Nice work! Through efforts with Claude in the last few weeks, I have a working model of the actual wireless protocol between sensor and bridge, and have built a passive listener device to snoop on local traffic. I'm in the process of creating documentation for the protocol and would be happy to share what I've learned.

Shoot me an email at my username-at-gmail if you want to chat.

I did this with my Petlibro cat feeders. It was significantly easier: redirect the MQTT server to a relay. No TLS, no device key, user & password for device transmitted in plaintext. Needless to say, the devices are now blocked from the internet and managed with a local mosquito server.