[climate] Add StringRef overloads for ClimateCall::set_fan_mode and set_preset

Co-authored-by: J. Nick Koston <nick@home-assistant.io>
Co-authored-by: J. Nick Koston <nick@koston.org>

.agents/skills/display-test/SKILL.md

@@ -0,0 +1,156 @@
+---
+name: display-test
+description: Test an ESPHome display driver on a real panel with a camera. Use when a task asks to verify a display (LCD, e-paper, OLED, RLCD) on hardware, check orientation/rotation, partial updates, colours, contrast, or that text and shapes render correctly. Covers finding the USB port, flashing a test pattern, capturing the panel with any camera, and reading the photo.
+allowed-tools: Read, Write, Edit, Bash, Glob, Grep
+---
+
+# Display testing with a camera
+
+Point a camera at the panel to get visual evidence that a driver renders correctly. Any camera
+and capture tool works; this skill covers the common ones. `$SKILL` below is this directory
+(`.agents/skills/display-test`).
+
+## Ask before using a camera
+
+A camera can show people and rooms, not only the panel. Before the first capture, ask the user
+for permission and for which camera to use. List the cameras the host has (the commands below
+show how), name the one you intend to use, and wait for the user to confirm it. Do not pick a
+camera yourself, and do not fall back to another camera if the chosen one fails; ask again.
+
+The permission covers this session and the camera the user named. Ask again for a different
+camera or in a new session. If the user declines, stop and report that the display was not
+checked visually.
+
+## Capturing a frame
+
+Grab a still image, skipping the first few frames so auto-exposure and white balance settle.
+Read the JPEG with the Read tool; the image is shown visually.
+
+### macOS
+
+The bundled Swift tool uses AVFoundation and avoids the frame-grabbing problems some USB
+cameras have with other tools:
+
+```bash
+mkdir -p /tmp/camsnap /tmp/display-test
+swiftc -O "$SKILL/scripts/camsnap.swift" -o /tmp/camsnap/camsnap
+/tmp/camsnap/camsnap <camera-name-substring> /tmp/display-test/after.jpg 30
+```
+
+The camera argument is a case-insensitive substring of the name AVFoundation reports. If it does
+not match, the tool lists the cameras it found, so a run with a name that matches nothing lists
+the cameras without capturing. Use a substring that matches only the camera the user approved.
+It creates the output directory if needed and reports encoding or write errors on stderr. Other
+options include `ffmpeg` with `avfoundation` input, `imagesnap`, or Photo Booth's still capture.
+
+### Linux
+
+Use `ffmpeg` with the v4l2 input, `fswebcam`, or `v4l2-ctl`. With `ffmpeg`, `-ss 2` after the
+input discards the first two seconds of frames while exposure settles:
+
+```bash
+mkdir -p /tmp/display-test
+ffmpeg -f v4l2 -i /dev/video0 -ss 2 -frames:v 1 -y /tmp/display-test/after.jpg
+# or
+fswebcam -d /dev/video0 --skip 10 /tmp/display-test/after.jpg
+```
+
+List devices with `v4l2-ctl --list-devices`.
+
+### Windows
+
+Use `ffmpeg` with the DirectShow input (`-ss 2` skips the first frames, as on Linux), or any
+camera application that can save a still image:
+
+```powershell
+mkdir C:\temp -Force | Out-Null
+ffmpeg -f dshow -list_devices true -i dummy   # find the device name
+ffmpeg -f dshow -i video="<device name>" -ss 2 -frames:v 1 -y C:\temp\after.jpg
+```
+
+### Camera caveats
+
+- The board may sit at an angle. Do not trust absolute pixel positions or aspect ratios from the
+  photo; judge orientation, ordering and approximate spacing, using the corner markers as
+  references.
+- Reflections or a glossy cover can brighten one side. Capture again if a region is unclear.
+- A moving pattern is caught at an arbitrary phase. Take several captures, or use a static marker
+  per position.
+
+## Board and port
+
+Find the port; names change on every replug:
+
+```bash
+python3 "$SKILL/../hardware-test/scripts/ports.py"
+```
+
+Native-USB ESP32-S3/C3/C6/H2 boards show up as `USB JTAG/serial debug unit` and need
+`logger: hardware_uart: USB_SERIAL_JTAG`.
+
+## Test pattern
+
+Write a scratch config outside the checkout. Use one `name:` per board and include:
+
+- a white background, a black border and a filled square at the centre, drawn in the first
+  update (full-window check and scale);
+- a 60x20 bar near each corner, one bar per later update with `auto_clear_enabled: false`, so
+  each bar is written by its own partial window. The bars are wider than tall, which shows a
+  90 or 270 degree rotation; the corners exercise the window alignment;
+- a 20x20 square under the left end of the top-left bar, drawn in the same update, which marks
+  the top-left corner and shows a 180 degree rotation or a mirrored image.
+
+Use `Color::BLACK` and `Color::WHITE` in lambdas. Do not use the old `COLOR_OFF`/`COLOR_ON`
+constants; black must mean black.
+
+A ready template is in `$SKILL/templates/display-pattern.yaml`. Substitute the display platform,
+pins and (for a driver with fonts) a font. The marker pattern needs no font.
+
+## Build, flash, capture
+
+Run from the worktree under test so `python -m esphome` imports the checkout, not an installed
+copy:
+
+```bash
+cd <worktree>
+python3 -c "import esphome; print(esphome.__file__)"   # must print the worktree path
+PYTHONUNBUFFERED=1 python3 -m esphome compile /tmp/display-test/display-pattern.yaml
+PYTHONUNBUFFERED=1 python3 -m esphome upload /tmp/display-test/display-pattern.yaml \
+  --device /dev/cu.usbmodemXXXX
+sleep 6   # boot plus a few update intervals
+<capture command> /tmp/display-test/after.jpg
+```
+
+The device path differs by OS and host; use the path printed by `ports.py`. If the USB console
+wedges during flashing (esptool `No serial data received`), replug the board and retry. A board
+powered only by a battery may need the USB cable for flashing; the panel keeps its image when
+power is removed, which is useful for checking that an image is bistable.
+
+## What to check
+
+1. **Orientation**: the extra square sits under the bar in the expected top-left corner. If it is
+   in another corner, the image is rotated or mirrored. Test `rotation:` values with the same
+   pattern. The logical width and height swap at 90 and
+   270 degrees, so the 60x20 corner bars should then appear taller than wide on the physical
+   panel.
+2. **Coverage**: the border touches all four edges, with no dead rows or columns at the edges.
+3. **Partial updates**: with `auto_clear_enabled: false`, draw one marker per update. Each should
+   appear exactly at its requested position with no smearing, offset or mirrored placement.
+   Include all four corners.
+4. **Text and contrast**: sharp glyphs, correct polarity (black text on white, not inverted), no
+   ghosting from the previous frame.
+5. **Speed**: if the driver logs transfer sizes, check that a full refresh and a partial window
+   take the expected times.
+
+Record the build commit, board, config, and the captured image path when reporting results.
+
+## When a partial update looks wrong
+
+Take a marker-only capture before assuming the mapping is wrong: the camera's perspective makes
+absolute positions deceptive. If markers land in mirrored positions, the controller's address
+order (`MADCTL` MX/MY/MV) or the RAM block mapping is inverted for the window; verify the
+full-frame path separately, then fix the window computation.
+
+## Add findings
+
+Add new capture tools, panel quirks, or recovery steps here so the next session starts ahead.

.agents/skills/display-test/scripts/camsnap.swift

@@ -0,0 +1,71 @@
+// camsnap <camera name substring> <output.jpg> [frames to skip]
+// macOS only: grabs one frame from an AVFoundation camera after letting exposure settle.
+// See SKILL.md for capture tools on other systems.
+import AVFoundation
+import AppKit
+import CoreImage
+
+let args = CommandLine.arguments
+guard args.count >= 3 else {
+  FileHandle.standardError.write("usage: camsnap <camera name> <out.jpg> [skip]\n".data(using: .utf8)!)
+  exit(2)
+}
+let wanted = args[1].lowercased()
+let outPath = args[2]
+let skip = args.count > 3 ? Int(args[3]) ?? 30 : 30
+
+let discovery = AVCaptureDevice.DiscoverySession(
+  deviceTypes: [.external, .builtInWideAngleCamera], mediaType: .video, position: .unspecified)
+guard let device = discovery.devices.first(where: { $0.localizedName.lowercased().contains(wanted) }) else {
+  let names = discovery.devices.map { $0.localizedName }.joined(separator: ", ")
+  FileHandle.standardError.write("no camera matching '\(wanted)'; found: \(names)\n".data(using: .utf8)!)
+  exit(1)
+}
+
+final class Grabber: NSObject, AVCaptureVideoDataOutputSampleBufferDelegate {
+  var seen = 0
+  let skip: Int
+  let out: String
+  init(skip: Int, out: String) { self.skip = skip; self.out = out }
+  func captureOutput(_ output: AVCaptureOutput, didOutput sampleBuffer: CMSampleBuffer,
+                     from connection: AVCaptureConnection) {
+    seen += 1
+    guard seen > skip, let pixels = CMSampleBufferGetImageBuffer(sampleBuffer) else { return }
+    let image = CIImage(cvPixelBuffer: pixels)
+    let rep = NSBitmapImageRep(ciImage: image)
+    guard let jpeg = rep.representation(using: .jpeg, properties: [.compressionFactor: 0.9]) else {
+      FileHandle.standardError.write("failed to encode \(out) as JPEG\n".data(using: .utf8)!)
+      exit(1)
+    }
+    let url = URL(fileURLWithPath: out)
+    try? FileManager.default.createDirectory(
+      at: url.deletingLastPathComponent(), withIntermediateDirectories: true)
+    do {
+      try jpeg.write(to: url)
+    } catch {
+      FileHandle.standardError.write("failed to write \(out): \(error)\n".data(using: .utf8)!)
+      exit(1)
+    }
+    print("saved \(out) after \(seen) frames")
+    exit(0)
+  }
+}
+
+let session = AVCaptureSession()
+session.sessionPreset = .high
+guard let input = try? AVCaptureDeviceInput(device: device), session.canAddInput(input) else {
+  FileHandle.standardError.write("cannot open \(device.localizedName)\n".data(using: .utf8)!)
+  exit(1)
+}
+session.addInput(input)
+let output = AVCaptureVideoDataOutput()
+output.videoSettings = [kCVPixelBufferPixelFormatTypeKey as String: kCVPixelFormatType_32BGRA]
+let grabber = Grabber(skip: skip, out: outPath)
+output.setSampleBufferDelegate(grabber, queue: DispatchQueue(label: "camsnap"))
+session.addOutput(output)
+session.startRunning()
+DispatchQueue.main.asyncAfter(deadline: .now() + 15) {
+  FileHandle.standardError.write("timed out waiting for frames\n".data(using: .utf8)!)
+  exit(1)
+}
+RunLoop.main.run()

.agents/skills/display-test/templates/display-pattern.yaml

@@ -0,0 +1,43 @@
+# Display test pattern: corner markers, centre reference and partial-update markers.
+# Replace the display platform and pins with the driver under test.
+esphome:
+  name: display-pattern
+
+esp32:
+  board: esp32-s3-devkitc-1
+  framework:
+    type: esp-idf
+
+logger:
+  hardware_uart: USB_SERIAL_JTAG
+  level: DEBUG
+
+spi:
+  clk_pin: GPIO11
+  mosi_pin: GPIO12
+
+display:
+  - platform: st7305
+    id: test_display
+    cs_pin: GPIO40
+    dc_pin: GPIO5
+    reset_pin: GPIO41
+    update_interval: 1s
+    auto_clear_enabled: false
+    lambda: |-
+      static int frame = 0;
+      if (frame == 0) {
+        it.fill(Color::WHITE);
+        it.rectangle(0, 0, it.get_width(), it.get_height(), Color::BLACK);
+        it.filled_rectangle(it.get_width() / 2 - 10, it.get_height() / 2 - 10, 20, 20, Color::BLACK);
+      } else if (frame == 1) {
+        it.filled_rectangle(20, 20, 60, 20, Color::BLACK);
+        it.filled_rectangle(20, 50, 20, 20, Color::BLACK);
+      } else if (frame == 2) {
+        it.filled_rectangle(20, it.get_height() - 40, 60, 20, Color::BLACK);
+      } else if (frame == 3) {
+        it.filled_rectangle(it.get_width() - 80, 20, 60, 20, Color::BLACK);
+      } else if (frame == 4) {
+        it.filled_rectangle(it.get_width() - 80, it.get_height() - 40, 60, 20, Color::BLACK);
+      }
+      frame++;

.agents/skills/hardware-test/SKILL.md

@@ -93,13 +93,15 @@ ESP-IDF OTA image: `.esphome/build/<name>/build/firmware.ota.bin`. LibreTiny OTA
 - `ports.py`: list ports with VID:PID, product, serial and a board guess; `--wait VID[:PID]`,
   `--product NAME`, `--serial SN` (one specific board, whatever path it comes back under) and
   `--serial-of PORT` (the serial number behind a path).
-- `serial_capture.py PORT SECONDS OUT [--baud] [--released] [--reset] [--append]`: bounded timestamped
-  capture, ANSI stripped, `LOG_SECRET` text written as `<secret>`, reopens a vanished port, exits at the
+- `serial_capture.py PORT SECONDS OUT [--baud] [--released] [--reset] [--append] [--ms]`: bounded timestamped
+  capture (`--ms` adds milliseconds for timing work), ANSI stripped, `LOG_SECRET` text written as `<secret>`, reopens a vanished port, exits at the
   deadline. OUT is truncated unless `--append` is given, so counts over it cover one run.
 - `flash_rtl87xx_kit.py`: ltchiptool wrapper for the BW15 kit whose CH340 drives CEN (RTS) and the boot
   strap (DTR). `flash read` needs the family `realtek-ambz2`; `flash write` does not.
 - `flash_bk72xx.py`: ltchiptool wrapper for BK72xx boards whose RTS drives CEN. It misses the link now
   and then; retry up to three times.
+- `api_button.py HOST KEY list|press NAME [...]`: list a device's template buttons or press them over the API; the
+  recipes drive their test configs with it.
 - `wifisave_hammer.sh KIND DUT_PORT DUT_YAML DUT_TREE CLIENT_PORT CLIENT_YAML CLIENT_TREE [SETTLE]`:
   the fallback AP plus captive portal hammer end to end (compile, flash, capture, counts) with the
   templates below. KIND is `esp`, `pico`, `bw15` or `bk`. It ends with `RESULT PASS` (exit 0),
@@ -113,7 +115,7 @@ Per-topic scripts, each described in the matching `reference/recipes/<component>
 (host driver, Zephyr driver probe), `rtsp_server/` (protocol client, raw rate reader, measurement set,
 API image grab), `cse7766/` (API observer with ping), `zephyr_coredump/` (reader flow, decode with the
 Zephyr tools), `libretiny_prefs/` (rtc preference harness header), `libretiny_crash/` (BK72xx crash probe header and
-capture decoder).
+capture decoder), `api_outgoing/` (wake cycle and Wi-Fi drop timing readers), `ld2450/` (zone number driver), `dfrobot_sen0395/` (API driver and case runner), `homeassistant_light/` (direct bulb driver, held-report case driver), `usb_audio/` (URL player), `speaker_media_player/` (API player driver, pipeline task case runner), `web_server/` (SSE client, request mix, SSE and HTTPD case runners), `mqtt/` (broker config with TLS, client-certificate and WebSocket listeners, test CA with server and client certificates, transport case runner, flash-and-drive runner, CLI TLS check without a board), `udp/` (datagram recorder, `udp.write` payload checker and case driver), `entity_icons/` (icon and device class readback over the API, MQTT discovery, web_server and dump_config, with a comparer).
 
 ## Templates in `$SKILL/templates`
 
@@ -125,11 +127,19 @@ capture decoder).
 - Per-topic device configs, each described in `reference/recipes/<component>.md`: `online-image-dut.yaml`,
   `usb-cdc-acm-dongle-dut.yaml`, `nrf52-preferences-dut.yaml`, `rtsp-waveshare-s3-eth-dut.yaml`,
   `waveshare-s3-eth-camdiag.yaml`, `s31-cse7766-dut.yaml`, `nrf52-coredump-crash-dut.yaml`,
-  `bk72xx-rtc-prefs-dut.yaml`, `bk72xx-crash-probe-dut.yaml`, `dut-ap-only-wipe-once-bk72xx.yaml`.
+  `bk72xx-rtc-prefs-dut.yaml`, `bk72xx-crash-probe-dut.yaml`, `dut-ap-only-wipe-once-bk72xx.yaml`,
+  `homeassistant-light-dut.yaml`, `deep-sleep-outgoing-dut.yaml`, `outgoing-wifi-drop-dut.yaml`,
+  `globals-storage-dut.yaml`, `usb-audio-waveshare-s3-eth-dut.yaml`, `usb-audio-sendspin-s3-eth-dut.yaml`,
+  `cast-pro-1-sendspin-control.yaml`, `aux-2-preprod-stock-dut.yaml`, `aux-2-preprod-usb-audio-dut.yaml`,
+  `dfrobot-sen0395-dut.yaml`, `aux-2-preprod-speaker-player-dut.yaml`, `web-server-sse-dut.yaml`,
+  `mqtt-transport-dut.yaml`, `mqtt-tls-dut.yaml`, `udp-write-dut.yaml`, `entity-icon-dut.yaml`.
 
 ## When something looks wrong
 
 - A capture stopped early or a line is missing: check the timestamps before trusting it.
+- A script that pipes into `tee` never ends although its work is done: a background command written as
+  `(cd dir && server & echo $!)` backgrounds the whole `cd && server` list, so a shell stays behind holding the
+  pipe open and `$!` is that shell, not the server. Write `(cd dir && exec server > out 2>&1 < /dev/null) &`.
 - The client never joins the AP: another board may still run an AP with the same SSID, or the device
   booted with saved credentials because the name was reused. One AP device at a time on the bench.
 - Builds come out byte-identical between branches: the wrong tree was imported (rule 3). The reverse
@@ -139,6 +149,10 @@ capture decoder).
   preference and repeat it in a periodic alive line, as `scripts/libretiny_prefs/ltprefs.hpp` does.
 - Multicast from the host never arrives on some access points: test it device to device. Broadcast
   is lossy under Wi-Fi power save, unicast is not. Throttle UDP floods to a fixed packet rate.
+- The merge base comes from a freshly fetched `origin/dev`; a stale local `dev` puts dependency bumps into the
+  PR diff and builds the control from the wrong commit.
+- A `.local` name can stop resolving in the middle of a run; keep the address from the boot log and drive by it.
+- `wc -l` pads its count on macOS, so `tail -n +$n0` needs `$((n0+0))` or an arithmetic expansion.
 - `api:` reboots a board after 15 min without a client: `reboot_timeout: 0s` on `api:` and `mqtt:` for
   soak tests.
 

.agents/skills/hardware-test/reference/recipes/README.md

@@ -4,23 +4,29 @@ Each flow names the pull requests it was used on, so their result tables show wh
 
 One file per component, named after it:
 
-- [`api.md`](api.md): noise handshake and OTA encryption on the ESP8266
+- [`api.md`](api.md): noise handshake and OTA encryption on the ESP8266, outgoing connection wake timing on deep sleep and after a Wi-Fi drop
 - [`captive_portal.md`](captive_portal.md): fallback AP and /wifisave hammer
 - [`cse7766.md`](cse7766.md): Sonoff S31 parser check over the API
 - [`espnow.md`](espnow.md): ESP8266 broadcast receive
 - [`hdmi_cec.md`](hdmi_cec.md): two-board wire
-- [`ld2450.md`](ld2450.md): polygon zones
+- [`ld2450.md`](ld2450.md): polygon zones, zone number round trip through the radar's readback
 - [`libretiny.md`](libretiny.md): rtc preference emulation, BK72xx crash report on the next boot
-- [`mqtt.md`](mqtt.md): broker bench, QoS, reconnect, crash log over MQTT
+- [`mqtt.md`](mqtt.md): broker bench, QoS, reconnect, crash log over MQTT, WebSocket transports with a local and a public broker, TLS trust sources (own CA, client certificate, certificate bundle, no verification) with the CLI check
 - [`nrf52.md`](nrf52.md): dongle board support
 - [`online_image.md`](online_image.md): stalled and malformed downloads
 - [`openthread.md`](openthread.md): border router on the S3 host plus H2 RCP
 - [`ota.md`](ota.md): overlap and lock, timeouts, deflate
 - [`rtsp_server.md`](rtsp_server.md): camera streaming on the Waveshare ESP32-S3-ETH
 - [`scheduler.md`](scheduler.md): loop wake A/B
-- [`udp.md`](udp.md): datagrams, multicast, sockets
+- [`udp.md`](udp.md): datagrams, multicast, sockets, `udp.write` payload shapes
 - [`usb_cdc_acm.md`](usb_cdc_acm.md): nRF52840 dongle host driver
 - [`wifi.md`](wifi.md): reboot_timeout with a fallback AP, DHCP lease cache, Easy Connect (DPP)
 - [`zephyr.md`](zephyr.md): preferences on the nRF52840 dongle
 - [`zephyr_coredump.md`](zephyr_coredump.md): crash and decode on nRF52 boards
 - [`zwave_proxy.md`](zwave_proxy.md): frame checksums on a live proxy
+- [`globals.md`](globals.md): restoring globals with storage rtc and flash across every reset kind
+- [`homeassistant.md`](homeassistant.md): light platform mirrored from a local Home Assistant, held reports versus later calls
+- [`usb_audio.md`](usb_audio.md): USB audio speaker and microphone, the usb_host FIFO split, and Music Assistant playback through sendspin
+- [`dfrobot_sen0395.md`](dfrobot_sen0395.md): SEN0395 mmWave command flow, module quirks and overlong lines through its error reply
+- [`speaker.md`](speaker.md): media player pipeline tasks on the Connect AUX-2 with the `speaker` platform player
+- [`web_server.md`](web_server.md): state SSE stress and the HTTPD task stack on web_server_idf, entity icon and device class readback

.agents/skills/hardware-test/reference/recipes/api.md

@@ -5,3 +5,26 @@
 Host side timing is useless on a weak link; use an on-device bench with the minimum of five runs over
 two boots. Provision a key with `noise_encryption_set_key` through aioesphomeapi and upload with
 `espota2.run_ota(host, 8266, None, bin, noise_psk=key)` when the key is not in the yaml.
+
+## Outgoing connection wake timing on a deep sleep build (#21077)
+
+`templates/deep-sleep-outgoing-dut.yaml`: classic ESP32 ESP-IDF, `wifi: fast_connect`, `api: encryption` with a bare
+`outgoing_connection:`, `deep_sleep` 15 s run and 15 s sleep, a `homeassistant` text sensor, and `millis()` logged
+from `wifi: on_connect`, `api: on_client_connected` and the sensor's first `on_value`. Home Assistant's dial-in
+listener is on 6054; reuse a device name it already has. Flash by USB, `serial_capture.py PORT 360 OUT --reset` for
+12 cycles, then `scripts/api_outgoing/cycles.py OUT LABEL` prints per cycle the wifi, client and state millis with
+the client-wifi and state-client gaps. Wi-Fi takes 4 to 8 s after a wake, so compare the client-wifi gap, and run
+the PR twice around one base run because the spread is a few hundred ms.
+Results: https://github.com/esphome/esphome/pull/21077#issuecomment-6254098014
+
+## Outgoing connection on a mains build after a Wi-Fi drop (#21085)
+
+`templates/outgoing-wifi-drop-dut.yaml`: classic ESP32, `outgoing_connection: delay: 2s`, a "Wifi cycle" button doing
+`wifi.disable`, 4 s, `wifi.enable`, a `debug` loop-time sensor, millis from the wifi and api triggers. Flash by USB,
+`serial_capture.py PORT SECONDS OUT --ms`, press the button N times 40 s apart with `api_button.py DEV_IP KEY press
+"Wifi cycle"`, then `wificycles.py CAPTURE LABEL` prints per drop the Wi-Fi-to-dial gap, dials and dials closed, who
+connected first, and the loop-time maxima. For the loop cost of polling, repeat with an unreachable
+`host: 192.0.2.1`. Home Assistant refuses a dial-in while its own session is READY (`Refusing dial-in adoption`),
+so after a drop every dial is closed and HA's incoming reconnect wins 11 to 33 s later; the measurable effect is the
+first dial landing in the loop the network flag flips.
+Results: https://github.com/esphome/esphome/pull/21085#issuecomment-6254742791

.agents/skills/hardware-test/reference/recipes/dfrobot_sen0395.md

@@ -0,0 +1,21 @@
+# dfrobot_sen0395
+
+## DFRobot SEN0395 mmWave on an ESP32 DevKit V1 (#20906, #20979)
+
+Wiring: V to VIN (5 V, the module wants 3.6 to 5 V), G to GND, sensor TX to GPIO16 (RX2), sensor RX to GPIO17
+(TX2), IO2 to GPIO18 (presence output, a gpio binary sensor), I1 unconnected. `templates/dfrobot-sen0395-dut.yaml`
+has the hub, both detection binary sensors, the four switches, settings buttons and junk-line buttons.
+`scripts/dfrobot_sen0395/ctl.py HOST KEY press:NAME sw:NAME=on|off wait:S` drives it and prints binary sensor and
+switch updates; `cases.sh DEV_IP KEY CAPTURE LABEL` runs the whole flow against a running serial capture. Flash by
+USB, `serial_capture.py PORT 540 CAPTURE --reset`, then the cases; compare the `Sending command` and `Message:` lines
+and the counts of `Done`, `Error`, prompts and frames between builds. The module echoes every command, so the echoed
+lines are the bytes the component sent and can be compared between builds as a set.
+
+Module facts: it answers `Done` or `Error` and then the `leapMMW:/>` prompt without a line end; a junk line gets
+`<line> is not recognized as a CLI command` (36 chars longer than the line, so 220 and 240 byte junk gives 256 and
+276 char replies); input lines of 256 bytes or more make the module assert (`..\User_code\main.c line:232`) and
+restart, after which the sensor is stopped; a factory reset restarts the module about 7 s later; `sensorStop` on a
+stopped sensor answers `sensor stopped already` then `Error`; a settings press takes 5 to 6 s (stop, change, save,
+start). Free heap on the ESP32 is Wi-Fi noise (192 to 198 kB) and says nothing about the component.
+Results: https://github.com/esphome/esphome/pull/20979#issuecomment-6279129146 and
+https://github.com/esphome/esphome/pull/20906#issuecomment-6279129604

.agents/skills/hardware-test/reference/recipes/globals.md

@@ -0,0 +1,15 @@
+# globals
+
+## Restoring globals with storage: rtc and flash (#13954)
+
+`templates/globals-storage-dut.yaml` is the shared package: five restoring globals (rtc int, flash int, default int,
+rtc `std::string`, rtc `uint8_t[2]`), bumped and logged with the reset reason on every boot, saved and synced after
+2 s, odd boots `App.safe_reboot()`. Platform files add the board (`packages: dut: !include globals-storage-dut.yaml`), the `debug` reset-reason text sensor and, on the
+ESP32, `deep_sleep: run_duration: 12s, sleep_duration: 8s` (even boots sleep). No network needed: flash by USB,
+`serial_capture.py PORT 110 OUT --reset` gives the reset pulse plus a run of soft restarts and sleeps; the ESP32's
+EN pulse is a `POWERON_RESET` that empties RTC memory, the D1 mini's RST pulse (`rst cause:2`) keeps it, so the
+ESP8266 needs a real power cut by hand; arm long `--released` captures on both ports first (the capture
+reopens the port when it comes back, the very first boot lines are still lost, read the next boot's restored
+values). Unchanged-build check: the config with every `storage:` removed, built on the PR and on the dev merge
+commit under the PR's own commits (not the merge base, which is older dev), `cmp -l` plus an `nm -S` symbol diff;
+only the template names differ. Results: https://github.com/esphome/esphome/pull/13954#issuecomment-6254794712

