[socket] Rename the filter test so pytest collection stays unique

The bare test_init module name collided with the external components test; the both defines case now also checks the resolver stays in the build.
[socket] Compile the helper files only for components that require them
2026-10-14 18:22:48 +00:00 · 2026-10-02 06:49:15 -05:00 · 2026-10-02 06:38:13 -05:00
767 changed files with 4450 additions and 26766 deletions
@@ -299,7 +299,7 @@ jobs:
      # Pushes any fixes the hooks made back to the pull request. This step
      # must keep its default name: the GitHub App that performs the push
      # locates the workflow run by that name.
-      - uses: pre-commit-ci/lite-action@062bca0919bc9d6e66755cc05074b70c77e111fc # v1.2.0
+      - uses: pre-commit-ci/lite-action@5d6cc0eb514c891a40562a58a8e71576c5c7fb43 # v1.1.0
        if: always()
        with:
          msg: apply automatic formatting fixes
@@ -626,7 +626,7 @@ jobs:
            apt-get install -y libc6-dbg

      - name: Run CodSpeed benchmarks
-        uses: CodSpeedHQ/action@c4fd08a3a159bd0cc208da1e0edf32b8c47d75e5 # v5.4.0
+        uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1
        with:
          run: |
            . venv/bin/activate
@@ -125,20 +125,14 @@ jobs:
            }

            async function getEsphomeAndComponentChanges(github, owner, repo, prNumber) {
-                const changedFiles = await github.paginate(
-                    github.rest.pulls.listFiles,
-                    {
-                        owner: owner,
-                        repo: repo,
-                        pull_number: prNumber,
-                        per_page: 100,
-                    }
-                );
+                const changedFiles = await github.rest.pulls.listFiles({
+                    owner: owner,
+                    repo: repo,
+                    pull_number: prNumber,
+                });

-                // Files used only for development and CI, which do not affect use as an external component
-                const ignoredFiles = ["esphome/core/defines.h", "esphome/idf_component.yml"];
-                const esphomeChanges = changedFiles
-                    .filter(file => !ignoredFiles.includes(file.filename) && file.filename.startsWith('esphome/'))
+                const esphomeChanges = changedFiles.data
+                    .filter(file => file.filename !== "esphome/core/defines.h" && file.filename.startsWith('esphome/'))
                    .map(file => {
                        const match = file.filename.match(/esphome\/([^/]+)/);
                        return match ? match[1] : null;
@@ -150,7 +144,7 @@ jobs:
                }

                const uniqueEsphomeChanges = [...new Set(esphomeChanges)];
-                const componentChanges = changedFiles
+                const componentChanges = changedFiles.data
                    .filter(file => file.filename.startsWith('esphome/components/'))
                    .map(file => {
                        const match = file.filename.match(/esphome\/components\/([^/]+)\//);
@@ -7,6 +7,10 @@ on:
 permissions:
  pull-requests: read  # issues.listLabelsOnIssue to detect blocking labels (needs-docs, needs-developer-docs, merge-after-release, chained-pr)

+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
  check:
    name: Check blocking labels
@@ -15,8 +15,6 @@ on:
  # base branch checkout, so fork code never runs with the token.
  pull_request_target:
    types: [opened, synchronize, reopened]
-    branches:
-      - dev
    paths:
      - requirements_dev.txt
      - requirements_test.txt
@@ -10,7 +10,7 @@ ci:
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
    # Ruff version.
-    rev: v0.16.10
+    rev: v0.16.9
    hooks:
      # Run the linter.
      - id: ruff
@@ -187,12 +187,10 @@ esphome/components/esp32_rmt/* @jesserockz
 esphome/components/esp32_rmt_led_strip/* @jesserockz
 esphome/components/esp8266/* @esphome/core
 esphome/components/esp_ldo/* @clydebarrow
-esphome/components/espectre/* @francescopace
 esphome/components/espnow/* @jesserockz
 esphome/components/espnow/packet_transport/* @EasilyBoredEngineer
 esphome/components/ethernet_info/* @gtjadsonsantos
 esphome/components/event/* @nohat
-esphome/components/exponential_moving_average/* @clydebarrow
 esphome/components/exposure_notifications/* @OttoWinter
 esphome/components/ezo/* @ssieb
 esphome/components/ezo_pmp/* @carlos-sarmiento
@@ -247,11 +245,8 @@ esphome/components/hmac_md5/* @dwmw2
 esphome/components/hmac_sha256/* @dwmw2
 esphome/components/hoermann_hcp/* @zweckj
 esphome/components/homeassistant/* @esphome/core @OttoWinter
-esphome/components/homeassistant/button/* @jesserockz
 esphome/components/homeassistant/number/* @landonr
-esphome/components/homeassistant/select/* @jesserockz
 esphome/components/homeassistant/switch/* @Links2004
-esphome/components/homeassistant/text/* @jesserockz
 esphome/components/honeywell_hih_i2c/* @Benichou34
 esphome/components/honeywellabp/* @RubyBailey
 esphome/components/honeywellabp2_i2c/* @jpfaff
@@ -287,7 +282,6 @@ esphome/components/inkplate/* @jesserockz @JosipKuci
 esphome/components/integration/* @OttoWinter
 esphome/components/internal_temperature/* @Mat931
 esphome/components/interval/* @esphome/core
-esphome/components/ir_rf_base/* @bdraco @kbx81
 esphome/components/ir_rf_proxy/* @kbx81
 esphome/components/it8951/* @koosoli @limengdu @Passific
 esphome/components/jsn_sr04t/* @Mafus1
@@ -566,7 +560,6 @@ esphome/components/tc74/* @sethgirvan
 esphome/components/tca9548a/* @andreashergert1984
 esphome/components/tca9555/* @mobrembski
 esphome/components/tcl112/* @glmnet
-esphome/components/tcp_uart/* @Bascht74
 esphome/components/tee501/* @Stock-M
 esphome/components/teleinfo/* @0hax
 esphome/components/tem3200/* @bakerkj
@@ -608,13 +601,11 @@ esphome/components/uart/button/* @ssieb
 esphome/components/uart/event/* @eoasmxd
 esphome/components/uart/packet_transport/* @clydebarrow
 esphome/components/uart_mux/* @kbx81
-esphome/components/uart_tcp/* @Bascht74
 esphome/components/udp/* @clydebarrow
 esphome/components/ufire_ec/* @pvizeli
 esphome/components/ufire_ise/* @pvizeli
 esphome/components/ufm01/* @ljungqvist
 esphome/components/ultrasonic/* @ssieb @swoboda1337
-esphome/components/unicode/* @esphome/core
 esphome/components/update/* @jesserockz
 esphome/components/uponor_smatrix/* @kroimon
 esphome/components/usb_cdc_acm/* @kbx81
@@ -658,7 +649,6 @@ esphome/components/xiaomi_body_scale/* @dckiller51
 esphome/components/xiaomi_hhccjcy10/* @fariouche
 esphome/components/xiaomi_lywsd02mmc/* @juanluss31
 esphome/components/xiaomi_lywsd03mmc/* @ahpohl
-esphome/components/xiaomi_mccgq02hl/* @ahpohl @morph027
 esphome/components/xiaomi_mhoc303/* @drug123
 esphome/components/xiaomi_mhoc401/* @vevsvevs
 esphome/components/xiaomi_rtcgq02lm/* @jesserockz
@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         = 2026.11.0-dev
+PROJECT_NUMBER         = 2026.10.0-dev

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -22,7 +22,7 @@ RUN \
    -r /requirements.txt

 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.21.0
+RUN uv pip install --no-cache-dir esphome-device-builder==1.19.0

 RUN \
    platformio settings set enable_telemetry No \
@@ -829,9 +829,9 @@ def write_cpp_file() -> int:

 def compile_program(args: ArgsProtocol, config: ConfigType) -> int:
    if CORE.skip_bootloader and not (CORE.is_esp32 and CORE.using_toolchain_esp_idf):
-        # Debug only: an orchestrator cannot see YAML toolchain overrides,
-        # so this is its expected no-op, and a full build is safe.
-        _LOGGER.debug(
+        # Info, not a warning: an orchestrator cannot see YAML toolchain
+        # overrides, this is its expected no-op, and a full build is safe.
+        _LOGGER.info(
            "--skip-bootloader ignored: only supported on ESP32 with the "
            "esp-idf toolchain"
        )
@@ -1300,9 +1300,10 @@ def _choose_ota_platform(config: ConfigType, requested: str | None) -> str:
    The native API uses challenge-response auth with MD5/SHA256 hashing of a
    server-issued nonce, so the password is never sent over the wire; the
    ``web_server`` path uses HTTP Basic auth which transmits credentials in
-    cleartext over the LAN. (The native path also compresses the upload:
-    gzip on ESP8266 and RP2040, which inflate it at reboot, and a deflate
-    stream on ESP32/LibreTiny, which inflate it as it arrives.) Falls back to
+    cleartext over the LAN. (The native path also supports gzip compression
+    on ESP8266, where flash space is tight; on ESP32/RP2040/LibreTiny the
+    backend reports ``supports_compression() == false`` and the firmware is
+    sent uncompressed regardless of which platform is used.) Falls back to
    ``web_server`` only when that is the only available platform.
    """
    # Use a dict (insertion-ordered) instead of a list so error messages and
@@ -21,7 +21,7 @@ from esphome.const import (
    CONF_TYPE_ID,
    CONF_UPDATE_INTERVAL,
 )
-from esphome.core import CORE, ID, EsphomeError, HexInt, Lambda
+from esphome.core import CORE, ID, EsphomeError, Lambda
 from esphome.cpp_generator import (
    FlashStringLiteral,
    LambdaExpression,
@@ -35,32 +35,6 @@ from esphome.types import ConfigType, SafeExpType
 from esphome.util import Registry


-def progmem_bytes(name: str, data: bytes | list[int]) -> MockObj:
-    """Shared PROGMEM table for constant bytes; equal payloads share one, empty is nullptr."""
-    if not data:
-        return cg.nullptr
-    return cg.shared_progmem_array(
-        name, cg.uint8, cg.ArrayInitializer(*(HexInt(x) for x in data))
-    )
-
-
-async def templatable_bytes(
-    value: Any,
-    args: TemplateArgsType,
-    set_template: MockObj,
-    set_static: MockObj,
-    table_name: str,
-) -> None:
-    """Set a TemplatableBytes: a lambda via set_template, constant bytes via set_static."""
-    if cg.is_template(value):
-        fn = await cg.templatable(value, args, cg.std_vector.template(cg.uint8))
-        cg.add(set_template(fn))
-    elif len(value) > 0xFFFF:
-        raise EsphomeError(f"Byte payload is {len(value)} bytes; the maximum is 65535")
-    else:
-        cg.add(set_static(progmem_bytes(table_name, value), len(value)))
-
-
 def maybe_simple_id(*validators):
    """Allow a raw ID to be specified in place of a config block.
    If the value that's being validated is a dictionary, it's passed as-is to the specified validators. Otherwise, it's
@@ -66,43 +66,6 @@ else()
        "app edits will regenerate sections.ld.")
 endif()"""

-# lwip sources that compile to empty objects with the option off (their own
-# #if guard). (option, regex valid for both Python and CMake); a source is
-# only dropped when its option is defined and off, so a renamed option
-# keeps it.
-LWIP_EMPTY_SOURCES: tuple[tuple[str, str], ...] = (
-    ("CONFIG_LWIP_PPP_SUPPORT", "/netif/ppp/"),
-    ("CONFIG_LWIP_IPV6", "/core/ipv6/"),
-    ("CONFIG_LWIP_AUTOIP", "/core/ipv4/autoip[.]c$"),
-    ("CONFIG_LWIP_STATS", "/core/stats[.]c$"),
-)
-# Drift guard only: keep every lwip source.
-LWIP_FULL_SOURCES_ENV = "ESPHOME_LWIP_FULL_SOURCES"
-
-# Drops the empty objects after project(), once the lwip target exists.
-_LWIP_EMPTY_SOURCES_FILTER = f"""\
-idf_build_get_property(esphome_build_components BUILD_COMPONENTS)
-if(lwip IN_LIST esphome_build_components AND NOT DEFINED ENV{{{LWIP_FULL_SOURCES_ENV}}})
-    idf_component_get_property(esphome_lwip_lib lwip COMPONENT_LIB)
-    get_target_property(esphome_lwip_srcs ${{esphome_lwip_lib}} SOURCES)
-@FILTERS@
-    set_property(TARGET ${{esphome_lwip_lib}} PROPERTY SOURCES ${{esphome_lwip_srcs}})
-endif()"""
-
-
-def lwip_empty_source_gate(option: str, regex: str) -> str:
-    return (
-        f"    if(DEFINED {option} AND NOT {option})\n"
-        f'        list(FILTER esphome_lwip_srcs EXCLUDE REGEX "{regex}")\n'
-        "    endif()"
-    )
-
-
-def _lwip_empty_sources_filter() -> str:
-    gates = "\n".join(lwip_empty_source_gate(*entry) for entry in LWIP_EMPTY_SOURCES)
-    return _LWIP_EMPTY_SOURCES_FILTER.replace("@FILTERS@", gates)
-
-
 # Runs after project() so the walk has happened; catches the remaining
 # silent path where the top-level out-var was renamed.
 _LDGEN_OVERRIDE_CHECK = """\
@@ -160,7 +123,7 @@ def _cmake_quote(value: str) -> str:

 # CONFIG_APP_BUILD_BOOTLOADER is hidden and force-selected, so it can only be
 # cleared at the CMake level (the same state IDF's RAM-app build type uses).
-# The macro is IDF's __build_process_project_includes plus a few added lines;
+# The macro is IDF's __build_process_project_includes plus two added lines;
 # the flag is ignored and the bootloader builds as usual if IDF changes it.
 IDF_BOOTLOADER_OVERRIDE = """\
 # ESPHome bootloader skip switch; see esphome/espidf/toolchain.py.
@@ -173,9 +136,6 @@ if(ESPHOME_SKIP_BOOTLOADER)
        # skipped) bootloader project_include leaks; keep it defined, or
        # its empty TARGET_SRC_NAME sends file(GLOB_RECURSE) across /.
        idf_build_get_property(idf_target IDF_TARGET)
-        # partition_table's V1 ECDSA signing reads this key, which the
-        # skipped bootloader project_include also sets.
-        get_filename_component(SECURE_BOOT_SIGNING_KEY "${CONFIG_SECURE_BOOT_SIGNING_KEY}" ABSOLUTE BASE_DIR "${project_dir}")
        idf_build_get_property(build_properties __BUILD_PROPERTIES)
        foreach(build_property ${build_properties})
            idf_build_get_property(val ${build_property})
@@ -201,10 +161,6 @@ endif()
 BOOTLOADER_OVERRIDE_ADDED_LINES = (
    'set(CONFIG_APP_BUILD_BOOTLOADER "")',
    "idf_build_get_property(idf_target IDF_TARGET)",
-    (
-        "get_filename_component(SECURE_BOOT_SIGNING_KEY"
-        ' "${CONFIG_SECURE_BOOT_SIGNING_KEY}" ABSOLUTE BASE_DIR "${project_dir}")'
-    ),
 )

 _MACRO = re.compile(
@@ -392,8 +348,6 @@ project({CORE.name})

 {ldgen_override_check}

-{_lwip_empty_sources_filter()}
-
 # Emit per-memory-type JSON size data for ESPHome to read post-build.
 # json2 stays small; raw dumps every symbol (~2s on a large map) and
 # this command runs inside the link edge, blocking everything downstream.
@@ -31,7 +31,6 @@ from esphome.cpp_generator import (  # noqa: F401
    add_global,
    add_library,
    add_platformio_option,
-    extern_progmem_array,
    get_variable,
    get_variable_with_full_id,
    is_template,
@@ -41,7 +40,6 @@ from esphome.cpp_generator import (  # noqa: F401
    progmem_array,
    safe_exp,
    set_cpp_standard,
-    shared_progmem_array,
    statement,
    static_const_array,
    static_function,
@@ -62,10 +62,16 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_TVOC, var.set_tvoc)
-    await sensors(CONF_VERSION, var.set_version)
-    await sensors(CONF_RESISTANCE, var.set_resistance)
+    sens = await sensor.new_sensor(config[CONF_TVOC])
+    cg.add(var.set_tvoc(sens))
+
+    if version_config := config.get(CONF_VERSION):
+        sens = await sensor.new_sensor(version_config)
+        cg.add(var.set_version(sens))
+
+    if resistance_config := config.get(CONF_RESISTANCE):
+        sens = await sensor.new_sensor(resistance_config)
+        cg.add(var.set_resistance(sens))


 AGS10_NEW_I2C_ADDRESS_SCHEMA = cv.maybe_simple_value(
@@ -57,6 +57,10 @@ async def to_code(config: ConfigType) -> None:
    await i2c.register_i2c_device(var, config)
    cg.add(var.set_variant(config[CONF_VARIANT]))

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
-    await sensors(CONF_HUMIDITY, var.set_humidity_sensor)
+    if temperature := config.get(CONF_TEMPERATURE):
+        sens = await sensor.new_sensor(temperature)
+        cg.add(var.set_temperature_sensor(sens))
+
+    if humidity := config.get(CONF_HUMIDITY):
+        sens = await sensor.new_sensor(humidity)
+        cg.add(var.set_humidity_sensor(sens))
@@ -46,6 +46,10 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
-    await sensors(CONF_HUMIDITY, var.set_humidity_sensor)
+    if temperature_config := config.get(CONF_TEMPERATURE):
+        sens = await sensor.new_sensor(temperature_config)
+        cg.add(var.set_temperature_sensor(sens))
+
+    if humidity_config := config.get(CONF_HUMIDITY):
+        sens = await sensor.new_sensor(humidity_config)
+        cg.add(var.set_humidity_sensor(sens))
@@ -48,6 +48,10 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
-    await sensors(CONF_HUMIDITY, var.set_humidity_sensor)
+    if temperature_config := config.get(CONF_TEMPERATURE):
+        sens = await sensor.new_sensor(temperature_config)
+        cg.add(var.set_temperature_sensor(sens))
+
+    if humidity_config := config.get(CONF_HUMIDITY):
+        sens = await sensor.new_sensor(humidity_config)
+        cg.add(var.set_humidity_sensor(sens))
@@ -48,6 +48,10 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await ble_client.register_ble_node(var, config)

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_BATTERY_LEVEL, var.set_battery)
-    await sensors(CONF_ILLUMINANCE, var.set_illuminance)
+    if battery_level_config := config.get(CONF_BATTERY_LEVEL):
+        sens = await sensor.new_sensor(battery_level_config)
+        cg.add(var.set_battery(sens))
+
+    if illuminance_config := config.get(CONF_ILLUMINANCE):
+        sens = await sensor.new_sensor(illuminance_config)
+        cg.add(var.set_illuminance(sens))
@@ -1,4 +1,3 @@
-from ipaddress import IPv4Address, IPv6Address
 import logging
 import re
 from typing import Any
@@ -6,7 +5,7 @@ from typing import Any
 from esphome import automation
 from esphome.automation import Condition
 import esphome.codegen as cg
-from esphome.components.const import CONF_DESCRIPTION, CONF_HOST
+from esphome.components.const import CONF_DESCRIPTION
 from esphome.components.logger import request_log_listener

 # ENCRYPTION_SCHEMA and validate_encryption_key are re-exported for external
@@ -27,8 +26,6 @@ from esphome.const import (
    CONF_CAPTURE_RESPONSE,
    CONF_DATA,
    CONF_DATA_TEMPLATE,
-    CONF_DELAY,
-    CONF_ENABLE_IPV6,
    CONF_ENCRYPTION,
    CONF_EVENT,
    CONF_ID,
@@ -51,14 +48,10 @@ from esphome.const import (
    CONF_VARIABLES,
 )
 from esphome.core import CORE, ID, CoroPriority, EsphomeError, coroutine_with_priority
-from esphome.cpp_generator import Expression, MockObj, TemplateArgsType
-import esphome.final_validate as fv
-from esphome.helpers import cpp_string_escape, fnv1_hash
-from esphome.schema_extractors import SCHEMA_EXTRACT, schema_extractor
+from esphome.cpp_generator import MockObj, TemplateArgsType
+from esphome.helpers import fnv1_hash
 from esphome.types import ConfigFragmentType, ConfigType

-from . import wizard
-
 # Compat alias: downstream consumers (e.g. device-builder) referenced the
 # schema by its old private name before it moved to the noise component
 _encryption_schema = encryption_schema
@@ -93,7 +86,6 @@ APIServer = api_ns.class_("APIServer", cg.Component)
 HomeAssistantServiceCallAction = api_ns.class_(
    "HomeAssistantServiceCallAction", automation.Action
 )
-HomeAssistantField = api_ns.struct("HomeAssistantField")
 ActionResponse = api_ns.class_("ActionResponse")
 HomeAssistantActionResponseTrigger = api_ns.class_(
    "HomeAssistantActionResponseTrigger", automation.Trigger
@@ -143,7 +135,6 @@ CONF_HOMEASSISTANT_SERVICES = "homeassistant_services"
 CONF_HOMEASSISTANT_STATES = "homeassistant_states"
 CONF_LISTEN_BACKLOG = "listen_backlog"
 CONF_MAX_SEND_QUEUE = "max_send_queue"
-CONF_OUTGOING_CONNECTION = "outgoing_connection"
 CONF_STATE_SUBSCRIPTION_ONLY = "state_subscription_only"

 # Schema defaults that also match the C++ initializers in api_server.h; codegen
@@ -151,7 +142,6 @@ CONF_STATE_SUBSCRIPTION_ONLY = "state_subscription_only"
 DEFAULT_PORT = 6053
 DEFAULT_REBOOT_TIMEOUT = "15min"
 DEFAULT_BATCH_DELAY = "100ms"
-DEFAULT_LISTEN_BACKLOG = 4


 def _register_provisioning_source(config: ConfigType) -> ConfigType:
@@ -302,72 +292,9 @@ def _consume_api_sockets(config: ConfigType) -> ConfigType:
    # (not max_connections, which is the upper limit rarely reached)
    socket.consume_sockets(3, "api")(config)
    socket.consume_sockets(1, "api", socket.SocketType.TCP_LISTEN)(config)
-    if CONF_OUTGOING_CONNECTION in config:
-        socket.consume_sockets(1, "api_outgoing_connection")(config)
    return config


-def _validate_outgoing_connection(config: ConfigType) -> ConfigType:
-    if (outgoing := config.get(CONF_OUTGOING_CONNECTION)) is None:
-        return config
-    if CONF_ENCRYPTION not in config:
-        raise cv.Invalid(
-            "outgoing_connection requires 'encryption' so the peer is verified by key",
-            path=[CONF_OUTGOING_CONNECTION],
-        )
-    # A device with no client reboots once reboot_timeout passes, so a delay that
-    # reaches it would reboot the device before it ever dials
-    reboot_timeout = config[CONF_REBOOT_TIMEOUT]
-    delay = outgoing[CONF_DELAY]
-    if reboot_timeout.total_milliseconds and delay >= reboot_timeout:
-        raise cv.Invalid(
-            f"delay must be shorter than reboot_timeout ({reboot_timeout}), "
-            "otherwise the device reboots before it dials",
-            path=[CONF_OUTGOING_CONNECTION, CONF_DELAY],
-        )
-    return config
-
-
-def _validate_outgoing_host(value: str) -> IPv4Address | IPv6Address:
-    """Only accept an address the device itself can parse.
-
-    Python accepts a scope id, which neither `inet_pton` nor lwIP's `inet6_aton`
-    takes, and a v4-mapped address is dialed as plain IPv4, needing no IPv6 build.
-    """
-    address = cv.ipaddress(value)
-    if isinstance(address, IPv6Address):
-        if address.scope_id is not None:
-            raise cv.Invalid(
-                f"{value} carries a scope id, which the device cannot parse; "
-                "give the address without the '%' part"
-            )
-        if (mapped := address.ipv4_mapped) is not None:
-            return mapped
-    return address
-
-
-_OUTGOING_CONNECTION_SCHEMA = cv.Schema(
-    {
-        cv.Optional(CONF_HOST): _validate_outgoing_host,
-        cv.Optional(CONF_PORT, default=6054): cv.port,
-        # Bounded against reboot_timeout in _validate_outgoing_connection
-        cv.Optional(CONF_DELAY, default="60s"): cv.positive_time_period_milliseconds,
-    }
-)
-
-
-@schema_extractor("schema")
-def _outgoing_connection_schema(config: ConfigType | None) -> ConfigType:
-    # A bare `outgoing_connection:` block is valid; without a host the device
-    # dials the remembered last dial-back client
-    if config is SCHEMA_EXTRACT:
-        # Let the language-schema dumper walk host, port and delay
-        return _OUTGOING_CONNECTION_SCHEMA
-    if config is None:
-        config = {}
-    return _OUTGOING_CONNECTION_SCHEMA(config)
-
-
 CONFIG_SCHEMA = cv.All(
    cv.Schema(
        {
@@ -392,8 +319,6 @@ CONFIG_SCHEMA = cv.All(
            ): ACTIONS_SCHEMA,
            cv.Exclusive(CONF_ACTIONS, group_of_exclusion=CONF_ACTIONS): ACTIONS_SCHEMA,
            cv.Optional(CONF_ENCRYPTION): encryption_schema,
-            cv.Optional(wizard.CONF_WIZARD): wizard.WIZARD_SCHEMA,
-            cv.Optional(CONF_OUTGOING_CONNECTION): _outgoing_connection_schema,
            cv.Optional(CONF_BATCH_DELAY, default=DEFAULT_BATCH_DELAY): cv.All(
                cv.positive_time_period_milliseconds,
                cv.Range(max=cv.TimePeriod(milliseconds=65535)),
@@ -449,7 +374,6 @@ CONFIG_SCHEMA = cv.All(
        }
    ).extend(cv.COMPONENT_SCHEMA),
    cv.rename_key(CONF_SERVICES, CONF_ACTIONS),
-    _validate_outgoing_connection,
    _consume_api_sockets,
    _register_provisioning_source,
 )
@@ -506,34 +430,7 @@ def _validate_esp8266_action_strings(config: ConfigType) -> ConfigType:
    return config


-def _validate_outgoing_host_ipv6(config: ConfigType) -> ConfigType:
-    """An IPv6 host can never be parsed, so never dialed, without IPv6."""
-    if (
-        (outgoing := config.get(CONF_OUTGOING_CONNECTION)) is None
-        or (host := outgoing.get(CONF_HOST)) is None
-        or host.version != 6
-    ):
-        return config
-    network_conf = fv.full_config.get().get("network") or {}
-    if not network_conf.get(CONF_ENABLE_IPV6):
-        raise cv.Invalid(
-            "outgoing_connection host is an IPv6 address but IPv6 is not "
-            "enabled; set 'network: enable_ipv6: true'",
-            path=[CONF_OUTGOING_CONNECTION, CONF_HOST],
-        )
-    return config
-
-
-def _validate_wizard(config: ConfigType) -> ConfigType:
-    wizard.final_validate(config)
-    return config
-
-
-FINAL_VALIDATE_SCHEMA = cv.All(
-    _validate_esp8266_action_strings,
-    _validate_outgoing_host_ipv6,
-    _validate_wizard,
-)
+FINAL_VALIDATE_SCHEMA = _validate_esp8266_action_strings


 def _add_action_strings(
@@ -580,10 +477,8 @@ async def to_code(config: ConfigType) -> None:
        cg.add(var.set_reboot_timeout(reboot_timeout))
    if (batch_delay := config[CONF_BATCH_DELAY]) != cv.time_period(DEFAULT_BATCH_DELAY):
        cg.add(var.set_batch_delay(batch_delay))
-    if (
-        listen_backlog := config.get(CONF_LISTEN_BACKLOG)
-    ) is not None and listen_backlog != DEFAULT_LISTEN_BACKLOG:
-        cg.add(var.set_listen_backlog(listen_backlog))
+    if CONF_LISTEN_BACKLOG in config:
+        cg.add(var.set_listen_backlog(config[CONF_LISTEN_BACKLOG]))
    cg.add_define("MAX_API_CONNECTIONS", config[CONF_MAX_CONNECTIONS])
    cg.add_define("API_MAX_SEND_QUEUE", config[CONF_MAX_SEND_QUEUE])

@@ -688,9 +583,6 @@ async def to_code(config: ConfigType) -> None:
        # Stack buffer that list-entities copies PROGMEM strings into, sized for the largest action
        cg.add_define("API_USER_ACTION_STRINGS_SCRATCH_SIZE", max(scratch_size, 1))

-    if (wizard_config := config.get(wizard.CONF_WIZARD)) is not None:
-        await wizard.to_code(wizard_config)
-
    if CONF_ON_CLIENT_CONNECTED in config:
        cg.add_define("USE_API_CLIENT_CONNECTED_TRIGGER")
        await automation.build_automation(
@@ -709,7 +601,7 @@ async def to_code(config: ConfigType) -> None:

    if (encryption_config := config.get(CONF_ENCRYPTION, None)) is not None:
        if key := encryption_config.get(CONF_KEY):
-            cg.add(var.set_noise_psk(new_psk_progmem(key)))
+            cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], key)))
            cg.add_define("USE_API_NOISE_PSK_FROM_YAML")
        else:
            # No key provided, but encryption desired
@@ -726,13 +618,6 @@ async def to_code(config: ConfigType) -> None:
    else:
        cg.add_define("USE_API_PLAINTEXT")

-    if (outgoing := config.get(CONF_OUTGOING_CONNECTION)) is not None:
-        cg.add_define("USE_API_OUTGOING_CONNECTION")
-        if (host := outgoing.get(CONF_HOST)) is not None:
-            cg.add_define("API_OUTGOING_CONNECTION_HOST", str(host))
-        cg.add_define("API_OUTGOING_CONNECTION_PORT", outgoing[CONF_PORT])
-        cg.add_define("API_OUTGOING_CONNECTION_DELAY", outgoing[CONF_DELAY])
-
    cg.add_define("USE_API")
    cg.add_global(api_ns.using)

@@ -773,11 +658,6 @@ VARIABLES_SCHEMA = cv.Schema(
    {cv.string: cv.All(_coerce_implicit_lambda, cv.templatable(cv.string_strict))}
 )

-# The action stores each map's entry count in a uint8_t
-_FIELD_MAP_MAX = 255
-DATA_FIELDS_SCHEMA = cv.All(KEY_VALUE_SCHEMA, cv.Length(max=_FIELD_MAP_MAX))
-VARIABLES_FIELDS_SCHEMA = cv.All(VARIABLES_SCHEMA, cv.Length(max=_FIELD_MAP_MAX))
-

 def _validate_response_config(config: ConfigType) -> ConfigType:
    # Validate dependencies:
@@ -812,9 +692,9 @@ HOMEASSISTANT_ACTION_ACTION_SCHEMA = cv.All(
            cv.Exclusive(CONF_ACTION, group_of_exclusion=CONF_ACTION): cv.templatable(
                cv.string
            ),
-            cv.Optional(CONF_DATA, default={}): DATA_FIELDS_SCHEMA,
-            cv.Optional(CONF_DATA_TEMPLATE, default={}): DATA_FIELDS_SCHEMA,
-            cv.Optional(CONF_VARIABLES, default={}): VARIABLES_FIELDS_SCHEMA,
+            cv.Optional(CONF_DATA, default={}): KEY_VALUE_SCHEMA,
+            cv.Optional(CONF_DATA_TEMPLATE, default={}): KEY_VALUE_SCHEMA,
+            cv.Optional(CONF_VARIABLES, default={}): VARIABLES_SCHEMA,
            cv.Optional(CONF_RESPONSE_TEMPLATE): cv.templatable(cv.string),
            cv.Optional(CONF_CAPTURE_RESPONSE, default=False): cv.boolean,
            cv.Optional(CONF_ON_SUCCESS): automation.validate_automation(single=True),
@@ -827,62 +707,6 @@ HOMEASSISTANT_ACTION_ACTION_SCHEMA = cv.All(
 )


-def _field_string(value: str) -> Expression:
-    # ESP8266 can only keep a string in flash as its own PROGMEM array
-    literal = cg.RawExpression(cpp_string_escape(value))
-    if CORE.is_esp8266:
-        return cg.shared_progmem_array("ha_field_str", cg.char, literal)
-    return literal
-
-
-async def _new_service_call_action(
-    server_id: ID,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-    is_event: bool,
-    service: Any,
-    data: dict[str, Any],
-    data_template: dict[str, Any],
-    variables: dict[str, Any],
-) -> MockObj:
-    """Create the action with its name and fields in one shared flash table."""
-    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
-    serv = await cg.get_variable(server_id)
-    field_type = HomeAssistantField.template(template_arg)
-    groups = [data, data_template, variables]
-    # A lambda may keep static state, so a table with lambdas is never shared
-    has_lambda = cg.is_template(service) or any(
-        cg.is_template(value) for group in groups for value in group.values()
-    )
-
-    async def field(key: str | None, value: Any, output_type: Any = None) -> Expression:
-        key_exp = cg.nullptr if key is None else _field_string(key)
-        if cg.is_template(value):
-            # output_type=None lets lambdas return numbers or char pointers; C++ converts them
-            lam = await cg.process_lambda(value, args, return_type=output_type)
-            return cg.RawExpression(f"{field_type}::from_lambda({key_exp}, {lam})")
-        return cg.ArrayInitializer(key_exp, _field_string(value), cg.nullptr)
-
-    entries = [await field(None, service, cg.std_string)]
-    for group in groups:
-        for key, value in group.items():
-            entries.append(await field(key, value))
-    table = cg.shared_progmem_array(
-        "ha_action_fields",
-        field_type,
-        cg.ArrayInitializer(*entries, multiline=True),
-        share=not has_lambda,
-    )
-    return cg.new_Pvariable(
-        action_id, template_arg, serv, is_event, table, *(len(g) for g in groups)
-    )
-
-
-def _service_call_fields(config: ConfigType) -> tuple[dict[str, Any], ...]:
-    return config[CONF_DATA], config[CONF_DATA_TEMPLATE], config[CONF_VARIABLES]
-
-
 # synchronous=False: when on_success/on_error is configured, play() stores the
 # trigger args until the HomeassistantActionResponse arrives, so non-owning args
 # (StringRef into the API receive buffer) must not be used.
@@ -904,15 +728,36 @@ async def homeassistant_service_to_code(
    template_arg: cg.TemplateArguments,
    args: TemplateArgsType,
 ) -> MockObj:
-    var = await _new_service_call_action(
-        config[CONF_ID],
-        action_id,
-        template_arg,
-        args,
-        False,
-        config[CONF_ACTION],
-        *_service_call_fields(config),
-    )
+    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
+    serv = await cg.get_variable(config[CONF_ID])
+    var = cg.new_Pvariable(action_id, template_arg, serv, False)
+    templ = await cg.templatable(config[CONF_ACTION], args, cg.std_string)
+    cg.add(var.set_service(templ))
+
+    # Initialize FixedVectors with exact sizes from config
+    cg.add(var.init_data(len(config[CONF_DATA])))
+    for key, value in config[CONF_DATA].items():
+        # output_type=None because lambdas can return non-string types (int,
+        # float, char*) that TemplatableStringValue converts via to_string.
+        # Static strings are manually wrapped for PROGMEM on ESP8266.
+        templ = await cg.templatable(value, args, None)
+        if isinstance(templ, str):
+            templ = cg.FlashStringLiteral(templ)
+        cg.add(var.add_data(cg.FlashStringLiteral(key), templ))
+
+    cg.add(var.init_data_template(len(config[CONF_DATA_TEMPLATE])))
+    for key, value in config[CONF_DATA_TEMPLATE].items():
+        templ = await cg.templatable(value, args, None)
+        if isinstance(templ, str):
+            templ = cg.FlashStringLiteral(templ)
+        cg.add(var.add_data_template(cg.FlashStringLiteral(key), templ))
+
+    cg.add(var.init_variables(len(config[CONF_VARIABLES])))
+    for key, value in config[CONF_VARIABLES].items():
+        templ = await cg.templatable(value, args, None)
+        if isinstance(templ, str):
+            templ = cg.FlashStringLiteral(templ)
+        cg.add(var.add_variable(cg.FlashStringLiteral(key), templ))

    if on_error := config.get(CONF_ON_ERROR):
        cg.add_define("USE_API_HOMEASSISTANT_ACTION_RESPONSES")
@@ -964,9 +809,9 @@ HOMEASSISTANT_EVENT_ACTION_SCHEMA = cv.Schema(
    {
        cv.GenerateID(): cv.use_id(APIServer),
        cv.Required(CONF_EVENT): validate_homeassistant_event,
-        cv.Optional(CONF_DATA, default={}): DATA_FIELDS_SCHEMA,
-        cv.Optional(CONF_DATA_TEMPLATE, default={}): DATA_FIELDS_SCHEMA,
-        cv.Optional(CONF_VARIABLES, default={}): VARIABLES_FIELDS_SCHEMA,
+        cv.Optional(CONF_DATA, default={}): KEY_VALUE_SCHEMA,
+        cv.Optional(CONF_DATA_TEMPLATE, default={}): KEY_VALUE_SCHEMA,
+        cv.Optional(CONF_VARIABLES, default={}): VARIABLES_SCHEMA,
    }
 )

@@ -985,15 +830,38 @@ async def homeassistant_event_to_code(
    template_arg: cg.TemplateArguments,
    args: TemplateArgsType,
 ) -> MockObj:
-    return await _new_service_call_action(
-        config[CONF_ID],
-        action_id,
-        template_arg,
-        args,
-        True,
-        config[CONF_EVENT],
-        *_service_call_fields(config),
-    )
+    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
+    serv = await cg.get_variable(config[CONF_ID])
+    var = cg.new_Pvariable(action_id, template_arg, serv, True)
+    templ = await cg.templatable(config[CONF_EVENT], args, cg.std_string)
+    cg.add(var.set_service(templ))
+
+    # Initialize FixedVectors with exact sizes from config
+    cg.add(var.init_data(len(config[CONF_DATA])))
+    for key, value in config[CONF_DATA].items():
+        # output_type=None because lambdas can return non-string types (int,
+        # float, char*) that TemplatableStringValue converts via to_string.
+        # Static strings are manually wrapped for PROGMEM on ESP8266.
+        templ = await cg.templatable(value, args, None)
+        if isinstance(templ, str):
+            templ = cg.FlashStringLiteral(templ)
+        cg.add(var.add_data(cg.FlashStringLiteral(key), templ))
+
+    cg.add(var.init_data_template(len(config[CONF_DATA_TEMPLATE])))
+    for key, value in config[CONF_DATA_TEMPLATE].items():
+        templ = await cg.templatable(value, args, None)
+        if isinstance(templ, str):
+            templ = cg.FlashStringLiteral(templ)
+        cg.add(var.add_data_template(cg.FlashStringLiteral(key), templ))
+
+    cg.add(var.init_variables(len(config[CONF_VARIABLES])))
+    for key, value in config[CONF_VARIABLES].items():
+        templ = await cg.templatable(value, args, None)
+        if isinstance(templ, str):
+            templ = cg.FlashStringLiteral(templ)
+        cg.add(var.add_variable(cg.FlashStringLiteral(key), templ))
+
+    return var


