msie) ([\w.]+)/.exec(e)||e.indexOf("trident")>=0&&/(rv)(?::| )([\w.]+)/.exec(e)||e.indexOf("compatible")<0&&/(firefox)[ \/]([\w.]+)/.exec(e)||[],i=/(ipad)/.exec(e)||/(ipod)/.exec(e)||/(windows phone)/.exec(e)||/(iphone)/.exec(e)||/(kindle)/.exec(e)||/(android)/.exec(e)||/(windows)/.exec(e)||/(mac)/.exec(e)||/(linux)/.exec(e)||/(cros)/.exec(e)||[],a={browser:t[5]||t[3]||t[1]||"",version:t[2]||t[4]||"0",majorVersion:t[4]||t[2]||"0",platform:i[0]||""},r={};if(a.browser){r[a.browser]=!0;var o=a.majorVersion.split(".");r.version={major:parseInt(a.majorVersion,10),string:a.version},o.length>1&&(r.version.minor=parseInt(o[1],10)),o.length>2&&(r.version.build=parseInt(o[2],10))}if(a.platform&&(r[a.platform]=!0),(r.chrome||r.opr||r.safari)&&(r.webkit=!0),r.rv||r.iemobile){r.rv&&delete r.rv;a.browser="msie",r.msie=!0}if(r.edge){delete r.edge;a.browser="msedge",r.msedge=!0}if(r.opr){a.browser="opera",r.opera=!0}if(r.safari&&r.android){a.browser="android",r.android=!0}for(var s in r.name=a.browser,r.platform=a.platform,n)n.hasOwnProperty(s)&&delete n[s];Object.assign(n,r)}(),t.a=n},function(e,t,i){"use strict";t.a={OK:"OK",FORMAT_ERROR:"FormatError",FORMAT_UNSUPPORTED:"FormatUnsupported",CODEC_UNSUPPORTED:"CodecUnsupported"}},function(e,t,i){"use strict";var n;!function(e){e.ERROR="error",e.SOURCE_OPEN="source_open",e.UPDATE_END="update_end",e.BUFFER_FULL="buffer_full",e.START_STREAMING="start_streaming",e.END_STREAMING="end_streaming"}(n||(n={})),t.a=n},function(e,t,i){"use strict";var n=i(9),a=i.n(n),r=i(0),o=function(){function e(){}return Object.defineProperty(e,"forceGlobalTag",{get:function(){return r.a.FORCE_GLOBAL_TAG},set:function(t){r.a.FORCE_GLOBAL_TAG=t,e._notifyChange()},enumerable:!1,configurable:!0}),Object.defineProperty(e,"globalTag",{get:function(){return r.a.GLOBAL_TAG},set:function(t){r.a.GLOBAL_TAG=t,e._notifyChange()},enumerable:!1,configurable:!0}),Object.defineProperty(e,"enableAll",{get:function(){return r.a.ENABLE_VERBOSE&&r.a.ENABLE_DEBUG&&r.a.ENABLE_INFO&&r.a.ENABLE_WARN&&r.a.ENABLE_ERROR},set:function(t){r.a.ENABLE_VERBOSE=t,r.a.ENABLE_DEBUG=t,r.a.ENABLE_INFO=t,r.a.ENABLE_WARN=t,r.a.ENABLE_ERROR=t,e._notifyChange()},enumerable:!1,configurable:!0}),Object.defineProperty(e,"enableDebug",{get:function(){return r.a.ENABLE_DEBUG},set:function(t){r.a.ENABLE_DEBUG=t,e._notifyChange()},enumerable:!1,configurable:!0}),Object.defineProperty(e,"enableVerbose",{get:function(){return r.a.ENABLE_VERBOSE},set:function(t){r.a.ENABLE_VERBOSE=t,e._notifyChange()},enumerable:!1,configurable:!0}),Object.defineProperty(e,"enableInfo",{get:function(){return r.a.ENABLE_INFO},set:function(t){r.a.ENABLE_INFO=t,e._notifyChange()},enumerable:!1,configurable:!0}),Object.defineProperty(e,"enableWarn",{get:function(){return r.a.ENABLE_WARN},set:function(t){r.a.ENABLE_WARN=t,e._notifyChange()},enumerable:!1,configurable:!0}),Object.defineProperty(e,"enableError",{get:function(){return r.a.ENABLE_ERROR},set:function(t){r.a.ENABLE_ERROR=t,e._notifyChange()},enumerable:!1,configurable:!0}),e.getConfig=function(){return{globalTag:r.a.GLOBAL_TAG,forceGlobalTag:r.a.FORCE_GLOBAL_TAG,enableVerbose:r.a.ENABLE_VERBOSE,enableDebug:r.a.ENABLE_DEBUG,enableInfo:r.a.ENABLE_INFO,enableWarn:r.a.ENABLE_WARN,enableError:r.a.ENABLE_ERROR,enableCallback:r.a.ENABLE_CALLBACK}},e.applyConfig=function(e){r.a.GLOBAL_TAG=e.globalTag,r.a.FORCE_GLOBAL_TAG=e.forceGlobalTag,r.a.ENABLE_VERBOSE=e.enableVerbose,r.a.ENABLE_DEBUG=e.enableDebug,r.a.ENABLE_INFO=e.enableInfo,r.a.ENABLE_WARN=e.enableWarn,r.a.ENABLE_ERROR=e.enableError,r.a.ENABLE_CALLBACK=e.enableCallback},e._notifyChange=function(){var t=e.emitter;if(t.listenerCount("change")>0){var i=e.getConfig();t.emit("change",i)}},e.registerListener=function(t){e.emitter.addListener("change",t)},e.removeListener=function(t){e.emitter.removeListener("change",t)},e.addLogListener=function(t){r.a.emitter.addListener("log",t),r.a.emitter.listenerCount("log")>0&&(r.a.ENABLE_CALLBACK=!0,e._notifyChange())},e.removeLogListener=function(t){r.a.emitter.removeListener("log",t),0===r.a.emitter.listenerCount("log")&&(r.a.ENABLE_CALLBACK=!1,e._notifyChange())},e}();o.emitter=new a.a,t.a=o},function(e,t,i){"use strict";var n,a="object"==typeof Reflect?Reflect:null,r=a&&"function"==typeof a.apply?a.apply:function(e,t,i){return Function.prototype.apply.call(e,t,i)};n=a&&"function"==typeof a.ownKeys?a.ownKeys:Object.getOwnPropertySymbols?function(e){return Object.getOwnPropertyNames(e).concat(Object.getOwnPropertySymbols(e))}:function(e){return Object.getOwnPropertyNames(e)};var o=Number.isNaN||function(e){return e!=e};function s(){s.init.call(this)}e.exports=s,e.exports.once=function(e,t){return new Promise((function(i,n){function a(i){e.removeListener(t,r),n(i)}function r(){"function"==typeof e.removeListener&&e.removeListener("error",a),i([].slice.call(arguments))}g(e,t,r,{once:!0}),"error"!==t&&function(e,t,i){"function"==typeof e.on&&g(e,"error",t,i)}(e,a,{once:!0})}))},s.EventEmitter=s,s.prototype._events=void 0,s.prototype._eventsCount=0,s.prototype._maxListeners=void 0;var d=10;function _(e){if("function"!=typeof e)throw new TypeError('The "listener" argument must be of type Function. Received type '+typeof e)}function c(e){return void 0===e._maxListeners?s.defaultMaxListeners:e._maxListeners}function h(e,t,i,n){var a,r,o,s;if(_(i),void 0===(r=e._events)?(r=e._events=Object.create(null),e._eventsCount=0):(void 0!==r.newListener&&(e.emit("newListener",t,i.listener?i.listener:i),r=e._events),o=r[t]),void 0===o)o=r[t]=i,++e._eventsCount;else if("function"==typeof o?o=r[t]=n?[i,o]:[o,i]:n?o.unshift(i):o.push(i),(a=c(e))>0&&o.length>a&&!o.warned){o.warned=!0;var d=new Error("Possible EventEmitter memory leak detected. "+o.length+" "+String(t)+" listeners added. Use emitter.setMaxListeners() to increase limit");d.name="MaxListenersExceededWarning",d.emitter=e,d.type=t,d.count=o.length,s=d,console&&console.warn&&console.warn(s)}return e}function l(){if(!this.fired)return this.target.removeListener(this.type,this.wrapFn),this.fired=!0,0===arguments.length?this.listener.call(this.target):this.listener.apply(this.target,arguments)}function u(e,t,i){var n={fired:!1,wrapFn:void 0,target:e,type:t,listener:i},a=l.bind(n);return a.listener=i,n.wrapFn=a,a}function f(e,t,i){var n=e._events;if(void 0===n)return[];var a=n[t];return void 0===a?[]:"function"==typeof a?i?[a.listener||a]:[a]:i?function(e){for(var t=new Array(e.length),i=0;i<t.length;++i)t[i]=e[i].listener||e[i];return t}(a):m(a,a.length)}function p(e){var t=this._events;if(void 0!==t){var i=t[e];if("function"==typeof i)return 1;if(void 0!==i)return i.length}return 0}function m(e,t){for(var i=new Array(t),n=0;n<t;++n)i[n]=e[n];return i}function g(e,t,i,n){if("function"==typeof e.on)n.once?e.once(t,i):e.on(t,i);else{if("function"!=typeof e.addEventListener)throw new TypeError('The "emitter" argument must be of type EventEmitter. Received type '+typeof e);e.addEventListener(t,(function a(r){n.once&&e.removeEventListener(t,a),i(r)}))}}Object.defineProperty(s,"defaultMaxListeners",{enumerable:!0,get:function(){return d},set:function(e){if("number"!=typeof e||e<0||o(e))throw new RangeError('The value of "defaultMaxListeners" is out of range. It must be a non-negative number. Received '+e+".");d=e}}),s.init=function(){void 0!==this._events&&this._events!==Object.getPrototypeOf(this)._events||(this._events=Object.create(null),this._eventsCount=0),this._maxListeners=this._maxListeners||void 0},s.prototype.setMaxListeners=function(e){if("number"!=typeof e||e<0||o(e))throw new RangeError('The value of "n" is out of range. It must be a non-negative number. Received '+e+".");return this._maxListeners=e,this},s.prototype.getMaxListeners=function(){return c(this)},s.prototype.emit=function(e){for(var t=[],i=1;i<arguments.length;i++)t.push(arguments[i]);var n="error"===e,a=this._events;if(void 0!==a)n=n&&void 0===a.error;else if(!n)return!1;if(n){var o;if(t.length>0&&(o=t[0]),o instanceof Error)throw o;var s=new Error("Unhandled error."+(o?" ("+o.message+")":""));throw s.context=o,s}var d=a[e];if(void 0===d)return!1;if("function"==typeof d)r(d,this,t);else{var _=d.length,c=m(d,_);for(i=0;i<_;++i)r(c[i],this,t)}return!0},s.prototype.addListener=function(e,t){return h(this,e,t,!1)},s.prototype.on=s.prototype.addListener,s.prototype.prependListener=function(e,t){return h(this,e,t,!0)},s.prototype.once=function(e,t){return _(t),this.on(e,u(this,e,t)),this},s.prototype.prependOnceListener=function(e,t){return _(t),this.prependListener(e,u(this,e,t)),this},s.prototype.removeListener=function(e,t){var i,n,a,r,o;if(_(t),void 0===(n=this._events))return this;if(void 0===(i=n[e]))return this;if(i===t||i.listener===t)0==--this._eventsCount?this._events=Object.create(null):(delete n[e],n.removeListener&&this.emit("removeListener",e,i.listener||t));else if("function"!=typeof i){for(a=-1,r=i.length-1;r>=0;r--)if(i[r]===t||i[r].listener===t){o=i[r].listener,a=r;break}if(a<0)return this;0===a?i.shift():function(e,t){for(;t+1<e.length;t++)e[t]=e[t+1];e.pop()}(i,a),1===i.length&&(n[e]=i[0]),void 0!==n.removeListener&&this.emit("removeListener",e,o||t)}return this},s.prototype.off=s.prototype.removeListener,s.prototype.removeAllListeners=function(e){var t,i,n;if(void 0===(i=this._events))return this;if(void 0===i.removeListener)return 0===arguments.length?(this._events=Object.create(null),this._eventsCount=0):void 0!==i[e]&&(0==--this._eventsCount?this._events=Object.create(null):delete i[e]),this;if(0===arguments.length){var a,r=Object.keys(i);for(n=0;n<r.length;++n)"removeListener"!==(a=r[n])&&this.removeAllListeners(a);return this.removeAllListeners("removeListener"),this._events=Object.create(null),this._eventsCount=0,this}if("function"==typeof(t=i[e]))this.removeListener(e,t);else if(void 0!==t)for(n=t.length-1;n>=0;n--)this.removeListener(e,t[n]);return this},s.prototype.listeners=function(e){return f(this,e,!0)},s.prototype.rawListeners=function(e){return f(this,e,!1)},s.listenerCount=function(e,t){return"function"==typeof e.listenerCount?e.listenerCount(t):p.call(e,t)},s.prototype.listenerCount=p,s.prototype.eventNames=function(){return this._eventsCount>0?n(this._events):[]}},function(e,t,i){"use strict";i.d(t,"b",(function(){return r})),i.d(t,"a",(function(){return o}));var n=i(2),a=i(6),r={NETWORK_ERROR:"NetworkError",MEDIA_ERROR:"MediaError",OTHER_ERROR:"OtherError"},o={NETWORK_EXCEPTION:n.b.EXCEPTION,NETWORK_STATUS_CODE_INVALID:n.b.HTTP_STATUS_CODE_INVALID,NETWORK_TIMEOUT:n.b.CONNECTING_TIMEOUT,NETWORK_UNRECOVERABLE_EARLY_EOF:n.b.UNRECOVERABLE_EARLY_EOF,MEDIA_MSE_ERROR:"MediaMSEError",MEDIA_FORMAT_ERROR:a.a.FORMAT_ERROR,MEDIA_FORMAT_UNSUPPORTED:a.a.FORMAT_UNSUPPORTED,MEDIA_CODEC_UNSUPPORTED:a.a.CODEC_UNSUPPORTED}},function(e,t,i){"use strict";i.d(t,"d",(function(){return n})),i.d(t,"b",(function(){return a})),i.d(t,"a",(function(){return r})),i.d(t,"c",(function(){return o}));var n=function(e,t,i,n,a){this.dts=e,this.pts=t,this.duration=i,this.originalDts=n,this.isSyncPoint=a,this.fileposition=null},a=function(){function e(){this.beginDts=0,this.endDts=0,this.beginPts=0,this.endPts=0,this.originalBeginDts=0,this.originalEndDts=0,this.syncPoints=[],this.firstSample=null,this.lastSample=null}return e.prototype.appendSyncPoint=function(e){e.isSyncPoint=!0,this.syncPoints.push(e)},e}(),r=function(){function e(){this._list=[]}return e.prototype.clear=function(){this._list=[]},e.prototype.appendArray=function(e){var t=this._list;0!==e.length&&(t.length>0&&e[0].originalDts<t[t.length-1].originalDts&&this.clear(),Array.prototype.push.apply(t,e))},e.prototype.getLastSyncPointBeforeDts=function(e){if(0==this._list.length)return null;var t=this._list,i=0,n=t.length-1,a=0,r=0,o=n;for(e<t[0].dts&&(i=0,r=o+1);r<=o;){if((a=r+Math.floor((o-r)/2))===n||e>=t[a].dts&&e<t[a+1].dts){i=a;break}t[a].dts<e?r=a+1:o=a-1}return this._list[i]},e}(),o=function(){function e(e){this._type=e,this._list=[],this._lastAppendLocation=-1}return Object.defineProperty(e.prototype,"type",{get:function(){return this._type},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"length",{get:function(){return this._list.length},enumerable:!1,configurable:!0}),e.prototype.isEmpty=function(){return 0===this._list.length},e.prototype.clear=function(){this._list=[],this._lastAppendLocation=-1},e.prototype._searchNearestSegmentBefore=function(e){var t=this._list;if(0===t.length)return-2;var i=t.length-1,n=0,a=0,r=i,o=0;if(e<t[0].originalBeginDts)return o=-1;for(;a<=r;){if((n=a+Math.floor((r-a)/2))===i||e>t[n].lastSample.originalDts&&e<t[n+1].originalBeginDts){o=n;break}t[n].originalBeginDts<e?a=n+1:r=n-1}return o},e.prototype._searchNearestSegmentAfter=function(e){return this._searchNearestSegmentBefore(e)+1},e.prototype.append=function(e){var t=this._list,i=e,n=this._lastAppendLocation,a=0;-1!==n&&n<t.length&&i.originalBeginDts>=t[n].lastSample.originalDts&&(n===t.length-1||n<t.length-1&&i.originalBeginDts<t[n+1].originalBeginDts)?a=n+1:t.length>0&&(a=this._searchNearestSegmentBefore(i.originalBeginDts)+1),this._lastAppendLocation=a,this._list.splice(a,0,i)},e.prototype.getLastSegmentBefore=function(e){var t=this._searchNearestSegmentBefore(e);return t>=0?this._list[t]:null},e.prototype.getLastSampleBefore=function(e){var t=this.getLastSegmentBefore(e);return null!=t?t.lastSample:null},e.prototype.getLastSyncPointBefore=function(e){for(var t=this._searchNearestSegmentBefore(e),i=this._list[t].syncPoints;0===i.length&&t>0;)t--,i=this._list[t].syncPoints;return i.length>0?i[i.length-1]:null},e}()},function(e,t,i){"use strict";var n=function(){function e(){this.mimeType=null,this.duration=null,this.hasAudio=null,this.hasVideo=null,this.audioCodec=null,this.videoCodec=null,this.audioDataRate=null,this.videoDataRate=null,this.audioSampleRate=null,this.audioChannelCount=null,this.width=null,this.height=null,this.fps=null,this.profile=null,this.level=null,this.refFrames=null,this.chromaFormat=null,this.sarNum=null,this.sarDen=null,this.metadata=null,this.segments=null,this.segmentCount=null,this.hasKeyframesIndex=null,this.keyframesIndex=null}return e.prototype.isComplete=function(){var e=!1===this.hasAudio||!0===this.hasAudio&&null!=this.audioCodec&&null!=this.audioSampleRate&&null!=this.audioChannelCount,t=!1===this.hasVideo||!0===this.hasVideo&&null!=this.videoCodec&&null!=this.width&&null!=this.height&&null!=this.fps&&null!=this.profile&&null!=this.level&&null!=this.refFrames&&null!=this.chromaFormat&&null!=this.sarNum&&null!=this.sarDen;return null!=this.mimeType&&e&&t},e.prototype.isSeekable=function(){return!0===this.hasKeyframesIndex},e.prototype.getNearestKeyframe=function(e){if(null==this.keyframesIndex)return null;var t=this.keyframesIndex,i=this._search(t.times,e);return{index:i,milliseconds:t.times[i],fileposition:t.filepositions[i]}},e.prototype._search=function(e,t){var i=0,n=e.length-1,a=0,r=0,o=n;for(t<e[0]&&(i=0,r=o+1);r<=o;){if((a=r+Math.floor((o-r)/2))===n||t>=e[a]&&t<e[a+1]){i=a;break}e[a]<t?r=a+1:o=a-1}return i},e}();t.a=n},function(e,t,i){"use strict";var n=i(9),a=i.n(n),r=i(0),o=i(5),s=i(12);function d(e,t,i){var n=e;if(t+i<n.length){for(;i--;)if(128!=(192&n[++t]))return!1;return!0}return!1}var _,c=function(e){for(var t=[],i=e,n=0,a=e.length;n<a;)if(i[n]<128)t.push(String.fromCharCode(i[n])),++n;else{if(i[n]<192);else if(i[n]<224){if(d(i,n,1))if((r=(31&i[n])<<6|63&i[n+1])>=128){t.push(String.fromCharCode(65535&r)),n+=2;continue}}else if(i[n]<240){if(d(i,n,2))if((r=(15&i[n])<<12|(63&i[n+1])<<6|63&i[n+2])>=2048&&55296!=(63488&r)){t.push(String.fromCharCode(65535&r)),n+=3;continue}}else if(i[n]<248){var r;if(d(i,n,3))if((r=(7&i[n])<<18|(63&i[n+1])<<12|(63&i[n+2])<<6|63&i[n+3])>65536&&r<1114112){r-=65536,t.push(String.fromCharCode(r>>>10|55296)),t.push(String.fromCharCode(1023&r|56320)),n+=4;continue}}t.push(String.fromCharCode(65533)),++n}return t.join("")},h=i(3),l=(_=new ArrayBuffer(2),new DataView(_).setInt16(0,256,!0),256===new Int16Array(_)[0]),u=function(){function e(){}return e.parseScriptData=function(t,i,n){var a={};try{var o=e.parseValue(t,i,n),s=e.parseValue(t,i+o.size,n-o.size);a[o.data]=s.data}catch(e){r.a.e("AMF",e.toString())}return a},e.parseObject=function(t,i,n){if(n<3)throw new h.a("Data not enough when parse ScriptDataObject");var a=e.parseString(t,i,n),r=e.parseValue(t,i+a.size,n-a.size),o=r.objectEnd;return{data:{name:a.data,value:r.data},size:a.size+r.size,objectEnd:o}},e.parseVariable=function(t,i,n){return e.parseObject(t,i,n)},e.parseString=function(e,t,i){if(i<2)throw new h.a("Data not enough when parse String");var n=new DataView(e,t,i).getUint16(0,!l);return{data:n>0?c(new Uint8Array(e,t+2,n)):"",size:2+n}},e.parseLongString=function(e,t,i){if(i<4)throw new h.a("Data not enough when parse LongString");var n=new DataView(e,t,i).getUint32(0,!l);return{data:n>0?c(new Uint8Array(e,t+4,n)):"",size:4+n}},e.parseDate=function(e,t,i){if(i<10)throw new h.a("Data size invalid when parse Date");var n=new DataView(e,t,i),a=n.getFloat64(0,!l),r=n.getInt16(8,!l);return{data:new Date(a+=60*r*1e3),size:10}},e.parseValue=function(t,i,n){if(n<1)throw new h.a("Data not enough when parse Value");var a,o=new DataView(t,i,n),s=1,d=o.getUint8(0),_=!1;try{switch(d){case 0:a=o.getFloat64(1,!l),s+=8;break;case 1:a=!!o.getUint8(1),s+=1;break;case 2:var c=e.parseString(t,i+1,n-1);a=c.data,s+=c.size;break;case 3:a={};var u=0;for(9==(16777215&o.getUint32(n-4,!l))&&(u=3);s<n-4;){var f=e.parseObject(t,i+s,n-s-u);if(f.objectEnd)break;a[f.data.name]=f.data.value,s+=f.size}if(s<=n-3)9===(16777215&o.getUint32(s-1,!l))&&(s+=3);break;case 8:a={},s+=4;u=0;for(9==(16777215&o.getUint32(n-4,!l))&&(u=3);s<n-8;){var p=e.parseVariable(t,i+s,n-s-u);if(p.objectEnd)break;a[p.data.name]=p.data.value,s+=p.size}if(s<=n-3)9===(16777215&o.getUint32(s-1,!l))&&(s+=3);break;case 9:a=void 0,s=1,_=!0;break;case 10:a=[];var m=o.getUint32(1,!l);s+=4;for(var g=0;g<m;g++){var v=e.parseValue(t,i+s,n-s);a.push(v.data),s+=v.size}break;case 11:var y=e.parseDate(t,i+1,n-1);a=y.data,s+=y.size;break;case 12:var S=e.parseString(t,i+1,n-1);a=S.data,s+=S.size;break;default:s=n,r.a.w("AMF","Unsupported AMF value type "+d)}}catch(e){r.a.e("AMF",e.toString())}return{data:a,size:s,objectEnd:_}},e}(),f=function(){function e(e){this.TAG="ExpGolomb",this._buffer=e,this._buffer_index=0,this._total_bytes=e.byteLength,this._total_bits=8*e.byteLength,this._current_word=0,this._current_word_bits_left=0}return e.prototype.destroy=function(){this._buffer=null},e.prototype._fillCurrentWord=function(){var e=this._total_bytes-this._buffer_index;if(e<=0)throw new h.a("ExpGolomb: _fillCurrentWord() but no bytes available");var t=Math.min(4,e),i=new Uint8Array(4);i.set(this._buffer.subarray(this._buffer_index,this._buffer_index+t)),this._current_word=new DataView(i.buffer).getUint32(0,!1),this._buffer_index+=t,this._current_word_bits_left=8*t},e.prototype.readBits=function(e){if(e>32)throw new h.b("ExpGolomb: readBits() bits exceeded max 32bits!");if(e<=this._current_word_bits_left){var t=this._current_word>>>32-e;return this._current_word<<=e,this._current_word_bits_left-=e,t}var i=this._current_word_bits_left?this._current_word:0;i>>>=32-this._current_word_bits_left;var n=e-this._current_word_bits_left;this._fillCurrentWord();var a=Math.min(n,this._current_word_bits_left),r=this._current_word>>>32-a;return this._current_word<<=a,this._current_word_bits_left-=a,i=i<<a|r},e.prototype.readBool=function(){return 1===this.readBits(1)},e.prototype.readByte=function(){return this.readBits(8)},e.prototype._skipLeadingZero=function(){var e;for(e=0;e<this._current_word_bits_left;e++)if(0!=(this._current_word&2147483648>>>e))return this._current_word<<=e,this._current_word_bits_left-=e,e;return this._fillCurrentWord(),e+this._skipLeadingZero()},e.prototype.readUEG=function(){var e=this._skipLeadingZero();return this.readBits(e+1)-1},e.prototype.readSEG=function(){var e=this.readUEG();return 1&e?e+1>>>1:-1*(e>>>1)},e}(),p=function(){function e(){}return e._ebsp2rbsp=function(e){for(var t=e,i=t.byteLength,n=new Uint8Array(i),a=0,r=0;r<i;r++)r>=2&&3===t[r]&&0===t[r-1]&&0===t[r-2]||(n[a]=t[r],a++);return new Uint8Array(n.buffer,0,a)},e.parseSPS=function(t){for(var i=t.subarray(1,4),n="avc1.",a=0;a<3;a++){var r=i[a].toString(16);r.length<2&&(r="0"+r),n+=r}var o=e._ebsp2rbsp(t),s=new f(o);s.readByte();var d=s.readByte();s.readByte();var _=s.readByte();s.readUEG();var c=e.getProfileString(d),h=e.getLevelString(_),l=1,u=420,p=8,m=8;if((100===d||110===d||122===d||244===d||44===d||83===d||86===d||118===d||128===d||138===d||144===d)&&(3===(l=s.readUEG())&&s.readBits(1),l<=3&&(u=[0,420,422,444][l]),p=s.readUEG()+8,m=s.readUEG()+8,s.readBits(1),s.readBool()))for(var g=3!==l?8:12,v=0;v<g;v++)s.readBool()&&(v<6?e._skipScalingList(s,16):e._skipScalingList(s,64));s.readUEG();var y=s.readUEG();if(0===y)s.readUEG();else if(1===y){s.readBits(1),s.readSEG(),s.readSEG();var S=s.readUEG();for(v=0;v<S;v++)s.readSEG()}var b=s.readUEG();s.readBits(1);var A=s.readUEG(),E=s.readUEG(),R=s.readBits(1);0===R&&s.readBits(1),s.readBits(1);var T=0,L=0,k=0,w=0;s.readBool()&&(T=s.readUEG(),L=s.readUEG(),k=s.readUEG(),w=s.readUEG());var M=1,C=1,D=0,O=!0,B=0,I=0;if(s.readBool()){if(s.readBool()){var P=s.readByte();P>0&&P<16?(M=[1,12,10,16,40,24,20,32,80,18,15,64,160,4,3,2][P-1],C=[1,11,11,11,33,11,11,11,33,11,11,33,99,3,2,1][P-1]):255===P&&(M=s.readByte()<<8|s.readByte(),C=s.readByte()<<8|s.readByte())}if(s.readBool()&&s.readBool(),s.readBool()&&(s.readBits(4),s.readBool()&&s.readBits(24)),s.readBool()&&(s.readUEG(),s.readUEG()),s.readBool()){var x=s.readBits(32),U=s.readBits(32);O=s.readBool(),D=(B=U)/(I=2*x)}}var N=1;1===M&&1===C||(N=M/C);var V=0,G=0;0===l?(V=1,G=2-R):(V=3===l?1:2,G=(1===l?2:1)*(2-R));var F=16*(A+1),j=16*(E+1)*(2-R);F-=(T+L)*V,j-=(k+w)*G;var z=Math.ceil(F*N);return s.destroy(),s=null,{codec_mimetype:n,profile_idc:d,level_idc:_,profile_string:c,level_string:h,chroma_format_idc:l,bit_depth:p,bit_depth_luma:p,bit_depth_chroma:m,ref_frames:b,chroma_format:u,chroma_format_string:e.getChromaFormatString(u),frame_rate:{fixed:O,fps:D,fps_den:I,fps_num:B},sar_ratio:{width:M,height:C},codec_size:{width:F,height:j},present_size:{width:z,height:j}}},e._skipScalingList=function(e,t){for(var i=8,n=8,a=0;a<t;a++)0!==n&&(n=(i+e.readSEG()+256)%256),i=0===n?i:n},e.getProfileString=function(e){switch(e){case 66:return"Baseline";case 77:return"Main";case 88:return"Extended";case 100:return"High";case 110:return"High10";case 122:return"High422";case 244:return"High444";default:return"Unknown"}},e.getLevelString=function(e){return(e/10).toFixed(1)},e.getChromaFormatString=function(e){switch(e){case 420:return"4:2:0";case 422:return"4:2:2";case 444:return"4:4:4";default:return"Unknown"}},e}(),m=i(6),g=function(){function e(){}return e._ebsp2rbsp=function(e){for(var t=e,i=t.byteLength,n=new Uint8Array(i),a=0,r=0;r<i;r++)r>=2&&3===t[r]&&0===t[r-1]&&0===t[r-2]||(n[a]=t[r],a++);return new Uint8Array(n.buffer,0,a)},e.parseVPS=function(t){var i=e._ebsp2rbsp(t),n=new f(i);n.readByte(),n.readByte();n.readBits(4);n.readBits(2);n.readBits(6);return{num_temporal_layers:n.readBits(3)+1,temporal_id_nested:n.readBool()}},e.parseSPS=function(t){var i=e._ebsp2rbsp(t),n=new f(i);n.readByte(),n.readByte();for(var a=0,r=0,o=0,s=0,d=(n.readBits(4),n.readBits(3)),_=(n.readBool(),n.readBits(2)),c=n.readBool(),h=n.readBits(5),l=n.readByte(),u=n.readByte(),p=n.readByte(),m=n.readByte(),g=n.readByte(),v=n.readByte(),y=n.readByte(),S=n.readByte(),b=n.readByte(),A=n.readByte(),E=n.readByte(),R=[],T=[],L=0;L<d;L++)R.push(n.readBool()),T.push(n.readBool());if(d>0)for(L=d;L<8;L++)n.readBits(2);for(L=0;L<d;L++)R[L]&&(n.readByte(),n.readByte(),n.readByte(),n.readByte(),n.readByte(),n.readByte(),n.readByte(),n.readByte(),n.readByte(),n.readByte(),n.readByte()),T[L]&&n.readByte();n.readUEG();var k=n.readUEG();3==k&&n.readBits(1);var w=n.readUEG(),M=n.readUEG();n.readBool()&&(a+=n.readUEG(),r+=n.readUEG(),o+=n.readUEG(),s+=n.readUEG());var C=n.readUEG(),D=n.readUEG(),O=n.readUEG();for(L=n.readBool()?0:d;L<=d;L++)n.readUEG(),n.readUEG(),n.readUEG();n.readUEG(),n.readUEG(),n.readUEG(),n.readUEG(),n.readUEG(),n.readUEG();if(n.readBool()&&n.readBool())for(var B=0;B<4;B++)for(var I=0;I<(3===B?2:6);I++){if(n.readBool()){var P=Math.min(64,1<<4+(B<<1));B>1&&n.readSEG();for(L=0;L<P;L++)n.readSEG()}else n.readUEG()}n.readBool(),n.readBool();n.readBool()&&(n.readByte(),n.readUEG(),n.readUEG(),n.readBool());var x=n.readUEG(),U=0;for(L=0;L<x;L++){var N=!1;if(0!==L&&(N=n.readBool()),N){L===x&&n.readUEG(),n.readBool(),n.readUEG();for(var V=0,G=0;G<=U;G++){var F=n.readBool(),j=!1;F||(j=n.readBool()),(F||j)&&V++}U=V}else{var z=n.readUEG(),H=n.readUEG();U=z+H;for(G=0;G<z;G++)n.readUEG(),n.readBool();for(G=0;G<H;G++)n.readUEG(),n.readBool()}}if(n.readBool()){var q=n.readUEG();for(L=0;L<q;L++){for(G=0;G<O+4;G++)n.readBits(1);n.readBits(1)}}var K=0,W=1,Y=1,X=!1,Q=1,J=1;n.readBool(),n.readBool();if(n.readBool()){if(n.readBool()){var Z=n.readByte();Z>0&&Z<=16?(W=[1,12,10,16,40,24,20,32,80,18,15,64,160,4,3,2][Z-1],Y=[1,11,11,11,33,11,11,11,33,11,11,33,99,3,2,1][Z-1]):255===Z&&(W=n.readBits(16),Y=n.readBits(16))}if(n.readBool()&&n.readBool(),n.readBool())n.readBits(3),n.readBool(),n.readBool()&&(n.readByte(),n.readByte(),n.readByte());n.readBool()&&(n.readUEG(),n.readUEG());n.readBool(),n.readBool(),n.readBool();if(n.readBool()&&(n.readUEG(),n.readUEG(),n.readUEG(),n.readUEG()),n.readBool())if(Q=n.readBits(32),J=n.readBits(32),n.readBool()&&n.readUEG(),n.readBool()){var $=!1,ee=!1,te=!1;if($=n.readBool(),ee=n.readBool(),$||ee){(te=n.readBool())&&(n.readByte(),n.readBits(5),n.readBool(),n.readBits(5));n.readBits(4),n.readBits(4);te&&n.readBits(4),n.readBits(5),n.readBits(5),n.readBits(5)}for(L=0;L<=d;L++){var ie=n.readBool();X=ie;var ne=!0,ae=1;ie||(ne=n.readBool());var re=!1;if(ne?n.readUEG():re=n.readBool(),re||(ae=n.readUEG()+1),$){for(G=0;G<ae;G++)n.readUEG(),n.readUEG(),te&&(n.readUEG(),n.readUEG());n.readBool()}if(ee){for(G=0;G<ae;G++)n.readUEG(),n.readUEG(),te&&(n.readUEG(),n.readUEG());n.readBool()}}}if(n.readBool()){n.readBool(),n.readBool(),n.readBool();K=n.readUEG();n.readUEG(),n.readUEG(),n.readUEG(),n.readUEG()}}n.readBool();var oe="hvc1.".concat(h,".1.L").concat(E,".B0"),se=w-(a+r)*(1===k||2===k?2:1),de=M-(o+s)*(1===k?2:1),_e=1;return 1!==W&&1!==Y&&(_e=W/Y),n.destroy(),n=null,{codec_mimetype:oe,profile_string:e.getProfileString(h),level_string:e.getLevelString(E),profile_idc:h,bit_depth:C+8,ref_frames:1,chroma_format:k,chroma_format_string:e.getChromaFormatString(k),general_level_idc:E,general_profile_space:_,general_tier_flag:c,general_profile_idc:h,general_profile_compatibility_flags_1:l,general_profile_compatibility_flags_2:u,general_profile_compatibility_flags_3:p,general_profile_compatibility_flags_4:m,general_constraint_indicator_flags_1:g,general_constraint_indicator_flags_2:v,general_constraint_indicator_flags_3:y,general_constraint_indicator_flags_4:S,general_constraint_indicator_flags_5:b,general_constraint_indicator_flags_6:A,min_spatial_segmentation_idc:K,constant_frame_rate:0,chroma_format_idc:k,bit_depth_luma_minus8:C,bit_depth_chroma_minus8:D,frame_rate:{fixed:X,fps:J/Q,fps_den:Q,fps_num:J},sar_ratio:{width:W,height:Y},codec_size:{width:se,height:de},present_size:{width:se*_e,height:de}}},e.parsePPS=function(t){var i=e._ebsp2rbsp(t),n=new f(i);n.readByte(),n.readByte();n.readUEG(),n.readUEG(),n.readBool(),n.readBool(),n.readBits(3),n.readBool(),n.readBool(),n.readUEG(),n.readUEG(),n.readSEG(),n.readBool(),n.readBool();if(n.readBool())n.readUEG();n.readSEG(),n.readSEG(),n.readBool(),n.readBool(),n.readBool(),n.readBool();var a=n.readBool(),r=n.readBool(),o=1;return r&&a?o=0:r?o=3:a&&(o=2),{parallelismType:o}},e.getChromaFormatString=function(e){switch(e){case 0:return"4:0:0";case 1:return"4:2:0";case 2:return"4:2:2";case 3:return"4:4:4";default:return"Unknown"}},e.getProfileString=function(e){switch(e){case 1:return"Main";case 2:return"Main10";case 3:return"MainSP";case 4:return"Rext";case 9:return"SCC";default:return"Unknown"}},e.getLevelString=function(e){return(e/30).toFixed(1)},e}();function v(e){return e.byteOffset%2==0&&e.byteLength%2==0}function y(e){return e.byteOffset%4==0&&e.byteLength%4==0}function S(e,t){for(var i=0;i<e.length;i++)if(e[i]!==t[i])return!1;return!0}var b=function(e,t){return e.byteLength===t.byteLength&&(y(e)&&y(t)?function(e,t){return S(new Uint32Array(e.buffer,e.byteOffset,e.byteLength/4),new Uint32Array(t.buffer,t.byteOffset,t.byteLength/4))}(e,t):v(e)&&v(t)?function(e,t){return S(new Uint16Array(e.buffer,e.byteOffset,e.byteLength/2),new Uint16Array(t.buffer,t.byteOffset,t.byteLength/2))}(e,t):function(e,t){return S(e,t)}(e,t))},A=function(){return(A=Object.assign||function(e){for(var t,i=1,n=arguments.length;i<n;i++)for(var a in t=arguments[i])Object.prototype.hasOwnProperty.call(t,a)&&(e[a]=t[a]);return e}).apply(this,arguments)},E=function(){function e(){}return e.parseOBUs=function(t,i){for(var n=0;n<t.byteLength;){var a=n,r=(t[n],(120&t[n])>>3),o=0!=(4&t[n]),s=0!=(2&t[n]);t[n];n+=1;o&&(n+=1);var d=Number.POSITIVE_INFINITY;if(s){d=0;for(var _=0;;_++){var c=t[n++];if(d|=(127&c)<<7*_,0==(128&c))break}}console.log(r),1===r?i=A(A({},e.parseSeuqneceHeader(t.subarray(n,n+d))),{sequence_header_data:t.subarray(a,n+d)}):(3==r&&i||6==r&&i)&&(i=e.parseOBUFrameHeader(t.subarray(n,n+d),0,0,i)),n+=d}return i},e.parseSeuqneceHeader=function(t){var i=new f(t),n=i.readBits(3),a=(i.readBool(),i.readBool()),r=!0,o=0,s=1,d=void 0,_=[];if(a)_.push({operating_point_idc:0,level:i.readBits(5),tier:0});else{if(i.readBool()){var c=i.readBits(32),h=i.readBits(32),l=i.readBool();if(l){for(var u=0;;){if(0!==i.readBits(1))break;u+=1}u>=32?4294967295:(1<<u)-1+i.readBits(u)}if((o=h)/(s=c),r=l,i.readBool()){i.readBits(5);i.readBits(32);d=i.readBits(5);i.readBits(5)}}for(var p=i.readBool(),m=i.readBits(5),g=0;g<=m;g++){var v=i.readBits(12),y=i.readBits(5),S=y>7?i.readBits(1):0;if(_.push({operating_point_idc:v,level:y,tier:S}),p)if(i.readBool())i.readBits(4)}}var b=_[0],A=b.level,E=b.tier,R=i.readBits(4),T=i.readBits(4),L=i.readBits(R+1)+1,k=i.readBits(T+1)+1,w=!1;a||(w=i.readBool());if(w)i.readBits(4),i.readBits(4);i.readBool(),i.readBool(),i.readBool();var M=!1,C=2,D=2,O=0;if(!a){if(i.readBool(),i.readBool(),i.readBool(),i.readBool(),M=i.readBool())i.readBool(),i.readBool();if(C=i.readBool()?2:i.readBits(1))D=i.readBool()?2:i.readBits(1);else D=2;if(M)O=i.readBits(3)+1;else O=0}var B=i.readBool(),I=(i.readBool(),i.readBool(),i.readBool()),P=8;2===n&&I?P=i.readBool()?12:10:P=I?10:8;var x=!1;1!==n&&(x=i.readBool());if(i.readBool())i.readBits(8),i.readBits(8),i.readBits(8);var U=1,N=1;if(x){i.readBits(1),U=1,N=1}else{if(i.readBits(1),0==n)U=1,N=1;else if(1==n)U=0,N=0;else{if(12==P)if(i.readBits(1))i.readBits(1);else;else U=1,N=0}if(U&&N)i.readBits(2);i.readBits(1)}i.readBool();i.destroy(),i=null;return{codec_mimetype:"av01.".concat(n,".").concat(e.getLevelString(A,E),".").concat(P.toString(10).padStart(2,"0")),level:A,tier:E,level_string:e.getLevelString(A,E),profile_idc:n,profile_string:"".concat(n),bit_depth:P,ref_frames:1,chroma_format:e.getChromaFormat(x,U,N),chroma_format_string:e.getChromaFormatString(x,U,N),sequence_header:{frame_id_numbers_present_flag:w,additional_frame_id_length_minus_1:void 0,delta_frame_id_length_minus_2:void 0,reduced_still_picture_header:a,decoder_model_info_present_flag:!1,operating_points:_,buffer_removal_time_length_minus_1:d,equal_picture_interval:r,seq_force_screen_content_tools:C,seq_force_integer_mv:D,enable_order_hint:M,order_hint_bits:O,enable_superres:B,frame_width_bit:R+1,frame_height_bit:T+1,max_frame_width:L,max_frame_height:k},keyframe:void 0,frame_rate:{fixed:r,fps:o/s,fps_den:s,fps_num:o}}},e.parseOBUFrameHeader=function(t,i,n,a){var r=a.sequence_header,o=new f(t),s=(r.max_frame_width,r.max_frame_height,0);r.frame_id_numbers_present_flag&&(s=r.additional_frame_id_length_minus_1+r.delta_frame_id_length_minus_2+3);var d=0,_=!0,c=!0,h=!1;if(!r.reduced_still_picture_header){if(o.readBool())return a;_=2===(d=o.readBits(2))||0===d,(c=o.readBool())&&r.decoder_model_info_present_flag&&r.equal_picture_interval,c?o.readBool():0!==d,h=!!(3===d||0===d&&c)||o.readBool()}a.keyframe=_;o.readBool();var l=r.seq_force_screen_content_tools;2===r.seq_force_screen_content_tools&&(l=o.readBits(1));l&&(r.seq_force_integer_mv,2==r.seq_force_integer_mv&&o.readBits(1));r.frame_id_numbers_present_flag&&o.readBits(s);var u=!1;u=3==d||!r.reduced_still_picture_header&&o.readBool();o.readBits(r.order_hint_bits);if((_||h||o.readBits(3),r.decoder_model_info_present_flag)&&o.readBool())for(var p=0;p<=r.operating_points_cnt_minus_1;p++)if(r.operating_points[p].decoder_model_present_for_this_op[p]){var m=r.operating_points[p].operating_point_idc;(0===m||m>>i&1&&m>>n+8&1)&&o.readBits(r.buffer_removal_time_length_minus_1+1)}var g=255;if(3===d||0==d&&c||(g=o.readBits(8)),(_||255!==g)&&h&&r.enable_order_hint)for(var v=0;v<8;v++)o.readBits(r.order_hint_bits);if(_){var y=e.frameSizeAndRenderSize(o,u,r);a.codec_size={width:y.FrameWidth,height:y.FrameHeight},a.present_size={width:y.RenderWidth,height:y.RenderHeight},a.sar_ratio={width:y.RenderWidth/y.FrameWidth,height:y.RenderHeight/y.FrameHeight}}return o.destroy(),o=null,a},e.frameSizeAndRenderSize=function(e,t,i){var n=i.max_frame_width,a=i.max_frame_height;t&&(n=e.readBits(i.frame_width_bit)+1,a=e.readBits(i.frame_height_bit)+1);var r=!1;i.enable_superres&&(r=e.readBool());var o=8;r&&(o=e.readBits(3)+9);var s=n;n=Math.floor((8*s+o/2)/o);var d=s,_=a;if(e.readBool()){var c=e.readBits(16)+1,h=e.readBits(16)+1;d=e.readBits(c)+1,_=e.readBits(h)+1}return{UpscaledWidth:s,FrameWidth:n,FrameHeight:a,RenderWidth:d,RenderHeight:_}},e.getLevelString=function(e,t){return"".concat(e.toString(10).padStart(2,"0")).concat(0===t?"M":"H")},e.getChromaFormat=function(e,t,i){return e?0:0===t&&0===i?3:1===t&&0===i?2:1===t&&1===i?1:Number.NaN},e.getChromaFormatString=function(e,t,i){return e?"4:0:0":0===t&&0===i?"4:4:4":1===t&&0===i?"4:2:2":1===t&&1===i?"4:2:0":"Unknown"},e}();var R,T=function(){function e(e,t){this.TAG="FLVDemuxer",this._config=t,this._onError=null,this._onMediaInfo=null,this._onMetaDataArrived=null,this._onScriptDataArrived=null,this._onTrackMetadata=null,this._onDataAvailable=null,this._dataOffset=e.dataOffset,this._firstParse=!0,this._dispatch=!1,this._hasAudio=e.hasAudioTrack,this._hasVideo=e.hasVideoTrack,this._hasAudioFlagOverrided=!1,this._hasVideoFlagOverrided=!1,this._audioInitialMetadataDispatched=!1,this._videoInitialMetadataDispatched=!1,this._mediaInfo=new s.a,this._mediaInfo.hasAudio=this._hasAudio,this._mediaInfo.hasVideo=this._hasVideo,this._metadata=null,this._audioMetadata=null,this._videoMetadata=null,this._naluLengthSize=4,this._timestampBase=0,this._timescale=1e3,this._duration=0,this._durationOverrided=!1,this._referenceFrameRate={fixed:!0,fps:23.976,fps_num:23976,fps_den:1e3},this._flvSoundRateTable=[5500,11025,22050,44100,48e3],this._mpegSamplingRates=[96e3,88200,64e3,48e3,44100,32e3,24e3,22050,16e3,12e3,11025,8e3,7350],this._mpegAudioV10SampleRateTable=[44100,48e3,32e3,0],this._mpegAudioV20SampleRateTable=[22050,24e3,16e3,0],this._mpegAudioV25SampleRateTable=[11025,12e3,8e3,0],this._mpegAudioL1BitRateTable=[0,32,64,96,128,160,192,224,256,288,320,352,384,416,448,-1],this._mpegAudioL2BitRateTable=[0,32,48,56,64,80,96,112,128,160,192,224,256,320,384,-1],this._mpegAudioL3BitRateTable=[0,32,40,48,56,64,80,96,112,128,160,192,224,256,320,-1],this._videoTrack={type:"video",id:1,sequenceNumber:0,samples:[],length:0},this._audioTrack={type:"audio",id:2,sequenceNumber:0,samples:[],length:0},this._littleEndian=function(){var e=new ArrayBuffer(2);return new DataView(e).setInt16(0,256,!0),256===new Int16Array(e)[0]}()}return e.prototype.destroy=function(){this._mediaInfo=null,this._metadata=null,this._audioMetadata=null,this._videoMetadata=null,this._videoTrack=null,this._audioTrack=null,this._onError=null,this._onMediaInfo=null,this._onMetaDataArrived=null,this._onScriptDataArrived=null,this._onTrackMetadata=null,this._onDataAvailable=null},e.probe=function(e){var t=new Uint8Array(e);if(t.byteLength<9)return{needMoreData:!0};var i={match:!1};if(70!==t[0]||76!==t[1]||86!==t[2]||1!==t[3])return i;var n,a,r=(4&t[4])>>>2!=0,o=0!=(1&t[4]),s=(n=t)[a=5]<<24|n[a+1]<<16|n[a+2]<<8|n[a+3];return s<9?i:{match:!0,consumed:s,dataOffset:s,hasAudioTrack:r,hasVideoTrack:o}},e.prototype.bindDataSource=function(e){return e.onDataArrival=this.parseChunks.bind(this),this},Object.defineProperty(e.prototype,"onTrackMetadata",{get:function(){return this._onTrackMetadata},set:function(e){this._onTrackMetadata=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onMediaInfo",{get:function(){return this._onMediaInfo},set:function(e){this._onMediaInfo=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onMetaDataArrived",{get:function(){return this._onMetaDataArrived},set:function(e){this._onMetaDataArrived=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onScriptDataArrived",{get:function(){return this._onScriptDataArrived},set:function(e){this._onScriptDataArrived=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onError",{get:function(){return this._onError},set:function(e){this._onError=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onDataAvailable",{get:function(){return this._onDataAvailable},set:function(e){this._onDataAvailable=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"timestampBase",{get:function(){return this._timestampBase},set:function(e){this._timestampBase=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"overridedDuration",{get:function(){return this._duration},set:function(e){this._durationOverrided=!0,this._duration=e,this._mediaInfo.duration=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"overridedHasAudio",{set:function(e){this._hasAudioFlagOverrided=!0,this._hasAudio=e,this._mediaInfo.hasAudio=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"overridedHasVideo",{set:function(e){this._hasVideoFlagOverrided=!0,this._hasVideo=e,this._mediaInfo.hasVideo=e},enumerable:!1,configurable:!0}),e.prototype.resetMediaInfo=function(){this._mediaInfo=new s.a},e.prototype._isInitialMetadataDispatched=function(){return this._hasAudio&&this._hasVideo?this._audioInitialMetadataDispatched&&this._videoInitialMetadataDispatched:this._hasAudio&&!this._hasVideo?this._audioInitialMetadataDispatched:!(this._hasAudio||!this._hasVideo)&&this._videoInitialMetadataDispatched},e.prototype.parseChunks=function(t,i){if(!(this._onError&&this._onMediaInfo&&this._onTrackMetadata&&this._onDataAvailable))throw new h.a("Flv: onError & onMediaInfo & onTrackMetadata & onDataAvailable callback must be specified");var n=0,a=this._littleEndian;if(0===i){if(!(t.byteLength>13))return 0;n=e.probe(t).dataOffset}this._firstParse&&(this._firstParse=!1,i+n!==this._dataOffset&&r.a.w(this.TAG,"First time parsing but chunk byteStart invalid!"),0!==(o=new DataView(t,n)).getUint32(0,!a)&&r.a.w(this.TAG,"PrevTagSize0 !== 0 !!!"),n+=4);for(;n<t.byteLength;){this._dispatch=!0;var o=new DataView(t,n);if(n+11+4>t.byteLength)break;var s=o.getUint8(0),d=16777215&o.getUint32(0,!a);if(n+11+d+4>t.byteLength)break;if(8===s||9===s||18===s){var _=o.getUint8(4),c=o.getUint8(5),l=o.getUint8(6)|c<<8|_<<16|o.getUint8(7)<<24;0!==(16777215&o.getUint32(7,!a))&&r.a.w(this.TAG,"Meet tag which has StreamID != 0!");var u=n+11;switch(s){case 8:this._parseAudioData(t,u,d,l);break;case 9:this._parseVideoData(t,u,d,l,i+n);break;case 18:this._parseScriptData(t,u,d)}var f=o.getUint32(11+d,!a);f!==11+d&&r.a.w(this.TAG,"Invalid PrevTagSize ".concat(f)),n+=11+d+4}else r.a.w(this.TAG,"Unsupported tag type ".concat(s,", skipped")),n+=11+d+4}return this._isInitialMetadataDispatched()&&this._dispatch&&(this._audioTrack.length||this._videoTrack.length)&&this._onDataAvailable(this._audioTrack,this._videoTrack),n},e.prototype._parseScriptData=function(e,t,i){var n=u.parseScriptData(e,t,i);if(n.hasOwnProperty("onMetaData")){if(null==n.onMetaData||"object"!=typeof n.onMetaData)return void r.a.w(this.TAG,"Invalid onMetaData structure!");this._metadata&&r.a.w(this.TAG,"Found another onMetaData tag!"),this._metadata=n;var a=this._metadata.onMetaData;if(this._onMetaDataArrived&&this._onMetaDataArrived(Object.assign({},a)),"boolean"==typeof a.hasAudio&&!1===this._hasAudioFlagOverrided&&(this._hasAudio=a.hasAudio,this._mediaInfo.hasAudio=this._hasAudio),"boolean"==typeof a.hasVideo&&!1===this._hasVideoFlagOverrided&&(this._hasVideo=a.hasVideo,this._mediaInfo.hasVideo=this._hasVideo),"number"==typeof a.audiodatarate&&(this._mediaInfo.audioDataRate=a.audiodatarate),"number"==typeof a.videodatarate&&(this._mediaInfo.videoDataRate=a.videodatarate),"number"==typeof a.width&&(this._mediaInfo.width=a.width),"number"==typeof a.height&&(this._mediaInfo.height=a.height),"number"==typeof a.duration){if(!this._durationOverrided){var o=Math.floor(a.duration*this._timescale);this._duration=o,this._mediaInfo.duration=o}}else this._mediaInfo.duration=0;if("number"==typeof a.framerate){var s=Math.floor(1e3*a.framerate);if(s>0){var d=s/1e3;this._referenceFrameRate.fixed=!0,this._referenceFrameRate.fps=d,this._referenceFrameRate.fps_num=s,this._referenceFrameRate.fps_den=1e3,this._mediaInfo.fps=d}}if("object"==typeof a.keyframes){this._mediaInfo.hasKeyframesIndex=!0;var _=a.keyframes;this._mediaInfo.keyframesIndex=this._parseKeyframesIndex(_),a.keyframes=null}else this._mediaInfo.hasKeyframesIndex=!1;this._dispatch=!1,this._mediaInfo.metadata=a,r.a.v(this.TAG,"Parsed onMetaData"),this._mediaInfo.isComplete()&&this._onMediaInfo(this._mediaInfo)}Object.keys(n).length>0&&this._onScriptDataArrived&&this._onScriptDataArrived(Object.assign({},n))},e.prototype._parseKeyframesIndex=function(e){for(var t=[],i=[],n=1;n<e.times.length;n++){var a=this._timestampBase+Math.floor(1e3*e.times[n]);t.push(a),i.push(e.filepositions[n])}return{times:t,filepositions:i}},e.prototype._parseAudioData=function(e,t,i,n){if(i<=1)r.a.w(this.TAG,"Flv: Invalid audio packet, missing SoundData payload!");else if(!0!==this._hasAudioFlagOverrided||!1!==this._hasAudio){this._littleEndian;var a=new DataView(e,t,i).getUint8(0),o=a>>>4;if(9!==o)if(2===o||10===o){var s=0,d=(12&a)>>>2;if(d>=0&&d<=4){s=this._flvSoundRateTable[d];var _=1&a,c=this._audioMetadata,h=this._audioTrack;if(c||(!1===this._hasAudio&&!1===this._hasAudioFlagOverrided&&(this._hasAudio=!0,this._mediaInfo.hasAudio=!0),(c=this._audioMetadata={}).type="audio",c.id=h.id,c.timescale=this._timescale,c.duration=this._duration,c.audioSampleRate=s,c.channelCount=0===_?1:2),10===o){var l=this._parseAACAudioData(e,t+1,i-1);if(null==l)return;if(0===l.packetType){if(c.config){if(b(l.data.config,c.config))return;r.a.w(this.TAG,"AudioSpecificConfig has been changed, re-generate initialization segment")}var u=l.data;c.audioSampleRate=u.samplingRate,c.channelCount=u.channelCount,c.codec=u.codec,c.originalCodec=u.originalCodec,c.config=u.config,c.refSampleDuration=1024/c.audioSampleRate*c.timescale,r.a.v(this.TAG,"Parsed AudioSpecificConfig"),this._isInitialMetadataDispatched()?this._dispatch&&(this._audioTrack.length||this._videoTrack.length)&&this._onDataAvailable(this._audioTrack,this._videoTrack):this._audioInitialMetadataDispatched=!0,this._dispatch=!1,this._onTrackMetadata("audio",c),(g=this._mediaInfo).audioCodec=c.originalCodec,g.audioSampleRate=c.audioSampleRate,g.audioChannelCount=c.channelCount,g.hasVideo?null!=g.videoCodec&&(g.mimeType='video/x-flv; codecs="'+g.videoCodec+","+g.audioCodec+'"'):g.mimeType='video/x-flv; codecs="'+g.audioCodec+'"',g.isComplete()&&this._onMediaInfo(g)}else if(1===l.packetType){var f=this._timestampBase+n,p={unit:l.data,length:l.data.byteLength,dts:f,pts:f};h.samples.push(p),h.length+=l.data.length}else r.a.e(this.TAG,"Flv: Unsupported AAC data type ".concat(l.packetType))}else if(2===o){if(!c.codec){var g;if(null==(u=this._parseMP3AudioData(e,t+1,i-1,!0)))return;c.audioSampleRate=u.samplingRate,c.channelCount=u.channelCount,c.codec=u.codec,c.originalCodec=u.originalCodec,c.refSampleDuration=1152/c.audioSampleRate*c.timescale,r.a.v(this.TAG,"Parsed MPEG Audio Frame Header"),this._audioInitialMetadataDispatched=!0,this._onTrackMetadata("audio",c),(g=this._mediaInfo).audioCodec=c.codec,g.audioSampleRate=c.audioSampleRate,g.audioChannelCount=c.channelCount,g.audioDataRate=u.bitRate,g.hasVideo?null!=g.videoCodec&&(g.mimeType='video/x-flv; codecs="'+g.videoCodec+","+g.audioCodec+'"'):g.mimeType='video/x-flv; codecs="'+g.audioCodec+'"',g.isComplete()&&this._onMediaInfo(g)}var v=this._parseMP3AudioData(e,t+1,i-1,!1);if(null==v)return;f=this._timestampBase+n;var y={unit:v,length:v.byteLength,dts:f,pts:f};h.samples.push(y),h.length+=v.length}}else this._onError(m.a.FORMAT_ERROR,"Flv: Invalid audio sample rate idx: "+d)}else this._onError(m.a.CODEC_UNSUPPORTED,"Flv: Unsupported audio codec idx: "+o);else{if(i<=5)return void r.a.w(this.TAG,"Flv: Invalid audio packet, missing AudioFourCC in Ehnanced FLV payload!");var S=15&a,A=String.fromCharCode.apply(String,new Uint8Array(e,t,i).slice(1,5));switch(A){case"Opus":this._parseOpusAudioPacket(e,t+5,i-5,n,S);break;case"fLaC":this._parseFlacAudioPacket(e,t+5,i-5,n,S);break;default:this._onError(m.a.CODEC_UNSUPPORTED,"Flv: Unsupported audio codec: "+A)}}}},e.prototype._parseAACAudioData=function(e,t,i){if(!(i<=1)){var n={},a=new Uint8Array(e,t,i);return n.packetType=a[0],0===a[0]?n.data=this._parseAACAudioSpecificConfig(e,t+1,i-1):n.data=a.subarray(1),n}r.a.w(this.TAG,"Flv: Invalid AAC packet, missing AACPacketType or/and Data!")},e.prototype._parseAACAudioSpecificConfig=function(e,t,i){var n,a,r=new Uint8Array(e,t,i),o=null,s=0,d=null;if(s=n=r[0]>>>3,(a=(7&r[0])<<1|r[1]>>>7)<0||a>=this._mpegSamplingRates.length)this._onError(m.a.FORMAT_ERROR,"Flv: AAC invalid sampling frequency index!");else{var _=this._mpegSamplingRates[a],c=(120&r[1])>>>3;if(!(c<0||c>=8)){5===s&&(d=(7&r[1])<<1|r[2]>>>7,(124&r[2])>>>2);var h=self.navigator.userAgent.toLowerCase();return-1!==h.indexOf("firefox")?a>=6?(s=5,o=new Array(4),d=a-3):(s=2,o=new Array(2),d=a):-1!==h.indexOf("android")?(s=2,o=new Array(2),d=a):(s=5,d=a,o=new Array(4),a>=6?d=a-3:1===c&&(s=2,o=new Array(2),d=a)),o[0]=s<<3,o[0]|=(15&a)>>>1,o[1]=(15&a)<<7,o[1]|=(15&c)<<3,5===s&&(o[1]|=(15&d)>>>1,o[2]=(1&d)<<7,o[2]|=8,o[3]=0),{config:o,samplingRate:_,channelCount:c,codec:"mp4a.40."+s,originalCodec:"mp4a.40."+n}}this._onError(m.a.FORMAT_ERROR,"Flv: AAC invalid channel configuration")}},e.prototype._parseMP3AudioData=function(e,t,i,n){if(!(i<4)){this._littleEndian;var a=new Uint8Array(e,t,i),o=null;if(n){if(255!==a[0])return;var s=a[1]>>>3&3,d=(6&a[1])>>1,_=(240&a[2])>>>4,c=(12&a[2])>>>2,h=3!==(a[3]>>>6&3)?2:1,l=0,u=0;switch(s){case 0:l=this._mpegAudioV25SampleRateTable[c];break;case 2:l=this._mpegAudioV20SampleRateTable[c];break;case 3:l=this._mpegAudioV10SampleRateTable[c]}switch(d){case 1:34,_<this._mpegAudioL3BitRateTable.length&&(u=this._mpegAudioL3BitRateTable[_]);break;case 2:33,_<this._mpegAudioL2BitRateTable.length&&(u=this._mpegAudioL2BitRateTable[_]);break;case 3:32,_<this._mpegAudioL1BitRateTable.length&&(u=this._mpegAudioL1BitRateTable[_])}o={bitRate:u,samplingRate:l,channelCount:h,codec:"mp3",originalCodec:"mp3"}}else o=a;return o}r.a.w(this.TAG,"Flv: Invalid MP3 packet, header missing!")},e.prototype._parseOpusAudioPacket=function(e,t,i,n,a){if(0===a)this._parseOpusSequenceHeader(e,t,i);else if(1===a)this._parseOpusAudioData(e,t,i,n);else if(2!==a)return void this._onError(m.a.FORMAT_ERROR,"Flv: Invalid video packet type ".concat(a))},e.prototype._parseOpusSequenceHeader=function(e,t,i){if(i<=16)r.a.w(this.TAG,"Flv: Invalid OpusSequenceHeader, lack of data!");else{var n=this._audioMetadata,a=this._audioTrack;n||(!1===this._hasAudio&&!1===this._hasAudioFlagOverrided&&(this._hasAudio=!0,this._mediaInfo.hasAudio=!0),(n=this._audioMetadata={}).type="audio",n.id=a.id,n.timescale=this._timescale,n.duration=this._duration);var o=new DataView(e,t,i);o.setUint8(8,0);var s=o.getUint8(9);o.setUint16(10,o.getUint16(10,!0),!1);var d=o.getUint32(12,!0);o.setUint32(12,o.getUint32(12,!0),!1);var _={config:new Uint8Array(e,t+8,i-8),channelCount:s,samplingFrequence:d,codec:"opus",originalCodec:"opus"};if(n.config){if(b(_.config,n.config))return;r.a.w(this.TAG,"OpusSequenceHeader has been changed, re-generate initialization segment")}n.audioSampleRate=_.samplingFrequence,n.channelCount=_.channelCount,n.codec=_.codec,n.originalCodec=_.originalCodec,n.config=_.config,n.refSampleDuration=20,r.a.v(this.TAG,"Parsed OpusSequenceHeader"),this._isInitialMetadataDispatched()?this._dispatch&&(this._audioTrack.length||this._videoTrack.length)&&this._onDataAvailable(this._audioTrack,this._videoTrack):this._audioInitialMetadataDispatched=!0,this._dispatch=!1,this._onTrackMetadata("audio",n);var c=this._mediaInfo;c.audioCodec=n.originalCodec,c.audioSampleRate=n.audioSampleRate,c.audioChannelCount=n.channelCount,c.hasVideo?null!=c.videoCodec&&(c.mimeType='video/x-flv; codecs="'+c.videoCodec+","+c.audioCodec+'"'):c.mimeType='video/x-flv; codecs="'+c.audioCodec+'"',c.isComplete()&&this._onMediaInfo(c)}},e.prototype._parseOpusAudioData=function(e,t,i,n){var a=this._audioTrack,r=new Uint8Array(e,t,i),o=this._timestampBase+n,s={unit:r,length:r.byteLength,dts:o,pts:o};a.samples.push(s),a.length+=r.length},e.prototype._parseFlacAudioPacket=function(e,t,i,n,a){if(0===a)this._parseFlacSequenceHeader(e,t,i);else if(1===a)this._parseFlacAudioData(e,t,i,n);else if(2!==a)return void this._onError(m.a.FORMAT_ERROR,"Flv: Invalid Flac audio packet type ".concat(a))},e.prototype._parseFlacSequenceHeader=function(e,t,i){var n=this._audioMetadata,a=this._audioTrack;n||(!1===this._hasAudio&&!1===this._hasAudioFlagOverrided&&(this._hasAudio=!0,this._mediaInfo.hasAudio=!0),(n=this._audioMetadata={}).type="audio",n.id=a.id,n.timescale=this._timescale,n.duration=this._duration);var o=new Uint8Array(e,t+4,i-4),s=new f(o),d=s.readBits(16),_=s.readBits(16),c=_===d?_:null;s.readBits(24),s.readBits(24);var h=s.readBits(20),l=s.readBits(3)+1,u=s.readBits(5)+1;s.destroy();var p=new Uint8Array(o.byteLength+4);p.set(o,4),p[0]=128,p[1]=o.byteLength>>>16&255,p[2]=o.byteLength>>>8&255,p[3]=o.byteLength>>>0&255;var m={config:p,channelCount:l,samplingFrequence:h,sampleSize:u,codec:"flac",originalCodec:"flac"};if(n.config){if(b(m.config,n.config))return;r.a.w(this.TAG,"FlacSequenceHeader has been changed, re-generate initialization segment")}n.audioSampleRate=m.samplingFrequence,n.channelCount=m.channelCount,n.sampleSize=m.sampleSize,n.codec=m.codec,n.originalCodec=m.originalCodec,n.config=m.config,n.refSampleDuration=null!=c?1e3*c/m.samplingFrequence:null,r.a.v(this.TAG,"Parsed FlacSequenceHeader"),this._isInitialMetadataDispatched()?this._dispatch&&(this._audioTrack.length||this._videoTrack.length)&&this._onDataAvailable(this._audioTrack,this._videoTrack):this._audioInitialMetadataDispatched=!0,this._dispatch=!1,this._onTrackMetadata("audio",n);var g=this._mediaInfo;g.audioCodec=n.originalCodec,g.audioSampleRate=n.audioSampleRate,g.audioChannelCount=n.channelCount,g.hasVideo?null!=g.videoCodec&&(g.mimeType='video/x-flv; codecs="'+g.videoCodec+","+g.audioCodec+'"'):g.mimeType='video/x-flv; codecs="'+g.audioCodec+'"',g.isComplete()&&this._onMediaInfo(g)},e.prototype._parseFlacAudioData=function(e,t,i,n){var a=this._audioTrack,r=new Uint8Array(e,t,i),o=this._timestampBase+n,s={unit:r,length:r.byteLength,dts:o,pts:o};a.samples.push(s),a.length+=r.length},e.prototype._parseVideoData=function(e,t,i,n,a){if(i<=1)r.a.w(this.TAG,"Flv: Invalid video packet, missing VideoData payload!");else if(!0!==this._hasVideoFlagOverrided||!1!==this._hasVideo){var o=new Uint8Array(e,t,i)[0],s=(112&o)>>>4;if(0!=(128&o)){var d=15&o,_=String.fromCharCode.apply(String,new Uint8Array(e,t,i).slice(1,5));if("hvc1"===_)this._parseEnhancedHEVCVideoPacket(e,t+5,i-5,n,a,s,d);else{if("av01"!==_)return void this._onError(m.a.CODEC_UNSUPPORTED,"Flv: Unsupported codec in video frame: ".concat(_));this._parseEnhancedAV1VideoPacket(e,t+5,i-5,n,a,s,d)}}else{var c=15&o;if(7===c)this._parseAVCVideoPacket(e,t+1,i-1,n,a,s);else{if(12!==c)return void this._onError(m.a.CODEC_UNSUPPORTED,"Flv: Unsupported codec in video frame: ".concat(c));this._parseHEVCVideoPacket(e,t+1,i-1,n,a,s)}}}},e.prototype._parseAVCVideoPacket=function(e,t,i,n,a,o){if(i<4)r.a.w(this.TAG,"Flv: Invalid AVC packet, missing AVCPacketType or/and CompositionTime");else{var s=this._littleEndian,d=new DataView(e,t,i),_=d.getUint8(0),c=(16777215&d.getUint32(0,!s))<<8>>8;if(0===_)this._parseAVCDecoderConfigurationRecord(e,t+4,i-4);else if(1===_)this._parseAVCVideoData(e,t+4,i-4,n,a,o,c);else if(2!==_)return void this._onError(m.a.FORMAT_ERROR,"Flv: Invalid video packet type ".concat(_))}},e.prototype._parseHEVCVideoPacket=function(e,t,i,n,a,o){if(i<4)r.a.w(this.TAG,"Flv: Invalid HEVC packet, missing HEVCPacketType or/and CompositionTime");else{var s=this._littleEndian,d=new DataView(e,t,i),_=d.getUint8(0),c=(16777215&d.getUint32(0,!s))<<8>>8;if(0===_)this._parseHEVCDecoderConfigurationRecord(e,t+4,i-4);else if(1===_)this._parseHEVCVideoData(e,t+4,i-4,n,a,o,c);else if(2!==_)return void this._onError(m.a.FORMAT_ERROR,"Flv: Invalid video packet type ".concat(_))}},e.prototype._parseEnhancedHEVCVideoPacket=function(e,t,i,n,a,r,o){var s=this._littleEndian,d=new DataView(e,t,i);if(0===o)this._parseHEVCDecoderConfigurationRecord(e,t,i);else if(1===o){var _=(4294967040&d.getUint32(0,!s))>>8;this._parseHEVCVideoData(e,t+3,i-3,n,a,r,_)}else if(3===o)this._parseHEVCVideoData(e,t,i,n,a,r,0);else if(2!==o)return void this._onError(m.a.FORMAT_ERROR,"Flv: Invalid video packet type ".concat(o))},e.prototype._parseEnhancedAV1VideoPacket=function(e,t,i,n,a,r,o){this._littleEndian,new DataView(e,t,i);if(0===o)this._parseAV1CodecConfigurationRecord(e,t,i);else if(1===o)this._parseAV1VideoData(e,t,i,n,a,r,0);else{if(5===o)return void this._onError(m.a.FORMAT_ERROR,"Flv: Not Supported MP2T AV1 video packet type ".concat(o));if(2!==o)return void this._onError(m.a.FORMAT_ERROR,"Flv: Invalid video packet type ".concat(o))}},e.prototype._parseAVCDecoderConfigurationRecord=function(e,t,i){if(i<7)r.a.w(this.TAG,"Flv: Invalid AVCDecoderConfigurationRecord, lack of data!");else{var n=this._videoMetadata,a=this._videoTrack,o=this._littleEndian,s=new DataView(e,t,i);if(n){if(void 0!==n.avcc){var d=new Uint8Array(e,t,i);if(b(d,n.avcc))return;r.a.w(this.TAG,"AVCDecoderConfigurationRecord has been changed, re-generate initialization segment")}}else!1===this._hasVideo&&!1===this._hasVideoFlagOverrided&&(this._hasVideo=!0,this._mediaInfo.hasVideo=!0),(n=this._videoMetadata={}).type="video",n.id=a.id,n.timescale=this._timescale,n.duration=this._duration;var _=s.getUint8(0),c=s.getUint8(1);s.getUint8(2),s.getUint8(3);if(1===_&&0!==c)if(this._naluLengthSize=1+(3&s.getUint8(4)),3===this._naluLengthSize||4===this._naluLengthSize){var h=31&s.getUint8(5);if(0!==h){h>1&&r.a.w(this.TAG,"Flv: Strange AVCDecoderConfigurationRecord: SPS Count = ".concat(h));for(var l=6,u=0;u<h;u++){var f=s.getUint16(l,!o);if(l+=2,0!==f){var g=new Uint8Array(e,t+l,f);l+=f;var v=p.parseSPS(g);if(0===u){n.codecWidth=v.codec_size.width,n.codecHeight=v.codec_size.height,n.presentWidth=v.present_size.width,n.presentHeight=v.present_size.height,n.profile=v.profile_string,n.level=v.level_string,n.bitDepth=v.bit_depth,n.chromaFormat=v.chroma_format,n.sarRatio=v.sar_ratio,n.frameRate=v.frame_rate,!1!==v.frame_rate.fixed&&0!==v.frame_rate.fps_num&&0!==v.frame_rate.fps_den||(n.frameRate=this._referenceFrameRate);var y=n.frameRate.fps_den,S=n.frameRate.fps_num;n.refSampleDuration=n.timescale*(y/S);for(var A=g.subarray(1,4),E="avc1.",R=0;R<3;R++){var T=A[R].toString(16);T.length<2&&(T="0"+T),E+=T}n.codec=E;var L=this._mediaInfo;L.width=n.codecWidth,L.height=n.codecHeight,L.fps=n.frameRate.fps,L.profile=n.profile,L.level=n.level,L.refFrames=v.ref_frames,L.chromaFormat=v.chroma_format_string,L.sarNum=n.sarRatio.width,L.sarDen=n.sarRatio.height,L.videoCodec=E,L.hasAudio?null!=L.audioCodec&&(L.mimeType='video/x-flv; codecs="'+L.videoCodec+","+L.audioCodec+'"'):L.mimeType='video/x-flv; codecs="'+L.videoCodec+'"',L.isComplete()&&this._onMediaInfo(L)}}}var k=s.getUint8(l);if(0!==k){k>1&&r.a.w(this.TAG,"Flv: Strange AVCDecoderConfigurationRecord: PPS Count = ".concat(k)),l++;for(u=0;u<k;u++){f=s.getUint16(l,!o);l+=2,0!==f&&(l+=f)}n.avcc=new Uint8Array(i),n.avcc.set(new Uint8Array(e,t,i),0),r.a.v(this.TAG,"Parsed AVCDecoderConfigurationRecord"),this._isInitialMetadataDispatched()?this._dispatch&&(this._audioTrack.length||this._videoTrack.length)&&this._onDataAvailable(this._audioTrack,this._videoTrack):this._videoInitialMetadataDispatched=!0,this._dispatch=!1,this._onTrackMetadata("video",n)}else this._onError(m.a.FORMAT_ERROR,"Flv: Invalid AVCDecoderConfigurationRecord: No PPS")}else this._onError(m.a.FORMAT_ERROR,"Flv: Invalid AVCDecoderConfigurationRecord: No SPS")}else this._onError(m.a.FORMAT_ERROR,"Flv: Strange NaluLengthSizeMinusOne: ".concat(this._naluLengthSize-1));else this._onError(m.a.FORMAT_ERROR,"Flv: Invalid AVCDecoderConfigurationRecord")}},e.prototype._parseHEVCDecoderConfigurationRecord=function(e,t,i){if(i<22)r.a.w(this.TAG,"Flv: Invalid HEVCDecoderConfigurationRecord, lack of data!");else{var n=this._videoMetadata,a=this._videoTrack,o=this._littleEndian,s=new DataView(e,t,i);if(n){if(void 0!==n.hvcc){var d=new Uint8Array(e,t,i);if(b(d,n.hvcc))return;r.a.w(this.TAG,"HEVCDecoderConfigurationRecord has been changed, re-generate initialization segment")}}else!1===this._hasVideo&&!1===this._hasVideoFlagOverrided&&(this._hasVideo=!0,this._mediaInfo.hasVideo=!0),(n=this._videoMetadata={}).type="video",n.id=a.id,n.timescale=this._timescale,n.duration=this._duration;var _=s.getUint8(0),c=31&s.getUint8(1);if(0!==_&&1!==_||0===c)this._onError(m.a.FORMAT_ERROR,"Flv: Invalid HEVCDecoderConfigurationRecord");else if(this._naluLengthSize=1+(3&s.getUint8(21)),3===this._naluLengthSize||4===this._naluLengthSize){for(var h=s.getUint8(22),l=0,u=23;l<h;l++){var f=63&s.getUint8(u+0),p=s.getUint16(u+1,!o);u+=3;for(var v=0;v<p;v++){var y=s.getUint16(u+0,!o);if(0===v)if(33===f){u+=2;var S=new Uint8Array(e,t+u,y),A=g.parseSPS(S);n.codecWidth=A.codec_size.width,n.codecHeight=A.codec_size.height,n.presentWidth=A.present_size.width,n.presentHeight=A.present_size.height,n.profile=A.profile_string,n.level=A.level_string,n.bitDepth=A.bit_depth,n.chromaFormat=A.chroma_format,n.sarRatio=A.sar_ratio,n.frameRate=A.frame_rate,!1!==A.frame_rate.fixed&&0!==A.frame_rate.fps_num&&0!==A.frame_rate.fps_den||(n.frameRate=this._referenceFrameRate);var E=n.frameRate.fps_den,R=n.frameRate.fps_num;n.refSampleDuration=n.timescale*(E/R),n.codec=A.codec_mimetype;var T=this._mediaInfo;T.width=n.codecWidth,T.height=n.codecHeight,T.fps=n.frameRate.fps,T.profile=n.profile,T.level=n.level,T.refFrames=A.ref_frames,T.chromaFormat=A.chroma_format_string,T.sarNum=n.sarRatio.width,T.sarDen=n.sarRatio.height,T.videoCodec=A.codec_mimetype,T.hasAudio?null!=T.audioCodec&&(T.mimeType='video/x-flv; codecs="'+T.videoCodec+","+T.audioCodec+'"'):T.mimeType='video/x-flv; codecs="'+T.videoCodec+'"',T.isComplete()&&this._onMediaInfo(T),u+=y}else u+=2+y;else u+=2+y}}n.hvcc=new Uint8Array(i),n.hvcc.set(new Uint8Array(e,t,i),0),r.a.v(this.TAG,"Parsed HEVCDecoderConfigurationRecord"),this._isInitialMetadataDispatched()?this._dispatch&&(this._audioTrack.length||this._videoTrack.length)&&this._onDataAvailable(this._audioTrack,this._videoTrack):this._videoInitialMetadataDispatched=!0,this._dispatch=!1,this._onTrackMetadata("video",n)}else this._onError(m.a.FORMAT_ERROR,"Flv: Strange NaluLengthSizeMinusOne: ".concat(this._naluLengthSize-1))}},e.prototype._parseAV1CodecConfigurationRecord=function(e,t,i){if(i<4)r.a.w(this.TAG,"Flv: Invalid AV1CodecConfigurationRecord, lack of data!");else{var n=this._videoMetadata,a=this._videoTrack,o=(this._littleEndian,new DataView(e,t,i));n?void 0!==n.av1c&&r.a.w(this.TAG,"Found another AV1CodecConfigurationRecord!"):(!1===this._hasVideo&&!1===this._hasVideoFlagOverrided&&(this._hasVideo=!0,this._mediaInfo.hasVideo=!0),(n=this._videoMetadata={}).type="video",n.id=a.id,n.timescale=this._timescale,n.duration=this._duration);var s=127&o.getUint8(0);o.getUint8(1),o.getUint8(1),o.getUint8(2);if(1===s){var d=E.parseOBUs(new Uint8Array(e,t+4,i-4));if(null!=d){n.profile=d.profile_string,n.level=d.level_string,n.bitDepth=d.bit_depth,n.chromaFormat=d.chroma_format,n.frameRate=d.frame_rate,!1!==d.frame_rate.fixed&&0!==d.frame_rate.fps_num&&0!==d.frame_rate.fps_den||(n.frameRate=this._referenceFrameRate);var _=n.frameRate.fps_den,c=n.frameRate.fps_num;n.refSampleDuration=n.timescale*(_/c),n.codec=d.codec_mimetype,n.extra=d;var h=this._mediaInfo;h.fps=n.frameRate.fps,h.profile=n.profile,h.level=n.level,h.refFrames=d.ref_frames,h.chromaFormat=d.chroma_format_string,h.videoCodec=d.codec_mimetype,h.hasAudio?null!=h.audioCodec&&(h.mimeType='video/x-flv; codecs="'+h.videoCodec+","+h.audioCodec+'"'):h.mimeType='video/x-flv; codecs="'+h.videoCodec+'"',h.isComplete()&&this._onMediaInfo(h),n.av1c=new Uint8Array(i),n.av1c.set(new Uint8Array(e,t,i),0),r.a.v(this.TAG,"Preparing AV1CodecConfigurationRecord")}else this._onError(m.a.FORMAT_ERROR,"Flv: Invalid AV1CodecConfigurationRecord")}else this._onError(m.a.FORMAT_ERROR,"Flv: Invalid AV1CodecConfigurationRecord")}},e.prototype._parseAVCVideoData=function(e,t,i,n,a,o,s){for(var d=this._littleEndian,_=new DataView(e,t,i),c=[],h=0,l=0,u=this._naluLengthSize,f=this._timestampBase+n,p=1===o;l<i;){if(l+4>=i){r.a.w(this.TAG,"Malformed Nalu near timestamp ".concat(f,", offset = ").concat(l,", dataSize = ").concat(i));break}var m=_.getUint32(l,!d);if(3===u&&(m>>>=8),m>i-u)return void r.a.w(this.TAG,"Malformed Nalus near timestamp ".concat(f,", NaluSize > DataSize!"));var g=31&_.getUint8(l+u);5===g&&(p=!0);var v=new Uint8Array(e,t+l,u+m),y={type:g,data:v};c.push(y),h+=v.byteLength,l+=u+m}if(c.length){var S=this._videoTrack,b={units:c,length:h,isKeyframe:p,dts:f,cts:s,pts:f+s};p&&(b.fileposition=a),S.samples.push(b),S.length+=h}},e.prototype._parseHEVCVideoData=function(e,t,i,n,a,o,s){for(var d=this._littleEndian,_=new DataView(e,t,i),c=[],h=0,l=0,u=this._naluLengthSize,f=this._timestampBase+n,p=1===o;l<i;){if(l+4>=i){r.a.w(this.TAG,"Malformed Nalu near timestamp ".concat(f,", offset = ").concat(l,", dataSize = ").concat(i));break}var m=_.getUint32(l,!d);if(3===u&&(m>>>=8),m>i-u)return void r.a.w(this.TAG,"Malformed Nalus near timestamp ".concat(f,", NaluSize > DataSize!"));var g=_.getUint8(l+u)>>1&63;19!==g&&20!==g&&21!==g||(p=!0);var v=new Uint8Array(e,t+l,u+m),y={type:g,data:v};c.push(y),h+=v.byteLength,l+=u+m}if(c.length){var S=this._videoTrack,b={units:c,length:h,isKeyframe:p,dts:f,cts:s,pts:f+s};p&&(b.fileposition=a),S.samples.push(b),S.length+=h}},e.prototype._parseAV1VideoData=function(e,t,i,n,a,o,s){this._littleEndian,new DataView(e,t,i);var d,_=[],c=this._timestampBase+n,h=1===o;if(h){var l=this._videoMetadata,u=E.parseOBUs(new Uint8Array(e,t,i),l.extra);if(null==u)return void this._onError(m.a.FORMAT_ERROR,"Flv: Invalid AV1 VideoData");console.log(u),l.codecWidth=u.codec_size.width,l.codecHeight=u.codec_size.height,l.presentWidth=u.present_size.width,l.presentHeight=u.present_size.height,l.sarRatio=u.sar_ratio;var f=this._mediaInfo;f.width=l.codecWidth,f.height=l.codecHeight,f.sarNum=l.sarRatio.width,f.sarDen=l.sarRatio.height,r.a.v(this.TAG,"Parsed AV1DecoderConfigurationRecord"),this._isInitialMetadataDispatched()?this._dispatch&&(this._audioTrack.length||this._videoTrack.length)&&this._onDataAvailable(this._audioTrack,this._videoTrack):this._videoInitialMetadataDispatched=!0,this._dispatch=!1,this._onTrackMetadata("video",l)}if(d=i,_.push({unitType:0,data:new Uint8Array(e,t+0,i)}),_.length){var p=this._videoTrack,g={units:_,length:d,isKeyframe:h,dts:c,cts:s,pts:c+s};h&&(g.fileposition=a),p.samples.push(g),p.length+=d}},e}(),L=function(){function e(){}return e.prototype.destroy=function(){this.onError=null,this.onMediaInfo=null,this.onMetaDataArrived=null,this.onTrackMetadata=null,this.onDataAvailable=null,this.onTimedID3Metadata=null,this.onSynchronousKLVMetadata=null,this.onAsynchronousKLVMetadata=null,this.onSMPTE2038Metadata=null,this.onSCTE35Metadata=null,this.onPESPrivateData=null,this.onPESPrivateDataDescriptor=null},e}(),k=function(){this.program_pmt_pid={}};!function(e){e[e.kMPEG1Audio=3]="kMPEG1Audio",e[e.kMPEG2Audio=4]="kMPEG2Audio",e[e.kPESPrivateData=6]="kPESPrivateData",e[e.kADTSAAC=15]="kADTSAAC",e[e.kLOASAAC=17]="kLOASAAC",e[e.kAC3=129]="kAC3",e[e.kEAC3=135]="kEAC3",e[e.kMetadata=21]="kMetadata",e[e.kSCTE35=134]="kSCTE35",e[e.kH264=27]="kH264",e[e.kH265=36]="kH265"}(R||(R={}));var w,M=function(){this.pid_stream_type={},this.common_pids={h264:void 0,h265:void 0,av1:void 0,adts_aac:void 0,loas_aac:void 0,opus:void 0,ac3:void 0,eac3:void 0,mp3:void 0},this.pes_private_data_pids={},this.timed_id3_pids={},this.synchronous_klv_pids={},this.asynchronous_klv_pids={},this.scte_35_pids={},this.smpte2038_pids={}},C=function(){},D=function(){},O=function(){this.slices=[],this.total_length=0,this.expected_length=0,this.file_position=0};!function(e){e[e.kUnspecified=0]="kUnspecified",e[e.kSliceNonIDR=1]="kSliceNonIDR",e[e.kSliceDPA=2]="kSliceDPA",e[e.kSliceDPB=3]="kSliceDPB",e[e.kSliceDPC=4]="kSliceDPC",e[e.kSliceIDR=5]="kSliceIDR",e[e.kSliceSEI=6]="kSliceSEI",e[e.kSliceSPS=7]="kSliceSPS",e[e.kSlicePPS=8]="kSlicePPS",e[e.kSliceAUD=9]="kSliceAUD",e[e.kEndOfSequence=10]="kEndOfSequence",e[e.kEndOfStream=11]="kEndOfStream",e[e.kFiller=12]="kFiller",e[e.kSPSExt=13]="kSPSExt",e[e.kReserved0=14]="kReserved0"}(w||(w={}));var B,I,P=function(){},x=function(e){var t=e.data.byteLength;this.type=e.type,this.data=new Uint8Array(4+t),new DataView(this.data.buffer).setUint32(0,t),this.data.set(e.data,4)},U=function(){function e(e){this.TAG="H264AnnexBParser",this.current_startcode_offset_=0,this.eof_flag_=!1,this.data_=e,this.current_startcode_offset_=this.findNextStartCodeOffset(0),this.eof_flag_&&r.a.e(this.TAG,"Could not find H264 startcode until payload end!")}return e.prototype.findNextStartCodeOffset=function(e){for(var t=e,i=this.data_;;){if(t+3>=i.byteLength)return this.eof_flag_=!0,i.byteLength;var n=i[t+0]<<24|i[t+1]<<16|i[t+2]<<8|i[t+3],a=i[t+0]<<16|i[t+1]<<8|i[t+2];if(1===n||1===a)return t;t++}},e.prototype.readNextNaluPayload=function(){for(var e=this.data_,t=null;null==t&&!this.eof_flag_;){var i=this.current_startcode_offset_,n=31&e[i+=1===(e[i]<<24|e[i+1]<<16|e[i+2]<<8|e[i+3])?4:3],a=(128&e[i])>>>7,r=this.findNextStartCodeOffset(i);if(this.current_startcode_offset_=r,!(n>=w.kReserved0)&&0===a){var o=e.subarray(i,r);(t=new P).type=n,t.data=o}}return t},e}(),N=function(){function e(e,t,i){var n=8+e.byteLength+1+2+t.byteLength,a=!1;66!==e[3]&&77!==e[3]&&88!==e[3]&&(a=!0,n+=4);var r=this.data=new Uint8Array(n);r[0]=1,r[1]=e[1],r[2]=e[2],r[3]=e[3],r[4]=255,r[5]=225;var o=e.byteLength;r[6]=o>>>8,r[7]=255&o;var s=8;r.set(e,8),r[s+=o]=1;var d=t.byteLength;r[s+1]=d>>>8,r[s+2]=255&d,r.set(t,s+3),s+=3+d,a&&(r[s]=252|i.chroma_format_idc,r[s+1]=248|i.bit_depth_luma-8,r[s+2]=248|i.bit_depth_chroma-8,r[s+3]=0,s+=4)}return e.prototype.getData=function(){return this.data},e}();!function(e){e[e.kNull=0]="kNull",e[e.kAACMain=1]="kAACMain",e[e.kAAC_LC=2]="kAAC_LC",e[e.kAAC_SSR=3]="kAAC_SSR",e[e.kAAC_LTP=4]="kAAC_LTP",e[e.kAAC_SBR=5]="kAAC_SBR",e[e.kAAC_Scalable=6]="kAAC_Scalable",e[e.kLayer1=32]="kLayer1",e[e.kLayer2=33]="kLayer2",e[e.kLayer3=34]="kLayer3"}(B||(B={})),function(e){e[e.k96000Hz=0]="k96000Hz",e[e.k88200Hz=1]="k88200Hz",e[e.k64000Hz=2]="k64000Hz",e[e.k48000Hz=3]="k48000Hz",e[e.k44100Hz=4]="k44100Hz",e[e.k32000Hz=5]="k32000Hz",e[e.k24000Hz=6]="k24000Hz",e[e.k22050Hz=7]="k22050Hz",e[e.k16000Hz=8]="k16000Hz",e[e.k12000Hz=9]="k12000Hz",e[e.k11025Hz=10]="k11025Hz",e[e.k8000Hz=11]="k8000Hz",e[e.k7350Hz=12]="k7350Hz"}(I||(I={}));var V,G,F=[96e3,88200,64e3,48e3,44100,32e3,24e3,22050,16e3,12e3,11025,8e3,7350],j=(V=function(e,t){return(V=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var i in t)Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i])})(e,t)},function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function i(){this.constructor=e}V(e,t),e.prototype=null===t?Object.create(t):(i.prototype=t.prototype,new i)}),z=function(){},H=function(e){function t(){return null!==e&&e.apply(this,arguments)||this}return j(t,e),t}(z),q=function(){function e(e){this.TAG="AACADTSParser",this.data_=e,this.current_syncword_offset_=this.findNextSyncwordOffset(0),this.eof_flag_&&r.a.e(this.TAG,"Could not found ADTS syncword until payload end")}return e.prototype.findNextSyncwordOffset=function(e){for(var t=e,i=this.data_;;){if(t+7>=i.byteLength)return this.eof_flag_=!0,i.byteLength;if(4095===(i[t+0]<<8|i[t+1])>>>4)return t;t++}},e.prototype.readNextAACFrame=function(){for(var e=this.data_,t=null;null==t&&!this.eof_flag_;){var i=this.current_syncword_offset_,n=(8&e[i+1])>>>3,a=(6&e[i+1])>>>1,r=1&e[i+1],o=(192&e[i+2])>>>6,s=(60&e[i+2])>>>2,d=(1&e[i+2])<<2|(192&e[i+3])>>>6,_=(3&e[i+3])<<11|e[i+4]<<3|(224&e[i+5])>>>5;e[i+6];if(i+_>this.data_.byteLength){this.eof_flag_=!0,this.has_last_incomplete_data=!0;break}var c=1===r?7:9,h=_-c;i+=c;var l=this.findNextSyncwordOffset(i+h);if(this.current_syncword_offset_=l,(0===n||1===n)&&0===a){var u=e.subarray(i,i+h);(t=new z).audio_object_type=o+1,t.sampling_freq_index=s,t.sampling_frequency=F[s],t.channel_config=d,t.data=u}}return t},e.prototype.hasIncompleteData=function(){return this.has_last_incomplete_data},e.prototype.getIncompleteData=function(){return this.has_last_incomplete_data?this.data_.subarray(this.current_syncword_offset_):null},e}(),K=function(){function e(e){this.TAG="AACLOASParser",this.data_=e,this.current_syncword_offset_=this.findNextSyncwordOffset(0),this.eof_flag_&&r.a.e(this.TAG,"Could not found LOAS syncword until payload end")}return e.prototype.findNextSyncwordOffset=function(e){for(var t=e,i=this.data_;;){if(t+1>=i.byteLength)return this.eof_flag_=!0,i.byteLength;if(695===(i[t+0]<<3|i[t+1]>>>5))return t;t++}},e.prototype.getLATMValue=function(e){for(var t=e.readBits(2),i=0,n=0;n<=t;n++)i<<=8,i|=e.readByte();return i},e.prototype.readNextAACFrame=function(e){for(var t=this.data_,i=null;null==i&&!this.eof_flag_;){var n=this.current_syncword_offset_,a=(31&t[n+1])<<8|t[n+2];if(n+3+a>=this.data_.byteLength){this.eof_flag_=!0,this.has_last_incomplete_data=!0;break}var o=new f(t.subarray(n+3,n+3+a)),s=null;if(o.readBool()){if(null==e){r.a.w(this.TAG,"StreamMuxConfig Missing"),this.current_syncword_offset_=this.findNextSyncwordOffset(n+3+a),o.destroy();continue}s=e}else{var d=o.readBool();if(d&&o.readBool()){r.a.e(this.TAG,"audioMuxVersionA is Not Supported"),o.destroy();break}if(d&&this.getLATMValue(o),!o.readBool()){r.a.e(this.TAG,"allStreamsSameTimeFraming zero is Not Supported"),o.destroy();break}if(0!