Keep the RTSPS proxy's handler set off the server object (issue #3001)

asyncio's Server has a __dict__ and uvloop's, a Cython cdef class, does
not, so the attribute added in 1.2.5.4 raised AttributeError under uvloop.
Every RTSP camera failed before opening a socket, which is the
diagnostic's capture_exception at 0 ms.

Our own unit files all pin --loop asyncio for #1896 and were never
affected. The reports come from units we do not write: the Proxmox VE
Helper-Scripts LXC pins no loop, and installs predating that fix never
gained the flag because update.sh does not rewrite unit files. The loop
is not ours to assume, so fix the code rather than add another flag.

The set moves to a module-level WeakKeyDictionary, keyed weakly so an
abandoned proxy retires its own entry rather than leaking one and later
handing a new server a dead one's handlers.

Pinned on a real uvloop loop and, for hosts without uvloop, against a
__slots__ server; conftest builds its loop from the default policy, so
nothing in the suite had ever run the branch that broke.

Also routes the two external-camera teardowns through close_tls_proxy,
which #2968 introduced and left them out of.

-----

Say so at startup when running on uvloop (issue #3001)

An install on the wrong loop had no way to find out it was. #3001 was
loud enough to notice; the #1896 upload truncation it is also exposed to
is silent, and shows up as a print failing from a file that was corrupt
on arrival.

One WARNING in the lifespan naming the loop, the risk and the flag to
add. A warning and not a refusal: uvicorn has already chosen its loop by
the time any application code runs, and a server that answers requests
beats one that will not boot.

Asks the running loop what it is rather than whether uvloop imports --
uvicorn[standard] installs uvloop everywhere, so its presence says
nothing -- and matches on the module name so the question never imports
uvloop on a host without it.

-----

Repair a service file written before the --loop asyncio pin (issue #3001)

install.sh has pinned the loop since #1896, but nothing has ever
rewritten an existing service file, so every native install created
between 2025-11-28 (when uvicorn[standard] brought uvloop into the venv)
and 2026-07-05 still runs on uvloop no matter how often it is updated.

Both update scripts now add the flag themselves while the service is
stopped, so it takes effect on the same restart -- systemd via sed,
launchd via PlistBuddy, each backing the file up first and inserting
nothing but the flag.

Refuses to edit and explains instead when the shape is not a plain
single-line uvicorn unit: a wrapper script, a continued ExecStart,
several of them, a read-only file, or a service with drop-ins, since a
drop-in may be what defines ExecStart and editing the fragment would
change nothing while reporting success. A deliberate --loop uvloop is
left alone. Reads the effective ExecStart from systemd rather than the
file, so it is idempotent.

install/update.sh

@@ -52,6 +52,87 @@ cleanup_old_backups() {
   log "Pruned old backups, kept newest $max_count file(s)"
 }
 
+# Restore the --loop asyncio pin on a unit file written before it existed (#3001).
+#
+# install.sh has pinned the loop since 2026-07-05 (#1896), but this script has
+# never rewritten a unit file, and nothing else does either -- so an install
+# created before that date still runs on uvloop today no matter how many times
+# it has been updated. uvloop has been in every native venv since
+# uvicorn[standard] landed on 2025-11-28, and uvicorn's --loop auto prefers it,
+# so that is a seven-month window of installs still on the wrong loop. It cost
+# them every RTSP camera on 1.2.5.4 (#3001), and before that it exposed them to
+# Virtual Printer FTP uploads being silently truncated (#1896). Neither is
+# discoverable from the outside, which is why this repairs rather than reports.
+#
+# Only ever inserts the one flag. Everything else in the unit -- hardening,
+# environment, ExecStartPre, a hand-edited port -- is left byte-identical, and
+# the file is copied aside first.
+repair_loop_flag() {
+  local fragment exec_line backup
+
+  # The effective ExecStart, so a drop-in that already pins the loop counts.
+  if systemctl show "$SERVICE_NAME" --property=ExecStart --value 2>/dev/null | grep -q -- '--loop'; then
+    return 0
+  fi
+
+  fragment="$(systemctl show "$SERVICE_NAME" --property=FragmentPath --value 2>/dev/null || true)"
+  if [ -z "$fragment" ] || [ ! -f "$fragment" ]; then
+    warn "Cannot locate the unit file for $SERVICE_NAME; not repairing the --loop flag."
+    return 0
+  fi
+
+  # A drop-in, not the fragment, may be what defines ExecStart. Editing the
+  # fragment would then change nothing while reporting success.
+  if [ -n "$(systemctl show "$SERVICE_NAME" --property=DropInPaths --value 2>/dev/null || true)" ]; then
+    warn "$SERVICE_NAME has systemd drop-ins; add '--loop asyncio' to its uvicorn command by hand. See #1896."
+    return 0
+  fi
+
+  # Anything but exactly one single-line uvicorn ExecStart is someone else's
+  # arrangement -- a wrapper script, a continuation, several ExecStart lines --
+  # and is described rather than edited.
+  if [ "$(grep -c '^ExecStart=' "$fragment")" -ne 1 ]; then
+    warn "$fragment has no single ExecStart line; add '--loop asyncio' to its uvicorn command by hand. See #1896."
+    return 0
+  fi
+  exec_line="$(grep '^ExecStart=' "$fragment")"
+  case "$exec_line" in
+    *uvicorn*) ;;
+    *)
+      warn "$fragment does not start uvicorn directly; add '--loop asyncio' to it by hand. See #1896."
+      return 0
+      ;;
+  esac
+  case "$exec_line" in
+    *\\)
+      warn "$fragment continues its ExecStart onto another line; add '--loop asyncio' by hand. See #1896."
+      return 0
+      ;;
+  esac
+  if [ ! -w "$fragment" ]; then
+    warn "$fragment is not writable; add '--loop asyncio' to its uvicorn command by hand. See #1896."
+    return 0
+  fi
+
+  backup="$fragment.bak-$(date +%Y%m%d-%H%M%S)"
+  cp -p "$fragment" "$backup" || {
+    warn "Could not back up $fragment; leaving it alone."
+    return 0
+  }
+
+  # Appended, not spliced: uvicorn accepts its options in any order after the
+  # app path, and appending cannot disturb a value already on the line.
+  if ! sed -i 's|^ExecStart=.*|& --loop asyncio|' "$fragment"; then
+    warn "Failed to edit $fragment; restoring from $backup."
+    cp -p "$backup" "$fragment" || true
+    return 0
+  fi
+
+  log "Added the missing '--loop asyncio' flag to $fragment (was written before #1896; backup at $backup)"
+  log "Without it Bambuddy runs on uvloop, which breaks RTSP cameras (#3001) and can truncate Virtual Printer FTP uploads (#1896)."
+  systemctl daemon-reload || warn "systemctl daemon-reload failed; the new flag applies after the next reload."
+}
+
 on_error() {
   local exit_code="$1"
 