 HOMEASSISTANT_TAG_SCANNED_ACTION_SCHEMA = cv.maybe_simple_value(
@@ -1017,17 +885,15 @@ async def homeassistant_tag_scanned_to_code(
    template_arg: cg.TemplateArguments,
    args: TemplateArgsType,
 ) -> MockObj:
-    return await _new_service_call_action(
-        config[CONF_ID],
-        action_id,
-        template_arg,
-        args,
-        True,
-        "esphome.tag_scanned",
-        {"tag_id": config[CONF_TAG]},
-        {},
-        {},
-    )
+    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
+    serv = await cg.get_variable(config[CONF_ID])
+    var = cg.new_Pvariable(action_id, template_arg, serv, True)
+    cg.add(var.set_service(cg.FlashStringLiteral("esphome.tag_scanned")))
+    # Initialize FixedVector with exact size (1 data field)
+    cg.add(var.init_data(1))
+    templ = await cg.templatable(config[CONF_TAG], args, cg.std_string)
+    cg.add(var.add_data(cg.FlashStringLiteral("tag_id"), templ))
+    return var


 CONF_SUCCESS = "success"
@@ -1138,8 +1004,6 @@ _define_filter = filter_source_files_from_defines(
        "user_services.cpp": "USE_API_USER_DEFINED_ACTIONS",
        "api_frame_helper_noise.cpp": "USE_API_NOISE",
        "api_frame_helper_plaintext.cpp": "USE_API_PLAINTEXT",
-        "api_wizard.cpp": "USE_API_WIZARD",
-        "api_outgoing_connection.cpp": "USE_API_OUTGOING_CONNECTION",
    }
 )

@@ -20,8 +20,6 @@ service APIConnection {
    option (needs_authentication) = false;
  }
  rpc device_capabilities (DeviceCapabilitiesRequest) returns (DeviceCapabilitiesResponse) {}
-  rpc device_wizard (DeviceWizardRequest) returns (DeviceWizardResponse) {}
-  rpc wizard_input_set (WizardInputSetRequest) returns (void) {}
  rpc list_entities (ListEntitiesRequest) returns (void) {}
  rpc subscribe_states (SubscribeStatesRequest) returns (void) {}
  rpc subscribe_logs (SubscribeLogsRequest) returns (void) {}
@@ -78,7 +76,6 @@ service APIConnection {
  rpc serial_proxy_write(SerialProxyWriteRequest) returns (void) {}
  rpc serial_proxy_set_modem_pins(SerialProxySetModemPinsRequest) returns (void) {}
  rpc serial_proxy_get_modem_pins(SerialProxyGetModemPinsRequest) returns (void) {}
-  rpc subscribe_serial_proxy_identity(SubscribeSerialProxyIdentityRequest) returns (void) {}
  rpc serial_proxy_request(SerialProxyRequest) returns (void) {}
  rpc serial_proxy_set_mode(SerialProxySetModeRequest) returns (void) {}
 }
@@ -116,11 +113,6 @@ message HelloRequest {
  string client_info = 1;
  uint32 api_version_major = 2;
  uint32 api_version_minor = 3;
-
-  // Set by clients that can accept connections the device opens to them
-  // (see api: outgoing_connection:). The device remembers this client's
-  // address as the target to dial when no such client is connected.
-  bool outgoing_connection_target = 4 [(field_ifdef) = "USE_API_OUTGOING_CONNECTION"];
 }

 // Confirmation of successful connection request.
@@ -236,7 +228,6 @@ enum SerialProxyPortType {
  SERIAL_PROXY_PORT_TYPE_TTL = 0;
  SERIAL_PROXY_PORT_TYPE_RS232 = 1;
  SERIAL_PROXY_PORT_TYPE_RS485 = 2;
-  SERIAL_PROXY_PORT_TYPE_USB_SERIAL = 3;  // since API 1.18
 }

 message SerialProxyInfo {
@@ -341,10 +332,6 @@ message DeviceInfoResponse {
  // all-zeros PSK, so the api encryption key can be provisioned without being
  // sent in plaintext (protects against passive sniffing, not active MITM)
  bool api_encryption_provisionable = 26 [(field_ifdef) = "USE_API_NOISE"];
-
-  // Device is built with the api outgoing_connection option and can open
-  // the TCP connection to a dial-back target itself
-  bool api_outgoing_connection_supported = 27 [(field_ifdef) = "USE_API_OUTGOING_CONNECTION"];
 }

 // ==================== DEVICE CAPABILITIES ====================
@@ -393,11 +380,6 @@ message ZWaveProxyCapabilities {
  uint32 home_id = 2;
 }

-message WizardCapabilities {
-  // True when the device has a wizard configured, so DeviceWizardRequest will be answered
-  bool configured = 1;
-}
-
 message DeviceCapabilitiesResponse {
  option (id) = 150;
  option (source) = SOURCE_SERVER;
@@ -407,90 +389,6 @@ message DeviceCapabilitiesResponse {
  ZWaveProxyCapabilities zwave_proxy = 3 [(field_ifdef) = "USE_ZWAVE_PROXY"];
  repeated SerialProxyInfo serial_proxies = 4
      [(field_ifdef) = "USE_SERIAL_PROXY", (fixed_array_size_define) = "SERIAL_PROXY_COUNT"];
-  WizardCapabilities wizard = 5 [(field_ifdef) = "USE_API_WIZARD"];
-}
-
-// ==================== DEVICE WIZARD ====================
-
-// Asks the device for the onboarding wizard that Home Assistant presents when the
-// device is added.
-//
-// The wizard is read once, when the device is added, whereas capabilities are read
-// on every connect, so it is a separate message rather than part of
-// DeviceCapabilitiesResponse. It is only served on an authenticated connection.
-//
-// A device without a wizard does not have this message at all and never answers it,
-// as a device ignores messages it does not know. Clients therefore check
-// DeviceCapabilitiesResponse.wizard.configured before sending it.
-message DeviceWizardRequest {
-  option (id) = 156;
-  option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_API_WIZARD";
-  // Empty
-}
-
-// The wizard, as UTF-8 JSON compressed into a single zstd frame. The device builds it
-// when it is compiled and sends it unchanged, so its size varies with the wizard and
-// its format can grow without new fields here. Clients decompress it, then read:
-//
-//   {"version": 1,
-//    "pages": [{"title": "...", "description": "...",
-//      "entities": [{"key": 123, "device_id": 456, "description": "..."}],
-//      "inputs": [{"key": 789, "description": "...",
-//        "entity_filters": [{"integration": "...", "domain": ["..."],
-//                            "device_class": ["..."], "supported_features": ["..."]}]}]}]}
-//
-// Values that are empty or unset are left out, and so are empty lists. Strings may be
-// Home Assistant translation placeholders such as "[%key:component::domain::name%]",
-// passed through verbatim. The pages are shown in the order listed. A client that does
-// not know the version must not use the wizard.
-//
-// An entity is an entity of this device that the page shows to the user (for example to
-// turn it on or off). Its key is the key ListEntitiesResponse sends for it. Its
-// device_id is the device_id ListEntitiesResponse sends, and is left out when that is 0.
-//
-// An input is filled in by the user with the id of a Home Assistant entity. It either
-// stands for one entity of the device's homeassistant platform (sensor, binary_sensor,
-// text_sensor, number, switch, text, select or button) that sets no entity_id of its own,
-// as Home Assistant supplies it, or it is a standalone input that only stores the entity
-// id for the device's own automations. Its key is the FNV-1 hash
-// of the input's ESPHome id, not an entity key. The client sends the chosen entity id to
-// the device with a WizardInputSetRequest. entity_filters says which Home Assistant
-// entities the user may choose, and mirrors Home Assistant's EntityFilterSelectorConfig:
-// an entity matches a filter when it satisfies every field that is set, and an entity
-// that matches any one of the filters is accepted.
-//
-// The device keeps the entity id of an input in RAM only and does not store it across
-// restarts. The client therefore stores the choice itself and, after every connection
-// and before it sends SubscribeHomeAssistantStatesRequest, sends a WizardInputSetRequest
-// for each input. It sends one again whenever the user changes the choice.
-message DeviceWizardResponse {
-  option (id) = 157;
-  option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_API_WIZARD";
-  // Not logged: the data is in flash, which ESP8266 cannot read for a dump
-  option (log) = false;
-
-  // The data is in flash, and the device sends it from there
-  bytes data = 1 [(pointer_to_buffer) = true];
-}
-
-// Sets the entity id of a wizard input (see WizardInputField.key). Clients send
-// this only when DeviceCapabilitiesResponse.wizard.configured is set. There is no
-// reply. The device ignores a request whose key matches no input or whose entity_id
-// is empty, longer than 255 bytes or has no '.'. Otherwise it keeps the id in RAM,
-// not across restarts, and when the input belongs to a homeassistant platform entity
-// it subscribes to that entity's state. Clients send this for every input right
-// after connecting, before SubscribeHomeAssistantStatesRequest. A request that
-// arrives later still works: the device then sends the affected state subscriptions
-// again.
-message WizardInputSetRequest {
-  option (id) = 158;
-  option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_API_WIZARD_INPUTS";
-
-  fixed32 key = 1;
-  string entity_id = 2 [(max_data_length) = 255];
 }

 message ListEntitiesRequest {
@@ -1541,7 +1439,7 @@ message ListEntitiesSelectResponse {
  reserved 4; // Deprecated: was string unique_id

  string icon = 5 [(field_ifdef) = "USE_ENTITY_ICON", (max_data_length) = 63];
-  repeated string options = 6 [(container_pointer_no_template) = "std::span<const char *const>"];
+  repeated string options = 6 [(container_pointer_no_template) = "FixedVector<const char *>"];
  bool disabled_by_default = 7;
  EntityCategory entity_category = 8;
  uint32 device_id = 9 [(field_ifdef) = "USE_DEVICES"];
@@ -2785,7 +2683,7 @@ message ListEntitiesInfraredResponse {
 message InfraredRFTransmitRawTimingsRequest {
  option (id) = 136;
  option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_IR_RF";
+  option (ifdef) = "USE_IR_RF || USE_RADIO_FREQUENCY";

  uint32 device_id = 1 [(field_ifdef) = "USE_DEVICES"];
  fixed32 key = 2 [(force) = true];     // Key identifying the transmitter instance
@@ -2799,7 +2697,7 @@ message InfraredRFTransmitRawTimingsRequest {
 message InfraredRFReceiveEvent {
  option (id) = 137;
  option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_IR_RF";
+  option (ifdef) = "USE_IR_RF || USE_RADIO_FREQUENCY";
  option (no_delay) = true;
  option (speed_optimized) = true;

@@ -2808,28 +2706,6 @@ message InfraredRFReceiveEvent {
  repeated sint32 timings = 3 [packed = true, (container_pointer_no_template) = "std::vector<int32_t>"];  // Raw timings in microseconds (zigzag-encoded): alternating mark/space periods
 }

-// Sent only to the client that issued an InfraredRFTransmitRawTimingsRequest, once the
-// transmitter reports that the transmission (all repeats) has finished, or immediately with
-// success=false if it was refused before reaching the transmitter (unknown key, no transmitter,
-// no or invalid timings) or the transmitter could not send it (not set up, hardware error).
-// success=false also answers a request superseded by a newer request on the same entity, from
-// any client, and a transmit that reported nothing within 30 s past its expected air time, so a
-// client should not retry on it blindly. The device serializes transmits per transmitter and
-// several entities may share one, so a client should keep at most one transmit outstanding per
-// device, not per entity. A reply for an unknown key or a refused request is sent once and can be lost
-// when the device's send buffer is full, so a client should also stop waiting on its own after the
-// expected air time plus a margin. Lets clients pace requests instead of estimating durations (since API 1.18)
-message InfraredRFTransmitCompleteResponse {
-  option (id) = 153;
-  option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_IR_RF";
-  option (no_delay) = true;
-
-  uint32 device_id = 1 [(field_ifdef) = "USE_DEVICES"];
-  fixed32 key = 2 [(force) = true];  // Key of the transmitter entity from the request
-  bool success = 3;                  // false if the request was refused, not sent, superseded, or never reported
-}
-
 // ==================== RADIO FREQUENCY ====================

 // Lists available radio frequency entity instances
@@ -3000,56 +2876,6 @@ message SerialProxySetModeRequest {
  SerialProxyMode mode = 2;
 }

-// Subscribe to the identity of every serial proxy port. The device answers with one
-// SerialProxyIdentity per port, then sends another whenever a port's identity changes,
-// for the life of the connection (since API 1.18).
-message SubscribeSerialProxyIdentityRequest {
-  option (id) = 154;
-  option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_SERIAL_PROXY";
-}
-
-// Where a port's identity comes from
-enum SerialProxyIdentitySource {
-  SERIAL_PROXY_IDENTITY_SOURCE_NONE = 0;        // The port carries no identity
-  SERIAL_PROXY_IDENTITY_SOURCE_CONFIGURED = 1;  // Reserved for identities stated in the device configuration; not sent yet
-  SERIAL_PROXY_IDENTITY_SOURCE_USB = 2;         // Read from the descriptors of the USB device behind the port;
-                                                // changes when a device is attached or removed
-}
-
-enum SerialProxyIdentityFlag {
-  SERIAL_PROXY_IDENTITY_FLAG_NONE = 0;
-  SERIAL_PROXY_IDENTITY_FLAG_CONNECTED = 1;  // The backend believes the device is present and usable on this port
-  SERIAL_PROXY_IDENTITY_FLAG_ERROR = 2;      // The USB host stack refused the descriptor query; the strings and
-                                             // IDs below are empty
-}
-
-// The descriptor fields of a USB device as seen by the host stack
-message UsbDeviceDescriptor {
-  uint32 vendor_id = 1;
-  uint32 product_id = 2;
-  uint32 bcd_device = 3;
-  uint32 interface_number = 4;   // bInterfaceNumber the host driver binds to
-}
-
-// The identity of the device behind a port. Identifies one physical device among others of
-// the same kind, so a client matches on manufacturer and product regardless of source. The
-// strings are empty for source NONE, and for source USB while nothing is connected
-// (since API 1.18).
-message SerialProxyIdentity {
-  option (id) = 155;
-  option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_SERIAL_PROXY";
-
-  uint32 instance = 1;
-  SerialProxyIdentitySource source = 2;
-  uint32 flags = 3;               // Bitmask of SerialProxyIdentityFlag
-  string manufacturer = 4;
-  string product = 5;
-  string serial_number = 6;
-  UsbDeviceDescriptor usb = 7;    // Only sent for source USB
-}
-
 // ==================== BLUETOOTH CONNECTION PARAMS ====================
 message BluetoothSetConnectionParamsRequest {
  option (id) = 145;
@@ -198,17 +198,6 @@ APIConnection::~APIConnection() {
      proxy->serial_proxy_request(this, enums::SERIAL_PROXY_REQUEST_TYPE_UNSUBSCRIBE);
    }
  }
-#endif
-  // entities holding a transmit reply for this client must not answer into a freed connection
-#ifdef USE_INFRARED
-  for (auto *infrared : App.get_infrareds()) {
-    infrared->on_api_connection_closed(this);
-  }
-#endif
-#ifdef USE_RADIO_FREQUENCY
-  for (auto *radio_frequency : App.get_radio_frequencies()) {
-    radio_frequency->on_api_connection_closed(this);
-  }
 #endif
 }

@@ -1001,9 +990,7 @@ uint16_t APIConnection::try_send_select_state(EntityBase *entity, APIConnection
 uint16_t APIConnection::try_send_select_info(EntityBase *entity, APIConnection *conn, uint32_t remaining_size) {
  auto *select = static_cast<select::Select *>(entity);
  ListEntitiesSelectResponse msg;
-  const auto &opts = select->traits.get_options();
-  const std::span<const char *const> options(opts.data(), opts.size());
-  msg.options = &options;
+  msg.options = &select->traits.get_options();
  return fill_and_encode_entity_info(select, msg, conn, remaining_size);
 }
 void APIConnection::on_select_command_request(const SelectCommandRequest &msg) {
@@ -1528,10 +1515,8 @@ uint16_t APIConnection::try_send_event_info(EntityBase *entity, APIConnection *c
 }
 #endif

-#ifdef USE_IR_RF
+#if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
 void APIConnection::on_infrared_rf_transmit_raw_timings_request(const InfraredRFTransmitRawTimingsRequest &msg) {
-  // Clients on API 1.18+ are told when the frame has left the transmitter; the entity owns that reply
-  const bool want_reply = this->client_supports_api_version(1, 18);
  // Dispatch by key: infrared entities are checked first, then radio frequency entities.
  // The key is unique across all entity instances on a device, so at most one lookup will succeed.
 #ifdef USE_INFRARED
@@ -1541,7 +1526,6 @@ void APIConnection::on_infrared_rf_transmit_raw_timings_request(const InfraredRF
    call.set_carrier_frequency(msg.carrier_frequency);
    call.set_raw_timings_packed(msg.timings_data_, msg.timings_length_, msg.timings_count_);
    call.set_repeat_count(msg.repeat_count);
-    call.set_api_connection(want_reply ? this : nullptr);
    call.perform();
    return;
  }
@@ -1554,38 +1538,13 @@ void APIConnection::on_infrared_rf_transmit_raw_timings_request(const InfraredRF
    call.set_modulation(static_cast<radio_frequency::RadioFrequencyModulation>(msg.modulation));
    call.set_repeat_count(msg.repeat_count);
    call.set_raw_timings_packed(msg.timings_data_, msg.timings_length_, msg.timings_count_);
-    call.set_api_connection(want_reply ? this : nullptr);
    call.perform();
-    return;
  }
 #endif
-  ESP_LOGW(TAG, "IR/RF transmit for unknown key %" PRIu32, msg.key);
-  if (want_reply) {
-    // nothing will ever report for an unknown key, so answer as not started right away
-#ifdef USE_DEVICES
-    const uint32_t device_id = msg.device_id;
-#else
-    const uint32_t device_id = 0;
-#endif
-    if (!this->send_infrared_rf_transmit_complete(device_id, msg.key, false)) {
-      API_LOG_MSG_DROPPED(TAG, "IR/RF reply");
-    }
-  }
-}
-
-bool APIConnection::send_infrared_rf_transmit_complete([[maybe_unused]] uint32_t device_id, uint32_t key,
-                                                       bool success) {
-  InfraredRFTransmitCompleteResponse resp{};
-#ifdef USE_DEVICES
-  resp.device_id = device_id;
-#endif
-  resp.key = key;
-  resp.success = success;
-  return this->send_message(resp);
 }
 #endif

-#ifdef USE_IR_RF
+#if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
 void APIConnection::send_infrared_rf_receive_event(const InfraredRFReceiveEvent &msg) {
  if (!this->send_message(msg)) {
    // V: fires per decoded frame with no subscription gate, so a warning
@@ -1593,7 +1552,6 @@ void APIConnection::send_infrared_rf_receive_event(const InfraredRFReceiveEvent
    ESP_LOGV(TAG, "IR/RF event dropped, TCP buffer full");
  }
 }
-
 #endif

 #ifdef USE_SERIAL_PROXY
@@ -1685,22 +1643,6 @@ void APIConnection::on_serial_proxy_get_modem_pins_request(const SerialProxyGetM
  }
 }

-void APIConnection::on_subscribe_serial_proxy_identity_request() {
-#ifdef USE_SERIAL_PROXY_USB_IDENTITY
-  // Only USB ports change identity after this snapshot
-  this->flags_.serial_proxy_identity_subscription = true;
-#endif
-  for (auto *proxy : App.get_serial_proxies()) {
-    proxy->send_identity(this);
-  }
-}
-
-void APIConnection::send_serial_proxy_identity(const SerialProxyIdentity &msg) {
-  if (!this->send_message(msg)) {
-    API_LOG_MSG_DROPPED(TAG, "Serial proxy identity");
-  }
-}
-
 void APIConnection::on_serial_proxy_request(const SerialProxyRequest &msg) {
  auto &proxies = App.get_serial_proxies();
  if (msg.instance >= proxies.size()) {
@@ -1872,7 +1814,7 @@ bool APIConnection::send_hello_response_(const HelloRequest &msg) {

  HelloResponse resp;
  resp.api_version_major = 1;
-  resp.api_version_minor = 18;
+  resp.api_version_minor = 17;
  // Send only the version string - the client only logs this for debugging and doesn't use it otherwise
  resp.server_info = ESPHOME_VERSION_REF;
  resp.name = StringRef(App.get_name());
@@ -1895,19 +1837,6 @@ bool APIConnection::send_hello_response_(const HelloRequest &msg) {
  // Auto-authenticate - password auth was removed in ESPHome 2026.1.0
  this->complete_authentication_();

-#ifdef USE_API_OUTGOING_CONNECTION
-  // With a PSK set only key-verified transports reach hello: plaintext and
-  // zero-PSK are rejected, and pre-activation sessions are force-closed
-  if (msg.outgoing_connection_target && !this->flags_.outgoing_connection_target) {
-    if (this->parent_->get_noise_ctx().has_psk()) {
-      this->flags_.outgoing_connection_target = true;
-      this->parent_->on_outgoing_target_client(this);
-    } else {
-      this->log_client_(ESPHOME_LOG_LEVEL_WARN, LOG_STR("Dial-back target refused; no key active"));
-    }
-  }
-#endif
-
  return this->send_message(resp);
 }

@@ -2030,9 +1959,6 @@ bool APIConnection::send_device_info_response_() {
  // one) so this advertisement survives the plaintext removal in 2027.2.0.
  resp.api_encryption_provisionable = !this->parent_->get_noise_ctx().has_psk();
 #endif
-#ifdef USE_API_OUTGOING_CONNECTION
-  resp.api_outgoing_connection_supported = true;
-#endif
 #endif
 #ifdef USE_DEVICES
  size_t device_index = 0;
@@ -2085,9 +2011,6 @@ bool APIConnection::send_device_capabilities_response_() {
    info.port_type = proxy->get_port_type();
    info.configured_line_states = proxy->get_configured_modem_pins();
  }
-#endif
-#ifdef USE_API_WIZARD
-  resp.wizard.configured = true;
 #endif
  return this->send_message(resp);
 }
@@ -2302,13 +2225,7 @@ void APIConnection::on_noise_encryption_set_key_request(const NoiseEncryptionSet
 }
 #endif
 #ifdef USE_API_HOMEASSISTANT_STATES
-void APIConnection::on_subscribe_home_assistant_states_request() {
-#ifdef USE_API_WIZARD_LINKED_INPUTS
-  // Remember it, as a client that subscribed also gets the subscriptions again when a wizard input is set
-  this->flags_.home_assistant_states = true;
-#endif
-  state_subs_at_ = 0;
-}
+void APIConnection::on_subscribe_home_assistant_states_request() { state_subs_at_ = 0; }
 #endif
 bool APIConnection::try_to_clear_buffer_slow_(bool log_out_of_space) {
  delay(0);
@@ -2352,7 +2269,8 @@ bool APIConnection::send_message_(uint32_t payload_size, uint16_t message_type,
 #endif
  // Capacity reserved above, cannot fail
  (void) shared_buf.resize(write_start + payload_size);
-  uint8_t *end = encode_fn(msg, shared_buf.data() + write_start PROTO_ENCODE_DEBUG_INIT(&shared_buf));
+  ProtoWriteBuffer buffer{&shared_buf, write_start};
+  uint8_t *end = encode_fn(msg, buffer PROTO_ENCODE_DEBUG_INIT(&shared_buf));
 #ifdef ESPHOME_DEBUG_API
  proto_check_encode_end(end, shared_buf.data() + shared_buf.size());
 #else
@@ -2750,13 +2668,6 @@ void APIConnection::process_state_subscriptions_() {
  }

  const auto &it = subs[this->state_subs_at_];
-#ifdef USE_API_WIZARD_LINKED_INPUTS
-  // An entity id that is not set yet (a wizard input) has nothing to subscribe to; it is sent once it is set
-  if (it.entity_id[0] == '\0') {
-    this->state_subs_at_++;
-    return;
-  }
-#endif
  SubscribeHomeAssistantStateResponse resp;
  resp.entity_id = StringRef(it.entity_id);

@@ -233,12 +233,9 @@ class APIConnection final : public APIServerConnectionBase {
  void on_water_heater_command_request(const WaterHeaterCommandRequest &msg);
 #endif

-#ifdef USE_IR_RF
+#if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
  void on_infrared_rf_transmit_raw_timings_request(const InfraredRFTransmitRawTimingsRequest &msg);
  void send_infrared_rf_receive_event(const InfraredRFReceiveEvent &msg);
-  // Reply to an InfraredRFTransmitRawTimingsRequest (API 1.18+); false when the TCP buffer is
-  // full, the entity that owns the reply retries it then
-  [[nodiscard]] bool send_infrared_rf_transmit_complete(uint32_t device_id, uint32_t key, bool success);
 #endif

 #ifdef USE_SERIAL_PROXY
@@ -246,9 +243,6 @@ class APIConnection final : public APIServerConnectionBase {
  void on_serial_proxy_write_request(const SerialProxyWriteRequest &msg);
  void on_serial_proxy_set_modem_pins_request(const SerialProxySetModemPinsRequest &msg);
  void on_serial_proxy_get_modem_pins_request(const SerialProxyGetModemPinsRequest &msg);
-  void on_subscribe_serial_proxy_identity_request();
-  /// Send a port identity to this client
-  void send_serial_proxy_identity(const SerialProxyIdentity &msg);
  void on_serial_proxy_request(const SerialProxyRequest &msg);
  void on_serial_proxy_set_mode_request(const SerialProxySetModeRequest &msg);
  void send_serial_proxy_data(const SerialProxyDataReceived &msg);
@@ -279,12 +273,6 @@ class APIConnection final : public APIServerConnectionBase {
  void on_ping_request();
  void on_device_info_request();
  void on_device_capabilities_request();
-#ifdef USE_API_WIZARD
-  void on_device_wizard_request();
-#endif
-#ifdef USE_API_WIZARD_INPUTS
-  void on_wizard_input_set_request(const WizardInputSetRequest &msg);
-#endif
  void on_list_entities_request() { this->begin_iterator_(ActiveIterator::LIST_ENTITIES); }
  void on_subscribe_states_request() {
    this->flags_.state_subscription = true;
@@ -314,10 +302,6 @@ class APIConnection final : public APIServerConnectionBase {
 #endif
 #ifdef USE_API_HOMEASSISTANT_STATES
  void on_subscribe_home_assistant_states_request();
-#ifdef USE_API_WIZARD_LINKED_INPUTS
-  /// Tell this client about the subscriptions whose entity id is stored in the given buffer, as the buffer changed
-  void resend_state_subscriptions(const char *entity_id);
-#endif
 #endif
 #ifdef USE_API_USER_DEFINED_ACTIONS
  void on_execute_service_request(const ExecuteServiceRequest &msg);
@@ -361,7 +345,7 @@ class APIConnection final : public APIServerConnectionBase {
  void on_no_setup_connection();

  // Function pointer type for type-erased message encoding
-  using MessageEncodeFn = ProtoEncodeFn;
+  using MessageEncodeFn = uint8_t *(*) (const void *, ProtoWriteBuffer &PROTO_ENCODE_DEBUG_PARAM);
  // Function pointer type for type-erased size calculation
  using CalculateSizeFn = uint32_t (*)(const void *);

@@ -394,23 +378,6 @@ class APIConnection final : public APIServerConnectionBase {
    return this->helper_->get_peername_to(buf);
  }

-#ifdef USE_API_OUTGOING_CONNECTION
-  /// Get the peer address itself, for remembering a dial-back target
-  int getpeername(struct sockaddr *addr, socklen_t *addrlen) const { return this->helper_->getpeername(addr, addrlen); }
-  /// Outgoing connection: send our server hello immediately so the peer can
-  /// pick the matching key. Outgoing connections are only dialed when a PSK
-  /// is set, so the helper is always the noise helper. Call after start().
-  void mark_outgoing() {
-    if (this->flags_.remove) {
-      return;  // start() failed; the connection is already being torn down
-    }
-    APIError err = static_cast<APINoiseFrameHelper *>(this->helper_.get())->send_server_hello_first();
-    if (err != APIError::OK) {
-      this->fatal_error_with_log_(LOG_STR("Server hello failed"), err);
-    }
-  }
-#endif
-
 protected:
  bool try_to_clear_buffer_slow_(bool log_out_of_space);

@@ -423,9 +390,6 @@ class APIConnection final : public APIServerConnectionBase {
  bool send_ping_response_();
  bool send_device_info_response_();
  bool send_device_capabilities_response_();
-#ifdef USE_API_WIZARD
-  bool send_device_wizard_response_();
-#endif
 #ifdef USE_API_NOISE
  bool send_noise_encryption_set_key_response_(const NoiseEncryptionSetKeyRequest &msg);
 #endif
@@ -770,21 +734,12 @@ class APIConnection final : public APIServerConnectionBase {
    uint8_t batch_first_message : 1;          // For batch buffer allocation
    uint8_t should_try_send_immediately : 1;  // True after initial states are sent
    uint8_t may_have_remaining_data : 1;      // Read loop hit limit, retry without ready check
-#ifdef USE_API_WIZARD_LINKED_INPUTS
-    uint8_t home_assistant_states : 1;  // Client subscribed to Home Assistant states
-#endif
-#ifdef USE_API_OUTGOING_CONNECTION
-    uint8_t outgoing_connection_target : 1;  // Client declared itself a dial-back target in its hello
-#endif
 #ifdef HAS_PROTO_MESSAGE_DUMP
    uint8_t log_only_mode : 1;
 #endif
-#ifdef USE_SERIAL_PROXY_USB_IDENTITY
-    uint8_t serial_proxy_identity_subscription : 1;
-#endif
-  } flags_{};  // 2 bytes; 3 with HAS_PROTO_MESSAGE_DUMP + USE_API_OUTGOING_CONNECTION + USE_SERIAL_PROXY_USB_IDENTITY
+  } flags_{};  // 2 bytes total

-  // 2-byte type immediately after flags_ (one padding byte when flags_ is 3 bytes)
+  // 2-byte type immediately after flags_ (no padding between them)
  uint16_t batch_message_type_{0};  // Current message type during batch encoding
  // 1-byte types to fill remaining space before next 4-byte boundary
  // Client API versions are clamped to 255 on receive (see send_hello_response_)
@@ -45,8 +45,8 @@ inline uint16_t ESPHOME_ALWAYS_INLINE APIConnection::encode_to_buffer(uint32_t c
    conn->fatal_out_of_memory_();
    return 0;
  }
-  uint8_t *end =
-      encode_fn(msg, shared_buf.data() + shared_buf.size() - calculated_size PROTO_ENCODE_DEBUG_INIT(&shared_buf));
+  ProtoWriteBuffer buffer{&shared_buf, shared_buf.size() - calculated_size};
+  uint8_t *end = encode_fn(msg, buffer PROTO_ENCODE_DEBUG_INIT(&shared_buf));
 #ifdef ESPHOME_DEBUG_API
  // A body that writes fewer bytes than calculate_size() promised would ship stale buffer bytes
  proto_check_encode_end(end, shared_buf.data() + shared_buf.size());
@@ -285,8 +285,7 @@ class APIFrameHelper {
    DATA = 5,
    CLOSED = 6,
    FAILED = 7,
-    EXPLICIT_REJECT = 8,        // Noise only
-    CLIENT_HELLO_OUTGOING = 9,  // Noise only: like CLIENT_HELLO but the server hello already went out (outgoing conn)
+    EXPLICIT_REJECT = 8,  // Noise only
  };

  // Fast inline state check for read_packet/write_protobuf_messages hot path.
@@ -70,13 +70,6 @@ APIError APINoiseFrameHelper::init() {
  state_ = State::CLIENT_HELLO;
  return APIError::OK;
 }
-#ifdef USE_API_OUTGOING_CONNECTION
-APIError APINoiseFrameHelper::send_server_hello_first() {
-  // The peer needs our name and MAC to pick the key before its first message
-  this->state_ = State::CLIENT_HELLO_OUTGOING;
-  return this->send_server_hello_frame_();
-}
-#endif
 #ifdef USE_API_PLAINTEXT
 APIError APINoiseFrameHelper::init_from_handoff(const uint8_t *header, uint8_t header_len) {
  APIError err = this->init();
@@ -249,9 +242,6 @@ APIError APINoiseFrameHelper::state_action_() {
      HELPER_LOG("Bad state for method: %d", (int) this->state_);
      return APIError::BAD_STATE;
    case State::CLIENT_HELLO:
-#ifdef USE_API_OUTGOING_CONNECTION
-    case State::CLIENT_HELLO_OUTGOING:
-#endif
      return this->state_action_client_hello_();
    case State::SERVER_HELLO:
      return this->state_action_server_hello_();
@@ -284,16 +274,11 @@ APIError APINoiseFrameHelper::state_action_client_hello_() {
    std::memcpy(dst + 2, this->rx_buf_.data(), rx_size);
  }

-#ifdef USE_API_OUTGOING_CONNECTION
-  if (this->state_ == State::CLIENT_HELLO_OUTGOING) {
-    // Server hello already went out at handoff
-    return this->start_handshake_();
-  }
-#endif
  state_ = State::SERVER_HELLO;
  return APIError::OK;
 }
-APIError APINoiseFrameHelper::send_server_hello_frame_() {
+APIError APINoiseFrameHelper::state_action_server_hello_() {
+  // send server hello
  const auto &name = App.get_name();
  char mac[MAC_ADDRESS_BUFFER_SIZE];
  get_mac_address_into_buffer(mac);
@@ -317,18 +302,15 @@ APIError APINoiseFrameHelper::send_server_hello_frame_() {
  // node mac, terminated by null byte
  std::memcpy(msg + mac_offset, mac, MAC_ADDRESS_BUFFER_SIZE);