==o.readBits(6)){r.a.e(this.TAG,"more than 2 numSubFrames Not Supported"),o.destroy();break}if(0!==o.readBits(4)){r.a.e(this.TAG,"more than 2 numProgram Not Supported"),o.destroy();break}if(0!==o.readBits(3)){r.a.e(this.TAG,"more than 2 numLayer Not Supported"),o.destroy();break}var _=d?this.getLATMValue(o):0,c=o.readBits(5);_-=5;var h=o.readBits(4);_-=4;var l=o.readBits(4);_-=4,o.readBits(3),(_-=3)>0&&o.readBits(_);var u=o.readBits(3);if(0!==u){r.a.e(this.TAG,"frameLengthType = ".concat(u,". Only frameLengthType = 0 Supported")),o.destroy();break}o.readByte();var p=o.readBool();if(p)if(d)this.getLATMValue(o);else{for(var m=0;;){m<<=8;var g=o.readBool();if(m+=o.readByte(),!g)break}console.log(m)}o.readBool()&&o.readByte(),(s=new H).audio_object_type=c,s.sampling_freq_index=h,s.sampling_frequency=F[s.sampling_freq_index],s.channel_config=l,s.other_data_present=p}for(var v=0;;){var y=o.readByte();if(v+=y,255!==y)break}for(var S=new Uint8Array(v),b=0;b<v;b++)S[b]=o.readByte();(i=new H).audio_object_type=s.audio_object_type,i.sampling_freq_index=s.sampling_freq_index,i.sampling_frequency=F[s.sampling_freq_index],i.channel_config=s.channel_config,i.other_data_present=s.other_data_present,i.data=S,this.current_syncword_offset_=this.findNextSyncwordOffset(n+3+a)}return i},e.prototype.hasIncompleteData=function(){return this.has_last_incomplete_data},e.prototype.getIncompleteData=function(){return this.has_last_incomplete_data?this.data_.subarray(this.current_syncword_offset_):null},e}(),W=function(e){var t=null,i=e.audio_object_type,n=e.audio_object_type,a=e.sampling_freq_index,r=e.channel_config,o=0,s=navigator.userAgent.toLowerCase();-1!==s.indexOf("firefox")?a>=6?(n=5,t=new Array(4),o=a-3):(n=2,t=new Array(2),o=a):-1!==s.indexOf("android")?(n=2,t=new Array(2),o=a):(n=5,o=a,t=new Array(4),a>=6?o=a-3:1===r&&(n=2,t=new Array(2),o=a)),t[0]=n<<3,t[0]|=(15&a)>>>1,t[1]=(15&a)<<7,t[1]|=(15&r)<<3,5===n&&(t[1]|=(15&o)>>>1,t[2]=(1&o)<<7,t[2]|=8,t[3]=0),this.config=t,this.sampling_rate=F[a],this.channel_count=r,this.codec_mimetype="mp4a.40."+n,this.original_codec_mimetype="mp4a.40."+i},Y=function(){},X=function(){};!function(e){e[e.kSpliceNull=0]="kSpliceNull",e[e.kSpliceSchedule=4]="kSpliceSchedule",e[e.kSpliceInsert=5]="kSpliceInsert",e[e.kTimeSignal=6]="kTimeSignal",e[e.kBandwidthReservation=7]="kBandwidthReservation",e[e.kPrivateCommand=255]="kPrivateCommand"}(G||(G={}));var Q,J=function(e){var t=e.readBool();return t?(e.readBits(6),{time_specified_flag:t,pts_time:4*e.readBits(31)+e.readBits(2)}):(e.readBits(7),{time_specified_flag:t})},Z=function(e){var t=e.readBool();return e.readBits(6),{auto_return:t,duration:4*e.readBits(31)+e.readBits(2)}},$=function(e,t){var i=t.readBits(8);return e?{component_tag:i}:{component_tag:i,splice_time:J(t)}},ee=function(e){return{component_tag:e.readBits(8),utc_splice_time:e.readBits(32)}},te=function(e){var t=e.readBits(32),i=e.readBool();e.readBits(7);var n={splice_event_id:t,splice_event_cancel_indicator:i};if(i)return n;if(n.out_of_network_indicator=e.readBool(),n.program_splice_flag=e.readBool(),n.duration_flag=e.readBool(),e.readBits(5),n.program_splice_flag)n.utc_splice_time=e.readBits(32);else{n.component_count=e.readBits(8),n.components=[];for(var a=0;a<n.component_count;a++)n.components.push(ee(e))}return n.duration_flag&&(n.break_duration=Z(e)),n.unique_program_id=e.readBits(16),n.avail_num=e.readBits(8),n.avails_expected=e.readBits(8),n},ie=function(e,t,i,n){return{descriptor_tag:e,descriptor_length:t,identifier:i,provider_avail_id:n.readBits(32)}},ne=function(e,t,i,n){var a=n.readBits(8),r=n.readBits(3);n.readBits(5);for(var o="",s=0;s<r;s++)o+=String.fromCharCode(n.readBits(8));return{descriptor_tag:e,descriptor_length:t,identifier:i,preroll:a,dtmf_count:r,DTMF_char:o}},ae=function(e){var t=e.readBits(8);return e.readBits(7),{component_tag:t,pts_offset:4*e.readBits(31)+e.readBits(2)}},re=function(e,t,i,n){var a=n.readBits(32),r=n.readBool();n.readBits(7);var o={descriptor_tag:e,descriptor_length:t,identifier:i,segmentation_event_id:a,segmentation_event_cancel_indicator:r};if(r)return o;if(o.program_segmentation_flag=n.readBool(),o.segmentation_duration_flag=n.readBool(),o.delivery_not_restricted_flag=n.readBool(),o.delivery_not_restricted_flag?n.readBits(5):(o.web_delivery_allowed_flag=n.readBool(),o.no_regional_blackout_flag=n.readBool(),o.archive_allowed_flag=n.readBool(),o.device_restrictions=n.readBits(2)),!o.program_segmentation_flag){o.component_count=n.readBits(8),o.components=[];for(var s=0;s<o.component_count;s++)o.components.push(ae(n))}o.segmentation_duration_flag&&(o.segmentation_duration=n.readBits(40)),o.segmentation_upid_type=n.readBits(8),o.segmentation_upid_length=n.readBits(8);var d=new Uint8Array(o.segmentation_upid_length);for(s=0;s<o.segmentation_upid_length;s++)d[s]=n.readBits(8);return o.segmentation_upid=d.buffer,o.segmentation_type_id=n.readBits(8),o.segment_num=n.readBits(8),o.segments_expected=n.readBits(8),52!==o.segmentation_type_id&&54!==o.segmentation_type_id&&56!==o.segmentation_type_id&&58!==o.segmentation_type_id||(o.sub_segment_num=n.readBits(8),o.sub_segments_expected=n.readBits(8)),o},oe=function(e,t,i,n){return{descriptor_tag:e,descriptor_length:t,identifier:i,TAI_seconds:n.readBits(48),TAI_ns:n.readBits(32),UTC_offset:n.readBits(16)}},se=function(e){return{component_tag:e.readBits(8),ISO_code:String.fromCharCode(e.readBits(8),e.readBits(8),e.readBits(8)),Bit_Stream_Mode:e.readBits(3),Num_Channels:e.readBits(4),Full_Srvc_Audio:e.readBool()}},de=function(e,t,i,n){for(var a=n.readBits(4),r=[],o=0;o<a;o++)r.push(se(n));return{descriptor_tag:e,descriptor_length:t,identifier:i,audio_count:a,components:r}},_e=function(e){var t=new f(e),i=t.readBits(8),n=t.readBool(),a=t.readBool();t.readBits(2);var r=t.readBits(12),o=t.readBits(8),s=t.readBool(),d=t.readBits(6),_=4*t.readBits(31)+t.readBits(2),c=t.readBits(8),h=t.readBits(12),l=t.readBits(12),u=t.readBits(8),p=null;u===G.kSpliceNull?p={}:u===G.kSpliceSchedule?p=function(e){for(var t=e.readBits(8),i=[],n=0;n<t;n++)i.push(te(e));return{splice_count:t,events:i}}(t):u===G.kSpliceInsert?p=function(e){var t=e.readBits(32),i=e.readBool();e.readBits(7);var n={splice_event_id:t,splice_event_cancel_indicator:i};if(i)return n;if(n.out_of_network_indicator=e.readBool(),n.program_splice_flag=e.readBool(),n.duration_flag=e.readBool(),n.splice_immediate_flag=e.readBool(),e.readBits(4),n.program_splice_flag&&!n.splice_immediate_flag&&(n.splice_time=J(e)),!n.program_splice_flag){n.component_count=e.readBits(8),n.components=[];for(var a=0;a<n.component_count;a++)n.components.push($(n.splice_immediate_flag,e))}return n.duration_flag&&(n.break_duration=Z(e)),n.unique_program_id=e.readBits(16),n.avail_num=e.readBits(8),n.avails_expected=e.readBits(8),n}(t):u===G.kTimeSignal?p=function(e){return{splice_time:J(e)}}(t):u===G.kBandwidthReservation?p={}:u===G.kPrivateCommand?p=function(e,t){for(var i=String.fromCharCode(t.readBits(8),t.readBits(8),t.readBits(8),t.readBits(8)),n=new Uint8Array(e-4),a=0;a<e-4;a++)n[a]=t.readBits(8);return{identifier:i,private_data:n.buffer}}(l,t):t.readBits(8*l);for(var m=[],g=t.readBits(16),v=0;v<g;){var y=t.readBits(8),S=t.readBits(8),b=String.fromCharCode(t.readBits(8),t.readBits(8),t.readBits(8),t.readBits(8));0===y?m.push(ie(y,S,b,t)):1===y?m.push(ne(y,S,b,t)):2===y?m.push(re(y,S,b,t)):3===y?m.push(oe(y,S,b,t)):4===y?m.push(de(y,S,b,t)):t.readBits(8*(S-4)),v+=2+S}var A={table_id:i,section_syntax_indicator:n,private_indicator:a,section_length:r,protocol_version:o,encrypted_packet:s,encryption_algorithm:d,pts_adjustment:_,cw_index:c,tier:h,splice_command_length:l,splice_command_type:u,splice_command:p,descriptor_loop_length:g,splice_descriptors:m,E_CRC32:s?t.readBits(32):void 0,CRC32:t.readBits(32)};if(u===G.kSpliceInsert){var E=p;if(E.splice_event_cancel_indicator)return{splice_command_type:u,detail:A,data:e};if(E.program_splice_flag&&!E.splice_immediate_flag){var R=E.duration_flag?E.break_duration.auto_return:void 0,T=E.duration_flag?E.break_duration.duration/90:void 0;return E.splice_time.time_specified_flag?{splice_command_type:u,pts:(_+E.splice_time.pts_time)%Math.pow(2,33),auto_return:R,duraiton:T,detail:A,data:e}:{splice_command_type:u,auto_return:R,duraiton:T,detail:A,data:e}}return{splice_command_type:u,auto_return:R=E.duration_flag?E.break_duration.auto_return:void 0,duraiton:T=E.duration_flag?E.break_duration.duration/90:void 0,detail:A,data:e}}if(u===G.kTimeSignal){var L=p;return L.splice_time.time_specified_flag?{splice_command_type:u,pts:(_+L.splice_time.pts_time)%Math.pow(2,33),detail:A,data:e}:{splice_command_type:u,detail:A,data:e}}return{splice_command_type:u,detail:A,data:e}};!function(e){e[e.kSliceIDR_W_RADL=19]="kSliceIDR_W_RADL",e[e.kSliceIDR_N_LP=20]="kSliceIDR_N_LP",e[e.kSliceCRA_NUT=21]="kSliceCRA_NUT",e[e.kSliceVPS=32]="kSliceVPS",e[e.kSliceSPS=33]="kSliceSPS",e[e.kSlicePPS=34]="kSlicePPS",e[e.kSliceAUD=35]="kSliceAUD"}(Q||(Q={}));var ce=function(){},he=function(e){var t=e.data.byteLength;this.type=e.type,this.data=new Uint8Array(4+t),new DataView(this.data.buffer).setUint32(0,t),this.data.set(e.data,4)},le=function(){function e(e){this.TAG="H265AnnexBParser",this.current_startcode_offset_=0,this.eof_flag_=!1,this.data_=e,this.current_startcode_offset_=this.findNextStartCodeOffset(0),this.eof_flag_&&r.a.e(this.TAG,"Could not find H265 startcode until payload end!")}return e.prototype.findNextStartCodeOffset=function(e){for(var t=e,i=this.data_;;){if(t+3>=i.byteLength)return this.eof_flag_=!0,i.byteLength;var n=i[t+0]<<24|i[t+1]<<16|i[t+2]<<8|i[t+3],a=i[t+0]<<16|i[t+1]<<8|i[t+2];if(1===n||1===a)return t;t++}},e.prototype.readNextNaluPayload=function(){for(var e=this.data_,t=null;null==t&&!this.eof_flag_;){var i=this.current_startcode_offset_,n=e[i+=1===(e[i]<<24|e[i+1]<<16|e[i+2]<<8|e[i+3])?4:3]>>1&63,a=(128&e[i])>>>7,r=this.findNextStartCodeOffset(i);if(this.current_startcode_offset_=r,0===a){var o=e.subarray(i,r);(t=new ce).type=n,t.data=o}}return t},e}(),ue=function(){function e(e,t,i,n){var a=23+(5+e.byteLength)+(5+t.byteLength)+(5+i.byteLength),r=this.data=new Uint8Array(a);r[0]=1,r[1]=(3&n.general_profile_space)<<6|(n.general_tier_flag?1:0)<<5|31&n.general_profile_idc,r[2]=n.general_profile_compatibility_flags_1,r[3]=n.general_profile_compatibility_flags_2,r[4]=n.general_profile_compatibility_flags_3,r[5]=n.general_profile_compatibility_flags_4,r[6]=n.general_constraint_indicator_flags_1,r[7]=n.general_constraint_indicator_flags_2,r[8]=n.general_constraint_indicator_flags_3,r[9]=n.general_constraint_indicator_flags_4,r[10]=n.general_constraint_indicator_flags_5,r[11]=n.general_constraint_indicator_flags_6,r[12]=n.general_level_idc,r[13]=240|(3840&n.min_spatial_segmentation_idc)>>8,r[14]=255&n.min_spatial_segmentation_idc,r[15]=252|3&n.parallelismType,r[16]=252|3&n.chroma_format_idc,r[17]=248|7&n.bit_depth_luma_minus8,r[18]=248|7&n.bit_depth_chroma_minus8,r[19]=0,r[20]=0,r[21]=(3&n.constant_frame_rate)<<6|(7&n.num_temporal_layers)<<3|(n.temporal_id_nested?1:0)<<2|3,r[22]=3,r[23]=128|Q.kSliceVPS,r[24]=0,r[25]=1,r[26]=(65280&e.byteLength)>>8,r[27]=(255&e.byteLength)>>0,r.set(e,28),r[23+(5+e.byteLength)+0]=128|Q.kSliceSPS,r[23+(5+e.byteLength)+1]=0,r[23+(5+e.byteLength)+2]=1,r[23+(5+e.byteLength)+3]=(65280&t.byteLength)>>8,r[23+(5+e.byteLength)+4]=(255&t.byteLength)>>0,r.set(t,23+(5+e.byteLength)+5),r[23+(5+e.byteLength+5+t.byteLength)+0]=128|Q.kSlicePPS,r[23+(5+e.byteLength+5+t.byteLength)+1]=0,r[23+(5+e.byteLength+5+t.byteLength)+2]=1,r[23+(5+e.byteLength+5+t.byteLength)+3]=(65280&i.byteLength)>>8,r[23+(5+e.byteLength+5+t.byteLength)+4]=(255&i.byteLength)>>0,r.set(i,23+(5+e.byteLength+5+t.byteLength)+5)}return e.prototype.getData=function(){return this.data},e}(),fe=function(){},pe=function(){},me=function(){},ge=[[64,64,80,80,96,96,112,112,128,128,160,160,192,192,224,224,256,256,320,320,384,384,448,448,512,512,640,640,768,768,896,896,1024,1024,1152,1152,1280,1280],[69,70,87,88,104,105,121,122,139,140,174,175,208,209,243,244,278,279,348,349,417,418,487,488,557,558,696,697,835,836,975,976,1114,1115,1253,1254,1393,1394],[96,96,120,120,144,144,168,168,192,192,240,240,288,288,336,336,384,384,480,480,576,576,672,672,768,768,960,960,1152,1152,1344,1344,1536,1536,1728,1728,1920,1920]],ve=function(){function e(e){this.TAG="AC3Parser",this.data_=e,this.current_syncword_offset_=this.findNextSyncwordOffset(0),this.eof_flag_&&r.a.e(this.TAG,"Could not found AC3 syncword until payload end")}return e.prototype.findNextSyncwordOffset=function(e){for(var t=e,i=this.data_;;){if(t+7>=i.byteLength)return this.eof_flag_=!0,i.byteLength;if(2935===(i[t+0]<<8|i[t+1]<<0))return t;t++}},e.prototype.readNextAC3Frame=function(){for(var e=this.data_,t=null;null==t&&!this.eof_flag_;){var i=this.current_syncword_offset_,n=e[i+4]>>6,a=[48e3,44200,33e3][n],r=63&e[i+4],o=2*ge[n][r];if(isNaN(o)||i+o>this.data_.byteLength){this.eof_flag_=!0,this.has_last_incomplete_data=!0;break}var s=this.findNextSyncwordOffset(i+o);this.current_syncword_offset_=s;var d=e[i+5]>>3,_=7&e[i+5],c=e[i+6]>>5,h=0;0!=(1&c)&&1!==c&&(h+=2),0!=(4&c)&&(h+=2),2===c&&(h+=2);var l=(e[i+6]<<8|e[i+7]<<0)>>12-h&1,u=[2,1,2,3,3,4,4,5][c]+l;(t=new me).sampling_frequency=a,t.channel_count=u,t.channel_mode=c,t.bit_stream_identification=d,t.low_frequency_effects_channel_on=l,t.bit_stream_mode=_,t.frame_size_code=r,t.data=e.subarray(i,i+o)}return t},e.prototype.hasIncompleteData=function(){return this.has_last_incomplete_data},e.prototype.getIncompleteData=function(){return this.has_last_incomplete_data?this.data_.subarray(this.current_syncword_offset_):null},e}(),ye=function(e){var t;t=[e.sampling_rate_code<<6|e.bit_stream_identification<<1|e.bit_stream_mode>>2,(3&e.bit_stream_mode)<<6|e.channel_mode<<3|e.low_frequency_effects_channel_on<<2|e.frame_size_code>>4,e.frame_size_code<<4&224],this.config=t,this.sampling_rate=e.sampling_frequency,this.bit_stream_identification=e.bit_stream_identification,this.bit_stream_mode=e.bit_stream_mode,this.low_frequency_effects_channel_on=e.low_frequency_effects_channel_on,this.channel_count=e.channel_count,this.channel_mode=e.channel_mode,this.codec_mimetype="ac-3",this.original_codec_mimetype="ac-3"},Se=function(){},be=function(){function e(e){this.TAG="EAC3Parser",this.data_=e,this.current_syncword_offset_=this.findNextSyncwordOffset(0),this.eof_flag_&&r.a.e(this.TAG,"Could not found AC3 syncword until payload end")}return e.prototype.findNextSyncwordOffset=function(e){for(var t=e,i=this.data_;;){if(t+7>=i.byteLength)return this.eof_flag_=!0,i.byteLength;if(2935===(i[t+0]<<8|i[t+1]<<0))return t;t++}},e.prototype.readNextEAC3Frame=function(){for(var e=this.data_,t=null;null==t&&!this.eof_flag_;){var i=this.current_syncword_offset_,n=new f(e.subarray(i+2)),a=(n.readBits(2),n.readBits(3),n.readBits(11)+1<<1),r=n.readBits(2),o=null,s=null;3===r?(o=[24e3,22060,16e3][r=n.readBits(2)],s=3):(o=[48e3,44100,32e3][r],s=n.readBits(2));var d=n.readBits(3),_=n.readBits(1),c=n.readBits(5);if(i+a>this.data_.byteLength){this.eof_flag_=!0,this.has_last_incomplete_data=!0;break}var h=this.findNextSyncwordOffset(i+a);this.current_syncword_offset_=h;var l=[2,1,2,3,3,4,4,5][d]+_;n.destroy(),(t=new Se).sampling_frequency=o,t.channel_count=l,t.channel_mode=d,t.bit_stream_identification=c,t.low_frequency_effects_channel_on=_,t.frame_size=a,t.num_blks=[1,2,3,6][s],t.data=e.subarray(i,i+a)}return t},e.prototype.hasIncompleteData=function(){return this.has_last_incomplete_data},e.prototype.getIncompleteData=function(){return this.has_last_incomplete_data?this.data_.subarray(this.current_syncword_offset_):null},e}(),Ae=function(e){var t,i=Math.floor(e.frame_size*e.sampling_frequency/(16*e.num_blks));t=[255&i,248&i,e.sampling_rate_code<<6|e.bit_stream_identification<<1|0,0|e.channel_mode<<1|e.low_frequency_effects_channel_on<<0,0],this.config=t,this.sampling_rate=e.sampling_frequency,this.bit_stream_identification=e.bit_stream_identification,this.num_blks=e.num_blks,this.low_frequency_effects_channel_on=e.low_frequency_effects_channel_on,this.channel_count=e.channel_count,this.channel_mode=e.channel_mode,this.codec_mimetype="ec-3",this.original_codec_mimetype="ec-3"},Ee=function(){},Re=function(){function e(e){this.TAG="AV1OBUInMpegTsParser",this.current_startcode_offset_=0,this.eof_flag_=!1,this.data_=e,this.current_startcode_offset_=this.findNextStartCodeOffset(0),this.eof_flag_&&r.a.e(this.TAG,"Could not find AV1 startcode until payload end!")}return e._ebsp2rbsp=function(e){for(var t=e,i=t.byteLength,n=new Uint8Array(i),a=0,r=0;r<i;r++)r>=2&&3===t[r]&&0===t[r-1]&&0===t[r-2]||(n[a]=t[r],a++);return new Uint8Array(n.buffer,0,a)},e.prototype.findNextStartCodeOffset=function(e){for(var t=e,i=this.data_;;){if(t+2>=i.byteLength)return this.eof_flag_=!0,i.byteLength;if(1===(i[t+0]<<16|i[t+1]<<8|i[t+2]))return t;t++}},e.prototype.readNextOBUPayload=function(){for(var t=this.data_,i=null;null==i&&!this.eof_flag_;){var n=this.current_startcode_offset_+3,a=this.findNextStartCodeOffset(n);this.current_startcode_offset_=a,i=e._ebsp2rbsp(t.subarray(n,a))}return i},e}(),Te=function(){var e=function(t,i){return(e=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var i in t)Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i])})(t,i)};return function(t,i){if("function"!=typeof i&&null!==i)throw new TypeError("Class extends value "+String(i)+" is not a constructor or null");function n(){this.constructor=t}e(t,i),t.prototype=null===i?Object.create(i):(n.prototype=i.prototype,new n)}}(),Le=function(){return(Le=Object.assign||function(e){for(var t,i=1,n=arguments.length;i<n;i++)for(var a in t=arguments[i])Object.prototype.hasOwnProperty.call(t,a)&&(e[a]=t[a]);return e}).apply(this,arguments)},ke=function(e){function t(t,i){var n=e.call(this)||this;return n.TAG="TSDemuxer",n.first_parse_=!0,n.media_info_=new s.a,n.timescale_=90,n.duration_=0,n.current_pmt_pid_=-1,n.program_pmt_map_={},n.pes_slice_queues_={},n.section_slice_queues_={},n.video_metadata_={vps:void 0,sps:void 0,pps:void 0,av1c:void 0,details:void 0},n.audio_metadata_={codec:void 0,audio_object_type:void 0,sampling_freq_index:void 0,sampling_frequency:void 0,channel_config:void 0},n.last_pcr_base_=NaN,n.timestamp_offset_=0,n.audio_last_sample_pts_=void 0,n.aac_last_incomplete_data_=null,n.has_video_=!1,n.has_audio_=!1,n.video_init_segment_dispatched_=!1,n.audio_init_segment_dispatched_=!1,n.video_metadata_changed_=!1,n.audio_metadata_changed_=!1,n.loas_previous_frame=null,n.video_track_={type:"video",id:1,sequenceNumber:0,samples:[],length:0},n.audio_track_={type:"audio",id:2,sequenceNumber:0,samples:[],length:0},n.ts_packet_size_=t.ts_packet_size,n.sync_offset_=t.sync_offset,n.config_=i,n}return Te(t,e),t.prototype.destroy=function(){this.media_info_=null,this.pes_slice_queues_=null,this.section_slice_queues_=null,this.video_metadata_=null,this.audio_metadata_=null,this.aac_last_incomplete_data_=null,this.video_track_=null,this.audio_track_=null,e.prototype.destroy.call(this)},t.probe=function(e){var t=new Uint8Array(e),i=-1,n=188;if(t.byteLength<=3*n)return{needMoreData:!0};for(;-1===i;){for(var a=Math.min(1e3,t.byteLength-3*n),o=0;o<a;){if(71===t[o]&&71===t[o+n]&&71===t[o+2*n]){i=o;break}o++}if(-1===i)if(188===n)n=192;else{if(192!==n)break;n=204}}return-1===i?{match:!1}:(192===n&&i>=4?(r.a.v("TSDemuxer","ts_packet_size = 192, m2ts mode"),i-=4):204===n&&r.a.v("TSDemuxer","ts_packet_size = 204, RS encoded MPEG2-TS stream"),{match:!0,consumed:0,ts_packet_size:n,sync_offset:i})},t.prototype.bindDataSource=function(e){return e.onDataArrival=this.parseChunks.bind(this),this},t.prototype.resetMediaInfo=function(){this.media_info_=new s.a},t.prototype.parseChunks=function(e,t){if(!(this.onError&&this.onMediaInfo&&this.onTrackMetadata&&this.onDataAvailable))throw new h.a("onError & onMediaInfo & onTrackMetadata & onDataAvailable callback must be specified");var i=0;for(this.first_parse_&&(this.first_parse_=!1,i=this.sync_offset_);i+this.ts_packet_size_<=e.byteLength;){var n=t+i;192===this.ts_packet_size_&&(i+=4);var a=new Uint8Array(e,i,188),o=a[0];if(71!==o){r.a.e(this.TAG,"sync_byte = ".concat(o,", not 0x47"));break}var s=(64&a[1])>>>6,d=(a[1],(31&a[1])<<8|a[2]),_=(48&a[3])>>>4,c=15&a[3],l=!(!this.pmt_||this.pmt_.pcr_pid!==d),u={},f=4;if(2==_||3==_){var p=a[4];if(p>0&&(l||3==_))if(u.discontinuity_indicator=(128&a[5])>>>7,u.random_access_indicator=(64&a[5])>>>6,u.elementary_stream_priority_indicator=(32&a[5])>>>5,(16&a[5])>>>4){var m=300*this.getPcrBase(a)+((1&a[10])<<8|a[11]);this.last_pcr_=m}if(2==_||5+p===188){i+=188,204===this.ts_packet_size_&&(i+=16);continue}f=5+p}if(1==_||3==_)if(0===d||d===this.current_pmt_pid_||null!=this.pmt_&&this.pmt_.pid_stream_type[d]===R.kSCTE35){var g=188-f;this.handleSectionSlice(e,i+f,g,{pid:d,file_position:n,payload_unit_start_indicator:s,continuity_conunter:c,random_access_indicator:u.random_access_indicator})}else if(null!=this.pmt_&&null!=this.pmt_.pid_stream_type[d]){g=188-f;var v=this.pmt_.pid_stream_type[d];d!==this.pmt_.common_pids.h264&&d!==this.pmt_.common_pids.h265&&d!==this.pmt_.common_pids.av1&&d!==this.pmt_.common_pids.adts_aac&&d!==this.pmt_.common_pids.loas_aac&&d!==this.pmt_.common_pids.ac3&&d!==this.pmt_.common_pids.eac3&&d!==this.pmt_.common_pids.opus&&d!==this.pmt_.common_pids.mp3&&!0!==this.pmt_.pes_private_data_pids[d]&&!0!==this.pmt_.timed_id3_pids[d]&&!0!==this.pmt_.synchronous_klv_pids[d]&&!0!==this.pmt_.asynchronous_klv_pids[d]||this.handlePESSlice(e,i+f,g,{pid:d,stream_type:v,file_position:n,payload_unit_start_indicator:s,continuity_conunter:c,random_access_indicator:u.random_access_indicator})}i+=188,204===this.ts_packet_size_&&(i+=16)}return this.dispatchAudioVideoMediaSegment(),i},t.prototype.handleSectionSlice=function(e,t,i,n){var a=new Uint8Array(e,t,i),r=this.section_slice_queues_[n.pid];if(n.payload_unit_start_indicator){var o=a[0];if(null!=r&&0!==r.total_length){var s=new Uint8Array(e,t+1,Math.min(i,o));r.slices.push(s),r.total_length+=s.byteLength,r.total_length===r.expected_length?this.emitSectionSlices(r,n):this.clearSlices(r,n)}for(var d=1+o;d<a.byteLength;){if(255===a[d+0])break;var _=(15&a[d+1])<<8|a[d+2];this.section_slice_queues_[n.pid]=new O,(r=this.section_slice_queues_[n.pid]).expected_length=_+3,r.file_position=n.file_position,r.random_access_indicator=n.random_access_indicator;s=new Uint8Array(e,t+d,Math.min(i-d,r.expected_length-r.total_length));r.slices.push(s),r.total_length+=s.byteLength,r.total_length===r.expected_length?this.emitSectionSlices(r,n):r.total_length>=r.expected_length&&this.clearSlices(r,n),d+=s.byteLength}}else if(null!=r&&0!==r.total_length){s=new Uint8Array(e,t,Math.min(i,r.expected_length-r.total_length));r.slices.push(s),r.total_length+=s.byteLength,r.total_length===r.expected_length?this.emitSectionSlices(r,n):r.total_length>=r.expected_length&&this.clearSlices(r,n)}},t.prototype.handlePESSlice=function(e,t,i,n){var a=new Uint8Array(e,t,i),o=a[0]<<16|a[1]<<8|a[2],s=(a[3],a[4]<<8|a[5]);if(n.payload_unit_start_indicator){if(1!==o)return void r.a.e(this.TAG,"handlePESSlice: packet_start_code_prefix should be 1 but with value ".concat(o));var d=this.pes_slice_queues_[n.pid];d&&(0===d.expected_length||d.expected_length===d.total_length?this.emitPESSlices(d,n):this.clearSlices(d,n)),this.pes_slice_queues_[n.pid]=new O,this.pes_slice_queues_[n.pid].file_position=n.file_position,this.pes_slice_queues_[n.pid].random_access_indicator=n.random_access_indicator}if(null!=this.pes_slice_queues_[n.pid]){var _=this.pes_slice_queues_[n.pid];_.slices.push(a),n.payload_unit_start_indicator&&(_.expected_length=0===s?0:s+6),_.total_length+=a.byteLength,_.expected_length>0&&_.expected_length===_.total_length?this.emitPESSlices(_,n):_.expected_length>0&&_.expected_length<_.total_length&&this.clearSlices(_,n)}},t.prototype.emitSectionSlices=function(e,t){for(var i=new Uint8Array(e.total_length),n=0,a=0;n<e.slices.length;n++){var r=e.slices[n];i.set(r,a),a+=r.byteLength}e.slices=[],e.expected_length=-1,e.total_length=0;var o=new D;o.pid=t.pid,o.data=i,o.file_position=e.file_position,o.random_access_indicator=e.random_access_indicator,this.parseSection(o)},t.prototype.emitPESSlices=function(e,t){for(var i=new Uint8Array(e.total_length),n=0,a=0;n<e.slices.length;n++){var r=e.slices[n];i.set(r,a),a+=r.byteLength}e.slices=[],e.expected_length=-1,e.total_length=0;var o=new C;o.pid=t.pid,o.data=i,o.stream_type=t.stream_type,o.file_position=e.file_position,o.random_access_indicator=e.random_access_indicator,this.parsePES(o)},t.prototype.clearSlices=function(e,t){e.slices=[],e.expected_length=-1,e.total_length=0},t.prototype.parseSection=function(e){var t=e.data,i=e.pid;0===i?this.parsePAT(t):i===this.current_pmt_pid_?this.parsePMT(t):null!=this.pmt_&&this.pmt_.scte_35_pids[i]&&this.parseSCTE35(t)},t.prototype.parsePES=function(e){var t=e.data,i=t[0]<<16|t[1]<<8|t[2],n=t[3],a=t[4]<<8|t[5];if(1===i){if(188!==n&&190!==n&&191!==n&&240!==n&&241!==n&&255!==n&&242!==n&&248!==n){t[6];var o=(192&t[7])>>>6,s=t[8],d=void 0,_=void 0;2!==o&&3!==o||(d=this.getTimestamp(t,9),_=3===o?this.getTimestamp(t,14):d);var c=9+s,h=void 0;if(0!==a){if(a<3+s)return void r.a.v(this.TAG,"Malformed PES: PES_packet_length < 3 + PES_header_data_length");h=a-3-s}else h=t.byteLength-c;var l=t.subarray(c,c+h);switch(e.stream_type){case R.kMPEG1Audio:case R.kMPEG2Audio:this.parseMP3Payload(l,d);break;case R.kPESPrivateData:this.pmt_.common_pids.av1===e.pid?this.parseAV1Payload(l,d,_,e.file_position,e.random_access_indicator):this.pmt_.common_pids.opus===e.pid?this.parseOpusPayload(l,d):this.pmt_.common_pids.ac3===e.pid?this.parseAC3Payload(l,d):this.pmt_.common_pids.eac3===e.pid?this.parseEAC3Payload(l,d):this.pmt_.asynchronous_klv_pids[e.pid]?this.parseAsynchronousKLVMetadataPayload(l,e.pid,n):this.pmt_.smpte2038_pids[e.pid]?this.parseSMPTE2038MetadataPayload(l,d,_,e.pid,n):this.parsePESPrivateDataPayload(l,d,_,e.pid,n);break;case R.kADTSAAC:this.parseADTSAACPayload(l,d);break;case R.kLOASAAC:this.parseLOASAACPayload(l,d);break;case R.kAC3:this.parseAC3Payload(l,d);break;case R.kEAC3:this.parseEAC3Payload(l,d);break;case R.kMetadata:this.pmt_.timed_id3_pids[e.pid]?this.parseTimedID3MetadataPayload(l,d,_,e.pid,n):this.pmt_.synchronous_klv_pids[e.pid]&&this.parseSynchronousKLVMetadataPayload(l,d,_,e.pid,n);break;case R.kH264:this.parseH264Payload(l,d,_,e.file_position,e.random_access_indicator);break;case R.kH265:this.parseH265Payload(l,d,_,e.file_position,e.random_access_indicator)}}else if((188===n||191===n||240===n||241===n||255===n||242===n||248===n)&&e.stream_type===R.kPESPrivateData){c=6,h=void 0;h=0!==a?a:t.byteLength-c;l=t.subarray(c,c+h);this.parsePESPrivateDataPayload(l,void 0,void 0,e.pid,n)}}else r.a.e(this.TAG,"parsePES: packet_start_code_prefix should be 1 but with value ".concat(i))},t.prototype.parsePAT=function(e){var t=e[0];if(0===t){var i=(15&e[1])<<8|e[2],n=(e[3],e[4],(62&e[5])>>>1),a=1&e[5],o=e[6],s=(e[7],null);if(1===a&&0===o)(s=new k).version_number=n;else if(null==(s=this.pat_))return;for(var d=i-5-4,_=-1,c=-1,h=8;h<8+d;h+=4){var l=e[h]<<8|e[h+1],u=(31&e[h+2])<<8|e[h+3];0===l?s.network_pid=u:(s.program_pmt_pid[l]=u,-1===_&&(_=l),-1===c&&(c=u))}1===a&&0===o&&(null==this.pat_&&r.a.v(this.TAG,"Parsed first PAT: ".concat(JSON.stringify(s))),this.pat_=s,this.current_program_=_,this.current_pmt_pid_=c)}else r.a.e(this.TAG,"parsePAT: table_id ".concat(t," is not corresponded to PAT!"))},t.prototype.parsePMT=function(e){var t=e[0];if(2===t){var i=(15&e[1])<<8|e[2],n=e[3]<<8|e[4],a=(62&e[5])>>>1,o=1&e[5],s=e[6],d=(e[7],null);if(1===o&&0===s)(d=new M).program_number=n,d.version_number=a,this.program_pmt_map_[n]=d;else if(null==(d=this.program_pmt_map_[n]))return;d.pcr_pid=(31&e[8])<<8|e[9];for(var _=(15&e[10])<<8|e[11],c=12+_,h=i-9-_-4,l=c;l<c+h;){var u=e[l],f=(31&e[l+1])<<8|e[l+2],p=(15&e[l+3])<<8|e[l+4];d.pid_stream_type[f]=u;var m=d.common_pids.h264||d.common_pids.h265,g=d.common_pids.adts_aac||d.common_pids.loas_aac||d.common_pids.ac3||d.common_pids.eac3||d.common_pids.opus||d.common_pids.mp3;if(u!==R.kH264||m)if(u!==R.kH265||m)if(u!==R.kADTSAAC||g)if(u!==R.kLOASAAC||g)if(u!==R.kAC3||g)if(u!==R.kEAC3||g)if(u!==R.kMPEG1Audio&&u!==R.kMPEG2Audio||g)if(u===R.kPESPrivateData){if(d.pes_private_data_pids[f]=!0,p>0){for(var v=l+5;v<l+5+p;){var y=e[v+0],S=e[v+1];if(5===y){var b=String.fromCharCode.apply(String,Array.from(e.subarray(v+2,v+2+S)));"VANC"===b?d.smpte2038_pids[f]=!0:"AV01"===b?d.common_pids.av1=f:"Opus"===b?d.common_pids.opus=f:"KLVA"===b&&(d.asynchronous_klv_pids[f]=!0)}else if(127===y){if(f===d.common_pids.opus){var A=null;if(128===e[v+2]&&(A=e[v+3]),null==A){r.a.e(this.TAG,"Not Supported Opus channel count.");continue}var E={codec:"opus",channel_count:0==(15&A)?2:15&A,channel_config_code:A,sample_rate:48e3},T={codec:"opus",meta:E};0==this.audio_init_segment_dispatched_?(this.audio_metadata_=E,this.dispatchAudioInitSegment(T)):this.detectAudioMetadataChange(T)&&(this.dispatchAudioMediaSegment(),this.dispatchAudioInitSegment(T))}}else 128===y&&f===d.common_pids.av1&&(this.video_metadata_.av1c=e.subarray(v+2,v+2+S));v+=2+S}var L=e.subarray(l+5,l+5+p);this.dispatchPESPrivateDataDescriptor(f,u,L)}}else if(u===R.kMetadata){if(p>0)for(v=l+5;v<l+5+p;){y=e[v+0];var k=e[v+1];if(38===y){var w=e[v+2]<<8|e[v+3]<<0,C=null;65535===w&&(C=String.fromCharCode.apply(String,Array.from(e.subarray(v+4,v+4+4))));var D=null;if(255===e[v+4+(65535===w?4:0)]){var O=4+(65535===w?4:0)+1;D=String.fromCharCode.apply(String,Array.from(e.subarray(v+O,v+O+4)))}"ID3 "===C&&"ID3 "===D?d.timed_id3_pids[f]=!0:"KLVA"===D&&(d.synchronous_klv_pids[f]=!0)}v+=2+k}}else u===R.kSCTE35&&(d.scte_35_pids[f]=!0);else d.common_pids.mp3=f;else d.common_pids.eac3=f;else d.common_pids.ac3=f;else d.common_pids.loas_aac=f;else d.common_pids.adts_aac=f;else d.common_pids.h265=f;else d.common_pids.h264=f;l+=5+p}n===this.current_program_&&(null==this.pmt_&&r.a.v(this.TAG,"Parsed first PMT: ".concat(JSON.stringify(d))),this.pmt_=d,(d.common_pids.h264||d.common_pids.h265||d.common_pids.av1)&&(this.has_video_=!0),(d.common_pids.adts_aac||d.common_pids.loas_aac||d.common_pids.ac3||d.common_pids.opus||d.common_pids.mp3)&&(this.has_audio_=!0))}else r.a.e(this.TAG,"parsePMT: table_id ".concat(t," is not corresponded to PMT!"))},t.prototype.parseSCTE35=function(e){var t=_e(e);if(null!=t.pts){var i=Math.floor(t.pts/this.timescale_);t.pts=i}else t.nearest_pts=this.getNearestTimestampMilliseconds();this.onSCTE35Metadata&&this.onSCTE35Metadata(t)},t.prototype.parseAV1Payload=function(e,t,i,n,a){for(var r=new Re(e),o=null,s=[],d=0,_=!1,c=null;null!=(o=r.readNextOBUPayload());){if((c=E.parseOBUs(o,this.video_metadata_.details))&&!0===c.keyframe)if(this.video_init_segment_dispatched_){if(!0===this.detectVideoMetadataChange(null,c)){var h;this.video_metadata_changed_=!0,this.dispatchVideoMediaSegment(),(h=new Uint8Array(new ArrayBuffer(this.video_metadata_.av1c.byteLength+c.sequence_header_data.byteLength))).set(this.video_metadata_.av1c,0),h.set(c.sequence_header_data,this.video_metadata_.av1c.byteLength),c.av1c=h,this.dispatchVideoInitSegment()}}else(h=new Uint8Array(new ArrayBuffer(this.video_metadata_.av1c.byteLength+c.sequence_header_data.byteLength))).set(this.video_metadata_.av1c,0),h.set(c.sequence_header_data,this.video_metadata_.av1c.byteLength),c.av1c=h,this.video_metadata_.details=c,this.dispatchVideoInitSegment();this.video_metadata_.details=c,_||(_=c.keyframe),s.push({data:o}),d+=o.byteLength}var l=Math.floor(t/this.timescale_),u=Math.floor(i/this.timescale_);if(s.length){var f=this.video_track_,p={units:s,length:d,isKeyframe:_,dts:u,pts:l,cts:l-u,file_position:n};f.samples.push(p),f.length+=d}},t.prototype.parseH264Payload=function(e,t,i,n,a){for(var o=new U(e),s=null,d=[],_=0,c=!1;null!=(s=o.readNextNaluPayload());){var h=new x(s);if(h.type===w.kSliceSPS){var l=p.parseSPS(s.data);this.video_init_segment_dispatched_?!0===this.detectVideoMetadataChange(h,l)&&(r.a.v(this.TAG,"H264: Critical h264 metadata has been changed, attempt to re-generate InitSegment"),this.video_metadata_changed_=!0,this.video_metadata_={vps:void 0,sps:h,pps:void 0,av1c:void 0,details:l}):(this.video_metadata_.sps=h,this.video_metadata_.details=l)}else h.type===w.kSlicePPS?this.video_init_segment_dispatched_&&!this.video_metadata_changed_||(this.video_metadata_.pps=h,this.video_metadata_.sps&&this.video_metadata_.pps&&(this.video_metadata_changed_&&this.dispatchVideoMediaSegment(),this.dispatchVideoInitSegment())):(h.type===w.kSliceIDR||h.type===w.kSliceNonIDR&&1===a)&&(c=!0);this.video_init_segment_dispatched_&&(d.push(h),_+=h.data.byteLength)}var u=Math.floor(t/this.timescale_),f=Math.floor(i/this.timescale_);if(d.length){var m=this.video_track_,g={units:d,length:_,isKeyframe:c,dts:f,pts:u,cts:u-f,file_position:n};m.samples.push(g),m.length+=_}},t.prototype.parseH265Payload=function(e,t,i,n,a){for(var o=new le(e),s=null,d=[],_=0,c=!1;null!=(s=o.readNextNaluPayload());){var h=new he(s);if(h.type===Q.kSliceVPS){if(!this.video_init_segment_dispatched_){var l=g.parseVPS(s.data);this.video_metadata_.vps=h,this.video_metadata_.details=Le(Le({},this.video_metadata_.details),l)}}else if(h.type===Q.kSliceSPS){l=g.parseSPS(s.data);this.video_init_segment_dispatched_?!0===this.detectVideoMetadataChange(h,l)&&(r.a.v(this.TAG,"H265: Critical h265 metadata has been changed, attempt to re-generate InitSegment"),this.video_metadata_changed_=!0,this.video_metadata_={vps:void 0,sps:h,pps:void 0,av1c:void 0,details:l}):(this.video_metadata_.sps=h,this.video_metadata_.details=Le(Le({},this.video_metadata_.details),l))}else if(h.type===Q.kSlicePPS){if(!this.video_init_segment_dispatched_||this.video_metadata_changed_){l=g.parsePPS(s.data);this.video_metadata_.pps=h,this.video_metadata_.details=Le(Le({},this.video_metadata_.details),l),this.video_metadata_.vps&&this.video_metadata_.sps&&this.video_metadata_.pps&&(this.video_metadata_changed_&&this.dispatchVideoMediaSegment(),this.dispatchVideoInitSegment())}}else h.type!==Q.kSliceIDR_W_RADL&&h.type!==Q.kSliceIDR_N_LP&&h.type!==Q.kSliceCRA_NUT||(c=!0);this.video_init_segment_dispatched_&&(d.push(h),_+=h.data.byteLength)}var u=Math.floor(t/this.timescale_),f=Math.floor(i/this.timescale_);if(d.length){var p=this.video_track_,m={units:d,length:_,isKeyframe:c,dts:f,pts:u,cts:u-f,file_position:n};p.samples.push(m),p.length+=_}},t.prototype.detectVideoMetadataChange=function(e,t){if(t.codec_mimetype!==this.video_metadata_.details.codec_mimetype)return r.a.v(this.TAG,"Video: Codec mimeType changed from "+"".concat(this.video_metadata_.details.codec_mimetype," to ").concat(t.codec_mimetype)),!0;if(t.codec_size.width!==this.video_metadata_.details.codec_size.width||t.codec_size.height!==this.video_metadata_.details.codec_size.height){var i=this.video_metadata_.details.codec_size,n=t.codec_size;return r.a.v(this.TAG,"Video: Coded Resolution changed from "+"".concat(i.width,"x").concat(i.height," to ").concat(n.width,"x").concat(n.height)),!0}return t.present_size.width!==this.video_metadata_.details.present_size.width&&(r.a.v(this.TAG,"Video: Present resolution width changed from "+"".concat(this.video_metadata_.details.present_size.width," to ").concat(t.present_size.width)),!0)},t.prototype.isInitSegmentDispatched=function(){return this.has_video_&&this.has_audio_?this.video_init_segment_dispatched_&&this.audio_init_segment_dispatched_:this.has_video_&&!this.has_audio_?this.video_init_segment_dispatched_:!(this.has_video_||!this.has_audio_)&&this.audio_init_segment_dispatched_},t.prototype.dispatchVideoInitSegment=function(){var e=this.video_metadata_.details,t={type:"video"};t.id=this.video_track_.id,t.timescale=1e3,t.duration=this.duration_,t.codecWidth=e.codec_size.width,t.codecHeight=e.codec_size.height,t.presentWidth=e.present_size.width,t.presentHeight=e.present_size.height,t.profile=e.profile_string,t.level=e.level_string,t.bitDepth=e.bit_depth,t.chromaFormat=e.chroma_format,t.sarRatio=e.sar_ratio,t.frameRate=e.frame_rate;var i=t.frameRate.fps_den,n=t.frameRate.fps_num;if(t.refSampleDuration=i/n*1e3,t.codec=e.codec_mimetype,this.video_metadata_.av1c)t.av1c=this.video_metadata_.av1c,0==this.video_init_segment_dispatched_&&r.a.v(this.TAG,"Generated first AV1 for mimeType: ".concat(t.codec));else if(this.video_metadata_.vps){var a=this.video_metadata_.vps.data.subarray(4),o=this.video_metadata_.sps.data.subarray(4),s=this.video_metadata_.pps.data.subarray(4),d=new ue(a,o,s,e);t.hvcc=d.getData(),0==this.video_init_segment_dispatched_&&r.a.v(this.TAG,"Generated first HEVCDecoderConfigurationRecord for mimeType: ".concat(t.codec))}else{o=this.video_metadata_.sps.data.subarray(4),s=this.video_metadata_.pps.data.subarray(4);var _=new N(o,s,e);t.avcc=_.getData(),0==this.video_init_segment_dispatched_&&r.a.v(this.TAG,"Generated first AVCDecoderConfigurationRecord for mimeType: ".concat(t.codec))}this.onTrackMetadata("video",t),this.video_init_segment_dispatched_=!0,this.video_metadata_changed_=!1;var c=this.media_info_;c.hasVideo=!0,c.width=t.codecWidth,c.height=t.codecHeight,c.fps=t.frameRate.fps,c.profile=t.profile,c.level=t.level,c.refFrames=e.ref_frames,c.chromaFormat=e.chroma_format_string,c.sarNum=t.sarRatio.width,c.sarDen=t.sarRatio.height,c.videoCodec=t.codec,c.hasAudio&&c.audioCodec?c.mimeType='video/mp2t; codecs="'.concat(c.videoCodec,",").concat(c.audioCodec,'"'):c.mimeType='video/mp2t; codecs="'.concat(c.videoCodec,'"'),c.isComplete()&&this.onMediaInfo(c)},t.prototype.dispatchVideoMediaSegment=function(){this.isInitSegmentDispatched()&&this.video_track_.length&&this.onDataAvailable(null,this.video_track_)},t.prototype.dispatchAudioMediaSegment=function(){this.isInitSegmentDispatched()&&this.audio_track_.length&&this.onDataAvailable(this.audio_track_,null)},t.prototype.dispatchAudioVideoMediaSegment=function(){this.isInitSegmentDispatched()&&(this.audio_track_.length||this.video_track_.length)&&this.onDataAvailable(this.audio_track_,this.video_track_)},t.prototype.parseADTSAACPayload=function(e,t){if(!this.has_video_||this.video_init_segment_dispatched_){if(this.aac_last_incomplete_data_){var i=new Uint8Array(e.byteLength+this.aac_last_incomplete_data_.byteLength);i.set(this.aac_last_incomplete_data_,0),i.set(e,this.aac_last_incomplete_data_.byteLength),e=i}var n,a;if(null!=t&&(a=t/this.timescale_),"aac"===this.audio_metadata_.codec){if(null==t&&null!=this.audio_last_sample_pts_)n=1024/this.audio_metadata_.sampling_frequency*1e3,a=this.audio_last_sample_pts_+n;else if(null==t)return void r.a.w(this.TAG,"AAC: Unknown pts");if(this.aac_last_incomplete_data_&&this.audio_last_sample_pts_){n=1024/this.audio_metadata_.sampling_frequency*1e3;var o=this.audio_last_sample_pts_+n;Math.abs(o-a)>1&&(r.a.w(this.TAG,"AAC: Detected pts overlapped, "+"expected: ".concat(o,"ms, PES pts: ").concat(a,"ms")),a=o)}}for(var s,d=new q(e),_=null,c=a;null!=(_=d.readNextAACFrame());){n=1024/_.sampling_frequency*1e3;var h={codec:"aac",data:_};0==this.audio_init_segment_dispatched_?(this.audio_metadata_={codec:"aac",audio_object_type:_.audio_object_type,sampling_freq_index:_.sampling_freq_index,sampling_frequency:_.sampling_frequency,channel_config:_.channel_config},this.dispatchAudioInitSegment(h)):this.detectAudioMetadataChange(h)&&(this.dispatchAudioMediaSegment(),this.dispatchAudioInitSegment(h)),s=c;var l=Math.floor(c),u={unit:_.data,length:_.data.byteLength,pts:l,dts:l};this.audio_track_.samples.push(u),this.audio_track_.length+=_.data.byteLength,c+=n}d.hasIncompleteData()&&(this.aac_last_incomplete_data_=d.getIncompleteData()),s&&(this.audio_last_sample_pts_=s)}},t.prototype.parseLOASAACPayload=function(e,t){var i;if(!this.has_video_||this.video_init_segment_dispatched_){if(this.aac_last_incomplete_data_){var n=new Uint8Array(e.byteLength+this.aac_last_incomplete_data_.byteLength);n.set(this.aac_last_incomplete_data_,0),n.set(e,this.aac_last_incomplete_data_.byteLength),e=n}var a,o;if(null!=t&&(o=t/this.timescale_),"aac"===this.audio_metadata_.codec){if(null==t&&null!=this.audio_last_sample_pts_)a=1024/this.audio_metadata_.sampling_frequency*1e3,o=this.audio_last_sample_pts_+a;else if(null==t)return void r.a.w(this.TAG,"AAC: Unknown pts");if(this.aac_last_incomplete_data_&&this.audio_last_sample_pts_){a=1024/this.audio_metadata_.sampling_frequency*1e3;var s=this.audio_last_sample_pts_+a;Math.abs(s-o)>1&&(r.a.w(this.TAG,"AAC: Detected pts overlapped, "+"expected: ".concat(s,"ms, PES pts: ").concat(o,"ms")),o=s)}}for(var d,_=new K(e),c=null,h=o;null!=(c=_.readNextAACFrame(null!==(i=this.loas_previous_frame)&&void 0!==i?i:void 0));){this.loas_previous_frame=c,a=1024/c.sampling_frequency*1e3;var l={codec:"aac",data:c};0==this.audio_init_segment_dispatched_?(this.audio_metadata_={codec:"aac",audio_object_type:c.audio_object_type,sampling_freq_index:c.sampling_freq_index,sampling_frequency:c.sampling_frequency,channel_config:c.channel_config},this.dispatchAudioInitSegment(l)):this.detectAudioMetadataChange(l)&&(this.dispatchAudioMediaSegment(),this.dispatchAudioInitSegment(l)),d=h;var u=Math.floor(h),f={unit:c.data,length:c.data.byteLength,pts:u,dts:u};this.audio_track_.samples.push(f),this.audio_track_.length+=c.data.byteLength,h+=a}_.hasIncompleteData()&&(this.aac_last_incomplete_data_=_.getIncompleteData()),d&&(this.audio_last_sample_pts_=d)}},t.prototype.parseAC3Payload=function(e,t){if(!this.has_video_||this.video_init_segment_dispatched_){var i,n;if(null!=t&&(n=t/this.timescale_),"ac-3"===this.audio_metadata_.codec)if(null==t&&null!=this.audio_last_sample_pts_)i=1536/this.audio_metadata_.sampling_frequency*1e3,n=this.audio_last_sample_pts_+i;else if(null==t)return void r.a.w(this.TAG,"AC3: Unknown pts");for(var a,o=new ve(e),s=null,d=n;null!=(s=o.readNextAC3Frame());){i=1536/s.sampling_frequency*1e3;var _={codec:"ac-3",data:s};0==this.audio_init_segment_dispatched_?(this.audio_metadata_={codec:"ac-3",sampling_frequency:s.sampling_frequency,bit_stream_identification:s.bit_stream_identification,bit_stream_mode:s.bit_stream_mode,low_frequency_effects_channel_on:s.low_frequency_effects_channel_on,channel_mode:s.channel_mode},this.dispatchAudioInitSegment(_)):this.detectAudioMetadataChange(_)&&(this.dispatchAudioMediaSegment(),this.dispatchAudioInitSegment(_)),a=d;var c=Math.floor(d),h={unit:s.data,length:s.data.byteLength,pts:c,dts:c};this.audio_track_.samples.push(h),this.audio_track_.length+=s.data.byteLength,d+=i}a&&(this.audio_last_sample_pts_=a)}},t.prototype.parseEAC3Payload=function(e,t){if(!this.has_video_||this.video_init_segment_dispatched_){var i,n;if(null!=t&&(n=t/this.timescale_),"ec-3"===this.audio_metadata_.codec)if(null==t&&null!=this.audio_last_sample_pts_)i=256*this.audio_metadata_.num_blks/this.audio_metadata_.sampling_frequency*1e3,n=this.audio_last_sample_pts_+i;else if(null==t)return void r.a.w(this.TAG,"EAC3: Unknown pts");for(var a,o=new be(e),s=null,d=n;null!=(s=o.readNextEAC3Frame());){i=1536/s.sampling_frequency*1e3;var _={codec:"ec-3",data:s};0==this.audio_init_segment_dispatched_?(this.audio_metadata_={codec:"ec-3",sampling_frequency:s.sampling_frequency,bit_stream_identification:s.bit_stream_identification,low_frequency_effects_channel_on:s.low_frequency_effects_channel_on,num_blks:s.num_blks,channel_mode:s.channel_mode},this.dispatchAudioInitSegment(_)):this.detectAudioMetadataChange(_)&&(this.dispatchAudioMediaSegment(),this.dispatchAudioInitSegment(_)),a=d;var c=Math.floor(d),h={unit:s.data,length:s.data.byteLength,pts:c,dts:c};this.audio_track_.samples.push(h),this.audio_track_.length+=s.data.byteLength,d+=i}a&&(this.audio_last_sample_pts_=a)}},t.prototype.parseOpusPayload=function(e,t){if(!this.has_video_||this.video_init_segment_dispatched_){var i,n;if(null!=t&&(n=t/this.timescale_),"opus"===this.audio_metadata_.codec)if(null==t&&null!=this.audio_last_sample_pts_)i=20,n=this.audio_last_sample_pts_+i;else if(null==t)return void r.a.w(this.TAG,"Opus: Unknown pts");for(var a,o=n,s=0;s<e.length;){i=20;for(var d=0!=(16&e[s+1]),_=0!=(8&e[s+1]),c=s+2,h=0;255===e[c];)h+=255,c+=1;h+=e[c],c+=1,c+=d?2:0,c+=_?2:0,a=o;var l=Math.floor(o),u=e.slice(c,c+h),f={unit:u,length:u.byteLength,pts:l,dts:l};this.audio_track_.samples.push(f),this.audio_track_.length+=u.byteLength,o+=i,s=c+h}a&&(this.audio_last_sample_pts_=a)}},t.prototype.parseMP3Payload=function(e,t){if(!this.has_video_||this.video_init_segment_dispatched_){var i=[0,32,64,96,128,160,192,224,256,288,320,352,384,416,448,-1],n=[0,32,48,56,64,80,96,112,128,160,192,224,256,320,384,-1],a=[0,32,40,48,56,64,80,96,112,128,160,192,224,256,320,-1],r=e[1]>>>3&3,o=(6&e[1])>>1,s=(240&e[2])>>>4,d=(12&e[2])>>>2,_=3!==(e[3]>>>6&3)?2:1,c=0,h=34;switch(r){case 0:c=[11025,12e3,8e3,0][d];break;case 2:c=[22050,24e3,16e3,0][d];break;case 3:c=[44100,48e3,32e3,0][d]}switch(o){case 1:h=34,s<a.length&&a[s];break;case 2:h=33,s<n.length&&n[s];break;case 3:h=32,s<i.length&&i[s]}var l=new pe;l.object_type=h,l.sample_rate=c,l.channel_count=_,l.data=e;var u={codec:"mp3",data:l};0==this.audio_init_segment_dispatched_?(this.audio_metadata_={codec:"mp3",object_type:h,sample_rate:c,channel_count:_},this.dispatchAudioInitSegment(u)):this.detectAudioMetadataChange(u)&&(this.dispatchAudioMediaSegment(),this.dispatchAudioInitSegment(u));var f={unit:e,length:e.byteLength,pts:t/this.timescale_,dts:t/this.timescale_};this.audio_track_.samples.push(f),this.audio_track_.length+=e.byteLength}},t.prototype.detectAudioMetadataChange=function(e){if(e.codec!==this.audio_metadata_.codec)return r.a.v(this.TAG,"Audio: Audio Codecs changed from "+"".concat(this.audio_metadata_.codec," to ").concat(e.codec)),!0;if("aac"===e.codec&&"aac"===this.audio_metadata_.codec){if((t=e.data).audio_object_type!==this.audio_metadata_.audio_object_type)return r.a.v(this.TAG,"AAC: AudioObjectType changed from "+"".concat(this.audio_metadata_.audio_object_type," to ").concat(t.audio_object_type)),!0;if(t.sampling_freq_index!==this.audio_metadata_.sampling_freq_index)return r.a.v(this.TAG,"AAC: SamplingFrequencyIndex changed from "+"".concat(this.audio_metadata_.sampling_freq_index," to ").concat(t.sampling_freq_index)),!0;if(t.channel_config!==this.audio_metadata_.channel_config)return r.a.v(this.TAG,"AAC: Channel configuration changed from "+"".concat(this.audio_metadata_.channel_config," to ").concat(t.channel_config)),!0}else if("ac-3"===e.codec&&"ac-3"===this.audio_metadata_.codec){var t;if((t=e.data).sampling_frequency!==this.audio_metadata_.sampling_frequency)return r.a.v(this.TAG,"AC3: Sampling Frequency changed from "+"".concat(this.audio_metadata_.sampling_frequency," to ").concat(t.sampling_frequency)),!0;if(t.bit_stream_identification!==this.audio_metadata_.bit_stream_identification)return r.a.v(this.TAG,"AC3: Bit Stream Identification changed from "+"".concat(this.audio_metadata_.bit_stream_identification," to ").concat(t.bit_stream_identification)),!0;if(t.bit_stream_mode!==this.audio_metadata_.bit_stream_mode)return r.a.v(this.TAG,"AC3: BitStream Mode changed from "+"".concat(this.audio_metadata_.bit_stream_mode," to ").concat(t.bit_stream_mode)),!0;if(t.channel_mode!==this.audio_metadata_.channel_mode)return r.a.v(this.TAG,"AC3: Channel Mode changed from "+"".concat(this.audio_metadata_.channel_mode," to ").concat(t.channel_mode)),!0;if(t.low_frequency_effects_channel_on!==this.audio_metadata_.low_frequency_effects_channel_on)return r.a.v(this.TAG,"AC3: Low Frequency Effects Channel On changed from "+"".concat(this.audio_metadata_.low_frequency_effects_channel_on," to ").concat(t.low_frequency_effects_channel_on)),!0}else if("opus"===e.codec&&"opus"===this.audio_metadata_.codec){if((i=e.meta).sample_rate!==this.audio_metadata_.sample_rate)return r.a.v(this.TAG,"Opus: SamplingFrequencyIndex changed from "+"".concat(this.audio_metadata_.sample_rate," to ").concat(i.sample_rate)),!0;if(i.channel_count!==this.audio_metadata_.channel_count)return r.a.v(this.TAG,"Opus: Channel count changed from "+"".concat(this.audio_metadata_.channel_count," to ").concat(i.channel_count)),!0}else if("mp3"===e.codec&&"mp3"===this.audio_metadata_.codec){var i;if((i=e.data).object_type!==this.audio_metadata_.object_type)return r.a.v(this.TAG,"MP3: AudioObjectType changed from "+"".concat(this.audio_metadata_.object_type," to ").concat(i.object_type)),!0;if(i.sample_rate!==this.audio_metadata_.sample_rate)return r.a.v(this.TAG,"MP3: SamplingFrequencyIndex changed from "+"".concat(this.audio_metadata_.sample_rate," to ").concat(i.sample_rate)),!0;if(i.channel_count!==this.audio_metadata_.channel_count)return r.a.v(this.TAG,"MP3: Channel count changed from "+"".concat(this.audio_metadata_.channel_count," to ").concat(i.channel_count)),!0}return!1},t.prototype.dispatchAudioInitSegment=function(e){var t={type:"audio"};if(t.id=this.audio_track_.id,t.timescale=1e3,t.duration=this.duration_,"aac"===this.audio_metadata_.codec){var i="aac"===e.codec?e.data:null,n=new W(i);t.audioSampleRate=n.sampling_rate,t.channelCount=n.channel_count,t.codec=n.codec_mimetype,t.originalCodec=n.original_codec_mimetype,t.config=n.config,t.refSampleDuration=1024/t.audioSampleRate*t.timescale}else if("ac-3"===this.audio_metadata_.codec){var a="ac-3"===e.codec?e.data:null,o=new ye(a);t.audioSampleRate=o.sampling_rate,t.channelCount=o.channel_count,t.codec=o.codec_mimetype,t.originalCodec=o.original_codec_mimetype,t.config=o.config,t.refSampleDuration=1536/t.audioSampleRate*t.timescale}else if("ec-3"===this.audio_metadata_.codec){var s="ec-3"===e.codec?e.data:null,d=new Ae(s);t.audioSampleRate=d.sampling_rate,t.channelCount=d.channel_count,t.codec=d.codec_mimetype,t.originalCodec=d.original_codec_mimetype,t.config=d.config,t.refSampleDuration=256*d.num_blks/t.audioSampleRate*t.timescale}else"opus"===this.audio_metadata_.codec?(t.audioSampleRate=this.audio_metadata_.sample_rate,t.channelCount=this.audio_metadata_.channel_count,t.channelConfigCode=this.audio_metadata_.channel_config_code,t.codec="opus",t.originalCodec="opus",t.config=void 0,t.refSampleDuration=20):"mp3"===this.audio_metadata_.codec&&(t.audioSampleRate=this.audio_metadata_.sample_rate,t.channelCount=this.audio_metadata_.channel_count,t.codec="mp3",t.originalCodec="mp3",t.config=void 0);0==this.audio_init_segment_dispatched_&&r.a.v(this.TAG,"Generated first AudioSpecificConfig for mimeType: ".concat(t.codec)),this.onTrackMetadata("audio",t),this.audio_init_segment_dispatched_=!0,this.video_metadata_changed_=!1;var _=this.media_info_;_.hasAudio=!0,_.audioCodec=t.originalCodec,_.audioSampleRate=t.audioSampleRate,_.audioChannelCount=t.channelCount,_.hasVideo&&_.videoCodec?_.mimeType='video/mp2t; codecs="'.concat(_.videoCodec,",").concat(_.audioCodec,'"'):_.mimeType='video/mp2t; codecs="'.concat(_.audioCodec,'"'),_.isComplete()&&this.onMediaInfo(_)},t.prototype.dispatchPESPrivateDataDescriptor=function(e,t,i){var n=new X;n.pid=e,n.stream_type=t,n.descriptor=i,this.onPESPrivateDataDescriptor&&this.onPESPrivateDataDescriptor(n)},t.prototype.parsePESPrivateDataPayload=function(e,t,i,n,a){var r=new Y;if(r.pid=n,r.stream_id=a,r.len=e.byteLength,r.data=e,null!=t){var o=Math.floor(t/this.timescale_);r.pts=o}else r.nearest_pts=this.getNearestTimestampMilliseconds();if(null!=i){var s=Math.floor(i/this.timescale_);r.dts=s}this.onPESPrivateData&&this.onPESPrivateData(r)},t.prototype.parseTimedID3MetadataPayload=function(e,t,i,n,a){var r=new Y;if(r.pid=n,r.stream_id=a,r.len=e.byteLength,r.data=e,null!=t){var o=Math.floor(t/this.timescale_);r.pts=o}if(null!=i){var s=Math.floor(i/this.timescale_);r.dts=s}this.onTimedID3Metadata&&this.onTimedID3Metadata(r)},t.prototype.parseSynchronousKLVMetadataPayload=function(e,t,i,n,a){var r=new Ee;if(r.pid=n,r.stream_id=a,r.len=e.byteLength,r.data=e,null!=t){var o=Math.floor(t/this.timescale_);r.pts=o}if(null!=i){var s=Math.floor(i/this.timescale_);r.dts=s}r.access_units=function(e){for(var t=[],i=0;i+5<e.byteLength;){var n=e[i+0],a=e[i+1],r=e[i+2],o=e[i+3]<<8|e[i+4]<<0,s=e.slice(i+5,i+5+o);t.push({service_id:n,sequence_number:a,flags:r,data:s}),i+=5+o}return t}(e),this.onSynchronousKLVMetadata&&this.onSynchronousKLVMetadata(r)},t.prototype.parseAsynchronousKLVMetadataPayload=function(e,t,i){var n=new Y;n.pid=t,n.stream_id=i,n.len=e.byteLength,n.data=e,this.onAsynchronousKLVMetadata&&this.onAsynchronousKLVMetadata(n)},t.prototype.parseSMPTE2038MetadataPayload=function(e,t,i,n,a){var r=new fe;if(r.pid=n,r.stream_id=a,r.len=e.byteLength,r.data=e,null!=t){var o=Math.floor(t/this.timescale_);r.pts=o}if(r.nearest_pts=this.getNearestTimestampMilliseconds(),null!=i){var s=Math.floor(i/this.timescale_);r.dts=s}r.ancillaries=function(e){for(var t=new f(e),i=0,n=[];;){if(i+=6,0!==t.readBits(6))break;var a=t.readBool();i+=1;var r=t.readBits(11);i+=11;var o=t.readBits(12);i+=12;var s=255&t.readBits(10);i+=10;var d=255&t.readBits(10);i+=10;var _=255&t.readBits(10);i+=10;for(var c=new Uint8Array(_),h=0;h<_;h++){var l=255&t.readBits(10);i+=10,c[h]=l}t.readBits(10);i+=10;var u="User Defined";65===s?7===d&&(u="SCTE-104"):95===s?220===d?u="ARIB STD-B37 (1SEG)":221===d?u="ARIB STD-B37 (ANALOG)":222===d?u="ARIB STD-B37 (SD)":223===d&&(u="ARIB STD-B37 (HD)"):97===s&&(1===d?u="EIA-708":2===d&&(u="EIA-608")),n.push({yc_indicator:a,line_number:r,horizontal_offset:o,did:s,sdid:d,user_data:c,description:u,information:{}}),t.readBits(8-(i-Math.floor(i/8))%8),i+=(8-(i-Math.floor(i/8)))%8}return t.destroy(),t=null,n}(e),this.onSMPTE2038Metadata&&this.onSMPTE2038Metadata(r)},t.prototype.getNearestTimestampMilliseconds=function(){return null!=this.audio_last_sample_pts_?Math.floor(this.audio_last_sample_pts_):null!=this.last_pcr_?Math.floor(this.last_pcr_/300/this.timescale_):void 0},t.prototype.getPcrBase=function(e){var t=33554432*e[6]+131072*e[7]+512*e[8]+2*e[9]+(128&e[10])/128+this.timestamp_offset_;return t+4294967296<this.last_pcr_base_&&(t+=8589934592,this.timestamp_offset_+=8589934592),this.last_pcr_base_=t,t},t.prototype.getTimestamp=function(e,t){var i=536870912*(14&e[t])+4194304*(255&e[t+1])+16384*(254&e[t+2])+128*(255&e[t+3])+(254&e[t+4])/2+this.timestamp_offset_;return i+4294967296<this.last_pcr_base_&&(i+=8589934592),i},t}(L),we=function(e,t,i){if(i||2===arguments.length)for(var n,a=0,r=t.length;a<r;a++)!n&&a in t||(n||(n=Array.prototype.slice.call(t,0,a)),n[a]=t[a]);return e.concat(n||Array.prototype.slice.call(t))},Me=function(){function e(){}return e.init=function(){for(var t in e.types={avc1:[],avcC:[],btrt:[],dinf:[],dref:[],esds:[],ftyp:[],hdlr:[],hvc1:[],hvcC:[],av01:[],av1C:[],mdat:[],mdhd:[],mdia:[],mfhd:[],minf:[],moof:[],moov:[],mp4a:[],mvex:[],mvhd:[],sdtp:[],stbl:[],stco:[],stsc:[],stsd:[],stsz:[],stts:[],tfdt:[],tfhd:[],traf:[],trak:[],trun:[],trex:[],tkhd:[],vmhd:[],smhd:[],".mp3":[],Opus:[],dOps:[],"ac-3":[],dac3:[],"ec-3":[],dec3:[],fLaC:[],dfLa:[]},e.types)e.types.hasOwnProperty(t)&&(e.types[t]=[t.charCodeAt(0),t.charCodeAt(1),t.charCodeAt(2),t.charCodeAt(3)]);var i=e.constants={};i.FTYP=new Uint8Array([105,115,111,109,0,0,0,1,105,115,111,109,97,118,99,49]),i.STSD_PREFIX=new Uint8Array([0,0,0,0,0,0,0,1]),i.STTS=new Uint8Array([0,0,0,0,0,0,0,0]),i.STSC=i.STCO=i.STTS,i.STSZ=new Uint8Array([0,0,0,0,0,0,0,0,0,0,0,0]),i.HDLR_VIDEO=new Uint8Array([0,0,0,0,0,0,0,0,118,105,100,101,0,0,0,0,0,0,0,0,0,0,0,0,86,105,100,101,111,72,97,110,100,108,101,114,0]),i.HDLR_AUDIO=new Uint8Array([0,0,0,0,0,0,0,0,115,111,117,110,0,0,0,0,0,0,0,0,0,0,0,0,83,111,117,110,100,72,97,110,100,108,101,114,0]),i.DREF=new Uint8Array([0,0,0,0,0,0,0,1,0,0,0,12,117,114,108,32,0,0,0,1]),i.SMHD=new Uint8Array([0,0,0,0,0,0,0,0]),i.VMHD=new Uint8Array([0,0,0,1,0,0,0,0,0,0,0,0])},e.box=function(e){for(var t=8,i=null,n=Array.prototype.slice.call(arguments,1),a=n.length,r=0;r<a;r++)t+=n[r].byteLength;(i=new Uint8Array(t))[0]=t>>>24&255,i[1]=t>>>16&255,i[2]=t>>>8&255,i[3]=255&t,i.set(e,4);var o=8;for(r=0;r<a;r++)i.set(n[r],o),o+=n[r].byteLength;return i},e.generateInitSegment=function(t){var i=e.box(e.types.ftyp,e.constants.FTYP),n=e.moov(t),a=new Uint8Array(i.byteLength+n.byteLength);return a.set(i,0),a.set(n,i.byteLength),a},e.moov=function(t){var i=e.mvhd(t.timescale,t.duration),n=e.trak(t),a=e.mvex(t);return e.box(e.types.moov,i,n,a)},e.mvhd=function(t,i){return e.box(e.types.mvhd,new Uint8Array([0,0,0,0,0,0,0,0,0,0,0,0,t>>>24&255,t>>>16&255,t>>>8&255,255&t,i>>>24&255,i>>>16&255,i>>>8&255,255&i,0,1,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,255,255,255,255]))},e.trak=function(t){return e.box(e.types.trak,e.tkhd(t),e.mdia(t))},e.tkhd=function(t){var i=t.id,n=t.duration,a=t.presentWidth,r=t.presentHeight;return e.box(e.types.tkhd,new Uint8Array([0,0,0,7,0,0,0,0,0,0,0,0,i>>>24&255,i>>>16&255,i>>>8&255,255&i,0,0,0,0,n>>>24&255,n>>>16&255,n>>>8&255,255&n,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,0,0,0,a>>>8&255,255&a,0,0,r>>>8&255,255&r,0,0]))},e.mdia=function(t){return e.box(e.types.mdia,e.mdhd(t),e.hdlr(t),e.minf(t))},e.mdhd=function(t){var i=t.timescale,n=t.duration;return e.box(e.types.mdhd,new Uint8Array([0,0,0,0,0,0,0,0,0,0,0,0,i>>>24&255,i>>>16&255,i>>>8&255,255&i,n>>>24&255,n>>>16&255,n>>>8&255,255&n,85,196,0,0]))},e.hdlr=function(t){var i=null;return i="audio"===t.type?e.constants.HDLR_AUDIO:e.constants.HDLR_VIDEO,e.box(e.types.hdlr,i)},e.minf=function(t){var i=null;return i="audio"===t.type?e.box(e.types.smhd,e.constants.SMHD):e.box(e.types.vmhd,e.constants.VMHD),e.box(e.types.minf,i,e.dinf(),e.stbl(t))},e.dinf=function(){return e.box(e.types.dinf,e.box(e.types.dref,e.constants.DREF))},e.stbl=function(t){return e.box(e.types.stbl,e.stsd(t),e.box(e.types.stts,e.constants.STTS),e.box(e.types.stsc,e.constants.STSC),e.box(e.types.stsz,e.constants.STSZ),e.box(e.types.stco,e.constants.STCO))},e.stsd=function(t){return"audio"===t.type?"mp3"===t.codec?e.box(e.types.stsd,e.constants.STSD_PREFIX,e.mp3(t)):"ac-3"===t.codec?e.box(e.types.stsd,e.constants.STSD_PREFIX,e.ac3(t)):"ec-3"===t.codec?e.box(e.types.stsd,e.constants.STSD_PREFIX,e.ec3(t)):"opus"===t.codec?e.box(e.types.stsd,e.constants.STSD_PREFIX,e.Opus(t)):"flac"==t.codec?e.box(e.types.stsd,e.constants.STSD_PREFIX,e.fLaC(t)):e.box(e.types.stsd,e.constants.STSD_PREFIX,e.mp4a(t)):"video"===t.type&&t.codec.startsWith("hvc1")?e.box(e.types.stsd,e.constants.STSD_PREFIX,e.hvc1(t)):"video"===t.type&&t.codec.startsWith("av01")?e.box(e.types.stsd,e.constants.STSD_PREFIX,e.av01(t)):e.box(e.types.stsd,e.constants.STSD_PREFIX,e.avc1(t))},e.mp3=function(t){var i=t.channelCount,n=t.audioSampleRate,a=new Uint8Array([0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,i,0,16,0,0,0,0,n>>>8&255,255&n,0,0]);return e.box(e.types[".mp3"],a)},e.mp4a=function(t){var i=t.channelCount,n=t.audioSampleRate,a=new Uint8Array([0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,i,0,16,0,0,0,0,n>>>8&255,255&n,0,0]);return e.box(e.types.mp4a,a,e.esds(t))},e.ac3=function(t){var i=t.channelCount,n=t.audioSampleRate,a=new Uint8Array([0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,i,0,16,0,0,0,0,n>>>8&255,255&n,0,0]);return e.box(e.types["ac-3"],a,e.box(e.types.dac3,new Uint8Array(t.config)))},e.ec3=function(t){var i=t.channelCount,n=t.audioSampleRate,a=new Uint8Array([0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,i,0,16,0,0,0,0,n>>>8&255,255&n,0,0]);return e.box(e.types["ec-3"],a,e.box(e.types.dec3,new Uint8Array(t.config)))},e.esds=function(t){var i=t.config||[],n=i.length,a=new Uint8Array([0,0,0,0,3,23+n,0,1,0,4,15+n,64,21,0,0,0,0,0,0,0,0,0,0,0,5].concat([n]).concat(i).concat([6,1,2]));return e.box(e.types.esds,a)},e.Opus=function(t){var i=t.channelCount,n=t.audioSampleRate,a=new Uint8Array([0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,i,0,16,0,0,0,0,n>>>8&255,255&n,0,0]);return e.box(e.types.Opus,a,e.dOps(t))},e.dOps=function(t){var i=t.channelCount,n=t.channelConfigCode,a=t.audioSampleRate;if(t.config)return e.box(e.types.dOps,t.config);var r=[];switch(n){case 1:case 2:r=[0];break;case 0:r=[255,1,1,0,1];break;case 128:r=[255,2,0,0,1];break;case 3:r=[1,2,1,0,2,1];break;case 4:r=[1,2,2,0,1,2,3];break;case 5:r=[1,3,2,0,4,1,2,3];break;case 6:r=[1,4,2,0,4,1,2,3,5];break;case 7:r=[1,4,2,0,4,1,2,3,5,6];break;case 8:r=[1,5,3,0,6,1,2,3,4,5,7];break;case 130:r=[1,1,2,0,1];break;case 131:r=[1,1,3,0,1,2];break;case 132:r=[1,1,4,0,1,2,3];break;case 133:r=[1,1,5,0,1,2,3,4];break;case 134:r=[1,1,6,0,1,2,3,4,5];break;case 135:r=[1,1,7,0,1,2,3,4,5,6];break;case 136:r=[1,1,8,0,1,2,3,4,5,6,7]}var o=new Uint8Array(we([0,i,0,0,a>>>24&255,a>>>17&255,a>>>8&255,a>>>0&255,0,0],r,!0));return e.box(e.types.dOps,o)},e.fLaC=function(t){var i=t.channelCount,n=Math.min(t.audioSampleRate,65535),a=t.sampleSize,r=new Uint8Array([0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,i,0,a,0,0,0,0,n>>>8&255,255&n,0,0]);return e.box(e.types.fLaC,r,e.dfLa(t))},e.dfLa=function(t){var i=new Uint8Array(we([0,0,0,0],t.config,!0));return e.box(e.types.dfLa,i)},e.avc1=function(t){var i=t.avcc,n=t.codecWidth,a=t.codecHeight,r=new Uint8Array([0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,n>>>8&255,255&n,a>>>8&255,255&a,0,72,0,0,0,72,0,0,0,0,0,0,0,1,10,120,113,113,47,102,108,118,46,106,115,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,24,255,255]);return e.box(e.types.avc1,r,e.box(e.types.avcC,i))},e.hvc1=function(t){var i=t.hvcc,n=t.codecWidth,a=t.codecHeight,r=new Uint8Array([0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,n>>>8&255,255&n,a>>>8&255,255&a,0,72,0,0,0,72,0,0,0,0,0,0,0,1,10,120,113,113,47,102,108,118,46,106,115,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,24,255,255]);return e.box(e.types.hvc1,r,e.box(e.types.hvcC,i))},e.av01=function(t){var i=t.av1c,n=t.codecWidth||192,a=t.codecHeight||108,r=new Uint8Array([0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,n>>>8&255,255&n,a>>>8&255,255&a,0,72,0,0,0,72,0,0,0,0,0,0,0,1,10,120,113,113,47,102,108,118,46,106,115,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,24,255,255]);return e.box(e.types.av01,r,e.box(e.types.av1C,i))},e.mvex=function(t){return e.box(e.types.mvex,e.trex(t))},e.trex=function(t){var i=t.id,n=new Uint8Array([0,0,0,0,i>>>24&255,i>>>16&255,i>>>8&255,255&i,0,0,0,1,0,0,0,0,0,0,0,0,0,1,0,1]);return e.box(e.types.trex,n)},e.moof=function(t,i){return e.box(e.types.moof,e.mfhd(t.sequenceNumber),e.traf(t,i))},e.mfhd=function(t){var i=new Uint8Array([0,0,0,0,t>>>24&255,t>>>16&255,t>>>8&255,255&t]);return e.box(e.types.mfhd,i)},e.traf=function(t,i){var n=t.id,a=e.box(e.types.tfhd,new Uint8Array([0,0,0,0,n>>>24&255,n>>>16&255,n>>>8&255,255&n])),r=e.box(e.types.tfdt,new Uint8Array([0,0,0,0,i>>>24&255,i>>>16&255,i>>>8&255,255&i])),o=e.sdtp(t),s=e.trun(t,o.byteLength+16+16+8+16+8+8);return e.box(e.types.traf,a,r,s,o)},e.sdtp=function(t){for(var i=t.samples||[],n=i.length,a=new Uint8Array(4+n),r=0;r<n;r++){var o=i[r].flags;a[r+4]=o.isLeading<<6|o.dependsOn<<4|o.isDependedOn<<2|o.hasRedundancy}return e.box(e.types.sdtp,a)},e.trun=function(t,i){var n=t.samples||[],a=n.length,r=12+16*a,o=new Uint8Array(r);i+=8+r,o.set([0,0,15,1,a>>>24&255,a>>>16&255,a>>>8&255,255&a,i>>>24&255,i>>>16&255,i>>>8&255,255&i],0);for(var s=0;s<a;s++){var d=n[s].duration,_=n[s].size,c=n[s].flags,h=n[s].cts;o.set([d>>>24&255,d>>>16&255,d>>>8&255,255&d,_>>>24&255,_>>>16&255,_>>>8&255,255&_,c.isLeading<<2|c.dependsOn,c.isDependedOn<<6|c.hasRedundancy<<4|c.isNonSync,0,0,h>>>24&255,h>>>16&255,h>>>8&255,255&h],12+16*s)}return e.box(e.types.trun,o)},e.mdat=function(t){return e.box(e.types.mdat,t)},e}();Me.init();var Ce=Me,De=function(){function e(){}return e.getSilentFrame=function(e,t){if("mp4a.40.2"===e){if(1===t)return new Uint8Array([0,200,0,128,35,128]);if(2===t)return new Uint8Array([33,0,73,144,2,25,0,35,128]);if(3===t)return new Uint8Array([0,200,0,128,32,132,1,38,64,8,100,0,142]);if(4===t)return new Uint8Array([0,200,0,128,32,132,1,38,64,8,100,0,128,44,128,8,2,56]);if(5===t)return new Uint8Array([0,200,0,128,32,132,1,38,64,8,100,0,130,48,4,153,0,33,144,2,56]);if(6===t)return new Uint8Array([0,200,0,128,32,132,1,38,64,8,100,0,130,48,4,153,0,33,144,2,0,178,0,32,8,224])}else{if(1===t)return new Uint8Array([1,64,34,128,163,78,230,128,186,8,0,0,0,28,6,241,193,10,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,94]);if(2===t)return new Uint8Array([1,64,34,128,163,94,230,128,186,8,0,0,0,0,149,0,6,241,161,10,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,94]);if(3===t)return new Uint8Array([1,64,34,128,163,94,230,128,186,8,0,0,0,0,149,0,6,241,161,10,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,90,94])}return null},e}(),Oe=i(11),Be=function(){function e(e){this.TAG="MP4Remuxer",this._config=e,this._isLive=!0===e.isLive,this._dtsBase=-1,this._dtsBaseInited=!1,this._audioDtsBase=1/0,this._videoDtsBase=1/0,this._audioNextDts=void 0,this._videoNextDts=void 0,this._audioStashedLastSample=null,this._videoStashedLastSample=null,this._audioMeta=null,this._videoMeta=null,this._audioSegmentInfoList=new Oe.c("audio"),this._videoSegmentInfoList=new Oe.c("video"),this._onInitSegment=null,this._onMediaSegment=null,this._forceFirstIDR=!(!o.a.chrome||!(o.a.version.major<50||50===o.a.version.major&&o.a.version.build<2661)),this._fillSilentAfterSeek=o.a.msedge||o.a.msie,this._mp3UseMpegAudio=!o.a.firefox,this._fillAudioTimestampGap=this._config.fixAudioTimestampGap}return e.prototype.destroy=function(){this._dtsBase=-1,this._dtsBaseInited=!1,this._audioMeta=null,this._videoMeta=null,this._audioSegmentInfoList.clear(),this._audioSegmentInfoList=null,this._videoSegmentInfoList.clear(),this._videoSegmentInfoList=null,this._onInitSegment=null,this._onMediaSegment=null},e.prototype.bindDataSource=function(e){return e.onDataAvailable=this.remux.bind(this),e.onTrackMetadata=this._onTrackMetadataReceived.bind(this),this},Object.defineProperty(e.prototype,"onInitSegment",{get:function(){return this._onInitSegment},set:function(e){this._onInitSegment=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onMediaSegment",{get:function(){return this._onMediaSegment},set:function(e){this._onMediaSegment=e},enumerable:!1,configurable:!0}),e.prototype.insertDiscontinuity=function(){this._audioNextDts=this._videoNextDts=void 0},e.prototype.seek=function(e){this._audioStashedLastSample=null,this._videoStashedLastSample=null,this._videoSegmentInfoList.clear(),this._audioSegmentInfoList.clear()},e.prototype.remux=function(e,t){if(!this._onMediaSegment)throw new h.a("MP4Remuxer: onMediaSegment callback must be specificed!");this._dtsBaseInited||this._calculateDtsBase(e,t),t&&this._remuxVideo(t),e&&this._remuxAudio(e)},e.prototype._onTrackMetadataReceived=function(e,t){var i=null,n="mp4",a=t.codec;if("audio"===e)this._audioMeta=t,"mp3"===t.codec&&this._mp3UseMpegAudio?(n="mpeg",a="",i=new Uint8Array):i=Ce.generateInitSegment(t);else{if("video"!==e)return;this._videoMeta=t,i=Ce.generateInitSegment(t)}if(!this._onInitSegment)throw new h.a("MP4Remuxer: onInitSegment callback must be specified!");this._onInitSegment(e,{type:e,data:i.buffer,codec:a,container:"".concat(e,"/").concat(n),mediaDuration:t.duration})},e.prototype._calculateDtsBase=function(e,t){this._dtsBaseInited||(e&&e.samples&&e.samples.length&&(this._audioDtsBase=e.samples[0].dts),t&&t.samples&&t.samples.length&&(this._videoDtsBase=t.samples[0].dts),this._dtsBase=Math.min(this._audioDtsBase,this._videoDtsBase),this._dtsBaseInited=!0)},e.prototype.getTimestampBase=function(){if(this._dtsBaseInited)return this._dtsBase},e.prototype.flushStashedSamples=function(){var e=this._videoStashedLastSample,t=this._audioStashedLastSample,i={type:"video",id:1,sequenceNumber:0,samples:[],length:0};null!=e&&(i.samples.push(e),i.length=e.length);var n={type:"audio",id:2,sequenceNumber:0,samples:[],length:0};null!=t&&(n.samples.push(t),n.length=t.length),this._videoStashedLastSample=null,this._audioStashedLastSample=null,this._remuxVideo(i,!0),this._remuxAudio(n,!0)},e.prototype._remuxAudio=function(e,t){if(null!=this._audioMeta){var i,n=e,a=n.samples,s=void 0,d=-1,_=this._audioMeta.refSampleDuration,c="mp3"===this._audioMeta.codec&&this._mp3UseMpegAudio,h=this._dtsBaseInited&&void 0===this._audioNextDts,l=!1;if(a&&0!==a.length&&(1!==a.length||t)){var u=0,f=null,p=0;c?(u=0,p=n.length):(u=8,p=8+n.length);var m=null;if(a.length>1&&(p-=(m=a.pop()).length),null!=this._audioStashedLastSample){var g=this._audioStashedLastSample;this._audioStashedLastSample=null,a.unshift(g),p+=g.length}null!=m&&(this._audioStashedLastSample=m);var v=a[0].dts-this._dtsBase;if(this._audioNextDts)s=v-this._audioNextDts;else if(this._audioSegmentInfoList.isEmpty())s=0,this._fillSilentAfterSeek&&!this._videoSegmentInfoList.isEmpty()&&"mp3"!==this._audioMeta.originalCodec&&(l=!0);else{var y=this._audioSegmentInfoList.getLastSampleBefore(v);if(null!=y){var S=v-(y.originalDts+y.duration);S<=3&&(S=0),s=v-(y.dts+y.duration+S)}else s=0}if(l){var b=v-s,A=this._videoSegmentInfoList.getLastSegmentBefore(v);if(null!=A&&A.beginDts<b){if(B=De.getSilentFrame(this._audioMeta.originalCodec,this._audioMeta.channelCount)){var E=A.beginDts,R=b-A.beginDts;r.a.v(this.TAG,"InsertPrefixSilentAudio: dts: ".concat(E,", duration: ").concat(R)),a.unshift({unit:B,dts:E,pts:E}),p+=B.byteLength}}else l=!1}for(var T=[],L=0;L<a.length;L++){var k=(g=a[L]).unit,w=g.dts-this._dtsBase,M=(E=w,!1),C=null,D=0;if(!(w<-.001)){if("mp3"!==this._audioMeta.codec&&null!