.agents/skills/hardware-test/reference/recipes/homeassistant.md

@@ -0,0 +1,47 @@
+# homeassistant
+
+## homeassistant light platform against a local Home Assistant (#11354)
+
+A local Home Assistant dev install (`hass -c config`, https://127.0.0.1:8123 with a self-signed cert); its ESPHome
+entries and entity ids are in `config/.storage/`. Two ESPHome RGBCW bulbs with a plaintext API are the lights, so an
+"HA side" change is made directly on a bulb with `scripts/homeassistant_light/bulb.py BULB_IP - on|off|state|restart`.
+Add the test devices to HA by hand with the shared `api_key` and "Allow the device to perform Home Assistant actions".
+
+`templates/homeassistant-light-dut.yaml` is a package: two mirrors, buttons for each change, a "Log state" button, a
+30 s alive line, an `on_boot` `light.turn_on` for the change-before-first-write path, and VERBOSE logging with the
+noisy tags at DEBUG (a tag cannot exceed the global level). A platform file sets the board and includes it:
+
+```yaml
+esphome:
+  name: ha-light-dut
+esp32:
+  board: esp32dev
+  framework:
+    type: esp-idf
+packages:
+  dut: !include homeassistant-light-dut.yaml
+```
+
+Flash by USB, start a bounded `esphome logs` capture per device, then press buttons with
+`scripts/api_button.py DEV_IP KEY press "Button"` and read the bulb with `bulb.py`. Cases: each
+button against the bulb and the device log; a direct bulb change that both mirrors follow; restart the bulb, send a
+change, expect the 5 s `did not report the change back` and the fallback (with an off and with an on last report);
+OTA reboot with a serial capture running to see the boot-time change (the API log client reconnects too late).
+
+Lessons: the light core clamps mireds to the range HA reported; a flash sends nothing; a change sent while HA is
+connected but not yet subscribed is dropped by the api server (`client has not subscribed to actions (yet)`); after a
+fallback to an off report the mirror keeps the unsent brightness; a mirror that never saw its light on since boot has
+no levels to restore. Results: https://github.com/esphome/esphome/pull/11354#issuecomment-6253630336 and
+https://github.com/esphome/esphome/pull/11354#issuecomment-6254161409
+
+## Held report versus a later call (#21144)
+
+A report that arrives during a transition is held and applied when the transition ends, unless a call came after
+it. `scripts/homeassistant_light/heldcase.py DEV_IP KEY BULB_IP same|many [BULB_KEY]` (a key of `-` is plaintext) keeps one API connection to the mirror
+device and one to the bulb so the steps land inside a 3 s fade: press "A 50 fade 3s", 0.7 s later set the bulb to
+90% directly (the report is held), 1.4 s in press the same fade again (or "A many calls", 16 calls in one loop
+pass). Pass: the mirror and the bulb end at the second call's target. Only `same` reproduces the bug: a build
+without the fix logs `Applying the report that arrived during the transition` and the bulb stays at 90%. `many`
+ends at 100% on both builds because the last call's target differs from the held report, so it is a regression
+check only, not a reproduction. Separate button presses are too slow (about 1.5 s each) to land inside the fade.
+The mirrors are not API entities, so read their state from the "Log state" button's line. Results: https://github.com/esphome/esphome/pull/21144#issuecomment-6278257695

.agents/skills/hardware-test/reference/recipes/ld2450.md

@@ -5,3 +5,11 @@
 To make a target "leave" without anyone moving, set the radar's Zone-1 numbers over the target and
 switch the zone type to `Filter` (the count drops to 0 within 0.5 s); set it back to `Disabled` after.
 Writing those numbers blocks the ld2450 loop about 50 ms.
+
+## Zone numbers round trip (#21146)
+
+`scripts/ld2450/zonedrive.py HOST KEY(- for plaintext) set:NAME=VALUE sel:NAME=OPTION wait:S list` sets numbers and
+selects over the API and prints every LD2450 state update. After each set the hub sends the set zone command, queries
+the radar and republishes all twelve coordinates from the answer, so set each coordinate of each zone to a distinct
+value and check the readbacks; no target is needed. Readbacks can arrive late over Wi-Fi, so match them by content.
+Results: https://github.com/esphome/esphome/pull/21146#issuecomment-6278026922

.agents/skills/hardware-test/reference/recipes/mqtt.md

@@ -10,3 +10,44 @@ after bulk subscribe and unsubscribe; read the heap seconds later over several r
 leak. Spawned subscriptions need about 2.5 s to reach the broker before the next publish.
 `esphome logs --device MQTT` only uses the MQTT transport when the config has no `api:`. Driver pattern: a
 paho script publishes and polls the serial capture file.
+
+## WebSocket transports on ESP-IDF (#16056)
+
+One build per transport from `templates/mqtt-transport-dut.yaml`, with `scripts/mqtt/mosquitto-ws.conf` as the
+local broker (mosquitto 2.x from brew has `websockets` support; `log_type all` prints `New connection from <ip>:<port>
+on port <listener>`, which proves which listener each client used) and `scripts/mqtt/make_test_ca.sh BROKER_IP` for
+the TLS listener's certificate, both run in the scratch directory so keys, logs and outputs stay out of the checkout. `scripts/mqtt/cases.sh NAME KEY BROKER_HOST SUB_PORT CAPTURE [DEV_HOST] [restart]` subscribes
+to `NAME/#`, sends a switch command and an `on_message` topic, presses the 3000 byte publish button over the API,
+restarts the local broker when the last argument is `restart` (the PID in `mosquitto.pid`, written when the broker
+was started with `mosquitto -c mosquitto-ws.conf & echo $! > mosquitto.pid` in the working directory next to the
+certificates), checks every listener in the broker config answers again, and prints the broker's message counts with the device log. `mosquitto_sub` cannot speak
+WebSocket, so it subscribes on the plain listener of the same broker. Cases: `tcp` on 1883, `ws` on 9001, `wss` on
+9002 with `certificate_authority` (the certificate names an address, so `skip_cert_cn_check: true`), `wss` to
+test.mosquitto.org on 8081 with no CA for the certificate bundle, and two negatives that must never connect: a
+different CA (`mbedtls_ssl_handshake returned -0x2700`) and the self-signed server through the bundle
+(`esp-x509-crt-bundle: Failed to verify certificate`, `-0x3000`). `CONFIG_MQTT_TRANSPORT_WEBSOCKET` is on by
+default in the generated sdkconfig. The TLS session costs about 29 kB of internal heap while connected; the public
+broker carries other devices' `esphome/discover` traffic, which is noise. Results:
+https://github.com/esphome/esphome/pull/16056#issuecomment-6301034019
+
+## TLS trust sources on ESP-IDF (#14318)
+
+One build per trust source from `templates/mqtt-tls-dut.yaml`: broker only (port must resolve to 1883),
+`certificate_authority` with no port (must resolve to 8883), `verify_ssl: false` with no CA, the CA plus
+`client_certificate` and `client_certificate_key` on the 8884 listener that requires one, `transport: wss` with the CA,
+`tls: true` to test.mosquitto.org on 8886 for the certificate bundle, and `tls: true` to the local self-signed broker as
+the negative. `scripts/mqtt/mosquitto-ws.conf` now has the 8883 and 8884 listeners and `scripts/mqtt/make_test_ca.sh`
+also writes `client.crt`/`client.key`. Before flashing, check each build's `src/esphome/core/defines.h` for
+`USE_MQTT_TLS`, `USE_MQTT_CERT_BUNDLE` and `USE_MQTT_TLS_INSECURE` and its `sdkconfig.<name>` for
+`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE` and `CONFIG_ESP_TLS_INSECURE`: only the bundle builds may carry the bundle and only
+the unverified build the insecure flags. `scripts/mqtt/flash_and_drive.sh TREE YAML PORT KEY BROKER_HOST
+local|public|neg` runs one build end to end (flash, bounded capture, `cases.sh` with a restart for the local broker,
+counts and the broker's per-listener connection lines) and prints the config dump's `TLS:` line (`CA certificate`,
+`certificate bundle` or `no verification`). The CLI side (`esphome/mqtt.py`) is covered without a board by
+`scripts/mqtt/cli_tls_check.sh TREE [neg] YAML...`, which runs `esphome clean-mqtt` under a timeout: status 124
+after `Connected to MQTT broker!` is a pass, and with `neg` each config must instead fail with
+`CERTIFICATE_VERIFY_FAILED` and never connect. Python's default SSL
+context rejects a CA that lacks a `keyUsage` extension (`CA cert does not include key usage extension`) while mbedTLS
+on the device accepts it, which is why the test CA carries `basicConstraints` and `keyUsage`. A broker kill shows as one
+`Last esp-tls error: 0x8008` on every build, TLS or not. Results:
+https://github.com/esphome/esphome/pull/14318#issuecomment-6311863827

.agents/skills/hardware-test/reference/recipes/speaker.md

@@ -0,0 +1,19 @@
+# speaker
+
+## Media player pipeline tasks (#21203)
+
+The `speaker` media player platform (`speaker/media_player/`) creates `ann_read`, `ann_decode`, `med_read` and
+`med_decode` FreeRTOS tasks on every play and deletes them after a stop. The AUX-2 and sendspin packages use the
+`speaker_source` player instead, which has its own pipeline and never runs that code, so a test of
+`speaker/media_player/*` has to swap the player: `templates/aux-2-preprod-speaker-player-dut.yaml` removes the
+package's `external_media_player` with `id: !remove` and adds a `speaker` platform player on the package's resampler
+speakers, plus a "Task names" button whose lambda calls `xTaskGetHandle()` on the four names and logs internal free
+heap. Serve FLAC files from the host (`ffmpeg -f lavfi -i "sine=frequency=440:duration=90" -ac 2 -ar 48000 -c:a flac
+media90.flac`, a 3 s mono one for announcements, `python3 -m http.server 8765 --directory www`); `audio_http`
+refuses WAV and MP3. `scripts/speaker_media_player/cases.sh HOST KEY MEDIA_URL ANN_URL CAPTURE LABEL` runs three
+cycles through `drive.py` (`play:URL | ann:URL | stop | press:NAME | wait:S` on one API connection) with the probe
+pressed idle, during media, during the announcement, after it and after the stop. Pass: idle none, media `med_*`
+only, announcement all four, after stop none, every cycle. API commands land a second or two late over Wi-Fi, so read
+the probe against the `State changed to` lines rather than the driver's timestamps. Internal free heap after a stop
+moved by 2.5 kB between two boots of the same build, so a heap delta needs more than one boot per build. Results:
+https://github.com/esphome/esphome/pull/21203#issuecomment-6299581943

.agents/skills/hardware-test/reference/recipes/udp.md

@@ -9,3 +9,18 @@ listener. Broadcast to boards is lossy under power save, unicast is not. Flood a
 reconnect on the Pico keeps IGMP membership. Set a long loop interval from `wifi.on_connect`
 (`App.set_loop_interval(20000)`), not `on_boot`, or Wi-Fi connect crawls. The `logger.log` action
 rejects `%.*s`; use a lambda.
+
+## udp.write payload shapes (#21263, ApplyBytes)
+
+`templates/udp-write-dut.yaml` puts every payload shape behind a template button (constant 4 bytes twice, 3, 9, 0,
+128, 129 and 600 bytes, a 300 byte lambda, a simple value, a string) plus an `on_receive` that replies with the
+received bytes reversed. `scripts/udp/write_cases.sh DEVICE_IP KEY` records the device's datagrams with
+`udp_listen.py` on the test host, presses the buttons two seconds apart, sends one unicast datagram for the echo and
+compares everything byte for byte with `check.py`; a missing datagram shifts every later one, so read the first
+mismatch. Before flashing, check the generated `main.cpp`: on ESP8266 a constant payload is copied out of its
+`PROGMEM` table into `uint8_t esphome__bytes[N]` up to the stack limit and into `std::make_unique<uint8_t[]>` beyond,
+identical payloads share one table, a lambda is sent from its vector. An empty constant payload is generated as
+`send_packet(nullptr, 0)`, and the raw lwIP UDP `sendto` used on ESP8266 rejected a null buffer with `EINVAL`
+(`sendto() error 22` in the log, no datagram) until it accepted `nullptr` with a zero length; the old
+`TemplatableBytes::visit` had passed a zero length stack buffer instead. Compare sizes against the stacked PR's own
+head when the PR is stacked, not against dev. Results: https://github.com/esphome/esphome/pull/21263

.agents/skills/hardware-test/reference/recipes/usb_audio.md

@@ -0,0 +1,52 @@
+# usb_audio
+
+## USB audio on the Waveshare ESP32-S3-ETH (#21081, #11728)
+
+`templates/usb-audio-waveshare-s3-eth-dut.yaml`: ESP-IDF, PoE, logs over the API on Ethernet (the native USB port is
+the host port, so there is no console), `usb_audio` hub, a 48 kHz 16-bit microphone, a 48 kHz 24-bit speaker (many
+speakerphones offer only 24-bit; a wrong format logs the device's alternates), buttons for capture start and stop,
+a non-blocking beep fed from an 8 ms interval with `play(buf, len, 0)` (a blocking `play()` on the main loop trips
+the task watchdog), and a status interval with mic bytes, speaker state and heap. Drive the buttons with
+`scripts/api_button.py IP KEY press "Beep"`. Expect 192 kB/s microphone bytes and the FIFO split
+RX 80 / NPTX 16 / PTX 104 in the build's `defines.h`; with the balanced split the 294-byte OUT pipe is refused
+(`EP MPS (294) exceeds supported limit (128)`). A device whose OUT endpoint is larger than 600 bytes cannot be
+claimed on an S3 at all.
+
+## Music Assistant through sendspin
+
+`templates/usb-audio-sendspin-s3-eth-dut.yaml` overlays the template above with the Apollo CAST-1 wiring: resampler
+speakers into a mixer whose inputs never time out, `speaker_source` media player with the sendspin source, and
+`sendspin: unpaired_access: true`. A `media_player: platform: speaker` is not a media-source consumer and gives
+"Player over its buffer", no audio. Music Assistant finds the device by mDNS within 15 s of boot.
+
+Read the result from the device, not only by ear: sendspin's sync task logs `Lost sync (N us off)` (DEBUG, tag
+`SsSync`) for every correction over 5 ms, a positive N inserts that much silence, and each one is an audible click.
+For the chunk lead histogram, edit the managed library in the build directory,
+`.esphome/build/<name>/managed_components/sendspin__sendspin-cpp/src/sync_task.cpp` (an `SS_LOGD` before the
+late-chunk skip in `decode_chunk()` printing the chunk's lead against `new_audio_client_playtime`), update only that
+file's `size` and sha256 `hash` in the component's `CHECKSUMS.json`, and compile again; deleting `.component_hash` or
+recomputing it makes the manager refuse or refetch. Check the edit is in the image with `strings firmware.ota.bin`.
+A lead below -5 ms makes the library skip the whole chunk; an I2S speaker keeps it within 0.1 ms of zero, which is
+the figure a USB speaker has to match.
+
+Gotchas: wait two minutes after a reboot before the measured stream (safe mode's boot counter write stalls the cores
+for about 140 ms once, 60 to 75 s after boot); with the serial console on, a DEBUG log line per report saturates
+UART0 and trips the task watchdog, so use `logger: baud_rate: 0` and the API log; two overlapping `esphome logs`
+captures double every count; and every audio test must include a pause and resume cycle, since a stream end that
+leaves less than one transfer parked in the driver was what hung the speaker after #11728 merged.
+
+## Controls
+
+Apollo CAST PRO-1 (`templates/cast-pro-1-sendspin-control.yaml`): `Core.yaml` next to it is
+`Integrations/ESPHome/Core.yaml` from ApolloAutomation/CAST_PRO-1, which also defines the `version` substitution.
+Keep its framework log level at ERROR (DEBUG floods driver output and trips the watchdog); the package reboots itself
+into Ethernet-only once it sees a link and appends the MAC suffix to the name. `wifi: enable_on_boot: false` keeps
+sendspin off Wi-Fi.
+
+Nabu Casa Connect AUX-2 (a pre-production unit): build from `packages/aux-2-pre-prod.yaml` at NabuCasa/aux-2 commit
+283f2e64 (dropped in bde41e01), not the public `aux-2.yaml`, whose W5500, codec and I2S pins differ (the public one
+reads W5500 chip ID 0x00 and fails the codec's I2C writes). Point its local `external_components` source at
+`github://NabuCasa/aux-2@main`. Templates `aux-2-preprod-stock-dut.yaml` (I2S codec) and
+`aux-2-preprod-usb-audio-dut.yaml` (the USB speaker as the mixer output via `!extend mixing_speaker`). The console is
+the CH343 (1a86:55d3); first flash over it, OTA after. Forcing the Wi-Fi flag off with `restore_value: no` boot-loops
+when Ethernet fails, so let the package switch itself.

.agents/skills/hardware-test/reference/recipes/web_server.md

@@ -0,0 +1,60 @@
+# web_server
+
+## State SSE on web_server_idf (#21109) and the HTTPD task stack (#21038)
+
+`templates/web-server-sse-dut.yaml` (ESP32 classic, ESP-IDF, `web_server` version 3) publishes eight sensors every
+200 ms (small state events on the 1024 byte stack buffer) and three text sensors whose JSON carries the string twice
+(`value` and `state`): 600 chars for about 1.3 kB (the 2048 byte tail), 1800 chars for about 3.7 kB (tail grown to
+4096) and 2800 chars for about 5.7 kB, over the 5120 byte JSON room, which must log `State event does not fit`
+and never put a truncated frame on the wire. An `interval` lambda logs `uxTaskGetStackHighWaterMark()` of the loop
+task (`nullptr`) and of the HTTPD task (`xTaskGetHandle("httpd")`) every 5 s; the ESPHome loop task is `loopTask`
+on ESP32. Keep `power_save_mode: none`, and drive the device by address: mDNS names dropped out mid-run once.
+
+`scripts/web_server/sse.py HOST SECONDS [--clients N] [--stall] [--churn CYCLES]` opens raw TCP connections to
+`/events`, decodes the chunked body and parses every `state` event as JSON; `--stall` adds a connection with a 2 kB
+receive buffer that never reads (the device must log `Closing stuck EventSource connection` after the 20 s stall
+timeout), `--churn` opens and resets a connection CYCLES times. `sse_cases.sh HOST KEY LABEL CAPTURE` runs the
+set: 1 client 60 s, 4 clients 60 s, a reader plus a stalled client 45 s, a reader plus 10 abrupt closes, then two
+clients with the "Burst" button (50 sensor and 50 text publishes in one loop pass). Pass: 0 invalid JSON on every
+client, the oversize sensor dropped with its warning on every publish, the stalled session closed after about
+20 s, no reset. The loop task watermark is a minimum since boot, so compare the value after the first client, after
+four clients and after the burst between the builds (the SSE split in #21109 left 1280 B more on the ESP32 classic).
+
+For the HTTPD task, `web_server: auth: type: digest` (the default `auth` is Basic) and
+`scripts/web_server/httpd_cases.sh HOST USER PASS LABEL CAPTURE`: `httpmix.sh` sends a `curl --anyauth` request
+mix per round (page, `/sensor/<Name>`, `/text_sensor/<Name>`, `/switch/<Name>`, a `POST` with `Content-Length: 0`
+to `/switch/<Name>/toggle`, an unknown path, which the IDF server closes without a response, an unauthenticated
+request answered 401, and a 2 s `/events` stream), 20 rounds alone and 12 rounds next to two `ssecurl.sh` SSE
+clients. Entity URLs use the entity name, URL encoded, not an object id. The HTTPD watermark follows the deepest
+request of the boot; compare after the mix and after the SSE round, with two boots when the numbers are close.
+Results: https://github.com/esphome/esphome/pull/21109#issuecomment-6300582328 and
+https://github.com/esphome/esphome/pull/21038#issuecomment-6301310182
+
+## Entity icon and device class readback (#21111)
+
+Covers every path that reads an entity's icon or device class: the native API listing, MQTT discovery, the web_server
+`/events` listing and REST endpoints, and `dump_config`. `templates/entity-icon-dut.yaml` (ESP8266 board with wifi,
+encrypted api, ota, web_server and mqtt against a local broker) carries a sensor with a 63 character icon, one with no
+icon or device class, an internal sensor, and binary_sensor, switch, button, text_sensor, number, select, event, cover
+and text entities with icons and device classes. The per-run file supplies `name` and `broker_ip` through
+substitutions. Flash the PR and base builds under different names, then from the scratch directory:
+
+```sh
+scripts/entity_icons/readback.sh DEVICE_IP KEY NAME BROKER_HOST cap-NAME.txt   # once per build
+scripts/entity_icons/compare.sh ic-base ic-pr                                   # api, web, mqttn, dump all identical
+```
+
+`readback.sh` takes about 25 s once the device is on the network: 12 s of `mosquitto_sub` on `homeassistant/#` and
+`NAME/#`, the API listing (`api_list.py`, one JSON line per entity with icon, device class, unit, options and event
+types) and `web_dump.py` (6 s on `/events`, keeping only the listing rows that carry `domain`, then a GET of each
+listed id with `?detail=all` and one retry, because the ESP8266 async server occasionally leaves a request unanswered
+within 5 s). The web ids are `domain/Name`, not object ids, and `/event/<name>` has no GET handler (404 on every
+build). `mqtt_norm.py` drops the `dev` block (compile time) and the `NAME/debug` topic (heap probe), so a clean run
+differs in nothing. `dump_config` prints icons and device classes only for some domains; button, event and
+binary_sensor icons never appear there.
+
+Found with this flow on 2026-10-21: since #19577 every ESP8266 `web_server` build that lists a cover, climate, lock,
+valve, update, alarm_control_panel or water_heater entity reboots with `Exception (3) LoadStoreErr` in
+`json::linked(const char *)` (the ROM `strlen` on a flash address), fixed by #21316. The cover in the template keeps
+that path covered; before #21316 is merged, apply its one line change to both trees or the web_server comparison
+cannot run.

.agents/skills/hardware-test/scripts/api_button.py

@@ -0,0 +1,33 @@
+"""Press a template button on the test device over the API, or list its buttons.
+
+usage: api_button.py HOST KEY list | press "Button name" [...]  (KEY of - means a plaintext API)
+"""
+
+import asyncio
+import sys
+
+from aioesphomeapi import APIClient, ButtonInfo
+
+HOST, KEY = sys.argv[1], sys.argv[2]
+CMD, ARGS = sys.argv[3], sys.argv[4:]
+
+
+async def main() -> None:
+    c = APIClient(HOST, 6053, None, noise_psk=None if KEY == "-" else KEY)
+    await c.connect(login=True)
+    ents, _ = await c.list_entities_services()
+    buttons = {e.name: e for e in ents if isinstance(e, ButtonInfo)}
+    if CMD == "list":
+        print("\n".join(sorted(buttons)))
+    else:
+        for name in ARGS:
+            if name not in buttons:
+                sys.exit(f"no button named {name!r}; have {sorted(buttons)}")
+            c.button_command(buttons[name].key)
+            print("pressed", name)
+            await asyncio.sleep(0.3)
+    await asyncio.sleep(0.5)
+    await c.disconnect()
+
+
+asyncio.run(main())

.agents/skills/hardware-test/scripts/api_outgoing/cycles.py

@@ -0,0 +1,73 @@
+"""Per wake cycle timings from a serial capture of the deep sleep timing config.
+
+usage: cycles.py CAPTURE [LABEL]
+A cycle starts at the boot banner; the numbers are the device's millis() from the timing lines, and the
+capture clock gap from the first line of the cycle to the "Dialing" line.
+"""
+
+import pathlib
+import re
+import statistics
+import sys
+
+cap = (
+    pathlib.Path(sys.argv[1]).read_text(encoding="utf-8", errors="replace").splitlines()
+)
+label = sys.argv[2] if len(sys.argv) > 2 else ""
+TS = re.compile(r"^\[(\d\d):(\d\d):(\d\d)(?:\.(\d+))?\]")
+
+
+def secs(line):
+    m = TS.match(line)
+    if not m:
+        return None
+    h, mi, s, f = m.groups()
+    return int(h) * 3600 + int(mi) * 60 + int(s) + (int(f) / 10 ** len(f) if f else 0)
+
+
+cycles = []
+cur = None
+for line in cap:
+    if "rst:0x" in line or (cur is None and "Log initialized" in line):
+        cur = {"start": secs(line), "reset": line.split("]", 1)[-1].strip()[:60]}
+        cycles.append(cur)
+        continue
+    if cur is None:
+        continue
+    if "Dialing" in line:
+        cur.setdefault("dial_cap", secs(line))
+    m = re.search(r"wifi connected at (\d+) ms", line)
+    if m:
+        cur.setdefault("wifi", int(m.group(1)))
+    m = re.search(r"client connected at (\d+) ms \((.*?)\)", line)
+    if m and "client" not in cur:
+        cur["client"] = int(m.group(1))
+        cur["who"] = m.group(2)
+    m = re.search(r"first HA state '(.*?)' at (\d+) ms", line)
+    if m and "state" not in cur:
+        cur["state"] = int(m.group(2))
+
+print(f"{label} cycles: {len(cycles)}")
+print(
+    f"{'n':>2} {'wifi ms':>8} {'dial +ms':>9} {'client ms':>10} {'state ms':>9} {'client-wifi':>11} {'state-client':>12}  client  reset"
+)
+for i, c in enumerate(cycles, 1):
+    dial = ""
+    if c.get("dial_cap") is not None and c.get("start") is not None:
+        dial = f"{(c['dial_cap'] - c['start']) * 1000:.0f}"
+    cw = c["client"] - c["wifi"] if "client" in c and "wifi" in c else ""
+    sc = c["state"] - c["client"] if "state" in c and "client" in c else ""
+    print(
+        f"{i:>2} {c.get('wifi', ''):>8} {dial:>9} {c.get('client', ''):>10} {c.get('state', ''):>9} {cw:>11} {sc:>12}  {c.get('who', '')}  {c.get('reset', '')[:28]}"
+    )
+for c in cycles:
+    if "client" in c and "wifi" in c:
+        c["client-wifi"] = c["client"] - c["wifi"]
+    if "state" in c and "client" in c:
+        c["state-client"] = c["state"] - c["client"]
+for key in ("wifi", "client", "state", "client-wifi", "state-client"):
+    vals = [c[key] for c in cycles if key in c]
+    if vals:
+        print(
+            f"{key}: n={len(vals)} min={min(vals)} median={statistics.median(vals):.0f} max={max(vals)}"
+        )