-  return write_frame_(msg, total_size);
-}
-APIError APINoiseFrameHelper::state_action_server_hello_() {
-  APIError aerr = this->send_server_hello_frame_();
+  APIError aerr = write_frame_(msg, total_size);
  if (aerr != APIError::OK)
    return aerr;
-  return this->start_handshake_();
-}
-APIError APINoiseFrameHelper::start_handshake_() {
-  APIError aerr = init_handshake_();
+
+  // start handshake
+  aerr = init_handshake_();
  if (aerr != APIError::OK)
    return aerr;
+
  state_ = State::HANDSHAKE;
  return APIError::OK;
 }
@@ -28,12 +28,6 @@ class APINoiseFrameHelper final : public APIFrameHelper {
  // Seeds the already-read header bytes and pumps the handshake state machine
  // until it would block.
  APIError init_from_handoff(const uint8_t *header, uint8_t header_len);
-#endif
-#ifdef USE_API_OUTGOING_CONNECTION
-  // Send the server hello immediately so the peer can pick the key before
-  // its PSK-mixed message. Call after init(); the mode is tracked in state_
-  // so the helper does not grow.
-  APIError send_server_hello_first();
 #endif
  APIError loop() override;
  APIError read_packet(ReadPacketBuffer *buffer) override;
@@ -45,8 +39,6 @@ class APINoiseFrameHelper final : public APIFrameHelper {
  APIError state_action_();
  APIError state_action_client_hello_();
  APIError state_action_server_hello_();
-  APIError send_server_hello_frame_();
-  APIError start_handshake_();
  APIError state_action_handshake_();
  APIError state_action_handshake_read_();
  APIError state_action_handshake_write_();
@@ -1,318 +0,0 @@
-#include "api_outgoing_connection.h"
-#if defined(USE_API) && defined(USE_API_OUTGOING_CONNECTION)
-
-#include "api_connection.h"
-#include "api_server.h"
-#include "esphome/components/network/util.h"
-#include "esphome/core/application.h"
-#include "esphome/core/helpers.h"
-#include "esphome/core/log.h"
-
-#include <cerrno>
-#include <cinttypes>
-#include <cstdint>
-#include <cstring>
-
-namespace esphome::api {
-
-static const char *const TAG = "api.outgoing";
-
-#ifndef API_OUTGOING_CONNECTION_HOST
-static constexpr uint32_t OUTGOING_TARGET_PREF_HASH = 629847102UL;
-#endif
-
-#ifndef API_OUTGOING_CONNECTION_HOST
-// Read the connection's peer address into target; false when unavailable or
-// of a family this build cannot dial
-static bool peer_to_target(APIConnection *conn, SavedOutgoingTarget &target) {
-  // Zeroed because the raw lwIP getpeername() leaves sin6_scope_id untouched
-  struct sockaddr_storage peer = {};
-  socklen_t peer_len = sizeof(peer);
-  if (conn->getpeername((struct sockaddr *) &peer, &peer_len) != 0) {
-    return false;
-  }
-  const sa_family_t family = ((struct sockaddr *) &peer)->sa_family;
-#if USE_NETWORK_IPV6
-  if (family == AF_INET6) {
-    const auto *addr6 = reinterpret_cast<const struct sockaddr_in6 *>(&peer);
-    const auto *bytes = reinterpret_cast<const uint8_t *>(&addr6->sin6_addr);
-    uint32_t prefix[3];
-    memcpy(prefix, bytes, sizeof(prefix));
-    // A dual-stack listener reports an IPv4 peer as ::ffff:a.b.c.d
-    if (prefix[0] == 0 && prefix[1] == 0 && prefix[2] == htonl(0xFFFFUL)) {
-      target.family = AF_INET;
-      memcpy(target.addr, bytes + sizeof(prefix), sizeof(struct in_addr));
-      return true;
-    }
-    // A link-local target is only reachable through the interface it came in
-    // on. Device platforms number interfaces from one; a host build can hand
-    // out an index too large to store, and a truncated one dials the wrong
-    // interface, so that target is not remembered at all.
-    if (addr6->sin6_scope_id > UINT8_MAX) {
-      return false;
-    }
-    target.family = AF_INET6;
-    memcpy(target.addr, bytes, sizeof(target.addr));
-    target.scope_id = static_cast<uint8_t>(addr6->sin6_scope_id);
-    return true;
-  }
-#endif
-  if (family != AF_INET) {
-    return false;
-  }
-  const auto *addr4 = reinterpret_cast<const struct sockaddr_in *>(&peer);
-  target.family = AF_INET;
-  memcpy(target.addr, &addr4->sin_addr, sizeof(addr4->sin_addr));
-  return true;
-}
-#endif
-
-socklen_t OutgoingConnectionManager::target_sockaddr_(struct sockaddr_storage *addr) const {
-#ifdef API_OUTGOING_CONNECTION_HOST
-  // Validation only lets through a literal both inet_pton and inet6_aton
-  // accept, so this cannot fail
-  return socket::set_sockaddr((struct sockaddr *) addr, sizeof(*addr), API_OUTGOING_CONNECTION_HOST,
-                              API_OUTGOING_CONNECTION_PORT);
-#else
-#if USE_NETWORK_IPV6
-  if (this->saved_.family == AF_INET6) {
-    auto *addr6 = reinterpret_cast<struct sockaddr_in6 *>(addr);
-    memset(addr6, 0, sizeof(*addr6));
-    addr6->sin6_family = AF_INET6;
-    addr6->sin6_port = htons(API_OUTGOING_CONNECTION_PORT);
-    memcpy(&addr6->sin6_addr, this->saved_.addr, sizeof(this->saved_.addr));
-    addr6->sin6_scope_id = this->saved_.scope_id;
-    return sizeof(*addr6);
-  }
-#endif
-  if (this->saved_.family != AF_INET) {
-    return 0;
-  }
-  auto *addr4 = reinterpret_cast<struct sockaddr_in *>(addr);
-  memset(addr4, 0, sizeof(*addr4));
-  addr4->sin_family = AF_INET;
-  addr4->sin_port = htons(API_OUTGOING_CONNECTION_PORT);
-  memcpy(&addr4->sin_addr, this->saved_.addr, sizeof(addr4->sin_addr));
-  return sizeof(*addr4);
-#endif
-}
-
-#ifndef API_OUTGOING_CONNECTION_HOST
-void OutgoingConnectionManager::format_target_(std::span<char, socket::SOCKADDR_STR_LEN> buf) const {
-  struct sockaddr_storage addr;
-  socklen_t addr_len = this->target_sockaddr_(&addr);
-  if (addr_len == 0) {
-    buf[0] = '\0';
-    return;
-  }
-  // Clears buf itself if it cannot format the address
-  socket::format_sockaddr_to((struct sockaddr *) &addr, addr_len, buf);
-}
-#endif
-
-void OutgoingConnectionManager::setup() {
-#ifndef API_OUTGOING_CONNECTION_HOST
-  this->target_pref_ = global_preferences->make_preference<SavedOutgoingTarget>(OUTGOING_TARGET_PREF_HASH, true);
-  struct sockaddr_storage addr;
-  // dump_config() prints whichever target this leaves in place
-  if (this->target_pref_.load(&this->saved_) && this->target_sockaddr_(&addr) != 0) {
-    this->host_persisted_ = true;
-  } else {
-    // Never saved, failed its size or CRC check, or holds an unknown family
-    this->saved_ = {};
-  }
-#endif
-}
-
-void OutgoingConnectionManager::loop(APIServer *server) {
-  if (server->has_outgoing_target_client_()) {
-    return;  // on_target_client() already reset the dial state
-  }
-  if (this->dialed_conn_ != nullptr) {
-    // A live dialed session (flagged or not, e.g. a host: peer) is the
-    // target; a silent one dies on the handshake timeout
-    return;
-  }
-  const uint32_t now = App.get_loop_component_start_time();
-  switch (this->state_) {
-    case DialState::DIAL_STATE_IDLE:
-      // Target went away; give it the configured delay to reconnect first
-      this->schedule_wait_(now, IDLE_WAIT_MS);
-      break;
-    case DialState::DIAL_STATE_WAITING:
-      if (now - this->state_ts_ >= this->wait_) {
-        this->try_dial_(server, now);
-      }
-      break;
-    case DialState::DIAL_STATE_CONNECTING:
-      this->poll_connect_(server, now);
-      break;
-  }
-}
-
-void OutgoingConnectionManager::try_dial_(APIServer *server, uint32_t now) {
-  if (!network::is_connected()) {
-    // Flips within seconds of boot; recheck fast so a deep sleep wake
-    // window is not spent waiting
-    this->schedule_wait_(now, NETWORK_RETRY_MS);
-    return;
-  }
-  struct sockaddr_storage addr;
-  socklen_t addr_len = this->target_sockaddr_(&addr);
-  const bool at_limit = server->at_client_limit_();
-  // No target is the steady state until a dial-back client has ever connected
-  if (addr_len == 0 || at_limit || !server->noise_ctx_.has_psk()) {
-    // Repeats for as long as the reason holds, so keep it out of debug logs
-    ESP_LOGV(TAG, "Not dialing: %s",
-             addr_len == 0 ? LOG_STR_LITERAL("no target")
-                           : (at_limit ? LOG_STR_LITERAL("max connections") : LOG_STR_LITERAL("no key")));
-    // Not a dial failure; retry without escalating the backoff
-    this->schedule_wait_(now, PRECONDITION_RETRY_MS);
-    return;
-  }
-  this->dial_socket_ = socket::socket_loop_monitored(((struct sockaddr *) &addr)->sa_family, SOCK_STREAM, IPPROTO_TCP);
-  if (!this->dial_socket_ || this->dial_socket_->setblocking(false) != 0) {
-    ESP_LOGW(TAG, "Socket %s failed: errno %d",
-             this->dial_socket_ ? LOG_STR_LITERAL("setblocking") : LOG_STR_LITERAL("create"), errno);
-    this->schedule_retry_(now);
-    return;
-  }
-#ifdef API_OUTGOING_CONNECTION_HOST
-  ESP_LOGD(TAG, "Dialing " API_OUTGOING_CONNECTION_HOST ":%u", API_OUTGOING_CONNECTION_PORT);
-#else
-  char host[socket::SOCKADDR_STR_LEN];
-  socket::format_sockaddr_to((struct sockaddr *) &addr, addr_len, host);
-  ESP_LOGD(TAG, "Dialing %s:%u", host, API_OUTGOING_CONNECTION_PORT);
-#endif
-  int err = this->dial_socket_->connect((struct sockaddr *) &addr, addr_len);
-  if (err == 0) {
-    // Immediate success (possible for localhost)
-    this->handoff_(server, now);
-    return;
-  }
-  if (errno != EINPROGRESS) {
-    ESP_LOGW(TAG, "Connect failed: %d", errno);
-    this->schedule_retry_(now);
-    return;
-  }
-  this->state_ = DialState::DIAL_STATE_CONNECTING;
-  this->state_ts_ = now;
-  this->last_poll_ = now;
-}
-
-void OutgoingConnectionManager::poll_connect_(APIServer *server, uint32_t now) {
-  if (now - this->state_ts_ >= CONNECT_TIMEOUT_MS) {
-    ESP_LOGW(TAG, "Connect timeout");
-    this->schedule_retry_(now);
-    return;
-  }
-  if (now - this->last_poll_ < CONNECT_POLL_INTERVAL_MS) {
-    return;
-  }
-  this->last_poll_ = now;
-  int err = 0;
-  switch (socket::poll_connect(*this->dial_socket_, err)) {
-    case socket::ConnectPollResult::CONNECT_POLL_RESULT_PENDING:
-      break;
-    case socket::ConnectPollResult::CONNECT_POLL_RESULT_CONNECTED:
-      this->handoff_(server, now);
-      break;
-    case socket::ConnectPollResult::CONNECT_POLL_RESULT_ERROR:
-      ESP_LOGW(TAG, "Connect failed: %d", err);
-      this->schedule_retry_(now);
-      break;
-  }
-}
-
-void OutgoingConnectionManager::handoff_(APIServer *server, uint32_t now) {
-  this->dialed_conn_ = server->add_outgoing_client_(std::move(this->dial_socket_));
-  if (this->dialed_conn_ == nullptr) {
-    // Only preconditions (slot limit, key cleared) refuse the handoff; the
-    // peer is reachable, so do not escalate the backoff
-    this->schedule_wait_(now, PRECONDITION_RETRY_MS);
-    return;
-  }
-  // Connected; dialed_conn_ gates further dialing until the session settles
-  this->state_ = DialState::DIAL_STATE_IDLE;
-}
-
-void OutgoingConnectionManager::schedule_wait_(uint32_t now, uint32_t wait) {
-  this->dial_socket_.reset();  // no-op when the socket was handed off
-  this->state_ = DialState::DIAL_STATE_WAITING;
-  this->state_ts_ = now;
-  this->wait_ = wait;
-}
-
-void OutgoingConnectionManager::schedule_retry_(uint32_t now) {
-  // +/-20% jitter so a fleet of devices does not retry one server in lockstep
-  const uint32_t jitter_span = this->backoff_ / 5;
-  this->schedule_wait_(now, this->backoff_ - jitter_span + (random_uint32() % (2 * jitter_span + 1)));
-  this->backoff_ = std::min(this->backoff_ * 2, BACKOFF_MAX_MS);
-}
-
-void OutgoingConnectionManager::on_client_removed(APIConnection *conn, bool was_authenticated) {
-  if (conn != this->dialed_conn_) {
-    return;
-  }
-  this->dialed_conn_ = nullptr;
-  if (was_authenticated) {
-    // A working peer (e.g. a host: target that never sends the flag)
-    // disconnected normally; state is IDLE, so loop() applies the delay
-    this->backoff_ = BACKOFF_MIN_MS;
-  } else {
-    this->schedule_retry_(App.get_loop_component_start_time());
-  }
-}
-
-void OutgoingConnectionManager::on_target_client(APIConnection *conn) {
-  // The target is connected; stop any dial in flight and reset the backoff.
-  // A dialed connection stays tracked unless it is this one: an inbound
-  // target must not orphan a still-open dial.
-  this->dial_socket_.reset();
-  if (conn == this->dialed_conn_) {
-    this->dialed_conn_ = nullptr;
-  }
-  this->state_ = DialState::DIAL_STATE_IDLE;
-  this->backoff_ = BACKOFF_MIN_MS;
-#ifndef API_OUTGOING_CONNECTION_HOST
-  SavedOutgoingTarget target{};
-  if (!peer_to_target(conn, target)) {
-    ESP_LOGW(TAG, "Not remembering this target; its address cannot be dialed");
-    return;
-  }
-  if (this->host_persisted_ && memcmp(&target, &this->saved_, sizeof(target)) == 0) {
-    return;  // unchanged and already on flash; avoid flash wear
-  }
-  // Use the fresh address this boot even if the flash write fails; a failed
-  // write is retried on the next flagged hello via host_persisted_
-  this->saved_ = target;
-  if (!this->persist_target_()) {
-    ESP_LOGW(TAG, "Failed to save target");
-    return;
-  }
-  char host[socket::SOCKADDR_STR_LEN];
-  this->format_target_(host);
-  ESP_LOGD(TAG, "Remembered %s as the dial target", host);
-#endif
-}
-
-void OutgoingConnectionManager::dump_config() const {
-  // The boot delay differs from delay: on deep sleep builds, so print the
-  // value that actually applies
-  ESP_LOGCONFIG(TAG,
-                "  Outgoing connection port: %u\n"
-                "  Outgoing connection boot delay: %" PRIu32 "ms",
-                API_OUTGOING_CONNECTION_PORT, BOOT_WAIT_MS);
-  // Both forms keep their text out of RAM on ESP8266: in the format string,
-  // or through LOG_STR_LITERAL
-#ifdef API_OUTGOING_CONNECTION_HOST
-  ESP_LOGCONFIG(TAG, "  Outgoing connection host: " API_OUTGOING_CONNECTION_HOST);
-#else
-  char buf[socket::SOCKADDR_STR_LEN];
-  this->format_target_(buf);
-  ESP_LOGCONFIG(TAG, "  Outgoing connection host: %s", buf[0] == '\0' ? LOG_STR_LITERAL("none remembered yet") : buf);
-#endif
-}
-
-}  // namespace esphome::api
-#endif  // USE_API && USE_API_OUTGOING_CONNECTION
@@ -1,120 +0,0 @@
-#pragma once
-
-#include "esphome/core/defines.h"
-#if defined(USE_API) && defined(USE_API_OUTGOING_CONNECTION)
-
-#ifndef USE_API_NOISE
-#error "api outgoing_connection needs noise encryption so the peer is verified by key"
-#endif
-
-#include "esphome/components/socket/socket.h"
-#include "esphome/core/preferences.h"
-
-#include <memory>
-
-namespace esphome::api {
-
-class APIServer;
-class APIConnection;
-
-// Room for an IPv6 address in every build, so a remembered IPv4 target is
-// still dialed after enable_ipv6 is turned on. A size that followed the build
-// would also shift every preference registered after this one on ESP8266,
-// where slots are positional. An IPv6 target on a build without IPv6 is
-// dropped by target_sockaddr_() and relearned.
-// Bytes in an IPv6 address
-static constexpr size_t TARGET_ADDR_LEN = 16;
-
-struct SavedOutgoingTarget {
-  // 0 when none is remembered, else AF_INET or AF_INET6
-  uint8_t family;
-  // Network order, IPv4 in the first four bytes and the rest zero
-  uint8_t addr[TARGET_ADDR_LEN];
-  // Interface a link-local IPv6 target is reachable on, 0 when it needs none.
-  // Free in flash: the record still rounds up to the same five words.
-  uint8_t scope_id;
-} PACKED;  // NOLINT
-
-/// Dials out when no dial-back target client is connected. Only the TCP
-/// direction flips: the device stays the Noise responder, so both sides
-/// still verify by key. Targets the YAML host or the last remembered client.
-class OutgoingConnectionManager {
- public:
-  void setup();
-  void loop(APIServer *server);
-  /// A key-verified client declared itself a dial-back target; last one wins
-  void on_target_client(APIConnection *conn);
-  /// Clears the dialed-connection gate; dying unauthenticated escalates the backoff
-  void on_client_removed(APIConnection *conn, bool was_authenticated);
-  void on_shutdown() { this->dial_socket_.reset(); }
-  void dump_config() const;
-
- protected:
-  enum class DialState : uint8_t {
-    DIAL_STATE_IDLE,
-    DIAL_STATE_WAITING,
-    DIAL_STATE_CONNECTING,
-  };
-
-  static constexpr uint32_t BACKOFF_MIN_MS = 5000;
-  static constexpr uint32_t BACKOFF_MAX_MS = 300000;
-  static constexpr uint32_t CONNECT_TIMEOUT_MS = 10000;
-  static constexpr uint32_t CONNECT_POLL_INTERVAL_MS = 250;
-  static constexpr uint32_t NETWORK_RETRY_MS = 500;
-  static constexpr uint32_t PRECONDITION_RETRY_MS = 5000;
-  // A deep sleep wake window is too short to spend on the delay, so those
-  // builds dial out as soon as the target is gone
-#ifdef USE_DEEP_SLEEP
-  static constexpr uint32_t BOOT_WAIT_MS = 0;
-  static constexpr uint32_t IDLE_WAIT_MS = BACKOFF_MIN_MS;
-#else
-  static constexpr uint32_t BOOT_WAIT_MS = API_OUTGOING_CONNECTION_DELAY;
-  static constexpr uint32_t IDLE_WAIT_MS = API_OUTGOING_CONNECTION_DELAY;
-#endif
-
-  void try_dial_(APIServer *server, uint32_t now);
-  void poll_connect_(APIServer *server, uint32_t now);
-  // Hand the connected socket to the server and gate on the new connection
-  void handoff_(APIServer *server, uint32_t now);
-  // Close any half-open dial and wait a jittered backoff before retrying
-  void schedule_retry_(uint32_t now);
-  // Wait without escalating the backoff (used for unmet preconditions)
-  void schedule_wait_(uint32_t now, uint32_t wait);
-  /// Fill addr with the target and return its length, or 0 when there is none
-  socklen_t target_sockaddr_(struct sockaddr_storage *addr) const;
-#ifndef API_OUTGOING_CONNECTION_HOST
-  // Write saved_ to flash, tracking success in host_persisted_
-  bool persist_target_() {
-    this->host_persisted_ = this->target_pref_.save(&this->saved_) && global_preferences->sync();
-    return this->host_persisted_;
-  }
-  /// Format the remembered target for a log line; empty when there is none
-  void format_target_(std::span<char, socket::SOCKADDR_STR_LEN> buf) const;
-#endif
-
-  // Pointers first (4 bytes each on 32-bit)
-  std::unique_ptr<socket::Socket> dial_socket_;
-  // Compared only, never dereferenced
-  APIConnection *dialed_conn_{nullptr};
-#ifndef API_OUTGOING_CONNECTION_HOST
-  ESPPreferenceObject target_pref_;
-#endif
-
-  // 4-byte types
-  uint32_t backoff_{BACKOFF_MIN_MS};
-  uint32_t wait_{BOOT_WAIT_MS};
-  uint32_t state_ts_{0};
-  uint32_t last_poll_{0};
-
-  // Byte-aligned types last
-#ifndef API_OUTGOING_CONNECTION_HOST
-  SavedOutgoingTarget saved_{};
-  // False while saved_ holds a value the flash write failed for; retried on
-  // the next flagged hello
-  bool host_persisted_{false};
-#endif
-  DialState state_{DialState::DIAL_STATE_WAITING};
-};
-
-}  // namespace esphome::api
-#endif  // USE_API && USE_API_OUTGOING_CONNECTION
@@ -143,8 +143,6 @@ template<> const char *proto_enum_to_string<enums::SerialProxyPortType>(enums::S
      return ESPHOME_PSTR("SERIAL_PROXY_PORT_TYPE_RS232");
    case enums::SERIAL_PROXY_PORT_TYPE_RS485:
      return ESPHOME_PSTR("SERIAL_PROXY_PORT_TYPE_RS485");
-    case enums::SERIAL_PROXY_PORT_TYPE_USB_SERIAL:
-      return ESPHOME_PSTR("SERIAL_PROXY_PORT_TYPE_USB_SERIAL");
    default:
      return ESPHOME_PSTR("UNKNOWN");
  }
@@ -892,40 +890,13 @@ template<> const char *proto_enum_to_string<enums::SerialProxyMode>(enums::Seria
      return ESPHOME_PSTR("UNKNOWN");
  }
 }
-template<> const char *proto_enum_to_string<enums::SerialProxyIdentitySource>(enums::SerialProxyIdentitySource value) {
-  switch (value) {
-    case enums::SERIAL_PROXY_IDENTITY_SOURCE_NONE:
-      return ESPHOME_PSTR("SERIAL_PROXY_IDENTITY_SOURCE_NONE");
-    case enums::SERIAL_PROXY_IDENTITY_SOURCE_CONFIGURED:
-      return ESPHOME_PSTR("SERIAL_PROXY_IDENTITY_SOURCE_CONFIGURED");
-    case enums::SERIAL_PROXY_IDENTITY_SOURCE_USB:
-      return ESPHOME_PSTR("SERIAL_PROXY_IDENTITY_SOURCE_USB");
-    default:
-      return ESPHOME_PSTR("UNKNOWN");
-  }
-}
 #endif
-template<> const char *proto_enum_to_string<enums::SerialProxyIdentityFlag>(enums::SerialProxyIdentityFlag value) {
-  switch (value) {
-    case enums::SERIAL_PROXY_IDENTITY_FLAG_NONE:
-      return ESPHOME_PSTR("SERIAL_PROXY_IDENTITY_FLAG_NONE");
-    case enums::SERIAL_PROXY_IDENTITY_FLAG_CONNECTED:
-      return ESPHOME_PSTR("SERIAL_PROXY_IDENTITY_FLAG_CONNECTED");
-    case enums::SERIAL_PROXY_IDENTITY_FLAG_ERROR:
-      return ESPHOME_PSTR("SERIAL_PROXY_IDENTITY_FLAG_ERROR");
-    default:
-      return ESPHOME_PSTR("UNKNOWN");
-  }
-}

 const char *HelloRequest::dump_to(DumpBuffer &out) const {
  MessageDumpHelper helper(out, ESPHOME_PSTR("HelloRequest"));
  dump_field(out, ESPHOME_PSTR("client_info"), this->client_info);
  dump_field(out, ESPHOME_PSTR("api_version_major"), this->api_version_major);
  dump_field(out, ESPHOME_PSTR("api_version_minor"), this->api_version_minor);
-#ifdef USE_API_OUTGOING_CONNECTION
-  dump_field(out, ESPHOME_PSTR("outgoing_connection_target"), this->outgoing_connection_target);
-#endif
  return out.c_str();
 }
 const char *HelloResponse::dump_to(DumpBuffer &out) const {
@@ -1049,9 +1020,6 @@ const char *DeviceInfoResponse::dump_to(DumpBuffer &out) const {
 #endif
 #ifdef USE_API_NOISE
  dump_field(out, ESPHOME_PSTR("api_encryption_provisionable"), this->api_encryption_provisionable);
-#endif
-#ifdef USE_API_OUTGOING_CONNECTION
-  dump_field(out, ESPHOME_PSTR("api_outgoing_connection_supported"), this->api_outgoing_connection_supported);
 #endif
  return out.c_str();
 }
@@ -1078,13 +1046,6 @@ const char *ZWaveProxyCapabilities::dump_to(DumpBuffer &out) const {
  return out.c_str();
 }
 #endif
-#ifdef USE_API_WIZARD
-const char *WizardCapabilities::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("WizardCapabilities"));
-  dump_field(out, ESPHOME_PSTR("configured"), this->configured);
-  return out.c_str();
-}
-#endif
 const char *DeviceCapabilitiesResponse::dump_to(DumpBuffer &out) const {
  MessageDumpHelper helper(out, ESPHOME_PSTR("DeviceCapabilitiesResponse"));
 #ifdef USE_BLUETOOTH_PROXY
@@ -1108,29 +1069,9 @@ const char *DeviceCapabilitiesResponse::dump_to(DumpBuffer &out) const {
    it.dump_to(out);
    out.append("\n");
  }
-#endif
-#ifdef USE_API_WIZARD
-  out.append(2, ' ').append_p(ESPHOME_PSTR("wizard")).append(": ");
-  this->wizard.dump_to(out);
-  out.append("\n");
 #endif
  return out.c_str();
 }
-#ifdef USE_API_WIZARD
-const char *DeviceWizardResponse::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("DeviceWizardResponse"));
-  dump_bytes_field(out, ESPHOME_PSTR("data"), this->data, this->data_len);
-  return out.c_str();
-}
-#endif
-#ifdef USE_API_WIZARD_INPUTS
-const char *WizardInputSetRequest::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("WizardInputSetRequest"));
-  dump_field(out, ESPHOME_PSTR("key"), this->key);
-  dump_field(out, ESPHOME_PSTR("entity_id"), this->entity_id);
-  return out.c_str();
-}
-#endif
 const char *ListEntitiesDoneResponse::dump_to(DumpBuffer &out) const {
  out.append_p(ESPHOME_PSTR("ListEntitiesDoneResponse {}"));
  return out.c_str();
@@ -2773,7 +2714,7 @@ const char *ListEntitiesInfraredResponse::dump_to(DumpBuffer &out) const {
  return out.c_str();
 }
 #endif
-#ifdef USE_IR_RF
+#if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
 const char *InfraredRFTransmitRawTimingsRequest::dump_to(DumpBuffer &out) const {
  MessageDumpHelper helper(out, ESPHOME_PSTR("InfraredRFTransmitRawTimingsRequest"));
 #ifdef USE_DEVICES
@@ -2802,15 +2743,6 @@ const char *InfraredRFReceiveEvent::dump_to(DumpBuffer &out) const {
  }
  return out.c_str();
 }
-const char *InfraredRFTransmitCompleteResponse::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("InfraredRFTransmitCompleteResponse"));
-#ifdef USE_DEVICES
-  dump_field(out, ESPHOME_PSTR("device_id"), this->device_id);
-#endif
-  dump_field(out, ESPHOME_PSTR("key"), this->key);
-  dump_field(out, ESPHOME_PSTR("success"), this->success);
-  return out.c_str();
-}
 #endif
 #ifdef USE_RADIO_FREQUENCY
 const char *ListEntitiesRadioFrequencyResponse::dump_to(DumpBuffer &out) const {
@@ -2894,27 +2826,6 @@ const char *SerialProxySetModeRequest::dump_to(DumpBuffer &out) const {
  dump_field(out, ESPHOME_PSTR("mode"), static_cast<enums::SerialProxyMode>(this->mode));
  return out.c_str();
 }
-const char *UsbDeviceDescriptor::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("UsbDeviceDescriptor"));
-  dump_field(out, ESPHOME_PSTR("vendor_id"), this->vendor_id);
-  dump_field(out, ESPHOME_PSTR("product_id"), this->product_id);
-  dump_field(out, ESPHOME_PSTR("bcd_device"), this->bcd_device);
-  dump_field(out, ESPHOME_PSTR("interface_number"), this->interface_number);
-  return out.c_str();
-}
-const char *SerialProxyIdentity::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("SerialProxyIdentity"));
-  dump_field(out, ESPHOME_PSTR("instance"), this->instance);
-  dump_field(out, ESPHOME_PSTR("source"), static_cast<enums::SerialProxyIdentitySource>(this->source));
-  dump_field(out, ESPHOME_PSTR("flags"), this->flags);
-  dump_field(out, ESPHOME_PSTR("manufacturer"), this->manufacturer);
-  dump_field(out, ESPHOME_PSTR("product"), this->product);
-  dump_field(out, ESPHOME_PSTR("serial_number"), this->serial_number);
-  out.append(2, ' ').append_p(ESPHOME_PSTR("usb")).append(": ");
-  this->usb.dump_to(out);
-  out.append("\n");
-  return out.c_str();
-}
 #endif
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
 const char *BluetoothSetConnectionParamsRequest::dump_to(DumpBuffer &out) const {
@@ -28,7 +28,6 @@

 // Standard library includes that might be needed
 #include <set>
-#include <span>
 #include <vector>
 #include <string>

@@ -628,7 +628,7 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
      break;
    }
 #endif
-#ifdef USE_IR_RF
+#if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
    case InfraredRFTransmitRawTimingsRequest::MESSAGE_TYPE: {
      InfraredRFTransmitRawTimingsRequest msg;
      msg.decode(msg_data, msg_size);
@@ -722,35 +722,6 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
      this->on_serial_proxy_set_mode_request(msg);
      break;
    }
-#endif
-#ifdef USE_SERIAL_PROXY
-    case 154 /* SubscribeSerialProxyIdentityRequest is empty */: {
-#ifdef HAS_PROTO_MESSAGE_DUMP
-      this->log_receive_message_(LOG_STR("on_subscribe_serial_proxy_identity_request"));
-#endif
-      this->on_subscribe_serial_proxy_identity_request();
-      break;
-    }
-#endif
-#ifdef USE_API_WIZARD
-    case 156 /* DeviceWizardRequest is empty */: {
-#ifdef HAS_PROTO_MESSAGE_DUMP
-      this->log_receive_message_(LOG_STR("on_device_wizard_request"));
-#endif
-      this->on_device_wizard_request();
-      break;
-    }
-#endif
-#ifdef USE_API_WIZARD_INPUTS
-    case WizardInputSetRequest::MESSAGE_TYPE: {
-      WizardInputSetRequest msg;
-      msg.decode(msg_data, msg_size);
-#ifdef HAS_PROTO_MESSAGE_DUMP
-      this->log_receive_message_(LOG_STR("on_wizard_input_set_request"), msg);
-#endif
-      this->on_wizard_input_set_request(msg);
-      break;
-    }
 #endif
    default:
      break;
@@ -29,13 +29,6 @@ class APIServerConnectionBase {

  void on_device_capabilities_request(){};

-#ifdef USE_API_WIZARD
-  void on_device_wizard_request(){};
-#endif
-
-#ifdef USE_API_WIZARD_INPUTS
-  void on_wizard_input_set_request(const WizardInputSetRequest &value){};
-#endif
  void on_list_entities_request(){};

  void on_subscribe_states_request(){};
@@ -220,7 +213,7 @@ class APIServerConnectionBase {
  void on_z_wave_proxy_request(const ZWaveProxyRequest &value){};
 #endif

-#ifdef USE_IR_RF
+#if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
  void on_infrared_rf_transmit_raw_timings_request(const InfraredRFTransmitRawTimingsRequest &value){};
 #endif

@@ -245,10 +238,6 @@ class APIServerConnectionBase {
 #ifdef USE_SERIAL_PROXY
  void on_serial_proxy_set_mode_request(const SerialProxySetModeRequest &value){};
 #endif
-#ifdef USE_SERIAL_PROXY
-  void on_subscribe_serial_proxy_identity_request(){};
-#endif
-
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
  void on_bluetooth_set_connection_params_request(const BluetoothSetConnectionParamsRequest &value){};
 #endif
@@ -56,12 +56,7 @@ APIServer::APIServer() { global_api_server = this; }
 void APIServer::socket_failed_(const LogString *msg) {
  ESP_LOGW(TAG, "Socket %s: errno %d", LOG_STR_ARG(msg), errno);
  this->destroy_socket_();
-#ifdef USE_API_OUTGOING_CONNECTION
-  // Dial-out needs no listener; degrade instead of stopping the component
-  this->status_set_error(LOG_STR("listen socket failed"));
-#else
  this->mark_failed();
-#endif
 }

 void APIServer::setup() {
@@ -77,6 +72,43 @@ void APIServer::setup() {
 #endif
 #endif

+  this->socket_ = socket::socket_ip_loop_monitored(SOCK_STREAM, 0).release();  // monitored for incoming connections
+  if (this->socket_ == nullptr) {
+    this->socket_failed_(LOG_STR("creation"));
+    return;
+  }
+  int enable = 1;
+  int err = this->socket_->setsockopt(SOL_SOCKET, SO_REUSEADDR, &enable, sizeof(int));
+  if (err != 0) {
+    ESP_LOGW(TAG, "Socket reuseaddr: errno %d", errno);
+    // we can still continue
+  }
+  err = this->socket_->setblocking(false);
+  if (err != 0) {
+    this->socket_failed_(LOG_STR("nonblocking"));
+    return;
+  }
+
+  struct sockaddr_storage server;
+
+  socklen_t sl = socket::set_sockaddr_any((struct sockaddr *) &server, sizeof(server), this->port_);
+  if (sl == 0) {
+    this->socket_failed_(LOG_STR("set sockaddr"));
+    return;
+  }
+
+  err = this->socket_->bind((struct sockaddr *) &server, sl);
+  if (err != 0) {
+    this->socket_failed_(LOG_STR("bind"));
+    return;
+  }
+
+  err = this->socket_->listen(this->listen_backlog_);
+  if (err != 0) {
+    this->socket_failed_(LOG_STR("listen"));
+    return;
+  }
+
 #ifdef USE_LOGGER
  if (logger::global_logger != nullptr) {
    logger::global_logger->add_log_callback(
@@ -122,47 +154,6 @@ void APIServer::setup() {
  if (this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
    this->status_set_warning(LOG_STR("waiting for client connection"));
  }
-#ifdef USE_API_OUTGOING_CONNECTION
-  this->outgoing_conn_.setup();
-#endif
-
-  // Listener last: on failure socket_failed_() returns early, and an
-  // outgoing_connection build keeps dialing out without one
-  this->socket_ = socket::socket_ip_loop_monitored(SOCK_STREAM, 0).release();  // monitored for incoming connections
-  if (this->socket_ == nullptr) {
-    this->socket_failed_(LOG_STR("creation"));
-    return;
-  }
-  int enable = 1;
-  int err = this->socket_->setsockopt(SOL_SOCKET, SO_REUSEADDR, &enable, sizeof(int));
-  if (err != 0) {
-    ESP_LOGW(TAG, "Socket reuseaddr: errno %d", errno);
-    // we can still continue
-  }
-  err = this->socket_->setblocking(false);
-  if (err != 0) {
-    this->socket_failed_(LOG_STR("nonblocking"));
-    return;
-  }
-
-  struct sockaddr_storage server;
-
-  socklen_t sl = socket::set_sockaddr_any((struct sockaddr *) &server, sizeof(server), this->port_);
-  if (sl == 0) {
-    this->socket_failed_(LOG_STR("set sockaddr"));
-    return;
-  }
-
-  err = this->socket_->bind((struct sockaddr *) &server, sl);
-  if (err != 0) {
-    this->socket_failed_(LOG_STR("bind"));
-    return;
-  }
-
-  err = this->socket_->listen(this->listen_backlog_);
-  if (err != 0) {
-    this->socket_failed_(LOG_STR("listen"));
-  }
 }

 void APIServer::loop() {
@@ -178,12 +169,6 @@ void APIServer::loop() {
  }
 #endif

-#ifdef USE_API_OUTGOING_CONNECTION
-  if (!this->shutting_down_) {
-    this->outgoing_conn_.loop(this);
-  }
-#endif
-
  if (this->api_connection_count_ == 0) {
    // Check reboot timeout - done in loop to avoid scheduler heap churn
    // (cancelled scheduler items sit in heap memory until their scheduled time).
@@ -256,15 +241,6 @@ void APIServer::remove_client_(uint8_t client_index) {
  std::string client_peername(client->get_peername_to(peername_buf));
 #endif

-  // Read before the swap-and-reset below destroys the connection
-  const bool was_authenticated = client->is_authenticated();
-#ifdef USE_API_OUTGOING_CONNECTION
-  if (client->flags_.outgoing_connection_target) {
-    this->outgoing_target_count_--;
-  }
-  this->outgoing_conn_.on_client_removed(client.get(), was_authenticated);
-#endif
-
  // Close socket now (was deferred from on_fatal_error to allow getpeername)
  client->helper_->close();

@@ -283,15 +259,9 @@ void APIServer::remove_client_(uint8_t client_index) {

  // Last client disconnected - set warning and start tracking for reboot timeout
  // (suppressed while provisioning is pending - see loop()).
-  // Refresh on every authenticated removal, not just the last one, so an
-  // unauthenticated straggler removed later (e.g. a port scan, or a dial to
-  // a host that accepts TCP but never speaks the API) cannot discard a
-  // healthy session's timestamp and trigger a spurious reboot
-  if (was_authenticated) {
-    this->last_connected_ = App.get_loop_component_start_time();
-  }
  if (this->api_connection_count_ == 0 && this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
    this->status_set_warning(LOG_STR("waiting for client connection"));
+    this->last_connected_ = App.get_loop_component_start_time();
  }

 #ifdef USE_API_CLIENT_DISCONNECTED_TRIGGER
@@ -313,7 +283,7 @@ void __attribute__((flatten)) APIServer::accept_new_connections_() {
    sock->getpeername_to(peername);

    // Check if we're at the connection limit
-    if (this->at_client_limit_()) {
+    if (this->api_connection_count_ >= MAX_API_CONNECTIONS) {
      ESP_LOGW(TAG, "Max connections (%d), rejecting %s", MAX_API_CONNECTIONS, peername);
      // Immediately close - socket destructor will handle cleanup
      sock.reset();
@@ -322,47 +292,18 @@ void __attribute__((flatten)) APIServer::accept_new_connections_() {

    ESP_LOGD(TAG, "Accept %s", peername);

-    this->add_client_(std::move(sock));
+    auto *conn = new APIConnection(std::move(sock), this);
+    this->clients_[this->api_connection_count_++].reset(conn);
+    conn->start();
+
+    // First client connected - clear warning and update timestamp
+    if (this->api_connection_count_ == 1 && this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
+      this->status_clear_warning();
+      this->last_connected_ = App.get_loop_component_start_time();
+    }
  }
 }

-APIConnection *APIServer::add_client_(std::unique_ptr<socket::Socket> sock) {
-  auto *conn = new APIConnection(std::move(sock), this);  // NOLINT(cppcoreguidelines-owning-memory)
-  this->clients_[this->api_connection_count_++].reset(conn);
-  conn->start();
-
-  // First client connected - clear warning. The reboot watchdog timestamp is
-  // refreshed when an authenticated client is removed (see remove_client_),
-  // never on bare TCP connects.
-  if (this->api_connection_count_ == 1 && this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
-    this->status_clear_warning();
-  }
-  return conn;
-}
-
-#ifdef USE_API_OUTGOING_CONNECTION
-APIConnection *APIServer::add_outgoing_client_(std::unique_ptr<socket::Socket> sock) {
-  // Re-check at the handoff: inbound clients may have taken the last slot and
-  // the PSK may have been cleared since the dial started (mark_outgoing()
-  // needs the noise helper)
-  const bool at_limit = this->at_client_limit_();
-  if (at_limit || !this->noise_ctx_.has_psk()) {
-    ESP_LOGW(TAG, "Dropping outgoing connection (%s)",
-             at_limit ? LOG_STR_LITERAL("max connections") : LOG_STR_LITERAL("no key"));
-    return nullptr;
-  }
-  auto *conn = this->add_client_(std::move(sock));
-  // After start(): sends our server hello first so the peer can pick the key
-  conn->mark_outgoing();
-  return conn;
-}
-
-void APIServer::on_outgoing_target_client(APIConnection *conn) {
-  this->outgoing_target_count_++;
-  this->outgoing_conn_.on_target_client(conn);
-}
-#endif
-
 void APIServer::dump_config() {
  char addr_buf[network::USE_ADDRESS_BUFFER_SIZE];
  ESP_LOGCONFIG(TAG,
@@ -379,9 +320,6 @@ void APIServer::dump_config() {
 #else
  ESP_LOGCONFIG(TAG, "  Noise encryption: NO");
 #endif
-#ifdef USE_API_OUTGOING_CONNECTION
-  this->outgoing_conn_.dump_config();
-#endif
 }

 void APIServer::handle_disconnect(APIConnection *conn) {}
@@ -504,16 +442,7 @@ void APIServer::on_zwave_proxy_request(const ZWaveProxyRequest &msg) {
 }
 #endif

-#ifdef USE_SERIAL_PROXY_USB_IDENTITY
-void APIServer::send_serial_proxy_identity(const SerialProxyIdentity &msg) {
-  for (auto &c : this->active_clients()) {
-    if (c->flags_.serial_proxy_identity_subscription)
-      c->send_serial_proxy_identity(msg);
-  }
-}
-#endif
-
-#ifdef USE_IR_RF
+#if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
 void APIServer::send_infrared_rf_receive_event([[maybe_unused]] uint32_t device_id, uint32_t key,
                                               const std::vector<int32_t> *timings) {
  InfraredRFReceiveEvent resp{};
@@ -526,7 +455,6 @@ void APIServer::send_infrared_rf_receive_event([[maybe_unused]] uint32_t device_
  for (auto &c : this->active_clients())
    c->send_infrared_rf_receive_event(resp);
 }
-
 #endif