=_){var O=w;if(this._audioNextDts&&(O=this._audioNextDts),(s=w-O)<=-3*_){r.a.w(this.TAG,"Dropping 1 audio frame (originalDts: ".concat(w," ms ,curRefDts: ").concat(O," ms)  due to dtsCorrection: ").concat(s," ms overlap."));continue}if(s>=3*_&&this._fillAudioTimestampGap&&!o.a.safari){M=!0;var B,I=Math.floor(s/_);r.a.w(this.TAG,"Large audio timestamp gap detected, may cause AV sync to drift. Silent frames will be generated to avoid unsync.\n"+"originalDts: ".concat(w," ms, curRefDts: ").concat(O," ms, ")+"dtsCorrection: ".concat(Math.round(s)," ms, generate: ").concat(I," frames")),E=Math.floor(O),D=Math.floor(O+_)-E,null==(B=De.getSilentFrame(this._audioMeta.originalCodec,this._audioMeta.channelCount))&&(r.a.w(this.TAG,"Unable to generate silent frame for "+"".concat(this._audioMeta.originalCodec," with ").concat(this._audioMeta.channelCount," channels, repeat last frame")),B=k),C=[];for(var P=0;P<I;P++){O+=_;var x=Math.floor(O),U=Math.floor(O+_)-x,N={dts:x,pts:x,cts:0,unit:B,size:B.byteLength,duration:U,originalDts:w,flags:{isLeading:0,dependsOn:1,isDependedOn:0,hasRedundancy:0}};C.push(N),p+=N.size}this._audioNextDts=O+_}else E=Math.floor(O),D=Math.floor(O+_)-E,this._audioNextDts=O+_}else{if(E=w-s,L!==a.length-1)D=a[L+1].dts-this._dtsBase-s-E;else if(null!=m)D=m.dts-this._dtsBase-s-E;else D=T.length>=1?T[T.length-1].duration:Math.floor(_);this._audioNextDts=E+D}-1===d&&(d=E),T.push({dts:E,pts:E,cts:0,unit:g.unit,size:g.unit.byteLength,duration:D,originalDts:w,flags:{isLeading:0,dependsOn:1,isDependedOn:0,hasRedundancy:0}}),M&&T.push.apply(T,C)}}if(0===T.length)return n.samples=[],void(n.length=0);c?f=new Uint8Array(p):((f=new Uint8Array(p))[0]=p>>>24&255,f[1]=p>>>16&255,f[2]=p>>>8&255,f[3]=255&p,f.set(Ce.types.mdat,4));for(L=0;L<T.length;L++){k=T[L].unit;f.set(k,u),u+=k.byteLength}var V=T[T.length-1];i=V.dts+V.duration;var G=new Oe.b;G.beginDts=d,G.endDts=i,G.beginPts=d,G.endPts=i,G.originalBeginDts=T[0].originalDts,G.originalEndDts=V.originalDts+V.duration,G.firstSample=new Oe.d(T[0].dts,T[0].pts,T[0].duration,T[0].originalDts,!1),G.lastSample=new Oe.d(V.dts,V.pts,V.duration,V.originalDts,!1),this._isLive||this._audioSegmentInfoList.append(G),n.samples=T,n.sequenceNumber++;var F=null;F=c?new Uint8Array:Ce.moof(n,d),n.samples=[],n.length=0;var j={type:"audio",data:this._mergeBoxes(F,f).buffer,sampleCount:T.length,info:G};c&&h&&(j.timestampOffset=d),this._onMediaSegment("audio",j)}}},e.prototype._remuxVideo=function(e,t){if(null!=this._videoMeta){var i,n,a=e,r=a.samples,o=void 0,s=-1,d=-1;if(r&&0!==r.length&&(1!==r.length||t)){var _=8,c=null,h=8+e.length,l=null;if(r.length>1&&(h-=(l=r.pop()).length),null!=this._videoStashedLastSample){var u=this._videoStashedLastSample;this._videoStashedLastSample=null,r.unshift(u),h+=u.length}null!=l&&(this._videoStashedLastSample=l);var f=r[0].dts-this._dtsBase;if(this._videoNextDts)o=f-this._videoNextDts;else if(this._videoSegmentInfoList.isEmpty())o=0;else{var p=this._videoSegmentInfoList.getLastSampleBefore(f);if(null!=p){var m=f-(p.originalDts+p.duration);m<=3&&(m=0),o=f-(p.dts+p.duration+m)}else o=0}for(var g=new Oe.b,v=[],y=0;y<r.length;y++){var S=(u=r[y]).dts-this._dtsBase,b=u.isKeyframe,A=S-o,E=u.cts,R=A+E;-1===s&&(s=A,d=R);var T=0;if(y!==r.length-1)T=r[y+1].dts-this._dtsBase-o-A;else if(null!=l)T=l.dts-this._dtsBase-o-A;else T=v.length>=1?v[v.length-1].duration:Math.floor(this._videoMeta.refSampleDuration);if(b){var L=new Oe.d(A,R,T,u.dts,!0);L.fileposition=u.fileposition,g.appendSyncPoint(L)}v.push({dts:A,pts:R,cts:E,units:u.units,size:u.length,isKeyframe:b,duration:T,originalDts:S,flags:{isLeading:0,dependsOn:b?2:1,isDependedOn:b?1:0,hasRedundancy:0,isNonSync:b?0:1}})}(c=new Uint8Array(h))[0]=h>>>24&255,c[1]=h>>>16&255,c[2]=h>>>8&255,c[3]=255&h,c.set(Ce.types.mdat,4);for(y=0;y<v.length;y++)for(var k=v[y].units;k.length;){var w=k.shift().data;c.set(w,_),_+=w.byteLength}var M=v[v.length-1];if(i=M.dts+M.duration,n=M.pts+M.duration,this._videoNextDts=i,g.beginDts=s,g.endDts=i,g.beginPts=d,g.endPts=n,g.originalBeginDts=v[0].originalDts,g.originalEndDts=M.originalDts+M.duration,g.firstSample=new Oe.d(v[0].dts,v[0].pts,v[0].duration,v[0].originalDts,v[0].isKeyframe),g.lastSample=new Oe.d(M.dts,M.pts,M.duration,M.originalDts,M.isKeyframe),this._isLive||this._videoSegmentInfoList.append(g),a.samples=v,a.sequenceNumber++,this._forceFirstIDR){var C=v[0].flags;C.dependsOn=2,C.isNonSync=0}var D=Ce.moof(a,s);a.samples=[],a.length=0,this._onMediaSegment("video",{type:"video",data:this._mergeBoxes(D,c).buffer,sampleCount:v.length,info:g})}}},e.prototype._mergeBoxes=function(e,t){var i=new Uint8Array(e.byteLength+t.byteLength);return i.set(e,0),i.set(t,e.byteLength),i},e}(),Ie=i(14),Pe=i(1),xe=(i(2),function(){function e(e,t){this.TAG="TransmuxingController",this._emitter=new a.a,this._config=t,e.segments||(e.segments=[{duration:e.duration,filesize:e.filesize,url:e.url}]),"boolean"!=typeof e.cors&&(e.cors=!0),"boolean"!=typeof e.withCredentials&&(e.withCredentials=!1),this._mediaDataSource=e,this._currentSegmentIndex=0;var i=0;this._mediaDataSource.segments.forEach((function(n){n.timestampBase=i,i+=n.duration,n.cors=e.cors,n.withCredentials=e.withCredentials,t.referrerPolicy&&(n.referrerPolicy=t.referrerPolicy)})),isNaN(i)||this._mediaDataSource.duration===i||(this._mediaDataSource.duration=i),this._mediaInfo=null,this._demuxer=null,this._remuxer=null,this._ioctl=null,this._pendingSeekTime=null,this._pendingResolveSeekPoint=null,this._statisticsReporter=null}return e.prototype.destroy=function(){this._mediaInfo=null,this._mediaDataSource=null,this._statisticsReporter&&this._disableStatisticsReporter(),this._ioctl&&(this._ioctl.destroy(),this._ioctl=null),this._demuxer&&(this._demuxer.destroy(),this._demuxer=null),this._remuxer&&(this._remuxer.destroy(),this._remuxer=null),this._emitter.removeAllListeners(),this._emitter=null},e.prototype.on=function(e,t){this._emitter.addListener(e,t)},e.prototype.off=function(e,t){this._emitter.removeListener(e,t)},e.prototype.start=function(){this._loadSegment(0),this._enableStatisticsReporter()},e.prototype._loadSegment=function(e,t){this._currentSegmentIndex=e;var i=this._mediaDataSource.segments[e],n=this._ioctl=new Ie.a(i,this._config,e);n.onError=this._onIOException.bind(this),n.onSeeked=this._onIOSeeked.bind(this),n.onComplete=this._onIOComplete.bind(this),n.onRedirect=this._onIORedirect.bind(this),n.onRecoveredEarlyEof=this._onIORecoveredEarlyEof.bind(this),t?this._demuxer.bindDataSource(this._ioctl):n.onDataArrival=this._onInitChunkArrival.bind(this),n.open(t)},e.prototype.stop=function(){this._internalAbort(),this._disableStatisticsReporter()},e.prototype._internalAbort=function(){this._ioctl&&(this._ioctl.destroy(),this._ioctl=null)},e.prototype.pause=function(){this._ioctl&&this._ioctl.isWorking()&&(this._ioctl.pause(),this._disableStatisticsReporter())},e.prototype.resume=function(){this._ioctl&&this._ioctl.isPaused()&&(this._ioctl.resume(),this._enableStatisticsReporter())},e.prototype.seek=function(e){if(null!=this._mediaInfo&&this._mediaInfo.isSeekable()){var t=this._searchSegmentIndexContains(e);if(t===this._currentSegmentIndex){var i=this._mediaInfo.segments[t];if(null==i)this._pendingSeekTime=e;else{var n=i.getNearestKeyframe(e);this._remuxer.seek(n.milliseconds),this._ioctl.seek(n.fileposition),this._pendingResolveSeekPoint=n.milliseconds}}else{var a=this._mediaInfo.segments[t];if(null==a)this._pendingSeekTime=e,this._internalAbort(),this._remuxer.seek(),this._remuxer.insertDiscontinuity(),this._loadSegment(t);else{n=a.getNearestKeyframe(e);this._internalAbort(),this._remuxer.seek(e),this._remuxer.insertDiscontinuity(),this._demuxer.resetMediaInfo(),this._demuxer.timestampBase=this._mediaDataSource.segments[t].timestampBase,this._loadSegment(t,n.fileposition),this._pendingResolveSeekPoint=n.milliseconds,this._reportSegmentMediaInfo(t)}}this._enableStatisticsReporter()}},e.prototype._searchSegmentIndexContains=function(e){for(var t=this._mediaDataSource.segments,i=t.length-1,n=0;n<t.length;n++)if(e<t[n].timestampBase){i=n-1;break}return i},e.prototype._onInitChunkArrival=function(e,t){var i=this,n=0;if(t>0)this._demuxer.bindDataSource(this._ioctl),this._demuxer.timestampBase=this._mediaDataSource.segments[this._currentSegmentIndex].timestampBase,n=this._demuxer.parseChunks(e,t);else{var a=null;(a=T.probe(e)).match&&(this._setupFLVDemuxerRemuxer(a),n=this._demuxer.parseChunks(e,t)),a.match||a.needMoreData||(a=ke.probe(e)).match&&(this._setupTSDemuxerRemuxer(a),n=this._demuxer.parseChunks(e,t)),a.match||a.needMoreData||(a=null,r.a.e(this.TAG,"Non MPEG-TS/FLV, Unsupported media type!"),Promise.resolve().then((function(){i._internalAbort()})),this._emitter.emit(Pe.a.DEMUX_ERROR,m.a.FORMAT_UNSUPPORTED,"Non MPEG-TS/FLV, Unsupported media type!"))}return n},e.prototype._setupFLVDemuxerRemuxer=function(e){this._demuxer=new T(e,this._config),this._remuxer||(this._remuxer=new Be(this._config));var t=this._mediaDataSource;null==t.duration||isNaN(t.duration)||(this._demuxer.overridedDuration=t.duration),"boolean"==typeof t.hasAudio&&(this._demuxer.overridedHasAudio=t.hasAudio),"boolean"==typeof t.hasVideo&&(this._demuxer.overridedHasVideo=t.hasVideo),this._demuxer.timestampBase=t.segments[this._currentSegmentIndex].timestampBase,this._demuxer.onError=this._onDemuxException.bind(this),this._demuxer.onMediaInfo=this._onMediaInfo.bind(this),this._demuxer.onMetaDataArrived=this._onMetaDataArrived.bind(this),this._demuxer.onScriptDataArrived=this._onScriptDataArrived.bind(this),this._remuxer.bindDataSource(this._demuxer.bindDataSource(this._ioctl)),this._remuxer.onInitSegment=this._onRemuxerInitSegmentArrival.bind(this),this._remuxer.onMediaSegment=this._onRemuxerMediaSegmentArrival.bind(this)},e.prototype._setupTSDemuxerRemuxer=function(e){var t=this._demuxer=new ke(e,this._config);this._remuxer||(this._remuxer=new Be(this._config)),t.onError=this._onDemuxException.bind(this),t.onMediaInfo=this._onMediaInfo.bind(this),t.onMetaDataArrived=this._onMetaDataArrived.bind(this),t.onTimedID3Metadata=this._onTimedID3Metadata.bind(this),t.onSynchronousKLVMetadata=this._onSynchronousKLVMetadata.bind(this),t.onAsynchronousKLVMetadata=this._onAsynchronousKLVMetadata.bind(this),t.onSMPTE2038Metadata=this._onSMPTE2038Metadata.bind(this),t.onSCTE35Metadata=this._onSCTE35Metadata.bind(this),t.onPESPrivateDataDescriptor=this._onPESPrivateDataDescriptor.bind(this),t.onPESPrivateData=this._onPESPrivateData.bind(this),this._remuxer.bindDataSource(this._demuxer),this._demuxer.bindDataSource(this._ioctl),this._remuxer.onInitSegment=this._onRemuxerInitSegmentArrival.bind(this),this._remuxer.onMediaSegment=this._onRemuxerMediaSegmentArrival.bind(this)},e.prototype._onMediaInfo=function(e){var t=this;null==this._mediaInfo&&(this._mediaInfo=Object.assign({},e),this._mediaInfo.keyframesIndex=null,this._mediaInfo.segments=[],this._mediaInfo.segmentCount=this._mediaDataSource.segments.length,Object.setPrototypeOf(this._mediaInfo,s.a.prototype));var i=Object.assign({},e);Object.setPrototypeOf(i,s.a.prototype),this._mediaInfo.segments[this._currentSegmentIndex]=i,this._reportSegmentMediaInfo(this._currentSegmentIndex),null!=this._pendingSeekTime&&Promise.resolve().then((function(){var e=t._pendingSeekTime;t._pendingSeekTime=null,t.seek(e)}))},e.prototype._onMetaDataArrived=function(e){this._emitter.emit(Pe.a.METADATA_ARRIVED,e)},e.prototype._onScriptDataArrived=function(e){this._emitter.emit(Pe.a.SCRIPTDATA_ARRIVED,e)},e.prototype._onTimedID3Metadata=function(e){var t=this._remuxer.getTimestampBase();null!=t&&(null!=e.pts&&(e.pts-=t),null!=e.dts&&(e.dts-=t),this._emitter.emit(Pe.a.TIMED_ID3_METADATA_ARRIVED,e))},e.prototype._onSynchronousKLVMetadata=function(e){var t=this._remuxer.getTimestampBase();null!=t&&(null!=e.pts&&(e.pts-=t),null!=e.dts&&(e.dts-=t),this._emitter.emit(Pe.a.SYNCHRONOUS_KLV_METADATA_ARRIVED,e))},e.prototype._onAsynchronousKLVMetadata=function(e){this._emitter.emit(Pe.a.ASYNCHRONOUS_KLV_METADATA_ARRIVED,e)},e.prototype._onSMPTE2038Metadata=function(e){var t=this._remuxer.getTimestampBase();null!=t&&(null!=e.pts&&(e.pts-=t),null!=e.dts&&(e.dts-=t),null!=e.nearest_pts&&(e.nearest_pts-=t),this._emitter.emit(Pe.a.SMPTE2038_METADATA_ARRIVED,e))},e.prototype._onSCTE35Metadata=function(e){var t=this._remuxer.getTimestampBase();null!=t&&(null!=e.pts&&(e.pts-=t),null!=e.nearest_pts&&(e.nearest_pts-=t),this._emitter.emit(Pe.a.SCTE35_METADATA_ARRIVED,e))},e.prototype._onPESPrivateDataDescriptor=function(e){this._emitter.emit(Pe.a.PES_PRIVATE_DATA_DESCRIPTOR,e)},e.prototype._onPESPrivateData=function(e){var t=this._remuxer.getTimestampBase();null!=t&&(null!=e.pts&&(e.pts-=t),null!=e.nearest_pts&&(e.nearest_pts-=t),null!=e.dts&&(e.dts-=t),this._emitter.emit(Pe.a.PES_PRIVATE_DATA_ARRIVED,e))},e.prototype._onIOSeeked=function(){this._remuxer.insertDiscontinuity()},e.prototype._onIOComplete=function(e){var t=e+1;t<this._mediaDataSource.segments.length?(this._internalAbort(),this._remuxer&&this._remuxer.flushStashedSamples(),this._loadSegment(t)):(this._remuxer&&this._remuxer.flushStashedSamples(),this._emitter.emit(Pe.a.LOADING_COMPLETE),this._disableStatisticsReporter())},e.prototype._onIORedirect=function(e){var t=this._ioctl.extraData;this._mediaDataSource.segments[t].redirectedURL=e},e.prototype._onIORecoveredEarlyEof=function(){this._emitter.emit(Pe.a.RECOVERED_EARLY_EOF)},e.prototype._onIOException=function(e,t){r.a.e(this.TAG,"IOException: type = ".concat(e,", code = ").concat(t.code,", msg = ").concat(t.msg)),this._emitter.emit(Pe.a.IO_ERROR,e,t),this._disableStatisticsReporter()},e.prototype._onDemuxException=function(e,t){r.a.e(this.TAG,"DemuxException: type = ".concat(e,", info = ").concat(t)),this._emitter.emit(Pe.a.DEMUX_ERROR,e,t)},e.prototype._onRemuxerInitSegmentArrival=function(e,t){this._emitter.emit(Pe.a.INIT_SEGMENT,e,t)},e.prototype._onRemuxerMediaSegmentArrival=function(e,t){if(null==this._pendingSeekTime&&(this._emitter.emit(Pe.a.MEDIA_SEGMENT,e,t),null!=this._pendingResolveSeekPoint&&"video"===e)){var i=t.info.syncPoints,n=this._pendingResolveSeekPoint;this._pendingResolveSeekPoint=null,o.a.safari&&i.length>0&&i[0].originalDts===n&&(n=i[0].pts),this._emitter.emit(Pe.a.RECOMMEND_SEEKPOINT,n)}},e.prototype._enableStatisticsReporter=function(){null==this._statisticsReporter&&(this._statisticsReporter=self.setInterval(this._reportStatisticsInfo.bind(this),this._config.statisticsInfoReportInterval))},e.prototype._disableStatisticsReporter=function(){this._statisticsReporter&&(self.clearInterval(this._statisticsReporter),this._statisticsReporter=null)},e.prototype._reportSegmentMediaInfo=function(e){var t=this._mediaInfo.segments[e],i=Object.assign({},t);i.duration=this._mediaInfo.duration,i.segmentCount=this._mediaInfo.segmentCount,delete i.segments,delete i.keyframesIndex,this._emitter.emit(Pe.a.MEDIA_INFO,i)},e.prototype._reportStatisticsInfo=function(){var e={};e.url=this._ioctl.currentURL,e.hasRedirect=this._ioctl.hasRedirect,e.hasRedirect&&(e.redirectedURL=this._ioctl.currentRedirectedURL),e.speed=this._ioctl.currentSpeed,e.loaderType=this._ioctl.loaderType,e.currentSegmentIndex=this._currentSegmentIndex,e.totalSegmentCount=this._mediaDataSource.segments.length,this._emitter.emit(Pe.a.STATISTICS_INFO,e)},e}());t.a=xe},function(e,t,i){"use strict";var n,a=i(0),r=function(){function e(){this._firstCheckpoint=0,this._lastCheckpoint=0,this._intervalBytes=0,this._totalBytes=0,this._lastSecondBytes=0,self.performance&&self.performance.now?this._now=self.performance.now.bind(self.performance):this._now=Date.now}return e.prototype.reset=function(){this._firstCheckpoint=this._lastCheckpoint=0,this._totalBytes=this._intervalBytes=0,this._lastSecondBytes=0},e.prototype.addBytes=function(e){0===this._firstCheckpoint?(this._firstCheckpoint=this._now(),this._lastCheckpoint=this._firstCheckpoint,this._intervalBytes+=e,this._totalBytes+=e):this._now()-this._lastCheckpoint<1e3?(this._intervalBytes+=e,this._totalBytes+=e):(this._lastSecondBytes=this._intervalBytes,this._intervalBytes=e,this._totalBytes+=e,this._lastCheckpoint=this._now())},Object.defineProperty(e.prototype,"currentKBps",{get:function(){this.addBytes(0);var e=(this._now()-this._lastCheckpoint)/1e3;return 0==e&&(e=1),this._intervalBytes/e/1024},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"lastSecondKBps",{get:function(){return this.addBytes(0),0!==this._lastSecondBytes?this._lastSecondBytes/1024:this._now()-this._lastCheckpoint>=500?this.currentKBps:0},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"averageKBps",{get:function(){var e=(this._now()-this._firstCheckpoint)/1e3;return this._totalBytes/e/1024},enumerable:!1,configurable:!0}),e}(),o=i(2),s=i(5),d=i(3),_=(n=function(e,t){return(n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var i in t)Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i])})(e,t)},function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function i(){this.constructor=e}n(e,t),e.prototype=null===t?Object.create(t):(i.prototype=t.prototype,new i)}),c=function(e){function t(t,i){var n=e.call(this,"fetch-stream-loader")||this;return n.TAG="FetchStreamLoader",n._seekHandler=t,n._config=i,n._needStash=!0,n._requestAbort=!1,n._abortController=null,n._contentLength=null,n._receivedLength=0,n}return _(t,e),t.isSupported=function(){try{var e=s.a.msedge&&s.a.version.minor>=15048,t=!s.a.msedge||e;return self.fetch&&self.ReadableStream&&t}catch(e){return!1}},t.prototype.destroy=function(){this.isWorking()&&this.abort(),e.prototype.destroy.call(this)},t.prototype.open=function(e,t){var i=this;this._dataSource=e,this._range=t;var n=e.url;this._config.reuseRedirectedURL&&null!=e.redirectedURL&&(n=e.redirectedURL);var a=this._seekHandler.getConfig(n,t),r=new self.Headers;if("object"==typeof a.headers){var s=a.headers;for(var _ in s)s.hasOwnProperty(_)&&r.append(_,s[_])}var c={method:"GET",headers:r,mode:"cors",cache:"default",referrerPolicy:"no-referrer-when-downgrade"};if("object"==typeof this._config.headers)for(var _ in this._config.headers)r.append(_,this._config.headers[_]);!1===e.cors&&(c.mode="same-origin"),e.withCredentials&&(c.credentials="include"),e.referrerPolicy&&(c.referrerPolicy=e.referrerPolicy),self.AbortController&&(this._abortController=new self.AbortController,c.signal=this._abortController.signal),this._status=o.c.kConnecting,self.fetch(a.url,c).then((function(e){if(i._requestAbort)return i._status=o.c.kIdle,void e.body.cancel();if(e.ok&&e.status>=200&&e.status<=299){if(e.url!==a.url&&i._onURLRedirect){var t=i._seekHandler.removeURLParameters(e.url);i._onURLRedirect(t)}var n=e.headers.get("Content-Length");return null!=n&&(i._contentLength=parseInt(n),0!==i._contentLength&&i._onContentLengthKnown&&i._onContentLengthKnown(i._contentLength)),i._pump.call(i,e.body.getReader())}if(i._status=o.c.kError,!i._onError)throw new d.d("FetchStreamLoader: Http code invalid, "+e.status+" "+e.statusText);i._onError(o.b.HTTP_STATUS_CODE_INVALID,{code:e.status,msg:e.statusText})})).catch((function(e){if(!i._abortController||!i._abortController.signal.aborted){if(i._status=o.c.kError,!i._onError)throw e;i._onError(o.b.EXCEPTION,{code:-1,msg:e.message})}}))},t.prototype.abort=function(){if(this._requestAbort=!0,(this._status!==o.c.kBuffering||!s.a.chrome)&&this._abortController)try{this._abortController.abort()}catch(e){}},t.prototype._pump=function(e){var t=this;return e.read().then((function(i){if(i.done)if(null!==t._contentLength&&t._receivedLength<t._contentLength){t._status=o.c.kError;var n=o.b.EARLY_EOF,a={code:-1,msg:"Fetch stream meet Early-EOF"};if(!t._onError)throw new d.d(a.msg);t._onError(n,a)}else t._status=o.c.kComplete,t._onComplete&&t._onComplete(t._range.from,t._range.from+t._receivedLength-1);else{if(t._abortController&&t._abortController.signal.aborted)return void(t._status=o.c.kComplete);if(!0===t._requestAbort)return t._status=o.c.kComplete,e.cancel();t._status=o.c.kBuffering;var r=i.value.buffer,s=t._range.from+t._receivedLength;t._receivedLength+=r.byteLength,t._onDataArrival&&t._onDataArrival(r,s,t._receivedLength),t._pump(e)}})).catch((function(e){if(t._abortController&&t._abortController.signal.aborted)t._status=o.c.kComplete;else if(11!==e.code||!s.a.msedge){t._status=o.c.kError;var i=0,n=null;if(19!==e.code&&"network error"!==e.message||!(null===t._contentLength||null!==t._contentLength&&t._receivedLength<t._contentLength)?(i=o.b.EXCEPTION,n={code:e.code,msg:e.message}):(i=o.b.EARLY_EOF,n={code:e.code,msg:"Fetch stream meet Early-EOF"}),!t._onError)throw new d.d(n.msg);t._onError(i,n)}}))},t}(o.a),h=function(){var e=function(t,i){return(e=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var i in t)Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i])})(t,i)};return function(t,i){if("function"!=typeof i&&null!==i)throw new TypeError("Class extends value "+String(i)+" is not a constructor or null");function n(){this.constructor=t}e(t,i),t.prototype=null===i?Object.create(i):(n.prototype=i.prototype,new n)}}(),l=function(e){function t(t,i){var n=e.call(this,"xhr-moz-chunked-loader")||this;return n.TAG="MozChunkedLoader",n._seekHandler=t,n._config=i,n._needStash=!0,n._xhr=null,n._requestAbort=!1,n._contentLength=null,n._receivedLength=0,n}return h(t,e),t.isSupported=function(){try{var e=new XMLHttpRequest;return e.open("GET","https://example.com",!0),e.responseType="moz-chunked-arraybuffer","moz-chunked-arraybuffer"===e.responseType}catch(e){return a.a.w("MozChunkedLoader",e.message),!1}},t.prototype.destroy=function(){this.isWorking()&&this.abort(),this._xhr&&(this._xhr.onreadystatechange=null,this._xhr.onprogress=null,this._xhr.onloadend=null,this._xhr.onerror=null,this._xhr=null),e.prototype.destroy.call(this)},t.prototype.open=function(e,t){this._dataSource=e,this._range=t;var i=e.url;this._config.reuseRedirectedURL&&null!=e.redirectedURL&&(i=e.redirectedURL);var n=this._seekHandler.getConfig(i,t);this._requestURL=n.url;var a=this._xhr=new XMLHttpRequest;if(a.open("GET",n.url,!0),a.responseType="moz-chunked-arraybuffer",a.onreadystatechange=this._onReadyStateChange.bind(this),a.onprogress=this._onProgress.bind(this),a.onloadend=this._onLoadEnd.bind(this),a.onerror=this._onXhrError.bind(this),e.withCredentials&&(a.withCredentials=!0),"object"==typeof n.headers){var r=n.headers;for(var s in r)r.hasOwnProperty(s)&&a.setRequestHeader(s,r[s])}if("object"==typeof this._config.headers){r=this._config.headers;for(var s in r)r.hasOwnProperty(s)&&a.setRequestHeader(s,r[s])}this._status=o.c.kConnecting,a.send()},t.prototype.abort=function(){this._requestAbort=!0,this._xhr&&this._xhr.abort(),this._status=o.c.kComplete},t.prototype._onReadyStateChange=function(e){var t=e.target;if(2===t.readyState){if(null!=t.responseURL&&t.responseURL!==this._requestURL&&this._onURLRedirect){var i=this._seekHandler.removeURLParameters(t.responseURL);this._onURLRedirect(i)}if(0!==t.status&&(t.status<200||t.status>299)){if(this._status=o.c.kError,!this._onError)throw new d.d("MozChunkedLoader: Http code invalid, "+t.status+" "+t.statusText);this._onError(o.b.HTTP_STATUS_CODE_INVALID,{code:t.status,msg:t.statusText})}else this._status=o.c.kBuffering}},t.prototype._onProgress=function(e){if(this._status!==o.c.kError){null===this._contentLength&&null!==e.total&&0!==e.total&&(this._contentLength=e.total,this._onContentLengthKnown&&this._onContentLengthKnown(this._contentLength));var t=e.target.response,i=this._range.from+this._receivedLength;this._receivedLength+=t.byteLength,this._onDataArrival&&this._onDataArrival(t,i,this._receivedLength)}},t.prototype._onLoadEnd=function(e){!0!==this._requestAbort?this._status!==o.c.kError&&(this._status=o.c.kComplete,this._onComplete&&this._onComplete(this._range.from,this._range.from+this._receivedLength-1)):this._requestAbort=!1},t.prototype._onXhrError=function(e){this._status=o.c.kError;var t=0,i=null;if(this._contentLength&&e.loaded<this._contentLength?(t=o.b.EARLY_EOF,i={code:-1,msg:"Moz-Chunked stream meet Early-Eof"}):(t=o.b.EXCEPTION,i={code:-1,msg:e.constructor.name+" "+e.type}),!this._onError)throw new d.d(i.msg);this._onError(t,i)},t}(o.a),u=function(){var e=function(t,i){return(e=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var i in t)Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i])})(t,i)};return function(t,i){if("function"!=typeof i&&null!==i)throw new TypeError("Class extends value "+String(i)+" is not a constructor or null");function n(){this.constructor=t}e(t,i),t.prototype=null===i?Object.create(i):(n.prototype=i.prototype,new n)}}(),f=(function(e){function t(t,i){var n=e.call(this,"xhr-msstream-loader")||this;return n.TAG="MSStreamLoader",n._seekHandler=t,n._config=i,n._needStash=!0,n._xhr=null,n._reader=null,n._totalRange=null,n._currentRange=null,n._currentRequestURL=null,n._currentRedirectedURL=null,n._contentLength=null,n._receivedLength=0,n._bufferLimit=16777216,n._lastTimeBufferSize=0,n._isReconnecting=!1,n}u(t,e),t.isSupported=function(){try{if(void 0===self.MSStream||void 0===self.MSStreamReader)return!1;var e=new XMLHttpRequest;return e.open("GET","https://example.com",!0),e.responseType="ms-stream","ms-stream"===e.responseType}catch(e){return a.a.w("MSStreamLoader",e.message),!1}},t.prototype.destroy=function(){this.isWorking()&&this.abort(),this._reader&&(this._reader.onprogress=null,this._reader.onload=null,this._reader.onerror=null,this._reader=null),this._xhr&&(this._xhr.onreadystatechange=null,this._xhr=null),e.prototype.destroy.call(this)},t.prototype.open=function(e,t){this._internalOpen(e,t,!1)},t.prototype._internalOpen=function(e,t,i){this._dataSource=e,i?this._currentRange=t:this._totalRange=t;var n=e.url;this._config.reuseRedirectedURL&&(null!=this._currentRedirectedURL?n=this._currentRedirectedURL:null!=e.redirectedURL&&(n=e.redirectedURL));var a=this._seekHandler.getConfig(n,t);this._currentRequestURL=a.url;var r=this._reader=new self.MSStreamReader;r.onprogress=this._msrOnProgress.bind(this),r.onload=this._msrOnLoad.bind(this),r.onerror=this._msrOnError.bind(this);var s=this._xhr=new XMLHttpRequest;if(s.open("GET",a.url,!0),s.responseType="ms-stream",s.onreadystatechange=this._xhrOnReadyStateChange.bind(this),s.onerror=this._xhrOnError.bind(this),e.withCredentials&&(s.withCredentials=!0),"object"==typeof a.headers){var d=a.headers;for(var _ in d)d.hasOwnProperty(_)&&s.setRequestHeader(_,d[_])}if("object"==typeof this._config.headers){d=this._config.headers;for(var _ in d)d.hasOwnProperty(_)&&s.setRequestHeader(_,d[_])}this._isReconnecting?this._isReconnecting=!1:this._status=o.c.kConnecting,s.send()},t.prototype.abort=function(){this._internalAbort(),this._status=o.c.kComplete},t.prototype._internalAbort=function(){this._reader&&(1===this._reader.readyState&&this._reader.abort(),this._reader.onprogress=null,this._reader.onload=null,this._reader.onerror=null,this._reader=null),this._xhr&&(this._xhr.abort(),this._xhr.onreadystatechange=null,this._xhr=null)},t.prototype._xhrOnReadyStateChange=function(e){var t=e.target;if(2===t.readyState)if(t.status>=200&&t.status<=299){if(this._status=o.c.kBuffering,null!=t.responseURL){var i=this._seekHandler.removeURLParameters(t.responseURL);t.responseURL!==this._currentRequestURL&&i!==this._currentRedirectedURL&&(this._currentRedirectedURL=i,this._onURLRedirect&&this._onURLRedirect(i))}var n=t.getResponseHeader("Content-Length");if(null!=n&&null==this._contentLength){var a=parseInt(n);a>0&&(this._contentLength=a,this._onContentLengthKnown&&this._onContentLengthKnown(this._contentLength))}}else{if(this._status=o.c.kError,!this._onError)throw new d.d("MSStreamLoader: Http code invalid, "+t.status+" "+t.statusText);this._onError(o.b.HTTP_STATUS_CODE_INVALID,{code:t.status,msg:t.statusText})}else if(3===t.readyState&&t.status>=200&&t.status<=299){this._status=o.c.kBuffering;var r=t.response;this._reader.readAsArrayBuffer(r)}},t.prototype._xhrOnError=function(e){this._status=o.c.kError;var t=o.b.EXCEPTION,i={code:-1,msg:e.constructor.name+" "+e.type};if(!this._onError)throw new d.d(i.msg);this._onError(t,i)},t.prototype._msrOnProgress=function(e){var t=e.target.result;if(null!=t){var i=t.slice(this._lastTimeBufferSize);this._lastTimeBufferSize=t.byteLength;var n=this._totalRange.from+this._receivedLength;this._receivedLength+=i.byteLength,this._onDataArrival&&this._onDataArrival(i,n,this._receivedLength),t.byteLength>=this._bufferLimit&&(a.a.v(this.TAG,"MSStream buffer exceeded max size near ".concat(n+i.byteLength,", reconnecting...")),this._doReconnectIfNeeded())}else this._doReconnectIfNeeded()},t.prototype._doReconnectIfNeeded=function(){if(null==this._contentLength||this._receivedLength<this._contentLength){this._isReconnecting=!0,this._lastTimeBufferSize=0,this._internalAbort();var e={from:this._totalRange.from+this._receivedLength,to:-1};this._internalOpen(this._dataSource,e,!0)}},t.prototype._msrOnLoad=function(e){this._status=o.c.kComplete,this._onComplete&&this._onComplete(this._totalRange.from,this._totalRange.from+this._receivedLength-1)},t.prototype._msrOnError=function(e){this._status=o.c.kError;var t=0,i=null;if(this._contentLength&&this._receivedLength<this._contentLength?(t=o.b.EARLY_EOF,i={code:-1,msg:"MSStream meet Early-Eof"}):(t=o.b.EARLY_EOF,i={code:-1,msg:e.constructor.name+" "+e.type}),!this._onError)throw new d.d(i.msg);this._onError(t,i)}}(o.a),function(){var e=function(t,i){return(e=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var i in t)Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i])})(t,i)};return function(t,i){if("function"!=typeof i&&null!==i)throw new TypeError("Class extends value "+String(i)+" is not a constructor or null");function n(){this.constructor=t}e(t,i),t.prototype=null===i?Object.create(i):(n.prototype=i.prototype,new n)}}()),p=function(e){function t(t,i){var n=e.call(this,"xhr-range-loader")||this;return n.TAG="RangeLoader",n._seekHandler=t,n._config=i,n._needStash=!1,n._chunkSizeKBList=[128,256,384,512,768,1024,1536,2048,3072,4096,5120,6144,7168,8192],n._currentChunkSizeKB=384,n._currentSpeedNormalized=0,n._zeroSpeedChunkCount=0,n._xhr=null,n._speedSampler=new r,n._requestAbort=!1,n._waitForTotalLength=!1,n._totalLengthReceived=!1,n._currentRequestURL=null,n._currentRedirectedURL=null,n._currentRequestRange=null,n._totalLength=null,n._contentLength=null,n._receivedLength=0,n._lastTimeLoaded=0,n}return f(t,e),t.isSupported=function(){try{var e=new XMLHttpRequest;return e.open("GET","https://example.com",!0),e.responseType="arraybuffer","arraybuffer"===e.responseType}catch(e){return a.a.w("RangeLoader",e.message),!1}},t.prototype.destroy=function(){this.isWorking()&&this.abort(),this._xhr&&(this._xhr.onreadystatechange=null,this._xhr.onprogress=null,this._xhr.onload=null,this._xhr.onerror=null,this._xhr=null),e.prototype.destroy.call(this)},Object.defineProperty(t.prototype,"currentSpeed",{get:function(){return this._speedSampler.lastSecondKBps},enumerable:!1,configurable:!0}),t.prototype.open=function(e,t){this._dataSource=e,this._range=t,this._status=o.c.kConnecting;var i=!1;null!=this._dataSource.filesize&&0!==this._dataSource.filesize&&(i=!0,this._totalLength=this._dataSource.filesize),this._totalLengthReceived||i?this._openSubRange():(this._waitForTotalLength=!0,this._internalOpen(this._dataSource,{from:0,to:-1}))},t.prototype._openSubRange=function(){var e=1024*this._currentChunkSizeKB,t=this._range.from+this._receivedLength,i=t+e;null!=this._contentLength&&i-this._range.from>=this._contentLength&&(i=this._range.from+this._contentLength-1),this._currentRequestRange={from:t,to:i},this._internalOpen(this._dataSource,this._currentRequestRange)},t.prototype._internalOpen=function(e,t){this._lastTimeLoaded=0;var i=e.url;this._config.reuseRedirectedURL&&(null!=this._currentRedirectedURL?i=this._currentRedirectedURL:null!=e.redirectedURL&&(i=e.redirectedURL));var n=this._seekHandler.getConfig(i,t);this._currentRequestURL=n.url;var a=this._xhr=new XMLHttpRequest;if(a.open("GET",n.url,!0),a.responseType="arraybuffer",a.onreadystatechange=this._onReadyStateChange.bind(this),a.onprogress=this._onProgress.bind(this),a.onload=this._onLoad.bind(this),a.onerror=this._onXhrError.bind(this),e.withCredentials&&(a.withCredentials=!0),"object"==typeof n.headers){var r=n.headers;for(var o in r)r.hasOwnProperty(o)&&a.setRequestHeader(o,r[o])}if("object"==typeof this._config.headers){r=this._config.headers;for(var o in r)r.hasOwnProperty(o)&&a.setRequestHeader(o,r[o])}a.send()},t.prototype.abort=function(){this._requestAbort=!0,this._internalAbort(),this._status=o.c.kComplete},t.prototype._internalAbort=function(){this._xhr&&(this._xhr.onreadystatechange=null,this._xhr.onprogress=null,this._xhr.onload=null,this._xhr.onerror=null,this._xhr.abort(),this._xhr=null)},t.prototype._onReadyStateChange=function(e){var t=e.target;if(2===t.readyState){if(null!=t.responseURL){var i=this._seekHandler.removeURLParameters(t.responseURL);t.responseURL!==this._currentRequestURL&&i!==this._currentRedirectedURL&&(this._currentRedirectedURL=i,this._onURLRedirect&&this._onURLRedirect(i))}if(t.status>=200&&t.status<=299){if(this._waitForTotalLength)return;this._status=o.c.kBuffering}else{if(this._status=o.c.kError,!this._onError)throw new d.d("RangeLoader: Http code invalid, "+t.status+" "+t.statusText);this._onError(o.b.HTTP_STATUS_CODE_INVALID,{code:t.status,msg:t.statusText})}}},t.prototype._onProgress=function(e){if(this._status!==o.c.kError){if(null===this._contentLength){var t=!1;if(this._waitForTotalLength){this._waitForTotalLength=!1,this._totalLengthReceived=!0,t=!0;var i=e.total;this._internalAbort(),null!=i&0!==i&&(this._totalLength=i)}if(-1===this._range.to?this._contentLength=this._totalLength-this._range.from:this._contentLength=this._range.to-this._range.from+1,t)return void this._openSubRange();this._onContentLengthKnown&&this._onContentLengthKnown(this._contentLength)}var n=e.loaded-this._lastTimeLoaded;this._lastTimeLoaded=e.loaded,this._speedSampler.addBytes(n)}},t.prototype._normalizeSpeed=function(e){var t=this._chunkSizeKBList,i=t.length-1,n=0,a=0,r=i;if(e<t[0])return t[0];for(;a<=r;){if((n=a+Math.floor((r-a)/2))===i||e>=t[n]&&e<t[n+1])return t[n];t[n]<e?a=n+1:r=n-1}},t.prototype._onLoad=function(e){if(this._status!==o.c.kError)if(this._waitForTotalLength)this._waitForTotalLength=!1;else{this._lastTimeLoaded=0;var t=this._speedSampler.lastSecondKBps;if(0===t&&(this._zeroSpeedChunkCount++,this._zeroSpeedChunkCount>=3&&(t=this._speedSampler.currentKBps)),0!==t){var i=this._normalizeSpeed(t);this._currentSpeedNormalized!==i&&(this._currentSpeedNormalized=i,this._currentChunkSizeKB=i)}var n=e.target.response,a=this._range.from+this._receivedLength;this._receivedLength+=n.byteLength;var r=!1;null!=this._contentLength&&this._receivedLength<this._contentLength?this._openSubRange():r=!0,this._onDataArrival&&this._onDataArrival(n,a,this._receivedLength),r&&(this._status=o.c.kComplete,this._onComplete&&this._onComplete(this._range.from,this._range.from+this._receivedLength-1))}},t.prototype._onXhrError=function(e){this._status=o.c.kError;var t=0,i=null;if(this._contentLength&&this._receivedLength>0&&this._receivedLength<this._contentLength?(t=o.b.EARLY_EOF,i={code:-1,msg:"RangeLoader meet Early-Eof"}):(t=o.b.EXCEPTION,i={code:-1,msg:e.constructor.name+" "+e.type}),!this._onError)throw new d.d(i.msg);this._onError(t,i)},t}(o.a),m=function(){var e=function(t,i){return(e=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var i in t)Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i])})(t,i)};return function(t,i){if("function"!=typeof i&&null!==i)throw new TypeError("Class extends value "+String(i)+" is not a constructor or null");function n(){this.constructor=t}e(t,i),t.prototype=null===i?Object.create(i):(n.prototype=i.prototype,new n)}}(),g=function(e){function t(){var t=e.call(this,"websocket-loader")||this;return t.TAG="WebSocketLoader",t._needStash=!0,t._ws=null,t._requestAbort=!1,t._receivedLength=0,t}return m(t,e),t.isSupported=function(){try{return void 0!==self.WebSocket}catch(e){return!1}},t.prototype.destroy=function(){this._ws&&this.abort(),e.prototype.destroy.call(this)},t.prototype.open=function(e){try{var t=this._ws=new self.WebSocket(e.url);t.binaryType="arraybuffer",t.onopen=this._onWebSocketOpen.bind(this),t.onclose=this._onWebSocketClose.bind(this),t.onmessage=this._onWebSocketMessage.bind(this),t.onerror=this._onWebSocketError.bind(this),this._status=o.c.kConnecting}catch(e){this._status=o.c.kError;var i={code:e.code,msg:e.message};if(!this._onError)throw new d.d(i.msg);this._onError(o.b.EXCEPTION,i)}},t.prototype.abort=function(){var e=this._ws;!e||0!==e.readyState&&1!==e.readyState||(this._requestAbort=!0,e.close()),this._ws=null,this._status=o.c.kComplete},t.prototype._onWebSocketOpen=function(e){this._status=o.c.kBuffering},t.prototype._onWebSocketClose=function(e){!0!==this._requestAbort?(this._status=o.c.kComplete,this._onComplete&&this._onComplete(0,this._receivedLength-1)):this._requestAbort=!1},t.prototype._onWebSocketMessage=function(e){var t=this;if(e.data instanceof ArrayBuffer)this._dispatchArrayBuffer(e.data);else if(e.data instanceof Blob){var i=new FileReader;i.onload=function(){t._dispatchArrayBuffer(i.result)},i.readAsArrayBuffer(e.data)}else{this._status=o.c.kError;var n={code:-1,msg:"Unsupported WebSocket message type: "+e.data.constructor.name};if(!this._onError)throw new d.d(n.msg);this._onError(o.b.EXCEPTION,n)}},t.prototype._dispatchArrayBuffer=function(e){var t=e,i=this._receivedLength;this._receivedLength+=t.byteLength,this._onDataArrival&&this._onDataArrival(t,i,this._receivedLength)},t.prototype._onWebSocketError=function(e){this._status=o.c.kError;var t={code:e.code,msg:e.message};if(!this._onError)throw new d.d(t.msg);this._onError(o.b.EXCEPTION,t)},t}(o.a),v=function(){function e(e){this._zeroStart=e||!1}return e.prototype.getConfig=function(e,t){var i={};if(0!==t.from||-1!==t.to){var n=void 0;n=-1!==t.to?"bytes=".concat(t.from.toString(),"-").concat(t.to.toString()):"bytes=".concat(t.from.toString(),"-"),i.Range=n}else this._zeroStart&&(i.Range="bytes=0-");return{url:e,headers:i}},e.prototype.removeURLParameters=function(e){return e},e}(),y=function(){function e(e,t){this._startName=e,this._endName=t}return e.prototype.getConfig=function(e,t){var i=e;if(0!==t.from||-1!==t.to){var n=!0;-1===i.indexOf("?")&&(i+="?",n=!1),n&&(i+="&"),i+="".concat(this._startName,"=").concat(t.from.toString()),-1!==t.to&&(i+="&".concat(this._endName,"=").concat(t.to.toString()))}return{url:i,headers:{}}},e.prototype.removeURLParameters=function(e){var t=e.split("?")[0],i=void 0,n=e.indexOf("?");-1!==n&&(i=e.substring(n+1));var a="";if(null!=i&&i.length>0)for(var r=i.split("&"),o=0;o<r.length;o++){var s=r[o].split("="),d=o>0;s[0]!==this._startName&&s[0]!==this._endName&&(d&&(a+="&"),a+=r[o])}return 0===a.length?t:t+"?"+a},e}(),S=function(){function e(e,t,i){this.TAG="IOController",this._config=t,this._extraData=i,this._stashInitialSize=65536,null!=t.stashInitialSize&&t.stashInitialSize>0&&(this._stashInitialSize=t.stashInitialSize),this._stashUsed=0,this._stashSize=this._stashInitialSize,this._bufferSize=Math.max(this._stashSize,3145728),this._stashBuffer=new ArrayBuffer(this._bufferSize),this._stashByteStart=0,this._enableStash=!0,!1===t.enableStashBuffer&&(this._enableStash=!1),this._loader=null,this._loaderClass=null,this._seekHandler=null,this._dataSource=e,this._isWebSocketURL=/wss?:\/\/(.+?)/.test(e.url),this._refTotalLength=e.filesize?e.filesize:null,this._totalLength=this._refTotalLength,this._fullRequestFlag=!1,this._currentRange=null,this._redirectedURL=null,this._speedNormalized=0,this._speedSampler=new r,this._speedNormalizeList=[32,64,96,128,192,256,384,512,768,1024,1536,2048,3072,4096],this._isEarlyEofReconnecting=!1,this._paused=!1,this._resumeFrom=0,this._onDataArrival=null,this._onSeeked=null,this._onError=null,this._onComplete=null,this._onRedirect=null,this._onRecoveredEarlyEof=null,this._selectSeekHandler(),this._selectLoader(),this._createLoader()}return e.prototype.destroy=function(){this._loader.isWorking()&&this._loader.abort(),this._loader.destroy(),this._loader=null,this._loaderClass=null,this._dataSource=null,this._stashBuffer=null,this._stashUsed=this._stashSize=this._bufferSize=this._stashByteStart=0,this._currentRange=null,this._speedSampler=null,this._isEarlyEofReconnecting=!1,this._onDataArrival=null,this._onSeeked=null,this._onError=null,this._onComplete=null,this._onRedirect=null,this._onRecoveredEarlyEof=null,this._extraData=null},e.prototype.isWorking=function(){return this._loader&&this._loader.isWorking()&&!this._paused},e.prototype.isPaused=function(){return this._paused},Object.defineProperty(e.prototype,"status",{get:function(){return this._loader.status},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"extraData",{get:function(){return this._extraData},set:function(e){this._extraData=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onDataArrival",{get:function(){return this._onDataArrival},set:function(e){this._onDataArrival=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onSeeked",{get:function(){return this._onSeeked},set:function(e){this._onSeeked=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onError",{get:function(){return this._onError},set:function(e){this._onError=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onComplete",{get:function(){return this._onComplete},set:function(e){this._onComplete=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onRedirect",{get:function(){return this._onRedirect},set:function(e){this._onRedirect=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"onRecoveredEarlyEof",{get:function(){return this._onRecoveredEarlyEof},set:function(e){this._onRecoveredEarlyEof=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"currentURL",{get:function(){return this._dataSource.url},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"hasRedirect",{get:function(){return null!=this._redirectedURL||null!=this._dataSource.redirectedURL},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"currentRedirectedURL",{get:function(){return this._redirectedURL||this._dataSource.redirectedURL},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"currentSpeed",{get:function(){return this._loaderClass===p?this._loader.currentSpeed:this._speedSampler.lastSecondKBps},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"loaderType",{get:function(){return this._loader.type},enumerable:!1,configurable:!0}),e.prototype._selectSeekHandler=function(){var e=this._config;if("range"===e.seekType)this._seekHandler=new v(this._config.rangeLoadZeroStart);else if("param"===e.seekType){var t=e.seekParamStart||"bstart",i=e.seekParamEnd||"bend";this._seekHandler=new y(t,i)}else{if("custom"!==e.seekType)throw new d.b("Invalid seekType in config: ".concat(e.seekType));if("function"!=typeof e.customSeekHandler)throw new d.b("Custom seekType specified in config but invalid customSeekHandler!");this._seekHandler=new e.customSeekHandler}},e.prototype._selectLoader=function(){if(null!=this._config.customLoader)this._loaderClass=this._config.customLoader;else if(this._isWebSocketURL)this._loaderClass=g;else if(c.isSupported())this._loaderClass=c;else if(l.isSupported())this._loaderClass=l;else{if(!p.isSupported())throw new d.d("Your browser doesn't support xhr with arraybuffer responseType!");this._loaderClass=p}},e.prototype._createLoader=function(){this._loader=new this._loaderClass(this._seekHandler,this._config),!1===this._loader.needStashBuffer&&(this._enableStash=!1),this._loader.onContentLengthKnown=this._onContentLengthKnown.bind(this),this._loader.onURLRedirect=this._onURLRedirect.bind(this),this._loader.onDataArrival=this._onLoaderChunkArrival.bind(this),this._loader.onComplete=this._onLoaderComplete.bind(this),this._loader.onError=this._onLoaderError.bind(this)},e.prototype.open=function(e){this._currentRange={from:0,to:-1},e&&(this._currentRange.from=e),this._speedSampler.reset(),e||(this._fullRequestFlag=!0),this._loader.open(this._dataSource,Object.assign({},this._currentRange))},e.prototype.abort=function(){this._loader.abort(),this._paused&&(this._paused=!1,this._resumeFrom=0)},e.prototype.pause=function(){this.isWorking()&&(this._loader.abort(),0!==this._stashUsed?(this._resumeFrom=this._stashByteStart,this._currentRange.to=this._stashByteStart-1):this._resumeFrom=this._currentRange.to+1,this._stashUsed=0,this._stashByteStart=0,this._paused=!0)},e.prototype.resume=function(){if(this._paused){this._paused=!1;var e=this._resumeFrom;this._resumeFrom=0,this._internalSeek(e,!0)}},e.prototype.seek=function(e){this._paused=!1,this._stashUsed=0,this._stashByteStart=0,this._internalSeek(e,!0)},e.prototype._internalSeek=function(e,t){this._loader.isWorking()&&this._loader.abort(),this._flushStashBuffer(t),this._loader.destroy(),this._loader=null;var i={from:e,to:-1};this._currentRange={from:i.from,to:-1},this._speedSampler.reset(),this._stashSize=this._stashInitialSize,this._createLoader(),this._loader.open(this._dataSource,i),this._onSeeked&&this._onSeeked()},e.prototype.updateUrl=function(e){if(!e||"string"!=typeof e||0===e.length)throw new d.b("Url must be a non-empty string!");this._dataSource.url=e},e.prototype._expandBuffer=function(e){for(var t=this._stashSize;t+1048576<e;)t*=2;if((t+=1048576)!==this._bufferSize){var i=new ArrayBuffer(t);if(this._stashUsed>0){var n=new Uint8Array(this._stashBuffer,0,this._stashUsed);new Uint8Array(i,0,t).set(n,0)}this._stashBuffer=i,this._bufferSize=t}},e.prototype._normalizeSpeed=function(e){var t=this._speedNormalizeList,i=t.length-1,n=0,a=0,r=i;if(e<t[0])return t[0];for(;a<=r;){if((n=a+Math.floor((r-a)/2))===i||e>=t[n]&&e<t[n+1])return t[n];t[n]<e?a=n+1:r=n-1}},e.prototype._adjustStashSize=function(e){var t=0;(t=this._config.isLive?e/8:e<512?e:e>=512&&e<=1024?Math.floor(1.5*e):2*e)>8192&&(t=8192);var i=1024*t+1048576;this._bufferSize<i&&this._expandBuffer(i),this._stashSize=1024*t},e.prototype._dispatchChunks=function(e,t){return this._currentRange.to=t+e.byteLength-1,this._onDataArrival(e,t)},e.prototype._onURLRedirect=function(e){this._redirectedURL=e,this._onRedirect&&this._onRedirect(e)},e.prototype._onContentLengthKnown=function(e){e&&this._fullRequestFlag&&(this._totalLength=e,this._fullRequestFlag=!1)},e.prototype._onLoaderChunkArrival=function(e,t,i){if(!this._onDataArrival)throw new d.a("IOController: No existing consumer (onDataArrival) callback!");if(!this._paused){this._isEarlyEofReconnecting&&(this._isEarlyEofReconnecting=!1,this._onRecoveredEarlyEof&&this._onRecoveredEarlyEof()),this._speedSampler.addBytes(e.byteLength);var n=this._speedSampler.lastSecondKBps;if(0!==n){var a=this._normalizeSpeed(n);this._speedNormalized!==a&&(this._speedNormalized=a,this._adjustStashSize(a))}if(this._enableStash)if(0===this._stashUsed&&0===this._stashByteStart&&(this._stashByteStart=t),this._stashUsed+e.byteLength<=this._stashSize){(s=new Uint8Array(this._stashBuffer,0,this._stashSize)).set(new Uint8Array(e),this._stashUsed),this._stashUsed+=e.byteLength}else{s=new Uint8Array(this._stashBuffer,0,this._bufferSize);if(this._stashUsed>0){var r=this._stashBuffer.slice(0,this._stashUsed);if((_=this._dispatchChunks(r,this._stashByteStart))<r.byteLength){if(_>0){c=new Uint8Array(r,_);s.set(c,0),this._stashUsed=c.byteLength,this._stashByteStart+=_}}else this._stashUsed=0,this._stashByteStart+=_;this._stashUsed+e.byteLength>this._bufferSize&&(this._expandBuffer(this._stashUsed+e.byteLength),s=new Uint8Array(this._stashBuffer,0,this._bufferSize)),s.set(new Uint8Array(e),this._stashUsed),this._stashUsed+=e.byteLength}else{if((_=this._dispatchChunks(e,t))<e.byteLength)(o=e.byteLength-_)>this._bufferSize&&(this._expandBuffer(o),s=new Uint8Array(this._stashBuffer,0,this._bufferSize)),s.set(new Uint8Array(e,_),0),this._stashUsed+=o,this._stashByteStart=t+_}}else if(0===this._stashUsed){var o;if((_=this._dispatchChunks(e,t))<e.byteLength)(o=e.byteLength-_)>this._bufferSize&&this._expandBuffer(o),(s=new Uint8Array(this._stashBuffer,0,this._bufferSize)).set(new Uint8Array(e,_),0),this._stashUsed+=o,this._stashByteStart=t+_}else{var s,_;if(this._stashUsed+e.byteLength>this._bufferSize&&this._expandBuffer(this._stashUsed+e.byteLength),(s=new Uint8Array(this._stashBuffer,0,this._bufferSize)).set(new Uint8Array(e),this._stashUsed),this._stashUsed+=e.byteLength,(_=this._dispatchChunks(this._stashBuffer.slice(0,this._stashUsed),this._stashByteStart))<this._stashUsed&&_>0){var c=new Uint8Array(this._stashBuffer,_);s.set(c,0)}this._stashUsed-=_,this._stashByteStart+=_}}},e.prototype._flushStashBuffer=function(e){if(this._stashUsed>0){var t=this._stashBuffer.slice(0,this._stashUsed),i=this._dispatchChunks(t,this._stashByteStart),n=t.byteLength-i;if(i<t.byteLength){if(!e){if(i>0){var r=new Uint8Array(this._stashBuffer,0,this._bufferSize),o=new Uint8Array(t,i);r.set(o,0),this._stashUsed=o.byteLength,this._stashByteStart+=i}return 0}a.a.w(this.TAG,"".concat(n," bytes unconsumed data remain when flush buffer, dropped"))}return this._stashUsed=0,this._stashByteStart=0,n}return 0},e.prototype._onLoaderComplete=function(e,t){this._flushStashBuffer(!0),this._onComplete&&this._onComplete(this._extraData)},e.prototype._onLoaderError=function(e,t){switch(a.a.e(this.TAG,"Loader error, code = ".concat(t.code,", msg = ").concat(t.msg)),this._flushStashBuffer(!1),this._isEarlyEofReconnecting&&(this._isEarlyEofReconnecting=!1,e=o.b.UNRECOVERABLE_EARLY_EOF),e){case o.b.EARLY_EOF:if(!this._config.isLive&&this._totalLength){var i=this._currentRange.to+1;return void(i<this._totalLength&&(a.a.w(this.TAG,"Connection lost, trying reconnect..."),this._isEarlyEofReconnecting=!0,this._internalSeek(i,!1)))}e=o.b.UNRECOVERABLE_EARLY_EOF;break;case o.b.UNRECOVERABLE_EARLY_EOF:case o.b.CONNECTING_TIMEOUT:case o.b.HTTP_STATUS_CODE_INVALID:case o.b.EXCEPTION:}if(!this._onError)throw new d.d("IOException: "+t.msg);this._onError(e,t)},e}();t.a=S},function(e,t,i){"use strict";var n=function(){function e(){}return e.install=function(){Object.setPrototypeOf=Object.setPrototypeOf||function(e,t){return e.__proto__=t,e},Object.assign=Object.assign||function(e){if(null==e)throw new TypeError("Cannot convert undefined or null to object");for(var t=Object(e),i=1;i<arguments.length;i++){var n=arguments[i];if(null!=n)for(var a in n)n.hasOwnProperty(a)&&(t[a]=n[a])}return t},String.prototype.startsWith||Object.defineProperty(String.prototype,"startsWith",{value:function(e,t){var i=t>0?0|t:0;return this.substring(i,i+e.length)===e}}),"function"!=typeof self.Promise&&i(21).polyfill()},e}();n.install(),t.a=n},function(e,t,i){"use strict";var n=i(9),a=i.n(n),r=i(0),o=i(5),s=i(7),d=i(3),_=function(){function e(e){this.TAG="MSEController",this._config=e,this._emitter=new a.a,this._config.isLive&&null==this._config.autoCleanupSourceBuffer&&(this._config.autoCleanupSourceBuffer=!0),this.e={onSourceOpen:this._onSourceOpen.bind(this),onSourceEnded:this._onSourceEnded.bind(this),onSourceClose:this._onSourceClose.bind(this),onStartStreaming:this._onStartStreaming.bind(this),onEndStreaming:this._onEndStreaming.bind(this),onQualityChange:this._onQualityChange.bind(this),onSourceBufferError:this._onSourceBufferError.bind(this),onSourceBufferUpdateEnd:this._onSourceBufferUpdateEnd.bind(this)},this._useManagedMediaSource="ManagedMediaSource"in self&&!("MediaSource"in self),this._mediaSource=null,this._mediaSourceObjectURL=null,this._mediaElementProxy=null,this._isBufferFull=!1,this._hasPendingEos=!1,this._requireSetMediaDuration=!1,this._pendingMediaDuration=0,this._pendingSourceBufferInit=[],this._mimeTypes={video:null,audio:null},this._sourceBuffers={video:null,audio:null},this._lastInitSegments={video:null,audio:null},this._pendingSegments={video:[],audio:[]},this._pendingRemoveRanges={video:[],audio:[]}}return e.prototype.destroy=function(){this._mediaSource&&this.shutdown(),this._mediaSourceObjectURL&&this.revokeObjectURL(),this.e=null,this._emitter.removeAllListeners(),this._emitter=null},e.prototype.on=function(e,t){this._emitter.addListener(e,t)},e.prototype.off=function(e,t){this._emitter.removeListener(e,t)},e.prototype.initialize=function(e){if(this._mediaSource)throw new d.a("MediaSource has been attached to an HTMLMediaElement!");this._useManagedMediaSource&&r.a.v(this.TAG,"Using ManagedMediaSource");var t=this._mediaSource=this._useManagedMediaSource?new self.ManagedMediaSource:new self.MediaSource;t.addEventListener("sourceopen",this.e.onSourceOpen),t.addEventListener("sourceended",this.e.onSourceEnded),t.addEventListener("sourceclose",this.e.onSourceClose),this._useManagedMediaSource&&(t.addEventListener("startstreaming",this.e.onStartStreaming),t.addEventListener("endstreaming",this.e.onEndStreaming),t.addEventListener("qualitychange",this.e.onQualityChange)),this._mediaElementProxy=e},e.prototype.shutdown=function(){if(this._mediaSource){var e=this._mediaSource;for(var t in this._sourceBuffers){var i=this._pendingSegments[t];i.splice(0,i.length),this._pendingSegments[t]=null,this._pendingRemoveRanges[t]=null,this._lastInitSegments[t]=null;var n=this._sourceBuffers[t];if(n){if("closed"!==e.readyState){try{e.removeSourceBuffer(n)}catch(e){r.a.e(this.TAG,e.message)}n.removeEventListener("error",this.e.onSourceBufferError),n.removeEventListener("updateend",this.e.onSourceBufferUpdateEnd)}this._mimeTypes[t]=null,this._sourceBuffers[t]=null}}if("open"===e.readyState)try{e.endOfStream()}catch(e){r.a.e(this.TAG,e.message)}this._mediaElementProxy=null,e.removeEventListener("sourceopen",this.e.onSourceOpen),e.removeEventListener("sourceended",this.e.onSourceEnded),e.removeEventListener("sourceclose",this.e.onSourceClose),this._useManagedMediaSource&&(e.removeEventListener("startstreaming",this.e.onStartStreaming),e.removeEventListener("endstreaming",this.e.onEndStreaming),e.removeEventListener("qualitychange",this.e.onQualityChange)),this._pendingSourceBufferInit=[],this._isBufferFull=!1,this._mediaSource=null}},e.prototype.isManagedMediaSource=function(){return this._useManagedMediaSource},e.prototype.getObject=function(){if(!this._mediaSource)throw new d.a("MediaSource has not been initialized yet!");return this._mediaSource},e.prototype.getHandle=function(){if(!this._mediaSource)throw new d.a("MediaSource has not been initialized yet!");return this._mediaSource.handle},e.prototype.getObjectURL=function(){if(!this._mediaSource)throw new d.a("MediaSource has not been initialized yet!");return null==this._mediaSourceObjectURL&&(this._mediaSourceObjectURL=URL.createObjectURL(this._mediaSource)),this._mediaSourceObjectURL},e.prototype.revokeObjectURL=function(){this._mediaSourceObjectURL&&(URL.revokeObjectURL(this._mediaSourceObjectURL),this._mediaSourceObjectURL=null)},e.prototype.appendInitSegment=function(e,t){if(void 0===t&&(t=void 0),!this._mediaSource||"open"!==this._mediaSource.readyState||!1===this._mediaSource.streaming)return this._pendingSourceBufferInit.push(e),void this._pendingSegments[e.type].push(e);var i=e,n="".concat(i.container);i.codec&&i.codec.length>0&&("opus"===i.codec&&o.a.safari&&(i.codec="Opus"),n+=";codecs=".concat(i.codec));var a=!1;if(r.a.v(this.TAG,"Received Initialization Segment, mimeType: "+n),this._lastInitSegments[i.type]=i,n!==this._mimeTypes[i.type]){if(this._mimeTypes[i.type])r.a.v(this.TAG,"Notice: ".concat(i.type," mimeType changed, origin: ").concat(this._mimeTypes[i.type],", target: ").concat(n));else{a=!0;try{var d=this._sourceBuffers[i.type]=this._mediaSource.addSourceBuffer(n);d.addEventListener("error",this.e.onSourceBufferError),d.addEventListener("updateend",this.e.onSourceBufferUpdateEnd)}catch(e){return r.a.e(this.TAG,e.message),void this._emitter.emit(s.a.ERROR,{code:e.code,msg:e.message})}}this._mimeTypes[i.type]=n}t||this._pendingSegments[i.type].push(i),a||this._sourceBuffers[i.type]&&!this._sourceBuffers[i.type].updating&&this._doAppendSegments(),o.a.safari&&"audio/mpeg"===i.container&&i.mediaDuration>0&&(this._requireSetMediaDuration=!0,this._pendingMediaDuration=i.mediaDuration/1e3,this._updateMediaSourceDuration())},e.prototype.appendMediaSegment=function(e){var t=e;this._pendingSegments[t.type].push(t),this._config.autoCleanupSourceBuffer&&this._needCleanupSourceBuffer()&&this._doCleanupSourceBuffer();var i=this._sourceBuffers[t.type];!i||i.updating||this._hasPendingRemoveRanges()||this._doAppendSegments()},e.prototype.flush=function(){for(var e in this._sourceBuffers)if(this._sourceBuffers[e]){var t=this._sourceBuffers[e];if("open"===this._mediaSource.readyState)try{t.abort()}catch(e){r.a.e(this.TAG,e.message)}var i=this._pendingSegments[e];if(i.splice(0,i.length),"closed"!==this._mediaSource.readyState){for(var n=0;n<t.buffered.length;n++){var a=t.buffered.start(n),s=t.buffered.end(n);this._pendingRemoveRanges[e].push({start:a,end:s})}if(t.updating||this._doRemoveRanges(),o.a.safari){var d=this._lastInitSegments[e];d&&(this._pendingSegments[e].push(d),t.updating||this._doAppendSegments())}}}},e.prototype.endOfStream=function(){var e=this._mediaSource,t=this._sourceBuffers;e&&"open"===e.readyState?t.video&&t.video.updating||t.audio&&t.audio.updating?this._hasPendingEos=!0:(this._hasPendingEos=!1,e.endOfStream()):e&&"closed"===e.readyState&&this._hasPendingSegments()&&(this._hasPendingEos=!0)},e.prototype._needCleanupSourceBuffer=function(){if(!this._config.autoCleanupSourceBuffer)return!1;var e=this._mediaElementProxy.getCurrentTime();for(var t in this._sourceBuffers){var i=this._sourceBuffers[t];if(i){var n=i.buffered;if(n.length>=1&&e-n.start(0)>=this._config.autoCleanupMaxBackwardDuration)return!0}}return!1},e.prototype._doCleanupSourceBuffer=function(){var e=this._mediaElementProxy.getCurrentTime();for(var t in this._sourceBuffers){var i=this._sourceBuffers[t];if(i){for(var n=i.buffered,a=!1,r=0;r<n.length;r++){var o=n.start(r),s=n.end(r);if(o<=e&&e<s+3){if(e-o>=this._config.autoCleanupMaxBackwardDuration){a=!0;var d=e-this._config.autoCleanupMinBackwardDuration;this._pendingRemoveRanges[t].push({start:o,end:d})}}else s<e&&(a=!0,this._pendingRemoveRanges[t].push({start:o,end:s}))}a&&!i.updating&&this._doRemoveRanges()}}},e.prototype._updateMediaSourceDuration=function(){var e=this._sourceBuffers;if(0!==this._mediaElementProxy.getReadyState()&&"open"===this._mediaSource.readyState&&!(e.video&&e.video.updating||e.audio&&e.audio.updating)){var t=this._mediaSource.duration,i=this._pendingMediaDuration;i>0&&(isNaN(t)||i>t)&&(r.a.v(this.TAG,"Update MediaSource duration from ".concat(t," to ").concat(i)),this._mediaSource.duration=i),this._requireSetMediaDuration=!1,this._pendingMediaDuration=0}},e.prototype._doRemoveRanges=function(){for(var e in this._pendingRemoveRanges)if(this._sourceBuffers[e]&&!this._sourceBuffers[e].updating)for(var t=this._sourceBuffers[e],i=this._pendingRemoveRanges[e];i.length&&!t.updating;){var n=i.shift();t.remove(n.start,n.end)}},e.prototype._doAppendSegments=function(){var e=this._pendingSegments;for(var t in e)if(this._sourceBuffers[t]&&!this._sourceBuffers[t].updating&&!1!==this._mediaSource.streaming&&e[t].length>0){var i=e[t].shift();if("number"==typeof i.timestampOffset&&isFinite(i.timestampOffset)){var n=this._sourceBuffers[t].timestampOffset,a=i.timestampOffset/1e3;Math.abs(n-a)>.1&&(r.a.v(this.TAG,"Update MPEG audio timestampOffset from ".concat(n," to ").concat(a)),this._sourceBuffers[t].timestampOffset=a),delete i.timestampOffset}if(!i.data||0===i.data.byteLength)continue;try{this._sourceBuffers[t].appendBuffer(i.data),this._isBufferFull=!1}catch(e){this._pendingSegments[t].unshift(i),22===e.code?(this._isBufferFull||this._emitter.emit(s.a.BUFFER_FULL),this._isBufferFull=!0):(r.a.e(this.TAG,e.message),this._emitter.emit(s.a.ERROR,{code:e.code,msg:e.message}))}}},e.prototype._onSourceOpen=function(){if(r.a.v(this.TAG,"MediaSource onSourceOpen"),this._mediaSource.removeEventListener("sourceopen",this.e.onSourceOpen),this._pendingSourceBufferInit.length>0)for(var e=this._pendingSourceBufferInit;e.length;){var t=e.shift();this.appendInitSegment(t,!0)}this._hasPendingSegments()&&this._doAppendSegments(),this._emitter.emit(s.a.SOURCE_OPEN)},e.prototype._onStartStreaming=function(){r.a.v(this.TAG,"ManagedMediaSource onStartStreaming"),this._emitter.emit(s.a.START_STREAMING)},e.prototype._onEndStreaming=function(){r.a.v(this.TAG,"ManagedMediaSource onEndStreaming"),this._emitter.emit(s.a.END_STREAMING)},e.prototype._onQualityChange=function(){r.a.v(this.TAG,"ManagedMediaSource onQualityChange")},e.prototype._onSourceEnded=function(){r.a.v(this.TAG,"MediaSource onSourceEnded")},e.prototype._onSourceClose=function(){r.a.v(this.TAG,"MediaSource onSourceClose"),this._mediaSource&&null!=this.e&&(this._mediaSource.removeEventListener("sourceopen",this.e.onSourceOpen),this._mediaSource.removeEventListener("sourceended",this.e.onSourceEnded),this._mediaSource.removeEventListener("sourceclose",this.e.onSourceClose),this._useManagedMediaSource&&(this._mediaSource.removeEventListener("startstreaming",this.e.onStartStreaming),this._mediaSource.removeEventListener("endstreaming",this.e.onEndStreaming),this._mediaSource.removeEventListener("qualitychange",this.e.onQualityChange)))},e.prototype._hasPendingSegments=function(){var e=this._pendingSegments;return e.video.length>0||e.audio.length>0},e.prototype._hasPendingRemoveRanges=function(){var e=this._pendingRemoveRanges;return e.video.length>0||e.audio.length>0},e.prototype._onSourceBufferUpdateEnd=function(){this._requireSetMediaDuration?this._updateMediaSourceDuration():this._hasPendingRemoveRanges()?this._doRemoveRanges():this._hasPendingSegments()?this._doAppendSegments():this._hasPendingEos&&this.endOfStream(),this._emitter.emit(s.a.UPDATE_END)},e.prototype._onSourceBufferError=function(e){r.a.e(this.TAG,"SourceBuffer Error: ".concat(e))},e}();t.a=_},function(e,t,i){"use strict";var n=i(9),a=i.n(n),r=i(18),o=i.n(r),s=i(0),d=i(8),_=i(13),c=i(1),h=(i(19),i(12)),l=function(){function e(e,t){if(this.TAG="Transmuxer",this._emitter=new a.a,t.enableWorker&&"undefined"!=typeof Worker)try{this._worker=o()(19),this._workerDestroying=!1,this._worker.addEventListener("message",this._onWorkerMessage.bind(this)),this._worker.postMessage({cmd:"init",param:[e,t]}),this.e={onLoggingConfigChanged:this._onLoggingConfigChanged.bind(this)},d.a.registerListener(this.e.onLoggingConfigChanged),this._worker.postMessage({cmd:"logging_config",param:d.a.getConfig()})}catch(i){s.a.e(this.TAG,"Error while initialize transmuxing worker, fallback to inline transmuxing"),this._worker=null,this._controller=new _.a(e,t)}else this._controller=new _.a(e,t);if(this._controller){var i=this._controller;i.on(c.a.IO_ERROR,this._onIOError.bind(this)),i.on(c.a.DEMUX_ERROR,this._onDemuxError.bind(this)),i.on(c.a.INIT_SEGMENT,this._onInitSegment.bind(this)),i.on(c.a.MEDIA_SEGMENT,this._onMediaSegment.bind(this)),i.on(c.a.LOADING_COMPLETE,this._onLoadingComplete.bind(this)),i.on(c.a.RECOVERED_EARLY_EOF,this._onRecoveredEarlyEof.bind(this)),i.on(c.a.MEDIA_INFO,this._onMediaInfo.bind(this)),i.on(c.a.METADATA_ARRIVED,this._onMetaDataArrived.bind(this)),i.on(c.a.SCRIPTDATA_ARRIVED,this._onScriptDataArrived.bind(this)),i.on(c.a.TIMED_ID3_METADATA_ARRIVED,this._onTimedID3MetadataArrived.bind(this)),i.on(c.a.SYNCHRONOUS_KLV_METADATA_ARRIVED,this._onSynchronousKLVMetadataArrived.bind(this)),i.on(c.a.ASYNCHRONOUS_KLV_METADATA_ARRIVED,this._onAsynchronousKLVMetadataArrived.bind(this)),i.on(c.a.SMPTE2038_METADATA_ARRIVED,this._onSMPTE2038MetadataArrived.bind(this)),i.on(c.a.SCTE35_METADATA_ARRIVED,this._onSCTE35MetadataArrived.bind(this)),i.on(c.a.PES_PRIVATE_DATA_DESCRIPTOR,this._onPESPrivateDataDescriptor.bind(this)),i.on(c.a.PES_PRIVATE_DATA_ARRIVED,this._onPESPrivateDataArrived.bind(this)),i.on(c.a.STATISTICS_INFO,this._onStatisticsInfo.bind(this)),i.on(c.a.RECOMMEND_SEEKPOINT,this._onRecommendSeekpoint.bind(this))}}return e.prototype.destroy=function(){this._worker?this._workerDestroying||(this._workerDestroying=!0,this._worker.postMessage({cmd:"destroy"}),d.a.removeListener(this.e.onLoggingConfigChanged),this.e=null):(this._controller.destroy(),this._controller=null),this._emitter.removeAllListeners(),this._emitter=null},e.prototype.on=function(e,t){this._emitter.addListener(e,t)},e.prototype.off=function(e,t){this._emitter.removeListener(e,t)},e.prototype.hasWorker=function(){return null!=this._worker},e.prototype.open=function(){this._worker?this._worker.postMessage({cmd:"start"}):this._controller.start()},e.prototype.close=function(){this._worker?this._worker.postMessage({cmd:"stop"}):this._controller.stop()},e.prototype.seek=function(e){this._worker?this._worker.postMessage({cmd:"seek",param:e}):this._controller.seek(e)},e.prototype.pause=function(){this._worker?this._worker.postMessage({cmd:"pause"}):this._controller.pause()},e.prototype.resume=function(){this._worker?this._worker.postMessage({cmd:"resume"}):this._controller.resume()},e.prototype._onInitSegment=function(e,t){var i=this;Promise.resolve().then((function(){i._emitter.emit(c.a.INIT_SEGMENT,e,t)}))},e.prototype._onMediaSegment=function(e,t){var i=this;Promise.resolve().then((function(){i._emitter.emit(c.a.MEDIA_SEGMENT,e,t)}))},e.prototype._onLoadingComplete=function(){var e=this;Promise.resolve().then((function(){e._emitter.emit(c.a.LOADING_COMPLETE)}))},e.prototype._onRecoveredEarlyEof=function(){var e=this;Promise.resolve().then((function(){e._emitter.emit(c.a.RECOVERED_EARLY_EOF)}))},e.prototype._onMediaInfo=function(e){var t=this;Promise.resolve().then((function(){t._emitter.emit(c.a.MEDIA_INFO,e)}))},e.prototype._onMetaDataArrived=function(e){var t=this;Promise.resolve().then((function(){t._emitter.emit(c.a.METADATA_ARRIVED,e)}))},e.prototype._onScriptDataArrived=function(e){var t=this;Promise.resolve().then((function(){t._emitter.emit(c.a.SCRIPTDATA_ARRIVED,e)}))},e.prototype._onTimedID3MetadataArrived=function(e){var t=this;Promise.resolve().then((function(){t._emitter.emit(c.a.TIMED_ID3_METADATA_ARRIVED,e)}))},e.prototype._onSynchronousKLVMetadataArrived=function(e){var t=this;Promise.resolve().then((function(){t._emitter.emit(c.a.SYNCHRONOUS_KLV_METADATA_ARRIVED,e)}))},e.prototype._onAsynchronousKLVMetadataArrived=function(e){var t=this;Promise.resolve().then((function(){t._emitter.emit(c.a.ASYNCHRONOUS_KLV_METADATA_ARRIVED,e)}))},e.prototype._onSMPTE2038MetadataArrived=function(e){var t=this;Promise.resolve().then((function(){t._emitter.emit(c.a.SMPTE2038_METADATA_ARRIVED,e)}))},e.prototype._onSCTE35MetadataArrived=function(e){var t=this;Promise.resolve().then((function(){t._emitter.emit(c.a.SCTE35_METADATA_ARRIVED,e)}))},e.prototype._onPESPrivateDataDescriptor=function(e){var t=this;Promise.resolve().then((function(){t._emitter.emit(c.a.PES_PRIVATE_DATA_DESCRIPTOR,e)}))},e.prototype._onPESPrivateDataArrived=function(e){var t=this;Promise.resolve().then((function(){t._emitter.emit(c.a.PES_PRIVATE_DATA_ARRIVED,e)}))},e.prototype._onStatisticsInfo=function(e){var t=this;Promise.resolve().then((function(){t._emitter.emit(c.a.STATISTICS_INFO,e)}))},e.prototype._onIOError=function(e,t){var i=this;Promise.resolve().then((function(){i._emitter.emit(c.a.IO_ERROR,e,t)}))},e.prototype._onDemuxError=function(e,t){var i=this;Promise.resolve().then((function(){i._emitter.emit(c.a.DEMUX_ERROR,e,t)}))},e.prototype._onRecommendSeekpoint=function(e){var t=this;Promise.resolve().then((function(){t._emitter.emit(c.a.RECOMMEND_SEEKPOINT,e)}))},e.prototype._onLoggingConfigChanged=function(e){this._worker&&this._worker.postMessage({cmd:"logging_config",param:e})},e.prototype._onWorkerMessage=function(e){var t=e.data,i=t.data;if("destroyed"===t.msg||this._workerDestroying)return this._workerDestroying=!1,this._worker.terminate(),void(this._worker=null);switch(t.msg){case c.a.INIT_SEGMENT:case c.a.MEDIA_SEGMENT:this._emitter.emit(t.msg,i.type,i.data);break;case c.a.LOADING_COMPLETE:case c.a.RECOVERED_EARLY_EOF:this._emitter.emit(t.msg);break;case c.a.MEDIA_INFO:Object.setPrototypeOf(i,h.a.prototype),this._emitter.emit(t.msg,i);break;case c.a.METADATA_ARRIVED:case c.a.SCRIPTDATA_ARRIVED:case c.a.TIMED_ID3_METADATA_ARRIVED:case c.a.SYNCHRONOUS_KLV_METADATA_ARRIVED:case c.a.ASYNCHRONOUS_KLV_METADATA_ARRIVED:case c.a.SMPTE2038_METADATA_ARRIVED:case c.a.SCTE35_METADATA_ARRIVED:case c.a.PES_PRIVATE_DATA_DESCRIPTOR:case c.a.PES_PRIVATE_DATA_ARRIVED:case c.a.STATISTICS_INFO:this._emitter.emit(t.msg,i);break;case c.a.IO_ERROR:case c.a.DEMUX_ERROR:this._emitter.emit(t.msg,i.type,i.info);break;case c.a.RECOMMEND_SEEKPOINT:this._emitter.emit(t.msg,i);break;case"logcat_callback":s.a.emitter.emit("log",i.type,i.logcat)}},e}();t.a=l},function(e,t,i){function n(e){var t={};function i(n){if(t[n])return t[n].exports;var a=t[n]={i:n,l:!1,exports:{}};return e[n].call(a.exports,a,a.exports,i),a.l=!0,a.exports}i.m=e,i.c=t,i.i=function(e){return e},i.d=function(e,t,n){i.o(e,t)||Object.defineProperty(e,t,{configurable:!1,enumerable:!0,get:n})},i.r=function(e){Object.defineProperty(e,"__esModule",{value:!0})},i.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return i.d(t,"a",t),t},i.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},i.p="/",i.oe=function(e){throw console.error(e),e};var n=i(i.s=ENTRY_MODULE);return n.default||n}function a(e){return(e+"").replace(/[.?*+^$[\]\\(){}|-]/g,"\\$&")}function r(e,t,n){var r={};r[n]=[];var o=t.toString(),s=o.match(/^function\s?\w*\(\w+,\s*\w+,\s*(\w+)\)/);if(!s)return r;for(var d,_=s[1],c=new RegExp("(\\\\n|\\W)"+a(_)+"\\(\\s*(/\\*.*?\\*/)?\\s*.*?([\\.|\\-|\\+|\\w|/|@]+).*?\\)","g");d=c.exec(o);)"dll-reference"!==d[3]&&r[n].push(d[3]);for(c=new RegExp("\\("+a(_)+'\\("(dll-reference\\s([\\.|\\-|\\+|\\w|/|@]+))"\\)\\)\\(\\s*(/\\*.*?\\*/)?\\s*.*?([\\.|\\-|\\+|\\w|/|@]+).*?\\)',"g");d=c.exec(o);)e[d[2]]||(r[n].push(d[1]),e[d[2]]=i(d[1]).m),r[d[2]]=r[d[2]]||[],r[d[2]].push(d[4]);for(var h,l=Object.keys(r),u=0;u<l.length;u++)for(var f=0;f<r[l[u]].length;f++)h=r[l[u]][f],isNaN(1*h)||(r[l[u]][f]=1*r[l[u]][f]);return r}function o(e){return Object.keys(e).reduce((function(t,i){return t||e[i].length>0}),!1)}e.exports=function(e,t){t=t||{};var a={main:i.m},s=t.all?{main:Object.keys(a.main)}:function(e,t){for(var i={main:[t]},n={main:[]},a={main:{}};o(i);)for(var s=Object.keys(i),d=0;d<s.length;d++){var _=s[d],c=i[_].pop();if(a[_]=a[_]||{},!a[_][c]&&e[_][c]){a[_][c]=!0,n[_]=n[_]||[],n[_].push(c);for(var h=r(e,e[_][c],_),l=Object.keys(h),u=0;u<l.length;u++)i[l[u]]=i[l[u]]||[],i[l[u]]=i[l[u]].concat(h[l[u]])}}return n}(a,e),d="";Object.keys(s).filter((function(e){return"main"!==e})).forEach((function(e){for(var t=0;s[e][t];)t++;s[e].push(t),a[e][t]="(function(module, exports, __webpack_require__) { module.exports = __webpack_require__; })",d=d+"var "+e+" = ("+n.toString().replace("ENTRY_MODULE",JSON.stringify(t))+")({"+s[e].map((function(t){return JSON.stringify(t)+": "+a[e][t].toString()})).join(",")+"});\n"})),d=d+"new (("+n.toString().replace("ENTRY_MODULE",JSON.stringify(e))+")({"+s.main.map((function(e){return JSON.stringify(e)+": "+a.main[e].toString()})).join(",")+"}))(self);";var _=new self.Blob([d],{type:"text/javascript"});if(t.bare)return _;var c=(self.URL||self.webkitURL||self.mozURL||self.msURL).createObjectURL(_),h=new self.Worker(c);return h.objectURL=c,h}},function(e,t,i){"use strict";i.r(t);i(0);var n=i(8),a=i(15),r=i(13),o=i(1);t.default=function(e){var t=null,i=function(t,i){e.postMessage({msg:"logcat_callback",data:{type:t,logcat:i}})}.bind(this);function s(t,i){var n={msg:o.a.INIT_SEGMENT,data:{type:t,data:i}};e.postMessage(n,[i.data])}function d(t,i){var n={msg:o.a.MEDIA_SEGMENT,data:{type:t,data:i}};e.postMessage(n,[i.data])}function _(){var t={msg:o.a.LOADING_COMPLETE};e.postMessage(t)}function c(){var t={msg:o.a.RECOVERED_EARLY_EOF};e.postMessage(t)}function h(t){var i={msg:o.a.MEDIA_INFO,data:t};e.postMessage(i)}function l(t){var i={msg:o.a.METADATA_ARRIVED,data:t};e.postMessage(i)}function u(t){var i={msg:o.a.SCRIPTDATA_ARRIVED,data:t};e.postMessage(i)}function f(t){var i={msg:o.a.TIMED_ID3_METADATA_ARRIVED,data:t};e.postMessage(i)}function p(t){var i={msg:o.a.SYNCHRONOUS_KLV_METADATA_ARRIVED,data:t};e.postMessage(i)}function m(t){var i={msg:o.a.ASYNCHRONOUS_KLV_METADATA_ARRIVED,data:t};e.postMessage(i)}function g(t){var i={msg:o.a.SMPTE2038_METADATA_ARRIVED,data:t};e.postMessage(i)}function v(t){var i={msg:o.a.SCTE35_METADATA_ARRIVED,data:t};e.postMessage(i)}function y(t){var i={msg:o.a.PES_PRIVATE_DATA_DESCRIPTOR,data:t};e.postMessage(i)}function S(t){var i={msg:o.a.PES_PRIVATE_DATA_ARRIVED,data:t};e.postMessage(i)}function b(t){var i={msg:o.a.STATISTICS_INFO,data:t};e.postMessage(i)}function A(t,i){e.postMessage({msg:o.a.IO_ERROR,data:{type:t,info:i}})}function E(t,i){e.postMessage({msg:o.a.DEMUX_ERROR,data:{type:t,info:i}})}function R(t){e.postMessage({msg:o.a.RECOMMEND_SEEKPOINT,data:t})}a.a.install(),e.addEventListener("message",(function(a){switch(a.data.cmd){case"init":(t=new r.a(a.data.param[0],a.data.param[1])).on(o.a.IO_ERROR,A.bind(this)),t.on(o.a.DEMUX_ERROR,E.bind(this)),t.on(o.a.INIT_SEGMENT,s.bind(this)),t.on(o.a.MEDIA_SEGMENT,d.bind(this)),t.on(o.a.LOADING_COMPLETE,_.bind(this)),t.on(o.a.RECOVERED_EARLY_EOF,c.bind(this)),t.on(o.a.MEDIA_INFO,h.bind(this)),t.on(o.a.METADATA_ARRIVED,l.bind(this)),t.on(o.a.SCRIPTDATA_ARRIVED,u.bind(this)),t.on(o.a.TIMED_ID3_METADATA_ARRIVED,f.bind(this)),t.on(o.a.SYNCHRONOUS_KLV_METADATA_ARRIVED,p.bind(this)),t.on(o.a.ASYNCHRONOUS_KLV_METADATA_ARRIVED,m.bind(this)),t.on(o.a.SMPTE2038_METADATA_ARRIVED,g.bind(this)),t.on(o.a.SCTE35_METADATA_ARRIVED,v.bind(this)),t.on(o.a.PES_PRIVATE_DATA_DESCRIPTOR,y.bind(this)),t.on(o.a.PES_PRIVATE_DATA_ARRIVED,S.bind(this)),t.on(o.a.STATISTICS_INFO,b.bind(this)),t.on(o.a.RECOMMEND_SEEKPOINT,R.bind(this));break;case"destroy":t&&(t.destroy(),t=null),e.postMessage({msg:"destroyed"});break;case"start":t.start();break;case"stop":t.stop();break;case"seek":t.seek(a.data.param);break;case"pause":t.pause();break;case"resume":t.resume();break;case"logging_config":var T=a.data.param;n.a.applyConfig(T),!0===T.enableCallback?n.a.addLogListener(i):n.a.removeLogListener(i)}}))}},function(e,t,i){e.exports=i(25).default},function(e,t,i){(function(t,i){