.agents/skills/hardware-test/scripts/api_outgoing/wificycles.py

@@ -0,0 +1,107 @@
+"""Per Wi-Fi drop timings from a serial capture of the outgoing connection timing config.
+
+usage: wificycles.py CAPTURE [LABEL]
+A cycle starts at "wifi cycle disabling"; the numbers are the device's millis() from the timing lines.
+"dial" says whether the client that connected first came from the device's own dial ("Dialing" seen after the
+reconnect and before the hello) or from an incoming connection ("Accept" seen first).
+"""
+
+import pathlib
+import re
+import statistics
+import sys
+
+cap = (
+    pathlib.Path(sys.argv[1]).read_text(encoding="utf-8", errors="replace").splitlines()
+)
+label = sys.argv[2] if len(sys.argv) > 2 else ""
+TS = re.compile(r"^\[(\d\d):(\d\d):(\d\d)(?:\.(\d+))?\]")
+
+
+def secs(line):
+    m = TS.match(line)
+    if not m:
+        return None
+    h, mi, se, f = m.groups()
+    return int(h) * 3600 + int(mi) * 60 + int(se) + (int(f) / 10 ** len(f) if f else 0)
+
+
+cycles = []
+cur = None
+loop_max = []
+for line in cap:
+    m = re.search(r"loop time max (\d+) ms", line)
+    if m:
+        loop_max.append(int(m.group(1)))
+    if "wifi cycle disabling" in line:
+        cur = {"order": []}
+        cycles.append(cur)
+        continue
+    if cur is None:
+        continue
+    m = re.search(r"wifi connected at (\d+) ms", line)
+    if m and "wifi" not in cur:
+        cur["wifi"] = int(m.group(1))
+        cur["wifi_cap"] = secs(line)
+    if "Dialing" in line:
+        cur["order"].append("dial")
+        cur["dials"] = cur.get("dials", 0) + 1
+        if "dial_cap" not in cur and "wifi_cap" in cur:
+            cur["dial_cap"] = secs(line)
+        elif "dial_cap" not in cur and "dial_before_wifi_cap" not in cur:
+            cur["dial_before_wifi_cap"] = secs(line)
+    if (
+        re.search(r"client disconnected at \d+ ms \(\d+\.\d+\.\d+\.\d+\)", line)
+        and "wifi" in cur
+        and "client" not in cur
+    ):
+        cur["dial_closed"] = cur.get("dial_closed", 0) + 1
+    if "Accept " in line and "wifi" in cur:
+        cur["order"].append("accept")
+    m = re.search(r"client connected at (\d+) ms \((.*?)\)", line)
+    if m and "wifi" in cur and "client" not in cur:
+        cur["client"] = int(m.group(1))
+        cur["who"] = m.group(2).split(" ")[0]
+        cur["via"] = cur["order"][0] if cur["order"] else "?"
+    m = re.search(r"Connect (failed|timeout)", line)
+    if m:
+        cur.setdefault("connect_errors", 0)
+        cur["connect_errors"] += 1
+
+print(f"{label} cycles: {len(cycles)}")
+print(
+    f"{'n':>2} {'wifi ms':>8} {'dial-wifi cap ms':>16} {'client ms':>10} {'client-wifi':>11}  via     dials closed  client"
+)
+for i, c in enumerate(cycles, 1):
+    cw = c["client"] - c["wifi"] if "client" in c and "wifi" in c else ""
+    c["client-wifi"] = cw
+    dw = ""
+    if "wifi_cap" in c and c.get("wifi_cap") is not None:
+        # the first dial of the cycle, whether it was logged before or after the Wi-Fi line
+        if c.get("dial_before_wifi_cap") is not None:
+            dw = f"{(c['dial_before_wifi_cap'] - c['wifi_cap']) * 1000:.0f}"
+        elif "dial_cap" in c and c["dial_cap"] is not None:
+            dw = f"{(c['dial_cap'] - c['wifi_cap']) * 1000:.0f}"
+    c["dial-wifi"] = dw
+    print(
+        f"{i:>2} {c.get('wifi', ''):>8} {dw:>16} {c.get('client', ''):>10} {cw:>11}  {c.get('via', ''):7s} {c.get('dials', 0):>5} {c.get('dial_closed', 0):>6}  {c.get('who', '')}"
+    )
+for via in ("dial", "accept"):
+    vals = [
+        c["client-wifi"]
+        for c in cycles
+        if c.get("via") == via and c["client-wifi"] != ""
+    ]
+    if vals:
+        print(
+            f"client-wifi via {via}: n={len(vals)} min={min(vals)} median={statistics.median(vals):.0f} max={max(vals)}"
+        )
+dws = [float(c["dial-wifi"]) for c in cycles if c.get("dial-wifi") not in ("", None)]
+if dws:
+    print(
+        f"dial after wifi connected (capture clock): n={len(dws)} min={min(dws):.0f} median={statistics.median(dws):.0f} max={max(dws):.0f}"
+    )
+if loop_max:
+    print(
+        f"loop time max per 5 s: n={len(loop_max)} min={min(loop_max)} median={statistics.median(loop_max):.0f} max={max(loop_max)}"
+    )

.agents/skills/hardware-test/scripts/dfrobot_sen0395/cases.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+# cases.sh DEV_IP KEY CAPTURE LABEL : the SEN0395 flow (settings, switches, junk lines, factory reset, reset) against
+# templates/dfrobot-sen0395-dut.yaml, with a serial capture of the device running into CAPTURE
+D=$1; K=$2; LOG=$3; LABEL=$4; PY=${PYTHON:-python3}; CTL="$(dirname "$0")/ctl.py"
+show() { tail -n +$(($1+1)) "$LOG" | sed 's/\x1b\[[0-9;]*m//g' | grep -a 'dfrobot\|Detected\|\[W\]\|\[E\]\|sen\]' | grep -a -v 'JYBSS\|took a long time' | cut -c1-200; }
+step() { n0=$(wc -l < "$LOG"); echo "=== $LABEL: $1 ($(date +%T))"; shift; $PY "$CTL" "$D" "$K" "$@" || { rc=$?; echo "driver failed ($rc), aborting"; exit $rc; }; echo "--- device log:"; show "$n0"; }
+frames() { echo "frames: $(tail -n +$(($1+1)) "$LOG" | grep -a -c 'JYBSS,1') present, $(tail -n +$(($1+1)) "$LOG" | grep -a -c 'JYBSS,0') absent"; }
+n0=$(wc -l < "$LOG"); echo "=== $LABEL: 20 s of frames ($(date +%T))"; sleep 20; frames "$n0"
+step "range 0 to 3 m" "press:Range 0 to 3m" wait:12
+step "range 0 to 9 m" "press:Range 0 to 9m" wait:12
+step "latency 1 s / 2 s" "press:Latency 1s 2s" wait:12
+step "latency 0 / 0" "press:Latency 0 0" wait:12
+step "sensitivity 7" "press:Sensitivity 7" wait:12
+step "LED off then on" "sw:LED=off" wait:10 "sw:LED=on" wait:10
+step "sensor active off then on" "sw:Sensor active=off" wait:10 "sw:Sensor active=on" wait:10
+step "presence via UART off then on" "sw:Presence via UART=off" wait:10 "sw:Presence via UART=on" wait:10
+step "start after boot off then on" "sw:Start after boot=off" wait:10 "sw:Start after boot=on" wait:10
+for n in 100 160 200 220 240 256; do step "junk line of $n bytes" "press:Junk $n" wait:7; done
+step "junk 220 then a command" "press:Junk 220" wait:6 "press:Range 0 to 9m" wait:12
+step "factory reset" "press:Factory reset" wait:15
+step "reset" "press:Reset" wait:15
+n0=$(wc -l < "$LOG"); echo "=== $LABEL: 20 s of frames after ($(date +%T))"; sleep 20; frames "$n0"

.agents/skills/hardware-test/scripts/dfrobot_sen0395/ctl.py

@@ -0,0 +1,63 @@
+"""Drive the SEN0395 test device over the API and print its binary sensor and switch updates.
+usage: ctl.py HOST KEY(- for plaintext) OP [OP ...]   OP: press:NAME | sw:NAME=on|off | wait:SECONDS
+"""
+
+import asyncio
+import sys
+import time
+
+from aioesphomeapi import (
+    APIClient,
+    BinarySensorState,
+    ButtonInfo,
+    SwitchInfo,
+    SwitchState,
+)
+
+HOST, KEY = sys.argv[1], sys.argv[2]
+OPS = sys.argv[3:]
+T0 = time.time()
+
+
+async def main() -> None:
+    c = APIClient(HOST, 6053, None, noise_psk=None if KEY == "-" else KEY)
+    await c.connect(login=True)
+    ents, _ = await c.list_entities_services()
+    by_key = {e.key: e for e in ents}
+    buttons = {e.name: e for e in ents if isinstance(e, ButtonInfo)}
+    switches = {e.name: e for e in ents if isinstance(e, SwitchInfo)}
+
+    def on_state(s) -> None:
+        e = by_key.get(s.key)
+        if isinstance(s, BinarySensorState):
+            print(
+                f"{time.time() - T0:7.3f} BIN {e.name} = {'ON' if s.state else 'off'}"
+            )
+        elif isinstance(s, SwitchState):
+            print(
+                f"{time.time() - T0:7.3f} SW  {e.name} = {'on' if s.state else 'off'}"
+            )
+
+    c.subscribe_states(on_state)
+    await asyncio.sleep(1.0)
+    for op in OPS:
+        kind, _, rest = op.partition(":")
+        if kind == "wait":
+            await asyncio.sleep(float(rest))
+        elif kind == "press":
+            if rest not in buttons:
+                sys.exit(f"no button {rest!r}; have {sorted(buttons)}")
+            print(f"{time.time() - T0:7.3f} >>> press {rest}")
+            c.button_command(buttons[rest].key)
+        elif kind == "sw":
+            name, _, val = rest.partition("=")
+            if name not in switches:
+                sys.exit(f"no switch {name!r}; have {sorted(switches)}")
+            print(f"{time.time() - T0:7.3f} >>> switch {name} {val}")
+            c.switch_command(switches[name].key, val == "on")
+        else:
+            sys.exit(f"unknown op {op!r}")
+    await c.disconnect()
+
+
+asyncio.run(main())

.agents/skills/hardware-test/scripts/entity_icons/api_list.py

@@ -0,0 +1,56 @@
+"""List every entity over the native API with its icon, device class and unit: one sorted JSON line each.
+
+usage: api_list.py HOST KEY OUT
+"""
+
+import asyncio
+import json
+import pathlib
+import sys
+
+from aioesphomeapi import APIClient
+
+HOST, KEY, OUT = sys.argv[1], sys.argv[2], sys.argv[3]
+
+
+async def main() -> None:
+    c = APIClient(HOST, 6053, None, noise_psk=KEY)
+    await c.connect(login=True)
+    ents, _ = await c.list_entities_services()
+    rows = []
+    for e in ents:
+        row = {
+            "type": type(e).__name__,
+            "name": e.name,
+            "object_id": e.object_id,
+            "icon": e.icon,
+        }
+        for k in (
+            "device_class",
+            "unit_of_measurement",
+            "event_types",
+            "options",
+            "mode",
+        ):
+            if hasattr(e, k):
+                v = getattr(e, k)
+                row[k] = (
+                    list(v)
+                    if isinstance(v, (list, tuple))
+                    else (v.name if hasattr(v, "name") else v)
+                )
+        row["entity_category"] = (
+            e.entity_category.name
+            if hasattr(e.entity_category, "name")
+            else e.entity_category
+        )
+        row["disabled_by_default"] = e.disabled_by_default
+        rows.append(row)
+    rows.sort(key=lambda r: (r["type"], r["name"]))
+    with pathlib.Path(OUT).open("w", encoding="utf-8") as f:
+        f.writelines(json.dumps(r, sort_keys=True) + "\n" for r in rows)
+    print(f"{len(rows)} entities listed")
+    await c.disconnect()
+
+
+asyncio.run(main())

.agents/skills/hardware-test/scripts/entity_icons/compare.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+# compare.sh NAME_A NAME_B : diff the readback.sh outputs of two device names (api, web, mqttn and, when present, dump)
+# after replacing each name with DEV. Exit 1 when any pair differs; the diffs stay in cmp-KIND.diff.
+A=$1; B=$2; rc=0
+[ -n "$A" ] && [ -n "$B" ] || { echo "usage: compare.sh NAME_A NAME_B"; exit 2; }
+for k in api web mqttn dump; do
+  ext=jsonl; [ $k = dump ] && ext=txt
+  [ -f "$PWD/$k-$A.$ext" ] && [ -f "$PWD/$k-$B.$ext" ] || { echo "$k: missing"; [ $k = dump ] || rc=1; continue; }
+  sed "s/$A/DEV/g; s/$(echo "$A" | tr - _)/DEV/g" "$PWD/$k-$A.$ext" > "$PWD/cmp-$k-a.txt"
+  sed "s/$B/DEV/g; s/$(echo "$B" | tr - _)/DEV/g" "$PWD/$k-$B.$ext" > "$PWD/cmp-$k-b.txt"
+  if diff -u "$PWD/cmp-$k-a.txt" "$PWD/cmp-$k-b.txt" > "$PWD/cmp-$k.diff"; then echo "$k: identical ($(wc -l < "$PWD/cmp-$k-b.txt" | tr -d ' ') lines)"; else echo "$k: DIFFERS"; head -20 "$PWD/cmp-$k.diff"; rc=1; fi
+done
+exit $rc

.agents/skills/hardware-test/scripts/entity_icons/mqtt_norm.py

@@ -0,0 +1,37 @@
+"""Normalise mosquitto_sub output (topic TAB payload) for one device: drop other devices, replace the name, drop dev block.
+
+usage: mqtt_norm.py IN NAME OUT
+"""
+
+import json
+import pathlib
+import sys
+
+IN, NAME, OUT = sys.argv[1], sys.argv[2], sys.argv[3]
+rows = {}
+with pathlib.Path(IN).open(encoding="utf-8") as f:
+    for line in f:
+        topic, _, payload = line.rstrip("\n").partition("\t")
+        if (
+            f"/{NAME}/" not in topic and not topic.startswith(f"{NAME}/")
+        ) or topic == f"{NAME}/debug":
+            continue
+        topic = topic.replace(NAME, "DEV")
+        try:
+            obj = json.loads(payload)
+        except ValueError:
+            rows[topic] = payload.replace(NAME, "DEV")
+            continue
+        if isinstance(obj, dict):
+            obj.pop("dev", None)
+            obj = {
+                k: (v.replace(NAME, "DEV") if isinstance(v, str) else v)
+                for k, v in obj.items()
+            }
+        rows[topic] = obj
+with pathlib.Path(OUT).open("w", encoding="utf-8") as f:
+    f.writelines(
+        json.dumps({"topic": t, "payload": rows[t]}, sort_keys=True) + "\n"
+        for t in sorted(rows)
+    )
+print(f"{len(rows)} topics for {NAME}")

.agents/skills/hardware-test/scripts/entity_icons/readback.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# readback.sh DEVICE_IP KEY NAME BROKER_HOST [CAPTURE] : record how a device built from templates/entity-icon-dut.yaml
+# reports its entity icons and device classes: the native API listing (api-NAME.jsonl), the retained MQTT discovery
+# payloads and states (mqtt-NAME.txt, normalised to mqttn-NAME.jsonl with the device name replaced and the debug topic
+# dropped), the web_server /events listing plus every REST endpoint with ?detail=all (web-NAME.jsonl) and, when a
+# serial CAPTURE is given, the dump_config Icon and Device Class lines (dump-NAME.txt, timestamps and line numbers
+# removed). KEY as for api_button.py. Outputs go to the working directory; compare two names with compare.sh.
+HERE=$(cd "$(dirname "$0")" && pwd); PY=${PYTHON:-python3}; DEV=$1; KEY=$2; N=$3; B=$4; CAP=$5; rc=0; TAB=$(printf '\t')
+[ -n "$DEV" ] && [ -n "$KEY" ] && [ -n "$N" ] && [ -n "$B" ] || { echo "usage: readback.sh DEVICE_IP KEY NAME BROKER_HOST [CAPTURE]"; exit 2; }
+timeout 12 mosquitto_sub -h "$B" -v -t 'homeassistant/#' -t "$N/#" -F "%t$TAB%p" > "$PWD/mqtt-$N.txt" 2> "$PWD/mqtt-$N.err"
+$PY "$HERE/mqtt_norm.py" "$PWD/mqtt-$N.txt" "$N" "$PWD/mqttn-$N.jsonl" || rc=1
+$PY "$HERE/api_list.py" "$DEV" "$KEY" "$PWD/api-$N.jsonl" || { echo "API listing failed"; rc=1; }
+$PY "$HERE/web_dump.py" "$DEV" "$PWD/web-$N.jsonl" || { echo "web_server dump failed"; rc=1; }
+if [ -n "$CAP" ]; then
+  LC_ALL=C grep -a '\]:   Icon: \|\]:   Device Class: ' "$CAP" | LC_ALL=C sed 's/\x1b\[[0-9;]*m//g; s/^\[[^]]*\]//; s/:[0-9]*\]:/]:/' | sort > "$PWD/dump-$N.txt"
+  echo "dump_config icon lines $(grep -c 'Icon:' "$PWD/dump-$N.txt"), device class lines $(grep -c 'Device Class:' "$PWD/dump-$N.txt")"
+fi
+exit $rc

.agents/skills/hardware-test/scripts/entity_icons/web_dump.py

@@ -0,0 +1,99 @@
+"""Dump the web_server view of every entity: the /events listing (detail all) and each REST endpoint with ?detail=all.
+
+usage: web_dump.py HOST OUT
+"""
+
+import json
+import pathlib
+import socket
+import sys
+import time
+import urllib.parse
+import urllib.request
+
+HOST, OUT = sys.argv[1], sys.argv[2]
+
+
+def sse_listing(seconds: float) -> list[dict]:
+    s = socket.create_connection((HOST, 80), timeout=5)
+    s.sendall(
+        b"GET /events HTTP/1.1\r\nHost: %s\r\nAccept: text/event-stream\r\n\r\n"
+        % HOST.encode()
+    )
+    buf = b""
+    deadline = time.monotonic() + seconds
+    s.settimeout(1.0)
+    while time.monotonic() < deadline:
+        try:
+            data = s.recv(65536)
+        except TimeoutError:
+            continue
+        if not data:
+            break
+        buf += data
+    s.close()
+    head, _, body = buf.partition(b"\r\n\r\n")
+    if b"chunked" in head.lower():
+        out = b""
+        while True:
+            i = body.find(b"\r\n")
+            if i < 0:
+                break
+            size = int(body[:i].split(b";")[0], 16)
+            out += body[i + 2 : i + 2 + size]
+            body = body[i + 2 + size + 2 :]
+            if size == 0:
+                break
+        body = out
+    rows = []
+    for block in body.decode(errors="replace").split("\n\n"):
+        ev, data = None, None
+        for line in block.split("\n"):
+            line = line.rstrip("\r")
+            if line.startswith("event:"):
+                ev = line[6:].strip()
+            elif line.startswith("data:"):
+                data = line[5:].strip()
+        if ev in ("state", "state_detail_all") and data:
+            try:
+                obj = json.loads(data)
+            except ValueError:
+                rows.append({"event": ev, "invalid": data})
+                continue
+            # bare state updates that land inside the window carry no domain; only the listing rows are kept
+            if "domain" in obj:
+                rows.append({"event": ev, **obj})
+    return rows
+
+
+def get_json(url: str) -> dict:
+    """One retry: the ESP8266 async server occasionally leaves a request unanswered."""
+    for attempt in (1, 2):
+        try:
+            with urllib.request.urlopen(url, timeout=5) as resp:
+                return json.loads(resp.read())
+        except TimeoutError:
+            if attempt == 2:
+                raise
+            print(f"retrying {url}", flush=True)
+    return {}
+
+
+rows = sse_listing(6)
+ids = sorted({r["id"] for r in rows if "id" in r})
+rest = []
+for ident in ids:
+    domain, _, obj = ident.partition("/")
+    url = f"http://{HOST}/{domain}/{urllib.parse.quote(obj)}?detail=all"
+    try:
+        rest.append({"url": url.replace(HOST, "HOST"), **get_json(url)})
+    except Exception as e:  # noqa: BLE001
+        rest.append({"url": url.replace(HOST, "HOST"), "error": str(e)})
+    time.sleep(0.3)
+with pathlib.Path(OUT).open("w", encoding="utf-8") as f:
+    f.writelines(
+        json.dumps(r, sort_keys=True) + "\n"
+        for r in sorted(rows, key=lambda r: (r.get("id", ""), r["event"]))
+    )
+    f.writelines(json.dumps(r, sort_keys=True) + "\n" for r in rest)
+print(f"{len(rows)} sse rows, {len(ids)} ids, {len(rest)} rest rows")

.agents/skills/hardware-test/scripts/homeassistant_light/bulb.py

@@ -0,0 +1,78 @@
+"""Read or drive a bulb directly over its own ESPHome API (an HA-side change, independent of the mirror).
+
+usage: bulb.py HOST KEY state | on [brightness 0-1] [ct_mireds|rgb r,g,b] | off | restart
+"""
+
+import asyncio
+import sys
+
+from aioesphomeapi import APIClient, ButtonInfo, LightColorCapability, LightInfo
+
+HOST, KEY, CMD = sys.argv[1], sys.argv[2], sys.argv[3]
+ARGS = sys.argv[4:]
+
+
+async def main() -> None:
+    c = APIClient(HOST, 6053, None, noise_psk=None if KEY == "-" else KEY)
+    await c.connect(login=True)
+    ents, _ = await c.list_entities_services()
+    light = next((e for e in ents if isinstance(e, LightInfo)), None)
+    if light is None:
+        sys.exit("no light entity on this device; is HOST a bulb?")
+    if CMD == "state":
+        fut = asyncio.get_running_loop().create_future()
+
+        def on_state(st):
+            if getattr(st, "key", None) == light.key and not fut.done():
+                fut.set_result(st)
+
+        c.subscribe_states(on_state)
+        st = await asyncio.wait_for(fut, 5)
+        print(
+            f"{light.name}: on={st.state} mode={st.color_mode} bri={st.brightness:.2f} "
+            f"ct={st.color_temperature:.1f} rgb={st.red:.2f}/{st.green:.2f}/{st.blue:.2f} "
+            f"white={st.white:.2f} cold={st.cold_white:.2f} warm={st.warm_white:.2f}"
+        )
+    elif CMD == "on":
+        kw = {"state": True}
+        if ARGS:
+            kw["brightness"] = float(ARGS[0])
+        if len(ARGS) > 1:
+            if "," in ARGS[1]:
+                r, g, b = (float(x) for x in ARGS[1].split(","))
+                kw["rgb"] = (r, g, b)
+                kw["color_mode"] = (
+                    LightColorCapability.RGB
+                    | LightColorCapability.ON_OFF
+                    | LightColorCapability.BRIGHTNESS
+                )
+            else:
+                kw["color_temperature"] = float(ARGS[1])
+                kw["color_mode"] = (
+                    LightColorCapability.COLOR_TEMPERATURE
+                    | LightColorCapability.ON_OFF
+                    | LightColorCapability.BRIGHTNESS
+                )
+        c.light_command(light.key, **kw)
+        print("bulb on", kw)
+    elif CMD == "off":
+        c.light_command(light.key, state=False)
+        print("bulb off")
+    elif CMD == "restart":
+        btn = next(
+            (
+                e
+                for e in ents
+                if isinstance(e, ButtonInfo) and "restart" in e.name.lower()
+            ),
+            None,
+        )
+        if btn is None:
+            sys.exit("no restart button on this device")
+        c.button_command(btn.key)
+        print("bulb restart pressed")
+    await asyncio.sleep(0.5)
+    await c.disconnect()
+
+
+asyncio.run(main())

.agents/skills/hardware-test/scripts/homeassistant_light/heldcase.py

@@ -0,0 +1,71 @@
+"""Held-report cases for esphome#21144 with persistent API connections, so the steps land inside the 3 s fade.
+usage: heldcase.py DEV_IP KEY BULB_IP same|many [BULB_KEY]   (KEY or BULB_KEY of - means plaintext)
+  t0      press "A 50 fade 3s" on the mirror device (3 s fade to 50%)
+  t0+0.7  set the bulb directly to 90% (Home Assistant reports it to the mirror during the fade: held)
+  t0+1.4  same:  press "A 50 fade 3s" again (same target as the running fade)
+          many:  press "A many calls" (16 calls in one loop pass, the last one 100% with a 1 s fade)
+  t0+6.5  read the bulb, press Log state so the mirror prints its state
+"""
+
+import asyncio
+import sys
+import time
+
+from aioesphomeapi import APIClient, ButtonInfo, LightInfo, LightState
+
+DEV, KEY, BULB, CASE = sys.argv[1:5]
+BULB_KEY = sys.argv[5] if len(sys.argv) > 5 else "-"
+if CASE not in ("same", "many"):
+    sys.exit(f"case must be same or many, got {CASE!r}")
+T0 = time.time()
+
+
+def stamp() -> str:
+    return f"{time.time() - T0:6.3f}"
+
+
+async def main() -> None:
+    dev = APIClient(DEV, 6053, None, noise_psk=None if KEY == "-" else KEY)
+    bulb = APIClient(BULB, 6053, None, noise_psk=None if BULB_KEY == "-" else BULB_KEY)
+    await dev.connect(login=True)
+    await bulb.connect(login=True)
+    dents, _ = await dev.list_entities_services()
+    bents, _ = await bulb.list_entities_services()
+    buttons = {e.name: e for e in dents if isinstance(e, ButtonInfo)}
+    blight = next(e for e in bents if isinstance(e, LightInfo))
+    states = {}
+
+    def on_bulb(s) -> None:
+        if isinstance(s, LightState) and s.key == blight.key:
+            states["bulb"] = s
+            print(f"{stamp()} bulb state: on={s.state} bri={s.brightness:.2f}")
+
+    bulb.subscribe_states(on_bulb)
+    await asyncio.sleep(1.0)
+    print(f"{stamp()} >>> bulb to 100% (precondition)")
+    bulb.light_command(blight.key, state=True, brightness=1.0)
+    await asyncio.sleep(4.0)
+    t = time.time()
+    print(f"{stamp()} >>> t0 press A 50 fade 3s")
+    dev.button_command(buttons["A 50 fade 3s"].key)
+    await asyncio.sleep(0.7 - (time.time() - t))
+    print(f"{stamp()} >>> bulb direct to 90%")
+    bulb.light_command(blight.key, state=True, brightness=0.9)
+    await asyncio.sleep(1.4 - (time.time() - t))
+    name = "A 50 fade 3s" if CASE == "same" else "A many calls"
+    print(f"{stamp()} >>> press {name}")
+    dev.button_command(buttons[name].key)
+    await asyncio.sleep(6.5 - (time.time() - t))
+    print(f"{stamp()} >>> press Log state (the mirror's state is in the device log)")
+    dev.button_command(buttons["Log state"].key)
+    await asyncio.sleep(1.0)
+    b = states.get("bulb")
+    print(
+        f"{stamp()} RESULT bulb "
+        + (f"bri={b.brightness:.2f}" if b is not None else "no state")
+    )
+    await dev.disconnect()
+    await bulb.disconnect()
+
+
+asyncio.run(main())

.agents/skills/hardware-test/scripts/ld2450/zonedrive.py

@@ -0,0 +1,85 @@
+"""Drive LD2450 numbers and selects over the API while printing every LD2450 state update.
+usage: zonedrive.py HOST KEY(- for plaintext) OP [OP ...]
+  OP: set:NAME=VALUE | sel:NAME=OPTION | wait:SECONDS | list
+Every state update of an entity whose name contains "LD2450" is printed with a timestamp.
+"""
+
+import asyncio
+import sys
+import time
+
+from aioesphomeapi import (
+    APIClient,
+    NumberInfo,
+    NumberState,
+    SelectInfo,
+    SelectState,
+    SensorInfo,
+    SensorState,
+)
+
+HOST, KEY = sys.argv[1], sys.argv[2]
+OPS = sys.argv[3:]
+T0 = time.time()
+
+
+def stamp() -> str:
+    return f"{time.time() - T0:7.3f}"
+
+
+async def main() -> None:
+    c = APIClient(HOST, 6053, None, noise_psk=None if KEY == "-" else KEY)
+    await c.connect(login=True)
+    ents, _ = await c.list_entities_services()
+    by_key = {e.key: e for e in ents}
+    numbers = {e.name: e for e in ents if isinstance(e, NumberInfo)}
+    selects = {e.name: e for e in ents if isinstance(e, SelectInfo)}
+    sensors = {e.name: e for e in ents if isinstance(e, SensorInfo)}
+
+    def on_state(s) -> None:
+        e = by_key.get(s.key)
+        if e is None or "LD2450" not in e.name:
+            return
+        if isinstance(s, NumberState):
+            print(
+                f"{stamp()} NUM {e.name} = {s.state:.0f}{' (missing)' if s.missing_state else ''}"
+            )
+        elif isinstance(s, SelectState):
+            print(f"{stamp()} SEL {e.name} = {s.state}")
+        elif isinstance(s, SensorState) and "Count" in e.name:
+            print(f"{stamp()} CNT {e.name} = {s.state:.0f}")
+
+    c.subscribe_states(on_state)
+    await asyncio.sleep(1.5)
+    for op in OPS:
+        if op == "list":
+            for n in sorted(numbers):
+                print("number:", n)
+            for n in sorted(selects):
+                print("select:", n, selects[n].options)
+            for n in sorted(sensors):
+                if "Count" in n:
+                    print("sensor:", n)
+            continue
+        kind, _, rest = op.partition(":")
+        if kind == "wait":
+            await asyncio.sleep(float(rest))
+            continue
+        name, _, value = rest.partition("=")
+        if kind == "set":
+            if name not in numbers:
+                sys.exit(f"no number named {name!r}; have {sorted(numbers)}")
+            print(f"{stamp()} >>> set {name} = {value}")
+            c.number_command(numbers[name].key, float(value))
+        elif kind == "sel":
+            if name not in selects:
+                sys.exit(f"no select named {name!r}; have {sorted(selects)}")
+            print(f"{stamp()} >>> select {name} = {value}")
+            c.select_command(selects[name].key, value)
+        else:
+            sys.exit(f"unknown op {op!r}")
+        await asyncio.sleep(0.3)
+    await c.disconnect()
+
+
+asyncio.run(main())