 #ifdef USE_ALARM_CONTROL_PANEL
@@ -688,8 +616,6 @@ bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString
        if (!c->send_message(req)) {
          API_LOG_MSG_DROPPED(TAG, "Disconnect request");
        }
-        // Force it: a session from before the key was active must not survive
-        c->flags_.next_close = true;
      }
    });
  }
@@ -791,9 +717,6 @@ void APIServer::on_shutdown() {

  // Close the listening socket to prevent new connections
  this->destroy_socket_();
-#ifdef USE_API_OUTGOING_CONNECTION
-  this->outgoing_conn_.on_shutdown();
-#endif

  // Change batch delay to 5ms for quick flushing during shutdown
  this->batch_delay_ = 5;
@@ -11,7 +11,6 @@
 #endif
 #include "api_pb2.h"
 #include "api_pb2_service.h"
-#include "api_outgoing_connection.h"
 #include "esphome/components/socket/socket.h"
 #include "esphome/core/automation.h"
 #include "esphome/core/component.h"
@@ -91,10 +90,6 @@ class APIServer final : public Component
  void set_noise_psk(const uint8_t *psk) { this->noise_ctx_.set_psk(psk); }
  noise::NoiseContext &get_noise_ctx() { return this->noise_ctx_; }
 #endif  // USE_API_NOISE
-#ifdef USE_API_OUTGOING_CONNECTION
-  // Called by APIConnection when a client declares itself a dial-back target in its hello
-  void on_outgoing_target_client(APIConnection *conn);
-#endif

  void handle_disconnect(APIConnection *conn);
 #ifdef USE_BINARY_SENSOR
@@ -203,11 +198,7 @@ class APIServer final : public Component
 #ifdef USE_ZWAVE_PROXY
  void on_zwave_proxy_request(const ZWaveProxyRequest &msg);
 #endif
-#ifdef USE_SERIAL_PROXY_USB_IDENTITY
-  /// Tell every subscribed client that a serial proxy port's identity changed
-  void send_serial_proxy_identity(const SerialProxyIdentity &msg);
-#endif
-#ifdef USE_IR_RF
+#if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
  void send_infrared_rf_receive_event(uint32_t device_id, uint32_t key, const std::vector<int32_t> *timings);
 #endif

@@ -276,16 +267,6 @@ class APIServer final : public Component
 protected:
  // Accept incoming socket connections. Only called when socket has pending connections.
  void __attribute__((noinline)) accept_new_connections_();
-  /// Takes the socket into a new connection and starts it; callers must have
-  /// checked at_client_limit_() first
-  APIConnection *add_client_(std::unique_ptr<socket::Socket> sock);
-  bool at_client_limit_() const { return this->api_connection_count_ >= MAX_API_CONNECTIONS; }
-#ifdef USE_API_OUTGOING_CONNECTION
-  // Returns the new connection, or nullptr (socket dropped) when at the limit
-  APIConnection *add_outgoing_client_(std::unique_ptr<socket::Socket> sock);
-  bool has_outgoing_target_client_() const { return this->outgoing_target_count_ != 0; }
-  friend class OutgoingConnectionManager;
-#endif
  // Remove a disconnected client by index. Swaps with the last populated slot and resets it.
  void __attribute__((noinline)) remove_client_(uint8_t client_index);

@@ -326,8 +307,6 @@ class APIServer final : public Component
    delete this->socket_;
    this->socket_ = nullptr;
  }
-  /// Log the failure, drop the listen socket, and mark the component failed
-  /// unless this build can still dial out
  void socket_failed_(const LogString *msg);
  // Pointers and pointer-like types first (4 bytes each)
  socket::ListenSocket *socket_{nullptr};
@@ -378,13 +357,11 @@ class APIServer final : public Component
  // Group smaller types together
  uint16_t port_{6053};        // Keep in sync with DEFAULT_PORT in __init__.py
  uint16_t batch_delay_{100};  // Keep in sync with DEFAULT_BATCH_DELAY in __init__.py
-  uint8_t listen_backlog_{4};  // Keep in sync with DEFAULT_LISTEN_BACKLOG in __init__.py
+  // Connection limits - these defaults will be overridden by config values
+  // from cv.SplitDefault in __init__.py which sets platform-specific defaults.
+  uint8_t listen_backlog_{4};
  bool shutting_down_ = false;
  uint8_t api_connection_count_{0};
-#ifdef USE_API_OUTGOING_CONNECTION
-  // Connected clients whose hello declared them a dial-back target
-  uint8_t outgoing_target_count_{0};
-#endif
 #if defined(USE_PROVISIONING) && defined(USE_API_NOISE)
  // Index assigned by the provisioning manager for reporting this transport's state.
  uint8_t provisioning_source_{0};
@@ -400,9 +377,6 @@ class APIServer final : public Component
 #endif
  ESPPreferenceObject noise_pref_;
 #endif  // USE_API_NOISE
-#ifdef USE_API_OUTGOING_CONNECTION
-  OutgoingConnectionManager outgoing_conn_;
-#endif
 };

 extern APIServer *global_api_server;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
@@ -1,103 +0,0 @@
-#include "api_wizard.h"
-
-#ifdef USE_API_WIZARD
-
-#include <cstring>
-
-#include "api_connection.h"
-#include "api_pb2.h"
-#include "api_server.h"
-#include "esphome/core/log.h"
-
-namespace esphome::api {
-
-static const char *const TAG = "api.wizard";
-
-uint8_t *wizard_encode_response(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
-  const auto &msg = *static_cast<const DeviceWizardResponse *>(self);
-  if (msg.data_len == 0)
-    return pos;
-  pos = ProtoEncode::encode_field_raw(pos PROTO_ENCODE_DEBUG_ARG, 1, 2);  // type 2: Length-delimited
-  pos = ProtoEncode::encode_varint_raw(pos PROTO_ENCODE_DEBUG_ARG, msg.data_len);
-  PROTO_ENCODE_CHECK_BOUNDS(pos, msg.data_len);
-  progmem_memcpy(pos, msg.data, msg.data_len);
-  return pos + msg.data_len;
-}
-
-#ifdef USE_API_WIZARD_INPUTS
-static bool wizard_entity_id_valid(const char *entity_id, size_t length) {
-  return length > 0 && length < WIZARD_ENTITY_ID_BUFFER_SIZE && memchr(entity_id, '.', length) != nullptr;
-}
-
-const char *wizard_set_input(const WizardInputSetRequest &msg) {
-  if (!wizard_entity_id_valid(msg.entity_id.c_str(), msg.entity_id.size())) {
-    ESP_LOGW(TAG, "Ignoring an invalid entity id for wizard input");
-    return nullptr;
-  }
-  for (size_t i = 0; i < API_WIZARD_INPUT_COUNT; i++) {
-    // The table is in flash, which ESP8266 can only read through progmem_memcpy
-    WizardInputEntry entry;
-    progmem_memcpy(&entry, &API_WIZARD_INPUTS[i], sizeof(entry));
-    if (entry.key != msg.key)
-      continue;
-    memcpy(entry.entity_id, msg.entity_id.c_str(), msg.entity_id.size());
-    entry.entity_id[msg.entity_id.size()] = '\0';
-    return entry.entity_id;
-  }
-  ESP_LOGW(TAG, "Ignoring an entity id for an unknown wizard input");
-  return nullptr;
-}
-#endif  // USE_API_WIZARD_INPUTS
-
-bool APIConnection::send_device_wizard_response_() {
-  DeviceWizardResponse resp;
-  resp.data = API_WIZARD_DATA;
-  resp.data_len = API_WIZARD_DATA_SIZE;
-  // Not send_message: the data is in flash, so wizard_encode_response copies it out
-  return this->send_message_(DeviceWizardResponse::calc_size_msg(&resp), DeviceWizardResponse::MESSAGE_TYPE,
-                             &wizard_encode_response, &resp);
-}
-
-void APIConnection::on_device_wizard_request() {
-  if (!this->send_device_wizard_response_()) {
-    this->on_fatal_error();
-  }
-}
-
-#ifdef USE_API_WIZARD_INPUTS
-void APIConnection::on_wizard_input_set_request(const WizardInputSetRequest &msg) {
-  const char *entity_id = wizard_set_input(msg);
-  if (entity_id == nullptr)
-    return;
-#ifdef USE_API_WIZARD_LINKED_INPUTS
-  // Entities subscribed to the buffer before it held an entity id, so every client needs to learn of it now
-  for (auto &client : this->parent_->active_clients()) {
-    client->resend_state_subscriptions(entity_id);
-  }
-#endif
-}
-#endif
-
-#ifdef USE_API_WIZARD_LINKED_INPUTS
-void APIConnection::resend_state_subscriptions(const char *entity_id) {
-  if (!this->flags_.home_assistant_states)
-    return;
-  for (const auto &it : this->parent_->get_state_subs()) {
-    if (it.entity_id != entity_id)
-      continue;
-    SubscribeHomeAssistantStateResponse resp;
-    resp.entity_id = StringRef(it.entity_id);
-    resp.attribute = it.attribute != nullptr ? StringRef(it.attribute) : StringRef("");
-    resp.once = it.once;
-    if (!this->send_message(resp)) {
-      // Could not send now: send every subscription again from the loop
-      this->state_subs_at_ = 0;
-      return;
-    }
-  }
-}
-#endif
-
-}  // namespace esphome::api
-
-#endif  // USE_API_WIZARD
@@ -1,62 +0,0 @@
-#pragma once
-
-#include "esphome/core/defines.h"
-
-#ifdef USE_API_WIZARD
-
-#include <cstddef>
-#include <cstdint>
-
-#include "esphome/core/hal.h"
-#include "proto.h"
-#include "esphome/core/string_ref.h"
-
-namespace esphome::api {
-
-class WizardInputSetRequest;
-
-/// Size of the buffer holding the entity id of a wizard input. Home Assistant entity ids are at most 255 bytes.
-static constexpr size_t WIZARD_ENTITY_ID_BUFFER_SIZE = 256;
-
-/// The wizard as zstd compressed JSON (see DeviceWizardResponse), built by the generated code
-/// (components/api/wizard.py) and kept in flash. API_WIZARD_DATA_SIZE bytes long.
-extern const uint8_t API_WIZARD_DATA[] PROGMEM;
-
-/// Encodes a DeviceWizardResponse like the generated encoder would. The data is in flash, which ESP8266 can only read
-/// with progmem_memcpy, so the generated encoder (a plain memcpy) cannot be used. Plain memcpy elsewhere.
-uint8_t *wizard_encode_response(const void *self, uint8_t *pos PROTO_ENCODE_DEBUG_PARAM);
-
-#ifdef USE_API_WIZARD_INPUTS
-/// Where the entity id of an input is kept, found by the key the client uses for it.
-struct WizardInputEntry {
-  uint32_t key;     // FNV-1 hash of the ESPHome id of the input
-  char *entity_id;  // RAM buffer of WIZARD_ENTITY_ID_BUFFER_SIZE bytes, shared with the homeassistant entity
-};
-
-/// The inputs of the wizard, in flash. API_WIZARD_INPUT_COUNT entries long.
-extern const WizardInputEntry API_WIZARD_INPUTS[] PROGMEM;
-
-/// Apply a WizardInputSetRequest: validate it and copy the entity id into the input's buffer. Nothing is stored
-/// across restarts, so the client sends the choices again after every connection.
-/// Returns the buffer, or nullptr when the request was ignored.
-const char *wizard_set_input(const WizardInputSetRequest &msg);
-#endif
-
-#ifdef USE_API_WIZARD_STANDALONE_INPUTS
-/// An input of the wizard that is not tied to an entity of the device. The entity ID the user picks is only ever read
-/// by lambdas, for example `id(input).entity_id()`. It lives in the same RAM buffer a linked input uses.
-class WizardInput {
- public:
-  explicit WizardInput(const char *entity_id) : entity_id_(entity_id) {}
-  /// The Home Assistant entity ID, empty until the wizard sets one.
-  StringRef entity_id() const { return StringRef(this->entity_id_); }
-  bool has_entity_id() const { return this->entity_id_[0] != '\0'; }
-
- protected:
-  const char *entity_id_;
-};
-#endif
-
-}  // namespace esphome::api
-
-#endif  // USE_API_WIZARD
@@ -4,40 +4,64 @@
 #ifdef USE_API
 #ifdef USE_API_HOMEASSISTANT_SERVICES
 #include <functional>
-#include <string>
-#include <type_traits>
 #include <utility>
+#include <vector>
 #include "api_pb2.h"
 #ifdef USE_API_HOMEASSISTANT_ACTION_RESPONSES_JSON
 #include "esphome/components/json/json_util.h"
 #endif
 #include "esphome/core/automation.h"
 #include "esphome/core/helpers.h"
-#include "esphome/core/progmem.h"
 #include "esphome/core/string_ref.h"

 namespace esphome::api {

-// Converts a lambda result to the string sent to Home Assistant
-template<typename T>
-requires(!std::is_pointer_v<std::remove_cvref_t<T>>) std::string field_to_string(T &&val) {
-  return to_string(std::forward<T>(val));  // NOLINT
-}
-inline std::string field_to_string(const char *val) { return val ? std::string(val) : std::string(); }
-inline std::string field_to_string(std::string val) { return val; }
-inline std::string field_to_string(StringRef val) { return val.str(); }
+template<typename... X> class TemplatableStringValue : public TemplatableValue<std::string, X...> {
+  // Verify that const char* uses the base class STATIC_STRING optimization (no heap allocation)
+  // rather than being wrapped in a lambda. The base class constructor for const char* is more
+  // specialized than the templated constructor here, so it should be selected.
+  static_assert(std::is_constructible_v<TemplatableValue<std::string, X...>, const char *>,
+                "Base class must have const char* constructor for STATIC_STRING optimization");

-/// A key and value from codegen; on ESP8266 the table and its strings are in flash.
-/// The value is the constant `value`, or the result of `fn` when it is set.
-template<typename... Ts> struct HomeAssistantField {
-  const char *key;
-  const char *value;
-  std::string (*fn)(const Ts &...);
-
-  template<typename F> static constexpr HomeAssistantField from_lambda(const char *key, F /*lambda*/) {
-    return {key, nullptr, &call_lambda<F>};
+ private:
+  // Helper to convert value to string - handles the case where value is already a string
+  template<typename T> static std::string value_to_string(T &&val) {
+    return to_string(std::forward<T>(val));  // NOLINT
  }
-  template<typename F> static std::string call_lambda(const Ts &...x) { return field_to_string(F{}(x...)); }
+
+  // Overloads for string types - needed because std::to_string doesn't support them
+  static std::string value_to_string(char *val) {
+    return val ? std::string(val) : std::string();
+  }  // For lambdas returning char* (e.g., itoa)
+  static std::string value_to_string(const char *val) { return std::string(val); }  // For lambdas returning .c_str()
+  static std::string value_to_string(const std::string &val) { return val; }
+  static std::string value_to_string(std::string &&val) { return std::move(val); }
+  static std::string value_to_string(const StringRef &val) { return val.str(); }
+  static std::string value_to_string(StringRef &&val) { return val.str(); }
+
+ public:
+  TemplatableStringValue() : TemplatableValue<std::string, X...>() {}
+
+  template<typename F, enable_if_t<!is_invocable<F, X...>::value, int> = 0>
+  TemplatableStringValue(F value) : TemplatableValue<std::string, X...>(value) {}
+
+  template<typename F, enable_if_t<is_invocable<F, X...>::value, int> = 0>
+  TemplatableStringValue(F f)
+      : TemplatableValue<std::string, X...>([f](X... x) -> std::string { return value_to_string(f(x...)); }) {}
+};
+
+template<typename... Ts> class TemplatableKeyValuePair {
+ public:
+  // Default constructor needed for FixedVector::emplace_back()
+  TemplatableKeyValuePair() = default;
+
+  // Keys are always string literals from YAML dictionary keys (e.g., "code", "event")
+  // and never templatable values or lambdas. Only the value parameter can be a lambda/template.
+  // Using const char* avoids std::string heap allocation - keys remain in flash.
+  template<typename T> TemplatableKeyValuePair(const char *key, T value) : key(key), value(value) {}
+
+  const char *key{nullptr};
+  TemplatableStringValue<Ts...> value;
 };

 #ifdef USE_API_HOMEASSISTANT_ACTION_RESPONSES
@@ -82,20 +106,45 @@ template<typename... Ts> using ActionResponseCallback = std::function<void(const

 template<typename... Ts> class HomeAssistantServiceCallAction final : public Action<Ts...> {
 public:
-  using Field = HomeAssistantField<Ts...>;
-
-  /// `fields` is a codegen table: the action or event name (no key), then the data, data_template
-  /// and variables entries.
-  HomeAssistantServiceCallAction(APIServer *parent, bool is_event, const Field *fields, uint8_t data_count,
-                                 uint8_t data_template_count, uint8_t variables_count)
-      : parent_(parent),
-        fields_(fields),
-        data_count_(data_count),
-        data_template_count_(data_template_count),
-        variables_count_(variables_count) {
+  explicit HomeAssistantServiceCallAction(APIServer *parent, bool is_event) : parent_(parent) {
    this->flags_.is_event = is_event;
  }

+  template<typename T> void set_service(T service) { this->service_ = service; }
+
+  // Initialize FixedVector members - called from Python codegen with compile-time known sizes.
+  // Must be called before any add_* methods; capacity must match the number of subsequent add_* calls.
+  void init_data(size_t count) { this->data_.init(count); }
+  void init_data_template(size_t count) { this->data_template_.init(count); }
+  void init_variables(size_t count) { this->variables_.init(count); }
+
+  // Keys are always string literals from the Python code generation (e.g., cg.add(var.add_data("tag_id", templ))).
+  // The value parameter can be a lambda/template, but keys are never templatable.
+  // Using const char* for keys avoids std::string heap allocation - keys remain in flash.
+  template<typename V> void add_data(const char *key, V &&value) {
+    this->add_kv_(this->data_, key, std::forward<V>(value));
+  }
+  template<typename V> void add_data_template(const char *key, V &&value) {
+    this->add_kv_(this->data_template_, key, std::forward<V>(value));
+  }
+  template<typename V> void add_variable(const char *key, V &&value) {
+    this->add_kv_(this->variables_, key, std::forward<V>(value));
+  }
+
+#ifdef USE_ESP8266
+  // On ESP8266, ESPHOME_F() returns __FlashStringHelper* (PROGMEM pointer).
+  // Store as const char* — populate_service_map copies from PROGMEM at play() time.
+  template<typename V> void add_data(const __FlashStringHelper *key, V &&value) {
+    this->add_kv_(this->data_, reinterpret_cast<const char *>(key), std::forward<V>(value));
+  }
+  template<typename V> void add_data_template(const __FlashStringHelper *key, V &&value) {
+    this->add_kv_(this->data_template_, reinterpret_cast<const char *>(key), std::forward<V>(value));
+  }
+  template<typename V> void add_variable(const __FlashStringHelper *key, V &&value) {
+    this->add_kv_(this->variables_, reinterpret_cast<const char *>(key), std::forward<V>(value));
+  }
+#endif
+
 #ifdef USE_API_HOMEASSISTANT_ACTION_RESPONSES
  template<typename T> void set_response_template(T response_template) {
    this->response_template_ = response_template;
@@ -113,61 +162,19 @@ template<typename... Ts> class HomeAssistantServiceCallAction final : public Act
 #endif  // USE_API_HOMEASSISTANT_ACTION_RESPONSES

  void play(const Ts &...x) override {
-    const Field *fields = this->fields_;
-    const size_t total = 1 + this->data_count_ + this->data_template_count_ + this->variables_count_;
-
-    // Lambda results, and on ESP8266 the RAM copies of the flash strings, must live until the send
-    size_t lambda_count = 0;
-#ifdef USE_ESP8266
-    size_t flash_len = 0;
-#endif
-    for (size_t i = 0; i < total; i++) {
-      lambda_count += fields[i].fn != nullptr;
-#ifdef USE_ESP8266
-      if (fields[i].fn == nullptr)
-        flash_len += ESPHOME_strlen_P(fields[i].value);
-      if (fields[i].key != nullptr)
-        flash_len += ESPHOME_strlen_P(fields[i].key);
-#endif
-    }
-    FixedVector<std::string> results;
-    results.init(lambda_count);
-#ifdef USE_ESP8266
-    SmallBufferWithHeapFallback<128, char> flash_copy(flash_len);
-    char *cursor = flash_copy.get();
-#endif
-    auto string_ref = [&](const char *str) {
-#ifdef USE_ESP8266
-      size_t len = ESPHOME_strlen_P(str);
-      memcpy_P(cursor, str, len);
-      StringRef ref(cursor, len);
-      cursor += len;
-      return ref;
-#else
-      return StringRef(str);
-#endif
-    };
-    auto value_ref = [&](const Field &field) {
-      if (field.fn == nullptr)
-        return string_ref(field.value);
-      results.push_back(field.fn(x...));
-      return StringRef(results.back());
-    };
-    auto fill = [&](FixedVector<HomeassistantServiceMap> &dest, uint8_t count) {
-      dest.init(count);
-      for (uint8_t i = 0; i < count; i++, fields++) {
-        auto &kv = dest.emplace_back();
-        kv.key = string_ref(fields->key);
-        kv.value = value_ref(*fields);
-      }
-    };
-
    HomeassistantActionRequest resp;
-    resp.service = value_ref(*fields++);
+    std::string service_value = this->service_.value(x...);
+    resp.service = StringRef(service_value);
    resp.is_event = this->flags_.is_event;
-    fill(resp.data, this->data_count_);
-    fill(resp.data_template, this->data_template_count_);
-    fill(resp.variables, this->variables_count_);
+
+    // Local storage for lambda-evaluated strings - lives until after send
+    FixedVector<std::string> data_storage;
+    FixedVector<std::string> data_template_storage;
+    FixedVector<std::string> variables_storage;
+
+    this->populate_service_map(resp.data, this->data_, data_storage, x...);
+    this->populate_service_map(resp.data_template, this->data_template_, data_template_storage, x...);
+    this->populate_service_map(resp.variables, this->variables_, variables_storage, x...);

 #ifdef USE_API_HOMEASSISTANT_ACTION_RESPONSES
 #ifdef USE_API_HOMEASSISTANT_ACTION_RESPONSES_JSON
@@ -216,26 +223,90 @@ template<typename... Ts> class HomeAssistantServiceCallAction final : public Act
  }

 protected:
+  // Helper to add key-value pairs to FixedVectors
+  // Keys are always string literals (const char*), values can be lambdas/templates
+  template<typename V> void add_kv_(FixedVector<TemplatableKeyValuePair<Ts...>> &vec, const char *key, V &&value) {
+    auto &kv = vec.emplace_back();
+    kv.key = key;
+    kv.value = std::forward<V>(value);
+  }
+
+  template<typename VectorType, typename SourceType>
+  static void populate_service_map(VectorType &dest, SourceType &source, FixedVector<std::string> &value_storage,
+                                   Ts... x) {
+    dest.init(source.size());
+
+#ifdef USE_ESP8266
+    // On ESP8266, all static strings from codegen are FLASH_STRING (PROGMEM),
+    // so is_static_string() is always false — the zero-copy STATIC_STRING fast
+    // path from the non-ESP8266 branch cannot trigger. We copy all keys and
+    // values unconditionally: keys via _P functions (may be in PROGMEM), values
+    // via value() which handles FLASH_STRING internally.
+    value_storage.init(source.size() * 2);
+
+    for (auto &it : source) {
+      auto &kv = dest.emplace_back();
+
+      // Key: copy from possible PROGMEM
+      {
+        size_t key_len = strlen_P(it.key);
+        value_storage.push_back(std::string(key_len, '\0'));
+        memcpy_P(value_storage.back().data(), it.key, key_len);
+        kv.key = StringRef(value_storage.back());
+      }
+
+      // Value: value() handles FLASH_STRING via _P functions internally
+      value_storage.push_back(it.value.value(x...));
+      kv.value = StringRef(value_storage.back());
+    }
+#else
+    // On non-ESP8266, strings are directly readable from flash-mapped memory.
+    // Count non-static strings to allocate exact storage needed.
+    size_t lambda_count = 0;
+    for (const auto &it : source) {
+      if (!it.value.is_static_string()) {
+        lambda_count++;
+      }
+    }
+    value_storage.init(lambda_count);
+
+    for (auto &it : source) {
+      auto &kv = dest.emplace_back();
+      kv.key = StringRef(it.key);
+
+      if (it.value.is_static_string()) {
+        // Static string — pointer directly readable, zero allocation
+        kv.value = StringRef(it.value.get_static_string());
+      } else {
+        // Lambda — evaluate and store result
+        value_storage.push_back(it.value.value(x...));
+        kv.value = StringRef(value_storage.back());
+      }
+    }
+#endif
+  }
+
  APIServer *parent_;
-  const Field *fields_;
-  uint8_t data_count_;
-  uint8_t data_template_count_;
-  uint8_t variables_count_;
-  struct Flags {
-    uint8_t is_event : 1;
-    uint8_t wants_status : 1;
-    uint8_t wants_response : 1;
-    uint8_t has_response_template : 1;
-    uint8_t reserved : 4;
-  } flags_{0};
+  TemplatableStringValue<Ts...> service_{};
+  FixedVector<TemplatableKeyValuePair<Ts...>> data_;
+  FixedVector<TemplatableKeyValuePair<Ts...>> data_template_;
+  FixedVector<TemplatableKeyValuePair<Ts...>> variables_;
 #ifdef USE_API_HOMEASSISTANT_ACTION_RESPONSES
 #ifdef USE_API_HOMEASSISTANT_ACTION_RESPONSES_JSON
-  TemplatableValue<std::string, Ts...> response_template_{};
+  TemplatableStringValue<Ts...> response_template_{""};
  Trigger<JsonObjectConst, Ts...> success_trigger_with_response_;
 #endif  // USE_API_HOMEASSISTANT_ACTION_RESPONSES_JSON
  Trigger<Ts...> success_trigger_;
  Trigger<std::string, Ts...> error_trigger_;
 #endif  // USE_API_HOMEASSISTANT_ACTION_RESPONSES
+
+  struct Flags {
+    uint8_t is_event : 1;
+    uint8_t wants_status : 1;
+    uint8_t wants_response : 1;
+    uint8_t has_response_template : 1;
+    uint8_t reserved : 5;
+  } flags_{0};
 };

 }  // namespace esphome::api
@@ -119,7 +119,7 @@ uint32_t ProtoDecodableMessage::count_repeated_field(const uint8_t *buffer, size
 }

 // Single-pass encode for repeated submessage elements (non-template core).
-// Reserves 1 byte for length varint, encodes the submessage body,
+// Writes field tag, reserves 1 byte for length varint, encodes the submessage body,
 // then backpatches the actual length. For the common case (body < 128 bytes), this is
 // just a single byte write with no memmove — all current repeated submessage types
 // (BLE advertisements at ~47B, GATT descriptors at ~24B, service args, etc.) take
@@ -143,34 +143,51 @@ uint32_t ProtoDecodableMessage::count_repeated_field(const uint8_t *buffer, size
 //
 //   After writing 2-byte varint at len_pos:
 //   [tag][v1][v2][body ..... body]
-//                                ^-- returned cursor = element end, within buffer
-uint8_t *ProtoEncode::encode_sub_message_body(uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM, const void *value,
-                                              ProtoEncodeFn encode_fn) {
-  // Reserve 1 byte for the length varint (optimistic: submessage < 128 bytes)
-  uint8_t *len_pos = pos;
-  PROTO_ENCODE_CHECK_BOUNDS(pos, 1);
-  uint8_t *body_start = pos + 1;
-  uint8_t *after_body = encode_fn(value, body_start PROTO_ENCODE_DEBUG_ARG);
-  uint32_t body_size = static_cast<uint32_t>(after_body - body_start);
-  if (body_size < VARINT_MAX_1_BYTE) [[likely]] {
+//                                ^-- pos_ = element end, within buffer
+void ProtoWriteBuffer::encode_sub_message(uint32_t field_id, const void *value,
+                                          uint8_t *(*encode_fn)(const void *,
+                                                                ProtoWriteBuffer &PROTO_ENCODE_DEBUG_PARAM)) {
+  this->encode_field_raw(field_id, 2);
+  // Reserve 1 byte for length varint (optimistic: submessage < 128 bytes)
+  uint8_t *len_pos = this->pos_;
+  this->debug_check_bounds_(1);
+  this->pos_++;
+  uint8_t *body_start = this->pos_;
+  this->pos_ = encode_fn(value, *this PROTO_ENCODE_DEBUG_INIT(this->buffer_));
+  uint32_t body_size = static_cast<uint32_t>(this->pos_ - body_start);
+  if (body_size < 128) [[likely]] {
    // Common case: 1-byte varint, just backpatch
    *len_pos = static_cast<uint8_t>(body_size);
-    return after_body;
+    return;
  }
-  // Shift the body forward to make room for the extra length varint bytes
+  // Compute extra bytes needed for varint beyond the 1 already reserved
  uint8_t extra = ProtoSize::varint(body_size) - 1;
-  PROTO_ENCODE_CHECK_BOUNDS(after_body, extra);
+  // Shift body forward to make room for the extra varint bytes
+  this->debug_check_bounds_(extra);
  std::memmove(body_start + extra, body_start, body_size);
+  uint8_t *end = this->pos_ + extra;
  // Write the full varint at len_pos
-  (void) encode_varint_raw_loop(len_pos PROTO_ENCODE_DEBUG_ARG, body_size);
-  return after_body + extra;
+  this->pos_ = len_pos;
+  this->encode_varint_raw(body_size);
+  this->pos_ = end;
 }

 // Non-template core for encode_optional_sub_message.
-uint8_t *ProtoEncode::encode_sized_sub_message_body(uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM,
-                                                    uint32_t nested_size, const void *value, ProtoEncodeFn encode_fn) {
-  pos = encode_varint_raw(pos PROTO_ENCODE_DEBUG_ARG, nested_size);
-  return encode_fn(value, pos PROTO_ENCODE_DEBUG_ARG);
+void ProtoWriteBuffer::encode_optional_sub_message(uint32_t field_id, uint32_t nested_size, const void *value,
+                                                   uint8_t *(*encode_fn)(const void *,
+                                                                         ProtoWriteBuffer &PROTO_ENCODE_DEBUG_PARAM)) {
+  if (nested_size == 0)
+    return;
+  this->encode_field_raw(field_id, 2);
+  this->encode_varint_raw(nested_size);
+#ifdef ESPHOME_DEBUG_API
+  uint8_t *start = this->pos_;
+  this->pos_ = encode_fn(value, *this PROTO_ENCODE_DEBUG_INIT(this->buffer_));
+  if (static_cast<uint32_t>(this->pos_ - start) != nested_size)
+    this->debug_check_encode_size_(field_id, nested_size, this->pos_ - start);
+#else
+  this->pos_ = encode_fn(value, *this PROTO_ENCODE_DEBUG_INIT(this->buffer_));
+#endif
 }

 #ifdef ESPHOME_DEBUG_API
@@ -184,14 +201,6 @@ void proto_check_encode_end(const uint8_t *end, const uint8_t *expected) {
  ESP_LOGE(TAG, "Proto encode ended %td bytes off the calculated size", end - expected);
  abort();
 }
-void proto_check_sub_message_size(uint32_t field_id, uint32_t expected, const uint8_t *len_pos, const uint8_t *end) {
-  ptrdiff_t actual = end - (len_pos + ProtoSize::varint(expected));
-  if (actual == static_cast<ptrdiff_t>(expected))
-    return;
-  ESP_LOGE(TAG, "encode_message: size mismatch for field %" PRIu32 ": calculated=%" PRIu32 " actual=%td", field_id,
-           expected, actual);
-  abort();
-}
 void ProtoWriteBuffer::debug_check_bounds_(size_t bytes, const char *caller) {
  if (this->pos_ + bytes > this->buffer_->data() + this->buffer_->size()) {
    ESP_LOGE(TAG, "ProtoWriteBuffer bounds check failed in %s: bytes=%zu offset=%td buf_size=%zu", caller, bytes,
@@ -199,6 +208,11 @@ void ProtoWriteBuffer::debug_check_bounds_(size_t bytes, const char *caller) {
    abort();
  }
 }
+void ProtoWriteBuffer::debug_check_encode_size_(uint32_t field_id, uint32_t expected, ptrdiff_t actual) {
+  ESP_LOGE(TAG, "encode_message: size mismatch for field %" PRIu32 ": calculated=%" PRIu32 " actual=%td", field_id,
+           expected, actual);
+  abort();
+}

 #endif

@@ -56,25 +56,22 @@ inline constexpr int64_t decode_zigzag64(uint64_t value) {
  return (value & 1) ? static_cast<int64_t>(~(value >> 1)) : static_cast<int64_t>(value >> 1);
 }

-/// Count varints in a packed buffer: len minus bytes with the continuation bit, summed a word at a time.
-/// Word is a template parameter so tests can cover the 32-bit path on a 64-bit host.
-template<typename Word = size_t> inline uint16_t count_packed_varints(const uint8_t *data, size_t len) {
-  constexpr size_t word_size = sizeof(Word);
-  constexpr Word lane_ones = ~Word{0} / 0xFF;  // 0x01..01
-  const uint8_t *end = data + len;
-  size_t continuations = 0;
-  while (data != end) {
-    // Unaligned word loads fault on Xtensa
-    if ((reinterpret_cast<uintptr_t>(data) & (word_size - 1)) == 0 && static_cast<size_t>(end - data) >= word_size) {
-      Word word;
-      memcpy(&word, __builtin_assume_aligned(data, word_size), word_size);
-      continuations += (((word >> 7) & lane_ones) * lane_ones) >> (word_size * 8 - 8);
-      data += word_size;
-    } else {
-      continuations += *data++ >> 7;
+/// Count number of varints in a packed buffer
+inline uint16_t count_packed_varints(const uint8_t *data, size_t len) {
+  uint16_t count = 0;
+  while (len > 0) {
+    // Skip varint bytes until we find one without continuation bit
+    while (len > 0 && (*data & 0x80)) {
+      data++;
+      len--;
+    }
+    if (len > 0) {
+      data++;
+      len--;
+      count++;
    }
  }
-  return static_cast<uint16_t>(len - continuations);
+  return count;
 }

 /// Encode a varint directly into a pre-allocated buffer.
@@ -231,8 +228,6 @@ void proto_check_bounds_failed(const uint8_t *pos, size_t bytes, const uint8_t *
 /// Aborts unless an encode body ended exactly where calculate_size() promised. A plain check rather than
 /// assert(), so NDEBUG cannot switch it off.
 void proto_check_encode_end(const uint8_t *end, const uint8_t *expected);
-/// Aborts unless a sized sub-message (length prefix at len_pos) ended where its calculated size said.
-void proto_check_sub_message_size(uint32_t field_id, uint32_t expected, const uint8_t *len_pos, const uint8_t *end);
 #else
 #define PROTO_ENCODE_DEBUG_PARAM
 #define PROTO_ENCODE_DEBUG_ARG
@@ -265,6 +260,21 @@ class ProtoWriteBuffer {
   * Following https://protobuf.dev/programming-guides/encoding/#structure
   */
  void encode_field_raw(uint32_t field_id, uint32_t type) { this->encode_varint_raw(proto_tag(field_id, type)); }
+  /// Single-pass encode for repeated submessage elements.
+  /// Thin template wrapper; all buffer work is in the non-template core.
+  template<typename T> void encode_sub_message(uint32_t field_id, const T &value);
+  /// Encode an optional singular submessage field — skips if empty.
+  /// Thin template wrapper; all buffer work is in the non-template core.
+  template<typename T> void encode_optional_sub_message(uint32_t field_id, const T &value);
+
+  // NOLINTBEGIN(readability-identifier-naming)
+  // Non-template core for encode_sub_message — backpatch approach.
+  void encode_sub_message(uint32_t field_id, const void *value,
+                          uint8_t *(*encode_fn)(const void *, ProtoWriteBuffer &PROTO_ENCODE_DEBUG_PARAM));
+  // Non-template core for encode_optional_sub_message.
+  void encode_optional_sub_message(uint32_t field_id, uint32_t nested_size, const void *value,
+                                   uint8_t *(*encode_fn)(const void *, ProtoWriteBuffer &PROTO_ENCODE_DEBUG_PARAM));
+  // NOLINTEND(readability-identifier-naming)
  APIBuffer *get_buffer() const { return buffer_; }
  uint8_t *get_pos() const { return pos_; }
  void set_pos(uint8_t *pos) { pos_ = pos; }
@@ -275,6 +285,7 @@ class ProtoWriteBuffer {

 #ifdef ESPHOME_DEBUG_API
  void debug_check_bounds_(size_t bytes, const char *caller = __builtin_FUNCTION());
+  void debug_check_encode_size_(uint32_t field_id, uint32_t expected, ptrdiff_t actual);
 #else
  void debug_check_bounds_([[maybe_unused]] size_t bytes) {}
 #endif
@@ -299,9 +310,6 @@ class ProtoWriteBuffer {
 constexpr uint32_t VARINT_MAX_1_BYTE = 1 << 7;   // 128
 constexpr uint32_t VARINT_MAX_2_BYTE = 1 << 14;  // 16384