+/*!
+ * @overview es6-promise - a tiny implementation of Promises/A+.
+ * @copyright Copyright (c) 2014 Yehuda Katz, Tom Dale, Stefan Penner and contributors (Conversion to ES6 API by Jake Archibald)
+ * @license   Licensed under MIT license
+ *            See https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
+ * @version   v4.2.8+1e68dce6
+ */var n;n=function(){"use strict";function e(e){return"function"==typeof e}var n=Array.isArray?Array.isArray:function(e){return"[object Array]"===Object.prototype.toString.call(e)},a=0,r=void 0,o=void 0,s=function(e,t){f[a]=e,f[a+1]=t,2===(a+=2)&&(o?o(p):S())},d="undefined"!=typeof window?window:void 0,_=d||{},c=_.MutationObserver||_.WebKitMutationObserver,h="undefined"==typeof self&&void 0!==t&&"[object process]"==={}.toString.call(t),l="undefined"!=typeof Uint8ClampedArray&&"undefined"!=typeof importScripts&&"undefined"!=typeof MessageChannel;function u(){var e=setTimeout;return function(){return e(p,1)}}var f=new Array(1e3);function p(){for(var e=0;e<a;e+=2)(0,f[e])(f[e+1]),f[e]=void 0,f[e+1]=void 0;a=0}var m,g,v,y,S=void 0;function b(e,t){var i=this,n=new this.constructor(R);void 0===n[E]&&I(n);var a=i._state;if(a){var r=arguments[a-1];s((function(){return O(a,n,r,i._result)}))}else C(i,n,e,t);return n}function A(e){if(e&&"object"==typeof e&&e.constructor===this)return e;var t=new this(R);return L(t,e),t}h?S=function(){return t.nextTick(p)}:c?(g=0,v=new c(p),y=document.createTextNode(""),v.observe(y,{characterData:!0}),S=function(){y.data=g=++g%2}):l?((m=new MessageChannel).port1.onmessage=p,S=function(){return m.port2.postMessage(0)}):S=void 0===d?function(){try{var e=Function("return this")().require("vertx");return void 0!==(r=e.runOnLoop||e.runOnContext)?function(){r(p)}:u()}catch(e){return u()}}():u();var E=Math.random().toString(36).substring(2);function R(){}function T(t,i,n){i.constructor===t.constructor&&n===b&&i.constructor.resolve===A?function(e,t){1===t._state?w(e,t._result):2===t._state?M(e,t._result):C(t,void 0,(function(t){return L(e,t)}),(function(t){return M(e,t)}))}(t,i):void 0===n?w(t,i):e(n)?function(e,t,i){s((function(e){var n=!1,a=function(e,t,i,n){try{e.call(t,i,n)}catch(e){return e}}(i,t,(function(i){n||(n=!0,t!==i?L(e,i):w(e,i))}),(function(t){n||(n=!0,M(e,t))}),e._label);!n&&a&&(n=!0,M(e,a))}),e)}(t,i,n):w(t,i)}function L(e,t){if(e===t)M(e,new TypeError("You cannot resolve a promise with itself"));else if(a=typeof(n=t),null===n||"object"!==a&&"function"!==a)w(e,t);else{var i=void 0;try{i=t.then}catch(t){return void M(e,t)}T(e,t,i)}var n,a}function k(e){e._onerror&&e._onerror(e._result),D(e)}function w(e,t){void 0===e._state&&(e._result=t,e._state=1,0!==e._subscribers.length&&s(D,e))}function M(e,t){void 0===e._state&&(e._state=2,e._result=t,s(k,e))}function C(e,t,i,n){var a=e._subscribers,r=a.length;e._onerror=null,a[r]=t,a[r+1]=i,a[r+2]=n,0===r&&e._state&&s(D,e)}function D(e){var t=e._subscribers,i=e._state;if(0!==t.length){for(var n=void 0,a=void 0,r=e._result,o=0;o<t.length;o+=3)n=t[o],a=t[o+i],n?O(i,n,a,r):a(r);e._subscribers.length=0}}function O(t,i,n,a){var r=e(n),o=void 0,s=void 0,d=!0;if(r){try{o=n(a)}catch(e){d=!1,s=e}if(i===o)return void M(i,new TypeError("A promises callback cannot return that same promise."))}else o=a;void 0!==i._state||(r&&d?L(i,o):!1===d?M(i,s):1===t?w(i,o):2===t&&M(i,o))}var B=0;function I(e){e[E]=B++,e._state=void 0,e._result=void 0,e._subscribers=[]}var P=function(){function e(e,t){this._instanceConstructor=e,this.promise=new e(R),this.promise[E]||I(this.promise),n(t)?(this.length=t.length,this._remaining=t.length,this._result=new Array(this.length),0===this.length?w(this.promise,this._result):(this.length=this.length||0,this._enumerate(t),0===this._remaining&&w(this.promise,this._result))):M(this.promise,new Error("Array Methods must be provided an Array"))}return e.prototype._enumerate=function(e){for(var t=0;void 0===this._state&&t<e.length;t++)this._eachEntry(e[t],t)},e.prototype._eachEntry=function(e,t){var i=this._instanceConstructor,n=i.resolve;if(n===A){var a=void 0,r=void 0,o=!1;try{a=e.then}catch(e){o=!0,r=e}if(a===b&&void 0!==e._state)this._settledAt(e._state,t,e._result);else if("function"!=typeof a)this._remaining--,this._result[t]=e;else if(i===x){var s=new i(R);o?M(s,r):T(s,e,a),this._willSettleAt(s,t)}else this._willSettleAt(new i((function(t){return t(e)})),t)}else this._willSettleAt(n(e),t)},e.prototype._settledAt=function(e,t,i){var n=this.promise;void 0===n._state&&(this._remaining--,2===e?M(n,i):this._result[t]=i),0===this._remaining&&w(n,this._result)},e.prototype._willSettleAt=function(e,t){var i=this;C(e,void 0,(function(e){return i._settledAt(1,t,e)}),(function(e){return i._settledAt(2,t,e)}))},e}(),x=function(){function t(e){this[E]=B++,this._result=this._state=void 0,this._subscribers=[],R!==e&&("function"!=typeof e&&function(){throw new TypeError("You must pass a resolver function as the first argument to the promise constructor")}(),this instanceof t?function(e,t){try{t((function(t){L(e,t)}),(function(t){M(e,t)}))}catch(t){M(e,t)}}(this,e):function(){throw new TypeError("Failed to construct 'Promise': Please use the 'new' operator, this object constructor cannot be called as a function.")}())}return t.prototype.catch=function(e){return this.then(null,e)},t.prototype.finally=function(t){var i=this.constructor;return e(t)?this.then((function(e){return i.resolve(t()).then((function(){return e}))}),(function(e){return i.resolve(t()).then((function(){throw e}))})):this.then(t,t)},t}();return x.prototype.then=b,x.all=function(e){return new P(this,e).promise},x.race=function(e){var t=this;return n(e)?new t((function(i,n){for(var a=e.length,r=0;r<a;r++)t.resolve(e[r]).then(i,n)})):new t((function(e,t){return t(new TypeError("You must pass an array to race."))}))},x.resolve=A,x.reject=function(e){var t=new this(R);return M(t,e),t},x._setScheduler=function(e){o=e},x._setAsap=function(e){s=e},x._asap=s,x.polyfill=function(){var e=void 0;if(void 0!==i)e=i;else if("undefined"!=typeof self)e=self;else try{e=Function("return this")()}catch(e){throw new Error("polyfill failed because global object is unavailable in this environment")}var t=e.Promise;if(t){var n=null;try{n=Object.prototype.toString.call(t.resolve())}catch(e){}if("[object Promise]"===n&&!t.cast)return}e.Promise=x},x.Promise=x,x},e.exports=n()}).call(this,i(22),i(23))},function(e,t){var i,n,a=e.exports={};function r(){throw new Error("setTimeout has not been defined")}function o(){throw new Error("clearTimeout has not been defined")}function s(e){if(i===setTimeout)return setTimeout(e,0);if((i===r||!i)&&setTimeout)return i=setTimeout,setTimeout(e,0);try{return i(e,0)}catch(t){try{return i.call(null,e,0)}catch(t){return i.call(this,e,0)}}}!function(){try{i="function"==typeof setTimeout?setTimeout:r}catch(e){i=r}try{n="function"==typeof clearTimeout?clearTimeout:o}catch(e){n=o}}();var d,_=[],c=!1,h=-1;function l(){c&&d&&(c=!1,d.length?_=d.concat(_):h=-1,_.length&&u())}function u(){if(!c){var e=s(l);c=!0;for(var t=_.length;t;){for(d=_,_=[];++h<t;)d&&d[h].run();h=-1,t=_.length}d=null,c=!1,function(e){if(n===clearTimeout)return clearTimeout(e);if((n===o||!n)&&clearTimeout)return n=clearTimeout,clearTimeout(e);try{n(e)}catch(t){try{return n.call(null,e)}catch(t){return n.call(this,e)}}}(e)}}function f(e,t){this.fun=e,this.array=t}function p(){}a.nextTick=function(e){var t=new Array(arguments.length-1);if(arguments.length>1)for(var i=1;i<arguments.length;i++)t[i-1]=arguments[i];_.push(new f(e,t)),1!==_.length||c||s(u)},f.prototype.run=function(){this.fun.apply(null,this.array)},a.title="browser",a.browser=!0,a.env={},a.argv=[],a.version="",a.versions={},a.on=p,a.addListener=p,a.once=p,a.off=p,a.removeListener=p,a.removeAllListeners=p,a.emit=p,a.prependListener=p,a.prependOnceListener=p,a.listeners=function(e){return[]},a.binding=function(e){throw new Error("process.binding is not supported")},a.cwd=function(){return"/"},a.chdir=function(e){throw new Error("process.chdir is not supported")},a.umask=function(){return 0}},function(e,t){var i;i=function(){return this}();try{i=i||new Function("return this")()}catch(e){"object"==typeof window&&(i=window)}e.exports=i},function(e,t,i){"use strict";i.r(t);var n=i(0),a=i(8),r=i(3),o=i(7),s=i(16),d=i(17),_=i(1),c=i(4),h=i(10);t.default=function(e){var t="PlayerEngineWorker",i=function(t,i){e.postMessage({msg:"logcat_callback",type:t,logcat:i})}.bind(void 0),l=null,u=null,f=null,p=null,m=!1,g=!1,v=0,y=0,S=!1;function b(){f&&(f.shutdown(),f.destroy(),f=null)}function A(){if(null==l||null==u)throw new r.a("Worker not initialized");if(p)throw new r.a("Transmuxer has been initialized");g||(!u.deferLoadAfterSourceOpen||m?((p=new d.a(l,u)).on(_.a.INIT_SEGMENT,(function(e,t){f.appendInitSegment(t)})),p.on(_.a.MEDIA_SEGMENT,(function(t,i){f.appendMediaSegment(i),e.postMessage({msg:"buffered_position_changed",buffered_position_milliseconds:i.info.endDts})})),p.on(_.a.LOADING_COMPLETE,(function(){f.endOfStream(),e.postMessage({msg:"player_event",event:c.a.LOADING_COMPLETE})})),p.on(_.a.RECOVERED_EARLY_EOF,(function(){e.postMessage({msg:"player_event",event:c.a.RECOVERED_EARLY_EOF})})),p.on(_.a.IO_ERROR,(function(t,i){e.postMessage({msg:"player_event",event:c.a.ERROR,error_type:h.b.NETWORK_ERROR,error_detail:t,info:i})})),p.on(_.a.DEMUX_ERROR,(function(t,i){e.postMessage({msg:"player_event",event:c.a.ERROR,error_type:h.b.MEDIA_ERROR,error_detail:t,info:i})})),p.on(_.a.MEDIA_INFO,(function(e){w(_.a.MEDIA_INFO,e)})),p.on(_.a.STATISTICS_INFO,(function(e){w(_.a.STATISTICS_INFO,e)})),p.on(_.a.RECOMMEND_SEEKPOINT,(function(t){!function(t){e.postMessage({msg:"transmuxing_event",event:_.a.RECOMMEND_SEEKPOINT,milliseconds:t})}(t)})),p.on(_.a.METADATA_ARRIVED,(function(e){M(c.a.METADATA_ARRIVED,e)})),p.on(_.a.SCRIPTDATA_ARRIVED,(function(e){M(c.a.SCRIPTDATA_ARRIVED,e)})),p.on(_.a.TIMED_ID3_METADATA_ARRIVED,(function(e){M(c.a.TIMED_ID3_METADATA_ARRIVED,e)})),p.on(_.a.SYNCHRONOUS_KLV_METADATA_ARRIVED,(function(e){M(c.a.SYNCHRONOUS_KLV_METADATA_ARRIVED,e)})),p.on(_.a.ASYNCHRONOUS_KLV_METADATA_ARRIVED,(function(e){M(c.a.ASYNCHRONOUS_KLV_METADATA_ARRIVED,e)})),p.on(_.a.SMPTE2038_METADATA_ARRIVED,(function(e){M(c.a.SMPTE2038_METADATA_ARRIVED,e)})),p.on(_.a.SCTE35_METADATA_ARRIVED,(function(e){M(c.a.SCTE35_METADATA_ARRIVED,e)})),p.on(_.a.PES_PRIVATE_DATA_DESCRIPTOR,(function(e){M(c.a.PES_PRIVATE_DATA_DESCRIPTOR,e)})),p.on(_.a.PES_PRIVATE_DATA_ARRIVED,(function(e){M(c.a.PES_PRIVATE_DATA_ARRIVED,e)})),p.open()):g=!0)}function E(){f&&f.flush(),p&&(p.close(),p.destroy(),p=null)}function R(){m=!0,g&&(g=!1,A())}function T(){e.postMessage({msg:"mse_event",event:o.a.UPDATE_END})}function L(){n.a.v(t,"MSE SourceBuffer is full, report to main thread"),e.postMessage({msg:"mse_event",event:o.a.BUFFER_FULL})}function k(t){e.postMessage({msg:"player_event",event:c.a.ERROR,error_type:h.b.MEDIA_ERROR,error_detail:h.b.MEDIA_MSE_ERROR,info:t})}function w(t,i){e.postMessage({msg:"transmuxing_event",event:t,info:i})}function M(t,i){e.postMessage({msg:"player_event",event:t,extraData:i})}e.addEventListener("message",(function(r){if(!S){var d=r.data;switch(d.cmd){case"logging_config":var _=d;a.a.applyConfig(_.logging_config),!0===_.logging_config.enableCallback?a.a.addLogListener(i):a.a.removeLogListener(i);break;case"init":l=(_=d).media_data_source,u=_.config;break;case"destroy":!function(){p&&E();f&&b();S=!0,e.postMessage({msg:"destroyed"})}();break;case"initialize_mse":!function(){n.a.v(t,"Initializing MediaSource in DedicatedWorker"),(f=new s.a(u)).on(o.a.SOURCE_OPEN,R.bind(this)),f.on(o.a.UPDATE_END,T.bind(this)),f.on(o.a.BUFFER_FULL,L.bind(this)),f.on(o.a.ERROR,k.bind(this)),f.initialize({getCurrentTime:function(){return v},getReadyState:function(){return y}});var i=f.getHandle();e.postMessage({msg:"mse_init",handle:i},[i])}();break;case"shutdown_mse":b();break;case"load":A();break;case"unload":E();break;case"unbuffered_seek":_=d;f.flush(),p.seek(_.milliseconds);break;case"timeupdate":v=(_=d).current_time;break;case"readystatechange":y=(_=d).ready_state;break;case"pause_transmuxer":p.pause();break;case"resume_transmuxer":p.resume()}}}))}},function(e,t,i){"use strict";i.r(t);var n=i(15),a=i(14),r={enableWorker:!1,enableWorkerForMSE:!1,enableStashBuffer:!0,stashInitialSize:void 0,isLive:!1,liveBufferLatencyChasing:!1,liveBufferLatencyChasingOnPaused:!1,liveBufferLatencyMaxLatency:1.5,liveBufferLatencyMinRemain:.5,liveSync:!1,liveSyncMaxLatency:1.2,liveSyncTargetLatency:.8,liveSyncPlaybackRate:1.2,lazyLoad:!0,lazyLoadMaxDuration:180,lazyLoadRecoverDuration:30,deferLoadAfterSourceOpen:!0,autoCleanupMaxBackwardDuration:180,autoCleanupMinBackwardDuration:120,statisticsInfoReportInterval:600,fixAudioTimestampGap:!0,accurateSeek:!1,seekType:"range",seekParamStart:"bstart",seekParamEnd:"bend",rangeLoadZeroStart:!1,customSeekHandler:void 0,reuseRedirectedURL:!1,headers:void 0,customLoader:void 0};function o(){return Object.assign({},r)}var s=function(){function e(){}return e.supportMSEH264Playback=function(){var e=self.MediaSource&&self.MediaSource.isTypeSupported('video/mp4; codecs="avc1.42E01E,mp4a.40.2"'),t=self.ManagedMediaSource&&self.ManagedMediaSource.isTypeSupported('video/mp4; codecs="avc1.42E01E,mp4a.40.2"');return e||t},e.supportMSEH265Playback=function(){var e=self.MediaSource&&self.MediaSource.isTypeSupported('video/mp4; codecs="hvc1.1.6.L93.B0"'),t=self.ManagedMediaSource&&self.ManagedMediaSource.isTypeSupported('video/mp4; codecs="hvc1.1.6.L93.B0"');return e||t},e.supportNetworkStreamIO=function(){var e=new a.a({},o()),t=e.loaderType;return e.destroy(),"fetch-stream-loader"==t||"xhr-moz-chunked-loader"==t},e.getNetworkLoaderTypeName=function(){var e=new a.a({},o()),t=e.loaderType;return e.destroy(),t},e.supportNativeMediaPlayback=function(t){null==e.videoElement&&(e.videoElement=window.document.createElement("video"));var i=e.videoElement.canPlayType(t);return"probably"===i||"maybe"==i},e.getFeatureList=function(){var t={msePlayback:!1,mseLivePlayback:!1,mseH265Playback:!1,networkStreamIO:!1,networkLoaderName:"",nativeMP4H264Playback:!1,nativeMP4H265Playback:!1,nativeWebmVP8Playback:!1,nativeWebmVP9Playback:!1};return t.msePlayback=e.supportMSEH264Playback(),t.networkStreamIO=e.supportNetworkStreamIO(),t.networkLoaderName=e.getNetworkLoaderTypeName(),t.mseLivePlayback=t.msePlayback&&t.networkStreamIO,t.mseH265Playback=e.supportMSEH265Playback(),t.nativeMP4H264Playback=e.supportNativeMediaPlayback('video/mp4; codecs="avc1.42001E, mp4a.40.2"'),t.nativeMP4H265Playback=e.supportNativeMediaPlayback('video/mp4; codecs="hvc1.1.6.L93.B0"'),t.nativeWebmVP8Playback=e.supportNativeMediaPlayback('video/webm; codecs="vp8.0, vorbis"'),t.nativeWebmVP9Playback=e.supportNativeMediaPlayback('video/webm; codecs="vp9"'),t},e}(),d=i(2),_=i(0),c=i(9),h=i.n(c),l=i(16),u=i(4),f=i(17),p=i(7),m=i(10),g=i(3),v=i(1),y=i(5),S=i(11),b=function(){function e(e,t,i){this.TAG="SeekingHandler",this._config=null,this._media_element=null,this._always_seek_keyframe=!1,this._on_unbuffered_seek=null,this._request_set_current_time=!1,this._seek_request_record_clocktime=null,this._idr_sample_list=new S.a,this.e=null,this._config=e,this._media_element=t,this._on_unbuffered_seek=i,this.e={onMediaSeeking:this._onMediaSeeking.bind(this)};var n=y.a.chrome&&(y.a.version.major<50||50===y.a.version.major&&y.a.version.build<2661);this._always_seek_keyframe=!!(n||y.a.msedge||y.a.msie),this._always_seek_keyframe&&(this._config.accurateSeek=!1),this._media_element.addEventListener("seeking",this.e.onMediaSeeking)}return e.prototype.destroy=function(){this._idr_sample_list.clear(),this._idr_sample_list=null,this._media_element.removeEventListener("seeking",this.e.onMediaSeeking),this._media_element=null,this._on_unbuffered_seek=null},e.prototype.seek=function(e){var t=this._isPositionBuffered(e),i=!1;if(e<1&&this._media_element.buffered.length>0){var n=this._media_element.buffered.start(0);(n<1&&e<n||y.a.safari)&&(i=!0,e=y.a.safari?.1:n)}if(i)this.directSeek(e);else if(t)if(this._always_seek_keyframe){var a=this._getNearestKeyframe(Math.floor(1e3*e));null!=a&&(e=a.dts/1e3),this.directSeek(e)}else this.directSeek(e);else this._idr_sample_list.clear(),this._on_unbuffered_seek(Math.floor(1e3*e)),this._config.accurateSeek&&this.directSeek(e)},e.prototype.directSeek=function(e){this._request_set_current_time=!0,this._media_element.currentTime=e},e.prototype.appendSyncPoints=function(e){this._idr_sample_list.appendArray(e)},e.prototype._onMediaSeeking=function(t){if(this._request_set_current_time)this._request_set_current_time=!1;else{var i=this._media_element.currentTime,n=this._media_element.buffered;if(i<1&&n.length>0){var a=n.start(0);if(a<1&&i<a||y.a.safari){var r=y.a.safari?.1:a;return void this.directSeek(r)}}if(this._isPositionBuffered(i)){if(this._always_seek_keyframe){var o=this._getNearestKeyframe(Math.floor(1e3*i));null!=o&&(i=o.dts/1e3,this.directSeek(i))}}else this._seek_request_record_clocktime=e._getClockTime(),window.setTimeout(this._pollAndApplyUnbufferedSeek.bind(this),50)}},e.prototype._pollAndApplyUnbufferedSeek=function(){if(null!=this._seek_request_record_clocktime)if(this._seek_request_record_clocktime<=e._getClockTime()-100){var t=this._media_element.currentTime;this._seek_request_record_clocktime=null,this._isPositionBuffered(t)||(this._idr_sample_list.clear(),this._on_unbuffered_seek(Math.floor(1e3*t)),this._config.accurateSeek&&this.directSeek(t))}else window.setTimeout(this._pollAndApplyUnbufferedSeek.bind(this),50)},e.prototype._isPositionBuffered=function(e){for(var t=this._media_element.buffered,i=0;i<t.length;i++){var n=t.start(i),a=t.end(i);if(e>=n&&e<a)return!0}return!1},e.prototype._getNearestKeyframe=function(e){return this._idr_sample_list.getLastSyncPointBeforeDts(e)},e._getClockTime=function(){return self.performance&&self.performance.now?self.performance.now():Date.now()},e}(),A=function(){function e(e,t,i,n){this.TAG="LoadingController",this._config=null,this._media_element=null,this._on_pause_transmuxer=null,this._on_resume_transmuxer=null,this._paused=!1,this.e=null,this._config=e,this._media_element=t,this._on_pause_transmuxer=i,this._on_resume_transmuxer=n,this.e={onMediaTimeUpdate:this._onMediaTimeUpdate.bind(this)}}return e.prototype.destroy=function(){this._media_element.removeEventListener("timeupdate",this.e.onMediaTimeUpdate),this.e=null,this._media_element=null,this._config=null,this._on_pause_transmuxer=null,this._on_resume_transmuxer=null},e.prototype.notifyBufferedPositionChanged=function(e){!this._config.isLive&&this._config.lazyLoad&&(null==e?this._suspendTransmuxerIfNeeded():this._suspendTransmuxerIfBufferedPositionExceeded(e))},e.prototype._onMediaTimeUpdate=function(e){this._paused&&this._resumeTransmuxerIfNeeded()},e.prototype._suspendTransmuxerIfNeeded=function(){for(var e=this._media_element.buffered,t=this._media_element.currentTime,i=0,n=0;n<e.length;n++){var a=e.start(n),r=e.end(n);if(a<=t&&t<r){i=r;break}}i>0&&this._suspendTransmuxerIfBufferedPositionExceeded(i)},e.prototype._suspendTransmuxerIfBufferedPositionExceeded=function(e){e>=this._media_element.currentTime+this._config.lazyLoadMaxDuration&&!this._paused&&(_.a.v(this.TAG,"Maximum buffering duration exceeded, suspend transmuxing task"),this.suspendTransmuxer(),this._media_element.addEventListener("timeupdate",this.e.onMediaTimeUpdate))},e.prototype.suspendTransmuxer=function(){this._paused=!0,this._on_pause_transmuxer()},e.prototype._resumeTransmuxerIfNeeded=function(){for(var e=this._media_element.buffered,t=this._media_element.currentTime,i=this._config.lazyLoadRecoverDuration,n=!1,a=0;a<e.length;a++){var r=e.start(a),o=e.end(a);if(t>=r&&t<o){t>=o-i&&(n=!0);break}}n&&(_.a.v(this.TAG,"Continue loading from paused position"),this.resumeTransmuxer(),this._media_element.removeEventListener("timeupdate",this.e.onMediaTimeUpdate))},e.prototype.resumeTransmuxer=function(){this._paused=!1,this._on_resume_transmuxer()},e}(),E=function(){function e(e,t){this.TAG="StartupStallJumper",this._media_element=null,this._on_direct_seek=null,this._canplay_received=!1,this.e=null,this._media_element=e,this._on_direct_seek=t,this.e={onMediaCanPlay:this._onMediaCanPlay.bind(this),onMediaStalled:this._onMediaStalled.bind(this),onMediaProgress:this._onMediaProgress.bind(this)},this._media_element.addEventListener("canplay",this.e.onMediaCanPlay),this._media_element.addEventListener("stalled",this.e.onMediaStalled),this._media_element.addEventListener("progress",this.e.onMediaProgress)}return e.prototype.destroy=function(){this._media_element.removeEventListener("canplay",this.e.onMediaCanPlay),this._media_element.removeEventListener("stalled",this.e.onMediaStalled),this._media_element.removeEventListener("progress",this.e.onMediaProgress),this._media_element=null,this._on_direct_seek=null},e.prototype._onMediaCanPlay=function(e){this._canplay_received=!0,this._media_element.removeEventListener("canplay",this.e.onMediaCanPlay)},e.prototype._onMediaStalled=function(e){this._detectAndFixStuckPlayback(!0)},e.prototype._onMediaProgress=function(e){this._detectAndFixStuckPlayback()},e.prototype._detectAndFixStuckPlayback=function(e){var t=this._media_element,i=t.buffered;e||!this._canplay_received||t.readyState<2?i.length>0&&t.currentTime<i.start(0)&&(_.a.w(this.TAG,"Playback seems stuck at ".concat(t.currentTime,", seek to ").concat(i.start(0))),this._on_direct_seek(i.start(0)),this._media_element.removeEventListener("progress",this.e.onMediaProgress)):this._media_element.removeEventListener("progress",this.e.onMediaProgress)},e}(),R=function(){function e(e,t,i){this._config=null,this._media_element=null,this._on_direct_seek=null,this._config=e,this._media_element=t,this._on_direct_seek=i}return e.prototype.destroy=function(){this._on_direct_seek=null,this._media_element=null,this._config=null},e.prototype.notifyBufferedRangeUpdate=function(){this._chaseLiveLatency()},e.prototype._chaseLiveLatency=function(){var e=this._media_element.buffered,t=this._media_element.currentTime,i=this._media_element.paused;if(this._config.isLive&&this._config.liveBufferLatencyChasing&&0!=e.length&&(this._config.liveBufferLatencyChasingOnPaused||!i)){var n=e.end(e.length-1);if(n>this._config.liveBufferLatencyMaxLatency&&n-t>this._config.liveBufferLatencyMaxLatency){var a=n-this._config.liveBufferLatencyMinRemain;this._on_direct_seek(a)}}},e}(),T=function(){function e(e,t){this._config=null,this._media_element=null,this.e=null,this._config=e,this._media_element=t,this.e={onMediaTimeUpdate:this._onMediaTimeUpdate.bind(this)},this._media_element.addEventListener("timeupdate",this.e.onMediaTimeUpdate)}return e.prototype.destroy=function(){this._media_element.removeEventListener("timeupdate",this.e.onMediaTimeUpdate),this._media_element=null,this._config=null},e.prototype._onMediaTimeUpdate=function(e){if(this._config.isLive&&this._config.liveSync){var t=this._getCurrentLatency();if(t>this._config.liveSyncMaxLatency){var i=Math.min(2,Math.max(1,this._config.liveSyncPlaybackRate));this._media_element.playbackRate=i}else t>this._config.liveSyncTargetLatency||1!==this._media_element.playbackRate&&0!==this._media_element.playbackRate&&(this._media_element.playbackRate=1)}},e.prototype._getCurrentLatency=function(){if(!this._media_element)return 0;var e=this._media_element.buffered,t=this._media_element.currentTime;return 0==e.length?0:e.end(e.length-1)-t},e}(),L=function(){function e(e,t){this.TAG="PlayerEngineMainThread",this._emitter=new c,this._media_element=null,this._mse_controller=null,this._transmuxer=null,this._pending_seek_time=null,this._seeking_handler=null,this._loading_controller=null,this._startup_stall_jumper=null,this._live_latency_chaser=null,this._live_latency_synchronizer=null,this._mse_source_opened=!1,this._has_pending_load=!1,this._loaded_metadata_received=!1,this._media_info=null,this._statistics_info=null,this.e=null,this._media_data_source=e,this._config=o(),"object"==typeof t&&Object.assign(this._config,t),!0===e.isLive&&(this._config.isLive=!0),this.e={onMediaLoadedMetadata:this._onMediaLoadedMetadata.bind(this)}}return e.prototype.destroy=function(){this._emitter.emit(u.a.DESTROYING),this._transmuxer&&this.unload(),this._media_element&&this.detachMediaElement(),this.e=null,this._media_data_source=null,this._emitter.removeAllListeners(),this._emitter=null},e.prototype.on=function(e,t){var i=this;this._emitter.addListener(e,t),e===u.a.MEDIA_INFO&&this._media_info?Promise.resolve().then((function(){return i._emitter.emit(u.a.MEDIA_INFO,i.mediaInfo)})):e==u.a.STATISTICS_INFO&&this._statistics_info&&Promise.resolve().then((function(){return i._emitter.emit(u.a.STATISTICS_INFO,i.statisticsInfo)}))},e.prototype.off=function(e,t){this._emitter.removeListener(e,t)},e.prototype.attachMediaElement=function(e){var t=this;this._media_element=e,e.src="",e.removeAttribute("src"),e.srcObject=null,e.load(),e.addEventListener("loadedmetadata",this.e.onMediaLoadedMetadata),this._mse_controller=new l.a(this._config),this._mse_controller.on(p.a.UPDATE_END,this._onMSEUpdateEnd.bind(this)),this._mse_controller.on(p.a.BUFFER_FULL,this._onMSEBufferFull.bind(this)),this._mse_controller.on(p.a.SOURCE_OPEN,this._onMSESourceOpen.bind(this)),this._mse_controller.on(p.a.ERROR,this._onMSEError.bind(this)),this._mse_controller.on(p.a.START_STREAMING,this._onMSEStartStreaming.bind(this)),this._mse_controller.on(p.a.END_STREAMING,this._onMSEEndStreaming.bind(this)),this._mse_controller.initialize({getCurrentTime:function(){return t._media_element.currentTime},getReadyState:function(){return t._media_element.readyState}}),this._mse_controller.isManagedMediaSource()?(e.disableRemotePlayback=!0,e.srcObject=this._mse_controller.getObject()):e.src=this._mse_controller.getObjectURL()},e.prototype.detachMediaElement=function(){this._media_element&&(this._mse_controller.shutdown(),this._media_element.removeEventListener("loadedmetadata",this.e.onMediaLoadedMetadata),this._media_element.src="",this._media_element.removeAttribute("src"),this._media_element.srcObject=null,this._media_element.load(),this._media_element=null,this._mse_controller.revokeObjectURL()),this._mse_controller&&(this._mse_controller.destroy(),this._mse_controller=null)},e.prototype.load=function(){var e=this;if(!this._media_element)throw new g.a("HTMLMediaElement must be attached before load()!");if(this._transmuxer)throw new g.a("load() has been called, please call unload() first!");this._has_pending_load||(!this._config.deferLoadAfterSourceOpen||this._mse_source_opened?(this._transmuxer=new f.a(this._media_data_source,this._config),this._transmuxer.on(v.a.INIT_SEGMENT,(function(t,i){e._mse_controller.appendInitSegment(i)})),this._transmuxer.on(v.a.MEDIA_SEGMENT,(function(t,i){e._mse_controller.appendMediaSegment(i),!e._config.isLive&&"video"===t&&i.data&&i.data.byteLength>0&&"info"in i&&e._seeking_handler.appendSyncPoints(i.info.syncPoints),e._loading_controller.notifyBufferedPositionChanged(i.info.endDts/1e3)})),this._transmuxer.on(v.a.LOADING_COMPLETE,(function(){e._mse_controller.endOfStream(),e._emitter.emit(u.a.LOADING_COMPLETE)})),this._transmuxer.on(v.a.RECOVERED_EARLY_EOF,(function(){e._emitter.emit(u.a.RECOVERED_EARLY_EOF)})),this._transmuxer.on(v.a.IO_ERROR,(function(t,i){e._emitter.emit(u.a.ERROR,m.b.NETWORK_ERROR,t,i)})),this._transmuxer.on(v.a.DEMUX_ERROR,(function(t,i){e._emitter.emit(u.a.ERROR,m.b.MEDIA_ERROR,t,i)})),this._transmuxer.on(v.a.MEDIA_INFO,(function(t){e._media_info=t,e._emitter.emit(u.a.MEDIA_INFO,Object.assign({},t))})),this._transmuxer.on(v.a.STATISTICS_INFO,(function(t){e._statistics_info=e._fillStatisticsInfo(t),e._emitter.emit(u.a.STATISTICS_INFO,Object.assign({},t))})),this._transmuxer.on(v.a.RECOMMEND_SEEKPOINT,(function(t){e._media_element&&!e._config.accurateSeek&&e._seeking_handler.directSeek(t/1e3)})),this._transmuxer.on(v.a.METADATA_ARRIVED,(function(t){e._emitter.emit(u.a.METADATA_ARRIVED,t)})),this._transmuxer.on(v.a.SCRIPTDATA_ARRIVED,(function(t){e._emitter.emit(u.a.SCRIPTDATA_ARRIVED,t)})),this._transmuxer.on(v.a.TIMED_ID3_METADATA_ARRIVED,(function(t){e._emitter.emit(u.a.TIMED_ID3_METADATA_ARRIVED,t)})),this._transmuxer.on(v.a.SYNCHRONOUS_KLV_METADATA_ARRIVED,(function(t){e._emitter.emit(u.a.SYNCHRONOUS_KLV_METADATA_ARRIVED,t)})),this._transmuxer.on(v.a.ASYNCHRONOUS_KLV_METADATA_ARRIVED,(function(t){e._emitter.emit(u.a.ASYNCHRONOUS_KLV_METADATA_ARRIVED,t)})),this._transmuxer.on(v.a.SMPTE2038_METADATA_ARRIVED,(function(t){e._emitter.emit(u.a.SMPTE2038_METADATA_ARRIVED,t)})),this._transmuxer.on(v.a.SCTE35_METADATA_ARRIVED,(function(t){e._emitter.emit(u.a.SCTE35_METADATA_ARRIVED,t)})),this._transmuxer.on(v.a.PES_PRIVATE_DATA_DESCRIPTOR,(function(t){e._emitter.emit(u.a.PES_PRIVATE_DATA_DESCRIPTOR,t)})),this._transmuxer.on(v.a.PES_PRIVATE_DATA_ARRIVED,(function(t){e._emitter.emit(u.a.PES_PRIVATE_DATA_ARRIVED,t)})),this._seeking_handler=new b(this._config,this._media_element,this._onRequiredUnbufferedSeek.bind(this)),this._loading_controller=new A(this._config,this._media_element,this._onRequestPauseTransmuxer.bind(this),this._onRequestResumeTransmuxer.bind(this)),this._startup_stall_jumper=new E(this._media_element,this._onRequestDirectSeek.bind(this)),this._config.isLive&&this._config.liveBufferLatencyChasing&&(this._live_latency_chaser=new R(this._config,this._media_element,this._onRequestDirectSeek.bind(this))),this._config.isLive&&this._config.liveSync&&(this._live_latency_synchronizer=new T(this._config,this._media_element)),this._media_element.readyState>0&&this._seeking_handler.directSeek(0),this._transmuxer.open()):this._has_pending_load=!0)},e.prototype.unload=function(){var e,t,i,n,a,r,o,s,d;null===(e=this._media_element)||void 0===e||e.pause(),null===(t=this._live_latency_synchronizer)||void 0===t||t.destroy(),this._live_latency_synchronizer=null,null===(i=this._live_latency_chaser)||void 0===i||i.destroy(),this._live_latency_chaser=null,null===(n=this._startup_stall_jumper)||void 0===n||n.destroy(),this._startup_stall_jumper=null,null===(a=this._loading_controller)||void 0===a||a.destroy(),this._loading_controller=null,null===(r=this._seeking_handler)||void 0===r||r.destroy(),this._seeking_handler=null,null===(o=this._mse_controller)||void 0===o||o.flush(),null===(s=this._transmuxer)||void 0===s||s.close(),null===(d=this._transmuxer)||void 0===d||d.destroy(),this._transmuxer=null},e.prototype.play=function(){return this._media_element.play()},e.prototype.pause=function(){this._media_element.pause()},e.prototype.seek=function(e){this._media_element&&this._seeking_handler?this._seeking_handler.seek(e):this._pending_seek_time=e},Object.defineProperty(e.prototype,"mediaInfo",{get:function(){return Object.assign({},this._media_info)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"statisticsInfo",{get:function(){return Object.assign({},this._statistics_info)},enumerable:!1,configurable:!0}),e.prototype._onMSESourceOpen=function(){this._mse_source_opened=!0,this._has_pending_load&&(this._has_pending_load=!1,this.load())},e.prototype._onMSEUpdateEnd=function(){this._config.isLive&&this._config.liveBufferLatencyChasing&&this._live_latency_chaser&&this._live_latency_chaser.notifyBufferedRangeUpdate(),this._loading_controller.notifyBufferedPositionChanged()},e.prototype._onMSEBufferFull=function(){_.a.v(this.TAG,"MSE SourceBuffer is full, suspend transmuxing task"),this._loading_controller.suspendTransmuxer()},e.prototype._onMSEError=function(e){this._emitter.emit(u.a.ERROR,m.b.MEDIA_ERROR,m.a.MEDIA_MSE_ERROR,e)},e.prototype._onMSEStartStreaming=function(){this._loaded_metadata_received&&(this._config.isLive||(_.a.v(this.TAG,"Resume transmuxing task due to ManagedMediaSource onStartStreaming"),this._loading_controller.resumeTransmuxer()))},e.prototype._onMSEEndStreaming=function(){this._config.isLive||(_.a.v(this.TAG,"Suspend transmuxing task due to ManagedMediaSource onEndStreaming"),this._loading_controller.suspendTransmuxer())},e.prototype._onMediaLoadedMetadata=function(e){this._loaded_metadata_received=!0,null!=this._pending_seek_time&&(this._seeking_handler.seek(this._pending_seek_time),this._pending_seek_time=null)},e.prototype._onRequestDirectSeek=function(e){this._seeking_handler.directSeek(e)},e.prototype._onRequiredUnbufferedSeek=function(e){this._mse_controller.flush(),this._transmuxer.seek(e)},e.prototype._onRequestPauseTransmuxer=function(){this._transmuxer.pause()},e.prototype._onRequestResumeTransmuxer=function(){this._transmuxer.resume()},e.prototype._fillStatisticsInfo=function(e){if(e.playerType="MSEPlayer",!(this._media_element instanceof HTMLVideoElement))return e;var t=!0,i=0,n=0;if(this._media_element.getVideoPlaybackQuality){var a=this._media_element.getVideoPlaybackQuality();i=a.totalVideoFrames,n=a.droppedVideoFrames}else null!=this._media_element.webkitDecodedFrameCount?(i=this._media_element.webkitDecodedFrameCount,n=this._media_element.webkitDroppedFrameCount):t=!1;return t&&(e.decodedFrames=i,e.droppedFrames=n),e},e}(),k=i(18),w=i(8),M=function(){function e(e,t){this.TAG="PlayerEngineDedicatedThread",this._emitter=new c,this._media_element=null,this._worker_destroying=!1,this._seeking_handler=null,this._loading_controller=null,this._startup_stall_jumper=null,this._live_latency_chaser=null,this._live_latency_synchronizer=null,this._pending_seek_time=null,this._media_info=null,this._statistics_info=null,this.e=null,this._media_data_source=e,this._config=o(),"object"==typeof t&&Object.assign(this._config,t),!0===e.isLive&&(this._config.isLive=!0),this.e={onLoggingConfigChanged:this._onLoggingConfigChanged.bind(this),onMediaLoadedMetadata:this._onMediaLoadedMetadata.bind(this),onMediaTimeUpdate:this._onMediaTimeUpdate.bind(this),onMediaReadyStateChanged:this._onMediaReadyStateChange.bind(this)},w.a.registerListener(this.e.onLoggingConfigChanged),this._worker=k(24,{all:!0}),this._worker.addEventListener("message",this._onWorkerMessage.bind(this)),this._worker.postMessage({cmd:"init",media_data_source:this._media_data_source,config:this._config}),this._worker.postMessage({cmd:"logging_config",logging_config:w.a.getConfig()})}return e.isSupported=function(){return!!self.Worker&&(!(!self.MediaSource||!("canConstructInDedicatedWorker"in self.MediaSource)||!0!==self.MediaSource.canConstructInDedicatedWorker)||!(!self.ManagedMediaSource||!("canConstructInDedicatedWorker"in self.ManagedMediaSource)||!0!==self.ManagedMediaSource.canConstructInDedicatedWorker))},e.prototype.destroy=function(){this._emitter.emit(u.a.DESTROYING),this.unload(),this.detachMediaElement(),this._worker_destroying=!0,this._worker.postMessage({cmd:"destroy"}),w.a.removeListener(this.e.onLoggingConfigChanged),this.e=null,this._media_data_source=null,this._emitter.removeAllListeners(),this._emitter=null},e.prototype.on=function(e,t){var i=this;this._emitter.addListener(e,t),e===u.a.MEDIA_INFO&&this._media_info?Promise.resolve().then((function(){return i._emitter.emit(u.a.MEDIA_INFO,i.mediaInfo)})):e==u.a.STATISTICS_INFO&&this._statistics_info&&Promise.resolve().then((function(){return i._emitter.emit(u.a.STATISTICS_INFO,i.statisticsInfo)}))},e.prototype.off=function(e,t){this._emitter.removeListener(e,t)},e.prototype.attachMediaElement=function(e){this._media_element=e,this._media_element.src="",this._media_element.removeAttribute("src"),this._media_element.srcObject=null,this._media_element.load(),this._media_element.addEventListener("loadedmetadata",this.e.onMediaLoadedMetadata),this._media_element.addEventListener("timeupdate",this.e.onMediaTimeUpdate),this._media_element.addEventListener("readystatechange",this.e.onMediaReadyStateChanged),this._worker.postMessage({cmd:"initialize_mse"})},e.prototype.detachMediaElement=function(){this._worker.postMessage({cmd:"shutdown_mse"}),this._media_element&&(this._media_element.removeEventListener("loadedmetadata",this.e.onMediaLoadedMetadata),this._media_element.removeEventListener("timeupdate",this.e.onMediaTimeUpdate),this._media_element.removeEventListener("readystatechange",this.e.onMediaReadyStateChanged),this._media_element.src="",this._media_element.removeAttribute("src"),this._media_element.srcObject=null,this._media_element.load(),this._media_element=null)},e.prototype.load=function(){this._worker.postMessage({cmd:"load"}),this._seeking_handler=new b(this._config,this._media_element,this._onRequiredUnbufferedSeek.bind(this)),this._loading_controller=new A(this._config,this._media_element,this._onRequestPauseTransmuxer.bind(this),this._onRequestResumeTransmuxer.bind(this)),this._startup_stall_jumper=new E(this._media_element,this._onRequestDirectSeek.bind(this)),this._config.isLive&&this._config.liveBufferLatencyChasing&&(this._live_latency_chaser=new R(this._config,this._media_element,this._onRequestDirectSeek.bind(this))),this._config.isLive&&this._config.liveSync&&(this._live_latency_synchronizer=new T(this._config,this._media_element)),this._media_element.readyState>0&&this._seeking_handler.directSeek(0)},e.prototype.unload=function(){var e,t,i,n,a,r;null===(e=this._media_element)||void 0===e||e.pause(),this._worker.postMessage({cmd:"unload"}),null===(t=this._live_latency_synchronizer)||void 0===t||t.destroy(),this._live_latency_synchronizer=null,null===(i=this._live_latency_chaser)||void 0===i||i.destroy(),this._live_latency_chaser=null,null===(n=this._startup_stall_jumper)||void 0===n||n.destroy(),this._startup_stall_jumper=null,null===(a=this._loading_controller)||void 0===a||a.destroy(),this._loading_controller=null,null===(r=this._seeking_handler)||void 0===r||r.destroy(),this._seeking_handler=null},e.prototype.play=function(){return this._media_element.play()},e.prototype.pause=function(){this._media_element.pause()},e.prototype.seek=function(e){this._media_element&&this._seeking_handler?this._seeking_handler.seek(e):this._pending_seek_time=e},Object.defineProperty(e.prototype,"mediaInfo",{get:function(){return Object.assign({},this._media_info)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"statisticsInfo",{get:function(){return Object.assign({},this._statistics_info)},enumerable:!1,configurable:!0}),e.prototype._onLoggingConfigChanged=function(e){var t;null===(t=this._worker)||void 0===t||t.postMessage({cmd:"logging_config",logging_config:e})},e.prototype._onMSEUpdateEnd=function(){this._config.isLive&&this._config.liveBufferLatencyChasing&&this._live_latency_chaser&&this._live_latency_chaser.notifyBufferedRangeUpdate(),this._loading_controller.notifyBufferedPositionChanged()},e.prototype._onMSEBufferFull=function(){_.a.v(this.TAG,"MSE SourceBuffer is full, suspend transmuxing task"),this._loading_controller.suspendTransmuxer()},e.prototype._onMediaLoadedMetadata=function(e){null!=this._pending_seek_time&&(this._seeking_handler.seek(this._pending_seek_time),this._pending_seek_time=null)},e.prototype._onRequestDirectSeek=function(e){this._seeking_handler.directSeek(e)},e.prototype._onRequiredUnbufferedSeek=function(e){this._worker.postMessage({cmd:"unbuffered_seek",milliseconds:e})},e.prototype._onRequestPauseTransmuxer=function(){this._worker.postMessage({cmd:"pause_transmuxer"})},e.prototype._onRequestResumeTransmuxer=function(){this._worker.postMessage({cmd:"resume_transmuxer"})},e.prototype._onMediaTimeUpdate=function(e){this._worker.postMessage({cmd:"timeupdate",current_time:e.target.currentTime})},e.prototype._onMediaReadyStateChange=function(e){this._worker.postMessage({cmd:"readystatechange",ready_state:e.target.readyState})},e.prototype._onWorkerMessage=function(e){var t,i=e.data,n=i.msg;if("destroyed"==n||this._worker_destroying)return this._worker_destroying=!1,null===(t=this._worker)||void 0===t||t.terminate(),void(this._worker=null);switch(n){case"mse_init":var a=i;"ManagedMediaSource"in self&&!("MediaSource"in self)&&(this._media_element.disableRemotePlayback=!0),this._media_element.srcObject=a.handle;break;case"mse_event":(a=i).event==p.a.UPDATE_END?this._onMSEUpdateEnd():a.event==p.a.BUFFER_FULL&&this._onMSEBufferFull();break;case"transmuxing_event":if((a=i).event==v.a.MEDIA_INFO){var r=i;this._media_info=r.info,this._emitter.emit(u.a.MEDIA_INFO,Object.assign({},r.info))}else if(a.event==v.a.STATISTICS_INFO){var o=i;this._statistics_info=this._fillStatisticsInfo(o.info),this._emitter.emit(u.a.STATISTICS_INFO,Object.assign({},o.info))}else if(a.event==v.a.RECOMMEND_SEEKPOINT){var s=i;this._media_element&&!this._config.accurateSeek&&this._seeking_handler.directSeek(s.milliseconds/1e3)}break;case"player_event":if((a=i).event==u.a.ERROR){var d=i;this._emitter.emit(u.a.ERROR,d.error_type,d.error_detail,d.info)}else if("extraData"in a){var c=i;this._emitter.emit(c.event,c.extraData)}break;case"logcat_callback":a=i;_.a.emitter.emit("log",a.type,a.logcat);break;case"buffered_position_changed":a=i;this._loading_controller.notifyBufferedPositionChanged(a.buffered_position_milliseconds/1e3)}},e.prototype._fillStatisticsInfo=function(e){if(e.playerType="MSEPlayer",!(this._media_element instanceof HTMLVideoElement))return e;var t=!0,i=0,n=0;if(this._media_element.getVideoPlaybackQuality){var a=this._media_element.getVideoPlaybackQuality();i=a.totalVideoFrames,n=a.droppedVideoFrames}else null!=this._media_element.webkitDecodedFrameCount?(i=this._media_element.webkitDecodedFrameCount,n=this._media_element.webkitDroppedFrameCount):t=!1;return t&&(e.decodedFrames=i,e.droppedFrames=n),e},e}(),C=function(){function e(e,t){this.TAG="MSEPlayer",this._type="MSEPlayer",this._media_element=null,this._player_engine=null;var i=e.type.toLowerCase();if("mse"!==i&&"mpegts"!==i&&"m2ts"!==i&&"flv"!==i)throw new g.b("MSEPlayer requires an mpegts/m2ts/flv MediaDataSource input!");if(t&&t.enableWorkerForMSE&&M.isSupported())try{this._player_engine=new M(e,t)}catch(i){_.a.e(this.TAG,"Error while initializing PlayerEngineDedicatedThread, fallback to PlayerEngineMainThread"),this._player_engine=new L(e,t)}else this._player_engine=new L(e,t)}return e.prototype.destroy=function(){this._player_engine.destroy(),this._player_engine=null,this._media_element=null},e.prototype.on=function(e,t){this._player_engine.on(e,t)},e.prototype.off=function(e,t){this._player_engine.off(e,t)},e.prototype.attachMediaElement=function(e){this._media_element=e,this._player_engine.attachMediaElement(e)},e.prototype.detachMediaElement=function(){this._media_element=null,this._player_engine.detachMediaElement()},e.prototype.load=function(){this._player_engine.load()},e.prototype.unload=function(){this._player_engine.unload()},e.prototype.play=function(){return this._player_engine.play()},e.prototype.pause=function(){this._player_engine.pause()},Object.defineProperty(e.prototype,"type",{get:function(){return this._type},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"buffered",{get:function(){return this._media_element.buffered},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"duration",{get:function(){return this._media_element.duration},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"volume",{get:function(){return this._media_element.volume},set:function(e){this._media_element.volume=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"muted",{get:function(){return this._media_element.muted},set:function(e){this._media_element.muted=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"currentTime",{get:function(){return this._media_element?this._media_element.currentTime:0},set:function(e){this._player_engine.seek(e)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"mediaInfo",{get:function(){return this._player_engine.mediaInfo},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"statisticsInfo",{get:function(){return this._player_engine.statisticsInfo},enumerable:!1,configurable:!0}),e}(),D=function(){function e(e,t){this.TAG="NativePlayer",this._type="NativePlayer",this._emitter=new h.a,this._config=o(),"object"==typeof t&&Object.assign(this._config,t);var i=e.type.toLowerCase();if("mse"===i||"mpegts"===i||"m2ts"===i||"flv"===i)throw new g.b("NativePlayer does't support mse/mpegts/m2ts/flv MediaDataSource input!");if(e.hasOwnProperty("segments"))throw new g.b("NativePlayer(".concat(e.type,") doesn't support multipart playback!"));this.e={onvLoadedMetadata:this._onvLoadedMetadata.bind(this)},this._pendingSeekTime=null,this._statisticsReporter=null,this._mediaDataSource=e,this._mediaElement=null}return e.prototype.destroy=function(){this._emitter.emit(u.a.DESTROYING),this._mediaElement&&(this.unload(),this.detachMediaElement()),this.e=null,this._mediaDataSource=null,this._emitter.removeAllListeners(),this._emitter=null},e.prototype.on=function(e,t){var i=this;e===u.a.MEDIA_INFO?null!=this._mediaElement&&0!==this._mediaElement.readyState&&Promise.resolve().then((function(){i._emitter.emit(u.a.MEDIA_INFO,i.mediaInfo)})):e===u.a.STATISTICS_INFO&&null!=this._mediaElement&&0!==this._mediaElement.readyState&&Promise.resolve().then((function(){i._emitter.emit(u.a.STATISTICS_INFO,i.statisticsInfo)})),this._emitter.addListener(e,t)},e.prototype.off=function(e,t){this._emitter.removeListener(e,t)},e.prototype.attachMediaElement=function(e){if(this._mediaElement=e,e.addEventListener("loadedmetadata",this.e.onvLoadedMetadata),null!=this._pendingSeekTime)try{e.currentTime=this._pendingSeekTime,this._pendingSeekTime=null}catch(e){}},e.prototype.detachMediaElement=function(){this._mediaElement&&(this._mediaElement.src="",this._mediaElement.removeAttribute("src"),this._mediaElement.removeEventListener("loadedmetadata",this.e.onvLoadedMetadata),this._mediaElement=null),null!=this._statisticsReporter&&(window.clearInterval(this._statisticsReporter),this._statisticsReporter=null)},e.prototype.load=function(){if(!this._mediaElement)throw new g.a("HTMLMediaElement must be attached before load()!");this._mediaElement.src=this._mediaDataSource.url,this._mediaElement.readyState>0&&(this._mediaElement.currentTime=0),this._mediaElement.preload="auto",this._mediaElement.load(),this._statisticsReporter=window.setInterval(this._reportStatisticsInfo.bind(this),this._config.statisticsInfoReportInterval)},e.prototype.unload=function(){this._mediaElement&&(this._mediaElement.src="",this._mediaElement.removeAttribute("src")),null!=this._statisticsReporter&&(window.clearInterval(this._statisticsReporter),this._statisticsReporter=null)},e.prototype.play=function(){return this._mediaElement.play()},e.prototype.pause=function(){this._mediaElement.pause()},Object.defineProperty(e.prototype,"type",{get:function(){return this._type},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"buffered",{get:function(){return this._mediaElement.buffered},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"duration",{get:function(){return this._mediaElement.duration},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"volume",{get:function(){return this._mediaElement.volume},set:function(e){this._mediaElement.volume=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"muted",{get:function(){return this._mediaElement.muted},set:function(e){this._mediaElement.muted=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"currentTime",{get:function(){return this._mediaElement?this._mediaElement.currentTime:0},set:function(e){this._mediaElement?this._mediaElement.currentTime=e:this._pendingSeekTime=e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"mediaInfo",{get:function(){var e={mimeType:(this._mediaElement instanceof HTMLAudioElement?"audio/":"video/")+this._mediaDataSource.type};return this._mediaElement&&(e.duration=Math.floor(1e3*this._mediaElement.duration),this._mediaElement instanceof HTMLVideoElement&&(e.width=this._mediaElement.videoWidth,e.height=this._mediaElement.videoHeight)),e},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"statisticsInfo",{get:function(){var e={playerType:this._type,url:this._mediaDataSource.url};if(!(this._mediaElement instanceof HTMLVideoElement))return e;var t=!0,i=0,n=0;if(this._mediaElement.getVideoPlaybackQuality){var a=this._mediaElement.getVideoPlaybackQuality();i=a.totalVideoFrames,n=a.droppedVideoFrames}else null!=this._mediaElement.webkitDecodedFrameCount?(i=this._mediaElement.webkitDecodedFrameCount,n=this._mediaElement.webkitDroppedFrameCount):t=!1;return t&&(e.decodedFrames=i,e.droppedFrames=n),e},enumerable:!1,configurable:!0}),e.prototype._onvLoadedMetadata=function(e){null!=this._pendingSeekTime&&(this._mediaElement.currentTime=this._pendingSeekTime,this._pendingSeekTime=null),this._emitter.emit(u.a.MEDIA_INFO,this.mediaInfo)},e.prototype._reportStatisticsInfo=function(){this._emitter.emit(u.a.STATISTICS_INFO,this.statisticsInfo)},e}();n.a.install();var O={createPlayer:function(e,t){var i=e;if(null==i||"object"!=typeof i)throw new g.b("MediaDataSource must be an javascript object!");if(!i.hasOwnProperty("type"))throw new g.b("MediaDataSource must has type field to indicate video file type!");switch(i.type){case"mse":case"mpegts":case"m2ts":case"flv":return new C(i,t);default:return new D(i,t)}},isSupported:function(){return s.supportMSEH264Playback()},getFeatureList:function(){return s.getFeatureList()}};O.BaseLoader=d.a,O.LoaderStatus=d.c,O.LoaderErrors=d.b,O.Events=u.a,O.ErrorTypes=m.b,O.ErrorDetails=m.a,O.MSEPlayer=C,O.NativePlayer=D,O.LoggingControl=w.a,Object.defineProperty(O,"version",{enumerable:!0,get:function(){return"1.8.0"}});t.default=O}])}));
+//# sourceMappingURL=mpegts.js.map
\ No newline at end of file
diff --git a/webadmin/static/video-toggle.js b/webadmin/static/video-toggle.js
new file mode 100644
index 0000000..3b05ceb
--- /dev/null
+++ b/webadmin/static/video-toggle.js
@@ -0,0 +1,78 @@
+/*
+  Collapse the video settings when video is not enabled, and show only
+  as many port slots as the entry actually uses.
+
+  The block is long -- three ports with per-slot options, two passwords,
+  a grace window and a disk budget -- and every one of those is
+  irrelevant until the entry actually has video turned on. Showing them
+  regardless makes the edit page look like it is mostly about video when
+  for most entries it is about none of it.
+
+  Progressive enhancement: the markup ships visible and this hides it,
+  so an entry is never left with settings the operator cannot reach if
+  the script fails to load. The initial state is applied before first
+  paint where possible (the script is deferred, so it runs before
+  DOMContentLoaded fires) to avoid a visible collapse.
+ */
+(function () {
+    'use strict';
+
+    // Show slot rows 1..count. Rows past the count stay in the DOM and
+    // keep submitting, so lowering the count and raising it again does
+    // not lose that slot's options -- the server decides what to store.
+    function applyCount(root) {
+        var select = root.querySelector('#video_port_count');
+        if (!select) {
+            // Owner form has no selector; the server already emitted the
+            // right rows, so leave them as they are.
+            return;
+        }
+        var count = parseInt(select.value, 10);
+        if (isNaN(count)) {
+            return;
+        }
+        var rows = root.querySelectorAll('.video-slot');
+        for (var i = 0; i < rows.length; i++) {
+            rows[i].hidden =
+                parseInt(rows[i].getAttribute('data-slot'), 10) > count;
+        }
+    }
+
+    function wire(root) {
+        var checkbox = root.querySelector('#video_enabled');
+        var panel = root.querySelector('#video-options');
+        if (!checkbox || !panel) {
+            return;
+        }
+        var apply = function () {
+            panel.hidden = !checkbox.checked;
+            applyCount(root);
+        };
+        // Guard against being wired twice: auto-refresh.js re-runs
+        // helpers over freshly-injected content.
+        if (!checkbox.dataset.videoToggleWired) {
+            checkbox.dataset.videoToggleWired = '1';
+            checkbox.addEventListener('change', apply);
+        }
+        var select = root.querySelector('#video_port_count');
+        if (select && !select.dataset.videoToggleWired) {
+            select.dataset.videoToggleWired = '1';
+            select.addEventListener('change', apply);
+        }
+        apply();
+    }
+
+    function init() {
+        wire(document);
+    }
+
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', init);
+    } else {
+        init();
+    }
+
+    // auto-refresh.js swaps <main> in place and fires 'pageupdate';
+    // re-apply afterwards or the panel returns expanded on a disabled entry.
+    document.addEventListener('pageupdate', init);
+})();
diff --git a/webadmin/templates/_macros.html b/webadmin/templates/_macros.html
new file mode 100644
index 0000000..214f35b
--- /dev/null
+++ b/webadmin/templates/_macros.html
@@ -0,0 +1,61 @@
+{#
+  Field-rendering helpers.
+
+  Every option's explanation lives in its WTForms `description`, and
+  these macros turn it into a tooltip on the field row. Keeping the
+  rendering here rather than in each template means a field picks up its
+  tooltip from having a description, with nothing to remember at the
+  call site.
+
+  The whole row is the hover target, not a small "?" marker: aiming at a
+  one-em circle to read a sentence is more work than the sentence is
+  worth. The row also covers the keyboard case for free -- focusing the
+  input is :focus-within on the row.
+#}
+
+{# The tooltip body. Must be a DIRECT child of .field: the CSS shows
+   `.field:hover > .tip`, so that a row containing several individually
+   documented controls (the per-slot video options) does not throw all
+   of their tooltips up at once. #}
+{% macro tip(field) -%}
+  {%- if field.description -%}
+    <span class="tip" id="{{ field.id }}-tip" role="note">{{ field.description }}</span>
+  {%- endif -%}
+{%- endmacro %}
+
+{# Label-then-input, for text/number/password/select fields. #}
+{% macro row(field) -%}
+  <div class="field{{ ' has-tip' if field.description }}">
+    {{ field.label }}: {{ field(aria_describedby=field.id ~ '-tip', **kwargs) }}{{ tip(field) }}
+  </div>
+{%- endmacro %}
+
+{# Checkbox-then-label, for BooleanFields. #}
+{% macro check(field) -%}
+  <div class="field{{ ' has-tip' if field.description }}">
+    {{ field(aria_describedby=field.id ~ '-tip', **kwargs) }} {{ field.label }}{{ tip(field) }}
+  </div>
+{%- endmacro %}
+
+{#
+  Action icons for the log listings.
+
+  Inline SVG rather than an icon font or emoji: it needs no external
+  request (the pages are served under a strict policy and must be
+  self-contained), it inherits colour from the surrounding text via
+  currentColor, and it renders identically everywhere -- emoji glyphs
+  for these do not, and a bin in particular is missing on plenty of
+  systems.
+
+  Every call site pairs one with a title and aria-label. An icon alone
+  is a guess for a sighted user and nothing at all for a screen reader.
+#}
+{% macro icon(name) -%}
+{%- if name == 'play' -%}
+<svg class="icon" viewBox="0 0 16 16" aria-hidden="true" focusable="false"><path d="M4.5 2.6v10.8L13 8z"/></svg>
+{%- elif name == 'download' -%}
+<svg class="icon" viewBox="0 0 16 16" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M8 1.8v7.6"/><path d="M4.8 6.4 8 9.6l3.2-3.2"/><path d="M2.6 11.4v2.2h10.8v-2.2"/></svg>
+{%- elif name == 'trash' -%}
+<svg class="icon" viewBox="0 0 16 16" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"><path d="M2.6 4.1h10.8"/><path d="M6.4 2.5h3.2"/><path d="M4.6 4.1l.6 9.4h5.6l.6-9.4"/><path d="M6.8 6.4v4.9M9.2 6.4v4.9"/></svg>
+{%- endif -%}
+{%- endmacro %}
diff --git a/webadmin/templates/_video_fields.html b/webadmin/templates/_video_fields.html
new file mode 100644
index 0000000..7ee3223
--- /dev/null
+++ b/webadmin/templates/_video_fields.html
@@ -0,0 +1,107 @@
+{#
+  Video settings, shared by the owner and admin edit forms.
+
+  Port allocation and the disk budget are admin-only, so those fields are
+  only present on AdminEditForm; the owner view shows the allocated ports
+  read-only instead. WTForms' Form implements __contains__ over its field
+  names, so "in form" is the safe way to test for an optional field.
+#}
+{% from "_macros.html" import row, check, tip %}
+<h3>Video</h3>
+{{ check(form.video_enabled) }}
+
+{# Everything below is meaningless until video is on, and it is a long
+   block. video-toggle.js hides it while the box is clear. It ships
+   visible so a script failure cannot strand an operator with settings
+   they cannot reach. #}
+<div id="video-options">
+
+{% set has_ports = 'video_port_1' in form %}
+{% set count = form.video_port_count.data if has_ports else entry.video_port_count() %}
+
+{% if has_ports %}
+  {{ row(form.video_port_count) }}
+{% endif %}
+
+{% for slot in [1, 2, 3] %}
+  {% set p = entry.video_ports[slot - 1] %}
+  {# Slots past the chosen count are rendered but hidden, so the browser
+     still submits their options and lowering then raising the count does
+     not silently wipe them. video-toggle.js does the hiding; without JS
+     every slot stays reachable. #}
+  <div class="field video-slot" data-slot="{{ slot }}"
+       {% if slot > count %}hidden{% endif %}>
+    {# Every control on this row is its own hover target. If the port
+       field used the row-level tooltip instead, hovering an option --
+       which also hovers the row -- would stack two tooltips in the same
+       spot. #}
+    {% if has_ports %}
+      <span class="opt">{{ form['video_port_' ~ slot].label }}:
+        {{ form['video_port_' ~ slot]() }}{{ tip(form['video_port_' ~ slot]) }}</span>
+    {% else %}
+      Video port {{ slot }}:
+      {% if p %}<strong>{{ p }}</strong>{% else %}<em>not allocated</em>{% endif %}
+    {% endif %}
+    {# An owner can't allocate a port, so per-slot options for a slot with
+       no port are noise. An admin may be allocating one in this same save,
+       so they always see them.
+
+       Help for these three is written here rather than as field
+       descriptions: three slots x three options would be nine
+       near-identical strings in forms.py. tests/webadmin/test_tooltips.py
+       exempts them from the every-option-is-documented check and asserts
+       on this text instead. #}
+    {% if has_ports or p %}
+      <span class="video-slot-opts">
+        <span class="opt">{{ form['video_srt_' ~ slot]() }} SRT
+        <span class="tip" role="note">
+          Serve this slot's UDP side with SRT instead of plain MPEG-TS.
+          The two cannot share a port, so it is one or the other. SRT can
+          carry a publish password; plain MPEG-TS cannot.
+        </span></span>
+        <span class="opt">{{ form['video_record_' ~ slot]() }} record
+        <span class="tip" role="note">
+          Write this slot's stream to logs/&lt;port2&gt;/&lt;date&gt;/ as
+          timestamped .ts segments, alongside the tlogs. Bounded by the
+          video disk budget, never by the tlog budget.
+        </span></span>
+        <span class="opt">{{ form['video_rawtcp_' ~ slot]() }} open TCP viewers
+        <span class="tip" role="note">
+          Allow viewers that just open a TCP socket and read, with no
+          credential -- e.g. <code>ffplay tcp://host:port</code>. There is
+          nowhere in a raw stream to carry a password, so this is offered
+          only when no viewer password is set.
+        </span></span>
+        <span class="opt">RTMP
+          {{ form['video_rtmp_' ~ slot](size=16,
+                                        placeholder='app/stream') }}
+        {{ tip(form['video_rtmp_' ~ slot]) }}</span>
+      </span>
+    {% endif %}
+  </div>
+{% endfor %}
+
+{% if not has_ports and not entry.active_video_ports() %}
+  <div class="field"><em>No video ports have been allocated to this entry
+  yet — ask an admin to allocate one.</em></div>
+{% endif %}
+
+{{ check(form.video_audio) }}
+{{ row(form.video_viewer_pass) }}
+<div class="field">{{ form.video_viewer_pass_clear() }}
+  {{ form.video_viewer_pass_clear.label }}{{ tip(form.video_viewer_pass_clear) }}
+  {% if entry.video_viewer_pass_set() %}<em>(currently set)</em>
+  {% else %}<em>(currently unset — viewing is open)</em>{% endif %}
+</div>
+{{ row(form.video_publish_pass) }}
+<div class="field">{{ form.video_publish_pass_clear() }}
+  {{ form.video_publish_pass_clear.label }}{{ tip(form.video_publish_pass_clear) }}
+  {% if entry.video_publish_pass_set() %}<em>(currently set)</em>
+  {% else %}<em>(currently unset — a recent MAVLink session is required)</em>{% endif %}
+</div>
+{{ row(form.video_grace_s) }}
+{% if 'video_quota_mb' in form %}
+  {{ row(form.video_quota_mb) }}
+{% endif %}
+
+</div>{# /video-options #}
diff --git a/webadmin/templates/admin_edit.html b/webadmin/templates/admin_edit.html
index 0870eb6..908805a 100644
--- a/webadmin/templates/admin_edit.html
+++ b/webadmin/templates/admin_edit.html
@@ -1,4 +1,5 @@
 {% extends "base.html" %}
+{% from "_macros.html" import row, check, tip %}
 {% block title %}Edit {{ entry.port2 }} — {{ config.WEBUI_TITLE }}{% endblock %}
 {% block content %}
 <h2>Edit entry {{ entry.port1 }}/{{ entry.port2 }}</h2>
@@ -10,20 +11,21 @@ <h2>Edit entry {{ entry.port1 }}/{{ entry.port2 }}</h2>
 </dl>
 <form method="post" action="{{ url_for('admin.edit', port2=entry.port2) }}">
   {{ form.csrf_token }}
-  <div class="field">{{ form.name.label }}: {{ form.name() }}</div>
-  <div class="field">{{ form.port1.label }}: {{ form.port1() }}</div>
-  <div class="field">{{ form.new_passphrase.label }}: {{ form.new_passphrase() }}</div>
-  <div class="field">{{ form.confirm_passphrase.label }}: {{ form.confirm_passphrase() }}</div>
-  <div class="field">{{ form.is_admin() }} {{ form.is_admin.label }}</div>
-  <div class="field">{{ form.bidi_sign() }} {{ form.bidi_sign.label }}</div>
-  <div class="field">{{ form.tlog_enabled() }} {{ form.tlog_enabled.label }}</div>
-  <div class="field">{{ form.binlog_enabled() }} {{ form.binlog_enabled.label }}</div>
-  <div class="field">{{ form.log_retention_days.label }}: {{ form.log_retention_days() }}</div>
-  <div class="field">{{ form.fc_sysid.label }}: {{ form.fc_sysid() }}</div>
-  <div class="field">{{ form.use_tz() }} {{ form.use_tz.label }}</div>
-  <div class="field">{{ form.tz_offset_hours.label }}: {{ form.tz_offset_hours() }}</div>
+  {{ row(form.name) }}
+  {{ row(form.port1) }}
+  {{ row(form.new_passphrase) }}
+  {{ row(form.confirm_passphrase) }}
+  {{ check(form.is_admin) }}
+  {{ check(form.bidi_sign) }}
+  {{ check(form.tlog_enabled) }}
+  {{ check(form.binlog_enabled) }}
+  {{ row(form.log_retention_days) }}
+  {{ row(form.fc_sysid) }}
+  {{ check(form.use_tz) }}
+  {{ row(form.tz_offset_hours) }}
   <div class="field"><a href="{{ url_for('admin_logs.admin_dates', port2=entry.port2) }}">browse logs &rarr;</a></div>
-  <div class="field">{{ form.reset_timestamp() }} {{ form.reset_timestamp.label }}</div>
+  {% include "_video_fields.html" %}
+  {{ check(form.reset_timestamp) }}
   <div>{{ form.submit() }}</div>
   {% for field, errors in form.errors.items() %}
     {% for e in errors %}<div class="flash flash-error">{{ field }}: {{ e }}</div>{% endfor %}
diff --git a/webadmin/templates/admin_list.html b/webadmin/templates/admin_list.html
index 86142a1..32b20d9 100644
--- a/webadmin/templates/admin_list.html
+++ b/webadmin/templates/admin_list.html
@@ -1,4 +1,5 @@
 {% extends "base.html" %}
+{% from "_macros.html" import row, check, tip %}
 {% block title %}All entries — {{ config.WEBUI_TITLE }}{% endblock %}
 {% block content %}
 <h2>All entries ({{ entries | length }})</h2>
@@ -20,9 +21,15 @@ <h2>All entries ({{ entries | length }})</h2>
       <td>{{ ke.flag_names() | join(', ') or '—' }}</td>
       <td>
         <a href="{{ url_for('admin.edit', port2=ke.port2) }}">edit</a>
-        {% if 'tlog' in ke.flag_names() or 'binlog' in ke.flag_names() %}
+        {% if 'tlog' in ke.flag_names() or 'binlog' in ke.flag_names()
+              or ke.video_enabled() %}
         · <a href="{{ url_for('admin_logs.admin_dates', port2=ke.port2) }}">logs</a>
         {% endif %}
+        {# An admin can watch any entry's stream, so link straight to it
+           rather than making them hand-edit a ?port2= query. #}
+        {% if ke.video_enabled() and ke.active_video_ports() %}
+        · <a href="{{ url_for('video.index', port2=ke.port2) }}">video</a>
+        {% endif %}
       </td>
     </tr>
     {% else %}
@@ -40,11 +47,11 @@ <h3>Add a new entry</h3>
 </p>
 <form method="post" action="{{ url_for('admin.add_entry') }}" class="admin-add-form">
   {{ add_form.csrf_token }}
-  <div class="field">{{ add_form.port1.label }}: {{ add_form.port1() }}</div>
-  <div class="field">{{ add_form.count.label }}: {{ add_form.count(min=1, max=50) }}</div>
-  <div class="field">{{ add_form.port2.label }}: {{ add_form.port2() }}</div>
-  <div class="field">{{ add_form.name.label }}: {{ add_form.name() }}</div>
-  <div class="field">{{ add_form.passphrase.label }}: {{ add_form.passphrase() }}</div>
+  {{ row(add_form.port1) }}
+  {{ row(add_form.count, min=1, max=50) }}
+  {{ row(add_form.port2) }}
+  {{ row(add_form.name) }}
+  {{ row(add_form.passphrase) }}
   <div>{{ add_form.submit() }}</div>
 </form>
 {% endblock %}
diff --git a/webadmin/templates/admin_logs.html b/webadmin/templates/admin_logs.html
index 423a793..004288b 100644
--- a/webadmin/templates/admin_logs.html
+++ b/webadmin/templates/admin_logs.html
@@ -1,4 +1,5 @@
 {% extends "base.html" %}
+{% from "_macros.html" import icon %}
 {% block title %}Logs for {{ entry.port2 }} — {{ config.WEBUI_TITLE }}{% endblock %}
 {% block auto_refresh_seconds %}5{% endblock %}
 {% block content %}
@@ -7,6 +8,9 @@ <h2>Logs for {{ entry.port1 }}/{{ entry.port2 }} '{{ entry.name }}'</h2>
 <p>
   <a href="{{ url_for('admin.edit', port2=entry.port2) }}">edit entry</a> ·
   <a href="{{ url_for('admin.list_entries') }}">all entries</a>
+  {% if entry.video_enabled() and entry.active_video_ports() %}
+  · <a href="{{ url_for('video.index', port2=entry.port2) }}">watch live video &rarr;</a>
+  {% endif %}
 </p>
 