.agents/skills/hardware-test/scripts/mqtt/cases.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+# cases.sh NAME KEY BROKER_HOST SUB_PORT CAPTURE [DEV_HOST] [restart] : subscribe to NAME/# on the broker, send a
+# switch command and an on_message topic, press the 3000 byte publish button over the API (KEY, - for plaintext),
+# optionally restart the local broker (its PID from mosquitto.pid in the working directory, written when it was started
+# with `mosquitto -c mosquitto-ws.conf & echo $! > mosquitto.pid`), and show the device log. Outputs (sub-NAME.txt, mosquitto.out) go to the working directory, which should be the scratch directory.
+N=$1; KEY=$2; B=$3; SP=$4; LOG=$5; DEV=${6:-$1.local}; RESTART=$7; HERE=$(cd "$(dirname "$0")" && pwd); PY=${PYTHON:-python3}; WORK=$PWD
+BTN=$HERE/../api_button.py
+[ -n "$KEY" ] && [ -r "$LOG" ] || { echo "usage: cases.sh NAME KEY BROKER_HOST SUB_PORT CAPTURE [DEV_HOST] [restart] (CAPTURE must be a readable file)"; exit 2; }
+show() { tail -n +$(($1+1)) "$LOG" | sed 's/\x1b\[[0-9;]*m//g' | grep -a 'mqtt\|\[probe:\|cmd payload\|Relay\|\[W\]\|\[E\]\|Guru\|abort\|Backtrace\|ESPHome version' | grep -a -v 'took a long time\|Publish.*Counter\|sensor/counter' | cut -c1-170; }
+pub() { mosquitto_pub -h "$B" -p "$SP" -t "$1" -m "$2" || { echo "mosquitto_pub to $1 failed"; exit 1; }; }
+n0=$(($(wc -l < "$LOG")+0))
+timeout 75 mosquitto_sub -h "$B" -p "$SP" -v -t "$N/#" > "$WORK/sub-$N.txt" 2> "$WORK/sub-$N.err" &
+sub_pid=$!
+sleep 20
+echo "=== $N: command to the switch and the 3000 byte publish ($(date +%T))"
+pub "$N/switch/relay/command" ON; sleep 2
+pub "$N/cmd" "hello-over-$N"; sleep 2
+$PY "$BTN" "$DEV" "$KEY" press "Publish big" || { echo "button press failed"; exit 1; }; sleep 3
+pub "$N/switch/relay/command" OFF; sleep 2
+if [ "$RESTART" = restart ]; then
+  [ -f "$WORK/mosquitto-ws.conf" ] || { echo "no mosquitto-ws.conf in $WORK, cannot restart the broker"; exit 1; }
+  echo "=== $N: broker restart ($(date +%T))"; n1=$(($(wc -l < "$LOG")+0))
+  # Only this run's broker is signalled: its PID comes from mosquitto.pid, written when it was started
+  pid=$(cat "$WORK/mosquitto.pid" 2>/dev/null); [ -n "$pid" ] || { echo "no mosquitto.pid in $WORK, cannot restart the broker"; exit 1; }
+  kill "$pid" || { echo "broker PID $pid is not running, nothing to restart"; exit 1; }; sleep 8
+  nc -z -w 3 "$B" 1883 && { echo "the old broker still answers on 1883 after the kill"; exit 1; }
+  # exec so the PID is the broker's own and no shell stays behind holding the caller's output pipe open
+  (cd "$WORK" && exec mosquitto -c mosquitto-ws.conf > mosquitto.out 2>&1 < /dev/null) &
+  echo $! > "$WORK/mosquitto.pid"; sleep 25
+  for port in $(awk '/^listener/ {print $2}' "$WORK/mosquitto-ws.conf"); do nc -z -w 3 "$B" "$port" || { echo "broker port $port not listening after the restart"; exit 1; }; done
+  tail -n +$((n1+1)) "$LOG" | grep -a -q "MQTT_EVENT_CONNECTED\|\[mqtt:[0-9]*\]: Connected" || { echo "the device did not reconnect after the broker restart"; exit 1; }
+else
+  echo "=== $N: no broker restart (pass 'restart' as the 7th argument for a local broker)"
+fi
+wait $sub_pid; sub_rc=$?
+[ "$sub_rc" = 124 ] || { echo "subscriber ended with status $sub_rc: $(cat "$WORK/sub-$N.err")"; exit 1; }
+echo "--- broker saw ($(grep -c . "$WORK/sub-$N.txt") messages): $(cut -c1-60 "$WORK/sub-$N.txt" | awk '{print $1}' | sort | uniq -c | tr '\n' ';')"
+big=$(grep "^$N/big " "$WORK/sub-$N.txt" | awk '{print length($2)}' | tr '\n' ' ')
+echo "--- big payload bytes seen: $big"
+echo "--- device log:"; show "$n0"
+case " $big " in *" 3000 "*) ;; *) echo "the 3000 byte payload did not reach the broker"; exit 1;; esac
+for want in "Relay ON" "cmd payload: hello-over-$N" "Relay OFF"; do
+  tail -n +$((n0+1)) "$LOG" | grep -a -q "$want" || { echo "the device never logged '$want': the broker to device path failed"; exit 1; }
+done

.agents/skills/hardware-test/scripts/mqtt/cli_tls_check.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+# cli_tls_check.sh TREE [neg] YAML... : run `esphome clean-mqtt` from the checkout TREE for each config, which goes
+# through the same TLS setup in esphome/mqtt.py as `esphome logs` over MQTT, without needing a board. clean-mqtt never
+# exits on its own, so it runs under a 25 s timeout: status 124 after "Connected to MQTT broker!" means the CLI
+# connected. With neg every config must instead fail with CERTIFICATE_VERIFY_FAILED and never connect, so a negative
+# that fails for another reason (bad YAML, broker down) is reported as a failure too. A relative YAML path is taken
+# from the working directory, where the cleanmqtt-NAME.log outputs also go. Exit 1 when any config missed its result.
+TREE=$1; shift; PY=${PYTHON:-python3}; NEG=0
+[ "$1" = neg ] && { NEG=1; shift; }
+[ -d "$TREE/esphome" ] && [ -n "$1" ] || { echo "usage: cli_tls_check.sh TREE [neg] YAML..."; exit 2; }
+bad=0
+for y in "$@"; do
+  case $y in /*) ;; *) y=$PWD/$y;; esac
+  n=$(basename "$y" .yaml); log=$PWD/cleanmqtt-$n.log
+  (cd "$TREE" && PYTHONUNBUFFERED=1 timeout 25 $PY -m esphome clean-mqtt "$y" > "$log" 2>&1); rc=$?
+  if [ "$NEG" = 0 ] && [ "$rc" = 124 ] && grep -q "Connected to MQTT broker" "$log"; then
+    echo "$n: connected"
+  elif [ "$NEG" = 1 ] && grep -q "CERTIFICATE_VERIFY_FAILED" "$log" && ! grep -q "Connected to MQTT broker" "$log"; then
+    echo "$n: rejected (CERTIFICATE_VERIFY_FAILED)"
+  else
+    echo "$n: FAILED (status $rc): $(grep -a -m1 -i 'cannot connect\|error' "$log" | cut -c1-160)"; bad=$((bad+1))
+  fi
+done
+[ "$bad" = 0 ]

.agents/skills/hardware-test/scripts/mqtt/flash_and_drive.sh

@@ -0,0 +1,53 @@
+#!/bin/sh
+# flash_and_drive.sh TREE YAML PORT KEY BROKER_HOST MODE [SUB_PORT] : flash YAML from the checkout TREE over the serial
+# PORT, capture the serial log (cap-NAME.txt in the working directory), wait for the first MQTT connect or TLS error,
+# then drive the device with cases.sh (KEY as for cases.sh, - for a plaintext API). MODE local runs cases.sh with a
+# broker restart (the working directory must hold mosquitto-ws.conf and mosquitto.pid), public runs it without a
+# restart, neg only watches for 100 s (a build that must never connect). SUB_PORT is the plain listener cases.sh
+# subscribes on (default 1883). Ends with connect, disconnect, handshake error and crash counts, the config dump's
+# TLS line, the probe heap lines and the broker listener each connection used. Exit 1 when the capture did not start,
+# the device reached no MQTT event within 90 s (local and public), it crashed, or the mode's own check failed.
+TREE=$1; YAML=$2; PORT=$3; KEY=$4; B=$5; MODE=$6; SP=${7:-1883}
+case $YAML in /*) ;; *) YAML=$PWD/$YAML;; esac
+HERE=$(cd "$(dirname "$0")" && pwd); PY=${PYTHON:-python3}; N=$(basename "$YAML" .yaml); CAP=$PWD/cap-$N.txt; ULOG=$PWD/upload-$N.log
+[ -d "$TREE/esphome" ] && [ -e "$PORT" ] && [ -n "$KEY" ] && [ -n "$B" ] || { echo "usage: flash_and_drive.sh TREE YAML PORT KEY BROKER_HOST local|public|neg [SUB_PORT]"; exit 2; }
+case $MODE in local|public|neg) ;; *) echo "MODE must be local, public or neg"; exit 2;; esac
+pkill -f "[s]erial_capture.py $PORT "; sleep 1
+echo "=== $N: flash ($(date +%T))"
+(cd "$TREE" && PYTHONUNBUFFERED=1 timeout 300 $PY -m esphome upload "$YAML" --device "$PORT" > "$ULOG" 2>&1) || { echo "upload failed"; tail -5 "$ULOG"; exit 1; }
+SECS=200; [ "$MODE" = neg ] && SECS=100
+# a stale capture from an earlier run must not satisfy the wait below
+rm -f "$CAP"
+$PY "$HERE/../serial_capture.py" "$PORT" $SECS "$CAP" > "$PWD/cap-$N.stderr" 2>&1 &
+cap_pid=$!
+i=0; until grep -a -q "MQTT_EVENT_CONNECTED\|\[mqtt:[0-9]*\]: Connected\|mbedtls_ssl_handshake returned\|Failed to verify" "$CAP" 2>/dev/null || [ $i -ge 45 ]; do sleep 2; i=$((i+1)); done
+kill -0 $cap_pid 2>/dev/null && [ -f "$CAP" ] || { echo "serial capture is not running on $PORT"; tail -3 "$PWD/cap-$N.stderr"; exit 1; }
+DEV=$(grep -a -o 'IP Address: [0-9.]*' "$CAP" | head -1 | awk '{print $3}')
+if [ $i -ge 45 ] || [ -z "$DEV" ]; then
+  echo "=== $N: no MQTT event or no IP within 90 s ($(date +%T))"
+  [ "$MODE" = neg ] || { pkill -f "[s]erial_capture.py $PORT "; exit 1; }
+else
+  echo "=== $N: first MQTT event after $((i*2)) s, device $DEV ($(date +%T))"
+fi
+grep -a 'ESPHome version\|\]:   Transport\|\]:   TLS:' "$CAP" | sed 's/\x1b\[[0-9;]*m//g' | cut -c1-120
+rc=0
+case $MODE in
+  local)  PYTHON=$PY sh "$HERE/cases.sh" "$N" "$KEY" "$B" "$SP" "$CAP" "$DEV" restart; rc=$?;;
+  public) PYTHON=$PY sh "$HERE/cases.sh" "$N" "$KEY" "$B" "$SP" "$CAP" "$DEV"; rc=$?;;
+  neg)    sleep 70;;
+esac
+wait $cap_pid
+strip() { sed 's/\x1b\[[0-9;]*m//g'; }
+# count the backend's own events so the result does not depend on on_connect/on_disconnect log lines in the config
+connects=$(grep -a -c 'MQTT_EVENT_CONNECTED' "$CAP"); errors=$(grep -a -c 'mbedtls_ssl_handshake returned\|Failed to verify certificate' "$CAP")
+crashes=$(grep -a -c 'Guru\|abort()\|Backtrace' "$CAP")
+echo "=== $N: connects $connects, disconnects $(grep -a -c 'MQTT_EVENT_DISCONNECTED' "$CAP"), handshake errors $errors, crashes $crashes"
+grep -a 'mbedtls_ssl_handshake returned\|Failed to verify\|esp-tls' "$CAP" | strip | sed 's/^\[[^]]*\]//' | sort | uniq -c | sort -rn | head -4 | cut -c1-150
+grep -a '\[probe:' "$CAP" | strip | sed 's/.*\[probe:[0-9]*\]: //' | sed -n '1p;$p'
+[ -f "$PWD/mosquitto.log" ] && [ -n "$DEV" ] && echo "broker listeners used by $DEV: $(grep "New connection from $DEV" "$PWD/mosquitto.log" | sed 's/.*on port //' | sort | uniq -c | tr '\n' ';')"
+[ "$crashes" = 0 ] || { echo "device crashed $crashes time(s)"; exit 1; }
+if [ "$MODE" = neg ]; then
+  [ "$connects" = 0 ] && [ "$errors" -gt 0 ] || { echo "negative case: expected no connect and a handshake error"; exit 1; }
+else
+  [ "$rc" = 0 ] || { echo "cases.sh failed with status $rc"; exit 1; }
+fi

.agents/skills/hardware-test/scripts/mqtt/make_test_ca.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+# make_test_ca.sh BROKER_IP : a throwaway CA, a server certificate for the broker address and a client certificate
+# (30 days), written into the working directory; run it in the scratch directory where a copy of mosquitto-ws.conf
+# lives. The device config takes ca.crt as certificate_authority (skip_cert_cn_check: true, the name check does not
+# match an address) and client.crt/client.key as client_certificate/client_certificate_key for the listener that
+# requires one; other-ca.crt is a second CA for the negative case. The CA carries basicConstraints and keyUsage
+# because Python's default SSL context (esphome logs, esphome clean-mqtt) rejects a CA without them.
+set -e
+IP=$1
+[ -n "$IP" ] || { echo "usage: make_test_ca.sh BROKER_IP"; exit 2; }
+openssl req -x509 -newkey rsa:2048 -nodes -keyout ca.key -out ca.crt -days 30 -subj "/CN=hwtest-ca" \
+  -addext "basicConstraints=critical,CA:TRUE" -addext "keyUsage=critical,keyCertSign,cRLSign"
+openssl req -newkey rsa:2048 -nodes -keyout server.key -out server.csr -subj "/CN=hwtest-broker"
+printf "subjectAltName=IP:%s\nextendedKeyUsage=serverAuth\n" "$IP" > san.ext
+openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 30 -extfile san.ext
+openssl req -newkey rsa:2048 -nodes -keyout client.key -out client.csr -subj "/CN=hwtest-client"
+printf "extendedKeyUsage=clientAuth\n" > client.ext
+openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 30 -extfile client.ext
+openssl req -x509 -newkey rsa:2048 -nodes -keyout other-ca.key -out other-ca.crt -days 30 -subj "/CN=other-ca" \
+  -addext "basicConstraints=critical,CA:TRUE" -addext "keyUsage=critical,keyCertSign,cRLSign"
+openssl verify -CAfile ca.crt server.crt client.crt

.agents/skills/hardware-test/scripts/mqtt/mosquitto-ws.conf

@@ -0,0 +1,26 @@
+# Copy next to the certificates in the scratch directory and start it there with
+# `mosquitto -c mosquitto-ws.conf & echo $! > mosquitto.pid` (cases.sh restarts that PID): plain MQTT, MQTT over TLS,
+# MQTT over TLS that requires a client certificate, MQTT over WebSocket, and MQTT over WebSocket with TLS
+# (server.crt, server.key, ca.crt from make_test_ca.sh in the same directory). log_type all gives the listener port
+# per connection.
+listener 1883
+protocol mqtt
+listener 8883
+protocol mqtt
+certfile server.crt
+keyfile server.key
+listener 8884
+protocol mqtt
+certfile server.crt
+keyfile server.key
+cafile ca.crt
+require_certificate true
+listener 9001
+protocol websockets
+listener 9002
+protocol websockets
+certfile server.crt
+keyfile server.key
+allow_anonymous true
+log_type all
+log_dest file mosquitto.log

.agents/skills/hardware-test/scripts/serial_capture.py

@@ -1,6 +1,6 @@
 """Bounded, timestamped serial capture that always exits and closes the port.
 
-  serial_capture.py PORT SECONDS OUTFILE [--baud 115200] [--released] [--reset] [--append]
+  serial_capture.py PORT SECONDS OUTFILE [--baud 115200] [--released] [--reset] [--append] [--ms]
 
   default      open with DTR/RTS as pyserial leaves them (asserted); fine for ESP devkits and the Pico.
   --released   drive DTR and RTS low before opening: the BW15 and BK7238 CH340 kits strap the boot pin
@@ -76,14 +76,21 @@ def open_port(args: argparse.Namespace, path: str) -> serial.Serial:
     return s
 
 
-def write_line(out, tag: bytes, data: bytes) -> None:
-    stamp = time.strftime("[%H:%M:%S]").encode()
+def write_line(out, tag: bytes, data: bytes, ms: bool = False) -> None:
+    if ms:
+        now = time.time()
+        stamp = (
+            time.strftime("[%H:%M:%S", time.localtime(now))
+            + f".{int(now * 1000) % 1000:03d}]"
+        ).encode()
+    else:
+        stamp = time.strftime("[%H:%M:%S]").encode()
     out.write(stamp + tag + ANSI.sub(b"", SECRET.sub(b"<secret>", data)) + b"\n")
     out.flush()
 
 
-def note(out, text: str) -> None:
-    write_line(out, b"[capture] ", text.encode())
+def note(out, text: str, ms: bool = False) -> None:
+    write_line(out, b"[capture] ", text.encode(), ms)
 
 
 def capture(args: argparse.Namespace, out) -> int:
@@ -102,18 +109,18 @@ def capture(args: argparse.Namespace, out) -> int:
                 if serial_number is None:
                     serial_number, index = identify(path)
                 if path != args.port:
-                    note(out, f"reopened as {path}")
+                    note(out, f"reopened as {path}", args.ms)
             except PORT_ERRORS as err:
-                note(out, f"open failed: {err}")
+                note(out, f"open failed: {err}", args.ms)
                 time.sleep(1)
                 continue
         try:
             data = s.read(4096)
         except PORT_ERRORS as err:
             if buf:  # keep the cut-off line apart from the next boot's first line
-                write_line(out, b"[partial]", buf)
+                write_line(out, b"[partial]", buf, args.ms)
                 buf = b""
-            note(out, f"port lost: {err}")
+            note(out, f"port lost: {err}", args.ms)
             with contextlib.suppress(*PORT_ERRORS):
                 s.close()
             s = None
@@ -125,9 +132,9 @@ def capture(args: argparse.Namespace, out) -> int:
         buf += data
         while b"\n" in buf:
             line, buf = buf.split(b"\n", 1)
-            write_line(out, b"", line.rstrip(b"\r"))
+            write_line(out, b"", line.rstrip(b"\r"), args.ms)
     if buf:
-        write_line(out, b"[partial]", buf)
+        write_line(out, b"[partial]", buf, args.ms)
     if s is not None:
         s.close()
     return received
@@ -144,6 +151,7 @@ def main() -> int:
     ap.add_argument("--released", action="store_true")
     ap.add_argument("--reset", action="store_true")
     ap.add_argument("--append", action="store_true")
+    ap.add_argument("--ms", action="store_true", help="millisecond timestamps")
     args = ap.parse_args()
     with pathlib.Path(args.outfile).open("ab" if args.append else "wb") as out:
         received = capture(args, out)

.agents/skills/hardware-test/scripts/speaker_media_player/cases.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# cases.sh HOST KEY MEDIA_URL ANN_URL CAPTURE LABEL : three play, announce, stop cycles on a speaker media player with the
+# "Task names" probe button pressed idle, during media, during the announcement, after it and after the stop.
+# KEY of - is plaintext. Serve FLAC files with `python3 -m http.server 8765 --directory www` (audio_http refuses WAV and MP3).
+H=$1; K=$2; MEDIA=$3; ANN=$4; LOG=$5; LABEL=$6; PY=${PYTHON:-python3}; HERE=$(dirname "$0")
+[ -r "$LOG" ] || { echo "usage: cases.sh HOST KEY MEDIA_URL ANN_URL CAPTURE LABEL (CAPTURE must be a readable file)"; exit 2; }
+show() { tail -n +$(($1+1)) "$LOG" | sed 's/\x1b\[[0-9;]*m//g' | grep -a '\[tasks:\|speaker_media_player\|speaker_mixer\|\[W\]\|\[E\]\|Guru\|abort\|Backtrace' | grep -a -v 'took a long time' | cut -c1-180; }
+for cycle in 1 2 3; do
+  n0=$(wc -l < "$LOG"); echo "=== $LABEL cycle $cycle ($(date +%T))"
+  $PY "$HERE/drive.py" "$H" "$K" "press:Task names" wait:1 "play:$MEDIA" wait:5 "press:Task names" wait:1 "ann:$ANN" wait:1.5 "press:Task names" wait:5 "press:Task names" wait:1 stop wait:3 "press:Task names" || { rc=$?; echo "driver failed ($rc), aborting"; exit $rc; }
+  sleep 1; echo "--- device log:"; show "$n0"
+done

.agents/skills/hardware-test/scripts/speaker_media_player/drive.py

@@ -0,0 +1,50 @@
+"""Drive the speaker platform media player (the first media player found) over one API connection.
+
+usage: drive.py HOST KEY op [op ...]
+ops: play:URL | ann:URL | stop | press:BUTTON | wait:S
+"""
+
+import asyncio
+import sys
+
+from aioesphomeapi import APIClient, ButtonInfo, MediaPlayerCommand, MediaPlayerInfo
+
+HOST, KEY, OPS = sys.argv[1], sys.argv[2], sys.argv[3:]
+
+
+async def main() -> None:
+    c = APIClient(HOST, 6053, None, noise_psk=None if KEY == "-" else KEY)
+    await c.connect(login=True)
+    try:
+        await run_ops(c)
+    finally:
+        await c.disconnect()
+
+
+async def run_ops(c: APIClient) -> None:
+    ents, _ = await c.list_entities_services()
+    player = next((e for e in ents if isinstance(e, MediaPlayerInfo)), None)
+    if player is None:
+        sys.exit("no media player on this device")
+    buttons = {e.name: e for e in ents if isinstance(e, ButtonInfo)}
+    for op in OPS:
+        kind, _, rest = op.partition(":")
+        print(f"{asyncio.get_running_loop().time():.1f} {op}", flush=True)
+        if kind == "play":
+            c.media_player_command(player.key, media_url=rest)
+        elif kind == "ann":
+            c.media_player_command(player.key, media_url=rest, announcement=True)
+        elif kind == "stop":
+            c.media_player_command(player.key, command=MediaPlayerCommand.STOP)
+        elif kind == "press":
+            if rest not in buttons:
+                sys.exit(f"no button {rest!r}; have {sorted(buttons)}")
+            c.button_command(buttons[rest].key)
+        elif kind == "wait":
+            await asyncio.sleep(float(rest))
+        else:
+            sys.exit(f"unknown op {op!r}")
+    await asyncio.sleep(0.5)
+
+
+asyncio.run(main())

.agents/skills/hardware-test/scripts/udp/check.py

@@ -0,0 +1,40 @@
+"""Compare the listener log (JSON lines from udp_listen.py) against the udp-write-dut.yaml payload sequence.
+
+usage: check.py LISTEN_JSONL ECHO_HEX  (ECHO_HEX is the datagram sent to the device for the echo case)
+"""
+
+import json
+import pathlib
+import sys
+
+with pathlib.Path(sys.argv[1]).open(encoding="utf-8") as f:
+    log = [json.loads(line) for line in f if line.strip()]
+echo_in = bytes.fromhex(sys.argv[2])
+small = bytes([0xAA, 0x55, 0x01, 0x02])
+expected = [
+    ("small 1/2", small),
+    ("small 2/2", small),
+    ("simple", bytes([1, 2, 3])),
+    ("text", b"hello udp"),
+    ("empty", b""),
+    ("stack128", bytes((0x10 + i) & 0xFF for i in range(128))),
+    ("heap129", bytes((0x20 + i) & 0xFF for i in range(129))),
+    ("heap600", bytes((0x30 + i) & 0xFF for i in range(600))),
+    ("lambda300", bytes((i * 7) & 0xFF for i in range(300))),
+    ("echo", echo_in[::-1]),
+]
+got = [bytes.fromhex(e["hex"]) for e in log]
+ok = 0
+for i, (name, want) in enumerate(expected):
+    have = got[i] if i < len(got) else None
+    res = (
+        "OK"
+        if have == want
+        else f"MISMATCH got {None if have is None else have[:16].hex() + '... len ' + str(len(have))}"
+    )
+    ok += res == "OK"
+    print(f"{name:10s} {len(want):4d} B  {res}")
+print(
+    f"{ok}/{len(expected)} payloads byte-exact, {len(got)} datagrams received, sources {sorted({e['src'] for e in log})}"
+)
+sys.exit(0 if ok == len(expected) and len(got) == len(expected) else 1)

.agents/skills/hardware-test/scripts/udp/udp_listen.py

@@ -0,0 +1,32 @@
+"""Log every datagram on PORT for SECONDS as one JSON line: time, source, length, hex payload."""
+
+import json
+import pathlib
+import socket
+import sys
+import time
+
+port, secs, out = int(sys.argv[1]), float(sys.argv[2]), sys.argv[3]
+s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+s.bind(("", port))
+s.settimeout(1.0)
+end = time.monotonic() + secs
+with pathlib.Path(out).open("w", encoding="utf-8") as f:
+    while time.monotonic() < end:
+        try:
+            data, (ip, sport) = s.recvfrom(65535)
+        except TimeoutError:
+            continue
+        f.write(
+            json.dumps(
+                {
+                    "t": time.strftime("%H:%M:%S"),
+                    "src": ip,
+                    "len": len(data),
+                    "hex": data.hex(),
+                }
+            )
+            + "\n"
+        )
+        f.flush()

.agents/skills/hardware-test/scripts/udp/write_cases.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+# write_cases.sh DEVICE_IP KEY [PORT] : drive a device built from templates/udp-write-dut.yaml. Records every datagram
+# the device sends to PORT (the udp component's port, default 18511) with udp_listen.py in the working directory,
+# presses the eight payload buttons over the API two seconds apart (KEY as for api_button.py, - for a plaintext API),
+# sends one 16 byte unicast datagram to the device for the echo case, then compares the recorded datagrams with
+# check.py. The recorder runs until the driver stops it. Exit 1 when the recorder did not start or a payload is
+# missing or differs; listen.jsonl stays in the working directory.
+HERE=$(cd "$(dirname "$0")" && pwd); PY=${PYTHON:-python3}; DEV=$1; KEY=$2; PORT=${3:-18511}
+[ -n "$DEV" ] && [ -n "$KEY" ] || { echo "usage: write_cases.sh DEVICE_IP KEY [PORT]"; exit 2; }
+ECHO=0102030405060708090a0b0c0d0e0f10
+rm -f "$PWD/listen.jsonl"
+$PY "$HERE/udp_listen.py" "$PORT" 600 "$PWD/listen.jsonl" &
+lst=$!
+sleep 2
+kill -0 $lst 2>/dev/null || { echo "udp_listen.py is not running on port $PORT"; exit 1; }
+for b in Small Simple Text Empty Stack128 Heap129 Heap600 Lambda300; do
+  $PY "$HERE/../api_button.py" "$DEV" "$KEY" press "$b" > /dev/null || echo "press $b failed"; sleep 2
+done
+$PY -c "import socket; socket.socket(socket.AF_INET, socket.SOCK_DGRAM).sendto(bytes.fromhex('$ECHO'), ('$DEV', $PORT))"
+sleep 5
+kill $lst 2>/dev/null; wait $lst 2>/dev/null
+$PY "$HERE/check.py" "$PWD/listen.jsonl" "$ECHO"

.agents/skills/hardware-test/scripts/usb_audio/playurl.py

@@ -0,0 +1,30 @@
+"""Play a URL on the speaker_source media player over the API (no sync task involved).
+
+usage: playurl.py HOST KEY URL [PLAYER_NAME]
+"""
+
+import asyncio
+import sys
+
+from aioesphomeapi import APIClient, MediaPlayerInfo
+
+HOST, KEY, URL = sys.argv[1], sys.argv[2], sys.argv[3]
+PLAYER = sys.argv[4] if len(sys.argv) > 4 else "Player"
+
+
+async def main() -> None:
+    c = APIClient(HOST, 6053, None, noise_psk=KEY)
+    await c.connect(login=True)
+    ents, _ = await c.list_entities_services()
+    players = {e.name: e for e in ents if isinstance(e, MediaPlayerInfo)}
+    print("media players:", sorted(players))
+    if PLAYER not in players:
+        sys.exit(f"no media player named {PLAYER!r}; have {sorted(players)}")
+    p = players[PLAYER]
+    c.media_player_command(p.key, media_url=URL)
+    print("sent play_media to", PLAYER)
+    await asyncio.sleep(1)
+    await c.disconnect()
+
+
+asyncio.run(main())