-/// Generated encode body: writes the fields at pos, returns the cursor past them.
-using ProtoEncodeFn = uint8_t *(*) (const void *, uint8_t *PROTO_ENCODE_DEBUG_PARAM);
-
 /// Static encode helpers for the generated encode bodies. Each takes the write cursor by value and
 /// returns it advanced, so outlined calls at -Os chain through the return register instead of a
 /// stack slot. Helpers without a _force suffix skip fields holding the proto3 default.
@@ -564,36 +572,22 @@ class ProtoEncode {
                                                           uint32_t field_id, int64_t value) {
    return encode_uint64_force(pos PROTO_ENCODE_DEBUG_ARG, field_id, encode_zigzag64(value));
  }
-  /// Repeated sub-message element; the constant tag is written inline.
+  /// Sub-message encoding: sync pos to buffer, delegate, read the cursor back.
  template<typename T>
  [[nodiscard]] static inline uint8_t *encode_sub_message(uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM,
-                                                          uint32_t field_id, const T &value) {
-    pos = encode_field_raw(pos PROTO_ENCODE_DEBUG_ARG, field_id, 2);
-    return encode_sub_message_body(pos PROTO_ENCODE_DEBUG_ARG, &value, &T::encode_msg);
+                                                          ProtoWriteBuffer &buffer, uint32_t field_id, const T &value) {
+    buffer.set_pos(pos);
+    buffer.encode_sub_message(field_id, value);
+    return buffer.get_pos();
  }
-  /// Singular sub-message field, skipped when it encodes to nothing.
  template<typename T>
  [[nodiscard]] static inline uint8_t *encode_optional_sub_message(uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM,
-                                                                   uint32_t field_id, const T &value) {
-    uint32_t nested_size = T::calc_size_msg(&value);
-    if (nested_size == 0)
-      return pos;
-    pos = encode_field_raw(pos PROTO_ENCODE_DEBUG_ARG, field_id, 2);
-#ifdef ESPHOME_DEBUG_API
-    uint8_t *end = encode_sized_sub_message_body(pos PROTO_ENCODE_DEBUG_ARG, nested_size, &value, &T::encode_msg);
-    proto_check_sub_message_size(field_id, nested_size, pos, end);
-    return end;
-#else
-    return encode_sized_sub_message_body(pos, nested_size, &value, &T::encode_msg);
-#endif
+                                                                   ProtoWriteBuffer &buffer, uint32_t field_id,
+                                                                   const T &value) {
+    buffer.set_pos(pos);
+    buffer.encode_optional_sub_message(field_id, value);
+    return buffer.get_pos();
  }
-  /// Length and body, length backpatched after the body is written.
-  [[nodiscard]] static uint8_t *encode_sub_message_body(uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM,
-                                                        const void *value, ProtoEncodeFn encode_fn);
-  /// Length and body for a precomputed size.
-  [[nodiscard]] static uint8_t *encode_sized_sub_message_body(uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM,
-                                                              uint32_t nested_size, const void *value,
-                                                              ProtoEncodeFn encode_fn);

 private:
  /// Unaligned little endian store of four bytes: byte stores where the outlined helper lives (ESP-IDF, ARM
@@ -707,7 +701,9 @@ class ProtoMessage {
 public:
  // Non-virtual defaults for messages with no fields; generated classes hide all four. The
  // static encode_msg/calc_size_msg take const void * so &T::encode_msg needs no thunk.
-  static uint8_t *encode_msg(const void *self, uint8_t *pos PROTO_ENCODE_DEBUG_PARAM) { return pos; }
+  static uint8_t *encode_msg(const void *self, ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) {
+    return buffer.get_pos();
+  }
  static uint32_t calc_size_msg(const void *self) { return 0; }
  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const { return buffer.get_pos(); }
  uint32_t calculate_size() const { return 0; }
@@ -961,6 +957,18 @@ class ProtoSize {
  }
 };

+// Implementation of methods that depend on ProtoSize being fully defined
+
+// Thin template wrapper; delegates to non-template core in proto.cpp.
+template<typename T> inline void ProtoWriteBuffer::encode_sub_message(uint32_t field_id, const T &value) {
+  this->encode_sub_message(field_id, &value, &T::encode_msg);
+}
+
+// Thin template wrapper; delegates to non-template core.
+template<typename T> inline void ProtoWriteBuffer::encode_optional_sub_message(uint32_t field_id, const T &value) {
+  this->encode_optional_sub_message(field_id, T::calc_size_msg(&value), &value, &T::encode_msg);
+}
+
 template<typename T> const char *proto_enum_to_string(T value);

 // ProtoService removed — its methods were inlined into APIConnection.
@@ -1,461 +0,0 @@
-"""The device wizard of the api component: schema, validation and code generation.
-
-Home Assistant shows the wizard when the device is added. See api_wizard.h for the C++ side.
-"""
-
-from collections.abc import Callable
-import importlib
-import json
-from types import ModuleType
-from typing import Any
-
-from esphome import automation
-import esphome.codegen as cg
-from esphome.components.const import CONF_DESCRIPTION
-import esphome.config_validation as cv
-from esphome.const import (
-    CONF_DEVICE_CLASS,
-    CONF_DEVICE_ID,
-    CONF_DOMAIN,
-    CONF_ENTITY_ID,
-    CONF_ID,
-    CONF_INTERNAL,
-    CONF_NAME,
-    CONF_PAGES,
-    CONF_PLATFORM,
-    CONF_TARGET,
-)
-from esphome.core import CORE, ID
-import esphome.final_validate as fv
-from esphome.helpers import fnv1_hash, fnv1_hash_object_id, fnv1a_32bit_hash
-from esphome.types import ConfigType
-
-API_DOMAIN = "api"
-
-CONF_ENTITIES = "entities"
-CONF_ENTITY = "entity"
-CONF_INPUTS = "inputs"
-CONF_INTEGRATION = "integration"
-CONF_SUPPORTED_FEATURES = "supported_features"
-CONF_TITLE = "title"
-CONF_WIZARD = "wizard"
-
-_API = cg.esphome_ns.namespace("api")
-WizardInput = _API.class_("WizardInput")
-
-WIZARD_ENTITY_ID_BUFFER_SIZE = (
-    256  # api_wizard.h; Home Assistant entity IDs are at most 255 bytes
-)
-# One API message must fit APIBuffer::MAX_SIZE (65535) together with the largest frame header (7 bytes,
-# Noise) and footer (16 bytes, Noise MAC)
-WIZARD_RESPONSE_MAX_SIZE = 65535 - 7 - 16
-# Version of the JSON the wizard is sent as, see wizard_document()
-WIZARD_JSON_VERSION = 1
-# zstd level the JSON is compressed with. Output is deterministic for a given zstd version.
-WIZARD_ZSTD_LEVEL = 19
-
-# Wizard string limits; api.proto documents the same values
-WIZARD_TITLE_MAX_LENGTH = 127
-WIZARD_DESCRIPTION_MAX_LENGTH = 255
-WIZARD_FILTER_MAX_LENGTH = 63
-WIZARD_SUPPORTED_FEATURE_MAX_LENGTH = 127
-
-
-def _wizard_text(max_length: int) -> Callable[[Any], str]:
-    """A string passed to Home Assistant verbatim, so it may be a [%key:...%] translation placeholder."""
-    return cv.All(cv.string_strict, cv.Length(max=max_length))
-
-
-def _wizard_strings(max_length: int) -> Callable[[Any], list[str]]:
-    """A single string or a list of strings, always validated to a non-empty list."""
-    return cv.All(
-        cv.ensure_list(cv.All(cv.string_strict, cv.Length(min=1, max=max_length))),
-        cv.Length(min=1),
-    )
-
-
-# Mirrors Home Assistant's EntityFilterSelectorConfig
-WIZARD_ENTITY_FILTER_SCHEMA = cv.All(
-    cv.Schema(
-        {
-            cv.Optional(CONF_INTEGRATION): cv.All(
-                cv.string_strict, cv.Length(min=1, max=WIZARD_FILTER_MAX_LENGTH)
-            ),
-            cv.Optional(CONF_DOMAIN): _wizard_strings(WIZARD_FILTER_MAX_LENGTH),
-            cv.Optional(CONF_DEVICE_CLASS): _wizard_strings(WIZARD_FILTER_MAX_LENGTH),
-            cv.Optional(CONF_SUPPORTED_FEATURES): _wizard_strings(
-                WIZARD_SUPPORTED_FEATURE_MAX_LENGTH
-            ),
-        }
-    ),
-    cv.has_at_least_one_key(
-        CONF_INTEGRATION, CONF_DOMAIN, CONF_DEVICE_CLASS, CONF_SUPPORTED_FEATURES
-    ),
-)
-
-WIZARD_ENTITY_SCHEMA = cv.Schema(
-    {
-        cv.Required(CONF_ID): cv.use_id(cg.EntityBase),
-        cv.Optional(CONF_DESCRIPTION): _wizard_text(WIZARD_DESCRIPTION_MAX_LENGTH),
-    }
-)
-
-
-# An input is either standalone (id declares a new WizardInput) or linked to a homeassistant entity that has no
-# entity_id of its own: Home Assistant sets it
-WIZARD_INPUT_SCHEMA = cv.All(
-    cv.Schema(
-        {
-            cv.Optional(CONF_ID): cv.declare_id(WizardInput),
-            cv.Optional(CONF_ENTITY): cv.use_id(cg.EntityBase),
-            cv.Optional(CONF_DESCRIPTION): _wizard_text(WIZARD_DESCRIPTION_MAX_LENGTH),
-            cv.Optional(CONF_TARGET): cv.Schema(
-                {
-                    cv.Required(CONF_ENTITY): cv.All(
-                        cv.ensure_list(WIZARD_ENTITY_FILTER_SCHEMA), cv.Length(min=1)
-                    ),
-                }
-            ),
-        }
-    ),
-    cv.has_exactly_one_key(CONF_ID, CONF_ENTITY),
-)
-
-WIZARD_PAGE_SCHEMA = cv.All(
-    cv.Schema(
-        {
-            cv.Optional(CONF_TITLE): _wizard_text(WIZARD_TITLE_MAX_LENGTH),
-            cv.Optional(CONF_DESCRIPTION): _wizard_text(WIZARD_DESCRIPTION_MAX_LENGTH),
-            cv.Optional(CONF_ENTITIES): cv.All(
-                cv.ensure_list(WIZARD_ENTITY_SCHEMA), cv.Length(min=1)
-            ),
-            cv.Optional(CONF_INPUTS): cv.All(
-                cv.ensure_list(WIZARD_INPUT_SCHEMA), cv.Length(min=1)
-            ),
-        }
-    ),
-    cv.has_at_least_one_key(CONF_ENTITIES, CONF_INPUTS),
-)
-
-
-def _wizard_inputs(wizard: ConfigType) -> list[ConfigType]:
-    return [conf for page in wizard[CONF_PAGES] for conf in page.get(CONF_INPUTS, [])]
-
-
-def _wizard_input_id(conf: ConfigType) -> ID:
-    """The ID that names an input: the one a standalone input declares, or its linked entity."""
-    return conf[CONF_ID] if CONF_ID in conf else conf[CONF_ENTITY]
-
-
-def _validate_unique_wizard_inputs(wizard: ConfigType) -> ConfigType:
-    """An input is identified on the wire by a hash of its ID, so IDs and hashes must be unique."""
-    seen: dict[int, str] = {}
-    for conf in _wizard_inputs(wizard):
-        input_id = _wizard_input_id(conf).id
-        if (key := fnv1_hash(input_id)) in seen:
-            if seen[key] == input_id:
-                raise cv.Invalid(f"Wizard input '{input_id}' is used more than once")
-            raise cv.Invalid(
-                f"Wizard inputs '{seen[key]}' and '{input_id}' have the same hash, rename one"
-            )
-        seen[key] = input_id
-    return wizard
-
-
-WIZARD_SCHEMA = cv.All(
-    cv.Schema(
-        {
-            cv.Required(CONF_PAGES): cv.All(
-                cv.ensure_list(WIZARD_PAGE_SCHEMA), cv.Length(min=1)
-            ),
-        }
-    ),
-    _validate_unique_wizard_inputs,
-)
-
-# Platforms of the homeassistant component that a wizard input can stand for
-WIZARD_INPUT_DOMAINS = (
-    "binary_sensor",
-    "button",
-    "number",
-    "select",
-    "sensor",
-    "switch",
-    "text",
-    "text_sensor",
-)
-# Platforms that act on one family of Home Assistant domains, which the input's filters must stay within
-WIZARD_DOMAIN_LIMITED_PLATFORMS = ("button", "number", "select", "switch", "text")
-
-
-def wizard_input_ids(api_config: ConfigType) -> set[str]:
-    """The IDs of the entities that are linked inputs of the wizard in the given api config."""
-    if (wizard := api_config.get(CONF_WIZARD)) is None:
-        return set()
-    return {
-        conf[CONF_ENTITY].id for conf in _wizard_inputs(wizard) if CONF_ENTITY in conf
-    }
-
-
-def _wizard_buffer_name(entity_id: ID) -> str:
-    return f"api_wizard_input_{entity_id.id}"
-
-
-def wizard_input_buffer(entity_id: ID) -> str | None:
-    """Name of the RAM buffer holding the Home Assistant entity ID of a wizard input.
-
-    Returns None when the entity is not an input of the wizard. The buffer is defined by the api
-    codegen, and the homeassistant entity of the input is given it in place of a constant.
-    """
-    if entity_id.id not in wizard_input_ids(CORE.config.get(API_DOMAIN, {})):
-        return None
-    return _wizard_buffer_name(entity_id)
-
-
-def _wizard_input_declaration(
-    config: fv.FinalValidateConfig, entity_id: ID
-) -> tuple[str, ConfigType]:
-    """The domain (like sensor) and the config an input ID is declared in."""
-    path = config.get_path_for_id(entity_id)[:-1]
-    return path[0], config.get_config_for_path(path)
-
-
-def _wizard_input_filters(
-    conf: ConfigType, config: fv.FinalValidateConfig
-) -> list[ConfigType]:
-    """The entity filters of an input, with the defaults of a domain limited linked platform."""
-    if (filters := conf.get(CONF_TARGET, {}).get(CONF_ENTITY)) is not None:
-        return filters
-    if CONF_ENTITY in conf:
-        domain, _ = _wizard_input_declaration(config, conf[CONF_ENTITY])
-        if domains := _wizard_default_domains(domain):
-            return [{CONF_DOMAIN: domains}]
-    return []
-
-
-def _wizard_defines(wizard: ConfigType) -> set[str]:
-    """The defines for the parts of the wizard the configuration uses, so the rest is not compiled."""
-    inputs = _wizard_inputs(wizard)
-    defines = {"USE_API_WIZARD"}
-    if inputs:
-        defines.add("USE_API_WIZARD_INPUTS")
-    if any(CONF_ENTITY in conf for conf in inputs):
-        defines.add("USE_API_WIZARD_LINKED_INPUTS")
-    if any(CONF_ID in conf for conf in inputs):
-        defines.add("USE_API_WIZARD_STANDALONE_INPUTS")
-    return defines
-
-
-def _wizard_default_domains(domain: str) -> list[str] | None:
-    """The domains Home Assistant entities can be picked from when the input sets no target."""
-    if domain in WIZARD_DOMAIN_LIMITED_PLATFORMS:
-        platform = importlib.import_module(f"esphome.components.homeassistant.{domain}")
-        return list(platform.SUPPORTED_DOMAINS)
-    return None
-
-
-def _validate_wizard_input(conf: ConfigType) -> ConfigType:
-    if CONF_ENTITY not in conf:
-        return conf
-    domain, declaration = _wizard_input_declaration(
-        fv.full_config.get(), conf[CONF_ENTITY]
-    )
-    if (
-        declaration.get(CONF_PLATFORM) != "homeassistant"
-        or domain not in WIZARD_INPUT_DOMAINS
-    ):
-        raise cv.Invalid(
-            f"Wizard input '{conf[CONF_ENTITY].id}' must be a homeassistant "
-            f"{', '.join(WIZARD_INPUT_DOMAINS)} entity"
-        )
-    if CONF_ENTITY_ID in declaration:
-        # An entity_id in the configuration is a static entry, which is kept apart from the dynamic ones
-        raise cv.Invalid(
-            f"'{conf[CONF_ENTITY].id}' has an entity_id set in its configuration, so it cannot be a "
-            "wizard input. Remove entity_id to let Home Assistant set it through the wizard."
-        )
-    if domain in WIZARD_DOMAIN_LIMITED_PLATFORMS:
-        supported = _wizard_default_domains(domain)
-        for entity_filter in conf.get(CONF_TARGET, {}).get(CONF_ENTITY, []):
-            if not (domains := entity_filter.get(CONF_DOMAIN)):
-                raise cv.Invalid(
-                    f"Every filter of a homeassistant {domain} input must set domain"
-                )
-            if unsupported := [d for d in domains if d not in supported]:
-                raise cv.Invalid(
-                    f"The homeassistant {domain} does not support the domain(s) "
-                    f"{', '.join(unsupported)}. Supported: {', '.join(supported)}"
-                )
-    return conf
-
-
-def _validate_wizard_entity_exposed(value: ID) -> ID:
-    """Reject entities that are internal, as they are not exposed over the API, or have no name.
-
-    The key a client knows an entity by is a hash of its name. Without a name of its own, the
-    device works the name out at runtime from its friendly name, which can add the MAC address,
-    so the key cannot be known when the wizard is built.
-    """
-    _, declaration = _wizard_input_declaration(fv.full_config.get(), value)
-    if declaration.get(CONF_INTERNAL, False):
-        raise cv.Invalid(
-            f"Entity '{value.id}' is internal, so it is not exposed over the API "
-            "and cannot be used in the wizard"
-        )
-    if not declaration.get(CONF_NAME):
-        raise cv.Invalid(
-            f"Entity '{value.id}' has no name of its own, so its key is not known "
-            "when the wizard is built. Give it a name to use it in the wizard"
-        )
-    return value
-
-
-_WIZARD_FINAL_VALIDATE_SCHEMA = cv.Schema(
-    {
-        cv.Optional(CONF_WIZARD): {
-            cv.Optional(CONF_PAGES): [
-                {
-                    cv.Optional(CONF_ENTITIES): [
-                        {cv.Optional(CONF_ID): _validate_wizard_entity_exposed}
-                    ],
-                    cv.Optional(CONF_INPUTS): [_validate_wizard_input],
-                }
-            ]
-        }
-    },
-    extra=cv.ALLOW_EXTRA,
-)
-
-
-def final_validate(config: ConfigType) -> None:
-    """Final validation of the wizard in the given api config, if it has one."""
-    _WIZARD_FINAL_VALIDATE_SCHEMA(config)
-    if (wizard := config.get(CONF_WIZARD)) is not None:
-        size = len(wizard_blob(wizard, fv.full_config.get()))
-        if size > WIZARD_RESPONSE_MAX_SIZE:
-            raise cv.Invalid(
-                f"The compressed wizard is {size} bytes, {size - WIZARD_RESPONSE_MAX_SIZE} "
-                f"bytes over the {WIZARD_RESPONSE_MAX_SIZE} bytes one API message can hold. "
-                "Shorten the texts or use fewer pages, entities or filters",
-                path=[CONF_WIZARD],
-            )
-
-
-WIZARD_INPUT_IS_SET_SCHEMA = cv.maybe_simple_value(
-    {cv.Required(CONF_ID): cv.use_id(WizardInput)}, key=CONF_ID
-)
-
-# Only for standalone inputs: a linked input is read through its homeassistant entity
-automation.register_apply_condition(
-    "api.wizard.input_is_set", WIZARD_INPUT_IS_SET_SCHEMA, "has_entity_id()"
-)
-
-
-def zstd_module() -> ModuleType:
-    """The zstd module: the standard library one from Python 3.14, otherwise the backport."""
-    try:
-        return importlib.import_module("compression.zstd")
-    except ImportError:
-        return importlib.import_module("backports.zstd")
-
-
-def _entity_document(conf: ConfigType, config: fv.FinalValidateConfig) -> ConfigType:
-    """An entity of the device that the page shows, keyed as ListEntitiesResponse keys it."""
-    _, declaration = _wizard_input_declaration(config, conf[CONF_ID])
-    document: ConfigType = {"key": fnv1_hash_object_id(declaration[CONF_NAME])}
-    if (device := declaration.get(CONF_DEVICE_ID)) is not None:
-        document["device_id"] = fnv1a_32bit_hash(device.id)
-    if description := conf.get(CONF_DESCRIPTION):
-        document[CONF_DESCRIPTION] = description
-    return document
-
-
-def _input_document(conf: ConfigType, config: fv.FinalValidateConfig) -> ConfigType:
-    document: ConfigType = {"key": fnv1_hash(_wizard_input_id(conf).id)}
-    if description := conf.get(CONF_DESCRIPTION):
-        document[CONF_DESCRIPTION] = description
-    if filters := _wizard_input_filters(conf, config):
-        document["entity_filters"] = [dict(entity_filter) for entity_filter in filters]
-    return document
-
-
-def wizard_document(wizard: ConfigType, config: fv.FinalValidateConfig) -> ConfigType:
-    """The wizard as the JSON document the device sends, before it is serialised.
-
-    This is the format Home Assistant reads, and api.proto documents it for clients. Version 1:
-
-        {"version": 1,
-         "pages": [{"title": "...", "description": "...",
-           "entities": [{"key": 123, "device_id": 456, "description": "..."}],
-           "inputs": [{"key": 789, "description": "...",
-             "entity_filters": [{"integration": "...", "domain": ["..."],
-                                 "device_class": ["..."], "supported_features": ["..."]}]}]}]}
-
-    Anything empty or unset, and every empty list, is left out. Strings are passed through as
-    written, so they may be Home Assistant translation placeholders.
-
-    - An entity key is the key ListEntitiesResponse sends for the entity: the FNV-1 hash of the
-      object id made from its name (entity_helpers). device_id is the hash of the ESPHome id of
-      the device it belongs to (esphome/core/config.py), and is left out for the main device.
-    - An input key is the FNV-1 hash of the ESPHome id of the input, or of the linked entity. A linked
-      entity must not set entity_id, as that is a static entry kept apart from the ones the wizard sets.
-    - entity_filters are the filters of the input, or the default filters of a linked switch,
-      number, text, select or button.
-    """
-    pages: list[ConfigType] = []
-    for page in wizard[CONF_PAGES]:
-        document: ConfigType = {}
-        for key in (CONF_TITLE, CONF_DESCRIPTION):
-            if value := page.get(key):
-                document[key] = value
-        if entities := [
-            _entity_document(e, config) for e in page.get(CONF_ENTITIES, [])
-        ]:
-            document[CONF_ENTITIES] = entities
-        if inputs := [_input_document(i, config) for i in page.get(CONF_INPUTS, [])]:
-            document[CONF_INPUTS] = inputs
-        pages.append(document)
-    return {"version": WIZARD_JSON_VERSION, CONF_PAGES: pages}
-
-
-def wizard_blob(wizard: ConfigType, config: fv.FinalValidateConfig) -> bytes:
-    """The wizard document as compact, sorted UTF-8 JSON in a single zstd frame."""
-    text = json.dumps(
-        wizard_document(wizard, config),
-        separators=(",", ":"),
-        sort_keys=True,
-        ensure_ascii=False,
-    )
-    return zstd_module().compress(text.encode("utf-8"), level=WIZARD_ZSTD_LEVEL)
-
-
-async def to_code(wizard: ConfigType) -> None:
-    """Emit the compressed wizard, the table of inputs and the defines.
-
-    The API reads both tables from its own sources, so they are externally linked PROGMEM arrays.
-    """
-    blob = wizard_blob(wizard, CORE.config)
-    cg.extern_progmem_array("esphome::api::API_WIZARD_DATA", cg.uint8, list(blob))
-    cg.add_define("API_WIZARD_DATA_SIZE", len(blob))
-    for define in sorted(_wizard_defines(wizard)):
-        cg.add_define(define)
-    entries: list[cg.RawExpression] = []
-    for conf in _wizard_inputs(wizard):
-        input_id = _wizard_input_id(conf)
-        # Every buffer starts empty, until the wizard sets it. A linked homeassistant entity uses it as its entity id.
-        buffer = _wizard_buffer_name(input_id)
-        cg.add_global(
-            cg.RawStatement(
-                f'static char {buffer}[{WIZARD_ENTITY_ID_BUFFER_SIZE}] = "";'
-            )
-        )
-        if CONF_ID in conf:
-            cg.new_Pvariable(input_id, cg.RawExpression(buffer))
-        entries.append(cg.RawExpression(f"{{{fnv1_hash(input_id.id)}u, {buffer}}}"))
-    if entries:
-        cg.extern_progmem_array(
-            "esphome::api::API_WIZARD_INPUTS",
-            cg.esphome_ns.namespace("api").struct("WizardInputEntry"),
-            entries,
-        )
-        cg.add_define("API_WIZARD_INPUT_COUNT", len(entries))
@@ -35,6 +35,10 @@ CONFIG_SCHEMA = cv.Schema(
 async def to_code(config: ConfigType) -> None:
    hub = await cg.get_variable(config[CONF_AS3935_ID])

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_DISTANCE, hub.set_distance_sensor)
-    await sensors(CONF_LIGHTNING_ENERGY, hub.set_energy_sensor)
+    if distance_config := config.get(CONF_DISTANCE):
+        sens = await sensor.new_sensor(distance_config)
+        cg.add(hub.set_distance_sensor(sens))
+
+    if lightning_energy_config := config.get(CONF_LIGHTNING_ENERGY):
+        sens = await sensor.new_sensor(lightning_energy_config)
+        cg.add(hub.set_energy_sensor(sens))
@@ -241,9 +241,12 @@ async def to_code(config: ConfigType) -> None:
        if peak_current_config := conf.get(CONF_PEAK_CURRENT):
            sens = await sensor.new_sensor(peak_current_config)
            cg.add(var.set_peak_current_sensor(i, sens))
-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_FREQUENCY, var.set_freq_sensor)
-    await sensors(CONF_CHIP_TEMPERATURE, var.set_chip_temperature_sensor)
+    if frequency_config := config.get(CONF_FREQUENCY):
+        sens = await sensor.new_sensor(frequency_config)
+        cg.add(var.set_freq_sensor(sens))
+    if chip_temperature_config := config.get(CONF_CHIP_TEMPERATURE):
+        sens = await sensor.new_sensor(chip_temperature_config)
+        cg.add(var.set_chip_temperature_sensor(sens))
    cg.add(var.set_line_freq(config[CONF_LINE_FREQUENCY]))
    cg.add(var.set_current_phases(config[CONF_CURRENT_PHASES]))
    cg.add(var.set_pga_gain(config[CONF_GAIN_PGA]))
@@ -36,13 +36,14 @@ CONFIG_SCHEMA = cv.Schema(


 async def to_code(config: ConfigType) -> None:
-    hub = await cg.get_variable(config[CONF_ID])
+    parent = await cg.get_variable(config[CONF_ID])

    if phase_cfg := config.get(CONF_PHASE_STATUS):
        for i, key in enumerate(PHASE_KEYS):
            if sub_phase_cfg := phase_cfg.get(key):
                sens = await text_sensor.new_text_sensor(sub_phase_cfg)
-                cg.add(hub.set_phase_status_text_sensor(i, sens))
+                cg.add(parent.set_phase_status_text_sensor(i, sens))

-    text_sensors = text_sensor.sub_text_sensors(config)
-    await text_sensors(CONF_FREQUENCY_STATUS, hub.set_freq_status_text_sensor)
+    if freq_status_config := config.get(CONF_FREQUENCY_STATUS):
+        sens = await text_sensor.new_text_sensor(freq_status_config)
+        cg.add(parent.set_freq_status_text_sensor(sens))
@@ -6,7 +6,7 @@ import esphome.codegen as cg
 from esphome.components.esp32 import (
    add_idf_component,
    add_idf_sdkconfig_option,
-    request_http_client,
+    include_builtin_idf_component,
    require_certificate_bundle,
 )
 import esphome.config_validation as cv
@@ -334,7 +334,8 @@ def _emit_memory_pair(value: str | None, psram_key: str, internal_key: str) -> N


 async def to_code(config: ConfigType) -> None:
-    request_http_client()
+    # Re-enable ESP-IDF's HTTP client (excluded by default to save compile time)
+    include_builtin_idf_component("esp_http_client")
    # HTTPS streams verify the server against the root certificate bundle
    require_certificate_bundle()

@@ -72,7 +72,7 @@ esp_err_t AudioReader::add_sink(const std::weak_ptr<ring_buffer::RingBuffer> &ou
  return ESP_ERR_INVALID_STATE;
 }

-esp_err_t AudioReader::start(const AudioFile *audio_file, AudioFileType &file_type) {
+esp_err_t AudioReader::start(AudioFile *audio_file, AudioFileType &file_type) {
  file_type = AudioFileType::NONE;

  this->current_audio_file_ = audio_file;
@@ -47,7 +47,7 @@ class AudioReader {
  /// @param audio_file AudioFile struct containing the file.
  /// @param file_type AudioFileType variable passed-by-reference indicating the type of file being read.
  /// @return ESP_OK
-  esp_err_t start(const AudioFile *audio_file, AudioFileType &file_type);
+  esp_err_t start(AudioFile *audio_file, AudioFileType &file_type);

  /// @brief Reads new file data from the source and sends to the ring buffer sink.
  /// @return AudioReaderState
@@ -69,7 +69,7 @@ class AudioReader {

  esp_http_client_handle_t client_{nullptr};

-  const AudioFile *current_audio_file_{nullptr};
+  AudioFile *current_audio_file_{nullptr};
  AudioFileType audio_file_type_{AudioFileType::NONE};
  const uint8_t *file_current_{nullptr};
 };
@@ -19,7 +19,7 @@ from esphome.const import (
    CONF_URL,
 )
 from esphome.core import CORE, ID, HexInt
-from esphome.cpp_generator import MockObj, ProgmemAssignmentExpression
+from esphome.cpp_generator import MockObj
 from esphome.external_files import download_web_files_in_config
 from esphome.types import ConfigType

@@ -151,14 +151,11 @@ TYPED_FILE_SCHEMA = cv.typed_schema(
 )


-CONF_FILE_DATA_ID = "file_data_id"
-
 MEDIA_FILE_TYPE_SCHEMA = cv.Schema(
    {
        cv.Required(CONF_ID): cv.declare_id(audio.AudioFile),
        cv.Required(CONF_FILE): _file_schema,
        cv.GenerateID(CONF_RAW_DATA_ID): cv.declare_id(cg.uint8),
-        cv.GenerateID(CONF_FILE_DATA_ID): cv.declare_id(audio.AudioFile),
    }
 )

@@ -220,9 +217,9 @@ def audio_files_schema() -> cv.All:


 def generate_audio_file_code(file_config: ConfigType) -> MockObj:
-    """Generate the progmem data and a flash AudioFile for one file.
+    """Generate the progmem data, AudioFile struct, and Pvariable for one file.

-    Returns a const pointer to the AudioFile. Caller is responsible for any further
+    Returns the created Pvariable. Caller is responsible for any further
    registration (the audio_file component additionally registers each file in
    its named C++ registry; other consumers may skip that).
    """
@@ -233,33 +230,17 @@ def generate_audio_file_code(file_config: ConfigType) -> MockObj:
    else:
        data, media_file_type = read_audio_file_and_type(file_config)

-    # Global constants so the AudioFile lives in flash; the id stays a plain pointer
-    # because actions render id arguments as ``::<id>``.
-    data_id = file_config[CONF_RAW_DATA_ID]
-    cg.add_global(
-        ProgmemAssignmentExpression(
-            data_id.type, data_id, cg.safe_exp([HexInt(x) for x in data])
-        )
-    )
-    media_file = cg.StructInitializer(
+    rhs = [HexInt(x) for x in data]
+    prog_arr = cg.progmem_array(file_config[CONF_RAW_DATA_ID], rhs)
+
+    media_files_struct = cg.StructInitializer(
        audio.AudioFile,
-        ("data", MockObj(data_id, ".")),
-        ("length", len(data)),
+        ("data", prog_arr),
+        ("length", len(rhs)),
        ("file_type", media_file_type),
    )
-    file_var_id = file_config[CONF_ID]
-    storage = file_config[CONF_FILE_DATA_ID]
-    cg.add_global(
-        cg.RawStatement(f"static constexpr {storage.type} {storage} = {media_file};")
-    )
-    cg.add_global(
-        cg.RawStatement(
-            f"static const {storage.type} *const {file_var_id} = &{storage};"
-        )
-    )
-    var = MockObj(file_var_id, "->")
-    CORE.register_variable(file_var_id, var)
-    return var
+
+    return cg.new_Pvariable(file_config[CONF_ID], media_files_struct)


 CONFIG_SCHEMA = cv.All(
@@ -10,14 +10,14 @@
 namespace esphome::audio_file {

 struct NamedAudioFile {
-  const audio::AudioFile *file;
+  audio::AudioFile *file;
  const char *file_id;
 };

 inline StaticVector<NamedAudioFile, AUDIO_FILE_MAX_FILES>
    named_audio_files;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)

-inline void add_named_audio_file(const audio::AudioFile *file, const char *file_id) {
+inline void add_named_audio_file(audio::AudioFile *file, const char *file_id) {
  named_audio_files.push_back({file, file_id});
 }

@@ -46,7 +46,7 @@ class AudioFileMediaSource final : public Component,
 protected:
  std::unique_ptr<micro_decoder::DecoderSource> decoder_;
  audio::AudioStreamInfo stream_info_;
-  const audio::AudioFile *current_file_{nullptr};
+  audio::AudioFile *current_file_{nullptr};

  // Written from the main loop in handle_command(), read from the decoder task in
  // on_audio_write(). Must be atomic to avoid a data race.
@@ -33,9 +33,6 @@ void AudioHTTPMediaSource::dump_config() {
                "  Persistent Ring Buffer: %s\n"
                "  Decoder Task Stack in PSRAM: %s",
                this->buffer_size_, YESNO(this->persistent_ring_buffer_), YESNO(this->decoder_task_stack_in_psram_));
-#ifdef USE_AUDIO_HTTP_CA_CERTIFICATE
-  ESP_LOGCONFIG(TAG, "  Custom CA Certificate: %s", YESNO(this->http_ca_certificate_ != nullptr));
-#endif
 }

 void AudioHTTPMediaSource::setup() {
@@ -55,12 +52,6 @@ void AudioHTTPMediaSource::setup() {
  config.reader_stack_size = READER_TASK_STACK_SIZE;
  config.decoder_stack_size = DECODER_TASK_STACK_SIZE;
  config.decoder_stack_in_psram = this->decoder_task_stack_in_psram_;
-#ifdef USE_AUDIO_HTTP_CA_CERTIFICATE
-  // micro-decoder verifies HTTPS against this PEM only, skipping the built-in certificate bundle.
-  if (this->http_ca_certificate_ != nullptr) {
-    config.http_ca_certificate = this->http_ca_certificate_;
-  }
-#endif

  this->decoder_ = std::make_unique<micro_decoder::DecoderSource>(config);
  if (this->decoder_ == nullptr) {
@@ -34,11 +34,6 @@ class AudioHTTPMediaSource final : public Component,
  void set_buffer_size(size_t buffer_size) { this->buffer_size_ = buffer_size; }
  void set_task_stack_in_psram(bool task_stack_in_psram) { this->decoder_task_stack_in_psram_ = task_stack_in_psram; }
  void set_persistent_ring_buffer(bool persistent) { this->persistent_ring_buffer_ = persistent; }
-#ifdef USE_AUDIO_HTTP_CA_CERTIFICATE
-  /// PEM-encoded CA certificate(s) used as the sole trust anchor for HTTPS playback URLs,
-  /// replacing the built-in certificate bundle.
-  void set_http_ca_certificate(const char *ca_certificate) { this->http_ca_certificate_ = ca_certificate; }
-#endif

  // MediaSource interface implementation
  bool play_uri(const std::string &uri) override;
@@ -61,9 +56,6 @@ class AudioHTTPMediaSource final : public Component,
  std::atomic<bool> pause_{false};
  bool decoder_task_stack_in_psram_{false};
  bool persistent_ring_buffer_{false};
-#ifdef USE_AUDIO_HTTP_CA_CERTIFICATE
-  const char *http_ca_certificate_{nullptr};
-#endif
 };

 }  // namespace esphome::audio_http
@@ -1,22 +1,13 @@
-import logging
-from pathlib import Path
-
 import esphome.codegen as cg
 from esphome.components import audio, media_source, psram
 import esphome.config_validation as cv
 from esphome.const import CONF_BUFFER_SIZE, CONF_ID, CONF_TASK_STACK_IN_PSRAM
-import esphome.final_validate as fv
 from esphome.types import ConfigType

-_LOGGER = logging.getLogger(__name__)
-
 CODEOWNERS = ["@kahrendt"]
 AUTO_LOAD = ["audio"]

 CONF_PERSISTENT_RING_BUFFER = "persistent_ring_buffer"
-CONF_CA_CERTIFICATE_PATH = "ca_certificate_path"
-CONF_HTTP_REQUEST = "http_request"
-CONF_VERIFY_SSL = "verify_ssl"

 audio_http_ns = cg.esphome_ns.namespace("audio_http")
 AudioHTTPMediaSource = audio_http_ns.class_(
@@ -29,38 +20,6 @@ def _request_micro_decoder(config: ConfigType) -> ConfigType:
    return config


-def _inherit_ca_certificate_path(config: ConfigType) -> ConfigType:
-    # Default to the CA certificate configured on the http_request component so
-    # HTTPS playback verifies against the same trust anchor without repeating
-    # the option on every source. Needed because audio_http sources are often
-    # declared by device packages and cannot be extended from the device config.
-    # The PEM replaces the built-in certificate bundle as the sole trust anchor,
-    # so make the inheritance visible in the log.
-    if CONF_CA_CERTIFICATE_PATH in config:
-        return config
-    fconf = fv.full_config.get()
-    if CONF_HTTP_REQUEST not in fconf:
-        return config
-    http_request_config = fconf[CONF_HTTP_REQUEST]
-    # Mirror http_request's own semantics: it only applies its CA when SSL
-    # verification is enabled, so neither does the inheritance.
-    if not http_request_config.get(CONF_VERIFY_SSL, True):
-        return config
-    if ca_cert_path := http_request_config.get(CONF_CA_CERTIFICATE_PATH):
-        _LOGGER.info(
-            "audio_http source '%s' is inheriting ca_certificate_path from the "
-            "http_request component; HTTPS playback will verify against that PEM "
-            "instead of the built-in certificate bundle",
-            config[CONF_ID].id,
-        )
-        # Already validated by http_request's schema; the value is a resolved Path.
-        config[CONF_CA_CERTIFICATE_PATH] = ca_cert_path
-    return config
-
-
-FINAL_VALIDATE_SCHEMA = _inherit_ca_certificate_path
-
-
 CONFIG_SCHEMA = cv.All(
    media_source.media_source_schema(
        AudioHTTPMediaSource,
@@ -72,7 +31,6 @@ CONFIG_SCHEMA = cv.All(
            ),
            cv.Optional(CONF_TASK_STACK_IN_PSRAM): psram.validate_task_stack_in_psram,
            cv.Optional(CONF_PERSISTENT_RING_BUFFER, default=False): cv.boolean,
-            cv.Optional(CONF_CA_CERTIFICATE_PATH): cv.file_,
        }
    )
    .extend(cv.COMPONENT_SCHEMA),
@@ -89,16 +47,5 @@ async def to_code(config: ConfigType) -> None:
    if config.get(CONF_TASK_STACK_IN_PSRAM):
        cg.add(var.set_task_stack_in_psram(True))
        psram.request_external_task_stack()
-
    cg.add(var.set_buffer_size(config[CONF_BUFFER_SIZE]))
    cg.add(var.set_persistent_ring_buffer(config[CONF_PERSISTENT_RING_BUFFER]))
-
-    # Embed the certificate content, like http_request does. Passed to
-    # micro_decoder's DecoderConfig::http_ca_certificate, which then uses it as
-    # the sole trust anchor for HTTPS playback URLs instead of the certificate
-    # bundle.
-    if ca_cert_path := config.get(CONF_CA_CERTIFICATE_PATH):
-        cg.add_define("USE_AUDIO_HTTP_CA_CERTIFICATE")
-        with Path(ca_cert_path).open(encoding="utf-8") as f:
-            ca_cert_content = f.read()
-        cg.add(var.set_http_ca_certificate(ca_cert_content))
@@ -44,6 +44,10 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await register_bedjet_child(var, config)