 <h3>Dates</h3>
@@ -32,9 +36,20 @@ <h3>Sessions on {{ date }}</h3>
       <td>{{ s.name }}</td>
       <td>{{ s.size }} bytes</td>
       <td><time datetime="{{ s.mtime_iso }}">{{ s.mtime_utc }}</time></td>
-      <td>
-        <a href="{{ url_for('admin_logs.admin_download',
-                            port2=entry.port2, date=date, session_name=s.name) }}">download</a>
+      <td class="actions">
+        <a class="iconbtn" title="Download" aria-label="Download"
+           href="{{ url_for('admin_logs.admin_download', port2=entry.port2, date=date, session_name=s.name) }}">{{ icon('download') }}</a>
+        <form method="post" class="inline"
+              action="{{ url_for('admin_logs.admin_delete_session', port2=entry.port2, date=date, session_name=s.name) }}"
+              onsubmit="return confirm('Delete ' + {{ s.name|tojson }} + '?\n\nThis cannot be undone.');">
+          {{ del_form.csrf_token }}
+          <button type="submit" class="iconbtn danger-icon"
+                  title="Delete" aria-label="Delete">{{ icon('trash') }}</button>
+        </form>
+        {% if s.is_video %}
+        <a class="iconbtn" title="Play" aria-label="Play"
+           href="{{ url_for('admin_logs.admin_watch', port2=entry.port2, date=date, session_name=s.name) }}">{{ icon('play') }}</a>
+        {% endif %}
       </td>
     </tr>
     {% else %}
@@ -42,5 +57,11 @@ <h3>Sessions on {{ date }}</h3>
     {% endfor %}
   </tbody>
 </table>
+<form method="post" class="inline day-delete"
+      action="{{ url_for('admin_logs.admin_delete_date', port2=entry.port2, date=date) }}"
+      onsubmit="return confirm('Delete every log and video for {{ date }}?\n\nThis cannot be undone. Anything still being written is kept.');">
+  {{ del_form.csrf_token }}
+  <button type="submit" class="danger">{{ icon('trash') }} Delete all of {{ date }}</button>
+</form>
 {% endif %}
 {% endblock %}
diff --git a/webadmin/templates/admin_system.html b/webadmin/templates/admin_system.html
new file mode 100644
index 0000000..ba80ab2
--- /dev/null
+++ b/webadmin/templates/admin_system.html
@@ -0,0 +1,90 @@
+{% extends "base.html" %}
+{% block title %}Server — {{ config.WEBUI_TITLE }}{% endblock %}
+{% block content %}
+<h2>Server</h2>
+
+<p class="hint">
+  {% if daemon_pid %}
+    Proxy daemon running as pid {{ daemon_pid }}.
+  {% else %}
+    No running proxy daemon found.
+  {% endif %}
+</p>
+
+<form method="post" action="{{ url_for('system.restart') }}" class="inline"
+      onsubmit="return confirm('Restart the proxy?\n\nEvery live MAVLink session and video stream is dropped. The supervisor restarts it within a few seconds.');">
+  {{ restart_form.csrf_token }}
+  <button type="submit" class="danger">Restart proxy</button>
+</form>
+<span class="help-inline">Drops all live sessions. Publishers and
+  viewers reconnect on their own; a support engineer mid-session will
+  not.</span>
+
+<h3>Activity log</h3>
+<p class="hint">{{ log_path }} — newest at the bottom, updating live.
+  Viewer tokens are redacted.</p>
+
+<div class="log-controls">
+  <label><input type="checkbox" id="logfollow" checked> follow</label>
+  <span id="logstatus" class="hint"></span>
+</div>
+<pre id="logview" class="logview">loading…</pre>
+
+<script>
+(function () {
+  var view = document.getElementById('logview');
+  var follow = document.getElementById('logfollow');
+  var status = document.getElementById('logstatus');
+  var offset = -1;            // -1 asks for the tail
+  var ident = '';             // file identity, to spot a swap
+  var first = true;
+  // Bound what the page holds: a busy log left open for hours would
+  // otherwise grow the DOM without limit.
+  var MAX_CHARS = 400000;
+
+  function atBottom() {
+    return view.scrollHeight - view.scrollTop - view.clientHeight < 40;
+  }
+
+  function poll() {
+    var wasBottom = atBottom();
+    fetch('{{ url_for("system.log_data") }}?offset=' + offset +
+          '&ident=' + encodeURIComponent(ident),
+          {credentials: 'same-origin'})
+      .then(function (r) {
+        if (!r.ok) { throw new Error('HTTP ' + r.status); }
+        return r.json();
+      })
+      .then(function (d) {
+        if (d.restarted && !first) {
+          // Rotated, truncated, or we fell too far behind: what follows
+          // is not contiguous with what is on screen, so say so rather
+          // than splicing it on and implying it is.
+          view.textContent += '\n--- log rotated or skipped ahead ---\n';
+        }
+        if (d.text) {
+          view.textContent = (first ? '' : view.textContent) + d.text;
+          if (view.textContent.length > MAX_CHARS) {
+            view.textContent =
+              view.textContent.slice(view.textContent.length - MAX_CHARS);
+          }
+        } else if (first) {
+          view.textContent = '(log is empty)';
+        }
+        offset = d.offset;
+        ident = d.ident || '';
+        first = false;
+        status.textContent = '';
+        if (follow.checked && (wasBottom || first)) {
+          view.scrollTop = view.scrollHeight;
+        }
+      })
+      .catch(function (e) {
+        status.textContent = 'update failed: ' + e.message;
+      })
+      .then(function () { setTimeout(poll, 2000); });
+  }
+  poll();
+})();
+</script>
+{% endblock %}
diff --git a/webadmin/templates/base.html b/webadmin/templates/base.html
index d5c0e27..d64847c 100644
--- a/webadmin/templates/base.html
+++ b/webadmin/templates/base.html
@@ -20,8 +20,10 @@ <h1>{{ config.WEBUI_TITLE }}</h1>
       {% if session.get('is_admin') %}
         <a href="{{ url_for('admin.list_entries') }}">all entries</a>
         <a href="{{ url_for('admin.connections') }}">connections</a>
+        <a href="{{ url_for('system.index') }}">server</a>
       {% endif %}
       <a href="{{ url_for('owner.me') }}">my entry</a>
+      <a href="{{ url_for('video.index') }}">video</a>
       <form method="post" action="{{ url_for('auth.logout') }}" class="inline">
         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
         <button type="submit">log out</button>
@@ -56,5 +58,6 @@ <h1>{{ config.WEBUI_TITLE }}</h1>
 <script src="{{ url_for('static', filename='admin-add.js') }}" defer></script>
 <script src="{{ url_for('static', filename='localtime.js') }}" defer></script>
 <script src="{{ url_for('static', filename='auto-refresh.js') }}" defer></script>
+<script src="{{ url_for('static', filename='video-toggle.js') }}" defer></script>
 </body>
 </html>
diff --git a/webadmin/templates/log_play.html b/webadmin/templates/log_play.html
new file mode 100644
index 0000000..38a3f51
--- /dev/null
+++ b/webadmin/templates/log_play.html
@@ -0,0 +1,55 @@
+{% extends "base.html" %}
+{% block title %}{{ name }} — {{ config.WEBUI_TITLE }}{% endblock %}
+{% block content %}
+<h2>{{ name }}</h2>
+<p>
+  <a href="{{ back_url }}">&larr; back to {{ date }}</a> ·
+  <a href="{{ download_url }}">download</a>
+</p>
+
+{# Browsers cannot demux MPEG-TS, so the recording is remuxed to
+   fragmented MP4 on the way out -- a stream copy, no decoding. That
+   plays in a plain <video> element with no player library, which is
+   both far more reliable than driving Media Source Extensions from
+   JavaScript and the only thing that works with JS disabled. #}
+{% if have_ffmpeg %}
+<video id="player" controls playsinline preload="auto" autoplay muted
+       width="900" style="max-width:100%;background:#000"
+       src="{{ mp4_url }}"></video>
+<div class="video-status" id="status"></div>
+<p class="hint">Remuxed on the fly, so playback starts immediately but
+  cannot be scrubbed ahead of what has loaded. Download the file to seek
+  freely.</p>
+{% else %}
+<p class="flash flash-error">ffmpeg is not installed on this server, so
+  the recording cannot be remuxed for browser playback. Download it, or
+  use the command below.</p>
+{% endif %}
+
+<details class="video-fallback"{% if not have_ffmpeg %} open{% endif %}>
+  <summary>Play outside the browser</summary>
+  <p>Works for any codec, including ones a browser cannot decode:</p>
+  <pre><code>ffplay '{{ request.url_root.rstrip('/') }}{{ stream_url }}'</code></pre>
+  <p>A recording is a plain MPEG-TS file and needs no finalising, so even
+     a segment cut short by a crash plays in VLC as-is.</p>
+</details>
+
+{% if have_ffmpeg %}
+<script>
+(function () {
+  // The only failure worth explaining is a codec the browser cannot
+  // decode -- HEVC, in practice. Everything else the <video> element
+  // reports for itself.
+  var video = document.getElementById('player');
+  var status = document.getElementById('status');
+  video.addEventListener('error', function () {
+    status.textContent = 'This browser could not decode the recording. ' +
+      'If it is HEVC that is expected — use the command below.';
+  });
+  video.addEventListener('loadedmetadata', function () {
+    status.textContent = video.videoWidth + 'x' + video.videoHeight;
+  });
+})();
+</script>
+{% endif %}
+{% endblock %}
diff --git a/webadmin/templates/login.html b/webadmin/templates/login.html
index 2cb6fe6..68babad 100644
--- a/webadmin/templates/login.html
+++ b/webadmin/templates/login.html
@@ -1,4 +1,5 @@
 {% extends "base.html" %}
+{% from "_macros.html" import row, check, tip %}
 {% block title %}Log in — {{ config.WEBUI_TITLE }}{% endblock %}
 {% block content %}
 <h2>Log in</h2>
@@ -6,8 +7,8 @@ <h2>Log in</h2>
    for your entry, plus the passphrase you set with <code>keydb.py</code>.</p>
 <form method="post" action="{{ url_for('auth.login') }}">
   {{ form.csrf_token }}
-  <div class="field">{{ form.port.label }}: {{ form.port(autofocus=True) }}</div>
-  <div class="field">{{ form.passphrase.label }}: {{ form.passphrase() }}</div>
+  {{ row(form.port, autofocus=True) }}
+  {{ row(form.passphrase) }}
   <div>{{ form.submit() }}</div>
   {% for field, errors in form.errors.items() %}
     {% for e in errors %}<div class="flash flash-error">{{ field }}: {{ e }}</div>{% endfor %}
diff --git a/webadmin/templates/owner.html b/webadmin/templates/owner.html
index 4df4093..c2ac101 100644
--- a/webadmin/templates/owner.html
+++ b/webadmin/templates/owner.html
@@ -1,4 +1,5 @@
 {% extends "base.html" %}
+{% from "_macros.html" import row, check, tip %}
 {% block title %}My entry — {{ config.WEBUI_TITLE }}{% endblock %}
 {% block auto_refresh_seconds %}5{% endblock %}
 {% block content %}
@@ -47,18 +48,19 @@ <h2>My entry</h2>
 </dl>
 <form method="post" action="{{ url_for('owner.me') }}">
   {{ form.csrf_token }}
-  <div class="field">{{ form.name.label }}: {{ form.name() }}</div>
-  <div class="field">{{ form.new_passphrase.label }}: {{ form.new_passphrase() }}</div>
-  <div class="field">{{ form.confirm_passphrase.label }}: {{ form.confirm_passphrase() }}</div>
-  <div class="field">{{ form.bidi_sign() }} {{ form.bidi_sign.label }}</div>
-  <div class="field">{{ form.tlog_enabled() }} {{ form.tlog_enabled.label }}</div>
-  <div class="field">{{ form.binlog_enabled() }} {{ form.binlog_enabled.label }}</div>
-  <div class="field">{{ form.log_retention_days.label }}: {{ form.log_retention_days() }}</div>
-  <div class="field">{{ form.fc_sysid.label }}: {{ form.fc_sysid() }}</div>
-  <div class="field">{{ form.use_tz() }} {{ form.use_tz.label }}</div>
-  <div class="field">{{ form.tz_offset_hours.label }}: {{ form.tz_offset_hours() }}</div>
+  {{ row(form.name) }}
+  {{ row(form.new_passphrase) }}
+  {{ row(form.confirm_passphrase) }}
+  {{ check(form.bidi_sign) }}
+  {{ check(form.tlog_enabled) }}
+  {{ check(form.binlog_enabled) }}
+  {{ row(form.log_retention_days) }}
+  {{ row(form.fc_sysid) }}
+  {{ check(form.use_tz) }}
+  {{ row(form.tz_offset_hours) }}
   <div class="field"><a href="{{ url_for('owner_logs.owner_dates') }}">browse logs &rarr;</a></div>
-  <div class="field">{{ form.reset_timestamp() }} {{ form.reset_timestamp.label }}</div>
+  {% include "_video_fields.html" %}
+  {{ check(form.reset_timestamp) }}
   <div>{{ form.submit() }}</div>
   {% for field, errors in form.errors.items() %}
     {% for e in errors %}<div class="flash flash-error">{{ field }}: {{ e }}</div>{% endfor %}
diff --git a/webadmin/templates/owner_logs.html b/webadmin/templates/owner_logs.html
index fb96bb8..d5fae91 100644
--- a/webadmin/templates/owner_logs.html
+++ b/webadmin/templates/owner_logs.html
@@ -1,10 +1,15 @@
 {% extends "base.html" %}
+{% from "_macros.html" import icon %}
 {% block title %}My logs — {{ config.WEBUI_TITLE }}{% endblock %}
 {% block auto_refresh_seconds %}5{% endblock %}
 {% block content %}
 <h2>My logs ({{ entry.port1 }}/{{ entry.port2 }})</h2>
 