.agents/skills/hardware-test/scripts/web_server/httpd_cases.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+# httpd_cases.sh HOST USER PASS LABEL CAPTURE : HTTPD task stack load for the web_server_idf task size; probe lines from
+# CAPTURE, SSE client output into the working directory. A failed step ends the run with its status.
+H=$1; U=$2; P=$3; LABEL=$4; LOG=$5; HERE=$(dirname "$0")
+[ -r "$LOG" ] || { echo "usage: httpd_cases.sh HOST USER PASS LABEL CAPTURE (CAPTURE must be a readable file)"; exit 2; }
+probes() { tail -n +$(($1+1)) "$LOG" | sed 's/\x1b\[[0-9;]*m//g' | grep -a -o "\[[0-9:]*\]\[I\]\[probe:[0-9]*\]: .*httpd min free stack [0-9]*\|\[[0-9:]*\]\[[WE]\]\[[a-z_.]*:[0-9]*\].*\|Guru.*" | grep -a -v "took a long time\|does not fit\|\]\[httpd\]: /" | sed 's/\[I\]\[probe:[0-9]*\]: loopTask min free stack \([0-9]*\), httpd min free stack \([0-9]*\)/ loop \1 httpd \2/' | uniq -f1 | cut -c1-140; }
+step() { n0=$(wc -l < "$LOG"); echo "=== $LABEL: $1 ($(date +%T))"; shift; "$@" || { rc=$?; echo "step failed ($rc)"; exit $rc; }; echo "--- device log:"; probes "$n0"; }
+step "idle 15 s" sleep 15
+step "request mix, 20 rounds" sh "$HERE/httpmix.sh" "$H" "$U" "$P" 20
+# Two SSE clients next to the request mix; arguments stay quoted, nothing is reparsed as shell code
+concurrent() {
+  sh "$HERE/ssecurl.sh" "$H" "$U" "$P" 40 "$PWD/sse1-$LABEL.txt" & p1=$!
+  sh "$HERE/ssecurl.sh" "$H" "$U" "$P" 40 "$PWD/sse2-$LABEL.txt" & p2=$!
+  sh "$HERE/httpmix.sh" "$H" "$U" "$P" 12 && wait $p1 && wait $p2
+}
+step "2 SSE clients 40 s with the request mix alongside" concurrent
+step "idle 15 s after" sleep 15

.agents/skills/hardware-test/scripts/web_server/httpmix.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+# httpmix.sh HOST USER PASS ROUNDS : authenticated request mix (curl --anyauth follows the server's Basic or Digest
+# challenge): page, two json endpoints, a switch POST, a 404, an unauthenticated 401 and a 2 s SSE stream per round
+H=$1; U=$2; P=$3; N=$4; ok=0; bad=0
+# chk EXPECTED LABEL curl-args... : only LABEL is printed on a miss, never the argument list with the credentials
+chk() { exp=$1; label=$2; shift 2; c=$(curl -s -m 6 -o /dev/null -w "%{http_code}" "$@"); if [ "$c" = "$exp" ]; then ok=$((ok+1)); else bad=$((bad+1)); echo "expected $exp got $c: $label"; fi; }
+sse_tmp=$(mktemp)
+for i in $(seq 1 $N); do
+  page=$(curl -s -m 6 -o /dev/null -w "%{http_code}" -u "$U:$P" --anyauth "http://$H/")
+  if [ "$page" = 200 ]; then ok=$((ok+1)); else bad=$((bad+1)); echo "expected 200 got $page: /"; fi
+  chk 200 "GET /sensor/Fast%201" -u "$U:$P" --anyauth "http://$H/sensor/Fast%201"
+  chk 200 "GET /text_sensor/Big" -u "$U:$P" --anyauth "http://$H/text_sensor/Big"
+  chk 200 "GET /switch/Toggle" -u "$U:$P" --anyauth "http://$H/switch/Toggle"
+  chk 200 "POST /switch/Toggle/toggle" -u "$U:$P" --anyauth -X POST -H "Content-Length: 0" "http://$H/switch/Toggle/toggle"
+  # The IDF server closes an unknown path without a response: curl ends with 52 (empty reply) or 56 (reset), never a
+  # timeout (28) or a refused connection (7); only trust the close when the page just answered
+  c=$(curl -s -m 6 -o /dev/null -w "%{http_code}" -u "$U:$P" --anyauth "http://$H/nonexistent"); rc=$?
+  if [ "$c" = 000 ] && [ "$page" = 200 ] && { [ "$rc" = 52 ] || [ "$rc" = 56 ]; }; then ok=$((ok+1)); else bad=$((bad+1)); echo "unknown path: got $c, curl status $rc, with the page at $page"; fi
+  chk 401 "GET / without credentials" "http://$H/"
+  timeout 2 curl -s -N -u "$U:$P" --anyauth -o "$sse_tmp" "http://$H/events" 2>/dev/null; rc=$?
+  if [ "$rc" = 124 ] && grep -q "^event: state" "$sse_tmp"; then ok=$((ok+1)); else bad=$((bad+1)); echo "SSE stream: curl status $rc, $(grep -c '^event: state' "$sse_tmp") state events"; fi
+  sleep 1
+done
+rm -f "$sse_tmp"
+echo "httpmix: $ok ok, $bad unexpected"
+[ "$bad" = 0 ]

.agents/skills/hardware-test/scripts/web_server/sse.py

@@ -0,0 +1,187 @@
+"""SSE client(s) for a web_server /events stream: counts state events and checks each is valid JSON.
+
+usage: sse.py HOST SECONDS [--clients N] [--stall] [--churn CYCLES]
+--stall opens one extra connection that never reads (the device's socket buffer fills); --churn opens
+and abruptly closes a connection CYCLES times, 2 s apart, next to the reading clients.
+"""
+
+import argparse
+from collections import Counter
+import contextlib
+import json
+import socket
+import sys
+import threading
+import time
+
+ap = argparse.ArgumentParser()
+ap.add_argument("host")
+ap.add_argument("seconds", type=float)
+ap.add_argument("--clients", type=int, default=1)
+ap.add_argument("--stall", action="store_true")
+ap.add_argument("--churn", type=int, default=0)
+args = ap.parse_args()
+
+REQ = b"GET /events HTTP/1.1\r\nHost: %s\r\nAccept: text/event-stream\r\nConnection: keep-alive\r\n\r\n"
+
+
+def read_chunked(sock, deadline, on_line):
+    """Decode HTTP chunked transfer encoding and feed complete event-stream lines to on_line."""
+    buf = b""
+    body = b""
+    headers_done = False
+    sock.settimeout(1.0)
+    while time.monotonic() < deadline:
+        try:
+            data = sock.recv(65536)
+        except TimeoutError:
+            continue
+        if not data:
+            return "closed"
+        buf += data
+        if not headers_done:
+            i = buf.find(b"\r\n\r\n")
+            if i < 0:
+                continue
+            headers_done = True
+            buf = buf[i + 4 :]
+        while True:
+            i = buf.find(b"\r\n")
+            if i < 0:
+                break
+            size = int(buf[:i].split(b";")[0], 16)
+            if len(buf) < i + 2 + size + 2:
+                break
+            body += buf[i + 2 : i + 2 + size]
+            buf = buf[i + 2 + size + 2 :]
+            if size == 0:
+                return "closed"
+        while b"\n" in body:
+            line, body = body.split(b"\n", 1)
+            on_line(line.rstrip(b"\r"))
+    return "deadline"
+
+
+class Client(threading.Thread):
+    def __init__(self, idx, seconds):
+        super().__init__(daemon=True)
+        self.idx = idx
+        self.seconds = seconds
+        self.events = Counter()
+        self.ids = Counter()
+        self.invalid = 0
+        self.max_data = 0
+        self.bytes = 0
+        self.end = "?"
+        self.cur_event = None
+
+    def on_line(self, line):
+        self.bytes += len(line) + 1
+        if line.startswith(b"event:"):
+            self.cur_event = line[6:].strip().decode()
+        elif line.startswith(b"data:"):
+            ev = self.cur_event or "message"
+            self.events[ev] += 1
+            data = line[5:].strip()
+            self.max_data = max(self.max_data, len(data))
+            if ev in ("state", "state_detail_all"):
+                try:
+                    obj = json.loads(data)
+                    self.ids[obj.get("id", "?")] += 1
+                except ValueError:
+                    self.invalid += 1
+        elif line == b"":
+            self.cur_event = None
+
+    def run(self):
+        try:
+            s = socket.create_connection((args.host, 80), timeout=5)
+            s.sendall(REQ % args.host.encode())
+            self.end = read_chunked(s, time.monotonic() + self.seconds, self.on_line)
+            s.close()
+        except (OSError, ValueError) as e:
+            self.end = f"error: {e}"
+
+
+clients = [Client(i, args.seconds) for i in range(args.clients)]
+for c in clients:
+    c.start()
+    time.sleep(0.3)
+
+stall_sock = None
+if args.stall:
+    # The window scale is negotiated in the SYN, so the small buffer must be set before connect()
+    stall_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    stall_sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 2048)
+    stall_sock.settimeout(5)
+    stall_sock.connect((args.host, 80))
+    stall_sock.sendall(REQ % args.host.encode())
+    print("stalled client opened (never reads)", flush=True)
+
+churn_done = 0
+for _ in range(args.churn):
+    try:
+        cs = socket.create_connection((args.host, 80), timeout=5)
+        cs.sendall(REQ % args.host.encode())
+        cs.settimeout(1.0)
+        with contextlib.suppress(TimeoutError):
+            cs.recv(4096)
+        cs.setsockopt(
+            socket.SOL_SOCKET, socket.SO_LINGER, b"\x01\x00\x00\x00\x00\x00\x00\x00"
+        )  # RST on close
+        cs.close()
+        churn_done += 1
+    except OSError as e:
+        print("churn error", e, flush=True)
+    time.sleep(2)
+if args.churn:
+    print(f"churn: {churn_done}/{args.churn} abrupt closes", flush=True)
+
+for c in clients:
+    c.join()
+stall_closed = None
+if stall_sock is not None:
+    # Drain what the small buffer holds: a close shows as b"" or a reset after it. A session the device left
+    # open keeps feeding events, so the drain has its own deadline and data past it means "still open".
+    stall_sock.settimeout(2.0)
+    drain_deadline = time.monotonic() + 5.0
+    try:
+        while stall_sock.recv(65536):
+            if time.monotonic() > drain_deadline:
+                break
+        else:
+            stall_closed = True
+    except TimeoutError:
+        pass
+    except OSError:
+        stall_closed = True
+    if stall_closed is None:
+        stall_closed = False
+    print(
+        "stalled client: closed by device"
+        if stall_closed
+        else "stalled client: still open",
+        flush=True,
+    )
+    stall_sock.close()
+
+for c in clients:
+    states = c.events["state"]
+    print(
+        f"client {c.idx}: {c.end}, {states} state events, {c.invalid} invalid JSON, max data {c.max_data} B, "
+        f"{c.bytes} B, other events { {k: v for k, v in c.events.items() if k != 'state'} }",
+        flush=True,
+    )
+    print("  per id:", dict(sorted(c.ids.items())), flush=True)
+
+failed = [
+    c for c in clients if c.end != "deadline" or c.invalid or not c.events["state"]
+]
+if failed:
+    sys.exit(
+        f"{len(failed)} client(s) did not run clean to the deadline with valid state events"
+    )
+if stall_closed is False:
+    sys.exit("stalled session was not closed by the device")
+if churn_done < args.churn:
+    sys.exit(f"only {churn_done} of {args.churn} churn connections were made")

.agents/skills/hardware-test/scripts/web_server/sse_cases.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# sse_cases.sh HOST KEY LABEL CAPTURE : the SSE cases against templates/web-server-sse-dut.yaml with a console capture
+# running into CAPTURE; KEY is the API key (- for plaintext). The burst client output goes to the working directory.
+H=$1; K=$2; LABEL=$3; LOG=$4; PY=${PYTHON:-python3}; HERE=$(dirname "$0"); BTN=$HERE/../api_button.py
+[ -r "$LOG" ] || { echo "usage: sse_cases.sh HOST KEY LABEL CAPTURE (CAPTURE must be a readable file)"; exit 2; }
+show() { tail -n +$(($1+1)) "$LOG" | sed 's/\x1b\[[0-9;]*m//g' | grep -a '\[probe:\|\[W\]\|\[E\]\|web_server\|Guru\|abort\|Backtrace\|ESPHome version' | grep -a -v 'took a long time' | cut -c1-200; }
+step() { n0=$(wc -l < "$LOG"); echo "=== $LABEL: $1 ($(date +%T))"; shift; "$@" || { rc=$?; echo "client failed ($rc), aborting"; exit $rc; }; echo "--- device log:"; show "$n0"; }
+step "idle 15 s, no client" sleep 15
+step "1 client 60 s" $PY "$HERE/sse.py" "$H" 60 --clients 1
+step "4 clients 60 s" $PY "$HERE/sse.py" "$H" 60 --clients 4
+step "1 reader plus a stalled client 45 s" $PY "$HERE/sse.py" "$H" 45 --clients 1 --stall
+step "1 reader plus 10 abrupt closes 30 s" $PY "$HERE/sse.py" "$H" 30 --clients 1 --churn 10
+n0=$(wc -l < "$LOG"); echo "=== $LABEL: 2 clients 25 s with the Burst button at 5 s ($(date +%T))"
+$PY "$HERE/sse.py" "$H" 25 --clients 2 > "$PWD/burst-$LABEL.txt" 2>&1 &
+pid=$!
+sleep 5; $PY "$BTN" "$H" "$K" press "Burst" || { echo "button press failed"; exit 1; }
+wait $pid || { cat "$PWD/burst-$LABEL.txt"; echo "SSE clients failed during the burst"; exit 1; }
+cat "$PWD/burst-$LABEL.txt"; echo "--- device log:"; show "$n0"
+step "idle 15 s after" sleep 15

.agents/skills/hardware-test/scripts/web_server/ssecurl.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+# ssecurl.sh HOST USER PASS SECONDS OUT : one authenticated SSE client through curl; counts state events and checks JSON
+H=$1; U=$2; P=$3; T=$4; OUT=$5
+timeout "$T" curl -sS -f -N -u "$U:$P" --anyauth "http://$H/events" > "$OUT"; rc=$?
+[ "$rc" = 124 ] || { echo "sse: curl ended with status $rc before the $T s deadline"; exit 1; }
+python3 - "$OUT" <<'PY'
+import json, sys
+states = invalid = 0; biggest = 0; ev = None
+data = open(sys.argv[1], "rb").read()
+lines = data.split(b"\n")
+if not data.endswith(b"\n"):
+    lines = lines[:-1]  # the deadline can cut the last line in half; only complete lines are checked
+for line in lines:
+    line = line.rstrip(b"\r")
+    if line.startswith(b"event:"):
+        ev = line[6:].strip()
+    elif line.startswith(b"data:") and ev == b"state":
+        states += 1; d = line[5:].strip(); biggest = max(biggest, len(d))
+        try: json.loads(d)
+        except ValueError: invalid += 1
+    elif line == b"":
+        ev = None
+print(f"sse: {states} state events, {invalid} invalid JSON, largest {biggest} B")
+sys.exit(1 if invalid or not states else 0)
+PY

.agents/skills/hardware-test/templates/aux-2-preprod-speaker-player-dut.yaml

@@ -0,0 +1,66 @@
+# Needs packages/aux-2-pre-prod.yaml from NabuCasa/aux-2 at commit 283f2e64 next to this file (see
+# reference/recipes/usb_audio.md). The AUX-2 package with the package's speaker_source player swapped for the speaker
+# platform player, which is the one built on speaker/media_player/audio_pipeline.cpp, plus the task name probe.
+
+packages:
+  core: !include aux-2-pre-prod.yaml
+
+esphome:
+  name: aux-2-dut
+  name_add_mac_suffix: false
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+
+api:
+  encryption:
+    key: !secret api_key
+
+logger:
+  level: DEBUG
+
+sendspin:
+  unpaired_access: true
+
+media_player:
+  - id: !remove external_media_player
+  - platform: speaker
+    id: speaker_media_player
+    name: Media Player
+    volume_increment: 0.05
+    volume_min: 0.4
+    volume_max: 0.85
+    announcement_pipeline:
+      speaker: announcement_resampling_speaker
+      format: FLAC
+      num_channels: 1
+      sample_rate: 48000
+    media_pipeline:
+      speaker: media_resampling_speaker
+      format: FLAC
+      num_channels: 2
+      sample_rate: 48000
+    on_announcement:
+      - mixer_speaker.apply_ducking:
+          id: media_mixing_input
+          decibel_reduction: 20
+          duration: 0.0s
+
+button:
+  - platform: template
+    name: Task names
+    on_press:
+      - lambda: |-
+          static const char *const NAMES[] = {"ann_read", "ann_decode", "med_read", "med_decode"};
+          for (const char *n : NAMES) {
+            TaskHandle_t h = xTaskGetHandle(n);
+            if (h == nullptr) {
+              ESP_LOGI("tasks", "%s: missing", n);
+            } else {
+              ESP_LOGI("tasks", "%s: found as '%s', stack high water %u", n, pcTaskGetName(h),
+                       (unsigned) uxTaskGetStackHighWaterMark(h));
+            }
+          }
+          ESP_LOGI("tasks", "internal free %u, largest block %u", (unsigned) heap_caps_get_free_size(MALLOC_CAP_INTERNAL),
+                   (unsigned) heap_caps_get_largest_free_block(MALLOC_CAP_INTERNAL));

.agents/skills/hardware-test/templates/aux-2-preprod-stock-dut.yaml

@@ -0,0 +1,23 @@
+# Needs packages/aux-2-pre-prod.yaml from NabuCasa/aux-2 at commit 283f2e64 next to this file, with its local
+# external_components source pointed at github://NabuCasa/aux-2@main (see reference/recipes/usb_audio.md).
+# Nabu Casa Connect AUX-2 on the usb_audio PR tree: stock package (I2S PCM5122 output) as a control.
+packages:
+  core: !include aux-2-pre-prod.yaml
+
+esphome:
+  name: aux-2-dut
+  name_add_mac_suffix: false
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+
+api:
+  encryption:
+    key: !secret api_key
+
+logger:
+  level: DEBUG
+
+sendspin:
+  unpaired_access: true

.agents/skills/hardware-test/templates/aux-2-preprod-usb-audio-dut.yaml

@@ -0,0 +1,39 @@
+# Needs packages/aux-2-pre-prod.yaml from NabuCasa/aux-2 at commit 283f2e64 next to this file, with its local
+# external_components source pointed at github://NabuCasa/aux-2@main (see reference/recipes/usb_audio.md).
+# Nabu Casa Connect AUX-2 on the usb_audio PR tree: the Anker S330 on the USB host port as the mixer output.
+packages:
+  core: !include aux-2-pre-prod.yaml
+
+esphome:
+  name: aux-2-usb-dut
+  name_add_mac_suffix: false
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+
+api:
+  encryption:
+    key: !secret api_key
+
+logger:
+  level: DEBUG
+  baud_rate: 0
+
+sendspin:
+  unpaired_access: true
+
+usb_audio:
+  id: usb_audio_id
+
+speaker:
+  - platform: usb_audio
+    id: usb_speaker
+    usb_audio_id: usb_audio_id
+    sample_rate: 48000
+    bits_per_sample: 24bit
+    num_channels: 2
+    buffer_size: 28800
+    write_timeout: 50ms
+  - id: !extend mixing_speaker
+    output_speaker: usb_speaker

.agents/skills/hardware-test/templates/cast-pro-1-sendspin-control.yaml

@@ -0,0 +1,27 @@
+# CAST PRO-1 control for the sendspin sync comparison: Apollo's current package, DEBUG logging as on the S3.
+esphome:
+  name: "cast-pro-1-dut"
+  friendly_name: CAST PRO-1 test
+  project:
+    name: "ApolloAutomation.CAST_PRO-1"
+    version: ${version}
+
+packages:
+  core: !include Core.yaml
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  enable_on_boot: false
+
+logger:
+  level: DEBUG
+
+api:
+  encryption:
+    key: !secret api_key
+
+sendspin:
+  manufacturer: Apollo
+  model: CAST PRO-1 control
+  unpaired_access: true

.agents/skills/hardware-test/templates/deep-sleep-outgoing-dut.yaml

@@ -0,0 +1,46 @@
+# Deep sleep wake timing for the outgoing API connection: boot -> dial -> client hello -> first HA state.
+esphome:
+  name: deep-sleep-dut
+  on_boot:
+    priority: -100
+    then:
+      - lambda: ESP_LOGI("timing", "setup done at %u ms", (unsigned) millis());
+
+esp32:
+  board: esp32dev
+  framework:
+    type: esp-idf
+
+logger:
+  level: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  fast_connect: true
+  on_connect:
+    - lambda: ESP_LOGI("timing", "wifi connected at %u ms", (unsigned) millis());
+
+api:
+  encryption:
+    key: !secret api_key
+  outgoing_connection:
+  on_client_connected:
+    - lambda: ESP_LOGI("timing", "client connected at %u ms (%s %s)", (unsigned) millis(), client_info.c_str(), client_address.c_str());
+  on_client_disconnected:
+    - lambda: ESP_LOGI("timing", "client disconnected at %u ms", (unsigned) millis());
+
+ota:
+  - platform: esphome
+
+text_sensor:
+  - platform: homeassistant
+    id: ha_state
+    entity_id: light.ENTITY
+    on_value:
+      - lambda: ESP_LOGI("timing", "first HA state '%s' at %u ms", x.c_str(), (unsigned) millis());
+
+deep_sleep:
+  id: ds
+  run_duration: 15s
+  sleep_duration: 15s

.agents/skills/hardware-test/templates/dfrobot-sen0395-dut.yaml

@@ -0,0 +1,186 @@
+# DFRobot SEN0395 on an ESP32 DevKit V1: V to VIN (5 V), G to GND, sensor TX to GPIO16 (RX2), sensor RX to GPIO17 (TX2),
+# IO2 to GPIO18, I1 unconnected. Settings buttons, the four switches and junk-line buttons whose echo and
+# "is not recognized" reply come back as lines of known length (220 and 240 bytes give replies over 252 chars).
+esp32:
+  board: esp32dev
+  framework:
+    type: esp-idf
+
+logger:
+  level: VERBOSE
+  logs:
+    api: DEBUG
+    api.connection: DEBUG
+    api.service: DEBUG
+    wifi: DEBUG
+    mdns: DEBUG
+    scheduler: DEBUG
+    component: DEBUG
+    esp32: DEBUG
+    uart: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+uart:
+  id: mmwave_uart
+  tx_pin: GPIO17
+  rx_pin: GPIO16
+  baud_rate: 115200
+
+dfrobot_sen0395:
+  id: mmwave
+  uart_id: mmwave_uart
+
+binary_sensor:
+  - platform: dfrobot_sen0395
+    dfrobot_sen0395_id: mmwave
+    name: Detected via UART
+    id: uart_detected
+  - platform: gpio
+    name: Detected via GPIO
+    device_class: motion
+    pin:
+      number: GPIO18
+      mode: INPUT_PULLDOWN
+
+switch:
+  - platform: dfrobot_sen0395
+    dfrobot_sen0395_id: mmwave
+    type: sensor_active
+    name: Sensor active
+  - platform: dfrobot_sen0395
+    dfrobot_sen0395_id: mmwave
+    type: presence_via_uart
+    name: Presence via UART
+  - platform: dfrobot_sen0395
+    dfrobot_sen0395_id: mmwave
+    type: turn_on_led
+    name: LED
+  - platform: dfrobot_sen0395
+    dfrobot_sen0395_id: mmwave
+    type: start_after_boot
+    name: Start after boot
+
+button:
+  - platform: template
+    name: Range 0 to 3m
+    on_press:
+      - dfrobot_sen0395.settings:
+          id: mmwave
+          detection_segments:
+            - [0cm, 3m]
+  - platform: template
+    name: Range 0 to 9m
+    on_press:
+      - dfrobot_sen0395.settings:
+          id: mmwave
+          detection_segments:
+            - [0cm, 9m]
+  - platform: template
+    name: Latency 1s 2s
+    on_press:
+      - dfrobot_sen0395.settings:
+          id: mmwave
+          output_latency:
+            delay_after_detect: 1s
+            delay_after_disappear: 2s
+  - platform: template
+    name: Latency 0 0
+    on_press:
+      - dfrobot_sen0395.settings:
+          id: mmwave
+          output_latency:
+            delay_after_detect: 0s
+            delay_after_disappear: 0s
+  - platform: template
+    name: Sensitivity 7
+    on_press:
+      - dfrobot_sen0395.settings:
+          id: mmwave
+          sensitivity: 7
+  - platform: template
+    name: Factory reset
+    on_press:
+      - dfrobot_sen0395.settings:
+          id: mmwave
+          factory_reset: true
+  - platform: template
+    name: Reset
+    on_press:
+      - dfrobot_sen0395.reset:
+          id: mmwave
+  - platform: template
+    name: Junk 100
+    on_press:
+      - uart.write:
+          id: mmwave_uart
+          data: !lambda |-
+            std::vector<uint8_t> v(100, 'x');
+            v.push_back('\r');
+            v.push_back('\n');
+            return v;
+  - platform: template
+    name: Junk 160
+    on_press:
+      - uart.write:
+          id: mmwave_uart
+          data: !lambda |-
+            std::vector<uint8_t> v(160, 'x');
+            v.push_back('\r');
+            v.push_back('\n');
+            return v;
+  - platform: template
+    name: Junk 200
+    on_press:
+      - uart.write:
+          id: mmwave_uart
+          data: !lambda |-
+            std::vector<uint8_t> v(200, 'x');
+            v.push_back('\r');
+            v.push_back('\n');
+            return v;
+  - platform: template
+    name: Junk 220
+    on_press:
+      - uart.write:
+          id: mmwave_uart
+          data: !lambda |-
+            std::vector<uint8_t> v(220, 'x');
+            v.push_back('\r');
+            v.push_back('\n');
+            return v;
+  - platform: template
+    name: Junk 240
+    on_press:
+      - uart.write:
+          id: mmwave_uart
+          data: !lambda |-
+            std::vector<uint8_t> v(240, 'x');
+            v.push_back('\r');
+            v.push_back('\n');
+            return v;
+  - platform: template
+    name: Junk 256
+    on_press:
+      - uart.write:
+          id: mmwave_uart
+          data: !lambda |-
+            std::vector<uint8_t> v(256, 'x');
+            v.push_back('\r');
+            v.push_back('\n');
+            return v;
+
+interval:
+  - interval: 30s
+    then:
+      - lambda: 'ESP_LOGI("sen", "alive uart_detected=%d heap=%u", id(uart_detected).state, (unsigned) esp_get_free_heap_size());'