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_OUTLET_TEMPERATURE, var.set_outlet_temperature_sensor)
-    await sensors(CONF_AMBIENT_TEMPERATURE, var.set_ambient_temperature_sensor)
+    if outlet_temperature_sensor := config.get(CONF_OUTLET_TEMPERATURE):
+        sensor_var = await sensor.new_sensor(outlet_temperature_sensor)
+        cg.add(var.set_outlet_temperature_sensor(sensor_var))
+
+    if ambient_temperature_sensor := config.get(CONF_AMBIENT_TEMPERATURE):
+        sensor_var = await sensor.new_sensor(ambient_temperature_sensor)
+        cg.add(var.set_ambient_temperature_sensor(sensor_var))
@@ -11,34 +11,29 @@
 #include "esphome/core/automation.h"
 #include "esphome/core/helpers.h"

-namespace esphome::ble_device_base {
+#include <algorithm>
+#include <initializer_list>

-/// True if `address` is in `table`, a list of MACs ended by 0.
-inline bool mac_in_table(const uint64_t *table, uint64_t address) {
-  for (; *table != 0; table++) {
-    if (*table == address)
-      return true;
-  }
-  return false;
-}
+namespace esphome::ble_device_base {

 // on_ble_advertise: fires on every BLE advertisement, optionally filtered to one or more MACs.
 class ESPBTAdvertiseTrigger final : public Trigger<const ESPBTDevice &>, public ESPBTDeviceListener {
 public:
  template<typename Hub> explicit ESPBTAdvertiseTrigger(Hub *parent) { parent->register_listener(this); }

-  /// Table of MACs ended by 0; must outlive the trigger.
-  void set_addresses(const uint64_t *addresses) { this->addresses_ = addresses; }
+  void set_addresses(std::initializer_list<uint64_t> addresses) { this->addresses_ = addresses; }

  bool parse_device(const ESPBTDevice &device) override {
-    if (this->addresses_ != nullptr && !mac_in_table(this->addresses_, device.address_uint64()))
+    if (!this->addresses_.empty() && std::find(this->addresses_.begin(), this->addresses_.end(),
+                                               device.address_uint64()) == this->addresses_.end()) {
      return false;
+    }
    this->trigger(device);
    return true;
  }

 protected:
-  const uint64_t *addresses_{nullptr};
+  FixedVector<uint64_t> addresses_;
 };

 // on_ble_service_data_advertise: fires when an advertisement contains service
@@ -69,24 +69,13 @@ def uuid_trigger_schema(
    )


-def _filter_mac(value: Any) -> Any:
-    mac = cv.mac_address(value)
-    if not any(mac.parts):
-        # 0 ends the flash MAC table, and it is never a real device address.
-        raise cv.Invalid("00:00:00:00:00:00 cannot be used as a MAC address filter")
-    return mac
-
-
-MAC_FILTER_LIST = cv.ensure_list(_filter_mac)
-
-
 def advertise_trigger_schema(trigger_class: MockObjClass) -> Callable[[Any], Any]:
    """on_ble_advertise schema: multi-mac list filter, unlike the single-mac
    uuid_trigger_schema() — pairs with advertise_trigger_to_code()."""
    return automation.validate_automation(
        {
            cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(trigger_class),
-            cv.Optional(CONF_MAC_ADDRESS): MAC_FILTER_LIST,
+            cv.Optional(CONF_MAC_ADDRESS): cv.ensure_list(cv.mac_address),
        }
    )

@@ -105,18 +94,11 @@ def scan_end_trigger_schema(trigger_class: MockObjClass) -> Callable[[Any], Any]
 _count_listener = cg.slot_counter(LISTENER_COUNT_DEFINE)


-def mac_filter_table(macs: list) -> cg.MockObj:
-    """Shared flash table of MACs ended by 0 (never a valid address), so triggers store a pointer."""
-    return cg.shared_progmem_array(
-        "ble_mac_filter", cg.uint64, [*(mac.as_hex for mac in macs), 0]
-    )
-
-
 async def advertise_trigger_to_code(conf: ConfigType, var: cg.MockObj) -> None:
    """Build an on_ble_advertise trigger (optional multi-mac filter)."""
    trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
-    if macs := conf.get(CONF_MAC_ADDRESS):
-        cg.add(trigger.set_addresses(mac_filter_table(macs)))
+    if (macs := conf.get(CONF_MAC_ADDRESS)) is not None:
+        cg.add(trigger.set_addresses([it.as_hex for it in macs]))
    await automation.build_automation(trigger, [(ESPBTDeviceConstRef, "x")], conf)
    _count_listener()

@@ -88,11 +88,16 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_ACCELERATION_X, var.set_accel_x_sensor)
-    await sensors(CONF_GYROSCOPE_X, var.set_gyro_x_sensor)
-    await sensors(CONF_ACCELERATION_Y, var.set_accel_y_sensor)
-    await sensors(CONF_GYROSCOPE_Y, var.set_gyro_y_sensor)
-    await sensors(CONF_ACCELERATION_Z, var.set_accel_z_sensor)
-    await sensors(CONF_GYROSCOPE_Z, var.set_gyro_z_sensor)
-    await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
+    for d in ["x", "y", "z"]:
+        accel_key = f"acceleration_{d}"
+        if accel_key in config:
+            sens = await sensor.new_sensor(config[accel_key])
+            cg.add(getattr(var, f"set_accel_{d}_sensor")(sens))
+        accel_key = f"gyroscope_{d}"
+        if accel_key in config:
+            sens = await sensor.new_sensor(config[accel_key])
+            cg.add(getattr(var, f"set_gyro_{d}_sensor")(sens))
+
+    if CONF_TEMPERATURE in config:
+        sens = await sensor.new_sensor(config[CONF_TEMPERATURE])
+        cg.add(var.set_temperature_sensor(sens))
@@ -48,6 +48,10 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_TEMPERATURE, var.set_temperature)
-    await sensors(CONF_PRESSURE, var.set_pressure)
+    if temperature_config := config.get(CONF_TEMPERATURE):
+        sens = await sensor.new_sensor(temperature_config)
+        cg.add(var.set_temperature(sens))
+
+    if pressure_config := config.get(CONF_PRESSURE):
+        sens = await sensor.new_sensor(pressure_config)
+        cg.add(var.set_pressure(sens))
@@ -75,13 +75,14 @@ async def to_code_base(config: ConfigType) -> MockObj:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)

-    sensors = sensor.sub_sensors(config)
-    if await sensors(CONF_TEMPERATURE, var.set_temperature_sensor):
-        temperature_config = config[CONF_TEMPERATURE]
+    if temperature_config := config.get(CONF_TEMPERATURE):
+        sens = await sensor.new_sensor(temperature_config)
+        cg.add(var.set_temperature_sensor(sens))
        cg.add(var.set_temperature_oversampling(temperature_config[CONF_OVERSAMPLING]))

-    if await sensors(CONF_PRESSURE, var.set_pressure_sensor):
-        pressure_config = config[CONF_PRESSURE]
+    if pressure_config := config.get(CONF_PRESSURE):
+        sens = await sensor.new_sensor(pressure_config)
+        cg.add(var.set_pressure_sensor(sens))
        cg.add(var.set_pressure_oversampling(pressure_config[CONF_OVERSAMPLING]))

    cg.add(var.set_iir_filter(config[CONF_IIR_FILTER]))
@@ -80,17 +80,18 @@ async def to_code_base(config: ConfigType) -> MockObj:
    await cg.register_component(var, config)

    cg.add(var.set_iir_filter_config(config[CONF_IIR_FILTER]))
-    sensors = sensor.sub_sensors(config)
-    if await sensors(CONF_TEMPERATURE, var.set_temperature_sensor):
-        temperature_config = config[CONF_TEMPERATURE]
+    if temperature_config := config.get(CONF_TEMPERATURE):
+        sens = await sensor.new_sensor(temperature_config)
+        cg.add(var.set_temperature_sensor(sens))
        cg.add(
            var.set_temperature_oversampling_config(
                temperature_config[CONF_OVERSAMPLING]
            )
        )

-    if await sensors(CONF_PRESSURE, var.set_pressure_sensor):
-        pressure_config = config[CONF_PRESSURE]
+    if pressure_config := config.get(CONF_PRESSURE):
+        sens = await sensor.new_sensor(pressure_config)
+        cg.add(var.set_pressure_sensor(sens))
        cg.add(var.set_pressure_oversampling_config(pressure_config[CONF_OVERSAMPLING]))

    return var
@@ -137,9 +137,9 @@ CONFIG_SCHEMA_BASE = cv.Schema(
 async def to_code_base(config: ConfigType) -> MockObj:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
-    sensors = sensor.sub_sensors(config)
-    if await sensors(CONF_TEMPERATURE, var.set_temperature_sensor):
-        temperature_config = config[CONF_TEMPERATURE]
+    if temperature_config := config.get(CONF_TEMPERATURE):
+        sens = await sensor.new_sensor(temperature_config)
+        cg.add(var.set_temperature_sensor(sens))
        cg.add(
            var.set_temperature_oversampling_config(
                temperature_config[CONF_OVERSAMPLING]
@@ -149,8 +149,9 @@ async def to_code_base(config: ConfigType) -> MockObj:
            var.set_temperature_iir_filter_config(temperature_config[CONF_IIR_FILTER])
        )

-    if await sensors(CONF_PRESSURE, var.set_pressure_sensor):
-        pressure_config = config[CONF_PRESSURE]
+    if pressure_config := config.get(CONF_PRESSURE):
+        sens = await sensor.new_sensor(pressure_config)
+        cg.add(var.set_pressure_sensor(sens))
        cg.add(var.set_pressure_oversampling_config(pressure_config[CONF_OVERSAMPLING]))
        cg.add(var.set_pressure_iir_filter_config(pressure_config[CONF_IIR_FILTER]))

@@ -13,6 +13,7 @@ from esphome.const import (
    CONF_VALUE,
    CONF_WAIT_TIME,
 )
+from esphome.core import ID

 CODEOWNERS = ["@lygris", "@gabest11"]
 DEPENDENCIES = ["spi"]
@@ -383,10 +384,7 @@ def validate_raw_data(value):
 SEND_PACKET_ACTION_SCHEMA = cv.maybe_simple_value(
    {
        cv.GenerateID(): cv.use_id(CC1101Component),
-        # TX FIFO size
-        cv.Required(CONF_DATA): cv.templatable(
-            cv.All(validate_raw_data, cv.Length(max=64))
-        ),
+        cv.Required(CONF_DATA): cv.templatable(validate_raw_data),
    },
    key=CONF_DATA,
 )
@@ -401,13 +399,17 @@ SEND_PACKET_ACTION_SCHEMA = cv.maybe_simple_value(
 async def send_packet_action_to_code(config, action_id, template_arg, args):
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])
-    await automation.templatable_bytes(
-        config[CONF_DATA],
-        args,
-        var.set_data_template,
-        var.set_data_static,
-        "cc1101_data",
-    )
+    data = config[CONF_DATA]
+    if isinstance(data, bytes):
+        data = list(data)
+    if cg.is_template(data):
+        templ = await cg.templatable(data, args, cg.std_vector.template(cg.uint8))
+        cg.add(var.set_data_template(templ))
+    else:
+        # Generate static array in flash to avoid RAM copy
+        arr_id = ID(f"{action_id}_data", is_declaration=True, type=cg.uint8)
+        arr = cg.static_const_array(arr_id, cg.ArrayInitializer(*data))
+        cg.add(var.set_data_static(arr, len(data)))
    return var


@@ -3,16 +3,10 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include <cmath>
-#include <cstring>
-
-#ifdef USE_ESP32
-#include <esp_memory_utils.h>
-#endif

 namespace esphome::cc1101 {

 static const char *const TAG = "cc1101";
-static constexpr size_t TX_FIFO_SIZE = 64;

 static void split_float(float value, int mbits, uint8_t &e, uint32_t &m) {
  int e_tmp;
@@ -385,32 +379,18 @@ void CC1101Component::read_(Register reg, uint8_t *buffer, size_t length) {
  this->disable();
 }

-CC1101Error CC1101Component::transmit_packet(const uint8_t *data, size_t len) {
+CC1101Error CC1101Component::transmit_packet(const std::vector<uint8_t> &packet) {
  if (this->state_.PKT_FORMAT != static_cast<uint8_t>(PacketFormat::PACKET_FORMAT_FIFO)) {
    return CC1101Error::PARAMS;
  }
-  const bool variable = this->state_.LENGTH_CONFIG == static_cast<uint8_t>(LengthConfig::LENGTH_CONFIG_VARIABLE);
-  // In variable length mode the FIFO also holds the length byte
-  if (len + (variable ? 1 : 0) > TX_FIFO_SIZE) {
-    ESP_LOGE(TAG, "Packet of %u bytes does not fit the TX FIFO", static_cast<unsigned>(len));
-    return CC1101Error::PARAMS;
-  }

  // Write packet
  this->enter_idle_();
  this->strobe_(Command::FTX);
-  if (variable) {
-    this->write_(Register::FIFO, static_cast<uint8_t>(len));
+  if (this->state_.LENGTH_CONFIG == static_cast<uint8_t>(LengthConfig::LENGTH_CONFIG_VARIABLE)) {
+    this->write_(Register::FIFO, static_cast<uint8_t>(packet.size()));
  }
-#ifdef USE_ESP32
-  // SPI DMA cannot read flash or unaligned buffers; stage them here so the driver does not allocate a copy
-  alignas(4) uint8_t staged[TX_FIFO_SIZE];
-  if (len != 0 && (!esp_ptr_dma_capable(data) || (reinterpret_cast<uintptr_t>(data) & 3) != 0)) {
-    std::memcpy(staged, data, len);
-    data = staged;
-  }
-#endif
-  this->write_(Register::FIFO, data, len);
+  this->write_(Register::FIFO, packet.data(), packet.size());

  // Calibrate PLL
  if (!this->enter_calibrated_(State::FSTXON, Command::FSTXON)) {
@@ -89,10 +89,7 @@ class CC1101Component final : public Component,
  void set_whitening(bool value);

  // Packet mode operations
-  CC1101Error transmit_packet(const std::vector<uint8_t> &packet) {
-    return this->transmit_packet(packet.data(), packet.size());
-  }
-  CC1101Error transmit_packet(const uint8_t *data, size_t len);
+  CC1101Error transmit_packet(const std::vector<uint8_t> &packet);
  void register_listener(CC1101Listener *listener) { this->listeners_.push_back(listener); }
  Trigger<std::vector<uint8_t>, float, float, uint8_t> *get_packet_trigger() { return &this->packet_trigger_; }

@@ -134,11 +131,27 @@ class CC1101Component final : public Component,

 // Action Wrappers
 template<typename... Ts> class SendPacketAction final : public Action<Ts...>, public Parented<CC1101Component> {
-  TEMPLATABLE_BYTES(data)
+ public:
+  void set_data_template(std::function<std::vector<uint8_t>(Ts...)> func) { this->data_func_ = func; }
+  void set_data_static(const uint8_t *data, size_t len) {
+    this->data_static_ = data;
+    this->data_static_len_ = len;
+  }

  void play(const Ts &...x) override {
-    this->data_.visit([this](const uint8_t *data, size_t len) { this->parent_->transmit_packet(data, len); }, x...);
+    if (this->data_func_) {
+      auto data = this->data_func_(x...);
+      this->parent_->transmit_packet(data);
+    } else if (this->data_static_ != nullptr) {
+      std::vector<uint8_t> data(this->data_static_, this->data_static_ + this->data_static_len_);
+      this->parent_->transmit_packet(data);
+    }
  }
+
+ protected:
+  std::function<std::vector<uint8_t>(Ts...)> data_func_{};
+  const uint8_t *data_static_{nullptr};
+  size_t data_static_len_{0};
 };

 }  // namespace esphome::cc1101
@@ -54,8 +54,9 @@ async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await uart.register_uart_device(var, config)
-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_CO2, var.set_co2_sensor)
+    if co2_config := config.get(CONF_CO2):
+        sens = await sensor.new_sensor(co2_config)
+        cg.add(var.set_co2_sensor(sens))


 CALIBRATION_ACTION_SCHEMA = maybe_simple_id(
@@ -203,5 +203,6 @@ async def to_code(config: ConfigType) -> None:
        else:
            cg.add(var.add_source(source))

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_STD_DEV, var.set_std_dev_sensor)
+    if CONF_STD_DEV in config:
+        sens = await sensor.new_sensor(config[CONF_STD_DEV])
+        cg.add(var.set_std_dev_sensor(sens))
@@ -7,7 +7,6 @@ BYTE_ORDER_BIG = "big_endian"

 CONF_ACCELEROMETER_ODR = "accelerometer_odr"
 CONF_ACCELEROMETER_RANGE = "accelerometer_range"
-CONF_ALLOWED_IPS = "allowed_ips"
 CONF_B_CONSTANT = "b_constant"
 CONF_BREATH_VOC_EQUIVALENT = "breath_voc_equivalent"
 CONF_BYTE_ORDER = "byte_order"
@@ -16,7 +15,6 @@ CONF_CLIMATE_ID = "climate_id"
 CONF_CO2_EQUIVALENT = "co2_equivalent"
 CONF_COLOR_DEPTH = "color_depth"
 CONF_COLUMNS = "columns"
-CONF_CONNECTED = "connected"
 CONF_CONVERSION_RATE = "conversion_rate"
 CONF_CRC_ENABLE = "crc_enable"
 CONF_DATA_BITS = "data_bits"
@@ -43,9 +41,7 @@ CONF_ON_SCAN_END = "on_scan_end"
 CONF_ON_STATE_CHANGE = "on_state_change"
 CONF_PARITY = "parity"
 CONF_RECEIVER_FREQUENCY = "receiver_frequency"
-CONF_RECONNECT_INTERVAL = "reconnect_interval"
 CONF_REQUEST_HEADERS = "request_headers"
-CONF_ROLE = "role"
 CONF_ROWS = "rows"
 CONF_SCAN_PARAMETERS = "scan_parameters"
 CONF_SHA256 = "sha256"
@@ -117,10 +117,15 @@ async def to_code(config: ConfigType) -> None:
    cg.add(var.set_hpf_enable(config[CONF_CURRENT_HPF], config[CONF_VOLTAGE_HPF]))
    cg.add(var.set_pulse_energy_wh(config[CONF_PULSE_ENERGY]))

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_VOLTAGE, var.set_voltage_sensor)
-    await sensors(CONF_CURRENT, var.set_current_sensor)
-    await sensors(CONF_POWER, var.set_power_sensor)
+    if voltage_config := config.get(CONF_VOLTAGE):
+        sens = await sensor.new_sensor(voltage_config)
+        cg.add(var.set_voltage_sensor(sens))
+    if current_config := config.get(CONF_CURRENT):
+        sens = await sensor.new_sensor(current_config)
+        cg.add(var.set_current_sensor(sens))
+    if power_config := config.get(CONF_POWER):
+        sens = await sensor.new_sensor(power_config)
+        cg.add(var.set_power_sensor(sens))


 automation.register_apply_action(
@@ -61,8 +61,11 @@ async def to_code(config: ConfigType) -> None:
    pin = await gpio_pin_expression(config[CONF_PIN])
    cg.add(var.set_pin(pin))

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
-    await sensors(CONF_HUMIDITY, var.set_humidity_sensor)
+    if CONF_TEMPERATURE in config:
+        sens = await sensor.new_sensor(config[CONF_TEMPERATURE])
+        cg.add(var.set_temperature_sensor(sens))
+    if CONF_HUMIDITY in config:
+        sens = await sensor.new_sensor(config[CONF_HUMIDITY])
+        cg.add(var.set_humidity_sensor(sens))

    cg.add(var.set_dht_model(config[CONF_MODEL]))
@@ -46,6 +46,10 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
-    await sensors(CONF_HUMIDITY, var.set_humidity_sensor)
+    if CONF_TEMPERATURE in config:
+        sens = await sensor.new_sensor(config[CONF_TEMPERATURE])
+        cg.add(var.set_temperature_sensor(sens))
+
+    if CONF_HUMIDITY in config:
+        sens = await sensor.new_sensor(config[CONF_HUMIDITY])
+        cg.add(var.set_humidity_sensor(sens))
@@ -54,6 +54,10 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
-    await sensors(CONF_PRESSURE, var.set_pressure_sensor)
+    if temperature := config.get(CONF_TEMPERATURE):
+        sens = await sensor.new_sensor(temperature)
+        cg.add(var.set_temperature_sensor(sens))
+
+    if pressure := config.get(CONF_PRESSURE):
+        sens = await sensor.new_sensor(pressure)
+        cg.add(var.set_pressure_sensor(sens))
@@ -63,8 +63,9 @@ async def to_code(config: ConfigType) -> None:
    if CONF_LAMBDA in config:
        lambda_ = await cg.process_lambda(config[CONF_LAMBDA], [], return_type=cg.bool_)
        cg.add(var.set_lambda(lambda_))
-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_LAST_TIME, var.set_last_duty_time_sensor)
+    if CONF_LAST_TIME in config:
+        sens = await sensor.new_sensor(config[CONF_LAST_TIME])
+        cg.add(var.set_last_duty_time_sensor(sens))


 # AUTOMATIONS
@@ -57,7 +57,14 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
-    await sensors(CONF_CO2, var.set_co2_sensor)
-    await sensors(CONF_PRESSURE, var.set_pressure_sensor)
+    if temperature := config.get(CONF_TEMPERATURE):
+        sens = await sensor.new_sensor(temperature)
+        cg.add(var.set_temperature_sensor(sens))
+
+    if co2 := config.get(CONF_CO2):
+        sens = await sensor.new_sensor(co2)
+        cg.add(var.set_co2_sensor(sens))
+
+    if pressure := config.get(CONF_PRESSURE):
+        sens = await sensor.new_sensor(pressure)
+        cg.add(var.set_pressure_sensor(sens))
@@ -16,7 +16,6 @@ from esphome.const import (
    DEVICE_CLASS_TEMPERATURE,
    DEVICE_CLASS_VOLTAGE,
    STATE_CLASS_MEASUREMENT,
-    STATE_CLASS_TOTAL,
    STATE_CLASS_TOTAL_INCREASING,
    UNIT_AMPERE,
    UNIT_CELSIUS,
@@ -71,7 +70,7 @@ SENSOR_CONFIGS = {
    "E": {
        CONF_UNIT_OF_MEASUREMENT: UNIT_WATT_HOURS,
        CONF_DEVICE_CLASS: DEVICE_CLASS_ENERGY,
-        CONF_STATE_CLASS: STATE_CLASS_TOTAL,
+        CONF_STATE_CLASS: STATE_CLASS_TOTAL_INCREASING,
        CONF_ACCURACY_DECIMALS: 0,
    },
    "V": {
@@ -50,6 +50,10 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)

-    sensors = sensor.sub_sensors(config)
-    await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
-    await sensors(CONF_HUMIDITY, var.set_humidity_sensor)
+    if CONF_TEMPERATURE in config:
+        sens = await sensor.new_sensor(config[CONF_TEMPERATURE])
+        cg.add(var.set_temperature_sensor(sens))
+
+    if CONF_HUMIDITY in config:
+        sens = await sensor.new_sensor(config[CONF_HUMIDITY])
+        cg.add(var.set_humidity_sensor(sens))
@@ -62,12 +62,6 @@ automation.register_apply_action(
    automation.ApplyCall("request_full_update()"),
 )

-automation.register_apply_condition(
-    "epaper_spi.is_updating",
-    automation.maybe_simple_id({cv.Required(CONF_ID): cv.use_id(EPaperBase)}),
-    "is_updating()",
-)
-
 # Import all models dynamically from the models package
 for module_info in pkgutil.iter_modules(models.__path__):
    importlib.import_module(f".models.{module_info.name}", package=__package__)
@@ -109,8 +109,6 @@ class EPaperBase : public Display,
  void draw_pixel_at(int x, int y, Color color) override;
  // Make the next update a full one. Applied when that update starts, so one in progress is not affected.
  void request_full_update() { this->full_update_requested_ = true; }
-  // True from the start of an update until the display has refreshed and gone back to sleep.
-  bool is_updating() const { return this->state_ != EPaperState::IDLE; }

 protected:
  int get_height_internal() override { return this->height_; };
@@ -26,15 +26,3 @@ goodisplay_gdey042t81 = ssd1683.extend(
    width=400,
    height=300,
 )
-
-# The SSD1681 shares the SSD1683 command set for everything this driver uses:
-# the same 0x01/0x11/0x18 initialisation, the same 0x44/0x45 window and
-# 0x4E/0x4F cursor registers with a byte-addressed X and a 16-bit Y, and the
-# same 0x22/0x20 update. It only differs in the panel sizes it drives.
-ssd1681 = SSD1683("ssd1681")
-
-waveshare_1_54in_v2 = ssd1681.extend(
-    "waveshare-1.54in-v2",
-    width=200,
-    height=200,
-)
@@ -92,21 +92,6 @@ uint8_t ES8311::calculate_resolution_value(ES8311Resolution resolution) {
  }
 }

-/// Encodes the MCLK pre-multiplier for REG02 bits 3-4. The coefficient table stores the multiplier as the factor
-/// itself (1, 2, 4 or 8), while the register takes 0, 1, 2 or 3 (ES8311 datasheet, register 0x02 MULT_PRE).
-static uint8_t encode_pre_mult(uint8_t pre_mult) {
-  switch (pre_mult) {
-    case 2:
-      return 1;
-    case 4:
-      return 2;
-    case 8:
-      return 3;
-    default:
-      return 0;
-  }
-}
-
 const ES8311Coefficient *ES8311::get_coefficient(uint32_t mclk, uint32_t rate) {
  for (const auto &coefficient : ES8311_COEFFICIENTS) {
    if (coefficient.mclk == mclk && coefficient.rate == rate)
@@ -142,7 +127,7 @@ bool ES8311::configure_clock_() {
  ES8311_ERROR_CHECK(this->read_byte(ES8311_REG02_CLK_MANAGER, &reg02));
  reg02 &= 0x07;
  reg02 |= (coefficient->pre_div - 1) << 5;
-  reg02 |= encode_pre_mult(coefficient->pre_mult) << 3;
+  reg02 |= coefficient->pre_mult << 3;
  ES8311_ERROR_CHECK(this->write_byte(ES8311_REG02_CLK_MANAGER, reg02));

  // Register 0x03
@@ -30,13 +30,19 @@ CONFIG_SCHEMA = cv.All(


 async def to_code(config: ConfigType) -> None:
-    hub = await cg.get_variable(config[CONF_ES8388_ID])
-    selects = select.sub_selects(config, parent=hub)
-    await selects(
-        CONF_DAC_OUTPUT, hub.set_dac_output_select, options=["LINE1", "LINE2", "BOTH"]
-    )
-    await selects(
-        CONF_ADC_INPUT_MIC,
-        hub.set_adc_input_mic_select,
-        options=["LINE1", "LINE2", "DIFFERENCE"],
-    )
+    parent = await cg.get_variable(config[CONF_ES8388_ID])
+    if dac_output_config := config.get(CONF_DAC_OUTPUT):
+        s = await select.new_select(
+            dac_output_config,
+            options=["LINE1", "LINE2", "BOTH"],
+        )
+        await cg.register_parented(s, parent)
+        cg.add(parent.set_dac_output_select(s))
+
+    if adc_input_mic_config := config.get(CONF_ADC_INPUT_MIC):
+        s = await select.new_select(
+            adc_input_mic_config,
+            options=["LINE1", "LINE2", "DIFFERENCE"],
+        )
+        await cg.register_parented(s, parent)
+        cg.add(parent.set_adc_input_mic_select(s))
@@ -1,6 +1,6 @@
 from collections.abc import Callable, Iterable
 import contextlib
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 import itertools
 import logging
 import os
@@ -57,7 +57,7 @@ from esphome.const import (
 from esphome.core import CORE, EsphomeError, HexInt
 from esphome.core.config import BOARD_MAX_LENGTH
 from esphome.coroutine import CoroPriority, coroutine_with_priority
-from esphome.espidf.component import IDFComponent, generate_idf_components
+from esphome.espidf.component import generate_idf_components
 import esphome.final_validate as fv
 from esphome.helpers import copy_file_if_changed, rmtree, write_file_if_changed
 from esphome.schema_extractors import SCHEMA_EXTRACT, schema_extractor
@@ -76,7 +76,6 @@ from .const import (
    KEY_FLASH_SIZE,
    KEY_FULL_CERT_BUNDLE,
    KEY_IDF_VERSION,
-    KEY_MBEDTLS_SDKCONFIG,
    KEY_NETWORK_SDKCONFIG,
    KEY_PATH,
    KEY_REF,
@@ -238,7 +237,7 @@ DEFAULT_EXCLUDED_IDF_COMPONENTS = (
    "cmock",  # Unit testing mock framework - ESPHome doesn't use IDF's testing
    "console",  # Console REPL - unused by ESPHome; espressif/mdns pulls it back when configured
    "driver",  # Legacy driver shim - only needed by esp32_touch, esp32_can for legacy headers
-    "esp-tls",  # TLS wrapper - re-included by request_tls()
+    "esp-tls",  # TLS wrapper - re-included by http_request, mqtt, web_server_idf
    "esp_adc",  # ADC driver - only needed by adc component
    "esp_coex",  # WiFi/BT coexistence - re-included by esp32_ble_tracker, zigbee; esp_wifi/bt pull it back
    "esp_driver_cam",  # Camera driver - the esp32-camera managed component pulls it back
@@ -743,10 +742,9 @@ def is_idf_sdkconfig_option_enabled(name: str) -> bool:
 def set_idf_sdkconfig_default(name: str, value: SdkconfigValueType) -> None:
    """Set an sdkconfig option unless it is already set.

-    User sdkconfig_options take precedence regardless of to_code order:
-    esp32.to_code applies them unconditionally, and this helper preserves
-    values that are already set. FINAL priority reconcile jobs use the same
-    guard because they run after every to_code, including the user's options.
+    For the FINAL priority reconcile jobs: they run after every to_code,
+    including the user's sdkconfig_options, and must not override an
+    existing value.
    """
    if name not in CORE.data[KEY_ESP32][KEY_SDKCONFIG_OPTIONS]:
        add_idf_sdkconfig_option(name, value)
@@ -813,97 +811,6 @@ def request_software_coexistence() -> None:
    include_builtin_idf_component("esp_coex")


-@dataclass
-class MbedtlsSdkconfigData:
-    """Inputs for the mbedTLS sdkconfig flags, reconciled at FINAL.
-
-    Components call the require_mbedtls_*() helpers (and request_tls(), which
-    sets tls_required and also un-excludes the esp-tls component) rather than
-    writing the CONFIG_MBEDTLS_* flags directly; _reconcile_mbedtls_sdkconfig()
-    decides the final values once every to_code has run.
-    """
-
-    ecp_required: bool = False  # ECDH/ECDSA without TLS (openthread SRP host key)
-    tls_required: bool = False  # mbedTLS TLS role needed without the esp-tls wrapper
-    tls_server_required: bool = False  # server-side TLS/DTLS handshake
-    tls_extras_required: set[str] = field(default_factory=set)  # kept TLS extras
-    peer_cert_required: bool = False  # keep the peer certificate after the handshake
-    pkcs7_required: bool = False  # PKCS#7 parsing
-    sha512_required: bool = False  # SHA-384/SHA-512
-    # esp32 advanced disable_mbedtls_* options
-    disable_tls: bool = True
-    disable_tls_server: bool = True
-    disable_tls_extras: bool = True
-    disable_peer_cert: bool = True
-    disable_pkcs7: bool = True
-
-
-def _mbedtls_sdkconfig() -> MbedtlsSdkconfigData:
-    data = CORE.data[KEY_ESP32]
-    if KEY_MBEDTLS_SDKCONFIG not in data:
-        data[KEY_MBEDTLS_SDKCONFIG] = MbedtlsSdkconfigData()
-    return data[KEY_MBEDTLS_SDKCONFIG]
-
-
-# IDF components that reference esp_tls symbols from their own code, so
-# re-including any of them is an implicit TLS request.
-_ESP_TLS_LINKING_COMPONENTS = (
-    "esp-tls",
-    "esp_http_client",
-    "esp_https_ota",
-    "esp_https_server",
-    "esp_local_ctrl",
-    "mqtt",
-)
-
-
-def _mbedtls_tls_required() -> bool:
-    """TLS stays in the build: requested, or an esp_tls-linking component was re-included.
-
-    The exclusion-set signal keeps external components working whose only
-    obligation before request_tls() existed was include_builtin_idf_component()
-    of esp-tls or of a component that links it (esp_http_client, IDF mqtt).
-    """
-    if _mbedtls_sdkconfig().tls_required:
-        return True
-    excluded = CORE.data[KEY_ESP32][KEY_EXCLUDE_COMPONENTS]
-    return any(name not in excluded for name in _ESP_TLS_LINKING_COMPONENTS)
-
-
-def _mbedtls_tls_compiled_out() -> bool:
-    """True when this build removes the TLS stack from mbedTLS entirely."""
-    return (
-        not CORE.using_arduino
-        and _mbedtls_sdkconfig().disable_tls
-        and not _mbedtls_tls_required()
-    )
-
-
-def require_mbedtls_tls() -> None:
-    """Keep the mbedTLS TLS stack without compiling the esp-tls wrapper.
-
-    For code that talks to mbedTLS directly (wpa_supplicant's EAP client).
-    Components that use esp_tls call request_tls() instead.
-    """
-    _mbedtls_sdkconfig().tls_required = True
-
-
-def request_tls() -> None:
-    """Request the mbedTLS TLS stack and the esp-tls wrapper.
-
-    Without a request TLS and its ECP/PEM-write/CRL/CSR crypto compile out;
-    hashes, AES and RSA stay available.
-    """
-    require_mbedtls_tls()
-    include_builtin_idf_component("esp-tls")
-
-
-def request_http_client() -> None:
-    """Request ESP-IDF's HTTP client; it links esp_tls even for plain http."""
-    include_builtin_idf_component("esp_http_client")
-    request_tls()
-
-
 def add_idf_component(
    *,
    name: str,
@@ -1939,7 +1846,6 @@ CONF_DISABLE_OCD_AWARE = "disable_ocd_aware"
 CONF_DISABLE_USB_SERIAL_JTAG_SECONDARY = "disable_usb_serial_jtag_secondary"
 CONF_DISABLE_DEV_NULL_VFS = "disable_dev_null_vfs"
 CONF_DISABLE_MBEDTLS_PEER_CERT = "disable_mbedtls_peer_cert"
-CONF_DISABLE_MBEDTLS_TLS = "disable_mbedtls_tls"
 CONF_DISABLE_MBEDTLS_PKCS7 = "disable_mbedtls_pkcs7"
 CONF_DISABLE_MBEDTLS_TLS_SERVER = "disable_mbedtls_tls_server"
 CONF_DISABLE_MBEDTLS_TLS_EXTRAS = "disable_mbedtls_tls_extras"
@@ -1955,7 +1861,12 @@ KEY_VFS_TERMIOS_REQUIRED = "vfs_termios_required"
 # Feature requirement tracking - components can call require_* functions to re-enable
 # These are stored in CORE.data[KEY_ESP32] dict
 KEY_USB_SERIAL_JTAG_SECONDARY_REQUIRED = "usb_serial_jtag_secondary_required"
+KEY_MBEDTLS_PEER_CERT_REQUIRED = "mbedtls_peer_cert_required"
+KEY_MBEDTLS_PKCS7_REQUIRED = "mbedtls_pkcs7_required"
+KEY_MBEDTLS_TLS_SERVER_REQUIRED = "mbedtls_tls_server_required"
+KEY_MBEDTLS_TLS_EXTRAS_REQUIRED = "mbedtls_tls_extras_required"
 KEY_FATFS_REQUIRED = "fatfs_required"
+KEY_MBEDTLS_SHA512_REQUIRED = "mbedtls_sha512_required"
 KEY_ADC_ONESHOT_IRAM_REQUIRED = "adc_oneshot_iram_required"
 KEY_LIBC_PICOLIBC_NEWLIB_COMPAT_REQUIRED = "libc_picolibc_newlib_compat_required"

@@ -1994,9 +1905,6 @@ def require_certificate_bundle() -> None:
    certificates (http_request, audio streaming) call this so the bundle is
    compiled and gen_crt_bundle runs only when something uses it.
    """
-    # esp_crt_bundle.c lives in the mbedtls component and calls
-    # mbedtls_ssl_conf_*, so a bundle needs the TLS role but not esp-tls.
-    require_mbedtls_tls()
    CORE.data[KEY_ESP32][KEY_CERT_BUNDLE] = True


@@ -2022,37 +1930,33 @@ def require_usb_serial_jtag_secondary() -> None:
    CORE.data[KEY_ESP32][KEY_USB_SERIAL_JTAG_SECONDARY_REQUIRED] = True


-def require_mbedtls_ecp() -> None:
-    """Keep mbedTLS elliptic curve support (ECDH/ECDSA) without requesting TLS.
-
-    Call this from components that sign or verify with ECDSA outside a TLS
-    handshake (openthread's SRP host key). WiFi, Bluetooth and secure boot
-    select it through Kconfig on their own.
-    """
-    _mbedtls_sdkconfig().ecp_required = True
-
-
 def require_mbedtls_peer_cert() -> None:
-    """Keep the peer certificate after the TLS handshake (CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE).
+    """Mark that mbedTLS peer certificate retention is required by a component.