-<p><a href="{{ url_for('owner.me') }}">back to my entry</a></p>
+<p><a href="{{ url_for('owner.me') }}">back to my entry</a>
+  {% if entry.video_enabled() and entry.active_video_ports() %}
+  · <a href="{{ url_for('video.index') }}">watch live video &rarr;</a>
+  {% endif %}
+</p>
 
 <h3>Dates</h3>
 <ul class="log-dates">
@@ -29,9 +34,20 @@ <h3>Sessions on {{ date }}</h3>
       <td>{{ s.name }}</td>
       <td>{{ s.size }} bytes</td>
       <td><time datetime="{{ s.mtime_iso }}">{{ s.mtime_utc }}</time></td>
-      <td>
-        <a href="{{ url_for('owner_logs.owner_download',
-                            date=date, session_name=s.name) }}">download</a>
+      <td class="actions">
+        <a class="iconbtn" title="Download" aria-label="Download"
+           href="{{ url_for('owner_logs.owner_download', date=date, session_name=s.name) }}">{{ icon('download') }}</a>
+        <form method="post" class="inline"
+              action="{{ url_for('owner_logs.owner_delete_session', date=date, session_name=s.name) }}"
+              onsubmit="return confirm('Delete ' + {{ s.name|tojson }} + '?\n\nThis cannot be undone.');">
+          {{ del_form.csrf_token }}
+          <button type="submit" class="iconbtn danger-icon"
+                  title="Delete" aria-label="Delete">{{ icon('trash') }}</button>
+        </form>
+        {% if s.is_video %}
+        <a class="iconbtn" title="Play" aria-label="Play"
+           href="{{ url_for('owner_logs.owner_watch', date=date, session_name=s.name) }}">{{ icon('play') }}</a>
+        {% endif %}
       </td>
     </tr>
     {% else %}
@@ -39,5 +55,11 @@ <h3>Sessions on {{ date }}</h3>
     {% endfor %}
   </tbody>
 </table>
+<form method="post" class="inline day-delete"
+      action="{{ url_for('owner_logs.owner_delete_date', date=date) }}"
+      onsubmit="return confirm('Delete every log and video for {{ date }}?\n\nThis cannot be undone. Anything still being written is kept.');">
+  {{ del_form.csrf_token }}
+  <button type="submit" class="danger">{{ icon('trash') }} Delete all of {{ date }}</button>
+</form>
 {% endif %}
 {% endblock %}
diff --git a/webadmin/templates/video.html b/webadmin/templates/video.html
new file mode 100644
index 0000000..c665141
--- /dev/null
+++ b/webadmin/templates/video.html
@@ -0,0 +1,316 @@
+{% extends "base.html" %}
+{% block content %}
+<h2>Video &mdash; {{ entry.port1 }}/{{ port2 }} {{ entry.name }}</h2>
+
+{% if not enabled %}
+  <p><em>Video is not enabled for this entry.</em>
+  {% if 'video_port_1' %}Enable it on the settings page.{% endif %}</p>
+{% elif not slots %}
+  <p><em>No video ports have been allocated to this entry yet &mdash;
+  ask an admin to allocate one.</em></p>
+{% else %}
+
+<p class="hint">A stream only appears while an authorised publisher is
+sending. Playback starts at the last keyframe, so it can take a moment
+to appear.</p>
+
+{% for s in slots %}
+  <div class="video-slot-panel" data-slot="{{ s.slot }}">
+    <h3>Slot {{ s.number }} &mdash; port {{ s.port }}</h3>
+
+    {# One element for the life of the page. Picture-in-Picture is bound
+       to the element, so replacing it on reconnect tears PIP down --
+       see the teardown note in the script. #}
+    <video id="player{{ s.number }}" controls muted playsinline
+           width="640" style="max-width:100%;background:#000"></video>
+
+    <div class="video-status" id="status{{ s.number }}">Connecting&hellip;</div>
+
+    {# The fallback is not an error path: HEVC simply cannot be played
+       by most browsers, and a copyable command is more use than a
+       black rectangle. #}
+    {# The flags are not optional decoration. ffplay's default probe is
+       analyzeduration=5s, and it spends all of it before showing
+       anything -- measured as ~6.6s behind live, against ~0.9s with
+       these. VLC's default network cache is 1s on top of its own probe.
+       A command without them looks like the proxy is slow. #}
+    <details class="video-fallback">
+      <summary>Play outside the browser</summary>
+      <p>Works for any codec, including ones a browser cannot decode.
+         The flags cut the startup probe, which is otherwise 5 seconds
+         of lag:</p>
+      <pre><code>ffplay -fflags nobuffer -flags low_delay -framedrop \
+       -probesize 500000 -analyzeduration 1000000 \
+       http://{{ host }}:{{ s.port }}/v{{ s.number }}.ts{% if s.needs_password %}?pw=YOUR_VIEWER_PASSWORD{% endif %}</code></pre>
+      <pre><code>vlc --network-caching=200 --live-caching=200 \
+    http://{{ host }}:{{ s.port }}/v{{ s.number }}.ts{% if s.needs_password %}?pw=YOUR_VIEWER_PASSWORD{% endif %}</code></pre>
+    </details>
+  </div>
+{% endfor %}
+
+<script src="{{ url_for('static', filename='vendor/mpegts.js/mpegts.js') }}"></script>
+<script>
+(function () {
+  var slots = [
+    {% for s in slots %}
+    { n: {{ s.number }}, slot: {{ s.slot }}, port: {{ s.port }},
+      token: {{ s.token|tojson }} }{{ "," if not loop.last }}
+    {% endfor %}
+  ];
+  var host = {{ host|tojson }};
+  var scheme = (window.location.protocol === 'https:') ? 'wss' : 'ws';
+  var tokenUrl = {{ token_url|tojson }};
+
+  slots.forEach(function (s) {
+    var video = document.getElementById('player' + s.n);
+    var status = document.getElementById('status' + s.n);
+    var player = null;
+    var retryMs = 1000;
+    var pending = false;
+    var codecFailed = false;
+    var lastCodec = '';
+    // Consecutive media errors with no successful playback between
+    // them. Reset by MEDIA_INFO, so a stream that plays and later
+    // hiccups keeps its full retry budget.
+    var mediaErrors = 0;
+    var firstToken = s.token;
+
+    function say(msg) { status.textContent = msg; }
+
+    /*
+      The decoder's own verdict. mpegts.js only ever reports the
+      consequence -- "appendBuffer failed, HTMLMediaElement.error is not
+      null" -- which says the element had already failed and tells you
+      nothing about why. This is where the actual reason lives.
+     */
+    function mediaErrorText() {
+      var e = video.error;
+      if (!e) { return ''; }
+      var names = ['', 'aborted', 'network', 'decode', 'src-not-supported'];
+      return (names[e.code] || ('code ' + e.code))
+             + (e.message ? ': ' + e.message : '');
+    }
+
+    video.addEventListener('error', function () {
+      try {
+        console.error('[video] slot ' + s.n + ' element error',
+                      video.error && video.error.code,
+                      video.error && video.error.message);
+      } catch (e) { /* console may be absent */ }
+    });
+
+    function describe() {
+      var size = video.videoWidth
+          ? video.videoWidth + '×' + video.videoHeight : '';
+      say(('Playing ' + (lastCodec ? lastCodec + ' ' : '') + size).trim());
+    }
+
+    /*
+      Progress is taken from the element, not from mpegts.js.
+
+      MEDIA_INFO only fires once MediaInfo.isComplete(), which requires
+      hasAudio to be exactly true or false. It initialises to null and is
+      only set when audio metadata arrives, so a video-only stream --
+      which is what the backend produces by default, with -an -- leaves
+      it null and the event never fires at all. That left the status on
+      its initial text, and, because the media-error counter was reset
+      only there, let three transient errors over the life of a page
+      latch a stream that was playing perfectly well.
+
+      "playing" is the honest signal anyway: it means frames are being
+      presented, where MEDIA_INFO only ever meant metadata parsed.
+     */
+    video.addEventListener('loadedmetadata', describe);
+    video.addEventListener('playing', function () {
+      retryMs = 1000;
+      attempt = 0;
+      mediaErrors = 0;
+      describe();
+    });
+
+    /*
+      A token lives 60s; a page stays open far longer. Minting one at
+      render and reusing it means every reconnect after the first minute
+      is refused, which presents as "it only works if I reload".
+     */
+    function tokenFor(cb) {
+      if (firstToken) {
+        var t = firstToken;
+        firstToken = null;
+        cb(t);
+        return;
+      }
+      fetch(tokenUrl + '&slot=' + s.slot, { credentials: 'same-origin' })
+        .then(function (r) { return r.ok ? r.json() : null; })
+        .then(function (j) { cb(j && j.token); })
+        .catch(function () { cb(null); });
+    }
+
+    /*
+      Full teardown, then a brand-new <video>.
+
+      mpegts.js needs pause -> unload -> detachMediaElement -> destroy.
+      Skipping detachMediaElement leaves the element bound to the old,
+      already-ended MediaSource, and the next player cannot attach a
+      fresh one -- the reconnect then does nothing at all until the page
+      is reloaded, which is exactly the reported symptom.
+
+      Replacing the element as well costs nothing and makes that whole
+      class of stale-binding bug impossible.
+     */
+    /*
+      Tear down the player, and ONLY the player.
+
+      mpegts.js needs pause -> unload -> detachMediaElement -> destroy.
+      detachMediaElement is the call that unbinds the MediaSource, which
+      is what makes the same element reusable for the next connection.
+
+      The element itself must survive. Picture-in-Picture is bound to
+      the element, not to the page: replacing it drops PIP back into the
+      page in Firefox and leaves an orphaned, frozen PIP window in
+      Chrome. For the same reason the src attribute is left alone --
+      clearing it ends playback on the element and some browsers exit
+      PIP when that happens.
+     */
+    function teardown() {
+      if (!player) {
+        return;
+      }
+      try { player.pause(); } catch (e) { /* not playing */ }
+      try { player.unload(); } catch (e) { /* not loaded */ }
+      try { player.detachMediaElement(); } catch (e) { /* not attached */ }
+      try { player.destroy(); } catch (e) { /* already gone */ }
+      player = null;
+    }
+
+    var attempt = 0;
+
+    function schedule() {
+      // One disconnect can raise several events; without this each
+      // would start its own player and they would race.
+      if (pending || codecFailed) { return; }
+      pending = true;
+      attempt++;
+      var wait = retryMs;
+      // Capped low on purpose. A retry costs one WebSocket attempt, and
+      // the thing being waited for is usually a publisher being
+      // restarted by hand -- a 15s ceiling makes that look dead.
+      retryMs = Math.min(retryMs * 2, 5000);
+      setTimeout(function () { pending = false; connect(); }, wait);
+    }
+
+    function connect() {
+      if (codecFailed) { return; }
+      teardown();
+      tokenFor(function (tok) {
+        if (!tok) {
+          say('Could not get a viewer token \u2014 retrying\u2026');
+          schedule();
+          return;
+        }
+        start(scheme + '://' + host + ':' + s.port + '/v' + s.n +
+              '?t=' + encodeURIComponent(tok));
+      });
+    }
+
+    function start(url) {
+      player = mpegts.createPlayer(
+        { type: 'mpegts', isLive: true, url: url },
+        { enableWorker: true, liveBufferLatencyChasing: true });
+
+      // A publisher going away is a *clean* close, not an error: the
+      // proxy ends the stream deliberately. mpegts.js reports that as
+      // LOADING_COMPLETE, so listening only for ERROR misses the one
+      // case this reconnect exists for.
+      player.on(mpegts.Events.LOADING_COMPLETE, function () {
+        say('Stream ended \u2014 waiting for a publisher\u2026');
+        schedule();
+      });
+      player.on(mpegts.Events.ERROR, function (type, detail, info) {
+        // Keep the real error where it can be read; the status line has
+        // room for one line and this is what a diagnosis needs.
+        try {
+          console.error('[video] slot ' + s.n + ' error', type, detail,
+                        info && (info.msg || info.code),
+                        '| element:', mediaErrorText());
+        } catch (e) { /* console may be absent */ }
+
+        /*
+          An unsupported codec or container is permanent outright. Other
+          media errors may be transient -- Chrome raises them far more
+          readily than Firefox -- so they retry, but only a bounded
+          number of times: a stream this browser simply cannot play
+          errors again every time, and retrying for ever is a flashing
+          loop rather than an answer.
+         */
+        var permanent =
+            (detail === mpegts.ErrorDetails.MEDIA_CODEC_UNSUPPORTED
+             || detail === mpegts.ErrorDetails.MEDIA_FORMAT_UNSUPPORTED);
+        if (type === mpegts.ErrorTypes.MEDIA_ERROR) {
+          mediaErrors++;
+          if (permanent || mediaErrors >= 3) {
+            codecFailed = true;
+            var why = mediaErrorText();
+            say('This browser cannot play ' + (lastCodec || 'this stream') +
+                ' \u2014 ' + (why || detail) + '. If it is HEVC that is ' +
+                'expected \u2014 use the command below.');
+            return;
+          }
+          say('Media error (' + detail + ') \u2014 retrying\u2026');
+          schedule();
+          return;
+        }
+        say('Waiting for a publisher\u2026 (attempt ' + (attempt + 1) + ')');
+        schedule();
+      });
+      /*
+        Only for the codec name, and only when it arrives at all: see
+        the element listeners for why this cannot be relied on.
+       */
+      player.on(mpegts.Events.MEDIA_INFO, function (info) {
+        lastCodec = info.videoCodec || '';
+        describe();
+      });
+
+      var wasPip = (document.pictureInPictureElement === video);
+
+      player.attachMediaElement(video);
+      player.load();
+      video.play().catch(function () { say('Ready \u2014 press play.'); });
+
+      /*
+        Keeping the element is what preserves Picture-in-Picture across
+        a reconnect, position and size included. This is only a
+        fallback for a browser that drops it anyway: it cannot restore
+        where the window was, so it is strictly worse than not losing
+        it, and it is allowed to fail silently (a re-request without a
+        user gesture is often refused).
+       */
+      if (wasPip && document.pictureInPictureEnabled) {
+        video.addEventListener('loadedmetadata', function once() {
+          video.removeEventListener('loadedmetadata', once);
+          if (document.pictureInPictureElement !== video) {
+            video.requestPictureInPicture().catch(function () {});
+          }
+        });
+      }
+    }
+
+    // Registered once, not per connection: the element outlives every
+    // player now, so re-adding this on each reconnect would stack up a
+    // handler per attempt.
+    video.addEventListener('ended', function () {
+      say('Stream ended \u2014 waiting for a publisher\u2026');
+      schedule();
+    });
+
+    if (!window.mpegts || !mpegts.isSupported()) {
+      say('This browser cannot play MPEG-TS. Use the command below.');
+      return;
+    }
+    connect();
+  });
+})();
+</script>
+{% endif %}
+{% endblock %}
diff --git a/webadmin/videoform.py b/webadmin/videoform.py
new file mode 100644
index 0000000..430bfdc
--- /dev/null
+++ b/webadmin/videoform.py
@@ -0,0 +1,127 @@
+"""Shared glue between the video form fields and a KeyEntry.
+
+The owner and admin edit routes present the same video settings (the
+admin form adds port allocation and the disk budget), so the populate
+and apply logic lives here rather than being written twice.
+"""
+import keydb_lib
+
+# Per-slot form field prefixes -> the bit they map to.
+_SLOT_FIELDS = (
+    ('video_srt_%d', keydb_lib.VIDEO_SLOT_SRT),
+    ('video_record_%d', keydb_lib.VIDEO_SLOT_RECORD),
+    ('video_rawtcp_%d', keydb_lib.VIDEO_SLOT_RAW_TCP),
+)
+
+
+def populate(form, ke, db=None):
+    """Fill the video fields of `form` from `ke` (GET path).
+
+    `db` enables suggesting the next free port for unallocated slots.
+    """
+    form.video_enabled.data = ke.video_enabled()
+    form.video_audio.data = bool(
+        keydb_lib.video_entry_opts(ke.video_flags) & keydb_lib.VIDEO_OPT_AUDIO)
+    form.video_grace_s.data = ke.video_mav_grace_s
+
+    for slot in range(keydb_lib.MAX_VIDEO_PORTS):
+        opts = ke.slot_opts(slot)
+        for name_fmt, bit in _SLOT_FIELDS:
+            getattr(form, name_fmt % (slot + 1)).data = bool(opts & bit)
+        getattr(form, 'video_rtmp_%d' % (slot + 1)).data = ke.rtmp_path(slot)
+
+    # Admin-only fields.
+    if hasattr(form, 'video_port_1'):
+        form.video_port_count.data = ke.video_port_count()
+        # Suggest a port for every slot, not just the ones in use, so
+        # raising the count reveals a filled-in field instead of a blank
+        # one the admin has to research a free port for. Slots past the
+        # count are not saved (see apply), so an unused suggestion costs
+        # nothing.
+        if db is not None:
+            ports = keydb_lib.suggest_video_ports(
+                db, ke, keydb_lib.MAX_VIDEO_PORTS, keep=ke.video_ports)
+        else:
+            ports = list(ke.video_ports[:keydb_lib.MAX_VIDEO_PORTS])
+        for slot in range(keydb_lib.MAX_VIDEO_PORTS):
+            getattr(form, 'video_port_%d' % (slot + 1)).data = (
+                ports[slot] or None)
+    if hasattr(form, 'video_quota_mb'):
+        form.video_quota_mb.data = ke.video_quota_mb
+
+    # Password fields are never populated -- blank means "keep current".
+
+
+def apply(form, ke, db):
+    """Apply the video fields of `form` onto `ke` (POST path).
+
+    Returns an error string to flash, or None on success. `ke` is
+    mutated in place; the caller stores it.
+    """
+    if form.video_enabled.data:
+        ke.flags |= keydb_lib.FLAG_VIDEO
+    else:
+        ke.flags &= ~keydb_lib.FLAG_VIDEO
+
+    opts = keydb_lib.video_entry_opts(ke.video_flags)
+    if form.video_audio.data:
+        opts |= keydb_lib.VIDEO_OPT_AUDIO
+    else:
+        opts &= ~keydb_lib.VIDEO_OPT_AUDIO
+    ke.video_flags = keydb_lib.video_set_entry_opts(ke.video_flags, opts)
+
+    for slot in range(keydb_lib.MAX_VIDEO_PORTS):
+        slot_opts = ke.slot_opts(slot)
+        for name_fmt, bit in _SLOT_FIELDS:
+            if getattr(form, name_fmt % (slot + 1)).data:
+                slot_opts |= bit
+            else:
+                slot_opts &= ~bit
+        ke.set_slot_opts(slot, slot_opts)
+        try:
+            ke.set_rtmp_path(
+                slot, getattr(form, 'video_rtmp_%d' % (slot + 1)).data or '')
+        except keydb_lib.CLIError as e:
+            return 'Slot %d RTMP path: %s' % (slot + 1, e)
+
+    ke.video_mav_grace_s = int(form.video_grace_s.data or 0)
+
+    # Ports: admin-only. Validate against the whole DB before storing.
+    #
+    # Only touched while video is enabled. The page suggests a port for
+    # every slot, so writing them unconditionally would allocate ports
+    # to an entry that has video off just because someone saved an
+    # unrelated field on the same form.
+    if hasattr(form, 'video_port_1') and form.video_enabled.data:
+        # A submission that carries no count at all predates the
+        # selector; take every slot rather than silently dropping slot 2
+        # and 3 onto the field's default of 1.
+        count = keydb_lib.MAX_VIDEO_PORTS
+        if form.video_port_count.raw_data:
+            count = int(form.video_port_count.data or 1)
+        wanted = [getattr(form, 'video_port_%d' % (i + 1)).data or 0
+                  if i < count else 0
+                  for i in range(keydb_lib.MAX_VIDEO_PORTS)]
+        try:
+            ke.video_ports = keydb_lib.validate_video_ports(db, ke, wanted)
+        except keydb_lib.CLIError as e:
+            return str(e)
+    if hasattr(form, 'video_quota_mb'):
+        ke.video_quota_mb = int(form.video_quota_mb.data or 0)
+
+    # Passwords: blank keeps the current value, the paired checkbox clears
+    # it. Setting and clearing at once is a contradiction, so reject it
+    # rather than silently picking one.
+    for field, clear_field, setter, label in (
+            (form.video_viewer_pass, form.video_viewer_pass_clear,
+             ke.set_video_viewer_pass, 'viewer'),
+            (form.video_publish_pass, form.video_publish_pass_clear,
+             ke.set_video_publish_pass, 'publish')):
+        if field.data and clear_field.data:
+            return ('Cannot both set and clear the video %s password.' % label)
+        if clear_field.data:
+            setter('')
+        elif field.data:
+            setter(field.data)
+
+    return None
diff --git a/webadmin/videotoken.py b/webadmin/videotoken.py
new file mode 100644
index 0000000..213f8f5
--- /dev/null
+++ b/webadmin/videotoken.py
@@ -0,0 +1,51 @@
+"""Short-lived viewer tokens for browser playback.
+
+The browser needs a credential to open a WebSocket to the video port,
+and the obvious candidate -- the viewer password -- must not go in a
+URL: it would land in browser history, proxy logs and Referer headers.
+
+Instead the admin page, which has already authenticated the operator
+and can read the entry, mints a token signed with the entry's existing
+MAVLink secret key. The video child already loads that key, so this
+needs no new shared secret, no new state and no new file, and the
+browser never sees the key itself.
+
+Keep in sync with video_token_valid() in videoauth.cpp.
+"""
+import hashlib
+import hmac
+import time
+
+# Short by design: the token only has to survive the moment between
+# rendering the page and the player opening its socket.
+TOKEN_TTL_S = 60
+
+
+def mint(secret_key, port2, slot, ttl_s=TOKEN_TTL_S, now=None):
+    """Return "<expiry>.<hex hmac>" for this entry and slot."""
+    if now is None:
+        now = time.time()
+    expiry = int(now) + int(ttl_s)
+    msg = 'video-view|%d|%d|%d' % (int(port2), int(slot), expiry)
+    mac = hmac.new(bytes(secret_key), msg.encode('ascii'),
+                   hashlib.sha256).hexdigest()
+    return '%d.%s' % (expiry, mac)
+
+
+def verify(secret_key, port2, slot, token, now=None):
+    """Mirror of the C++ check, for tests."""
+    if now is None:
+        now = time.time()
+    if not token or '.' not in token:
+        return False
+    exp_s, _, mac = token.partition('.')
+    try:
+        expiry = int(exp_s)
+    except ValueError:
+        return False
+    if expiry <= 0 or now > expiry:
+        return False
+    msg = 'video-view|%d|%d|%d' % (int(port2), int(slot), expiry)
+    want = hmac.new(bytes(secret_key), msg.encode('ascii'),
+                    hashlib.sha256).hexdigest()
+    return hmac.compare_digest(want, mac)