.agents/skills/hardware-test/templates/entity-icon-dut.yaml

@@ -0,0 +1,148 @@
+# Entity icon and device class readback (esphome#21111): the per-run file supplies name and broker_ip through substitutions and includes this file as a package. Every readback path is covered: API listing, MQTT discovery, web_server JSON and dump_config. See reference/recipes/web_server.md.
+esp8266:
+  board: d1_mini
+
+logger:
+  level: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  power_save_mode: none
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+web_server:
+  port: 80
+
+mqtt:
+  broker: ${broker_ip}
+  reboot_timeout: 0s
+
+interval:
+  - interval: 10s
+    then:
+      - lambda: |-
+          ESP_LOGI("probe", "free heap %u, max block %u", (unsigned) ESP.getFreeHeap(), (unsigned) ESP.getMaxFreeBlockSize());
+
+esphome:
+  name: ${name}
+
+sensor:
+  - platform: template
+    name: Temp
+    id: temp
+    device_class: temperature
+    unit_of_measurement: "°C"
+    icon: mdi:thermometer
+    accuracy_decimals: 1
+    lambda: return 21.5;
+    update_interval: 30s
+  - platform: template
+    name: Long Icon
+    id: long_icon
+    icon: mdi:this-icon-name-is-exactly-sixty-three-characters-long-abcde
+    device_class: humidity
+    unit_of_measurement: "%"
+    lambda: return 40.0;
+    update_interval: 30s
+  - platform: template
+    name: Plain
+    id: plain
+    lambda: return 1.0;
+    update_interval: 30s
+  - platform: template
+    name: Hidden
+    id: hidden
+    internal: true
+    icon: mdi:eye-off
+    device_class: power
+    lambda: return 2.0;
+    update_interval: 30s
+
+binary_sensor:
+  - platform: template
+    name: Motion
+    id: motion
+    device_class: motion
+    icon: mdi:motion-sensor
+    lambda: return false;
+
+switch:
+  - platform: template
+    name: Relay
+    id: relay
+    device_class: outlet
+    icon: mdi:power-plug
+    optimistic: true
+
+button:
+  - platform: template
+    name: Reboot
+    id: reboot_btn
+    device_class: restart
+    icon: mdi:restart
+    on_press:
+      - logger.log: "Reboot pressed"
+
+text_sensor:
+  - platform: template
+    name: Version
+    id: version
+    device_class: timestamp
+    icon: mdi:tag
+    lambda: return {"2026-10-21T00:00:00+00:00"};
+    update_interval: 30s
+
+number:
+  - platform: template
+    name: Level
+    id: level
+    device_class: battery
+    icon: mdi:knob
+    unit_of_measurement: "%"
+    min_value: 0
+    max_value: 100
+    step: 1
+    optimistic: true
+    initial_value: 50
+
+select:
+  - platform: template
+    name: Mode
+    id: mode
+    icon: mdi:format-list-bulleted
+    options: [a, b, c]
+    optimistic: true
+    initial_option: a
+
+event:
+  - platform: template
+    name: Doorbell
+    id: doorbell
+    device_class: doorbell
+    icon: mdi:doorbell
+    event_types: [ring, knock]
+
+cover:
+  - platform: template
+    name: Garage
+    id: garage
+    device_class: garage
+    icon: mdi:garage
+    optimistic: true
+
+text:
+  - platform: template
+    name: Secret Note
+    id: note
+    mode: password
+    icon: mdi:form-textbox-password
+    optimistic: true
+    initial_value: "x"

.agents/skills/hardware-test/templates/globals-storage-dut.yaml

@@ -0,0 +1,66 @@
+# Restoring globals with every storage choice; each boot bumps the counters, logs them with the reset reason, saves
+# and syncs; odd boots soft restart, even boots deep sleep (ESP32) or idle (D1 mini). The host's reset pulse and a
+# power cut give the other reset kinds.
+logger:
+  level: DEBUG
+
+preferences:
+  flash_write_interval: 1s
+
+globals:
+  - id: cnt_rtc
+    type: int
+    restore_value: true
+    storage: rtc
+    initial_value: "0"
+  - id: cnt_flash
+    type: int
+    restore_value: true
+    storage: flash
+    initial_value: "0"
+  - id: cnt_default
+    type: int
+    restore_value: true
+    initial_value: "0"
+  - id: str_rtc
+    type: std::string
+    restore_value: true
+    storage: rtc
+    max_restore_data_length: 24
+    initial_value: '"fresh"'
+  - id: arr_rtc
+    type: uint8_t[2]
+    restore_value: true
+    storage: rtc
+    initial_value: "{0, 0}"
+
+esphome:
+  on_boot:
+    priority: -100
+    then:
+      - lambda: |-
+          id(cnt_rtc) += 1;
+          id(cnt_flash) += 1;
+          id(cnt_default) += 1;
+          id(arr_rtc)[0] += 1;
+          id(arr_rtc)[1] += 2;
+          char buf[24];
+          snprintf(buf, sizeof(buf), "boot%d", id(cnt_rtc));
+          ESP_LOGI("gl", "restored rtc=%d flash=%d default=%d str='%s' arr=%u/%u (values before this boot's bump: one less)",
+                   id(cnt_rtc) - 1, id(cnt_flash) - 1, id(cnt_default) - 1, id(str_rtc).c_str(), id(arr_rtc)[0] - 1, id(arr_rtc)[1] - 2);
+          id(str_rtc) = buf;
+      - delay: 2s
+      - lambda: |-
+          global_preferences->sync();
+          ESP_LOGI("gl", "saved rtc=%d flash=%d default=%d str='%s' arr=%u/%u", id(cnt_rtc), id(cnt_flash), id(cnt_default),
+                   id(str_rtc).c_str(), id(arr_rtc)[0], id(arr_rtc)[1]);
+      - if:
+          condition:
+            lambda: 'return id(cnt_rtc) % 2 == 1;'
+          then:
+            - delay: 3s
+            - lambda: 'ESP_LOGI("gl", "odd boot, soft restart now"); App.safe_reboot();'
+
+button:
+  - platform: restart
+    name: Restart

.agents/skills/hardware-test/templates/homeassistant-light-dut.yaml

@@ -0,0 +1,159 @@
+# shared part: two Home Assistant lights mirrored on the device plus buttons that drive them
+esphome:
+  # A local change made before the light core's first write (b19a776 sends it instead of merging it).
+  on_boot:
+    priority: -100
+    then:
+      - lambda: 'ESP_LOGI("halight", "on_boot turning B on at 35 percent before the first write");'
+      - light.turn_on:
+          id: bulb_b
+          brightness: 35%
+logger:
+  level: VERBOSE
+  logs:
+    api: DEBUG
+    api.connection: DEBUG
+    api.service: DEBUG
+    wifi: DEBUG
+    scheduler: DEBUG
+    component: DEBUG
+    sensor: DEBUG
+    mdns: DEBUG
+    ota: DEBUG
+    socket: DEBUG
+    esp-idf: DEBUG
+    preferences: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+light:
+  - platform: homeassistant
+    id: bulb_a
+    name: Mirror A
+    entity_id: light.ENTITY_A
+    report_timeout: 5s
+    on_turn_on:
+      - logger.log: "bulb_a on_turn_on"
+    on_turn_off:
+      - logger.log: "bulb_a on_turn_off"
+  - platform: homeassistant
+    id: bulb_b
+    name: Mirror B
+    entity_id: light.ENTITY_B
+    report_timeout: 5s
+
+button:
+  - platform: template
+    name: A warm 40
+    id: a_warm_40
+    on_press:
+      - light.turn_on:
+          id: bulb_a
+          brightness: 40%
+          color_temperature: 370 mireds
+  - platform: template
+    name: A cool 100
+    on_press:
+      - light.turn_on:
+          id: bulb_a
+          brightness: 100%
+          color_temperature: 153 mireds
+  - platform: template
+    name: A red
+    on_press:
+      - light.turn_on:
+          id: bulb_a
+          brightness: 80%
+          red: 100%
+          green: 0%
+          blue: 0%
+  - platform: template
+    name: A green dim
+    on_press:
+      - light.turn_on:
+          id: bulb_a
+          brightness: 20%
+          red: 0%
+          green: 100%
+          blue: 0%
+  - platform: template
+    name: A brightness only 60
+    on_press:
+      - light.turn_on:
+          id: bulb_a
+          brightness: 60%
+  - platform: template
+    name: A transition 100
+    on_press:
+      - light.turn_on:
+          id: bulb_a
+          brightness: 100%
+          transition_length: 3s
+  - platform: template
+    name: A flash
+    on_press:
+      - light.turn_on:
+          id: bulb_a
+          flash_length: 1s
+  - platform: template
+    name: A off
+    on_press:
+      - light.turn_off: bulb_a
+  - platform: template
+    name: A toggle
+    on_press:
+      - light.toggle: bulb_a
+  - platform: template
+    name: B warm 50
+    on_press:
+      - light.turn_on:
+          id: bulb_b
+          brightness: 50%
+          color_temperature: 300 mireds
+  - platform: template
+    name: B off
+    on_press:
+      - light.turn_off: bulb_b
+  - platform: template
+    name: A 50 fade 3s
+    on_press:
+      - light.turn_on:
+          id: bulb_a
+          brightness: 50%
+          transition_length: 3s
+  - platform: template
+    name: A many calls
+    on_press:
+      - lambda: |-
+          for (int i = 0; i < 16; i++) {
+            id(bulb_a).make_call().set_brightness(i == 15 ? 1.0f : 0.6f).set_transition_length(1000).perform();
+          }
+  - platform: template
+    name: Log state
+    on_press:
+      - lambda: |-
+          auto v = id(bulb_a).current_values;
+          ESP_LOGI("halight", "A: on=%d mode=%d bri=%.2f ct=%.1f rgb=%.2f/%.2f/%.2f  B: on=%d bri=%.2f",
+                   v.is_on(), (int) v.get_color_mode(), v.get_brightness(), v.get_color_temperature(),
+                   v.get_red(), v.get_green(), v.get_blue(), id(bulb_b).current_values.is_on(),
+                   id(bulb_b).current_values.get_brightness());
+
+interval:
+  - interval: 30s
+    then:
+      - lambda: |-
+          auto v = id(bulb_a).current_values;
+          ESP_LOGI("halight", "alive A: on=%d mode=%d bri=%.2f ct=%.1f rgb=%.2f/%.2f/%.2f  B: on=%d bri=%.2f",
+                   v.is_on(), (int) v.get_color_mode(), v.get_brightness(), v.get_color_temperature(),
+                   v.get_red(), v.get_green(), v.get_blue(), id(bulb_b).current_values.is_on(),
+                   id(bulb_b).current_values.get_brightness());

.agents/skills/hardware-test/templates/mqtt-tls-dut.yaml

@@ -0,0 +1,99 @@
+# MQTT TLS trust-source test (#14318, needs that PR's tree for tls and verify_ssl): one build per trust source, with
+# the name and the mqtt block edited per file (see reference/recipes/mqtt.md). Secrets: broker_ip (the local broker
+# from make_test_ca.sh), mqtt_ca, mqtt_client_cert and mqtt_client_key as block scalars from the same run.
+esp32:
+  board: esp32dev
+  framework:
+    type: esp-idf
+
+logger:
+  level: VERBOSE
+  logs:
+    wifi: DEBUG
+    api: DEBUG
+    api.connection: DEBUG
+    scheduler: DEBUG
+    component: DEBUG
+    sensor: DEBUG
+    esp32: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  power_save_mode: none
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+interval:
+  - interval: 10s
+    then:
+      - lambda: |-
+          ESP_LOGI("probe", "mqtt connected %d, internal free %u, largest block %u", id(mq).is_connected(),
+                   (unsigned) heap_caps_get_free_size(MALLOC_CAP_INTERNAL),
+                   (unsigned) heap_caps_get_largest_free_block(MALLOC_CAP_INTERNAL));
+
+sensor:
+  - platform: template
+    name: Counter
+    update_interval: 2s
+    accuracy_decimals: 0
+    lambda: |-
+      static uint32_t n = 0;
+      return n++;
+
+switch:
+  - platform: template
+    name: Relay
+    id: relay
+    optimistic: true
+    on_turn_on:
+      - logger.log: "Relay ON"
+    on_turn_off:
+      - logger.log: "Relay OFF"
+
+button:
+  - platform: template
+    name: Publish big
+    on_press:
+      - mqtt.publish:
+          topic: ${name}/big
+          payload: !lambda |-
+            return std::string(3000, 'q');
+
+substitutions:
+  name: mqtt-dut
+
+esphome:
+  name: ${name}
+
+mqtt:
+  id: mq
+  broker: !secret broker_ip        # test.mosquitto.org for the bundle run
+  # No port: it must resolve to 1883 without TLS options and to 8883 with them. Spell it out only for the
+  # client-certificate listener (8884), wss (9002) and the public bundle broker (8886).
+  # The next two lines are the own-CA build. Remove both for the broker-only build (skip_cert_cn_check alone turns
+  # TLS on), replace both with verify_ssl: false for the unverified build (the flag is rejected next to it), or with
+  # tls: true for the bundle builds (public broker, and the local one as the negative).
+  skip_cert_cn_check: true         # with the local CA: the certificate names an address
+  certificate_authority: !secret mqtt_ca
+  # client_certificate: !secret mqtt_client_cert       # with the CA, port 8884
+  # client_certificate_key: !secret mqtt_client_key
+  # transport: wss                                     # with the CA, port 9002
+  reboot_timeout: 0s
+  discovery: false
+  on_message:
+    - topic: ${name}/cmd
+      then:
+        - logger.log:
+            format: "cmd payload: %s"
+            args: ["x.c_str()"]
+  on_connect:
+    - logger.log: "MQTT on_connect"
+  on_disconnect:
+    - logger.log: "MQTT on_disconnect"

.agents/skills/hardware-test/templates/mqtt-transport-dut.yaml

@@ -0,0 +1,88 @@
+# MQTT transport test (#16056, needs that PR's tree for the transport option): one build per transport, name and mqtt block per file (see reference/recipes/mqtt.md).
+esp32:
+  board: esp32dev
+  framework:
+    type: esp-idf
+
+logger:
+  level: VERBOSE
+  logs:
+    wifi: DEBUG
+    api: DEBUG
+    api.connection: DEBUG
+    scheduler: DEBUG
+    component: DEBUG
+    sensor: DEBUG
+    esp32: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  power_save_mode: none
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+interval:
+  - interval: 10s
+    then:
+      - lambda: |-
+          ESP_LOGI("probe", "mqtt connected %d, internal free %u, largest block %u", id(mq).is_connected(),
+                   (unsigned) heap_caps_get_free_size(MALLOC_CAP_INTERNAL),
+                   (unsigned) heap_caps_get_largest_free_block(MALLOC_CAP_INTERNAL));
+
+sensor:
+  - platform: template
+    name: Counter
+    update_interval: 2s
+    accuracy_decimals: 0
+    lambda: |-
+      static uint32_t n = 0;
+      return n++;
+
+switch:
+  - platform: template
+    name: Relay
+    id: relay
+    optimistic: true
+    on_turn_on:
+      - logger.log: "Relay ON"
+    on_turn_off:
+      - logger.log: "Relay OFF"
+
+button:
+  - platform: template
+    name: Publish big
+    on_press:
+      - mqtt.publish:
+          topic: ${name}/big
+          payload: !lambda |-
+            return std::string(3000, 'q');
+
+substitutions:
+  name: mqtt-dut
+
+esphome:
+  name: ${name}
+
+mqtt:
+  id: mq
+  broker: !secret broker_ip        # test.mosquitto.org for the public bundle run
+  port: 9002                       # 1883 tcp, 9001 ws, 9002 wss, 8081 public wss
+  transport: wss                   # drop for tcp
+  ws_path: /mqtt                   # ws and wss only
+  certificate_authority: !secret mqtt_ca   # drop for the bundle runs
+  skip_cert_cn_check: true         # with the local CA only: the certificate names an address
+  reboot_timeout: 0s
+  discovery: false
+  on_message:
+    - topic: ${name}/cmd
+      then:
+        - logger.log:
+            format: "cmd payload: %s"
+            args: ["x.c_str()"]

.agents/skills/hardware-test/templates/outgoing-wifi-drop-dut.yaml

@@ -0,0 +1,55 @@
+# Mains build (no deep sleep): outgoing API connection timing after a Wi-Fi drop, and the loop cost while a
+# connect is pending or the network is down.
+esphome:
+  name: wifi-drop-dut
+
+esp32:
+  board: esp32dev
+  framework:
+    type: esp-idf
+
+logger:
+  level: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  fast_connect: true
+  on_connect:
+    - lambda: ESP_LOGI("timing", "wifi connected at %u ms", (unsigned) millis());
+  on_disconnect:
+    - lambda: ESP_LOGI("timing", "wifi disconnected at %u ms", (unsigned) millis());
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+  outgoing_connection:
+    delay: 2s
+  on_client_connected:
+    - lambda: ESP_LOGI("timing", "client connected at %u ms (%s %s)", (unsigned) millis(), client_info.c_str(), client_address.c_str());
+  on_client_disconnected:
+    - lambda: ESP_LOGI("timing", "client disconnected at %u ms (%s)", (unsigned) millis(), client_info.c_str());
+
+ota:
+  - platform: esphome
+
+debug:
+  update_interval: 5s
+
+sensor:
+  - platform: debug
+    loop_time:
+      name: Loop Time
+      on_value:
+        - lambda: ESP_LOGI("timing", "loop time max %.0f ms over the last 5 s at %u ms", x, (unsigned) millis());
+
+button:
+  - platform: template
+    name: Wifi cycle
+    on_press:
+      - lambda: ESP_LOGI("timing", "wifi cycle disabling at %u ms", (unsigned) millis());
+      - wifi.disable:
+      - delay: 4s
+      - lambda: ESP_LOGI("timing", "wifi cycle enabling at %u ms", (unsigned) millis());
+      - wifi.enable:

.agents/skills/hardware-test/templates/udp-write-dut.yaml

@@ -0,0 +1,93 @@
+# udp.write payload shapes (#21263): every shape the action takes behind a template button, plus an on_receive that
+# replies with the received bytes reversed through a lambda. Per run file: substitutions name and listener_ip (the test
+# host that runs scripts/udp/udp_listen.py), then packages: common: !include this file. Drive it with
+# scripts/udp/write_cases.sh DEVICE_IP KEY, which presses the buttons, sends the echo datagram and checks every payload.
+esp8266:
+  board: d1_mini
+
+logger:
+  level: VERBOSE
+  logs:
+    wifi: DEBUG
+    api: DEBUG
+    api.connection: DEBUG
+    scheduler: DEBUG
+    component: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  power_save_mode: none
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+interval:
+  - interval: 10s
+    then:
+      - lambda: |-
+          ESP_LOGI("probe", "free heap %u, max block %u", (unsigned) ESP.getFreeHeap(), (unsigned) ESP.getMaxFreeBlockSize());
+
+esphome:
+  name: ${name}
+
+udp:
+  id: u
+  addresses:
+    - ${listener_ip}
+  on_receive:
+    - lambda: ESP_LOGI("echo", "received %u bytes", (unsigned) data.size());
+    - udp.write: !lambda |-
+        std::vector<uint8_t> v(data.rbegin(), data.rend());
+        return v;
+
+button:
+  - platform: template
+    name: Small
+    on_press:
+      - logger.log: "case small"
+      - udp.write: [0xAA, 0x55, 0x01, 0x02]
+      - udp.write: [0xAA, 0x55, 0x01, 0x02]
+  - platform: template
+    name: Simple
+    on_press:
+      - logger.log: "case simple"
+      - udp.write: [1, 2, 3]
+  - platform: template
+    name: Text
+    on_press:
+      - logger.log: "case text"
+      - udp.write: "hello udp"
+  - platform: template
+    name: Empty
+    on_press:
+      - logger.log: "case empty"
+      - udp.write: []
+  - platform: template
+    name: Stack128
+    on_press:
+      - logger.log: "case stack128"
+      - udp.write: [0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8E, 0x8F]
+  - platform: template
+    name: Heap129
+    on_press:
+      - logger.log: "case heap129"
+      - udp.write: [0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8E, 0x8F, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9A, 0x9B, 0x9C, 0x9D, 0x9E, 0x9F, 0xA0]
+  - platform: template
+    name: Heap600
+    on_press:
+      - logger.log: "case heap600"
+      - udp.write: [0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8E, 0x8F, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9A, 0x9B, 0x9C, 0x9D, 0x9E, 0x9F, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5, 0xA6, 0xA7, 0xA8, 0xA9, 0xAA, 0xAB, 0xAC, 0xAD, 0xAE, 0xAF, 0xB0, 0xB1, 0xB2, 0xB3, 0xB4, 0xB5, 0xB6, 0xB7, 0xB8, 0xB9, 0xBA, 0xBB, 0xBC, 0xBD, 0xBE, 0xBF, 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF, 0xD0, 0xD1, 0xD2, 0xD3, 0xD4, 0xD5, 0xD6, 0xD7, 0xD8, 0xD9, 0xDA, 0xDB, 0xDC, 0xDD, 0xDE, 0xDF, 0xE0, 0xE1, 0xE2, 0xE3, 0xE4, 0xE5, 0xE6, 0xE7, 0xE8, 0xE9, 0xEA, 0xEB, 0xEC, 0xED, 0xEE, 0xEF, 0xF0, 0xF1, 0xF2, 0xF3, 0xF4, 0xF5, 0xF6, 0xF7, 0xF8, 0xF9, 0xFA, 0xFB, 0xFC, 0xFD, 0xFE, 0xFF, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8E, 0x8F, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9A, 0x9B, 0x9C, 0x9D, 0x9E, 0x9F, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5, 0xA6, 0xA7, 0xA8, 0xA9, 0xAA, 0xAB, 0xAC, 0xAD, 0xAE, 0xAF, 0xB0, 0xB1, 0xB2, 0xB3, 0xB4, 0xB5, 0xB6, 0xB7, 0xB8, 0xB9, 0xBA, 0xBB, 0xBC, 0xBD, 0xBE, 0xBF, 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF, 0xD0, 0xD1, 0xD2, 0xD3, 0xD4, 0xD5, 0xD6, 0xD7, 0xD8, 0xD9, 0xDA, 0xDB, 0xDC, 0xDD, 0xDE, 0xDF, 0xE0, 0xE1, 0xE2, 0xE3, 0xE4, 0xE5, 0xE6, 0xE7, 0xE8, 0xE9, 0xEA, 0xEB, 0xEC, 0xED, 0xEE, 0xEF, 0xF0, 0xF1, 0xF2, 0xF3, 0xF4, 0xF5, 0xF6, 0xF7, 0xF8, 0xF9, 0xFA, 0xFB, 0xFC, 0xFD, 0xFE, 0xFF, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87]
+  - platform: template
+    name: Lambda300
+    on_press:
+      - logger.log: "case lambda300"
+      - udp.write: !lambda |-
+          std::vector<uint8_t> v(300);
+          for (size_t i = 0; i < v.size(); i++) v[i] = (uint8_t) (i * 7);
+          return v;

.agents/skills/hardware-test/templates/usb-audio-sendspin-s3-eth-dut.yaml

@@ -0,0 +1,76 @@
+# Music Assistant target: the plain USB audio template plus the CAST-1 style sendspin wiring (resampler speakers
+# into a mixer whose inputs never time out, speaker_source media player, sendspin hub and sources).
+packages:
+  base: !include usb-audio-waveshare-s3-eth-dut.yaml
+
+# Logs over the API only: a DEBUG line per report would saturate UART0 and trip the task watchdog.
+logger:
+  baud_rate: 0
+
+speaker:
+  - id: !extend usb_speaker
+    buffer_size: 28800
+    write_timeout: 50ms
+  - platform: mixer
+    id: mixer_speaker_id
+    output_speaker: usb_speaker
+    num_channels: 2
+    task_stack_in_psram: true
+    source_speakers:
+      - id: announcement_mixer_input
+        timeout: never
+      - id: media_mixer_input
+        timeout: never
+  - platform: resampler
+    id: announcement_resampling_speaker
+    output_speaker: announcement_mixer_input
+    sample_rate: 48000
+    bits_per_sample: 16
+  - platform: resampler
+    id: media_resampling_speaker
+    output_speaker: media_mixer_input
+    sample_rate: 48000
+    bits_per_sample: 16
+
+sendspin:
+  id: sendspin_hub
+  # PSRAM stack skews time sync; keep internal
+  task_stack_in_psram: false
+  manufacturer: Waveshare
+  model: ESP32-S3-ETH USB audio
+  firmware_version: "0.1"
+  unpaired_access: true
+
+media_source:
+  - platform: sendspin
+    id: sendspin_source
+  - platform: audio_http
+    id: http_media_source
+    buffer_size: 500000
+  - platform: audio_http
+    id: http_announcement_source
+    buffer_size: 250000
+
+media_player:
+  - platform: sendspin
+    id: sendspin_group_media_player
+    name: Sendspin Player
+  - platform: speaker_source
+    id: external_media_player
+    name: Player
+    volume_increment: 0.05
+    announcement_pipeline:
+      format: FLAC
+      num_channels: 1
+      sample_rate: 48000
+      speaker: announcement_resampling_speaker
+      sources:
+        - http_announcement_source
+    media_pipeline:
+      speaker: media_resampling_speaker
+      format: FLAC
+      num_channels: 2
+      sample_rate: 48000
+      sources:
+        - sendspin_source
+        - http_media_source

.agents/skills/hardware-test/templates/usb-audio-waveshare-s3-eth-dut.yaml

@@ -0,0 +1,142 @@
+# Waveshare ESP32-S3-ETH: USB host for a speakerphone (usb_audio), logs over Ethernet, the USB port is the host port
+esphome:
+  name: usb-audio-dut
+
+esp32:
+  board: esp32-s3-devkitc-1
+  variant: esp32s3
+  flash_size: 16MB
+  framework:
+    type: esp-idf
+
+psram:
+  mode: octal
+  speed: 80MHz
+
+logger:
+  level: DEBUG
+  hardware_uart: UART0
+  logs:
+    usb_host: DEBUG
+
+ethernet:
+  type: W5500
+  clk_pin: GPIO13
+  mosi_pin: GPIO11
+  miso_pin: GPIO12
+  cs_pin: GPIO14
+  interrupt_pin: GPIO10
+  reset_pin: GPIO9
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+usb_audio:
+  id: usb_audio_id
+
+microphone:
+  - platform: usb_audio
+    id: usb_mic
+    usb_audio_id: usb_audio_id
+    sample_rate: 48000
+    bits_per_sample: 16bit
+    num_channels: 2
+    buffer_size: 9600
+    on_data:
+      - lambda: |-
+          id(mic_bytes) += x.size();
+          id(mic_chunks) += 1;
+
+speaker:
+  - platform: usb_audio
+    id: usb_speaker
+    usb_audio_id: usb_audio_id
+    sample_rate: 48000
+    bits_per_sample: 24bit
+    num_channels: 2
+    buffer_size: 9600
+    write_timeout: 20ms
+
+globals:
+  - id: beep_left
+    type: int
+    initial_value: "0"
+  - id: beep_written
+    type: uint32_t
+    initial_value: "0"
+  - id: beep_short
+    type: uint32_t
+    initial_value: "0"
+  - id: beep_phase
+    type: float
+    initial_value: "0"
+  - id: mic_bytes
+    type: uint32_t
+    initial_value: "0"
+  - id: mic_chunks
+    type: uint32_t
+    initial_value: "0"
+
+button:
+  - platform: template
+    name: Mic start
+    on_press:
+      - microphone.capture: usb_mic
+  - platform: template
+    name: Mic stop
+    on_press:
+      - microphone.stop_capture: usb_mic
+  - platform: template
+    name: Beep
+    on_press:
+      - lambda: |-
+          // 2 s of a 1 kHz tone at 48 kHz 24-bit stereo, fed 10 ms at a time from the interval below
+          id(beep_left) = 200;
+          id(beep_written) = 0;
+          id(beep_short) = 0;
+          id(beep_phase) = 0.0f;
+          id(usb_speaker).start();
+          ESP_LOGI("uatest", "beep started");
+  - platform: template
+    name: Speaker stop
+    on_press:
+      - speaker.stop: usb_speaker
+  - platform: template
+    name: Restart
+    on_press:
+      - lambda: App.safe_reboot();
+
+interval:
+  - interval: 8ms
+    then:
+      - lambda: |-
+          if (id(beep_left) <= 0) return;
+          // 10 ms of 48 kHz stereo 24-bit samples, 3 bytes little-endian per sample
+          static uint8_t buf[480 * 2 * 3];
+          float phase = id(beep_phase);
+          for (int i = 0; i < 480; i++) {
+            int32_t s = (int32_t) (1500000.0f * sinf(phase));
+            phase += 2.0f * 3.14159265f * 1000.0f / 48000.0f;
+            if (phase > 6.2831853f) phase -= 6.2831853f;
+            for (int c = 0; c < 2; c++) {
+              uint8_t *o = buf + (i * 2 + c) * 3;
+              o[0] = s & 0xFF; o[1] = (s >> 8) & 0xFF; o[2] = (s >> 16) & 0xFF;
+            }
+          }
+          size_t n = id(usb_speaker).play(buf, sizeof(buf), 0);
+          if (n == 0) { id(beep_short) += 1; return; }  // not accepted yet, try the same chunk next time
+          id(beep_phase) = phase;
+          id(beep_written) += n;
+          id(beep_left) -= 1;
+          if (id(beep_left) == 0) ESP_LOGI("uatest", "beep done: %u bytes queued, %u retries", (unsigned) id(beep_written), (unsigned) id(beep_short));
+  - interval: 5s
+    then:
+      - lambda: |-
+          ESP_LOGI("uatest", "mic capturing=%d bytes=%u chunks=%u | speaker running=%d | heap free %u",
+                   id(usb_mic).is_running(), (unsigned) id(mic_bytes), (unsigned) id(mic_chunks),
+                   id(usb_speaker).is_running(), (unsigned) heap_caps_get_free_size(MALLOC_CAP_INTERNAL));