-    A user sdkconfig_options value takes precedence.
+    Call this from components that need access to the peer certificate after
+    the TLS handshake is complete. This prevents CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
+    from being disabled.
    """
-    _mbedtls_sdkconfig().peer_cert_required = True
+    CORE.data[KEY_ESP32][KEY_MBEDTLS_PEER_CERT_REQUIRED] = True


 def require_mbedtls_pkcs7() -> None:
-    """Keep mbedTLS PKCS#7 support (CONFIG_MBEDTLS_PKCS7_C). A user sdkconfig_options value takes precedence."""
-    _mbedtls_sdkconfig().pkcs7_required = True
+    """Mark that mbedTLS PKCS#7 support is required by a component.
+
+    Call this from components that need PKCS#7 certificate validation.
+    This prevents CONFIG_MBEDTLS_PKCS7_C from being disabled.
+    """
+    CORE.data[KEY_ESP32][KEY_MBEDTLS_PKCS7_REQUIRED] = True


 def require_mbedtls_tls_server() -> None:
-    """Widen the TLS role to include the server-side handshake.
+    """Mark that the mbedTLS server-side TLS/DTLS handshake is required.

-    Only affects builds where TLS is compiled in; it prevents
-    CONFIG_MBEDTLS_TLS_CLIENT_ONLY from being selected. A component that
-    actually opens or accepts TLS/DTLS sessions must also call request_tls().
+    Call this from components that accept TLS connections (OpenThread's DTLS
+    commissioner does). This prevents CONFIG_MBEDTLS_TLS_CLIENT_ONLY from
+    being selected.
    """
-    _mbedtls_sdkconfig().tls_server_required = True
+    CORE.data[KEY_ESP32][KEY_MBEDTLS_TLS_SERVER_REQUIRED] = True


 def require_mbedtls_tls_extras(options: Iterable[str] | None = None) -> None:
@@ -2065,14 +1969,18 @@ def require_mbedtls_tls_extras(options: Iterable[str] | None = None) -> None:
    servers ESPHome cannot vet (wpa_supplicant's EAP client). A user-supplied
    sdkconfig_options value is never overridden either.
    """
-    _mbedtls_sdkconfig().tls_extras_required.update(
-        MBEDTLS_TLS_EXTRA_OPTIONS if options is None else options
-    )
+    required = CORE.data[KEY_ESP32].setdefault(KEY_MBEDTLS_TLS_EXTRAS_REQUIRED, set())
+    required.update(MBEDTLS_TLS_EXTRA_OPTIONS if options is None else options)


 def require_mbedtls_sha512() -> None:
-    """Keep mbedTLS SHA-384/SHA-512 (CONFIG_MBEDTLS_SHA384_C / CONFIG_MBEDTLS_SHA512_C)."""
-    _mbedtls_sdkconfig().sha512_required = True
+    """Mark that mbedTLS SHA-384/SHA-512 support is required by a component.
+
+    Call this from components that need to verify TLS certificates or signatures
+    using SHA-384 or SHA-512 algorithms. This prevents CONFIG_MBEDTLS_SHA384_C
+    and CONFIG_MBEDTLS_SHA512_C from being disabled.
+    """
+    CORE.data[KEY_ESP32][KEY_MBEDTLS_SHA512_REQUIRED] = True


 def idf_version() -> cv.Version:
@@ -2226,7 +2134,6 @@ FRAMEWORK_SCHEMA = cv.Schema(
                cv.Optional(CONF_DISABLE_DEV_NULL_VFS, default=True): cv.boolean,
                cv.Optional(CONF_DISABLE_MBEDTLS_PEER_CERT, default=True): cv.boolean,
                cv.Optional(CONF_DISABLE_MBEDTLS_PKCS7, default=True): cv.boolean,
-                cv.Optional(CONF_DISABLE_MBEDTLS_TLS, default=True): cv.boolean,
                cv.Optional(CONF_DISABLE_MBEDTLS_TLS_SERVER, default=True): cv.boolean,
                cv.Optional(CONF_DISABLE_MBEDTLS_TLS_EXTRAS, default=True): cv.boolean,
                cv.Optional(CONF_DISABLE_REGI2C_IN_IRAM, default=True): cv.boolean,
@@ -2592,103 +2499,34 @@ MBEDTLS_TLS_ROLE_OPTIONS = (
 )


-# User sdkconfig_options that mean "keep TLS on" when set to y. The
-# OpenThread entries compile its DTLS secure transport in, which links
-# mbedtls_ssl_*.
-_MBEDTLS_TLS_ON_OPTIONS = (
-    "CONFIG_MBEDTLS_TLS_ENABLED",
-    "CONFIG_MBEDTLS_TLS_SERVER_AND_CLIENT",
-    "CONFIG_MBEDTLS_TLS_SERVER_ONLY",
-    "CONFIG_MBEDTLS_TLS_CLIENT_ONLY",
-    "CONFIG_OPENTHREAD_COMMISSIONER",
-    "CONFIG_OPENTHREAD_JOINER",
-    "CONFIG_OPENTHREAD_BORDER_AGENT_ENABLE",
-    # Border router defaults the border agent (and its DTLS) on.
-    "CONFIG_OPENTHREAD_BORDER_ROUTER",
-    # Enterprise WiFi selects TLS back on (see the TLS-off block).
-    "CONFIG_ESP_WIFI_ENTERPRISE_SUPPORT",
-)
-# Any user option under these prefixes only makes sense with TLS compiled in.
-_TLS_OPTION_PREFIXES = ("CONFIG_ESP_TLS_", "CONFIG_MBEDTLS_SSL_", "CONFIG_ESP_HTTPS_")
-
-
-def _user_sdkconfig_wants_tls(options: dict[str, Any]) -> bool:
-    """True when sdkconfig_options turn TLS on or tune something under it; an `n` is never a request."""
-    return any(
-        (name in _MBEDTLS_TLS_ON_OPTIONS and value == "y")
-        or (name == "CONFIG_MBEDTLS_TLS_DISABLED" and value == "n")
-        or (name.startswith(_TLS_OPTION_PREFIXES) and value != "n")
-        for name, value in options.items()
-    )
-
-
@coroutine_with_priority(CoroPriority.FINAL)
-async def _reconcile_mbedtls_sdkconfig() -> None:
-    """Reconcile the mbedTLS sdkconfig flags after every request_tls() / require_mbedtls_*() call.
+async def _reconcile_mbedtls_tls_sdkconfig(
+    disable_tls_server: bool, disable_tls_extras: bool
+) -> None:
+    """Trim mbedTLS to what a TLS client needs unless a component asked otherwise.

-    mbedtls cannot be excluded from an IDF build (bootloader_support needs its
-    SHA-256), but with no TLS user the ssl_*.c sources and the TLS-only crypto
-    compile to empty objects. When TLS stays in, it is trimmed to the client
-    role and the legacy handshake extras are dropped. User sdkconfig_options
-    win; a user-chosen TLS role leaves the whole choice alone.
+    Runs at FINAL priority so every require_mbedtls_tls_server() and
+    require_mbedtls_tls_extras() call has happened. Only the server-side
+    handshake (~7 KB) is a separate option; nothing in ESPHome accepts TLS
+    connections, but OpenThread's DTLS commissioner does. A user-supplied
+    sdkconfig_options value always wins; for the TLS role choice, any member
+    the user set leaves the whole choice alone so the pair cannot conflict.
    """
-    data = _mbedtls_sdkconfig()
-    idf6 = idf_version() >= cv.Version(6, 0, 0)
-    opts = CORE.data[KEY_ESP32][KEY_SDKCONFIG_OPTIONS]
-
-    if _mbedtls_tls_compiled_out():
-        # IDF 6 made CONFIG_MBEDTLS_TLS_ENABLED a normal bool; on IDF 5 it has
-        # no prompt and is only reachable through the "None" TLS role choice.
-        if idf6:
-            set_idf_sdkconfig_default("CONFIG_MBEDTLS_TLS_ENABLED", False)
-        else:
-            set_idf_sdkconfig_default("CONFIG_MBEDTLS_TLS_DISABLED", True)
-        # Enterprise WiFi selects TLS back on; wifi writes this itself, but
-        # esp_wifi can also be in the build without a wifi: block (openthread).
-        set_idf_sdkconfig_default("CONFIG_ESP_WIFI_ENTERPRISE_SUPPORT", False)
-        # WiFi (ESP_WIFI_MBEDTLS_CRYPTO) and Bluetooth deliberately stay on
-        # the select-wins path: an unconditional request from request_wifi()
-        # would defeat the ECP trim for users who disable that select.
-        if not data.ecp_required:
-            set_idf_sdkconfig_default("CONFIG_MBEDTLS_ECP_C", False)
-        set_idf_sdkconfig_default("CONFIG_MBEDTLS_PEM_WRITE_C", False)
-        set_idf_sdkconfig_default("CONFIG_MBEDTLS_X509_CRL_PARSE_C", False)
-        set_idf_sdkconfig_default("CONFIG_MBEDTLS_X509_CSR_PARSE_C", False)
-    elif (
-        # TLS stays in: trim it to the client role unless a component accepts
-        # TLS connections or the user already chose a role.
-        data.disable_tls_server
-        and not data.tls_server_required
-        and not any(option in opts for option in MBEDTLS_TLS_ROLE_OPTIONS)
+    data = CORE.data[KEY_ESP32]
+    sdkconfig = data[KEY_SDKCONFIG_OPTIONS]
+    if (
+        disable_tls_server
+        and not data.get(KEY_MBEDTLS_TLS_SERVER_REQUIRED, False)
+        and not any(option in sdkconfig for option in MBEDTLS_TLS_ROLE_OPTIONS)
    ):
        add_idf_sdkconfig_option("CONFIG_MBEDTLS_TLS_CLIENT_ONLY", True)
        add_idf_sdkconfig_option("CONFIG_MBEDTLS_TLS_SERVER_AND_CLIENT", False)
-
-    # The extras run either way: CCM and deterministic ECDSA are plain
-    # crypto, not TLS-gated, so they matter even with TLS compiled out.
-    if data.disable_tls_extras:
+    if disable_tls_extras:
+        required = data.get(KEY_MBEDTLS_TLS_EXTRAS_REQUIRED, set())
        for option in MBEDTLS_TLS_EXTRA_OPTIONS:
-            if option not in data.tls_extras_required:
+            if option not in required:
                set_idf_sdkconfig_default(option, False)

-    # Keeping the peer certificate costs ~4KB heap per connection.
-    if data.peer_cert_required:
-        set_idf_sdkconfig_default("CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE", True)
-    elif data.disable_peer_cert:
-        set_idf_sdkconfig_default("CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE", False)
-
-    if data.pkcs7_required:
-        set_idf_sdkconfig_default("CONFIG_MBEDTLS_PKCS7_C", True)
-    elif data.disable_pkcs7:
-        set_idf_sdkconfig_default("CONFIG_MBEDTLS_PKCS7_C", False)
-
-    # SHA-384 shares the SHA-512 compression function, so both go together.
-    # Only IDF 6.0's PSA engine links a ~3KB software fallback for them; on
-    # IDF 5 they are a single hardware-only option with no code size cost.
-    if idf6 and not data.sha512_required:
-        set_idf_sdkconfig_default("CONFIG_MBEDTLS_SHA384_C", False)
-        set_idf_sdkconfig_default("CONFIG_MBEDTLS_SHA512_C", False)
-

@coroutine_with_priority(CoroPriority.FINAL)
 async def _reconcile_network_sdkconfig() -> None:
@@ -3035,8 +2873,6 @@ async def to_code(config):
            "CONFIG_ESP32P4_SELECTS_REV_LESS_V3",
            config.get(CONF_ENGINEERING_SAMPLE, False),
        )
-        # Work around ESP-IDF bug: see https://github.com/espressif/esp-idf/issues/19020
-        add_idf_sdkconfig_option("CONFIG_ESP_MAIN_TASK_STACK_SIZE", 8192)

    # ESP32-C2 defaults to the ROM's newlib "nano" printf, which does not
    # understand %zu or %lld and crashes on any %s that follows one.
@@ -3311,10 +3147,6 @@ async def to_code(config):

        for key, flag in SIGNING_SCHEMES.items():
            add_idf_sdkconfig_option(flag, scheme == key)
-        if scheme in (SIGNING_SCHEME_ECDSA256, SIGNING_SCHEME_ECDSA_V1):
-            # SECURE_SIGNED_APPS selects ECP in Kconfig anyway; requesting it
-            # keeps the resolved sdkconfig consistent with what ESPHome wrote.
-            require_mbedtls_ecp()

        if CONF_SIGNING_KEY in signed_ota:
            # Private key mode — auto-sign binaries during build
@@ -3385,6 +3217,38 @@ async def to_code(config):
    if advanced[CONF_DISABLE_DEV_NULL_VFS]:
        add_idf_sdkconfig_option("CONFIG_VFS_INITIALIZE_DEV_NULL", False)

+    # Disable keeping peer certificate after TLS handshake
+    # Saves ~4KB heap per connection, but prevents certificate inspection after handshake
+    # Components that need it can call require_mbedtls_peer_cert()
+    if CORE.data[KEY_ESP32].get(KEY_MBEDTLS_PEER_CERT_REQUIRED, False):
+        add_idf_sdkconfig_option("CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE", True)
+    elif advanced[CONF_DISABLE_MBEDTLS_PEER_CERT]:
+        add_idf_sdkconfig_option("CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE", False)
+
+    # Disable PKCS#7 support in mbedTLS
+    # Only needed for specific certificate validation scenarios
+    # Components that need it can call require_mbedtls_pkcs7()
+    if CORE.data[KEY_ESP32].get(KEY_MBEDTLS_PKCS7_REQUIRED, False):
+        # Component called require_mbedtls_pkcs7() - enable regardless of user setting
+        add_idf_sdkconfig_option("CONFIG_MBEDTLS_PKCS7_C", True)
+    elif advanced[CONF_DISABLE_MBEDTLS_PKCS7]:
+        add_idf_sdkconfig_option("CONFIG_MBEDTLS_PKCS7_C", False)
+
+    # Disable SHA-384 and SHA-512 in mbedTLS
+    # ESPHome doesn't use either algorithm. SHA-384 shares the same
+    # compression function as SHA-512 (mbedtls_internal_sha512_process),
+    # so both must be disabled to eliminate the ~3KB software fallback
+    # that IDF 6.0's PSA parallel engine always links in.
+    # On IDF < 6.0 these are a single config and hardware-only (no
+    # software fallback), so there was no code size cost to leaving
+    # them enabled.
+    # Components that need SHA-384/SHA-512 can call require_mbedtls_sha512()
+    if idf_version() >= cv.Version(6, 0, 0) and not CORE.data[KEY_ESP32].get(
+        KEY_MBEDTLS_SHA512_REQUIRED, False
+    ):
+        add_idf_sdkconfig_option("CONFIG_MBEDTLS_SHA384_C", False)
+        add_idf_sdkconfig_option("CONFIG_MBEDTLS_SHA512_C", False)
+
    # FINAL priority: runs after every require_libc_picolibc_newlib_compat() call
    CORE.add_job(_set_libc_picolibc_newlib_compat)

@@ -3394,14 +3258,12 @@ async def to_code(config):
    # FINAL priority: runs after every require_certificate_bundle() call
    CORE.add_job(_reconcile_certificate_bundle_sdkconfig)

-    # FINAL priority: runs after every request_tls() / require_mbedtls_*() call
-    mbedtls = _mbedtls_sdkconfig()
-    mbedtls.disable_tls = advanced[CONF_DISABLE_MBEDTLS_TLS]
-    mbedtls.disable_tls_server = advanced[CONF_DISABLE_MBEDTLS_TLS_SERVER]
-    mbedtls.disable_tls_extras = advanced[CONF_DISABLE_MBEDTLS_TLS_EXTRAS]
-    mbedtls.disable_peer_cert = advanced[CONF_DISABLE_MBEDTLS_PEER_CERT]
-    mbedtls.disable_pkcs7 = advanced[CONF_DISABLE_MBEDTLS_PKCS7]
-    CORE.add_job(_reconcile_mbedtls_sdkconfig)
+    # FINAL priority: runs after every require_mbedtls_tls_*() call
+    CORE.add_job(
+        _reconcile_mbedtls_tls_sdkconfig,
+        advanced[CONF_DISABLE_MBEDTLS_TLS_SERVER],
+        advanced[CONF_DISABLE_MBEDTLS_TLS_EXTRAS],
+    )

    # FINAL: require_*() calls can come from to_code at or below this priority, so an
    # inline read would be iteration-order-dependent; reconcile once after every job ran.
@@ -3434,8 +3296,6 @@ async def to_code(config):
    # so it still gets the CMN variant pinned.
    if conf[CONF_SDKCONFIG_OPTIONS].get("CONFIG_MBEDTLS_CERTIFICATE_BUNDLE") == "y":
        require_certificate_bundle()
-    if _user_sdkconfig_wants_tls(conf[CONF_SDKCONFIG_OPTIONS]):
-        request_tls()

    # Components from YAML are added in a separate coroutine with FINAL priority
    # Schedule it to run after all other components
@@ -3677,30 +3537,6 @@ def _write_idf_component_yml():
    yml_path = CORE.relative_build_path("src/idf_component.yml")
    dependencies: dict[str, dict] = {}

-    converted: list[IDFComponent] = []
-    if CORE.using_toolchain_esp_idf:
-        # Convert the PlatformIO libraries to ESP-IDF components as a batch so
-        # PlatformIO resolves the whole dependency tree at once -- deduplicating
-        # shared transitive deps (e.g. esphome/libsodium pulled by both noise-c
-        # and esp_wireguard) to a single version instead of clashing
-        # override_path entries.
-        libraries = [
-            library
-            for name, library in CORE.platformio_libraries.items()
-            # Don't process arduino libraries
-            if name not in ARDUINO_DISABLED_LIBRARIES
-        ]
-        # A library also declared as a managed component is not converted too, or
-        # IDF sees the same requirement twice; converted components reach it through
-        # ${ESPHOME_PROJECT_MANAGED_COMPONENTS}.
-        managed = set(CORE.data[KEY_ESP32].get(KEY_COMPONENTS, {}))
-        converted = generate_idf_components(libraries, managed=managed)
-    # IDF names a component after its directory and a later registration of the
-    # same name replaces the earlier one, so a stub beside a converted library of
-    # the same name (espressif/libsodium vs esphome/libsodium) would win or lose
-    # on path order. Such a stub points at the converted library instead.
-    converted_by_name = {component.path.name: component for component in converted}
-
    # For Arduino builds, override unused managed components from the Arduino framework
    # by pointing them to empty stub directories using override_path
    # This prevents the IDF component manager from downloading the real components
@@ -3724,17 +3560,8 @@ def _write_idf_component_yml():
        # always writes, and ninja keeps triggering CMake re-runs on
        # otherwise-cached rebuilds.
        for component_name in sorted(components_to_stub):
-            stub_name = _idf_component_stub_name(component_name)
-            stub_path = stubs_dir / stub_name
-            if (component := converted_by_name.get(stub_name)) is not None:
-                if stub_path.exists():
-                    rmtree(stub_path)
-                dependencies[_idf_component_dep_name(component_name)] = {
-                    "version": "*",
-                    "override_path": str(component.path),
-                }
-                continue
            # Create stub directory with minimal CMakeLists.txt
+            stub_path = stubs_dir / _idf_component_stub_name(component_name)
            stub_path.mkdir(exist_ok=True)
            stub_cmake = stub_path / "CMakeLists.txt"
            if not stub_cmake.exists():
@@ -3776,10 +3603,26 @@ def _write_idf_component_yml():
                ref=str(CORE.data[KEY_CORE][KEY_FRAMEWORK_VERSION]),
            )

-    for component in converted:
-        dependencies[component.get_sanitized_name()] = {
-            "override_path": str(component.path)
-        }
+    if CORE.using_toolchain_esp_idf:
+        # Convert the PlatformIO libraries to ESP-IDF components as a batch so
+        # PlatformIO resolves the whole dependency tree at once -- deduplicating
+        # shared transitive deps (e.g. esphome/libsodium pulled by both noise-c
+        # and esp_wireguard) to a single version instead of clashing
+        # override_path entries.
+        libraries = [
+            library
+            for name, library in CORE.platformio_libraries.items()
+            # Don't process arduino libraries
+            if name not in ARDUINO_DISABLED_LIBRARIES
+        ]
+        # A library also declared as a managed component is not converted too, or
+        # IDF sees the same requirement twice; converted components reach it through
+        # ${ESPHOME_PROJECT_MANAGED_COMPONENTS}.
+        managed = set(CORE.data[KEY_ESP32].get(KEY_COMPONENTS, {}))
+        for component in generate_idf_components(libraries, managed=managed):
+            dependencies[component.get_sanitized_name()] = {
+                "override_path": str(component.path)
+            }

    if CORE.data[KEY_ESP32][KEY_COMPONENTS]:
        components: dict = CORE.data[KEY_ESP32][KEY_COMPONENTS]
@@ -23,7 +23,6 @@ KEY_EXTRA_BUILD_FILES = "extra_build_files"
 KEY_CERT_BUNDLE = "cert_bundle"
 KEY_FULL_CERT_BUNDLE = "full_cert_bundle"
 KEY_NETWORK_SDKCONFIG = "network_sdkconfig"
-KEY_MBEDTLS_SDKCONFIG = "mbedtls_sdkconfig"

 VARIANT_ESP32 = "ESP32"
 VARIANT_ESP32C2 = "ESP32C2"
@@ -17,7 +17,8 @@ extern "C" __attribute__((weak)) void initArduino() {}
 namespace esphome {

 // HAL functions live in hal.cpp. This file keeps only the loop task setup.
-static StaticTask_t loop_task_tcb;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
+TaskHandle_t loop_task_handle = nullptr;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
+static StaticTask_t loop_task_tcb;        // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
 static StackType_t
    loop_task_stack[ESPHOME_LOOP_TASK_STACK_SIZE];  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)

@@ -39,10 +40,11 @@ extern "C" void app_main() {
  initArduino();
  esp32::setup_preferences();
 #if CONFIG_FREERTOS_UNICORE
-  xTaskCreateStatic(loop_task, "loopTask", ESPHOME_LOOP_TASK_STACK_SIZE, nullptr, 1, loop_task_stack, &loop_task_tcb);
+  loop_task_handle = xTaskCreateStatic(loop_task, "loopTask", ESPHOME_LOOP_TASK_STACK_SIZE, nullptr, 1, loop_task_stack,
+                                       &loop_task_tcb);
 #else
-  xTaskCreateStaticPinnedToCore(loop_task, "loopTask", ESPHOME_LOOP_TASK_STACK_SIZE, nullptr, 1, loop_task_stack,
-                                &loop_task_tcb, 1);
+  loop_task_handle = xTaskCreateStaticPinnedToCore(loop_task, "loopTask", ESPHOME_LOOP_TASK_STACK_SIZE, nullptr, 1,
+                                                   loop_task_stack, &loop_task_tcb, 1);
 #endif
 }

@@ -235,14 +235,14 @@ class ESP32BLE final : public Component {
 #ifdef USE_ESP32_BLE_ADVERTISING
  BLEAdvertising *advertising_{};  // 4 bytes (pointer)
 #endif
-  const char *name_{nullptr};          // 4 bytes (pointer to string literal in flash)
-  uint32_t advertising_cycle_time_{};  // 4 bytes
+  const char *name_{nullptr};                 // 4 bytes (pointer to string literal in flash)
+  esp_ble_io_cap_t io_cap_{ESP_IO_CAP_NONE};  // 4 bytes (enum)
+  uint32_t advertising_cycle_time_{};         // 4 bytes

  // 2-byte aligned members
  uint16_t appearance_{0};  // 2 bytes

  // 1-byte aligned members (grouped together to minimize padding)
-  esp_ble_io_cap_t io_cap_{ESP_IO_CAP_NONE};          // 1 byte (uint8_t typedef)
  BLEComponentState state_{BLE_COMPONENT_STATE_OFF};  // 1 byte (uint8_t enum)
  bool enable_on_boot_{};                             // 1 byte
 #ifdef USE_ESP32_BLE_ADVERTISING
@@ -8,10 +8,6 @@ from esphome import automation
 import esphome.codegen as cg
 from esphome.components import ble_device_base, esp32_ble, ota
 from esphome.components.ble_device_base import CONF_CONNECTION_SCAN_WINDOW
-from esphome.components.ble_device_base.automation import (
-    MAC_FILTER_LIST,
-    mac_filter_table,
-)
 from esphome.components.const import CONF_ON_SCAN_END, CONF_SCAN_PARAMETERS, CONF_WINDOW
 from esphome.components.esp32 import (
    add_idf_sdkconfig_option,
@@ -281,7 +277,7 @@ CONFIG_SCHEMA = cv.All(
                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
                        ESPBTAdvertiseTrigger
                    ),
-                    cv.Optional(CONF_MAC_ADDRESS): MAC_FILTER_LIST,
+                    cv.Optional(CONF_MAC_ADDRESS): cv.ensure_list(cv.mac_address),
                }
            ),
            cv.Optional(
@@ -385,8 +381,9 @@ async def to_code(config: ConfigType) -> None:
    for conf in config.get(CONF_ON_BLE_ADVERTISE, []):
        _request_listener_slot()
        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
-        if macs := conf.get(CONF_MAC_ADDRESS):
-            cg.add(trigger.set_addresses(mac_filter_table(macs)))
+        if CONF_MAC_ADDRESS in conf:
+            addr_list = [it.as_hex for it in conf[CONF_MAC_ADDRESS]]
+            cg.add(trigger.set_addresses(addr_list))
        await automation.build_automation(trigger, [(ESPBTDeviceConstRef, "x")], conf)
    for conf in config.get(CONF_ON_BLE_SERVICE_DATA_ADVERTISE, []):
        _request_listener_slot()
@@ -1,9 +1,10 @@
 #pragma once

 #include "esphome/core/automation.h"
-#include "esphome/components/ble_device_base/automation.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"

+#include <vector>
+
 #ifdef USE_ESP32

 namespace esphome::esp32_ble_tracker {
@@ -11,18 +12,22 @@ namespace esphome::esp32_ble_tracker {
 class ESPBTAdvertiseTrigger final : public Trigger<const ESPBTDevice &>, public ESPBTDeviceListener {
 public:
  explicit ESPBTAdvertiseTrigger(ESP32BLETracker *parent) { parent->register_listener(this); }
-  /// Table of MACs ended by 0; must outlive the trigger.
-  void set_addresses(const uint64_t *addresses) { this->addresses_ = addresses; }
+  void set_addresses(std::initializer_list<uint64_t> addresses) { this->address_vec_ = addresses; }

  bool parse_device(const ESPBTDevice &device) override {
-    if (this->addresses_ != nullptr && !ble_device_base::mac_in_table(this->addresses_, device.address_uint64()))
-      return false;
+    uint64_t u64_addr = device.address_uint64();
+    if (!address_vec_.empty()) {
+      if (std::find(address_vec_.begin(), address_vec_.end(), u64_addr) == address_vec_.end()) {
+        return false;
+      }
+    }
+
    this->trigger(device);
    return true;
  }

 protected:
-  const uint64_t *addresses_{nullptr};
+  std::vector<uint64_t> address_vec_;
 };