From cb1f4980d0708de9dd3775070d1613ea1b45d592 Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <andrew@tridgell.net>
Date: Tue, 4 Aug 2026 17:30:12 +1000
Subject: [PATCH 5/6] scripts/docs: video test publisher, deploy staging and
 log rotation

test_video.py publishes a test pattern with a clock over any of the
supported transports and can check a stream back, so the matrix can be
exercised without a camera. It kills its children through PDEATHSIG: an
orphaned ffmpeg from an earlier run holds the publisher slot and the
next attempt is refused as slot-busy, which reads as the proxy being
broken.

CI installs ffmpeg. It is a real test dependency rather than a
convenience: RTSP and RTMP ingest hand the stream to an ffmpeg child,
and every test that needs one skips itself without it -- so the runner
was quietly skipping 36 tests and the whole ingest, recording and
viewer suite never ran there at all.

The tool's own tests no longer assume an encoder is present. Those that
shell out to it are skipped without one, and the command-construction
tests stub the drawtext probe: ffmpeg_publish_cmd() asks the local
binary whether it can use drawtext, so on a machine with no ffmpeg they
were asserting on a command built without -vf and failing on its
absence rather than on anything they meant to test.

Log rotation by logrotate with copytruncate, which is required rather
than preferred: the unit writes its log with systemd's
StandardOutput=append:, so the descriptor is held for the life of the
process and renaming would leave the daemon writing to a file nothing
can see. The trade is that whatever is emitted between the copy and the
truncate is lost -- not merely a line -- and the alternative is
restarting the daemon to make it reopen, which drops every live session.
Rotated on size rather than a schedule, since the rate depends entirely
on what the proxy is doing; no delaycompress, which buys nothing when
the rotated file is already a finished copy; and no create, which
logrotate ignores under copytruncate.

README documents video for the first time: the transports and what
credential each can carry, that plain MPEG-TS over UDP can carry none
and why an entry used for video wants bidi_sign or a publish password,
the ffmpeg dependency for RTSP and RTMP, that the video ports are public
and need opening, the separate disk budget, the browser's H.264-only
limitation, and how to install the rotation config.
---
 README.md                      | 167 ++++++-
 scripts/deploy_video.sh        | 256 ++++++++++
 scripts/run_tests.py           |  12 +-
 scripts/setup_ci.sh            |   7 +-
 scripts/supportproxy.logrotate |  43 ++
 scripts/test_video.py          | 889 +++++++++++++++++++++++++++++++++
 tests/test_video_testtool.py   | 362 ++++++++++++++
 7 files changed, 1732 insertions(+), 4 deletions(-)
 create mode 100755 scripts/deploy_video.sh
 create mode 100644 scripts/supportproxy.logrotate
 create mode 100755 scripts/test_video.py
 create mode 100644 tests/test_video_testtool.py

diff --git a/README.md b/README.md
index 49953e9..624c991 100644
--- a/README.md
+++ b/README.md
@@ -16,6 +16,7 @@ For more information on using the support proxy see https://support.ardupilot.or
 - Supports WebSocket and WebSocket+SSL TCP connections for both user
   and support engineer
 - supports up to 8 simultaneous connections by support engineer
+- Optional video proxying alongside the MAVLink link, with recording
 
 ## How It Works
 
@@ -32,6 +33,59 @@ secure, authenticated connections.
 
 Both sides can optionally use WebSocket+SSL to get a fully encrypted link.
 
+## Video
+
+Optional, off unless an entry has it enabled. A user points a camera at
+one of their entry's video ports and any number of ground stations can
+watch, with the same NAT traversal and per-entry credentials the MAVLink
+side already provides. Recordings land beside the tlogs under
+`logs/<port2>/<date>/` and are covered by the same retention.
+
+Video is deliberately independent of the MAVLink session: it survives a
+telemetry dropout, and with a publish password it needs no MAVLink at
+all.
+
+**Ports.** Up to three per entry, allocated by an admin from the web UI
+(suggested from 40001). Each carries one stream, on TCP and UDP.
+**These are public listening ports and must be open in the firewall.**
+
+**Publishing.**
+
+| Transport | Credential |
+|---|---|
+| MPEG-TS over UDP | none possible — see below |
+| RTSP | `?pw=` on the request URI |
+| RTMP | `?pw=` on the stream key, e.g. `FPV?pw=secret` |
+
+Plain MPEG-TS over UDP has nowhere to carry a password, so it is
+admitted on the MAVLink-session path only: a publisher is accepted when
+a MAVLink session for the entry was seen from the same address within
+the grace window. On a non-bidi entry *any* datagram latches the user
+side, so a scanner between flights can become the authorised address and
+the aircraft's video is then refused until the grace expires. **Entries
+used for video should set `bidi_sign` or a publish password.**
+
+**Watching.** In the browser from the web UI, or outside it with the
+`ffplay`/`vlc` command the page offers. The browser player needs H.264:
+Chrome and Firefox will not decode HEVC in Media Source Extensions on
+desktop Linux, and nothing here transcodes.
+
+**Disk.** Video has its own budget, separate from telemetry, so a busy
+camera can never evict a user's tlogs. Set it per entry in the web UI;
+a free-space floor stops recording before the disk fills.
+
+**Log rotation.** The daemon's own log is not rotated by default.
+Install the supplied config once, as root:
+
+```bash
+sudo install -m 644 scripts/supportproxy.logrotate \
+    /etc/logrotate.d/supportproxy
+```
+
+It uses `copytruncate`, which is required rather than preferred when the
+daemon's stdout is a file systemd holds open — see the comments in that
+file.
+
 ## Building
 
 ### Prerequisites
@@ -40,6 +94,9 @@ Both sides can optionally use WebSocket+SSL to get a fully encrypted link.
 # Ubuntu/Debian
 sudo apt install libtdb-dev python3-tdb python3-venv gcc g++ git libssl-dev
 
+# Only if video is used: RTSP and RTMP ingest hand the stream to an
+# ffmpeg child for demuxing. Plain MPEG-TS over UDP needs nothing extra.
+sudo apt install ffmpeg
 ```
 
 ### Get the source
@@ -65,7 +122,60 @@ source venv/bin/activate
 pip install pymavlink
 ```
 
-### Building SupportProxy
+### Video
+
+Optional, off unless an entry has it enabled. A user points a camera at
+one of their entry's video ports and any number of ground stations can
+watch, with the same NAT traversal and per-entry credentials the MAVLink
+side already provides. Recordings land beside the tlogs under
+`logs/<port2>/<date>/` and are covered by the same retention.
+
+Video is deliberately independent of the MAVLink session: it survives a
+telemetry dropout, and with a publish password it needs no MAVLink at
+all.
+
+**Ports.** Up to three per entry, allocated by an admin from the web UI
+(suggested from 40001). Each carries one stream, on TCP and UDP.
+**These are public listening ports and must be open in the firewall.**
+
+**Publishing.**
+
+| Transport | Credential |
+|---|---|
+| MPEG-TS over UDP | none possible — see below |
+| RTSP | `?pw=` on the request URI |
+| RTMP | `?pw=` on the stream key, e.g. `FPV?pw=secret` |
+
+Plain MPEG-TS over UDP has nowhere to carry a password, so it is
+admitted on the MAVLink-session path only: a publisher is accepted when
+a MAVLink session for the entry was seen from the same address within
+the grace window. On a non-bidi entry *any* datagram latches the user
+side, so a scanner between flights can become the authorised address and
+the aircraft's video is then refused until the grace expires. **Entries
+used for video should set `bidi_sign` or a publish password.**
+
+**Watching.** In the browser from the web UI, or outside it with the
+`ffplay`/`vlc` command the page offers. The browser player needs H.264:
+Chrome and Firefox will not decode HEVC in Media Source Extensions on
+desktop Linux, and nothing here transcodes.
+
+**Disk.** Video has its own budget, separate from telemetry, so a busy
+camera can never evict a user's tlogs. Set it per entry in the web UI;
+a free-space floor stops recording before the disk fills.
+
+**Log rotation.** The daemon's own log is not rotated by default.
+Install the supplied config once, as root:
+
+```bash
+sudo install -m 644 scripts/supportproxy.logrotate \
+    /etc/logrotate.d/supportproxy
+```
+
+It uses `copytruncate`, which is required rather than preferred when the
+daemon's stdout is a file systemd holds open — see the comments in that
+file.
+
+## Building SupportProxy
 
 ```bash
 # Build everything (initializes submodules, generates headers, compiles)
@@ -207,7 +317,60 @@ netstat -ln | grep ":1000[0-9]"
 
 SupportProxy can also be run using Docker for easier deployment and management.
 
-### Building the Docker Image
+### Video
+
+Optional, off unless an entry has it enabled. A user points a camera at
+one of their entry's video ports and any number of ground stations can
+watch, with the same NAT traversal and per-entry credentials the MAVLink
+side already provides. Recordings land beside the tlogs under
+`logs/<port2>/<date>/` and are covered by the same retention.
+
+Video is deliberately independent of the MAVLink session: it survives a
+telemetry dropout, and with a publish password it needs no MAVLink at
+all.
+
+**Ports.** Up to three per entry, allocated by an admin from the web UI
+(suggested from 40001). Each carries one stream, on TCP and UDP.
+**These are public listening ports and must be open in the firewall.**
+
+**Publishing.**
+
+| Transport | Credential |
+|---|---|
+| MPEG-TS over UDP | none possible — see below |
+| RTSP | `?pw=` on the request URI |
+| RTMP | `?pw=` on the stream key, e.g. `FPV?pw=secret` |
+
+Plain MPEG-TS over UDP has nowhere to carry a password, so it is
+admitted on the MAVLink-session path only: a publisher is accepted when
+a MAVLink session for the entry was seen from the same address within
+the grace window. On a non-bidi entry *any* datagram latches the user
+side, so a scanner between flights can become the authorised address and
+the aircraft's video is then refused until the grace expires. **Entries
+used for video should set `bidi_sign` or a publish password.**
+
+**Watching.** In the browser from the web UI, or outside it with the
+`ffplay`/`vlc` command the page offers. The browser player needs H.264:
+Chrome and Firefox will not decode HEVC in Media Source Extensions on
+desktop Linux, and nothing here transcodes.
+
+**Disk.** Video has its own budget, separate from telemetry, so a busy
+camera can never evict a user's tlogs. Set it per entry in the web UI;
+a free-space floor stops recording before the disk fills.
+
+**Log rotation.** The daemon's own log is not rotated by default.
+Install the supplied config once, as root:
+
+```bash
+sudo install -m 644 scripts/supportproxy.logrotate \
+    /etc/logrotate.d/supportproxy
+```
+
+It uses `copytruncate`, which is required rather than preferred when the
+daemon's stdout is a file systemd holds open — see the comments in that
+file.
+
+## Building the Docker Image
 
 ```bash
 docker build -f docker/Dockerfile -t ap-supportproxy .
diff --git a/scripts/deploy_video.sh b/scripts/deploy_video.sh
new file mode 100755
index 0000000..5cd48f1
--- /dev/null
+++ b/scripts/deploy_video.sh
@@ -0,0 +1,256 @@
+#!/bin/bash
+# Stage the video feature onto a server, alongside whatever else is
+# already running there.
+#
+# Usage:
+#   scripts/deploy_video.sh [user@]host                 # pre-flight only
+#   scripts/deploy_video.sh [user@]host --apply         # deploy + configure
+#   scripts/deploy_video.sh [user@]host --apply --entry 11025 --ports 12001
+#
+# Deliberately dry-run by default: it restarts the proxy and edits
+# keys.tdb, so it should not do either because someone ran it to look.
+#
+# What it does NOT touch, ever:
+#   ~/Video/            mediamtx's install and its recordings. The two
+#                       systems run side by side until the new one is
+#                       proven, so its ports and its 22 GB of captures
+#                       are none of our business.
+#   ~/proxy/*.pem       the WSS certs.
+#   logs/               existing tlogs and bin logs.
+set -u
+
+HOST=""
+APPLY=0
+ENTRY=""
+PORTS=""
+RECORD=1
+BIDI=0
+PUBPASS=""
+VIEWPASS=""
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --apply)     APPLY=1 ;;
+        --entry)     ENTRY="$2"; shift ;;
+        --ports)     PORTS="$2"; shift ;;
+        --no-record)    RECORD=0 ;;
+        --bidi)         BIDI=1 ;;
+        --publish-pass) PUBPASS="$2"; shift ;;
+        --viewer-pass)  VIEWPASS="$2"; shift ;;
+        -h|--help)   sed -n '2,25p' "$0"; exit 0 ;;
+        *)           HOST="$1" ;;
+    esac
+    shift
+done
+
+if [ -z "$HOST" ]; then
+    echo "usage: $0 [user@]host [--apply] [--entry PORT2] [--ports P1[,P2,P3]]" >&2
+    exit 1
+fi
+
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+REPO_ROOT="$( cd "$SCRIPT_DIR/.." && pwd )"
+
+# Ports for mediamtx, so we can say plainly when a chosen video port
+# would collide with it while both systems are running.
+MEDIAMTX_PORTS="1935 8322 11002 11032 11033 10002 10003"
+
+say()  { printf '  %s\n' "$*"; }
+head2() { printf '\n=== %s ===\n' "$*"; }
+fail() { printf '\nABORT: %s\n' "$*" >&2; exit 1; }
+
+# ---------------------------------------------------------------- pre-flight
+
+head2 "$HOST: pre-flight"
+
+PRE=$(ssh "$HOST" bash -se <<'SSH_EOF' 2>&1
+set -u
+printf 'os=%s\n' "$( . /etc/os-release && echo "$PRETTY_NAME" )"
+printf 'ffmpeg=%s\n' "$(command -v ffmpeg || echo MISSING)"
+printf 'freekb=%s\n' "$(df -Pk "$HOME" | awk 'NR==2{print $4}')"
+printf 'mediamtx=%s\n' "$(pgrep -x mediamtx >/dev/null && echo running || echo stopped)"
+printf 'systemd=%s\n' "$(systemctl is-enabled supportproxy.service 2>/dev/null || echo no)"
+# What the build actually needs is mavgen.py on PATH (regen_headers.sh),
+# whether that comes from a venv or a --user install. Testing for the
+# venv instead would fail on a host where pymavlink is installed
+# system-wide, which is how this one is set up.
+printf 'mavgen=%s\n' "$(command -v mavgen.py || echo MISSING)"
+for p in libtdb-dev libssl-dev; do
+    printf 'pkg_%s=%s\n' "$p" "$(dpkg -l "$p" 2>/dev/null | awk '/^ii/{print "ok"}' | head -1)"
+done
+printf 'bound=%s\n' "$(ss -lntuH 2>/dev/null | awk '{print $5}' | sed 's/.*://' | sort -un | tr '\n' ',')"
+SSH_EOF
+) || fail "cannot reach $HOST"
+
+get() { echo "$PRE" | sed -n "s/^$1=//p" | head -1; }
+
+say "os:        $(get os)"
+say "ffmpeg:    $(get ffmpeg)"
+say "free disk: $(( $(get freekb) / 1024 / 1024 )) GiB"
+say "mediamtx:  $(get mediamtx)"
+say "systemd:   $(get systemd)"
+say "mavgen:    $(get mavgen)"
+
+BOUND=",$(get bound)"
+FREEKB=$(get freekb)
+
+[ "$(get mavgen)" != MISSING ] || fail "mavgen.py not on PATH; regen_headers.sh needs pymavlink installed"
+[ -n "$(get pkg_libtdb-dev)" ] || fail "libtdb-dev missing on the server"
+[ -n "$(get pkg_libssl-dev)" ] || fail "libssl-dev missing on the server"
+
+# 4 GiB: the default per-entry video budget is 4 GiB and the recorder
+# refuses to open a segment below a 2 GiB floor, so anything less and
+# recording would never start.
+if [ "$FREEKB" -lt $((6 * 1024 * 1024)) ]; then
+    fail "only $(( FREEKB / 1024 / 1024 )) GiB free; want >= 6 GiB (4 GiB video quota + the 2 GiB floor)"
+fi
+
+FFMPEG_OK=1
+if [ "$(get ffmpeg)" = MISSING ]; then
+    FFMPEG_OK=0
+    say ""
+    say "ffmpeg is NOT installed. MPEG-TS/UDP publish, all viewers and"
+    say "recording work without it; only RTSP ingest needs it. There is no"
+    say "passwordless sudo here, so install it yourself:"
+    say "    ssh $HOST sudo apt install ffmpeg"
+fi
+
+# ------------------------------------------------------------------- ports
+
+PORTS="${PORTS:-12001}"
+head2 "video ports: $PORTS"
+IFS=',' read -ra PORT_LIST <<< "$PORTS"
+for p in "${PORT_LIST[@]}"; do
+    case "$BOUND" in
+        *",$p,"*) fail "port $p is already bound on $HOST" ;;
+    esac
+    for m in $MEDIAMTX_PORTS; do
+        if [ "$p" = "$m" ]; then
+            fail "port $p is one of mediamtx's ($MEDIAMTX_PORTS) and both must keep running"
+        fi
+    done
+    say "$p free, and clear of mediamtx"
+done
+
+# ------------------------------------------------------------------ entries
+
+head2 "entries on $HOST"
+ssh "$HOST" "cd ~/proxy && python3 -c \"
+import sys; sys.path.insert(0, '\$HOME/SupportProxy')
+import keydb_lib
+db = keydb_lib.open_db('keys.tdb'); db.transaction_start()
+try:
+    for e in keydb_lib.list_entries(db):
+        print('  %5d/%-5d %-18s %s' % (e.port1, e.port2, e.name,
+                                       ','.join(e.flag_names()) or '(no flags)'))
+finally:
+    db.transaction_cancel(); db.close()
+\"" 2>&1 | head -30
+
+if [ -z "$ENTRY" ]; then
+    head2 "no --entry given"
+    say "Pre-flight only. Re-run with, for example:"
+    say "    $0 $HOST --apply --entry 11025 --ports $PORTS"
+    say ""
+    say ""
+    say "Publisher auth, pick one:"
+    say ""
+    say "  (a) --publish-pass SECRET   password only, no MAVLink needed."
+    say "      Publish with rtsp://HOST:PORT/cam?pw=SECRET."
+    say "      NOTE: the password REPLACES the address check, and plain"
+    say "      MPEG-TS/UDP cannot carry one -- with a password set, UDP"
+    say "      publish is refused. Use RTSP."
+    say ""
+    say "  (b) nothing                 address must match a recent MAVLink"
+    say "      session. Works for UDP and RTSP. But without bidi ANY"
+    say "      datagram latches conn1, and this server sees hundreds of"
+    say "      distinct scanners doing exactly that -- a scanner holding"
+    say "      conn1 makes the aircraft's own publish be refused until it"
+    say "      ages out (grace window, 60s default)."
+    say ""
+    say "  (c) --bidi                  as (b), but only a signature-checked"
+    say "      session can latch conn1, so scanners cannot interfere."
+    say "      Changes the entry: the aircraft must sign from then on."
+    exit 0
+fi
+
+if [ "$APPLY" != 1 ]; then
+    head2 "dry run"
+    say "Would deploy the current working tree to $HOST and then:"
+    say "  entry $ENTRY: video ports $PORTS"
+    [ "$BIDI" = 1 ]      && say "  entry $ENTRY: bidi_sign ON"
+    [ -n "$PUBPASS" ]    && say "  entry $ENTRY: publish password SET (UDP publish will be refused)"
+    [ -n "$VIEWPASS" ]   && say "  entry $ENTRY: viewer password SET"
+    [ "$RECORD" = 1 ]    && say "  slot 1: record ON"
+    if [ "$BIDI" = 0 ] && [ -z "$PUBPASS" ]; then
+        say ""
+        say "  WARNING: no bidi and no publish password -- a scanner that"
+        say "  latches conn1 will block the aircraft's video publish."
+    fi
+    say "Re-run with --apply to do it."
+    exit 0
+fi
+
+# ------------------------------------------------------------------- deploy
+
+head2 "$HOST: backing up keys.tdb"
+ssh "$HOST" 'cd ~/proxy && cp -a keys.tdb "keys.tdb.before-video.$(date +%Y%m%d%H%M%S)" && ls -1t keys.tdb.before-video.* | head -1' \
+    || fail "could not back up keys.tdb"
+
+head2 "$HOST: sync, build, restart"
+"$SCRIPT_DIR/update_server.sh" "$HOST" || fail "update_server.sh failed; nothing was reconfigured"
+
+head2 "$HOST: verifying the new build"
+ssh "$HOST" '~/SupportProxy/supportproxy --selftest-video' \
+    || fail "the deployed binary failed its own self-test"
+
+# ---------------------------------------------------------------- configure
+
+head2 "$HOST: configuring entry $ENTRY"
+ssh "$HOST" bash -se <<SSH_EOF
+set -e
+cd ~/proxy
+K=\$HOME/SupportProxy/keydb.py
+python3 \$K setvideo $ENTRY ${PORTS//,/ }
+python3 \$K setflag $ENTRY video
+if [ "$BIDI" = 1 ]; then python3 \$K setflag $ENTRY bidi_sign; fi
+if [ -n "$PUBPASS" ]; then python3 \$K setpublishpass $ENTRY '$PUBPASS'; fi
+if [ -n "$VIEWPASS" ]; then python3 \$K setviewerpass $ENTRY '$VIEWPASS'; fi
+if [ "$RECORD" = 1 ]; then python3 \$K videoflag $ENTRY 0 record; fi
+python3 \$K video $ENTRY
+SSH_EOF
+
+head2 "$HOST: post-check"
+sleep 8
+ssh "$HOST" bash -se <<SSH_EOF
+for p in ${PORTS//,/ }; do
+    if ss -lntu 2>/dev/null | grep -q ":\$p "; then
+        echo "  video port \$p is listening"
+    else
+        echo "  video port \$p NOT listening -- check ~/proxy/proxy.log"
+    fi
+done
+echo "  mediamtx: \$(pgrep -x mediamtx >/dev/null && echo 'still running (untouched)' || echo 'stopped (as it was)')"
+grep -E 'video (slot|child)' ~/proxy/proxy.log | tail -4 | sed 's/^/  /'
+SSH_EOF
+
+head2 "done"
+if [ -n "$PUBPASS" ]; then
+    say "Publish to: rtsp://$HOST:${PORT_LIST[0]}/cam?pw=$PUBPASS"
+    say "        (UDP publish is refused while a publish password is set)"
+else
+    say "Publish to: udp://$HOST:${PORT_LIST[0]}   (MPEG-TS, e.g. gstreamer udpsink)"
+    if [ "$FFMPEG_OK" = 1 ]; then
+        say "        or: rtsp://$HOST:${PORT_LIST[0]}/cam"
+    else
+        say "        RTSP publish needs ffmpeg installed first."
+    fi
+fi
+# Without the flags ffplay spends its default 5s analyzeduration before
+# showing anything, which reads as the proxy being slow.
+say "Watch with: ffplay -fflags nobuffer -flags low_delay -framedrop \\"
+say "                   -probesize 500000 -analyzeduration 1000000 \\"
+say "                   http://$HOST:${PORT_LIST[0]}/v1.ts"
+say "        or: the video page in the web admin"
+say ""
+say "mediamtx is untouched and still on its own ports."
diff --git a/scripts/run_tests.py b/scripts/run_tests.py
index a71a220..dae8de3 100755
--- a/scripts/run_tests.py
+++ b/scripts/run_tests.py
@@ -35,7 +35,17 @@
                               'tests/test_conn2_slot_orphan.py',
                               'tests/test_drop_lost_request.py',
                               'tests/test_websocket_decode.py',
-                              'tests/test_ws_handshake_ordering.py']),
+                              'tests/test_ws_handshake_ordering.py',
+                              'tests/test_websocket_framing.py',
+                              'tests/test_bidi_video_preauth.py',
+                              'tests/test_video_schema.py',
+                              'tests/test_video_ports.py',
+                              'tests/test_video_child.py',
+                              'tests/test_video_ingest.py',
+                              'tests/test_video_record.py',
+                              'tests/test_video_view.py',
+                              'tests/test_video_rtsp.py',
+                              'tests/test_video_testtool.py']),
     ('Webadmin Tests',       ['tests/webadmin/']),
 ]
 
diff --git a/scripts/setup_ci.sh b/scripts/setup_ci.sh
index b76a865..cb66bd6 100755
--- a/scripts/setup_ci.sh
+++ b/scripts/setup_ci.sh
@@ -12,6 +12,10 @@ cd "$(dirname "$0")/.."
 
