If the erase+reopen recovery also fails (e.g. missing/mislabeled NVS
partition), nvs_handle stays 0. Report that state explicitly instead of
claiming NVS was erased.
Stash the err code in a static and emit ESP_LOGW lazily from the first
make_preference() call (which runs after Logger::pre_setup() at
EARLY_INIT priority), so the diagnostic stays visible without
dereferencing global_logger before it is set.
libc++ eagerly instantiates the unique_ptr<APIConnection> destructor
when std::array<std::unique_ptr<APIConnection>, N> is parsed, requiring
sizeof(APIConnection). api_server.h only forward-declares APIConnection
(via list_entities.h), so the destructor instantiation fails for any
translation unit that includes api_server.h without also including
api_connection.h first.
Wrap the unique_ptr in a custom deleter (APIConnectionDeleter) whose
operator() is defined out-of-line in api_server.cpp where APIConnection
is complete. The default_delete<APIConnection> path is never
instantiated, so libc++'s incomplete-type assertion is avoided.
GCC/libstdc++ already deferred this instantiation, so this only affects
macOS host-platform builds (used by integration tests).
Address two issues on the new data-loop timeout:
- clang-tidy ESP32 Arduino flagged "cannot jump from this goto statement to its label" at the existing pre-loop `goto error` sites because the new `uint32_t last_data_ms = millis();` declaration sat between them and the `error:` label, so the jumps would skip past its initialization. Move the declaration up next to the other handle_data_ locals (`total`, `last_progress`) and just assign it before the loop entry. The earlier gotos no longer cross an init.
- Copilot pointed out the new timeout `goto error` left `error_code` at `OTA_RESPONSE_OK` (set by `backend_->begin()`), so the device would write OK back to the uploader even though it was aborting. Set `error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN` before the goto so the uploader receives a correct failure code.
The main `while (total < ota_size)` loop in `ESPHomeOTAComponent::handle_data_()`
had a `// TODO: timeout check` and no wall-clock guard. If the uploader
side dropped the TCP connection without a FIN/RST being delivered to
the device (uploader process killed mid-transfer, NAT/router state
dropped, packet loss eating the RST), `recv_fn` would never see a
close and `s_err_fn` would never fire, so:
- `pcb_` stays non-null
- `rx_closed_` stays false
- `waiting_for_data_()` stays true forever
- the loop spins on `EWOULDBLOCK`, fed by `App.feed_wdt(); continue;`,
indefinitely
LwIP TCP keepalive is not enabled on the OTA socket, and even when
enabled the default keepalive timer is on the order of hours, so the
device is effectively unresponsive until power cycle. This matches
the "device unresponsive until I do a hard power-reset" symptom in
issue #15953.
Track the timestamp of the last successful read and abort if no data
arrives for `OTA_SOCKET_TIMEOUT_DATA` (90s, same constant the handshake,
`readall_()`, and `writeall_()` already use). The timeout resets on
every successful read so a slow but live link does not false-trigger.
J. Nick Koston