.agents/skills/hardware-test/templates/web-server-sse-dut.yaml

@@ -0,0 +1,136 @@
+# web_server_idf state SSE and HTTPD task stress (#21109, #21038). Add `auth:` with `type: digest` for the HTTPD
+# stack case; the entity endpoints are named after the entities (/sensor/Fast%201, /switch/Toggle/toggle).
+esphome:
+  name: web-server-dut
+
+esp32:
+  board: esp32dev
+  framework:
+    type: esp-idf
+
+logger:
+  level: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  power_save_mode: none
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+web_server:
+  port: 80
+  version: 3
+
+# Stack and heap probe from the main loop task (loopTask) and the HTTPD task.
+interval:
+  - interval: 5s
+    then:
+      - lambda: |-
+          TaskHandle_t httpd = xTaskGetHandle("httpd");
+          if (httpd == nullptr) {
+            ESP_LOGW("probe", "httpd task not found, loopTask min free stack %u",
+                     (unsigned) uxTaskGetStackHighWaterMark(nullptr));
+            return;
+          }
+          ESP_LOGI("probe", "loopTask min free stack %u, httpd min free stack %u, internal free %u, largest block %u",
+                   (unsigned) uxTaskGetStackHighWaterMark(nullptr), (unsigned) uxTaskGetStackHighWaterMark(httpd),
+                   (unsigned) heap_caps_get_free_size(MALLOC_CAP_INTERNAL),
+                   (unsigned) heap_caps_get_largest_free_block(MALLOC_CAP_INTERNAL));
+
+# Small state events: eight sensors at 200 ms, well under the 1024 byte stack buffer.
+sensor:
+  - platform: template
+    name: Fast 1
+    id: fast1
+    update_interval: 200ms
+    accuracy_decimals: 3
+    lambda: return random_float() * 100.0f;
+  - platform: template
+    name: Fast 2
+    update_interval: 200ms
+    accuracy_decimals: 3
+    lambda: return random_float() * 100.0f;
+  - platform: template
+    name: Fast 3
+    update_interval: 200ms
+    accuracy_decimals: 3
+    lambda: return random_float() * 100.0f;
+  - platform: template
+    name: Fast 4
+    update_interval: 200ms
+    accuracy_decimals: 3
+    lambda: return random_float() * 100.0f;
+  - platform: template
+    name: Fast 5
+    update_interval: 200ms
+    accuracy_decimals: 3
+    lambda: return random_float() * 100.0f;
+  - platform: template
+    name: Fast 6
+    update_interval: 200ms
+    accuracy_decimals: 3
+    lambda: return random_float() * 100.0f;
+  - platform: template
+    name: Fast 7
+    update_interval: 200ms
+    accuracy_decimals: 3
+    lambda: return random_float() * 100.0f;
+  - platform: template
+    name: Fast 8
+    update_interval: 200ms
+    accuracy_decimals: 3
+    lambda: return random_float() * 100.0f;
+
+# Large state events: the text sensor JSON carries the string twice (value and state).
+# mid ~1.3 kB goes to the 2048 byte tail, big ~3.7 kB grows the tail to 4096, huge ~5.7 kB exceeds the
+# 5120 byte JSON room and must be dropped with "State event does not fit".
+text_sensor:
+  - platform: template
+    name: Mid
+    id: mid
+    update_interval: 1s
+    lambda: |-
+      static uint32_t n = 0;
+      std::string s = std::to_string(n++) + ":";
+      s.append(600 - s.size(), 'm');
+      return s;
+  - platform: template
+    name: Big
+    id: big
+    update_interval: 2s
+    lambda: |-
+      static uint32_t n = 0;
+      std::string s = std::to_string(n++) + ":";
+      s.append(1800 - s.size(), 'b');
+      return s;
+  - platform: template
+    name: Huge
+    id: huge
+    update_interval: 7s
+    lambda: |-
+      static uint32_t n = 0;
+      std::string s = std::to_string(n++) + ":";
+      s.append(2800 - s.size(), 'h');
+      return s;
+
+switch:
+  - platform: template
+    name: Toggle
+    optimistic: true
+
+button:
+  - platform: template
+    name: Burst
+    on_press:
+      - lambda: |-
+          for (int i = 0; i < 50; i++) {
+            id(fast1).publish_state(i);
+            id(mid).publish_state(std::string(600, 'x'));
+          }

.clang-tidy

@@ -12,6 +12,7 @@ Checks: >-
   -bugprone-multi-level-implicit-pointer-conversion,
   -bugprone-narrowing-conversions,
   -bugprone-tagged-union-member-count,
+  -bugprone-signed-bitwise,
   -bugprone-signed-char-misuse,
   -bugprone-switch-missing-default-case,
   -cert-dcl50-cpp,
@@ -39,6 +40,7 @@ Checks: >-
   -cppcoreguidelines-avoid-const-or-ref-data-members,
   -cppcoreguidelines-avoid-do-while,
   -cppcoreguidelines-avoid-magic-numbers,
+  -cppcoreguidelines-explicit-constructor,
   -cppcoreguidelines-init-variables,
   -cppcoreguidelines-macro-to-enum,
   -cppcoreguidelines-macro-usage,
@@ -84,6 +86,7 @@ Checks: >-
   -llvm-use-ranges,
   -llvmlibc-*,
   -misc-const-correctness,
+  -misc-explicit-constructor,
   -misc-include-cleaner,
   -misc-multiple-inheritance,
   -misc-no-recursion,
@@ -113,6 +116,7 @@ Checks: >-
   -objc-*,
   -performance-enum-size,
   -portability-avoid-pragma-once,
+  -portability-no-assembler,
   -portability-template-virtual-member-function,
   -readability-ambiguous-smartptr-reset-call,
   -readability-avoid-nested-conditional-operator,
@@ -129,9 +133,13 @@ Checks: >-
   -readability-named-parameter,
   -readability-redundant-casting,
   -readability-redundant-inline-specifier,
+  -readability-redundant-lambda-parameter-list,
   -readability-redundant-member-init,
+  -readability-redundant-nested-if,
   -readability-redundant-parentheses,
   -readability-redundant-typename,
+  -readability-trailing-comma,
+  -readability-trivial-switch,
   -readability-uppercase-literal-suffix,
   -readability-use-anyofallof,
   -readability-use-std-min-max,

.coveragerc

@@ -2,4 +2,6 @@
 omit =
     esphome/components/*
     esphome/analyze_memory/*
+    esphome/espidf/get_idf_tool_paths.py
+    esphome/espidf/get_idf_version.py
     tests/integration/*

.devcontainer/devcontainer.json

@@ -28,7 +28,6 @@
         // python
         "ms-python.python",
         "ms-python.pylint",
-        "ms-python.flake8",
         "charliermarsh.ruff",
         "visualstudioexptteam.vscodeintellicode",
         // yaml
@@ -48,9 +47,6 @@
         "pylint.args": [
           "--rcfile=${workspaceFolder}/pyproject.toml"
         ],
-        "flake8.args": [
-          "--config=${workspaceFolder}/.flake8"
-        ],
         "ruff.configuration": "${workspaceFolder}/pyproject.toml",
         "[python]": {
           // VS will say "Value is not accepted" before building the devcontainer, but the warning

.flake8

@@ -1,42 +0,0 @@
-[flake8]
-max-line-length = 120
-# Following 4 for black compatibility
-# E501: line too long
-# W503: Line break occurred before a binary operator
-# E203: Whitespace before ':'
-# D202 No blank lines allowed after function docstring
-
-# TODO fix flake8
-# D100 Missing docstring in public module
-# D101 Missing docstring in public class
-# D102 Missing docstring in public method
-# D103 Missing docstring in public function
-# D104 Missing docstring in public package
-# D105 Missing docstring in magic method
-# D107 Missing docstring in __init__
-# D200 One-line docstring should fit on one line with quotes
-# D205 1 blank line required between summary line and description
-# D209 Multi-line docstring closing quotes should be on a separate line
-# D400 First line should end with a period
-# D401 First line should be in imperative mood
-
-ignore =
-  E501,
-  W503,
-  E203,
-  D202,
-
-  D100,
-  D101,
-  D102,
-  D103,
-  D104,
-  D105,
-  D107,
-  D200,
-  D205,
-  D209,
-  D400,
-  D401,
-
-exclude = api_pb2.py

.github/scripts/auto-label-pr/constants.js

@@ -21,6 +21,7 @@ module.exports = {
     'github-actions',
     'by-code-owner',
     'has-tests',
+    'api.proto',
     'needs-tests',
     'needs-docs',
     'needs-developer-docs',

.github/scripts/auto-label-pr/detectors.js

@@ -272,6 +272,18 @@ async function detectTests(changedFiles) {
   return labels;
 }
 
+// Strategy: API protocol change detection
+// aioesphomeapi carries copies of both files, so every change here needs a sync there
+const API_PROTO_FILES = ['esphome/components/api/api.proto', 'esphome/components/api/api_options.proto'];
+
+async function detectApiProto(changedFiles) {
+  const labels = new Set();
+  if (changedFiles.some(file => API_PROTO_FILES.includes(file))) {
+    labels.add('api.proto');
+  }
+  return labels;
+}
+
 // Strategy: PR Template Checkbox detection
 async function detectPRTemplateCheckboxes(context) {
   const labels = new Set();
@@ -460,6 +472,7 @@ module.exports = {
   detectGitHubActionsChanges,
   detectCodeOwner,
   detectTests,
+  detectApiProto,
   detectPRTemplateCheckboxes,
   detectDeprecatedComponents,
   detectMaintainerAccess,

.github/scripts/auto-label-pr/index.js

@@ -10,6 +10,7 @@ const {
   detectGitHubActionsChanges,
   detectCodeOwner,
   detectTests,
+  detectApiProto,
   detectPRTemplateCheckboxes,
   detectDeprecatedComponents,
   detectMaintainerAccess,
@@ -114,6 +115,7 @@ module.exports = async ({ github, context }) => {
     actionsLabels,
     codeOwnerLabels,
     testLabels,
+    apiProtoLabels,
     checkboxLabels,
     deprecatedResult,
     maintainerAccess
@@ -128,6 +130,7 @@ module.exports = async ({ github, context }) => {
     detectGitHubActionsChanges(changedFiles),
     detectCodeOwner(github, context, changedFiles),
     detectTests(changedFiles),
+    detectApiProto(changedFiles),
     detectPRTemplateCheckboxes(context),
     detectDeprecatedComponents(github, context, changedFiles),
     detectMaintainerAccess(context)
@@ -156,6 +159,7 @@ module.exports = async ({ github, context }) => {
     ...actionsLabels,
     ...codeOwnerLabels,
     ...testLabels,
+    ...apiProtoLabels,
     ...checkboxLabels,
     ...deprecatedLabels
   ]);

.github/scripts/auto-label-pr/tests/detectors.test.js

@@ -1,6 +1,7 @@
 const { describe, it } = require('node:test');
 const assert = require('node:assert/strict');
 const {
+  detectApiProto,
   detectMergeBranch,
   detectNewPlatforms,
   detectNewComponents,
@@ -375,6 +376,27 @@ describe('detectRequirements', () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// detectApiProto
+// ---------------------------------------------------------------------------
+
+describe('detectApiProto', () => {
+  it('labels a PR that changes api.proto', async () => {
+    const labels = await detectApiProto(['esphome/components/api/api.proto', 'esphome/components/api/api_pb2.cpp']);
+    assert.deepEqual(Array.from(labels), ['api.proto']);
+  });
+
+  it('labels a PR that changes only api_options.proto', async () => {
+    const labels = await detectApiProto(['esphome/components/api/api_options.proto']);
+    assert.deepEqual(Array.from(labels), ['api.proto']);
+  });
+
+  it('ignores the generated protocol files and other components', async () => {
+    const labels = await detectApiProto(['esphome/components/api/api_pb2.cpp', 'esphome/components/uart/api.proto']);
+    assert.equal(labels.size, 0);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // MANAGED_LABELS
 // ---------------------------------------------------------------------------
@@ -387,6 +409,10 @@ describe('MANAGED_LABELS', () => {
   it('includes needs-developer-docs so the workflow syncs it', () => {
     assert.ok(MANAGED_LABELS.includes('needs-developer-docs'));
   });
+
+  it('includes api.proto so the workflow removes it when the file drops out of the diff', () => {
+    assert.ok(MANAGED_LABELS.includes('api.proto'));
+  });
 });
 
 // ---------------------------------------------------------------------------

.github/workflows/ci.yml

@@ -313,6 +313,7 @@ jobs:
           - "3.12"
           - "3.13"
           - "3.14"
+          - "3.15"
         os:
           - ubuntu-latest
           - macOS-latest
@@ -629,7 +630,7 @@ jobs:
             apt-get install -y libc6-dbg
 
       - name: Run CodSpeed benchmarks
-        uses: CodSpeedHQ/action@f842b9a3ffe213dbb81768fd7f7eeb4dfcf1c369 # v5.4.2
+        uses: CodSpeedHQ/action@821a40cd6c80e3cfe387caf55668287addd808da # v5.5.0
         with:
           run: |
             . venv/bin/activate
@@ -1006,19 +1007,19 @@ jobs:
           - id: clang-tidy
             name: Run script/clang-tidy for ESP32 S3
             # yamllint disable-line rule:line-length
-            options: --environment esp32s3-idf-tidy --grep SOC_TEMP_SENSOR_SUPPORTED --grep USE_ESP32_VARIANT_ESP32S3 --grep USE_LOGGER_USB_CDC --grep SOC_I2S_SUPPORTS_TDM --grep USE_OPENTHREAD
+            options: --environment esp32s3-idf-tidy --grep SOC_TEMP_SENSOR_SUPPORTED --grep SOC_RISCV_COPROC_SUPPORTED --grep USE_ESP32_VARIANT_ESP32S3 --grep USE_LOGGER_USB_CDC --grep SOC_I2S_SUPPORTS_TDM --grep USE_OPENTHREAD
             tidy_environment: esp32s3-idf-tidy
           - id: clang-tidy
             name: Run script/clang-tidy for ESP32 P4
             # P4 has no native Wi-Fi/BLE; those run over the hosted co-processor,
             # so their code paths differ -- lint them under the P4 build too.
             # yamllint disable-line rule:line-length
-            options: --environment esp32p4-idf-tidy --grep USE_ESP32_VARIANT_ESP32P4 --grep CONFIG_IDF_TARGET_ESP32P4 --grep USE_ESP32_HOSTED --grep USE_WIFI --grep USE_BLE
+            options: --environment esp32p4-idf-tidy --grep USE_ESP32_VARIANT_ESP32P4 --grep SOC_LP_CORE_SUPPORTED --grep CONFIG_IDF_TARGET_ESP32P4 --grep USE_ESP32_HOSTED --grep USE_WIFI --grep USE_BLE
             tidy_environment: esp32p4-idf-tidy
           - id: clang-tidy
             name: Run script/clang-tidy for ESP32 C6
             # yamllint disable-line rule:line-length
-            options: --environment esp32c6-idf-tidy --grep SOC_LP_I2C_SUPPORTED --grep USE_ESP32_VARIANT_ESP32C6 --grep USE_OPENTHREAD --grep USE_ZIGBEE
+            options: --environment esp32c6-idf-tidy --grep SOC_LP_I2C_SUPPORTED --grep SOC_LP_CORE_SUPPORTED --grep USE_ESP32_VARIANT_ESP32C6 --grep USE_OPENTHREAD --grep USE_ZIGBEE
             tidy_environment: esp32c6-idf-tidy
 
     steps:

.github/workflows/codeql.yml

@@ -56,7 +56,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -84,6 +84,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/lock.yml

@@ -14,4 +14,4 @@ jobs:
     permissions:
       issues: write         # issues.lock on closed issues
       pull-requests: write  # issues.lock on closed pull requests
-    uses: esphome/workflows/.github/workflows/lock.yml@cc3e76de337dc59bc1cba8da58d963cd23b873f1  # 2026.9.0
+    uses: esphome/workflows/.github/workflows/lock.yml@31d160e5f0ffa0ee65d5b27cb55c153d415f2abe  # 2026.10.2

.github/workflows/matchers/lint-python.json

@@ -1,39 +0,0 @@
-{
-  "problemMatcher": [
-    {
-      "owner": "ruff",
-      "severity": "error",
-      "pattern": [
-        {
-          "regexp": "^(.*): (Please format this file with the ruff formatter)",
-          "file": 1,
-          "message": 2
-        }
-      ]
-    },
-    {
-      "owner": "flake8",
-      "severity": "error",
-      "pattern": [
-          {
-          "regexp": "^(.*):(\\d+): ([EFCDNW]\\d{3}.*)$",
-          "file": 1,
-          "line": 2,
-          "message": 3
-          }
-      ]
-    },
-    {
-      "owner": "pylint",
-      "severity": "error",
-      "pattern": [
-        {
-          "regexp": "^(.*):(\\d+): (\\[[EFCRW]\\d{4}\\(.*\\),.*\\].*)$",
-          "file": 1,
-          "line": 2,
-          "message": 3
-        }
-      ]
-    }
-  ]
-}

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
     # No GITHUB_TOKEN permissions: the reusable workflow mints an ESPHome
     # GitHub App token so the labels, comments and closures come from
     # esphome[bot] instead of github-actions[bot].
-    uses: esphome/workflows/.github/workflows/stale.yml@4fbce13026c393d6eb6b247e394dcd9ef1af76c2  # main
+    uses: esphome/workflows/.github/workflows/stale.yml@31d160e5f0ffa0ee65d5b27cb55c153d415f2abe  # main
     secrets:
       ESPHOME_GITHUB_APP_PRIVATE_KEY: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
     with:

.github/workflows/sync-device-classes.yml

@@ -85,7 +85,7 @@ jobs:
       - name: Verify prek clean
         # Second pass: re-run all hooks against the now-fixed tree.
         # Auto-fixers exit 0 (nothing to change); any remaining failure
-        # from a check-only hook (flake8 / yamllint / ci-custom) is a
+        # from a check-only hook (yamllint / ci-custom) is a
         # real issue and fails the workflow loudly. Same PREK_SKIP list as
         # above for the same reasons.
         env:

.pre-commit-config.yaml

@@ -10,21 +10,13 @@ ci:
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.17.0
+    rev: v0.17.1
     hooks:
       # Run the linter.
       - id: ruff
         args: [--fix]
       # Run the formatter.
       - id: ruff-format
-  - repo: https://github.com/PyCQA/flake8
-    rev: 7.4.1
-    hooks:
-      - id: flake8
-        additional_dependencies:
-          - flake8-docstrings==1.7.0
-          - pydocstyle==5.1.1
-        files: ^(esphome|tests)/.+\.py$
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
     hooks:
@@ -46,7 +38,7 @@ repos:
       - id: yamllint
         exclude: ^(\.clang-format|\.clang-tidy)$
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: v13.0.1
+    rev: v23.1.3
     hooks:
       - id: clang-format
         types_or: [c, c++]

AGENTS.md

@@ -55,7 +55,7 @@ file does, and it is the authority when they disagree. The most useful starting
 *   https://developers.esphome.io/contributing/code/ - contribution rules, public API and breaking changes.
 
 *   **Formatting:**
-    *   **Python:** Uses `ruff` and `flake8` for linting and formatting. Configuration is in `pyproject.toml`.
+    *   **Python:** Uses `ruff` for linting and formatting. Configuration is in `pyproject.toml`.
     *   **C++:** Uses `clang-format` for formatting. Configuration is in `.clang-format`.
 
 *   **Naming Conventions:**
@@ -80,13 +80,15 @@ file does, and it is the authority when they disagree. The most useful starting
         ```python
         # Bad - looks up CONF_BLAH twice
         if CONF_BLAH in config:
-            cg.add(var.set_blah(config[CONF_BLAH]))
+            cg.add(var.set_blah_ms(config[CONF_BLAH].total_milliseconds))
 
         # Good - single lookup, value bound inline
         if (blah := config.get(CONF_BLAH)) is not None:
-            cg.add(var.set_blah(blah))
+            cg.add(var.set_blah_ms(blah.total_milliseconds))
         ```
         The same applies to `while` loops and comprehensions where it avoids recomputing a value. Don't contort code to use it — reach for `:=` only when it genuinely cuts repetition or an extra assignment line.
+        When the setter takes the value unchanged, use `cg.add_optional(var.set_blah, config.get(CONF_BLAH))`
+        instead; it is not awaited, and it skips only `None`, so `0` and `False` are still set.
 
 *   **C++ Field Visibility:**
     *   **Prefer `protected`:** Use `protected` for most class fields to enable extensibility and testing. Fields should be `lower_snake_case_with_trailing_underscore_`.
@@ -208,8 +210,14 @@ file does, and it is the authority when they disagree. The most useful starting
     *   **Fixed sets of names** (status words, model names): a `PROGMEM_STRING_TABLE` (`esphome/core/progmem.h`),
         logged with `get_log_str` and `LOG_STR_ARG`, copied out with `ESPHOME_strncpy_P` before `publish_state`.
         A `dump_config` helper that picks a name returns `const LogString *` from `LOG_STR(...)`.
-    *   **CRCs and bit tricks** come from `esphome/core/helpers.h` (`crc8`, `crc16`, `reverse_bits`, `encode_uint16`);
-        pick the helper's polynomial and bit-order arguments instead of writing a CRC loop.
+    *   **CRCs and bit tricks** come from `esphome/core/helpers.h` (`crc8`, `crc16`, `xor_bytes`, `sum16_bytes`,
+        `reverse_bits`, `encode_uint16`, `encode_value_le`, `sign_extend<BITS>`, `bcd_to_uint8`); pick the helper's
+        arguments instead of writing a loop. Epson style 7-byte RTC calendars (one-hot weekday) use
+        `time::decode_bcd_calendar`.
+    *   **Bus helpers:** UART drains with `read_available(on_byte)` and `discard_available()`, text lines with
+        `LineReader<N>`; I2C has `update_register`, `write_registers` (PROGMEM `I2CRegValue` table), `check_chip_id`
+        and `read_bytes_16_le`. `if (!this->status_comm_result(ok)) return;` sets or clears the warning.
+        A child sensor that skips repeated values is `SUB_SENSOR_WITH_DEDUP(name, type)`.
     *   **An unset float is `NAN`**, not `optional<float>`; the optional costs 4 to 8 bytes of padding per member.
     *   **`PollingComponent` first runs `update()`** after a random share of the interval; call `this->update()` at the
         end of `setup()` when the entities need a state at boot.
@@ -429,6 +437,22 @@ file does, and it is the authority when they disagree. The most useful starting
           and `await cg.add_variable(var.set_bus, config[CONF_BUS_ID])`; both skip a `None` value, so pass
           `config.get(KEY)` for an optional key, and return what they created. Use `cg.register_parented` for `set_parent`.
 
+        - **Hub forwarding entities need no C++ class:** a button, switch, number or select that only calls its hub
+          uses `button.ApplyButton` (`switch.ApplySwitch`, `number.ApplyNumber`, `select.ApplySelect`) in its schema
+          and `apply=` on the `sub_*` call. The body is a call on the hub with `entity` and `state`, `value` or
+          `index`/`option` in scope; on a switch, number or select `publish="before"` or `"after"` publishes the state.
+          ```python
+          switches = switch.sub_switches(config, parent=hub)
+          await switches(CONF_BLUETOOTH, None, apply="set_bluetooth(state)", publish="after")
+          ```
+
+        - **Other codegen helpers:** `uart.new_uart_component(config, *ctor_args)` (and `i2c.new_i2c_component`,
+          `spi.new_spi_component`, `modbus.new_modbus_client_component`, `ble_client.new_ble_node_component`)
+          constructs, registers and attaches in one call; `display.add_writer(var, config)` sets the lambda;
+          `MyEnum.options("on", prefix="MY_ENUM_")` builds an enum dict; `button.restart_button_schema(cls)` (and
+          `factory_reset_`, `query_`) are button presets; `fv.get_declaring_config(id)` finds a hub's config in
+          final validation.
+
 *   **Automations (Triggers, Actions, Conditions):**
 
     Automations have three building blocks: **Triggers** (fire when something happens), **Actions** (do something), and **Conditions** (check if something is true).