 echo "=== Setting up CI environment for SupportProxy tests ==="
 
+# ffmpeg is a real test dependency, not a convenience. RTSP and RTMP
+# ingest hand the stream to an ffmpeg child, and the video tests skip
+# themselves without it -- so leaving it out means the whole ingest,
+# recording and viewer suite silently does not run in CI.
 echo "Installing system dependencies..."
 sudo apt-get update
 sudo apt-get install -y \
@@ -24,7 +28,8 @@ sudo apt-get install -y \
     python3-tdb \
     python3-pip \
     python3-venv \
-    libtdb1
+    libtdb1 \
+    ffmpeg
 
 # Check if virtual environment exists
 if [ ! -d "venv" ]; then
diff --git a/scripts/supportproxy.logrotate b/scripts/supportproxy.logrotate
new file mode 100644
index 0000000..f7d111a
--- /dev/null
+++ b/scripts/supportproxy.logrotate
@@ -0,0 +1,43 @@
+# Rotation for the daemon and web admin activity logs.
+#
+# Install as root:
+#     install -m 644 scripts/supportproxy.logrotate \
+#         /etc/logrotate.d/supportproxy
+#
+# copytruncate is required, not optional. supportproxy.service writes
+# its log with systemd's StandardOutput=append:, so systemd holds the
+# descriptor for the life of the process -- renaming the file would
+# leave the daemon writing to an unlinked inode until the next restart,
+# and the visible log would stop growing with nothing to show why.
+# Copying and then truncating keeps the descriptor valid, and because it
+# is opened O_APPEND the next write lands at the new start.
+#
+# The trade: anything written between the copy and the truncate is lost
+# -- not merely a line, but whatever the daemon emits in that window,
+# which on a busy proxy with a large log is not nothing. The alternative
+# is restarting the daemon to make it reopen, which drops every live
+# session, so losing a moment of log is the lesser cost.
+
+# Rotated on size, not on a schedule: this is a debugging log whose rate
+# depends entirely on what the proxy is doing, so bounding the disk it
+# can take is the useful guarantee. logrotate's own timer decides how
+# often the size is checked -- daily on a stock Debian/Ubuntu -- and
+# specifying `daily` here as well would be dead text, since `size`
+# overrides it (logrotate says so itself in -d output).
+/home/fire/proxy/proxy.log /home/fire/proxy/webui.log {
+    size 64M
+    rotate 14
+    # No delaycompress: that exists to avoid compressing a file still
+    # being appended to, but copytruncate means the rotated file is a
+    # finished copy the moment it exists. Deferring would just keep an
+    # uncompressed generation on disk for no benefit.
+    compress
+    missingok
+    notifempty
+    copytruncate
+    su fire fire
+    # No `create`: logrotate ignores it under copytruncate, because the
+    # live file is never replaced. The permissions on proxy.log are
+    # whatever the daemon's umask made them; this stanza cannot set or
+    # repair them, and pretending otherwise would be misleading.
+}
diff --git a/scripts/test_video.py b/scripts/test_video.py
new file mode 100755
index 0000000..61406d0
--- /dev/null
+++ b/scripts/test_video.py
@@ -0,0 +1,889 @@
+#!/usr/bin/env python3
+"""Generate a test video stream for a SupportProxy video port, and pull it
+back to check what arrived.
+
+The picture carries a test pattern plus a running wall clock and elapsed
+timer burned into the frame, so a viewer anywhere can see at a glance
+whether the stream is live, how far behind it is, and whether it froze.
+
+  # publish a 720p H.264 test pattern over MPEG-TS/UDP
+  scripts/test_video.py publish --host neon --port 40001
+
+  # publish over RTSP with a publish password
+  scripts/test_video.py publish --host neon --port 40001 \
+      --transport rtsp --publish-pass secret
+
+  # pull it back and report on what arrived
+  scripts/test_video.py view --host neon --port 40001 --viewer-pass hunter2
+
+  # do both and print a pass/fail
+  scripts/test_video.py check --host neon --port 40001
+
+  # what can this machine do?
+  scripts/test_video.py caps
+
+Publish transports are the ones the proxy actually accepts: MPEG-TS over
+UDP, and RTSP. A plain TCP connection to a video port is treated as a
+viewer, so there is no raw-TCP publish; SRT is not implemented yet.
+"""
+import argparse
+import base64
+import json
+import os
+import re
+import shlex
+import shutil
+import signal
+import socket
+import subprocess
+import sys
+import threading
+import time
+
+TS_PACKET = 188
+# What a well-behaved MPEG-TS/UDP sender emits: 7 packets per datagram,
+# which is also SRT's default payload size for the same reason.
+TS_UDP_PAYLOAD = 7 * TS_PACKET
+
+# Stream types we recognise in a PMT, for reporting.
+STREAM_TYPES = {
+    0x02: 'MPEG-2 video', 0x03: 'MP2 audio', 0x04: 'MP3 audio',
+    0x0F: 'AAC', 0x1B: 'H.264', 0x24: 'HEVC', 0x81: 'AC-3',
+    0x06: 'private data',
+}
+
+
+def log(msg):
+    sys.stderr.write('%s\n' % msg)
+    sys.stderr.flush()
+
+
+def die(msg, code=2):
+    log('error: %s' % msg)
+    sys.exit(code)
+
+
+# ----------------------------------------------------------------- caps
+
+def have(prog):
+    return shutil.which(prog) is not None
+
+
+def ffmpeg_has_filter(name):
+    if not have('ffmpeg'):
+        return False
+    try:
+        out = subprocess.run(['ffmpeg', '-hide_banner', '-filters'],
+                             capture_output=True, text=True,
+                             timeout=20).stdout
+    except (OSError, subprocess.SubprocessError):
+        return False
+    return re.search(r'^\s*\S+\s+%s\s' % re.escape(name), out, re.M) is not None
+
+
+def gst_has(element):
+    if not have('gst-inspect-1.0'):
+        return False
+    return subprocess.run(['gst-inspect-1.0', element],
+                          stdout=subprocess.DEVNULL,
+                          stderr=subprocess.DEVNULL).returncode == 0
+
+
+def capabilities():
+    caps = {
+        'ffmpeg': have('ffmpeg'),
+        'ffprobe': have('ffprobe'),
+        'ffplay': have('ffplay'),
+        'gstreamer': have('gst-launch-1.0'),
+    }
+    caps['ffmpeg_drawtext'] = ffmpeg_has_filter('drawtext')
+    caps['ffmpeg_testsrc2'] = ffmpeg_has_filter('testsrc2')
+    caps['gst_clockoverlay'] = gst_has('clockoverlay')
+    caps['gst_rtspclientsink'] = gst_has('rtspclientsink')
+    return caps
+
+
+def pick_encoder(want, transport):
+    """Resolve --encoder auto against what is installed and what the
+    transport needs."""
+    caps = capabilities()
+    ff_ok = caps['ffmpeg'] and caps['ffmpeg_testsrc2']
+    gst_ok = caps['gstreamer'] and caps['gst_clockoverlay']
+    # GStreamer can only publish RTSP with rtspclientsink, which lives in
+    # the -bad plugin set and is often absent.
+    if transport == 'rtsp':
+        gst_ok = gst_ok and caps['gst_rtspclientsink']
+
+    if want == 'ffmpeg':
+        if not ff_ok:
+            die('ffmpeg not usable here (need ffmpeg with testsrc2); '
+                'run "%s caps"' % sys.argv[0])
+        return 'ffmpeg'
+    if want == 'gst':
+        if not gst_ok:
+            die('gstreamer not usable for %s here; run "%s caps"'
+                % (transport, sys.argv[0]))
+        return 'gst'
+    if ff_ok:
+        return 'ffmpeg'
+    if gst_ok:
+        return 'gst'
+    die('neither ffmpeg nor gstreamer is usable here; run "%s caps"'
+        % sys.argv[0])
+
+
+# ------------------------------------------------------------- publisher
+
+def publish_url(a):
+    if a.transport == 'udp':
+        # pkt_size makes ffmpeg emit 7-packet datagrams rather than
+        # splitting a TS packet across two, which the proxy rejects.
+        return 'udp://%s:%d?pkt_size=%d' % (a.host, a.port, TS_UDP_PAYLOAD)
+    # The publish password rides in the request-line query. It is the only
+    # place RTSP can carry one without us parsing the session, and ffmpeg
+    # passes the query through untouched.
+    url = 'rtsp://%s:%d/%s' % (a.host, a.port, a.rtsp_path.lstrip('/'))
+    if a.publish_pass:
+        url += '?pw=%s' % a.publish_pass
+    return url
+
+
+def ffmpeg_publish_cmd(a):
+    vcodec = {'h264': 'libx264', 'hevc': 'libx265'}[a.codec]
+    # The clock is the point of the exercise: wall time proves the stream
+    # is live, the elapsed timer proves it is not looping or stalled.
+    #
+    # The text needs BOTH single quotes around it AND a backslash on the
+    # colon in %{pts:hms} -- measured, not guessed. Quotes alone still
+    # split the filter arg at that colon, and the backslash alone does
+    # too. %{localtime} takes no argument so has no colon to escape.
+    fs = _font_size(a)
+    # x is clamped rather than plain (w-text_w)/2: a line wider than the
+    # frame would otherwise centre to a negative x and lose characters
+    # off BOTH edges, which is how the clock ends up unreadable at small
+    # sizes. The comma in max() is a filter-arg separator, so it escapes.
+    common = ('fontcolor=white:fontsize=%d:box=1:boxcolor=black@0.6:'
+              'boxborderw=6:x=max(0\\,(w-text_w)/2)' % fs)
+    filters = ["drawtext=text='%s':%s:y=h-text_h-%d"
+               % ("%{localtime}  +%{pts\\:hms}", common, max(8, fs // 3))]
+    if a.label:
+        # Its own line, so a long label cannot push the clock off-frame.
+        filters.append("drawtext=text='%s':%s:y=%d"
+                       % (_ff_escape(a.label), common, max(8, fs // 3)))
+    drawtext = ','.join(filters)
+
+    cmd = ['ffmpeg', '-hide_banner', '-nostdin', '-loglevel', a.loglevel,
+           '-re',
+           '-f', 'lavfi', '-i',
+           'testsrc2=size=%s:rate=%d' % (a.size, a.fps)]
+    if a.audio:
+        # A tone, so an audio track exists to exercise the audio path.
+        cmd += ['-f', 'lavfi', '-i',
+                'sine=frequency=440:sample_rate=48000']
+    vf = drawtext
+    if ffmpeg_has_filter('drawtext'):
+        cmd += ['-vf', vf]
+    else:
+        log('note: ffmpeg has no drawtext filter (needs libfreetype); '
+            'publishing the pattern without a clock overlay')
+    cmd += ['-c:v', vcodec, '-preset', 'ultrafast', '-tune', 'zerolatency',
+            '-b:v', a.bitrate, '-maxrate', a.bitrate,
+            '-bufsize', a.bitrate,
+            # A short GOP means a viewer joining late finds an anchor
+            # quickly; the proxy needs a keyframe to start anyone.
+            '-g', str(a.fps * a.gop_seconds),
+            '-pix_fmt', 'yuv420p']
+    if a.audio:
+        cmd += ['-c:a', 'aac', '-b:a', '96k']
+    else:
+        cmd += ['-an']
+    if a.duration:
+        cmd += ['-t', str(a.duration)]
+
+    if a.transport == 'udp':
+        cmd += ['-f', 'mpegts', '-muxdelay', '0', '-flush_packets', '1']
+    else:
+        cmd += ['-f', 'rtsp', '-rtsp_transport', 'tcp']
+    cmd += [publish_url(a)]
+    return cmd
+
+
+def _font_size(a):
+    """--font-size 0 means scale to the frame: the clock has to stay
+    readable at 320x180 and not fill the screen at 1080p."""
+    if a.font_size:
+        return a.font_size
+    try:
+        height = int(a.size.split('x')[1])
+    except (IndexError, ValueError):
+        return 24
+    return max(12, height // 20)
+
+
+def _ff_escape(s):
+    """Escape --label for use inside the single-quoted drawtext value.
+
+    A single quote cannot be escaped inside a single-quoted section of an
+    ffmpeg filter argument -- it has to close the quote, escape, reopen.
+    Not worth it for a caption on a test pattern, so those are dropped.
+    """
+    s = s.replace("'", '')
+    return s.replace('\\', r'\\').replace(':', r'\:').replace(',', r'\,')
+
+
+def gst_publish_cmd(a):
+    enc = {'h264': 'x264enc tune=zerolatency speed-preset=ultrafast '
+                   'key-int-max=%d bitrate=%d' % (a.fps * a.gop_seconds,
+                                                  _kbits(a.bitrate)),
+           'hevc': 'x265enc tune=zerolatency speed-preset=ultrafast '
+                   'key-int-max=%d bitrate=%d' % (a.fps * a.gop_seconds,
+                                                  _kbits(a.bitrate))}[a.codec]
+    w, h = a.size.split('x')
+    src = 'videotestsrc is-live=true pattern=smpte'
+    if a.duration:
+        src += ' num-buffers=%d' % (a.fps * a.duration)
+    fs = _font_size(a)
+    parts = [
+        src,
+        'video/x-raw,width=%s,height=%s,framerate=%d/1' % (w, h, a.fps),
+        'clockoverlay time-format="%H:%M:%S" font-desc="Sans {}" '
+        'valignment=bottom halignment=center'.format(fs),
+        'timeoverlay font-desc="Sans {}" valignment=top '
+        'halignment=center'.format(fs),
+        'videoconvert',
+        enc,
+        'mpegtsmux alignment=7 name=mux',
+    ]
+    if a.transport == 'udp':
+        parts.append('udpsink host=%s port=%d' % (a.host, a.port))
+    else:
+        parts.append('rtspclientsink location=%s' % publish_url(a))
+    # gst-launch takes each argv element as one pipeline token -- it does
+    # NOT split them on spaces -- so "videotestsrc is-live=true" as a
+    # single argument is a syntax error. shlex.split gives one word per
+    # argument while keeping "Sans 18" together as the quoted value it is.
+    return ['gst-launch-1.0', '-q'] + shlex.split(' ! '.join(parts))
+
+
+def _kbits(bitrate):
+    m = re.match(r'^(\d+)([kKmM]?)$', bitrate)
+    if not m:
+        die('bad --bitrate %r (try 2M or 2000k)' % bitrate)
+    n = int(m.group(1))
+    return n * 1000 if m.group(2).lower() == 'm' else (n if m.group(2)
+                                                       else n // 1000)
+
+
+def cmd_publish(a):
+    encoder = pick_encoder(a.encoder, a.transport)
+    cmd = (ffmpeg_publish_cmd(a) if encoder == 'ffmpeg'
+           else gst_publish_cmd(a))
+
+    log('publishing to %s' % publish_url(a))
+    log('  %s %s %s @ %dfps, %s, audio=%s, encoder=%s'
+        % (a.codec, a.size, a.transport, a.fps, a.bitrate,
+           'on' if a.audio else 'off', encoder))
+    if a.dry_run:
+        print(' '.join(_shquote(c) for c in cmd))
+        return 0
+    if a.verbose:
+        log('  $ %s' % ' '.join(_shquote(c) for c in cmd))
+
+    try:
+        p = _spawn(cmd)
+    except OSError as e:
+        die('cannot start %s: %s' % (cmd[0], e))
+    try:
+        return p.wait()
+    except KeyboardInterrupt:
+        p.send_signal(signal.SIGINT)
+        try:
+            return p.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            p.kill()
+            return 130
+    finally:
+        # Covers every other way this process can end: a signal, an
+        # exception, or the shell going away.
+        _reap(p)
+
+
+def _pdeathsig():
+    """Ask the kernel to SIGTERM this child when its parent dies.
+
+    Without it, killing the wrapper leaves ffmpeg publishing forever --
+    and because one publisher holds a slot, that orphan then refuses the
+    *next* publisher as slot-busy. A leaked test publisher can quietly
+    take over a real video port, which is exactly what it did.
+    """
+    try:
+        import ctypes
+        libc = ctypes.CDLL('libc.so.6', use_errno=True)
+        libc.prctl(1, signal.SIGTERM, 0, 0, 0)   # PR_SET_PDEATHSIG
+    except Exception:
+        pass                                     # best effort; the
+                                                 # finally: below still
+                                                 # covers a clean exit
+
+
+def _spawn(cmd, **kw):
+    return subprocess.Popen(cmd, preexec_fn=_pdeathsig, **kw)
+
+
+def _reap(p):
+    """Stop a publisher and make sure it is really gone."""
+    if p is None or p.poll() is not None:
+        return
+    p.terminate()
+    try:
+        p.wait(timeout=5)
+    except subprocess.TimeoutExpired:
+        p.kill()
+        p.wait()
+
+
+def _shquote(s):
+    return s if re.match(r'^[\w@%+=:,./-]+$', s) else "'%s'" % s.replace(
+        "'", "'\\''")
+
+
+# ---------------------------------------------------------------- viewer
+
+def viewer_query(a):
+    """Credential for a viewer URL. A token beats a password: it is
+    short-lived and does not land in logs or history as a reusable
+    secret."""
+    if a.token:
+        return 't=%s' % a.token
+    if a.viewer_pass:
+        return 'pw=%s' % a.viewer_pass
+    return ''
+
+
+def http_view(a, sink, deadline):
+    path = a.path
+    q = viewer_query(a)
+    if q:
+        path += ('&' if '?' in path else '?') + q
+    req = ('GET %s HTTP/1.1\r\nHost: %s:%d\r\nUser-Agent: supportproxy-test\r\n'
+           'Connection: close\r\n\r\n' % (path, a.host, a.port))
+    s = socket.create_connection((a.host, a.port), timeout=a.connect_timeout)
+    s.sendall(req.encode())
+    return _read_after_headers(s, sink, deadline, a)
+
+
+def tcp_view(a, sink, deadline):
+    """Raw TCP viewer: connect, say nothing, read. Only works when the
+    slot has 'open TCP viewers' enabled -- there is nowhere in a raw
+    stream to carry a credential."""
+    s = socket.create_connection((a.host, a.port), timeout=a.connect_timeout)
+    return _read_body(s, sink, deadline, a)
+
+
+def ws_view(a, sink, deadline):
+    key = base64.b64encode(os.urandom(16)).decode()
+    path = a.path
+    q = viewer_query(a)
+    if q:
+        path += ('&' if '?' in path else '?') + q
+    req = ('GET %s HTTP/1.1\r\nHost: %s:%d\r\nUpgrade: websocket\r\n'
+           'Connection: Upgrade\r\nSec-WebSocket-Key: %s\r\n'
+           'Sec-WebSocket-Version: 13\r\n\r\n'
+           % (path, a.host, a.port, key))
+    s = socket.create_connection((a.host, a.port), timeout=a.connect_timeout)
+    s.sendall(req.encode())
+    head, rest = _read_headers(s, a)
+    if '101' not in head.split('\r\n')[0]:
+        raise ViewError('websocket upgrade refused: %s'
+                        % head.split('\r\n')[0])
+    return _read_ws_frames(s, rest, sink, deadline, a)
+
+
+class ViewError(Exception):
+    pass
+
+
+def _read_headers(s, a):
+    buf = b''
+    while b'\r\n\r\n' not in buf:
+        if len(buf) > 65536:
+            raise ViewError('no end of headers after 64 KiB')
+        chunk = s.recv(4096)
+        if not chunk:
+            raise ViewError('connection closed during headers')
+        buf += chunk
+    head, _, rest = buf.partition(b'\r\n\r\n')
+    return head.decode('latin-1'), rest
+
+
+def _read_after_headers(s, sink, deadline, a):
+    head, rest = _read_headers(s, a)
+    status = head.split('\r\n')[0]
+    if ' 200' not in status:
+        raise ViewError('server said: %s\n%s' % (status, head))
+    if rest:
+        sink(rest)
+    return _read_body(s, sink, deadline, a, primed=True)
+
+
+def _read_body(s, sink, deadline, a, primed=False):
+    s.settimeout(1.0)
+    while time.time() < deadline:
+        try:
+            chunk = s.recv(65536)
+        except socket.timeout:
+            continue
+        if not chunk:
+            break
+        sink(chunk)
+    s.close()
+    return True
+
+
+def _read_ws_frames(s, rest, sink, deadline, a):
+    """Enough of RFC 6455 to read a binary stream from the server.
+    Server-to-client frames are never masked."""
+    buf = bytearray(rest)
+    s.settimeout(1.0)
+    while time.time() < deadline:
+        # Parse whatever complete frames are buffered.
+        while True:
+            frame, used = _ws_parse(buf)
+            if frame is None:
+                break
+            del buf[:used]
+            opcode, payload = frame
+            if opcode == 0x8:            # close
+                s.close()
+                return True
+            if opcode in (0x1, 0x2, 0x0):
+                sink(payload)
+        try:
+            chunk = s.recv(65536)
+        except socket.timeout:
+            continue
+        if not chunk:
+            break
+        buf += chunk
+    s.close()
+    return True
+
+
+def _ws_parse(buf):
+    if len(buf) < 2:
+        return None, 0
+    b0, b1 = buf[0], buf[1]
+    opcode = b0 & 0x0F
+    masked = bool(b1 & 0x80)
+    ln = b1 & 0x7F
+    off = 2
+    if ln == 126:
+        if len(buf) < off + 2:
+            return None, 0
+        ln = int.from_bytes(buf[off:off + 2], 'big')
+        off += 2
+    elif ln == 127:
+        if len(buf) < off + 8:
+            return None, 0
+        ln = int.from_bytes(buf[off:off + 8], 'big')
+        off += 8
+    if masked:
+        if len(buf) < off + 4:
+            return None, 0
+        mask = buf[off:off + 4]
+        off += 4
+    if len(buf) < off + ln:
+        return None, 0
+    payload = bytes(buf[off:off + ln])
+    if masked:
+        payload = bytes(c ^ mask[i % 4] for i, c in enumerate(payload))
+    return (opcode, payload), off + ln
+
+
+# ------------------------------------------------------------ TS analysis
+
+class TSAnalyser:
+    """Just enough MPEG-TS to say whether what arrived is a real stream.
+
+    Deliberately independent of the proxy's own scanner: a bug shared
+    between the thing under test and the thing checking it would be
+    invisible.
+    """
+
+    def __init__(self):
+        self.buf = bytearray()
+        self.bytes = 0
+        self.packets = 0
+        self.unsynced = 0
+        self.pids = {}
+        self.cc = {}
+        self.cc_errors = 0
+        self.rai = 0
+        self.pat_seen = 0
+        self.pmt_pids = set()
+        self.streams = {}
+        self.first_byte_at = None
+        self.last_byte_at = None
+
+    def feed(self, data):
+        now = time.time()
+        if self.first_byte_at is None:
+            self.first_byte_at = now
+        self.last_byte_at = now
+        self.bytes += len(data)
+        self.buf += data
+        # Resync to a sync byte if we are not on one.
+        while self.buf and self.buf[0] != 0x47:
+            del self.buf[0]
+            self.unsynced += 1
+        while len(self.buf) >= TS_PACKET:
+            pkt = bytes(self.buf[:TS_PACKET])
+            if pkt[0] != 0x47:
+                del self.buf[0]
+                self.unsynced += 1
+                continue
+            del self.buf[:TS_PACKET]
+            self._packet(pkt)
+
+    def _packet(self, pkt):
+        self.packets += 1
+        pid = ((pkt[1] & 0x1F) << 8) | pkt[2]
+        self.pids[pid] = self.pids.get(pid, 0) + 1
+        pusi = bool(pkt[1] & 0x40)
+        afc = (pkt[3] >> 4) & 0x3
+        cc = pkt[3] & 0x0F
+
+        # Continuity counter only advances on packets that carry payload.
+        if afc in (1, 3):
+            prev = self.cc.get(pid)
+            if prev is not None and cc != (prev + 1) % 16:
+                self.cc_errors += 1
+            self.cc[pid] = cc
+        payload = 4
+        if afc in (2, 3):
+            af_len = pkt[4]
+            if afc == 2:
+                payload = TS_PACKET
+            else:
+                payload = 5 + af_len
+            if af_len > 0 and len(pkt) > 5 and (pkt[5] & 0x40):
+                self.rai += 1
+        if afc in (1, 3) and payload < TS_PACKET:
+            if pid == 0 and pusi:
+                self.pat_seen += 1
+                self._parse_pat(pkt[payload:])
+            elif pid in self.pmt_pids and pusi:
+                self._parse_pmt(pkt[payload:])
+
+    def _section(self, data):
+        if not data:
+            return None
+        ptr = data[0]
+        body = data[1 + ptr:]
+        if len(body) < 3:
+            return None
+        length = ((body[1] & 0x0F) << 8) | body[2]
+        if len(body) < 3 + length:
+            return None          # spans packets; the next copy will do
+        return body[:3 + length]
+
+    def _parse_pat(self, data):
+        sec = self._section(data)
+        if not sec or sec[0] != 0x00:
+            return
+        # header 8 bytes, then 4-byte entries, then 4-byte CRC
+        body = sec[8:-4]
+        for i in range(0, len(body) - 3, 4):
+            prog = (body[i] << 8) | body[i + 1]
+            pid = ((body[i + 2] & 0x1F) << 8) | body[i + 3]
+            if prog != 0:
+                self.pmt_pids.add(pid)
+
+    def _parse_pmt(self, data):
+        sec = self._section(data)
+        if not sec or sec[0] != 0x02:
+            return
+        if len(sec) < 12:
+            return
+        info_len = ((sec[10] & 0x0F) << 8) | sec[11]
+        i = 12 + info_len
+        end = len(sec) - 4
+        while i + 4 < end:
+            stype = sec[i]
+            epid = ((sec[i + 1] & 0x1F) << 8) | sec[i + 2]
+            es_len = ((sec[i + 3] & 0x0F) << 8) | sec[i + 4]
+            self.streams[epid] = stype
+            i += 5 + es_len
+
+    def report(self):
+        span = 0.0
+        if self.first_byte_at and self.last_byte_at:
+            span = self.last_byte_at - self.first_byte_at
+        return {
+            'bytes': self.bytes,
+            'ts_packets': self.packets,
+            'seconds': round(span, 2),
+            'megabits_per_sec': round(self.bytes * 8 / span / 1e6, 2)
+            if span > 0.5 else None,
+            'discarded_unsynced_bytes': self.unsynced,
+            'continuity_errors': self.cc_errors,
+            'random_access_points': self.rai,
+            'pat_sections': self.pat_seen,
+            'pids': dict(sorted(self.pids.items())),
+            'elementary_streams': {
+                pid: STREAM_TYPES.get(t, 'type 0x%02X' % t)
+                for pid, t in sorted(self.streams.items())},
+        }
+
+    def verdict(self, want_seconds):
+        """(ok, [problems]) -- what a human would call a working stream."""
+        bad = []
+        if self.packets == 0:
+            bad.append('no MPEG-TS packets arrived at all')
+            return False, bad
+        if self.pat_seen == 0:
+            bad.append('no PAT: a viewer cannot discover the video PID')
+        if not self.streams:
+            bad.append('no PMT: no elementary streams declared')
+        if self.rai == 0:
+            bad.append('no random-access point: a late viewer has no '
+                       'anchor to start from')
+        if self.cc_errors:
+            bad.append('%d continuity errors (packet loss or interleaving)'
+                       % self.cc_errors)
+        if self.unsynced:
+            bad.append('%d bytes discarded resyncing' % self.unsynced)
+        span = (self.last_byte_at - self.first_byte_at) if self.first_byte_at \
+            else 0
+        if want_seconds and span < want_seconds * 0.5:
+            bad.append('stream stopped after %.1fs of %ds requested'
+                       % (span, want_seconds))
+        return (not bad), bad
+
+
+def cmd_view(a):
+    an = TSAnalyser()
+    out = open(a.save, 'wb') if a.save else None
+
+    def sink(data):
+        an.feed(data)
+        if out:
+            out.write(data)
+
+    log('viewing %s://%s:%d%s (%s) for %ds'
+        % (a.via, a.host, a.port, a.path if a.via != 'tcp' else '',
+           'token' if a.token else ('password' if a.viewer_pass else
+                                    'no credential'),
+           a.duration))
+    reader = {'http': http_view, 'tcp': tcp_view, 'ws': ws_view}[a.via]
+    deadline = time.time() + a.duration
+    try:
+        reader(a, sink, deadline)
+    except ViewError as e:
+        if out:
+            out.close()
+        die(str(e), 1)
+    except (socket.timeout, ConnectionRefusedError, OSError) as e:
+        if out:
+            out.close()
+        die('%s://%s:%d: %s' % (a.via, a.host, a.port, e), 1)
+    finally:
+        if out:
+            out.close()
+            log('wrote %s' % a.save)
+
+    rep = an.report()
+    if a.json:
+        print(json.dumps(rep, indent=2))
+    else:
+        _print_report(rep)
+    ok, problems = an.verdict(a.duration)
+    for p in problems:
+        log('  ! %s' % p)
+    return 0 if ok else 1
+
+
+def _print_report(rep):
+    print('bytes            %d' % rep['bytes'])
+    print('TS packets       %d' % rep['ts_packets'])
+    print('duration         %ss' % rep['seconds'])
+    if rep['megabits_per_sec'] is not None:
+        print('rate             %s Mbit/s' % rep['megabits_per_sec'])
+    print('PAT sections     %d' % rep['pat_sections'])
+    print('random access    %d' % rep['random_access_points'])
+    print('continuity errs  %d' % rep['continuity_errors'])
+    print('resync discards  %d' % rep['discarded_unsynced_bytes'])
+    if rep['elementary_streams']:
+        print('streams')
+        for pid, name in rep['elementary_streams'].items():
+            print('  PID %-5d %s' % (pid, name))
+    else:
+        print('streams          (none declared)')
+
+
+# ----------------------------------------------------------------- check
+
+def cmd_check(a):
+    """Publish and view at once, then say whether it worked."""
+    encoder = pick_encoder(a.encoder, a.transport)
+
+    # The publisher has to outlive the viewer: the viewer only starts
+    # after --settle, so publishing for exactly --duration would cut the
+    # stream off early and be reported as "stream stopped".
+    view_seconds = a.duration
+    pub_args = argparse.Namespace(**vars(a))
+    pub_args.duration = int(a.duration + a.settle + 2) if a.duration else 0
+
+    cmd = (ffmpeg_publish_cmd(pub_args) if encoder == 'ffmpeg'
+           else gst_publish_cmd(pub_args))
+    if a.verbose:
+        log('  $ %s' % ' '.join(_shquote(c) for c in cmd))
+
+    log('publishing to %s (%s, %s)' % (publish_url(a), a.codec, encoder))
+    pub = _spawn(cmd, stdout=subprocess.DEVNULL,
+                 stderr=(None if a.verbose else subprocess.DEVNULL))
+    result = {}
+
+    def run_view():
+        try:
+            result['rc'] = cmd_view(a)
+        except SystemExit as e:
+            result['rc'] = e.code
+
+    try:
+        # Give the publisher a moment to be admitted and start a GOP,
+        # otherwise the viewer arrives before there is any anchor to
+        # join at and reports a stream that is in fact fine.
+        time.sleep(a.settle)
+        if pub.poll() is not None:
+            die('publisher exited immediately (rc=%d); re-run with '
+                '--verbose to see why' % pub.returncode, 1)
+        t = threading.Thread(target=run_view)
+        t.start()
+        t.join()
+    finally:
+        _reap(pub)
+
+    rc = result.get('rc', 1)
+    log('RESULT: %s' % ('PASS' if rc == 0 else 'FAIL'))
+    return rc
+
+
+def cmd_caps(a):
+    caps = capabilities()
+    if a.json:
+        print(json.dumps(caps, indent=2))
+        return 0
+    for k, v in caps.items():
+        print('%-22s %s' % (k, 'yes' if v else 'NO'))
+    print()
+    print('publish transports: udp (MPEG-TS), rtsp')
+    print('                    SRT is not implemented in the proxy yet')
+    print('view transports:    http, tcp (raw), ws')
+    return 0
+
+
+# ------------------------------------------------------------------ main
+
+def add_common(p):
+    p.add_argument('--host', default='127.0.0.1',
+                   help='proxy host (default 127.0.0.1)')
+    p.add_argument('--port', type=int, required=True,
+                   help='the entry\'s video port')
+    p.add_argument('-v', '--verbose', action='store_true')
+
+
+def add_publish_opts(p):
+    p.add_argument('--transport', choices=['udp', 'rtsp'], default='udp',
+                   help='udp = MPEG-TS datagrams (cannot carry a password); '
+                        'rtsp = publish over RTSP (can)')
+    p.add_argument('--publish-pass', default='',
+                   help='publish password, RTSP only -- it rides in the '
+                        'request-line query as ?pw=')
+    p.add_argument('--rtsp-path', default='cam',
+                   help='RTSP path (cosmetic; the port selects the slot)')
+    p.add_argument('--codec', choices=['h264', 'hevc'], default='h264',
+                   help='h264 plays in a browser; hevc does not')
+    p.add_argument('--size', default='1280x720')
+    p.add_argument('--fps', type=int, default=25)
+    p.add_argument('--bitrate', default='2M')
+    p.add_argument('--gop-seconds', type=int, default=2,
+                   help='keyframe interval; a late viewer waits up to this '
+                        'long for an anchor (default 2)')
+    p.add_argument('--audio', action='store_true',
+                   help='include an AAC tone (off by default, like the '
+                        'proxy)')
+    p.add_argument('--duration', type=int, default=0,
+                   help='seconds to publish, 0 = until interrupted')
+    p.add_argument('--encoder', choices=['auto', 'ffmpeg', 'gst'],
+                   default='auto')
+    p.add_argument('--label', default='',
+                   help='extra text to burn into the frame, e.g. which '
+                        'host is sending')
+    p.add_argument('--font-size', type=int, default=0,
+                   help='0 = scale to the frame height (default)')
+    p.add_argument('--loglevel', default='warning',
+                   help='ffmpeg -loglevel (default warning)')
+    p.add_argument('--dry-run', action='store_true',
+                   help='print the encoder command and exit')
+
+
+def add_view_opts(p):
+    p.add_argument('--via', choices=['http', 'tcp', 'ws'], default='http')
+    p.add_argument('--path', default='/stream.ts',
+                   help='/stream.ts and / always work; /v1.ts../v3.ts name '
+                        'a slot explicitly')
+    p.add_argument('--viewer-pass', default='')
+    p.add_argument('--token', default='',
+                   help='short-lived HMAC token from the web admin video '
+                        'page; preferred over --viewer-pass')
+    p.add_argument('--save', default='',
+                   help='also write the received stream to this file')
+    p.add_argument('--json', action='store_true')
+    p.add_argument('--connect-timeout', type=float, default=10.0)
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(
+        description=__doc__,
+        formatter_class=argparse.RawDescriptionHelpFormatter)
+    sub = ap.add_subparsers(dest='cmd', required=True)
+
+    p = sub.add_parser('publish', help='send a test pattern to a video port')
+    add_common(p)
+    add_publish_opts(p)
+    p.set_defaults(func=cmd_publish)
+
+    p = sub.add_parser('view', help='pull a stream back and report on it')
+    add_common(p)
+    add_view_opts(p)
+    p.add_argument('--duration', type=int, default=10,
+                   help='seconds to watch (default 10)')
+    p.set_defaults(func=cmd_view)
+
+    p = sub.add_parser('check', help='publish and view together, pass/fail')
+    add_common(p)
+    add_publish_opts(p)
+    add_view_opts(p)
+    p.add_argument('--settle', type=float, default=3.0,
+                   help='seconds to let the publisher establish before '
+                        'the viewer joins (default 3)')
+    p.set_defaults(func=cmd_check)
+
+    p = sub.add_parser('caps', help='what this machine can generate')
+    p.add_argument('--json', action='store_true')
+    p.set_defaults(func=cmd_caps)
+
+    a = ap.parse_args(argv)
+    # 'check' takes both option sets; its --duration comes from the view
+    # side and doubles as how long to publish.
+    if a.cmd == 'check' and not a.duration:
+        a.duration = 10
+    return a.func(a)
+
+
+if __name__ == '__main__':
+    try:
+        sys.exit(main())
+    except KeyboardInterrupt:
+        sys.exit(130)
diff --git a/tests/test_video_testtool.py b/tests/test_video_testtool.py
new file mode 100644
index 0000000..8935d24
--- /dev/null
+++ b/tests/test_video_testtool.py
@@ -0,0 +1,362 @@
+"""scripts/test_video.py -- the test-pattern publisher and stream checker.
+
+The tool exists to tell a human whether a video port works, so the thing
+worth guarding is that it can still say "no". A checker that always
+passes is worse than no checker. The encoder command construction is
+covered without invoking ffmpeg or gstreamer; the full round trip is
+covered by one end-to-end case behind the same markers as the other
+video tests.
+"""
+import argparse
+import os
+import shlex
+import shutil
+import subprocess
+import sys
+import time
+
+import pytest
+
+_REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+sys.path.insert(0, os.path.join(_REPO_ROOT, 'scripts'))
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import test_video as tv                                    # noqa: E402
+import keydb_lib                                           # noqa: E402
+from test_video_child import (Proxy, _Mav, _make_workdir,   # noqa: E402
+                              _port_bound, VPORT, PORT_ENG)
+
+TOOL = os.path.join(_REPO_ROOT, 'scripts', 'test_video.py')
+
+
+def _args(**over):
+    base = dict(host='127.0.0.1', port=40001, transport='udp',
+                publish_pass='', rtsp_path='cam', codec='h264',
+                size='1280x720', fps=25, bitrate='2M', gop_seconds=2,
+                audio=False, duration=0, encoder='ffmpeg', label='',
+                font_size=0, loglevel='warning', dry_run=False,
+                verbose=False)
+    base.update(over)
+    return argparse.Namespace(**base)
+
+
+class TestPublishUrl:
+    def test_udp_uses_seven_packet_datagrams(self):
+        """A datagram that splits a TS packet across two is rejected by
+        the proxy, so pkt_size is not decoration."""
+        url = tv.publish_url(_args(transport='udp'))
+        assert url == 'udp://127.0.0.1:40001?pkt_size=1316'
+        assert 1316 % 188 == 0
+
+    def test_rtsp_carries_the_publish_password_in_the_query(self):
+        """The request-line query is the only place RTSP can carry a
+        credential without the proxy parsing the session."""
+        url = tv.publish_url(_args(transport='rtsp', publish_pass='s3cret'))
+        assert url == 'rtsp://127.0.0.1:40001/cam?pw=s3cret'
+
+    def test_rtsp_without_a_password_has_no_query(self):
+        url = tv.publish_url(_args(transport='rtsp'))
+        assert '?' not in url
+
+
+# Anything that shells out to the tool needs a usable encoder; the tool
+# exits 2 without one. Skip rather than fail, so the suite is honest on a
+# machine that has no ffmpeg -- CI installs it (scripts/setup_ci.sh) so
+# these do run there.
+needs_encoder = pytest.mark.skipif(
+    shutil.which('ffmpeg') is None and shutil.which('gst-launch-1.0') is None,
+    reason='needs ffmpeg or gstreamer')
+
+
+class TestFfmpegCommand:
+    """Pure command construction -- no encoder needs to exist.
+
+    ffmpeg_publish_cmd() probes the local binary to decide whether it can
+    use drawtext, so without that stub these assert on a command built
+    for a machine with no ffmpeg, and -vf is simply absent.
+    """
+
+    @pytest.fixture(autouse=True)
+    def _with_drawtext(self, monkeypatch):
+        monkeypatch.setattr(tv, 'ffmpeg_has_filter', lambda name: True)
+
+    def test_drawtext_colon_is_escaped_inside_quotes(self):
+        """Measured behaviour: the value needs BOTH the surrounding
+        single quotes and a backslash on the colon. Either alone still
+        splits the filter argument and ffmpeg refuses the graph."""
+        cmd = tv.ffmpeg_publish_cmd(_args())
+        vf = cmd[cmd.index('-vf') + 1]
+        assert "text='" in vf
+        assert r'%{pts\:hms}' in vf
+        assert r'%{pts\\:hms}' not in vf, 'double-escaped: prints a backslash'
+
+    def test_x_is_clamped_so_wide_text_is_not_clipped_both_ends(self):
+        cmd = tv.ffmpeg_publish_cmd(_args(size='320x180'))
+        vf = cmd[cmd.index('-vf') + 1]
+        assert 'max(0' in vf
+
+    def test_font_scales_with_frame_height(self):
+        small = tv._font_size(_args(size='320x180'))
+        big = tv._font_size(_args(size='1920x1080'))
+        assert small < big
+        assert small >= 12, 'must stay legible on a small frame'
+
+    def test_explicit_font_size_wins(self):
+        assert tv._font_size(_args(size='320x180', font_size=40)) == 40
+
+    def test_label_apostrophe_is_dropped_not_left_to_break_the_graph(self):
+        cmd = tv.ffmpeg_publish_cmd(_args(label="tridge's laptop"))
+        vf = cmd[cmd.index('-vf') + 1]
+        assert 'tridges laptop' in vf
+
+    def test_audio_off_by_default_matching_the_proxy(self):
+        assert '-an' in tv.ffmpeg_publish_cmd(_args())
+        assert '-an' not in tv.ffmpeg_publish_cmd(_args(audio=True))
+
+    def test_hevc_selects_the_right_encoder(self):
+        assert 'libx265' in tv.ffmpeg_publish_cmd(_args(codec='hevc'))
+
+    def test_keyframe_interval_follows_gop_seconds(self):
+        cmd = tv.ffmpeg_publish_cmd(_args(fps=30, gop_seconds=2))
+        assert cmd[cmd.index('-g') + 1] == '60'
+
+
+class TestGstCommand:
+    def test_each_word_is_its_own_argument(self):
+        """gst-launch takes every argv element as one pipeline token and
+        does NOT split on spaces, so 'videotestsrc is-live=true' passed
+        as a single argument is a syntax error."""
+        argv = tv.gst_publish_cmd(_args(encoder='gst'))
+        assert 'videotestsrc' in argv
+        assert not any(a.startswith('videotestsrc ') for a in argv)
+
+    def test_separators_are_present(self):
+        argv = tv.gst_publish_cmd(_args(encoder='gst'))
+        assert argv.count('!') >= 6
+
+    def test_quoted_font_stays_one_argument(self):
+        argv = tv.gst_publish_cmd(_args(encoder='gst', font_size=18))
+        assert 'font-desc=Sans 18' in argv
+
+    def test_alignment_7_for_udp(self):
+        """mpegtsmux must emit 7-packet groups to match the datagram."""
+        argv = tv.gst_publish_cmd(_args(encoder='gst'))
+        assert 'alignment=7' in argv
+
+    def test_duration_bounds_the_source(self):
+        argv = tv.gst_publish_cmd(_args(encoder='gst', duration=4, fps=25))
+        assert 'num-buffers=100' in argv
+
+
+class TestKbits:
+    @pytest.mark.parametrize('spec,want', [
+        ('2M', 2000), ('2000k', 2000), ('500k', 500), ('2000000', 2000)])
+    def test_conversion(self, spec, want):
+        assert tv._kbits(spec) == want
+
+
+class TestAnalyser:
+    """The analyser is what turns "bytes arrived" into "a stream
+    arrived", so its refusals matter more than its acceptances."""
+
+    def test_empty_input_is_not_a_stream(self):
+        an = tv.TSAnalyser()
+        ok, problems = an.verdict(0)
+        assert not ok
+        assert 'no MPEG-TS packets' in problems[0]
+
+    def test_garbage_is_not_a_stream(self):
+        an = tv.TSAnalyser()
+        an.feed(b'\xde\xad\xbe\xef' * 1000)
+        ok, _ = an.verdict(0)
+        assert not ok
+
+    def test_real_stream_is_accepted(self):
+        import tsgen
+        g = tsgen.TSGen()
+        an = tv.TSAnalyser()
+        for dgram in g.datagrams(g.stream(400)):
+            an.feed(dgram)
+        ok, problems = an.verdict(0)
+        assert ok, problems
+        rep = an.report()
+        assert rep['pat_sections'] > 0
+        assert rep['random_access_points'] > 0
+        assert rep['continuity_errors'] == 0
+
+    def test_resyncs_after_leading_junk(self):
+        """A viewer that joins mid-packet must not be reported as a
+        broken stream -- it should resync and say how much it dropped."""
+        import tsgen
+        g = tsgen.TSGen()
+        an = tv.TSAnalyser()
+        an.feed(b'\x00' * 37)
+        for dgram in g.datagrams(g.stream(400)):
+            an.feed(dgram)
+        assert an.packets > 0
+        assert an.unsynced == 37
+
+    def test_missing_pat_is_reported(self):
+        an = tv.TSAnalyser()
+        # 188-byte packets on a non-zero PID: syntactically fine, but a
+        # viewer could never find the video.
+        pkt = bytes([0x47, 0x01, 0x00, 0x10]) + b'\xff' * 184
+        an.feed(pkt * 50)
+        ok, problems = an.verdict(0)
+        assert not ok
+        assert any('PAT' in p for p in problems)
+
+
+class TestCli:
+    def test_caps_runs(self):
+        r = subprocess.run([sys.executable, TOOL, 'caps', '--json'],
+                           capture_output=True, text=True, timeout=60)
+        assert r.returncode == 0
+        import json
+        assert 'ffmpeg' in json.loads(r.stdout)
+
+    @needs_encoder
+    def test_dry_run_emits_a_runnable_command(self):
+        r = subprocess.run([sys.executable, TOOL, 'publish', '--port',
+                            '40001', '--dry-run'],
+                           capture_output=True, text=True, timeout=60)
+        assert r.returncode == 0
+        argv = shlex.split(r.stdout.strip())
+        assert argv[0] in ('ffmpeg', 'gst-launch-1.0')
+
+    def test_port_is_required(self):
+        r = subprocess.run([sys.executable, TOOL, 'publish'],
+                           capture_output=True, text=True, timeout=60)
+        assert r.returncode != 0
+
+
+@pytest.mark.slow
+@needs_encoder
+class TestEndToEnd:
+    """One real round trip: test pattern -> proxy -> viewer -> verdict."""
+
+    def _proxy(self, tmp_path, **kw):
+        wd = _make_workdir(tmp_path, **kw)
+        return wd, Proxy(wd)
+
+    def _wait_bound(self):
+        for _ in range(100):
+            if _port_bound(VPORT):
+                return True
+            time.sleep(0.1)
+        return False
+
+    def _check(self, *extra):
+        return subprocess.run(
+            [sys.executable, TOOL, 'check', '--host', '127.0.0.1',
+             '--port', str(VPORT), '--size', '320x180', '--duration', '4',
+             '--settle', '3'] + list(extra),
+            capture_output=True, text=True, timeout=120)
+
+    def test_publish_and_view_round_trip(self, tmp_path):
+        if not os.path.exists(os.path.join(_REPO_ROOT, 'supportproxy')):
+            pytest.skip('supportproxy not built')
+        wd, px = self._proxy(tmp_path)
+        try:
+            assert self._wait_bound()
+            _Mav()                      # latch conn1 from 127.0.0.1
+            time.sleep(1.5)
+            r = self._check()
+            assert r.returncode == 0, r.stdout + r.stderr
+            assert 'H.264' in r.stdout
+        finally:
+            px.proc.terminate()
+
+    def _with_viewer_pass(self, tmp_path, pw):
+        wd, px = self._proxy(tmp_path)
+        db = keydb_lib.open_db(str(wd / 'keys.tdb'))
+        db.transaction_start()
+        keydb_lib.set_video_viewer_pass(db, PORT_ENG, pw)
+        db.transaction_prepare_commit()
+        db.transaction_commit()
+        db.close()
+        return px
+
+    def test_the_wrong_viewer_password_fails(self, tmp_path):
+        """The guard that matters: a checker that cannot fail is
+        worthless. Each case gets its own proxy -- a publisher holds its
+        slot for 10s after going quiet, so a second run against the same
+        proxy would be refused as slot-busy and 'fail' for the wrong
+        reason."""
+        if not os.path.exists(os.path.join(_REPO_ROOT, 'supportproxy')):
+            pytest.skip('supportproxy not built')
+        px = self._with_viewer_pass(tmp_path, 'hunter2')
+        try:
+            assert self._wait_bound()
+            _Mav()
+            time.sleep(1.5)
+            assert self._check('--viewer-pass', 'wrong').returncode != 0
+        finally:
+            px.proc.terminate()
+
+    def test_the_right_viewer_password_passes(self, tmp_path):
+        if not os.path.exists(os.path.join(_REPO_ROOT, 'supportproxy')):
+            pytest.skip('supportproxy not built')
+        px = self._with_viewer_pass(tmp_path, 'hunter2')
+        try:
+            assert self._wait_bound()
+            _Mav()
+            time.sleep(1.5)
+            r = self._check('--viewer-pass', 'hunter2')
+            assert r.returncode == 0, r.stdout + r.stderr
+        finally:
+            px.proc.terminate()
+
+
+class TestNoOrphanPublisher:
+    """Killing the wrapper must take ffmpeg with it.
+
+    An orphaned publisher keeps sending, and because one publisher holds
+    a slot, it then refuses the *next* publisher as slot-busy. A leaked
+    test publisher quietly takes over a real video port -- which is
+    exactly what happened on the live server during this work.
+    """
+
+    def test_ffmpeg_dies_with_its_parent(self, tmp_path):
+        import shutil
+        if shutil.which('ffmpeg') is None:
+            pytest.skip('ffmpeg not installed')
+        # Publish to a port nothing is listening on: the publisher still
+        # runs, which is all this needs.
+        p = subprocess.Popen(
+            [sys.executable, TOOL, 'publish', '--host', '127.0.0.1',
+             '--port', '9', '--size', '128x72'],
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        try:
+            child = None
+            for _ in range(60):
+                time.sleep(0.2)
+                out = subprocess.run(['pgrep', '-P', str(p.pid), '-x', 'ffmpeg'],
+                                     capture_output=True, text=True).stdout
+                if out.strip():
+                    child = int(out.split()[0])
+                    break
+            assert child, 'ffmpeg never started'
+
+            p.kill()          # the worst case: no chance to clean up
+            p.wait()
+            for _ in range(50):
+                time.sleep(0.2)
+                if subprocess.run(['kill', '-0', str(child)],
+                                  capture_output=True).returncode != 0:
+                    return    # gone, as it should be
+            raise AssertionError('ffmpeg %d outlived its parent' % child)
+        finally:
+            if p.poll() is None:
+                p.kill()
+                p.wait()
+
+    def test_the_helper_is_wired_in(self):
+        """Both spawn sites must go through it, or one path leaks."""
+        src = open(TOOL).read()
+        assert 'PR_SET_PDEATHSIG' in src or 'prctl' in src
+        assert src.count('_spawn(') >= 3   # def + publish + check
+        assert 'subprocess.Popen(cmd)' not in src, \
+            'a raw Popen bypasses the death-signal helper'

From 03a1dbc14a0869dcdfb5b8a172b23771fedecf3b Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <andrew@tridgell.net>
Date: Fri, 7 Aug 2026 13:30:02 +1000
Subject: [PATCH 6/6] tests: wait for the port to listen, and count only our
 own ffmpeg

Three flakes, all of which only showed up once CI grew a video suite to
run alongside the rest. None was bad luck; each was a real race that an
idle machine happened to win.

Two tests connected as soon as the proxy logged "Added port". That line
is printed before the socket exists -- supportproxy.cpp prints it and
then calls open_sockets() -- so the connect was always racing the bind.
Wait for the port to reach LISTEN instead. Read from /proc rather than
probed with a connection: connecting to a user port latches conn1, so a
probe would consume the very thing the test is about to set up.

The orphaned-ffmpeg check counted every ffmpeg on the machine, so a
sibling xdist worker starting one between the two samples reported a
leak against a test that leaked nothing. Count our own children.
---
 tests/conftest.py                   | 33 +++++++++++++++++++++++++
 tests/test_ws_handshake_ordering.py | 31 +++++++++++++++++++++++
 tests/webadmin/test_log_video.py    | 38 ++++++++++++++++++++++++-----
 3 files changed, 96 insertions(+), 6 deletions(-)

diff --git a/tests/conftest.py b/tests/conftest.py
index 34c45a9..4a0b7c8 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -84,6 +84,33 @@ def terminate(self):
             self.proc.kill()
 
 
+def _wait_listening(ports, timeout=15.0):
+    """Block until every port is in LISTEN.
+
+    Read from /proc rather than probed with a connection: connecting to
+    a user port latches conn1, which would consume the very thing the
+    test is about to set up.
+    """
+    want = {'%04X' % p for p in ports}
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        listening = set()
+        try:
+            with open('/proc/net/tcp') as f:
+                next(f)
+                for line in f:
+                    fields = line.split()
+                    if fields[3] == '0A':            # LISTEN
+                        listening.add(fields[1].split(':')[1].upper())
+        except OSError:
+            pass
+        if want <= listening:
+            return
+        time.sleep(0.05)
+    raise RuntimeError('SupportProxy never listened on %s'
+                       % sorted(ports))
+
+
 @pytest.fixture(scope="session", autouse=True)
 def _worker_cwd(tmp_path_factory):
     """Each xdist worker runs in its own tmpdir so workers don't share a
@@ -165,6 +192,12 @@ def test_server(_worker_cwd):
                 markers[m] = True
                 print(f"DEBUG: SupportProxy loaded {m.replace('Added port ', '')}")
         if all(markers.values()):
+            # The marker is printed before the socket is bound
+            # (supportproxy.cpp prints "Added port" and then calls
+            # open_sockets), so a test that connects on the strength of
+            # it alone is racing. Harmless on an idle machine, and it
+            # starts losing when the runner is busy.
+            _wait_listening([port1, port2, port1_b, port2_b])
             print("DEBUG: SupportProxy ready for testing!")
             break
     else:
diff --git a/tests/test_ws_handshake_ordering.py b/tests/test_ws_handshake_ordering.py
index b5c4bc1..473ef66 100644
--- a/tests/test_ws_handshake_ordering.py
+++ b/tests/test_ws_handshake_ordering.py
@@ -82,9 +82,40 @@ def _drain():
         proc.kill()
         proc.wait(timeout=2)
         raise RuntimeError('proxy did not load test port pair')
+    _wait_accepting(PORT_USER)
     return proc
 
 
+def _wait_accepting(port, timeout=10.0):
+    """Block until `port` is in LISTEN.
+
+    The readiness line only says the parent has the pair in its table;
+    the listening socket is not necessarily up yet. Connecting on the
+    strength of the log line alone is a race that stays hidden on an
+    idle machine and starts losing when the runner is busy -- which is
+    what it did once CI grew a video suite to run alongside.
+
+    Read from /proc rather than probed with a connection: a connection
+    to the user port latches conn1, so probing would consume the very
+    thing the test is about to set up.
+    """
+    want = '%04X' % port
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        try:
+            with open('/proc/net/tcp') as f:
+                next(f)
+                for line in f:
+                    fields = line.split()
+                    if (fields[1].split(':')[1].upper() == want
+                            and fields[3] == '0A'):      # LISTEN
+                        return
+        except OSError:
+            pass
+        time.sleep(0.05)
+    raise RuntimeError('proxy never listened on port %d' % port)
+
+
 def _terminate(proc):
     proc.send_signal(signal.SIGTERM)
     try:
diff --git a/tests/webadmin/test_log_video.py b/tests/webadmin/test_log_video.py
index fcd9e1d..0f5a18a 100644
--- a/tests/webadmin/test_log_video.py
+++ b/tests/webadmin/test_log_video.py
@@ -86,6 +86,35 @@ def _seed_real_ts(app, port2):
     return root
 
 
+def _our_ffmpeg_count():
+    """ffmpeg processes this test process started.
+
+    Counting every ffmpeg on the machine made this fail whenever a
+    sibling xdist worker happened to start one between the two samples
+    -- a leak reported against a test that leaked nothing. The remux
+    spawns its ffmpeg as our direct child, so that is what to count.
+    """
+    mine = 0
+    us = os.getpid()
+    for name in os.listdir('/proc'):
+        if not name.isdigit():
+            continue
+        pid = int(name)
+        try:
+            with open('/proc/%d/comm' % pid) as f:
+                if f.read().strip() != 'ffmpeg':
+                    continue
+            with open('/proc/%d/status' % pid) as f:
+                for line in f:
+                    if line.startswith('PPid:'):
+                        if int(line.split()[1]) == us:
+                            mine += 1
+                        break
+        except (OSError, ValueError):
+            continue
+    return mine
+
+
 def _enable_video(keydb_path, port2, ports=(VPORT, 0, 0)):
     db = keydb_lib.open_db(keydb_path)
     db.transaction_start()
@@ -352,16 +381,13 @@ def test_no_ffmpeg_left_running_afterwards(self, client, app,
         """The generator kills ffmpeg in a finally, so a client that
         disconnects mid-stream cannot leak one."""
         self._skip_without_ffmpeg()
-        import subprocess as sp
         _seed_real_ts(app, ALICE_PORT2)
         login_as(client, BOB_PORT1, BOB_PASS)
-        before = sp.run(['pgrep', '-c', '-x', 'ffmpeg'],
-                        capture_output=True, text=True).stdout.strip() or '0'
+        before = _our_ffmpeg_count()
         r = client.get('/admin/logs/%d/%s/%s/play.mp4'
                        % (ALICE_PORT2, DATE, VIDEO))
         r.get_data()
         r.close()
         time.sleep(0.5)
-        after = sp.run(['pgrep', '-c', '-x', 'ffmpeg'],
-                       capture_output=True, text=True).stdout.strip() or '0'
-        assert int(after) <= int(before)
+        after = _our_ffmpeg_count()
+        assert after <= before