@@ -227,6 +308,8 @@ else
   warn "Skipping frontend build (frontend/package.json not found)."
 fi
 
+repair_loop_flag
+
 log "Starting service: $SERVICE_NAME"
 systemctl start "$SERVICE_NAME"
 SERVICE_STOPPED=0

install/update_macos.sh

@@ -57,6 +57,54 @@ is_service_active() {
   launchctl list | grep -q "$SERVICE_NAME"
 }
 
+# Restore the --loop asyncio pin on a plist written before it existed (#3001).
+#
+# The macOS twin of the systemd repair in update.sh, and there for the same
+# reason: install.sh has pinned the loop since 2026-07-05 (#1896), this script
+# has never rewritten the plist, and nothing else does -- so an install created
+# before that date still launches on uvloop today. uvloop reaches macOS as
+# well, since uvicorn[standard] only excludes it on Windows. That costs every
+# RTSP camera (#3001) and risks silently truncated Virtual Printer FTP uploads
+# (#1896), neither of which is visible from outside the machine.
+#
+# PlistBuddy is used rather than sed because the plist is XML and
+# ProgramArguments is an array; appending the two strings is safe because
+# uvicorn accepts its options in any order after the app path.
+repair_loop_flag() {
+  local plistbuddy="/usr/libexec/PlistBuddy" backup
+
+  [ -f "$PLIST_PATH" ] || return 0
+  if grep -q -- '--loop' "$PLIST_PATH"; then
+    return 0
+  fi
+  if [ ! -x "$plistbuddy" ]; then
+    warn "PlistBuddy not found; add '--loop' and 'asyncio' to ProgramArguments in $PLIST_PATH by hand. See #1896."
+    return 0
+  fi
+  # A plist that does not invoke uvicorn directly is someone else's
+  # arrangement and is described rather than edited.
+  if ! grep -q 'uvicorn' "$PLIST_PATH"; then
+    warn "$PLIST_PATH does not start uvicorn directly; add '--loop asyncio' to it by hand. See #1896."
+    return 0
+  fi
+
+  backup="$PLIST_PATH.bak-$(date +%Y%m%d-%H%M%S)"
+  cp -p "$PLIST_PATH" "$backup" || {
+    warn "Could not back up $PLIST_PATH; leaving it alone."
+    return 0
+  }
+
+  if ! "$plistbuddy" -c 'Add :ProgramArguments: string --loop' \
+                     -c 'Add :ProgramArguments: string asyncio' "$PLIST_PATH" >/dev/null 2>&1; then
+    warn "Failed to edit $PLIST_PATH; restoring from $backup."
+    cp -p "$backup" "$PLIST_PATH" || true
+    return 0
+  fi
+
+  log "Added the missing '--loop asyncio' flag to $PLIST_PATH (was written before #1896; backup at $backup)"
+  log "Without it Bambuddy runs on uvloop, which breaks RTSP cameras (#3001) and can truncate Virtual Printer FTP uploads (#1896)."
+}
+
 on_error() {
   local exit_code="$1"
 
@@ -211,6 +259,8 @@ else
   warn "Skipping frontend build (frontend/package.json not found)."
 fi
 
+repair_loop_flag
+
 log "Starting service: $SERVICE_NAME"
 launchctl load "$PLIST_PATH"
 SERVICE_STOPPED=0