CODEOWNERS

@@ -133,7 +133,7 @@ esphome/components/climate/* @esphome/core
 esphome/components/climate_ir/* @glmnet
 esphome/components/cm1106/* @andrewjswan
 esphome/components/color_temperature/* @jesserockz
-esphome/components/combination/* @Cat-Ion @kahrendt
+esphome/components/combination/* @kahrendt
 esphome/components/const/* @esphome/core
 esphome/components/coolix/* @glmnet
 esphome/components/copy/* @OttoWinter
@@ -205,6 +205,7 @@ esphome/components/esp32_hosted/update/* @swoboda1337
 esphome/components/esp32_power_management/* @rwrozelle
 esphome/components/esp32_rmt/* @jesserockz
 esphome/components/esp32_rmt_led_strip/* @jesserockz
+esphome/components/esp32_ulp/* @swoboda1337
 esphome/components/esp8266/* @esphome/core
 esphome/components/esp_ldo/* @clydebarrow
 esphome/components/espectre/* @francescopace
@@ -601,7 +602,10 @@ esphome/components/ssd1331_base/* @kbx81
 esphome/components/ssd1331_spi/* @kbx81
 esphome/components/ssd1351_base/* @kbx81
 esphome/components/ssd1351_spi/* @kbx81
+esphome/components/st25r/* @JohnMcLear
+esphome/components/st25r_spi/* @JohnMcLear
 esphome/components/st7123/* @miniskipper
+esphome/components/st7305/* @clydebarrow
 esphome/components/st7567_base/* @latonita
 esphome/components/st7567_i2c/* @latonita
 esphome/components/st7567_spi/* @latonita
@@ -684,15 +688,18 @@ esphome/components/ultrasonic/* @ssieb @swoboda1337
 esphome/components/unicode/* @esphome/core
 esphome/components/update/* @jesserockz
 esphome/components/uponor_smatrix/* @kroimon
+esphome/components/usb_audio/* @ab-tools
 esphome/components/usb_cdc_acm/* @kbx81
 esphome/components/usb_host/* @clydebarrow
 esphome/components/usb_uart/* @clydebarrow
 esphome/components/valve/* @esphome/core
 esphome/components/vbus/* @ssieb
 esphome/components/veml3235/* @kbx81
+esphome/components/veml6040/* @aalaei
 esphome/components/veml7700/* @latonita
 esphome/components/version/* @esphome/core
 esphome/components/vevor_dtx/* @Bofr5555
+esphome/components/vl53l1x/* @will-tm
 esphome/components/voice_assistant/* @jesserockz @kahrendt
 esphome/components/wake_on_lan/* @clydebarrow @willwill2will54
 esphome/components/watchdog/* @oarcher

codecov.yml

@@ -11,6 +11,9 @@ coverage:
 ignore:
   - "esphome/components/**/*"
   - "esphome/analyze_memory/**/*"
+  # Run as standalone scripts under the ESP-IDF Python, never imported by pytest
+  - "esphome/espidf/get_idf_tool_paths.py"
+  - "esphome/espidf/get_idf_version.py"
   - "tests/integration/**/*"
 
 comment:

docker/Dockerfile

@@ -22,7 +22,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.24.0
+RUN uv pip install --no-cache-dir esphome-device-builder==1.26.0
 
 RUN \
     platformio settings set enable_telemetry No \

esphome/__main__.py

@@ -791,6 +791,7 @@ def write_cpp(config: ConfigType) -> int:
 
     if not get_bool_env(ENV_NOGITIGNORE):
         writer.write_gitignore()
+    writer.check_build_tree_not_tracked()
 
     generate_cpp_contents(config)
     return write_cpp_file()

esphome/automation.py

@@ -430,12 +430,20 @@ def _apply_function(
 ) -> MockObj:
     """Emit the generated function and declare ``id_`` as the ``ApplyAction`` or
     ``ApplyCondition`` templated on it, so ``play()`` calls it directly."""
-    fn = cg.static_function(
-        f"esphome__{id_.id}__fn", return_type, lambda_args, statements
-    )
+    fn = apply_static_function(id_, return_type, lambda_args, statements)
     return cg.new_Pvariable(id_, cg.TemplateArguments(fn, *template_arg))
 
 
+def apply_static_function(
+    id_: ID,
+    return_type: SafeExpType,
+    params: TemplateArgsType,
+    statements: list[str],
+) -> MockObj:
+    """Emit the static function generated for ``id_`` and return an expression naming it."""
+    return cg.static_function(f"esphome__{id_.id}__fn", return_type, params, statements)
+
+
 async def _render_values(
     name: str,
     target: str,

esphome/build_gen/espidf.py

@@ -8,12 +8,14 @@ import textwrap
 
 from esphome.build_helpers import pch
 from esphome.components.esp32 import (
+    KEY_SRC_CMAKE,
     get_esp32_variant,
     get_excluded_builtin_components,
     get_managed_component_require_names,
     idf_version,
 )
 import esphome.config_validation as cv
+from esphome.const import KEY_ESP32
 from esphome.core import CORE
 from esphome.espidf import variant_to_idf_target
 from esphome.framework_helpers import (
@@ -460,6 +462,7 @@ def get_component_cmakelists() -> str:
     # get_project_cmakelists so they reach every component, not just src/.
     link_opts = get_project_link_flags()
     link_opts_str = "\n    ".join(link_opts) if link_opts else ""
+    src_cmake = "\n".join(CORE.data[KEY_ESP32].get(KEY_SRC_CMAKE, []))
 
     return f"""\
 # Auto-generated by ESPHome
@@ -505,6 +508,7 @@ idf_component_register(
 target_link_options(${{COMPONENT_LIB}} PUBLIC
     {link_opts_str}
 )
+{src_cmake}
 {_pch_cmake_block()}"""
 
 

esphome/codegen.py

@@ -53,6 +53,7 @@ from esphome.cpp_generator import (  # noqa: F401
     with_local_variable,
 )
 from esphome.cpp_helpers import (  # noqa: F401
+    add_optional,
     add_pin,
     add_variable,
     build_registry_entry,

esphome/components/absolute_humidity/absolute_humidity.cpp

@@ -10,7 +10,7 @@ void AbsoluteHumidityComponent::setup() {
     this->temperature_ = state;
     this->enable_loop();
   });
-  ESP_LOGD(TAG, "  Added callback for temperature '%s'", this->temperature_sensor_->get_name().c_str());
+  ESP_LOGD(TAG, "  Added callback for temperature '%s'", LOG_STR_ARG(this->temperature_sensor_->get_log_name()));
   // Get initial value
   if (this->temperature_sensor_->has_state()) {
     this->temperature_ = this->temperature_sensor_->get_state();
@@ -20,7 +20,7 @@ void AbsoluteHumidityComponent::setup() {
     this->humidity_ = state;
     this->enable_loop();
   });
-  ESP_LOGD(TAG, "  Added callback for relative humidity '%s'", this->humidity_sensor_->get_name().c_str());
+  ESP_LOGD(TAG, "  Added callback for relative humidity '%s'", LOG_STR_ARG(this->humidity_sensor_->get_log_name()));
   // Get initial value
   if (this->humidity_sensor_->has_state()) {
     this->humidity_ = this->humidity_sensor_->get_state();
@@ -49,7 +49,8 @@ void AbsoluteHumidityComponent::dump_config() {
                 "Sources\n"
                 "  Temperature: '%s'\n"
                 "  Relative Humidity: '%s'",
-                this->temperature_sensor_->get_name().c_str(), this->humidity_sensor_->get_name().c_str());
+                LOG_STR_ARG(this->temperature_sensor_->get_log_name()),
+                LOG_STR_ARG(this->humidity_sensor_->get_log_name()));
 }
 
 void AbsoluteHumidityComponent::loop() {

esphome/components/ac_dimmer/ac_dimmer.cpp

@@ -184,11 +184,9 @@ void AcDimmer::setup() {
   this->store_.zero_cross_pin_number = this->zero_cross_pin_->get_pin();
   this->store_.min_power = static_cast<uint16_t>(this->min_power_ * 1000);
   this->min_power_ = 0;
-  this->store_.method = this->method_;
 
   if (setup_zero_cross_pin) {
     this->zero_cross_pin_->setup();
-    this->store_.zero_cross_pin = this->zero_cross_pin_->to_isr();
     this->zero_cross_pin_->attach_interrupt(&AcDimmerDataStore::s_gpio_intr, &this->store_,
                                             this->zero_cross_interrupt_type_);
   }
@@ -227,24 +225,18 @@ void AcDimmer::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "AcDimmer:\n"
                 "  Min Power: %.1f%%\n"
-                "  Init with half cycle: %s",
-                this->store_.min_power / 10.0f, YESNO(this->init_with_half_cycle_));
+                "  Init with half cycle: %s\n"
+                "  Interrupt Type: %s\n"
+                "  Method: %s",
+                this->store_.min_power / 10.0f, YESNO(this->init_with_half_cycle_),
+                this->zero_cross_interrupt_type_ == gpio::INTERRUPT_RISING_EDGE    ? LOG_STR_LITERAL("rising")
+                : this->zero_cross_interrupt_type_ == gpio::INTERRUPT_FALLING_EDGE ? LOG_STR_LITERAL("falling")
+                                                                                   : LOG_STR_LITERAL("any"),
+                this->store_.method == DIM_METHOD_LEADING_PULSE ? LOG_STR_LITERAL("leading pulse")
+                : this->store_.method == DIM_METHOD_LEADING     ? LOG_STR_LITERAL("leading")
+                                                                : LOG_STR_LITERAL("trailing"));
   LOG_PIN("  Output Pin: ", this->gate_pin_);
   LOG_PIN("  Zero-Cross Pin: ", this->zero_cross_pin_);
-  if (this->zero_cross_interrupt_type_ == gpio::INTERRUPT_RISING_EDGE) {
-    ESP_LOGCONFIG(TAG, "  Interrupt Type: rising");
-  } else if (this->zero_cross_interrupt_type_ == gpio::INTERRUPT_FALLING_EDGE) {
-    ESP_LOGCONFIG(TAG, "  Interrupt Type: falling");
-  } else {
-    ESP_LOGCONFIG(TAG, "  Interrupt Type: any");
-  }
-  if (method_ == DIM_METHOD_LEADING_PULSE) {
-    ESP_LOGCONFIG(TAG, "  Method: leading pulse");
-  } else if (method_ == DIM_METHOD_LEADING) {
-    ESP_LOGCONFIG(TAG, "  Method: leading");
-  } else {
-    ESP_LOGCONFIG(TAG, "  Method: trailing");
-  }
   LOG_FLOAT_OUTPUT(this);
   ESP_LOGV(TAG, "  Estimated Frequency: %.3fHz", 1e6f / this->store_.cycle_time_us / 2);
 }

esphome/components/ac_dimmer/ac_dimmer.h

@@ -6,19 +6,11 @@
 
 namespace esphome::ac_dimmer {
 
-enum DimMethod { DIM_METHOD_LEADING_PULSE = 0, DIM_METHOD_LEADING, DIM_METHOD_TRAILING };
+enum DimMethod : uint8_t { DIM_METHOD_LEADING_PULSE = 0, DIM_METHOD_LEADING, DIM_METHOD_TRAILING };
 
 struct AcDimmerDataStore {
-  /// Zero-cross pin
-  ISRInternalGPIOPin zero_cross_pin;
-  /// Zero-cross pin number - used to share ZC pin across multiple dimmers
-  uint8_t zero_cross_pin_number;
   /// Output pin to write to
   ISRInternalGPIOPin gate_pin;
-  /// Value of the dimmer - 0 to 65535.
-  uint16_t value;
-  /// Minimum power for activation
-  uint16_t min_power;
   /// Time between the last two ZC pulses
   uint32_t cycle_time_us;
   /// Time (in micros()) of last ZC signal
@@ -27,6 +19,12 @@ struct AcDimmerDataStore {
   uint32_t enable_time_us;
   /// Time since last ZC pulse to disable gate pin. 0 means no disable.
   uint32_t disable_time_us;
+  /// Value of the dimmer - 0 to 65535.
+  uint16_t value;
+  /// Minimum power for activation
+  uint16_t min_power;
+  /// Zero-cross pin number - used to share ZC pin across multiple dimmers
+  uint8_t zero_cross_pin_number;
   /// Set to send the first half ac cycle complete
   bool init_cycle;
   /// Dimmer method
@@ -50,17 +48,16 @@ class AcDimmer final : public output::FloatOutput, public Component {
   void set_zero_cross_pin(InternalGPIOPin *zero_cross_pin) { zero_cross_pin_ = zero_cross_pin; }
   void set_zero_cross_interrupt_type(gpio::InterruptType type) { zero_cross_interrupt_type_ = type; }
   void set_init_with_half_cycle(bool init_with_half_cycle) { init_with_half_cycle_ = init_with_half_cycle; }
-  void set_method(DimMethod method) { method_ = method; }
+  void set_method(DimMethod method) { this->store_.method = method; }
 
  protected:
   void write_state(float state) override;
 
   InternalGPIOPin *gate_pin_;
   InternalGPIOPin *zero_cross_pin_;
-  gpio::InterruptType zero_cross_interrupt_type_;
   AcDimmerDataStore store_;
+  gpio::InterruptType zero_cross_interrupt_type_;
   bool init_with_half_cycle_;
-  DimMethod method_;
 };
 
 }  // namespace esphome::ac_dimmer

esphome/components/adc/adc_sensor_common.cpp

@@ -66,7 +66,7 @@ template class Aggregator<uint32_t>;
 
 void ADCSensor::update() {
   float value_v = this->sample();
-  ESP_LOGV(TAG, "'%s': Voltage=%.4fV", this->get_name().c_str(), value_v);
+  ESP_LOGV(TAG, "'%s': Voltage=%.4fV", LOG_STR_ARG(this->get_log_name()), value_v);
   this->publish_state(value_v);
 }
 

esphome/components/adc/adc_sensor_esp32.cpp

@@ -94,11 +94,11 @@ void ADCSensor::setup() {
     }
 #elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
     adc_cali_line_fitting_config_t cali_config = {
-      .unit_id = this->adc_unit_,
-      .atten = this->attenuation_,
-      .bitwidth = ADC_BITWIDTH_DEFAULT,
+        .unit_id = this->adc_unit_,
+        .atten = this->attenuation_,
+        .bitwidth = ADC_BITWIDTH_DEFAULT,
 #if !defined(USE_ESP32_VARIANT_ESP32S2) && !defined(USE_ESP32_VARIANT_ESP32C2)
-      .default_vref = 1100,  // Default reference voltage in mV
+        .default_vref = 1100,  // Default reference voltage in mV
 #endif  // !defined(USE_ESP32_VARIANT_ESP32S2) && !defined(USE_ESP32_VARIANT_ESP32C2)
     };
     err = adc_cali_create_scheme_line_fitting(&cali_config, &handle);
@@ -248,11 +248,11 @@ float ADCSensor::sample_autorange_() {
               (err == ESP_OK) ? "SUCCESS" : "FAILED", err);
 #elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
     adc_cali_line_fitting_config_t cali_config = {
-      .unit_id = this->adc_unit_,
-      .atten = atten,
-      .bitwidth = ADC_BITWIDTH_DEFAULT,
+        .unit_id = this->adc_unit_,
+        .atten = atten,
+        .bitwidth = ADC_BITWIDTH_DEFAULT,
 #if !defined(USE_ESP32_VARIANT_ESP32S2) && !defined(USE_ESP32_VARIANT_ESP32C2)
-      .default_vref = 1100,
+        .default_vref = 1100,
 #endif
     };
     err = adc_cali_create_scheme_line_fitting(&cali_config, &handle);

esphome/components/adc/adc_sensor_zephyr.cpp

@@ -111,6 +111,8 @@ static const LogString *input_to_str(uint8_t input) {
       return LOG_STR("VDD");
     case NRF_SAADC_INPUT_VDDHDIV5:
       return LOG_STR("VDDHDIV5");
+    default:
+      break;
   }
   return LOG_STR("undefined input");
 }

esphome/components/ads1115/sensor/ads1115_sensor.cpp

@@ -13,7 +13,7 @@ float ADS1115Sensor::sample() {
 void ADS1115Sensor::update() {
   float v = this->sample();
   if (!std::isnan(v)) {
-    ESP_LOGD(TAG, "'%s': Got Voltage=%fV", this->get_name().c_str(), v);
+    ESP_LOGD(TAG, "'%s': Got Voltage=%fV", LOG_STR_ARG(this->get_log_name()), v);
     this->publish_state(v);
   }
 }

esphome/components/ads1118/sensor/ads1118_sensor.cpp

@@ -21,7 +21,7 @@ float ADS1118Sensor::sample() {
 void ADS1118Sensor::update() {
   float v = this->sample();
   if (!std::isnan(v)) {
-    ESP_LOGD(TAG, "'%s': Got Voltage=%fV", this->get_name().c_str(), v);
+    ESP_LOGD(TAG, "'%s': Got Voltage=%fV", LOG_STR_ARG(this->get_log_name()), v);
     this->publish_state(v);
   }
 }

esphome/components/airton/airton.cpp

@@ -136,13 +136,7 @@ void AirtonClimate::transmit_state() {
   data->set_carrier_frequency(AIRTON_IR_FREQUENCY);
   data->mark(AIRTON_HEADER_MARK);
   data->space(AIRTON_HEADER_SPACE);
-  for (uint8_t payload_byte : remote_state) {
-    for (uint8_t payload_bit_cursor = 0; payload_bit_cursor < 8; payload_bit_cursor++) {
-      data->mark(AIRTON_BIT_MARK);
-      bool bit = payload_byte & (1 << payload_bit_cursor);
-      data->space(bit ? AIRTON_ONE_SPACE : AIRTON_ZERO_SPACE);
-    }
-  }
+  data->item_bytes<AIRTON_BIT_TIMINGS>(remote_state, AIRTON_STATE_FRAME_SIZE);
 
   data->mark(AIRTON_BIT_MARK);
   data->space(AIRTON_MESSAGE_SPACE);
@@ -267,6 +261,8 @@ void AirtonClimate::parse_state_frame_(const uint8_t *frame) {
     case AIRTON_FAN_AUTO:
       this->fan_mode = climate::CLIMATE_FAN_AUTO;
       break;
+    default:
+      break;
   }
 
   this->target_temperature = (frame[3] & 0b00001111) + AIRTON_TEMP_MIN;
@@ -284,20 +280,14 @@ void AirtonClimate::parse_state_frame_(const uint8_t *frame) {
 }
 
 bool AirtonClimate::on_receive(remote_base::RemoteReceiveData data) {
-  uint8_t remote_state[AIRTON_STATE_FRAME_SIZE] = {};
+  uint8_t remote_state[AIRTON_STATE_FRAME_SIZE];
   if (!data.expect_item(AIRTON_HEADER_MARK, AIRTON_HEADER_SPACE)) {
     ESP_LOGV(TAG, "Wrong header encoding detected!");
     return false;
   }
-  for (int i = 0; i < AIRTON_STATE_FRAME_SIZE; i++) {
-    for (int j = 0; j < 8; j++) {
-      if (data.expect_item(AIRTON_BIT_MARK, AIRTON_ONE_SPACE)) {
-        remote_state[i] |= 1 << j;
-      } else if (!data.expect_item(AIRTON_BIT_MARK, AIRTON_ZERO_SPACE)) {
-        ESP_LOGV(TAG, "Wrong modulation encoding for: Byte %d, bit %d", i, j);
-        return false;
-      }
-    }
+  if (!data.expect_bytes<AIRTON_BIT_TIMINGS>(remote_state, AIRTON_STATE_FRAME_SIZE)) {
+    ESP_LOGV(TAG, "Wrong modulation encoding");
+    return false;
   }
 
   if (remote_state[0] != AIRTON_HEADER_BYTE0 || remote_state[1] != AIRTON_HEADER_BYTE1) {

esphome/components/airton/airton.h

@@ -36,8 +36,8 @@ static constexpr uint32_t AIRTON_IR_FREQUENCY = 38000;
 static constexpr uint32_t AIRTON_HEADER_MARK = 6630;
 static constexpr uint32_t AIRTON_HEADER_SPACE = 3350;
 static constexpr uint32_t AIRTON_BIT_MARK = 400;
-static constexpr uint32_t AIRTON_ONE_SPACE = 1260;
-static constexpr uint32_t AIRTON_ZERO_SPACE = 430;
+static constexpr remote_base::BitTimings AIRTON_BIT_TIMINGS{
+    .bit_mark = AIRTON_BIT_MARK, .one_space = 1260, .zero_space = 430};
 static constexpr uint32_t AIRTON_MESSAGE_SPACE = 100000;
 
 static constexpr uint8_t AIRTON_STATE_FRAME_SIZE = 7;

esphome/components/airton/switch/__init__.py

@@ -8,19 +8,18 @@ from ..climate import CONF_AIRTON_ID, CONF_SLEEP_MODE, AirtonClimate, airton_ns
 
 CODEOWNERS = ["@Procsiab"]
 
-AirtonSwitch = airton_ns.class_("AirtonSwitch", switch.Switch)
 AirtonSetting = airton_ns.enum("AirtonSetting", is_class=True)
 
 CONFIG_SCHEMA = cv.Schema(
     {
         cv.GenerateID(CONF_AIRTON_ID): cv.use_id(AirtonClimate),
         cv.Optional(CONF_DISPLAY): switch.switch_schema(
-            AirtonSwitch,
+            switch.ApplySwitch,
             entity_category=ENTITY_CATEGORY_CONFIG,
             default_restore_mode="DISABLED",
         ),
         cv.Optional(CONF_SLEEP_MODE): switch.switch_schema(
-            AirtonSwitch,
+            switch.ApplySwitch,
             entity_category=ENTITY_CATEGORY_CONFIG,
             default_restore_mode="DISABLED",
         ),
@@ -32,10 +31,12 @@ async def to_code(config: ConfigType) -> None:
     hub = await cg.get_variable(config[CONF_AIRTON_ID])
     switches = switch.sub_switches(config, parent=hub)
     await switches(
-        CONF_DISPLAY, hub.set_display_switch, AirtonSetting.AIRTON_SETTING_DISPLAY
+        CONF_DISPLAY,
+        hub.set_display_switch,
+        apply=f"set_setting({AirtonSetting.AIRTON_SETTING_DISPLAY}, state)",
     )
     await switches(
         CONF_SLEEP_MODE,
         hub.set_sleep_mode_switch,
-        AirtonSetting.AIRTON_SETTING_SLEEP_MODE,
+        apply=f"set_setting({AirtonSetting.AIRTON_SETTING_SLEEP_MODE}, state)",
     )

esphome/components/airton/switch/airton_switch.h

@@ -1,19 +0,0 @@
-#pragma once
-
-#include "esphome/components/switch/switch.h"
-#include "../airton.h"
-
-namespace esphome::airton {
-
-// One of the unit's on/off settings; the parent sends the state and publishes it back
-class AirtonSwitch : public switch_::Switch, public Parented<AirtonClimate> {
- public:
-  explicit AirtonSwitch(AirtonSetting setting) : setting_(setting) {}
-
- protected:
-  void write_state(bool state) override { this->parent_->set_setting(this->setting_, state); }
-
-  AirtonSetting setting_;
-};
-
-}  // namespace esphome::airton

esphome/components/alarm_control_panel/alarm_control_panel.cpp

@@ -31,7 +31,7 @@ void AlarmControlPanel::publish_state(AlarmControlPanelState state) {
   this->last_update_ = millis();
   if (state != this->current_state_) {
     auto prev_state = this->current_state_;
-    ESP_LOGV(TAG, "'%s' >> %s (was %s)", this->get_name().c_str(),
+    ESP_LOGV(TAG, "'%s' >> %s (was %s)", LOG_STR_ARG(this->get_log_name()),
              LOG_STR_ARG(alarm_control_panel_state_to_string(state)),
              LOG_STR_ARG(alarm_control_panel_state_to_string(prev_state)));
     this->current_state_ = state;

esphome/components/am43/cover/am43_cover.cpp

@@ -30,9 +30,9 @@ void Am43Component::loop() {
     auto status =
         esp_ble_gattc_write_char(this->parent_->get_gattc_if(), this->parent_->get_conn_id(), this->char_handle_,
                                  packet->length, packet->data, ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
-    ESP_LOGI(TAG, "[%s] Logging into AM43", this->get_name().c_str());
+    ESP_LOGI(TAG, "[%s] Logging into AM43", LOG_STR_ARG(this->get_log_name()));
     if (status) {
-      ESP_LOGW(TAG, "[%s] Error writing set_pin to device, error = %d", this->get_name().c_str(), status);
+      ESP_LOGW(TAG, "[%s] Error writing set_pin to device, error = %d", LOG_STR_ARG(this->get_log_name()), status);
     } else {
       this->logged_in_ = true;
     }
@@ -50,7 +50,7 @@ CoverTraits Am43Component::get_traits() {
 
 void Am43Component::control(const CoverCall &call) {
   if (this->node_state != espbt::ClientState::ESTABLISHED) {
-    ESP_LOGW(TAG, "[%s] Cannot send cover control, not connected", this->get_name().c_str());
+    ESP_LOGW(TAG, "[%s] Cannot send cover control, not connected", LOG_STR_ARG(this->get_log_name()));
     return;
   }
   if (call.get_stop()) {
@@ -59,7 +59,7 @@ void Am43Component::control(const CoverCall &call) {
         esp_ble_gattc_write_char(this->parent_->get_gattc_if(), this->parent_->get_conn_id(), this->char_handle_,
                                  packet->length, packet->data, ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
     if (status) {
-      ESP_LOGW(TAG, "[%s] Error writing stop command to device, error = %d", this->get_name().c_str(), status);
+      ESP_LOGW(TAG, "[%s] Error writing stop command to device, error = %d", LOG_STR_ARG(this->get_log_name()), status);
     }
   }
   auto opt_pos = call.get_position();
@@ -73,7 +73,8 @@ void Am43Component::control(const CoverCall &call) {
         esp_ble_gattc_write_char(this->parent_->get_gattc_if(), this->parent_->get_conn_id(), this->char_handle_,
                                  packet->length, packet->data, ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
     if (status) {
-      ESP_LOGW(TAG, "[%s] Error writing set_position command to device, error = %d", this->get_name().c_str(), status);
+      ESP_LOGW(TAG, "[%s] Error writing set_position command to device, error = %d", LOG_STR_ARG(this->get_log_name()),
+               status);
     }
   }
 }
@@ -89,9 +90,9 @@ void Am43Component::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_
       auto *chr = this->parent_->get_characteristic(AM43_SERVICE_UUID, AM43_CHARACTERISTIC_UUID);
       if (chr == nullptr) {
         if (this->parent_->get_characteristic(AM43_TUYA_SERVICE_UUID, AM43_TUYA_CHARACTERISTIC_UUID) != nullptr) {
-          ESP_LOGE(TAG, "[%s] Detected a Tuya AM43 which is not supported, sorry.", this->get_name().c_str());
+          ESP_LOGE(TAG, "[%s] Detected a Tuya AM43 which is not supported, sorry.", LOG_STR_ARG(this->get_log_name()));
         } else {
-          ESP_LOGE(TAG, "[%s] No control service found at device, not an AM43..?", this->get_name().c_str());
+          ESP_LOGE(TAG, "[%s] No control service found at device, not an AM43..?", LOG_STR_ARG(this->get_log_name()));
         }
         break;
       }
@@ -100,7 +101,8 @@ void Am43Component::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_
       auto status = esp_ble_gattc_register_for_notify(this->parent_->get_gattc_if(), this->parent_->get_remote_bda(),
                                                       chr->handle);
       if (status) {
-        ESP_LOGW(TAG, "[%s] esp_ble_gattc_register_for_notify failed, status=%d", this->get_name().c_str(), status);
+        ESP_LOGW(TAG, "[%s] esp_ble_gattc_register_for_notify failed, status=%d", LOG_STR_ARG(this->get_log_name()),
+                 status);
       }
       break;
     }
@@ -126,25 +128,26 @@ void Am43Component::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_
 
       if (this->decoder_->has_pin_response()) {
         if (this->decoder_->pin_ok_) {
-          ESP_LOGI(TAG, "[%s] AM43 pin accepted.", this->get_name().c_str());
+          ESP_LOGI(TAG, "[%s] AM43 pin accepted.", LOG_STR_ARG(this->get_log_name()));
           auto *packet = this->encoder_->get_position_request();
           auto status = esp_ble_gattc_write_char(this->parent_->get_gattc_if(), this->parent_->get_conn_id(),
                                                  this->char_handle_, packet->length, packet->data,
                                                  ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
           if (status) {
-            ESP_LOGW(TAG, "[%s] Error writing set_position to device, error = %d", this->get_name().c_str(), status);
+            ESP_LOGW(TAG, "[%s] Error writing set_position to device, error = %d", LOG_STR_ARG(this->get_log_name()),
+                     status);
           }
         } else {
-          ESP_LOGW(TAG, "[%s] AM43 pin rejected!", this->get_name().c_str());
+          ESP_LOGW(TAG, "[%s] AM43 pin rejected!", LOG_STR_ARG(this->get_log_name()));
         }
       }
 
       if (this->decoder_->has_set_position_response() && !this->decoder_->set_position_ok_) {
-        ESP_LOGW(TAG, "[%s] Got nack after sending set_position. Bad pin?", this->get_name().c_str());
+        ESP_LOGW(TAG, "[%s] Got nack after sending set_position. Bad pin?", LOG_STR_ARG(this->get_log_name()));
       }
 
       if (this->decoder_->has_set_state_response() && !this->decoder_->set_state_ok_) {
-        ESP_LOGW(TAG, "[%s] Got nack after sending set_state. Bad pin?", this->get_name().c_str());
+        ESP_LOGW(TAG, "[%s] Got nack after sending set_state. Bad pin?", LOG_STR_ARG(this->get_log_name()));
       }
       break;
     }

esphome/components/anova/anova.cpp

@@ -67,8 +67,9 @@ void Anova::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_
     case ESP_GATTC_SEARCH_CMPL_EVT: {
       auto *chr = this->parent_->get_characteristic(ANOVA_SERVICE_UUID, ANOVA_CHARACTERISTIC_UUID);
       if (chr == nullptr) {
-        ESP_LOGW(TAG, "[%s] No control service found at device, not an Anova..?", this->get_name().c_str());
-        ESP_LOGW(TAG, "[%s] Note, this component does not currently support Anova Nano.", this->get_name().c_str());
+        ESP_LOGW(TAG, "[%s] No control service found at device, not an Anova..?", LOG_STR_ARG(this->get_log_name()));
+        ESP_LOGW(TAG, "[%s] Note, this component does not currently support Anova Nano.",
+                 LOG_STR_ARG(this->get_log_name()));
         break;
       }
       this->char_handle_ = chr->handle;
@@ -76,7 +77,8 @@ void Anova::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_
       auto status = esp_ble_gattc_register_for_notify(this->parent_->get_gattc_if(), this->parent_->get_remote_bda(),
                                                       chr->handle);
       if (status) {
-        ESP_LOGW(TAG, "[%s] esp_ble_gattc_register_for_notify failed, status=%d", this->get_name().c_str(), status);
+        ESP_LOGW(TAG, "[%s] esp_ble_gattc_register_for_notify failed, status=%d", LOG_STR_ARG(this->get_log_name()),
+                 status);
       }
       break;
     }

esphome/components/apc1/sensor.py

@@ -2,7 +2,7 @@ from esphome import automation, pins
 from esphome.automation import maybe_simple_id
 import esphome.codegen as cg
 from esphome.components import sensor, uart
-from esphome.components.const import CONF_AQI
+from esphome.components.const import CONF_AQI, CONF_ERROR_CODE
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_ECO2,
@@ -55,7 +55,6 @@ CONF_RAW_HUMIDITY = "raw_humidity"
 CONF_RS0 = "rs0"
 CONF_RS2 = "rs2"
 CONF_RS3 = "rs3"
-CONF_ERROR_CODE = "error_code"
 
 apc1_ns = cg.esphome_ns.namespace("apc1")
 APC1Component = apc1_ns.class_("APC1Component", uart.UARTDevice, cg.Component)