 class BLEServiceDataAdvertiseTrigger final : public Trigger<const adv_data_t &>, public ESPBTDeviceListener {
@@ -1,185 +0,0 @@
-from ipaddress import IPv4Address
-
-import esphome.codegen as cg
-from esphome.components import esp32, wifi
-from esphome.components.esp32.const import (
-    VARIANT_ESP32,
-    VARIANT_ESP32C3,
-    VARIANT_ESP32C5,
-    VARIANT_ESP32C6,
-    VARIANT_ESP32S2,
-    VARIANT_ESP32S3,
-)
-import esphome.config_validation as cv
-from esphome.const import CONF_ID, CONF_WIFI
-from esphome.core import CORE
-from esphome.types import ConfigType
-
-DOMAIN = "espectre"
-CODEOWNERS = ["@francescopace"]
-DEPENDENCIES = ["esp32", "wifi"]
-
-CONF_ESPECTRE_ID = "espectre_id"
-CONF_DETECTION_ALGORITHM = "detection_algorithm"
-CONF_CSI_CAPTURE_PROFILE = "csi_capture_profile"
-CONF_TRAFFIC_GENERATOR_MODE = "traffic_generator_mode"
-CONF_TRAFFIC_GENERATOR_TARGET_IP = "traffic_generator_target_ip"
-CONF_CSI_TRAFFIC_MULTICAST_GROUP = "csi_traffic_multicast_group"
-CONF_MOTION_ON_HITS = "motion_on_hits"
-CONF_MOTION_OFF_HITS = "motion_off_hits"
-
-# Fully qualified: a bare espectre:: in main.cpp would clash with the SDK namespace.
-espectre_ns = cg.global_ns.namespace("esphome").namespace("espectre")
-ESPectreComponent = espectre_ns.class_("ESPectreComponent", cg.Component)
-sdk_ns = cg.global_ns.namespace("::espectre")
-DetectionAlgorithm = sdk_ns.enum("DetectionAlgorithm", is_class=True)
-CsiCapturePolicy = sdk_ns.enum("CsiCapturePolicy", is_class=True)
-TrafficGeneratorMode = sdk_ns.enum("TrafficGeneratorMode", is_class=True)
-WifiBandPolicy = sdk_ns.enum("WifiBandPolicy", is_class=True)
-
-DETECTION_ALGORITHMS = {
-    "lightweight": DetectionAlgorithm.LIGHTWEIGHT,
-    "high_accuracy": DetectionAlgorithm.HIGH_ACCURACY,
-}
-CSI_CAPTURE_PROFILES = {
-    "auto": CsiCapturePolicy.AUTO,
-    "lltf": CsiCapturePolicy.LLTF,
-    "ht_vht": CsiCapturePolicy.HT_VHT,
-}
-TRAFFIC_GENERATOR_MODES = {
-    "ping": TrafficGeneratorMode.PING,
-    "dns": TrafficGeneratorMode.DNS,
-    "dns_tcp": TrafficGeneratorMode.DNS_TCP,
-    "wifi_raw": TrafficGeneratorMode.WIFI_RAW,
-    "external": TrafficGeneratorMode.EXTERNAL_HOST,
-}
-
-
-def validate_target_ip(value: str) -> str:
-    value = str(cv.ipv4address(value))
-    first_octet = int(IPv4Address(value)) >> 24
-    if first_octet in (0, 127) or first_octet >= 224 or value == "255.255.255.255":
-        raise cv.Invalid("ESPectre traffic target must be a unicast IPv4 address")
-    return value
-
-
-def validate_multicast_group(value: str) -> str:
-    """An IPv4 multicast group, or an empty string to skip joining one."""
-    if not (value := cv.string_strict(value).strip()):
-        return value
-    value = str(cv.ipv4address(value))
-    if not IPv4Address(value).is_multicast:
-        raise cv.Invalid("ESPectre multicast group must be an IPv4 multicast address")
-    return value
-
-
-def supported_traffic_generator_modes(config: ConfigType) -> list[str]:
-    """Traffic generator modes available with this chip and CSI capture profile."""
-    wifi_raw = (
-        esp32.get_esp32_variant() != VARIANT_ESP32C6
-        and config[CONF_CSI_CAPTURE_PROFILE] != "ht_vht"
-    )
-    return [mode for mode in TRAFFIC_GENERATOR_MODES if wifi_raw or mode != "wifi_raw"]
-
-
-def validate_config(config: ConfigType) -> ConfigType:
-    mode = config[CONF_TRAFFIC_GENERATOR_MODE]
-    if mode not in supported_traffic_generator_modes(config):
-        raise cv.Invalid(
-            "wifi_raw traffic is not supported on ESP32-C6 "
-            "or with the ht_vht CSI capture profile"
-        )
-    if mode in ("wifi_raw", "external") and CONF_TRAFFIC_GENERATOR_TARGET_IP in config:
-        raise cv.Invalid(f"{mode} traffic does not use a target IP address")
-    if mode != "external" and CONF_CSI_TRAFFIC_MULTICAST_GROUP in config:
-        raise cv.Invalid(
-            f"{CONF_CSI_TRAFFIC_MULTICAST_GROUP} requires "
-            f"{CONF_TRAFFIC_GENERATOR_MODE}: external"
-        )
-    return config
-
-
-CONFIG_SCHEMA = cv.All(
-    cv.Schema(
-        {
-            cv.GenerateID(): cv.declare_id(ESPectreComponent),
-            cv.Optional(CONF_DETECTION_ALGORITHM, default="lightweight"): cv.enum(
-                DETECTION_ALGORITHMS, lower=True
-            ),
-            cv.Optional(CONF_CSI_CAPTURE_PROFILE, default="auto"): cv.enum(
-                CSI_CAPTURE_PROFILES, lower=True
-            ),
-            cv.Optional(CONF_TRAFFIC_GENERATOR_MODE, default="ping"): cv.enum(
-                TRAFFIC_GENERATOR_MODES, lower=True
-            ),
-            cv.Optional(CONF_TRAFFIC_GENERATOR_TARGET_IP): validate_target_ip,
-            cv.Optional(CONF_CSI_TRAFFIC_MULTICAST_GROUP): validate_multicast_group,
-            cv.Optional(CONF_MOTION_ON_HITS): cv.int_range(min=1, max=20),
-            cv.Optional(CONF_MOTION_OFF_HITS): cv.int_range(min=1, max=20),
-        }
-    ).extend(cv.COMPONENT_SCHEMA),
-    esp32.only_on_variant(
-        supported=[
-            VARIANT_ESP32,
-            VARIANT_ESP32S2,
-            VARIANT_ESP32S3,
-            VARIANT_ESP32C3,
-            VARIANT_ESP32C5,
-            VARIANT_ESP32C6,
-        ],
-        msg_prefix="ESPectre",
-    ),
-    # Arduino 3.3.7 is the first release built on ESP-IDF 5.5.3.
-    cv.require_framework_version(
-        esp_idf=cv.Version(5, 5, 3), esp32_arduino=cv.Version(3, 3, 7)
-    ),
-    validate_config,
-)
-
-
-def final_validate(config: ConfigType) -> None:
-    wifi.force_power_save_off(
-        "ESPectre needs the radio awake to receive a steady flow of CSI packets"
-    )
-
-
-FINAL_VALIDATE_SCHEMA = final_validate
-
-
-async def to_code(config: ConfigType) -> None:
-    var = cg.new_Pvariable(config[CONF_ID])
-    await cg.register_component(var, config)
-    cg.add_define("USE_ESPECTRE")
-    cg.add(var.set_detection_algorithm(config[CONF_DETECTION_ALGORITHM]))
-    cg.add(var.set_csi_capture_profile(config[CONF_CSI_CAPTURE_PROFILE]))
-    cg.add(var.set_traffic_generator_mode(config[CONF_TRAFFIC_GENERATOR_MODE]))
-    if (target_ip := config.get(CONF_TRAFFIC_GENERATOR_TARGET_IP)) is not None:
-        cg.add(var.set_traffic_generator_target_ip(target_ip))
-    if (group := config.get(CONF_CSI_TRAFFIC_MULTICAST_GROUP)) is not None:
-        cg.add(var.set_csi_traffic_multicast_group(group))
-    if (on_hits := config.get(CONF_MOTION_ON_HITS)) is not None:
-        cg.add(var.set_motion_on_hits(on_hits))
-    if (off_hits := config.get(CONF_MOTION_OFF_HITS)) is not None:
-        cg.add(var.set_motion_off_hits(off_hits))
-    if esp32.get_esp32_variant() == VARIANT_ESP32C5:
-        band = CORE.config[CONF_WIFI].get(wifi.CONF_BAND_MODE, "AUTO")
-        cg.add(
-            var.set_wifi_band_policy(
-                {
-                    "2.4GHZ": WifiBandPolicy.BAND_2G,
-                    "5GHZ": WifiBandPolicy.BAND_5G,
-                    "AUTO": WifiBandPolicy.AUTO,
-                }[band]
-            )
-        )
-
-    wifi.enable_runtime_roaming_suppression()
-    esp32.add_idf_component(name="francescopace/espectre", ref="3.0.0")
-    esp32.add_idf_sdkconfig_option("CONFIG_ESP_WIFI_CSI_ENABLED", True)
-    # CSI is reported once per received transmission, so aggregation hides frames from sensing.
-    # Disabling TX aggregation also lets the SDK fix the station TX rate (6.5 Mbps on ESP32).
-    # Both may lower Wi-Fi throughput for the whole firmware.
-    esp32.add_idf_sdkconfig_option("CONFIG_ESP_WIFI_AMPDU_TX_ENABLED", False)
-    esp32.add_idf_sdkconfig_option("CONFIG_ESP_WIFI_AMPDU_RX_ENABLED", False)
-    # Keep the radio awake while disconnected too, matching force_power_save_off().
-    esp32.add_idf_sdkconfig_option("CONFIG_ESP_WIFI_STA_DISCONNECTED_PM_ENABLE", False)
@@ -1,32 +0,0 @@
-import esphome.codegen as cg
-from esphome.components import binary_sensor
-import esphome.config_validation as cv
-from esphome.const import CONF_MOTION, DEVICE_CLASS_MOTION, ENTITY_CATEGORY_DIAGNOSTIC
-from esphome.types import ConfigType
-
-from . import CONF_ESPECTRE_ID, ESPectreComponent
-
-DEPENDENCIES = ["espectre"]
-CONF_CALIBRATING = "calibrating"
-
-CONFIG_SCHEMA = cv.All(
-    cv.Schema(
-        {
-            cv.GenerateID(CONF_ESPECTRE_ID): cv.use_id(ESPectreComponent),
-            cv.Optional(CONF_MOTION): binary_sensor.binary_sensor_schema(
-                device_class=DEVICE_CLASS_MOTION
-            ),
-            cv.Optional(CONF_CALIBRATING): binary_sensor.binary_sensor_schema(
-                entity_category=ENTITY_CATEGORY_DIAGNOSTIC
-            ),
-        }
-    ),
-    cv.has_at_least_one_key(CONF_MOTION, CONF_CALIBRATING),
-)
-
-
-async def to_code(config: ConfigType) -> None:
-    hub = await cg.get_variable(config[CONF_ESPECTRE_ID])
-    binary_sensors = binary_sensor.sub_binary_sensors(config)
-    await binary_sensors(CONF_MOTION, hub.set_motion_binary_sensor)
-    await binary_sensors(CONF_CALIBRATING, hub.set_calibrating_binary_sensor)
@@ -1,20 +0,0 @@
-import esphome.codegen as cg
-from esphome.components import button
-import esphome.config_validation as cv
-from esphome.const import ENTITY_CATEGORY_CONFIG
-from esphome.types import ConfigType
-
-from .. import CONF_ESPECTRE_ID, ESPectreComponent, espectre_ns
-
-DEPENDENCIES = ["espectre"]
-
-RecalibrateButton = espectre_ns.class_("RecalibrateButton", button.Button)
-
-CONFIG_SCHEMA = button.button_schema(
-    RecalibrateButton, entity_category=ENTITY_CATEGORY_CONFIG
-).extend({cv.GenerateID(CONF_ESPECTRE_ID): cv.use_id(ESPectreComponent)})
-
-
-async def to_code(config: ConfigType) -> None:
-    var = await button.new_button(config)
-    await cg.register_parented(var, config[CONF_ESPECTRE_ID])
@@ -1,19 +0,0 @@
-#pragma once
-
-#include "esphome/core/defines.h"
-
-#ifdef USE_ESPECTRE
-
-#include "esphome/components/button/button.h"
-#include "../espectre.h"
-
-namespace esphome::espectre {
-
-class RecalibrateButton final : public button::Button, public Parented<ESPectreComponent> {
- protected:
-  void press_action() override { this->parent_->recalibrate(); }
-};
-
-}  // namespace esphome::espectre
-
-#endif  // USE_ESPECTRE
@@ -1,305 +0,0 @@
-#include "espectre.h"
-
-#ifdef USE_ESPECTRE
-
-#include <cinttypes>
-#include <cmath>
-#include <cstring>
-#include "esphome/core/application.h"
-#include "esphome/core/log.h"
-#if defined(USE_ESP32) && defined(USE_WIFI_RUNTIME_ROAMING_SUPPRESSION)
-#include "esphome/components/wifi/wifi_component.h"
-#endif
-
-namespace esphome::espectre {
-
-static const char *const TAG = "espectre";
-
-struct TrafficModeOption {
-  const char *name;
-  ::espectre::TrafficGeneratorMode mode;
-};
-// Option names match the traffic_generator_mode YAML values.
-static constexpr TrafficModeOption TRAFFIC_MODE_OPTIONS[] = {
-    {"ping", ::espectre::TrafficGeneratorMode::PING},
-    {"dns", ::espectre::TrafficGeneratorMode::DNS},
-    {"dns_tcp", ::espectre::TrafficGeneratorMode::DNS_TCP},
-    {"wifi_raw", ::espectre::TrafficGeneratorMode::WIFI_RAW},
-    {"external", ::espectre::TrafficGeneratorMode::EXTERNAL_HOST},
-};
-
-static const char *traffic_mode_name(::espectre::TrafficGeneratorMode mode) {
-  for (const auto &option : TRAFFIC_MODE_OPTIONS) {
-    if (option.mode == mode)
-      return option.name;
-  }
-  return nullptr;
-}
-
-static const char *csi_capture_profile_name(::espectre::CsiCapturePolicy profile) {
-  switch (profile) {
-    case ::espectre::CsiCapturePolicy::LLTF:
-      return LOG_STR_LITERAL("lltf");
-    case ::espectre::CsiCapturePolicy::HT_VHT:
-      return LOG_STR_LITERAL("ht_vht");
-    default:
-      return LOG_STR_LITERAL("auto");
-  }
-}
-
-#ifdef USE_SELECT
-void ESPectreComponent::request_traffic_generator_mode(const char *name) {
-  for (const auto &option : TRAFFIC_MODE_OPTIONS) {
-    if (strcmp(option.name, name) == 0) {
-      this->pending_traffic_mode_ = option.mode;
-      return;
-    }
-  }
-}
-#endif
-
-static int log_level(::espectre::LogLevel level) {
-  switch (level) {
-    case ::espectre::LogLevel::ERROR:
-      return ESPHOME_LOG_LEVEL_ERROR;
-    case ::espectre::LogLevel::WARNING:
-      return ESPHOME_LOG_LEVEL_WARN;
-    case ::espectre::LogLevel::INFO:
-      return ESPHOME_LOG_LEVEL_INFO;
-    case ::espectre::LogLevel::DEBUG:
-      return ESPHOME_LOG_LEVEL_DEBUG;
-    default:
-      return ESPHOME_LOG_LEVEL_VERBOSE;
-  }
-}
-
-void ESPectreComponent::setup() {
-  // ESPHome owns scan results, including scans requested by the SDK's CSI recovery.
-  this->runtime_.config().wifi_scan_results_managed_externally = true;
-#ifdef USE_SELECT
-  this->restore_traffic_mode_();
-#endif
-  this->start_runtime_();
-}
-
-void ESPectreComponent::start_runtime_() {
-#if defined(USE_ESP32) && defined(USE_WIFI_RUNTIME_ROAMING_SUPPRESSION)
-  // A sensor stays in one place, and each roaming scan takes the radio off-channel for
-  // seconds, emptying the CSI window. Losing the access point still reconnects normally.
-  if (wifi::global_wifi_component != nullptr) {
-    wifi::global_wifi_component->request_roaming_suppression();
-    this->roaming_suppressed_ = true;
-  }
-#endif
-  ::espectre::set_log_sink({
-      .context = nullptr,
-      .enabled = [](void *, ::espectre::LogLevel level, const char *) { return log_level(level) <= ESPHOME_LOG_LEVEL; },
-      .write = [](void *, ::espectre::LogLevel level, const char *tag, int line, const char *format,
-                  va_list args) { esp_log_vprintf_(log_level(level), tag, line, format, args); },
-  });
-  if (!this->runtime_.setup(this)) {
-    ESP_LOGE(TAG, "Runtime setup failed");
-    this->stop_();
-    this->schedule_restart_();
-    return;
-  }
-  this->running_ = true;
-  this->status_clear_error();
-#ifdef USE_SELECT
-  this->publish_traffic_mode_();
-#endif
-}
-
-void ESPectreComponent::schedule_restart_() {
-  // A fault can be transient, such as a Wi-Fi stall, so retry instead of failing for good.
-  this->runtime_fault_ = false;
-  this->status_set_error(LOG_STR("Runtime stopped"));
-  ESP_LOGW(TAG, "Restarting the runtime in %" PRIu32 " s", RESTART_DELAY_MS / 1000);
-  this->restart_pending_ = true;
-  this->restart_requested_ms_ = App.get_loop_component_start_time();
-}
-
-#ifdef USE_SELECT
-void ESPectreComponent::restore_traffic_mode_() {
-  if (this->traffic_mode_select_ == nullptr)
-    return;
-  // Keyed by the YAML mode, so changing it in YAML discards a mode saved from the select.
-  const auto yaml_mode = this->runtime_.config().traffic_generator_mode;
-  this->traffic_mode_pref_ =
-      this->traffic_mode_select_->make_entity_preference<uint8_t>(static_cast<uint32_t>(yaml_mode) + 1);
-  uint8_t saved;
-  if (!this->traffic_mode_pref_.load(&saved))
-    return;
-  const auto mode = static_cast<::espectre::TrafficGeneratorMode>(saved);
-  const char *name = traffic_mode_name(mode);
-  if (name != nullptr && this->traffic_mode_select_->has_option(name))
-    this->runtime_.config().traffic_generator_mode = mode;
-}
-
-void ESPectreComponent::apply_pending_traffic_mode_() {
-  if (!this->pending_traffic_mode_.has_value())
-    return;
-  const auto mode = *this->pending_traffic_mode_;
-  this->pending_traffic_mode_.reset();
-  if (this->runtime_.set_traffic_generator_mode(mode)) {
-    const auto saved = static_cast<uint8_t>(mode);
-    this->traffic_mode_pref_.save(&saved);
-  } else {
-    ESP_LOGW(TAG, "Traffic generator mode %s was rejected", traffic_mode_name(mode));
-  }
-  this->publish_traffic_mode_();
-}
-
-void ESPectreComponent::publish_traffic_mode_() {
-  if (this->traffic_mode_select_ == nullptr)
-    return;
-  const char *name = traffic_mode_name(this->runtime_.config().traffic_generator_mode);
-  if (name != nullptr)
-    this->traffic_mode_select_->publish_state(name);
-}
-#endif
-
-void ESPectreComponent::loop() {
-  if (this->runtime_fault_) {
-    this->stop_();
-    this->schedule_restart_();
-    return;
-  }
-  if (!this->running_) {
-    // Without a backend this only reaps a traffic worker that outlived the last runtime.
-    this->runtime_.loop();
-    if (this->restart_pending_ &&
-        App.get_loop_component_start_time() - this->restart_requested_ms_ >= RESTART_DELAY_MS) {
-      this->restart_pending_ = false;
-      this->start_runtime_();
-    }
-    return;
-  }
-  if (this->recalibrate_pending_) {
-    this->recalibrate_pending_ = false;
-    if (!this->runtime_.trigger_recalibration()) {
-      ESP_LOGW(TAG, "Recalibration is not available");
-    }
-  }
-#ifdef USE_SELECT
-  this->apply_pending_traffic_mode_();
-#endif
-  this->runtime_.loop();
-  if (this->runtime_fault_)
-    return;
-
-  // Read once after the SDK finishes dispatching callbacks, including readiness changes.
-  const auto &snapshot = this->runtime_.snapshot();
-#ifdef USE_BINARY_SENSOR
-  if (this->calibrating_binary_sensor_ != nullptr &&
-      (!this->calibrating_published_ || this->calibrating_state_ != snapshot.calibrating)) {
-    this->calibrating_state_ = snapshot.calibrating;
-    this->calibrating_published_ = true;
-    this->calibrating_binary_sensor_->publish_state(snapshot.calibrating);
-  }
-#endif
-  if (!snapshot.ready_to_publish) {
-    if (this->ready_)
-      this->invalidate_sensing_();
-    this->movement_pending_ = false;
-    return;
-  }
-
-#ifdef USE_BINARY_SENSOR
-  const bool motion = snapshot.motion_state == ::espectre::MotionState::MOTION;
-  if (this->motion_binary_sensor_ != nullptr && (!this->ready_ || this->motion_state_ != motion)) {
-    this->motion_state_ = motion;
-    this->motion_binary_sensor_->publish_state(motion);
-  }
-#endif
-#ifdef USE_SENSOR
-  if (this->movement_sensor_ != nullptr && (this->movement_pending_ || !this->ready_))
-    this->movement_sensor_->publish_state(snapshot.movement_metric);
-#endif
-  this->movement_pending_ = false;
-  this->ready_ = true;
-}
-
-void ESPectreComponent::invalidate_sensing_() {
-#ifdef USE_BINARY_SENSOR
-  if (this->motion_binary_sensor_ != nullptr)
-    this->motion_binary_sensor_->invalidate_state();
-#endif
-#ifdef USE_SENSOR
-  if (this->movement_sensor_ != nullptr)
-    this->movement_sensor_->publish_state(NAN);
-#endif
-  this->ready_ = false;
-}
-
-void ESPectreComponent::on_calibration_finished(const ::espectre::RuntimeSnapshot &snapshot, bool success) {
-  if (success) {
-    this->calibrated_ = true;
-    this->status_clear_warning();
-    ESP_LOGI(TAG, "Calibration complete");
-    return;
-  }
-  // After a successful calibration, a failed one keeps that calibrated threshold.
-  if (!this->calibrated_)
-    this->status_set_warning(LOG_STR("Calibration failed"));
-  ESP_LOGW(TAG, "Calibration failed; retaining the previous threshold");
-}
-
-void ESPectreComponent::on_runtime_fault(const char *message) {
-  ESP_LOGE(TAG, "Runtime fault: %s", message);
-  this->runtime_fault_ = true;
-}
-
-void ESPectreComponent::stop_() {
-#if defined(USE_ESP32) && defined(USE_WIFI_RUNTIME_ROAMING_SUPPRESSION)
-  if (this->roaming_suppressed_ && wifi::global_wifi_component != nullptr) {
-    wifi::global_wifi_component->release_roaming_suppression();
-  }
-#endif
-  this->roaming_suppressed_ = false;
-  this->running_ = false;
-  // The next runtime starts from the default threshold and publishes its calibration again.
-  this->calibrated_ = false;
-  this->calibrating_published_ = false;
-  this->runtime_.shutdown();
-  ::espectre::clear_log_sink();
-  this->invalidate_sensing_();
-#ifdef USE_BINARY_SENSOR
-  if (this->calibrating_binary_sensor_ != nullptr)
-    this->calibrating_binary_sensor_->invalidate_state();
-#endif
-}
-
-void ESPectreComponent::on_shutdown() {
-  this->restart_pending_ = false;
-  this->stop_();
-}
-
-void ESPectreComponent::dump_config() {
-  const auto &config = this->runtime_.config();
-  ESP_LOGCONFIG(TAG,
-                "ESPectre:\n"
-                "  Detection algorithm: %s\n"
-                "  CSI capture profile: %s\n"
-                "  Traffic generator mode: %s\n"
-                "  Motion on/off hits: %u/%u",
-                config.detection_algorithm == ::espectre::DetectionAlgorithm::LIGHTWEIGHT
-                    ? LOG_STR_LITERAL("lightweight")
-                    : LOG_STR_LITERAL("high_accuracy"),
-                csi_capture_profile_name(config.csi_capture_policy), traffic_mode_name(config.traffic_generator_mode),
-                config.motion_on_hits, config.motion_off_hits);
-#ifdef USE_BINARY_SENSOR
-  LOG_BINARY_SENSOR("  ", "Motion", this->motion_binary_sensor_);
-  LOG_BINARY_SENSOR("  ", "Calibrating", this->calibrating_binary_sensor_);
-#endif
-#ifdef USE_SENSOR
-  LOG_SENSOR("  ", "Movement score", this->movement_sensor_);
-#endif
-#ifdef USE_SELECT
-  LOG_SELECT("  ", "Traffic generator mode", this->traffic_mode_select_);
-#endif
-}
-
-}  // namespace esphome::espectre
-
-#endif  // USE_ESPECTRE
@@ -1,110 +0,0 @@
-#pragma once
-
-#include "esphome/core/defines.h"
-
-#ifdef USE_ESPECTRE
-
-#include "esphome/core/component.h"
-#include "esphome/core/helpers.h"
-#include "esphome/core/optional.h"
-#include <espectre_sdk.h>
-#include <string>
-#ifdef USE_BINARY_SENSOR
-#include "esphome/components/binary_sensor/binary_sensor.h"
-#endif
-#ifdef USE_SELECT
-#include "esphome/components/select/select.h"
-#include "esphome/core/preferences.h"
-#endif
-#ifdef USE_SENSOR
-#include "esphome/components/sensor/sensor.h"
-#endif
-
-namespace esphome::espectre {
-
-class ESPectreComponent final : public Component, public ::espectre::IRuntimeListener {
- public:
-  void setup() override;
-  void loop() override;
-  void dump_config() override;
-  void on_shutdown() override;
-  // Register the SDK's Wi-Fi event handlers after network setup, before station startup.
-  float get_setup_priority() const override { return setup_priority::WIFI + 1.0f; }
-
-  void set_detection_algorithm(::espectre::DetectionAlgorithm value) {
-    this->runtime_.config().detection_algorithm = value;
-  }
-  void set_csi_capture_profile(::espectre::CsiCapturePolicy value) {
-    this->runtime_.config().csi_capture_policy = value;
-  }
-  void set_traffic_generator_mode(::espectre::TrafficGeneratorMode value) {
-    this->runtime_.config().traffic_generator_mode = value;
-  }
-  void set_traffic_generator_target_ip(const std::string &value) {
-    this->runtime_.config().traffic_generator_target_ip = value;
-  }
-  void set_csi_traffic_multicast_group(const std::string &value) {
-    this->runtime_.config().csi_traffic_multicast_group = value;
-  }
-  void set_motion_on_hits(uint8_t value) { this->runtime_.config().motion_on_hits = value; }
-  void set_motion_off_hits(uint8_t value) { this->runtime_.config().motion_off_hits = value; }
-  void set_wifi_band_policy(::espectre::WifiBandPolicy value) { this->runtime_.config().wifi_band_policy = value; }
-  // Queue controls so entity automations cannot re-enter the SDK from a listener callback.
-  void recalibrate() { this->recalibrate_pending_ = true; }
-#ifdef USE_SELECT
-  void set_traffic_mode_select(select::Select *value) { this->traffic_mode_select_ = value; }
-  void request_traffic_generator_mode(::espectre::TrafficGeneratorMode mode) { this->pending_traffic_mode_ = mode; }
-  /// Request a mode by its traffic_generator_mode YAML name; unknown names are ignored.
-  void request_traffic_generator_mode(const char *name);
-#endif
-
-#ifdef USE_BINARY_SENSOR
-  SUB_BINARY_SENSOR(motion)
-  SUB_BINARY_SENSOR(calibrating)
-#endif
-#ifdef USE_SENSOR
-  SUB_SENSOR(movement)
-#endif
-  /// Latest one-second runtime diagnostics sample, or nullptr before the runtime starts.
-  const ::espectre::RuntimeDiagnosticsSample *diagnostics_sample() const { return this->runtime_.diagnostics_sample(); }
-
- protected:
-  // Called once per SDK detector evaluation (every 250 ms), which bounds the movement publish rate.
-  void on_live_telemetry(const ::espectre::RuntimeSnapshot &snapshot) override { this->movement_pending_ = true; }
-  void on_calibration_finished(const ::espectre::RuntimeSnapshot &snapshot, bool success) override;
-  void on_runtime_fault(const char *message) override;
-  void start_runtime_();
-  void schedule_restart_();
-  void invalidate_sensing_();
-  void stop_();
-#ifdef USE_SELECT
-  void restore_traffic_mode_();
-  void apply_pending_traffic_mode_();
-  void publish_traffic_mode_();
-#endif
-
-  static constexpr uint32_t RESTART_DELAY_MS = 30000;
-
-  ::espectre::RuntimeFrontendController runtime_;
-  uint32_t restart_requested_ms_{0};
-#ifdef USE_SELECT
-  select::Select *traffic_mode_select_{nullptr};
-  ESPPreferenceObject traffic_mode_pref_;
-  optional<::espectre::TrafficGeneratorMode> pending_traffic_mode_;
-#endif
-  bool recalibrate_pending_{false};
-  bool movement_pending_{false};
-  bool ready_{false};
-  bool motion_state_{false};
-  bool calibrating_state_{false};
-  bool calibrating_published_{false};
-  bool runtime_fault_{false};
-  bool running_{false};
-  bool restart_pending_{false};
-  bool calibrated_{false};
-  bool roaming_suppressed_{false};
-};
-
-}  // namespace esphome::espectre
-
-#endif  // USE_ESPECTRE
@@ -1,32 +0,0 @@
-import esphome.codegen as cg
-from esphome.components import select
-import esphome.config_validation as cv
-from esphome.const import ENTITY_CATEGORY_CONFIG
-from esphome.core import CORE
-from esphome.types import ConfigType
-
-from .. import (
-    CONF_ESPECTRE_ID,
-    DOMAIN,
-    ESPectreComponent,
-    espectre_ns,
-    supported_traffic_generator_modes,
-)
-
-DEPENDENCIES = ["espectre"]
-
-TrafficModeSelect = espectre_ns.class_(
-    "TrafficModeSelect", select.Select, cg.Parented.template(ESPectreComponent)
-)
-
-CONFIG_SCHEMA = select.select_schema(
-    TrafficModeSelect, entity_category=ENTITY_CATEGORY_CONFIG
-).extend({cv.GenerateID(CONF_ESPECTRE_ID): cv.use_id(ESPectreComponent)})
-
-
-async def to_code(config: ConfigType) -> None:
-    options = supported_traffic_generator_modes(CORE.config[DOMAIN])
-    var = await select.new_select(config, options=options)
-    await cg.register_parented(var, config[CONF_ESPECTRE_ID])
-    parent = await cg.get_variable(config[CONF_ESPECTRE_ID])
-    cg.add(parent.set_traffic_mode_select(var))
@@ -1,11 +0,0 @@
-#include "espectre_select.h"
-
-#ifdef USE_ESPECTRE
-
-namespace esphome::espectre {
-
-void TrafficModeSelect::control(size_t index) { this->parent_->request_traffic_generator_mode(this->option_at(index)); }
-
-}  // namespace esphome::espectre
-
-#endif  // USE_ESPECTRE
@@ -1,19 +0,0 @@
-#pragma once
-
-#include "esphome/core/defines.h"
-
-#ifdef USE_ESPECTRE
-
-#include "esphome/components/select/select.h"
-#include "../espectre.h"
-
-namespace esphome::espectre {
-
-class TrafficModeSelect final : public select::Select, public Parented<ESPectreComponent> {
- protected:
-  void control(size_t index) override;
-};
-
-}  // namespace esphome::espectre
-
-#endif  // USE_ESPECTRE
@@ -1,78 +0,0 @@
-import esphome.codegen as cg
-from esphome.components import sensor
-import esphome.config_validation as cv
-from esphome.const import (
-    CONF_ID,
-    ENTITY_CATEGORY_DIAGNOSTIC,
-    STATE_CLASS_MEASUREMENT,
-    UNIT_PERCENT,
-)
-from esphome.types import ConfigType
-
-from .. import CONF_ESPECTRE_ID, ESPectreComponent, espectre_ns
-
-DEPENDENCIES = ["espectre"]
-
-CONF_MOVEMENT = "movement"
-CONF_DIAGNOSTICS = "diagnostics"
-CONF_GENERATOR_RATE = "generator_rate"
-CONF_TRAFFIC_TX_RATE = "traffic_tx_rate"
-CONF_TRAFFIC_RX_RATE = "traffic_rx_rate"
-CONF_CSI_ACCEPTED_RATE = "csi_accepted_rate"
-CONF_CSI_OCCUPANCY = "csi_occupancy"
-UNIT_PACKETS_PER_SECOND = "pps"
-
-DiagnosticsUpdater = espectre_ns.class_("DiagnosticsUpdater", cg.PollingComponent)
-
-
-def _diagnostic_schema(unit: str, accuracy_decimals: int) -> cv.Schema:
-    return sensor.sensor_schema(
-        unit_of_measurement=unit,
-        accuracy_decimals=accuracy_decimals,
-        state_class=STATE_CLASS_MEASUREMENT,
-        entity_category=ENTITY_CATEGORY_DIAGNOSTIC,
-    )
-
-
-DIAGNOSTIC_SENSORS = {
-    CONF_GENERATOR_RATE: _diagnostic_schema(UNIT_PACKETS_PER_SECOND, 1),
-    CONF_TRAFFIC_TX_RATE: _diagnostic_schema(UNIT_PACKETS_PER_SECOND, 1),
-    CONF_TRAFFIC_RX_RATE: _diagnostic_schema(UNIT_PACKETS_PER_SECOND, 1),
-    CONF_CSI_ACCEPTED_RATE: _diagnostic_schema(UNIT_PACKETS_PER_SECOND, 1),
-    CONF_CSI_OCCUPANCY: _diagnostic_schema(UNIT_PERCENT, 0),
-}
-
-# Diagnostics are rarely watched, so they publish only on request unless an interval is set.
-DIAGNOSTICS_SCHEMA = cv.All(
-    cv.Schema(
-        {
-            cv.GenerateID(): cv.declare_id(DiagnosticsUpdater),
-            **{cv.Optional(key): schema for key, schema in DIAGNOSTIC_SENSORS.items()},
-        }
-    ).extend(cv.polling_component_schema("never")),
-    cv.has_at_least_one_key(*DIAGNOSTIC_SENSORS),
-)
-
-CONFIG_SCHEMA = cv.All(
-    cv.Schema(
-        {
-            cv.GenerateID(CONF_ESPECTRE_ID): cv.use_id(ESPectreComponent),
-            cv.Optional(CONF_MOVEMENT): sensor.sensor_schema(
-                accuracy_decimals=3, state_class=STATE_CLASS_MEASUREMENT
-            ),
-            cv.Optional(CONF_DIAGNOSTICS): DIAGNOSTICS_SCHEMA,
-        }
-    ),
-    cv.has_at_least_one_key(CONF_MOVEMENT, CONF_DIAGNOSTICS),
-)
-
-
-async def to_code(config: ConfigType) -> None:
-    hub = await cg.get_variable(config[CONF_ESPECTRE_ID])
-    await sensor.sub_sensors(config)(CONF_MOVEMENT, hub.set_movement_sensor)
-    if (diagnostics_config := config.get(CONF_DIAGNOSTICS)) is not None:
-        updater = cg.new_Pvariable(diagnostics_config[CONF_ID], hub)
-        await cg.register_component(updater, diagnostics_config)
-        diagnostic_sensors = sensor.sub_sensors(diagnostics_config)
-        for key in DIAGNOSTIC_SENSORS:
-            await diagnostic_sensors(key, getattr(updater, f"set_{key}_sensor"))
@@ -1,40 +0,0 @@
-#include "espectre_diagnostics.h"
-
-#ifdef USE_ESPECTRE
-
-#include <cmath>
-#include "esphome/core/log.h"
-
-namespace esphome::espectre {
-
-static const char *const TAG = "espectre.sensor";
-
-static void publish_diagnostic(sensor::Sensor *sensor, const ::espectre::RuntimeDiagnosticsSample *sample,
-                               float ::espectre::RuntimeDiagnosticsSample::*field, float scale = 1.0f) {
-  if (sensor != nullptr)
-    sensor->publish_state(sample != nullptr ? sample->*field * scale : NAN);
-}
-
-void DiagnosticsUpdater::update() {
-  using Sample = ::espectre::RuntimeDiagnosticsSample;
-  const auto *sample = this->parent_->diagnostics_sample();
-  publish_diagnostic(this->generator_rate_sensor_, sample, &Sample::generator_pps);
-  publish_diagnostic(this->traffic_tx_rate_sensor_, sample, &Sample::traffic_tx_pps);
-  publish_diagnostic(this->traffic_rx_rate_sensor_, sample, &Sample::traffic_rx_pps);
-  publish_diagnostic(this->csi_accepted_rate_sensor_, sample, &Sample::csi_accepted_pps);
-  publish_diagnostic(this->csi_occupancy_sensor_, sample, &Sample::csi_occupancy_ratio, 100.0f);
-}
-
-void DiagnosticsUpdater::dump_config() {
-  ESP_LOGCONFIG(TAG, "ESPectre diagnostics:");
-  LOG_UPDATE_INTERVAL(this);
-  LOG_SENSOR("  ", "Generator rate", this->generator_rate_sensor_);
-  LOG_SENSOR("  ", "Traffic TX rate", this->traffic_tx_rate_sensor_);
-  LOG_SENSOR("  ", "Traffic RX rate", this->traffic_rx_rate_sensor_);
-  LOG_SENSOR("  ", "CSI accepted rate", this->csi_accepted_rate_sensor_);
-  LOG_SENSOR("  ", "CSI occupancy", this->csi_occupancy_sensor_);
-}
-
-}  // namespace esphome::espectre
-
-#endif  // USE_ESPECTRE
@@ -1,32 +0,0 @@
-#pragma once
-
-#include "esphome/core/defines.h"
-
-#ifdef USE_ESPECTRE
-
-#include "esphome/components/sensor/sensor.h"
-#include "esphome/core/component.h"
-#include "../espectre.h"
-
-namespace esphome::espectre {
-
-/// Publishes all diagnostic sensors together from the same runtime sample.
-class DiagnosticsUpdater final : public PollingComponent {
- public:
-  explicit DiagnosticsUpdater(ESPectreComponent *parent) : parent_(parent) {}
-  void update() override;
-  void dump_config() override;
-
-  SUB_SENSOR(generator_rate)
-  SUB_SENSOR(traffic_tx_rate)
-  SUB_SENSOR(traffic_rx_rate)
-  SUB_SENSOR(csi_accepted_rate)
-  SUB_SENSOR(csi_occupancy)
-
- protected:
-  ESPectreComponent *parent_;
-};
-
-}  // namespace esphome::espectre
-
-#endif  // USE_ESPECTRE
@@ -133,12 +133,20 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
            _resolve_encryption_key(encryption_conf, api_conf)
        elif CONF_PASSWORD in ota_conf and static_encryption_key(api_conf) is not None:
            _LOGGER.warning(
-                "'%s' %s wastes significant flash and RAM; "
-                "using '%s' instead is recommended - "
-                "see https://esphome.io/components/ota/esphome/#configuration-variables",
+                "'%s' %s wastes significant flash and RAM (about 3.5 KB and 60 "
+                "bytes plus the password on the heap): the device already offers "
+                "encryption with the '%s' %s %s, which authenticates any uploader "
+                "that takes it, and a password only matters for uploaders without "
+                "encryption support; remove '%s' and add '%s' under '%s' so "
+                "uploads use the key and encryption is required",
                CONF_OTA,
                CONF_PASSWORD,
+                CONF_API,
                CONF_ENCRYPTION,
+                CONF_KEY,
+                CONF_PASSWORD,
+                CONF_ENCRYPTION,
+                CONF_OTA,
            )
        elif (
            CONF_PASSWORD in ota_conf
@@ -307,19 +315,10 @@ FINAL_VALIDATE_SCHEMA = ota_esphome_final_validate


 FILTER_SOURCE_FILES = filter_source_files_from_defines(
-    {
-        "ota_esphome_noise.cpp": "USE_OTA_ENCRYPTION",
-        "ota_esphome_inflate_session.cpp": "USE_OTA_DEFLATE",
-        "ota_esphome_inflate.c": "USE_OTA_DEFLATE",
-    }
+    {"ota_esphome_noise.cpp": "USE_OTA_ENCRYPTION"}
 )


-def enable_deflate() -> None:
-    """Compile the on-the-fly inflater for compressed uploads."""
-    cg.add_define("USE_OTA_DEFLATE")
-
-
@coroutine_with_priority(CoroPriority.OTA_UPDATES)
 async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
@@ -341,10 +340,6 @@ async def to_code(config: ConfigType) -> None:
    if config.get(CONF_ALLOW_PARTITION_ACCESS):
        cg.add_define("USE_OTA_PARTITIONS")

-    # ESP8266 and RP2040 inflate gzip at reboot; the rest inflate on the fly
-    if not (CORE.is_esp8266 or CORE.is_rp2):
-        enable_deflate()
-
    # One key per device: an api encryption block supplies it (static or
    # runtime) and offers; the ota block only adds the requirement
    api_conf = CORE.config.get(CONF_API) or {}
@@ -352,7 +347,7 @@ async def to_code(config: ConfigType) -> None:
        # Build time key: the ota keeps its own pointer so safe mode, which
        # has no api server, still has it
        cg.add_define("USE_OTA_ENCRYPTION")
-        cg.add(var.set_noise_psk(new_psk_progmem(key)))
+        cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], key)))
    elif CONF_ENCRYPTION in api_conf:
        # Runtime key: found in the api server, or in preferences in safe mode
        cg.add_define("USE_OTA_ENCRYPTION")
@@ -22,10 +22,8 @@
 #include "esphome/core/lwip_fast_select.h"
 #endif

-#include <algorithm>
 #include <cerrno>
 #include <cstdio>
-#include <cstring>
 #include <sys/time.h>

 namespace esphome {
@@ -49,8 +47,6 @@ static constexpr uint32_t OTA_SOCKET_TIMEOUT_HANDSHAKE = 20000;  // milliseconds
 // practice for a lost chunk ack (1.5 + 3 + 6 + 12 + 24 + 48 s); the CLI waits
 // longer (espota2.DATA_PHASE_TIMEOUT) so the device is free before it retries
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 105000;
-static constexpr uint32_t OTA_PROGRESS_INTERVAL_MS = 1000;
-static constexpr size_t OTA_SIZE_FIELD_BYTES = 4;  // sizes on the wire are 4 bytes MSB first

 // Single-instance pointer — multi-port configs are rejected in final_validate.
 // NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables)
@@ -198,23 +194,12 @@ static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_NOISE = 0x08;
-static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_DEFLATE = 0x10;
 // Noise needs the extended protocol: the prologue binds the 2-byte feature ack
 static constexpr uint8_t CLIENT_NOISE_FEATURES =
    CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_NOISE = 0x04;
-// Raw deflate, window <= OTA_INFLATE_WINDOW_SIZE. Binding once offered: the
-// client must then send the image size frame and a deflate stream.
-static constexpr uint8_t SERVER_FEATURE_SUPPORTS_DEFLATE = 0x08;
-
-#ifdef USE_OTA_ENCRYPTION
-inline bool ESPHomeOTAComponent::noise_offered_() const {
-  return (this->handshake_buf_[1] & SERVER_FEATURE_SUPPORTS_NOISE) != 0 &&
-         (this->ota_features_ & CLIENT_NOISE_FEATURES) == CLIENT_NOISE_FEATURES;
-}
-#endif

 inline bool ESPHomeOTAComponent::extended_proto_() const {
 #ifdef USE_OTA_ENCRYPTION_REQUIRED
@@ -320,7 +305,7 @@ void ESPHomeOTAComponent::handle_handshake_() {
      this->transition_ota_state_(OTAState::FEATURE_ACK);

      const bool supports_compression =
-          (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_COMPRESSION) != 0 && ota::OTABackend::supports_compression();
+          (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_COMPRESSION) != 0 && this->backend_->supports_compression();

      // Compose the feature-ack response. When the client negotiates the extended protocol we emit
      // a 2-byte response (marker + server feature flags); otherwise we emit the single-byte
@@ -340,28 +325,6 @@ void ESPHomeOTAComponent::handle_handshake_() {
 #elif defined(USE_OTA_ENCRYPTION)
        // A yaml key always exists: validation rejects the all-zeros key
        this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
-#endif
-#ifdef USE_OTA_ENCRYPTION
-        // Reserve the noise session before the optional inflate buffer, so the
-        // required allocation is not starved by the compression window
-        if (this->noise_offered_()) {
-          this->noise_reserve_session_();
-        }
-#endif
-#ifdef USE_OTA_DEFLATE
-        // Offered only once the session memory is in hand; else uncompressed
-        if ((this->ota_features_ & CLIENT_FEATURE_SUPPORTS_DEFLATE) != 0) {
-          // Value initialized: a corrupt stream that back references the
-          // window before it is filled then copies zeros, never stale memory.
-          // Default placement, PSRAM first where present: the session lives for one
-          // upload and keeps 4.9 KB of internal heap free while it runs
-          this->inflate_ = RAMAllocator<InflateSession>().make_unique();
-          if (this->inflate_ != nullptr) {
-            this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_DEFLATE;
-          } else {
-            ESP_LOGW(TAG, "No memory to inflate");
-          }
-        }
 #endif
      } else {
        this->handshake_buf_[0] =
@@ -380,7 +343,8 @@ void ESPHomeOTAComponent::handle_handshake_() {
 #ifdef USE_OTA_ENCRYPTION
      // Latch the offer actually sent: a key activating between the two
      // states must not start a session the client never expects
-      if (this->noise_offered_()) {
+      if ((this->handshake_buf_[1] & SERVER_FEATURE_SUPPORTS_NOISE) != 0 &&
+          (this->ota_features_ & CLIENT_NOISE_FEATURES) == CLIENT_NOISE_FEATURES) {
        // handshake_buf_ still holds the feature ack composed above; a
        // would-block re-entry lands here without rebuilding it
        if (!this->noise_start_session_(this->handshake_buf_[1])) {
@@ -478,11 +442,16 @@ void ESPHomeOTAComponent::handle_data_() {
  // Backend calls overwrite this with OK; reset to UNKNOWN before any
  // goto error that follows a successful begin()/write()
  ota::OTAResponseTypes error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
-  DataTransfer xfer;
+  size_t total = 0;
+  uint32_t last_progress = 0;
+  uint32_t last_data_ms = 0;
  uint8_t buf[OTA_BUFFER_SIZE];
  char *sbuf = reinterpret_cast<char *>(buf);
-  size_t image_size;
+  size_t ota_size;
  ota::OTAType ota_type = ota::OTA_TYPE_UPDATE_APP;
+#if USE_OTA_VERSION == 2
+  size_t size_acknowledged = 0;
+#endif

  // Set socket timeouts and blocking mode (see strategy table above)
  struct timeval tv;
@@ -511,20 +480,16 @@ void ESPHomeOTAComponent::handle_data_() {
  ESP_LOGV(TAG, "OTA type is 0x%02x", ota_type);

  // Read size, 4 bytes MSB first
-  if (!this->read_size_(buf, xfer.ota_size, LOG_STR("size"))) {
+  if (!this->data_readall_(buf, 4)) {
    // The first request byte is the type on the extended protocol; a close after it was a cut-off request
    if (!this->extended_proto_() && this->client_left_before_start_())
      return;
    this->log_read_error_(LOG_STR("size"));
    goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
  }
-  image_size = xfer.ota_size;
-#ifdef USE_OTA_DEFLATE
-  if (this->inflate_ != nullptr && !this->read_size_(buf, image_size, LOG_STR("image size"))) {
-    this->log_read_error_(LOG_STR("image size"));
-    goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-  }
-#endif
+  ota_size = (static_cast<size_t>(buf[0]) << 24) | (static_cast<size_t>(buf[1]) << 16) |
+             (static_cast<size_t>(buf[2]) << 8) | buf[3];
+  ESP_LOGV(TAG, "Size is %zu bytes", ota_size);

 #ifndef USE_OTA_PARTITIONS
  if (ota_type != ota::OTA_TYPE_UPDATE_APP) {
@@ -544,7 +509,7 @@ void ESPHomeOTAComponent::handle_data_() {
 #endif

  // begin() returns quickly; flash sectors are erased incrementally during write().
-  error_code = this->backend_->begin(image_size, ota_type);
+  error_code = this->backend_->begin(ota_size, ota_type);
  if (error_code != ota::OTA_RESPONSE_OK)
    goto error;  // NOLINT(cppcoreguidelines-avoid-goto)

@@ -564,25 +529,77 @@ void ESPHomeOTAComponent::handle_data_() {
  // Acknowledge MD5 OK - 1 byte
  this->data_write_byte_(ota::OTA_RESPONSE_BIN_MD5_OK);

-  xfer.last_data_ms = millis();
-#ifdef USE_OTA_DEFLATE
-  if (this->inflate_ != nullptr) {
-    error_code = this->inflate_data_(buf, image_size, xfer);
-    if (error_code != ota::OTA_RESPONSE_OK)
+  // Track when we last received data so a silently-vanished peer (no FIN/RST
+  // delivered, e.g. uploader killed mid-transfer or NAT/router dropped state)
+  // can't wedge the device indefinitely. Without this, the loop only exits
+  // on actual data, EOF, or a non-EWOULDBLOCK error from read(), and lwIP
+  // TCP keepalive isn't enabled here.
+  last_data_ms = millis();
+  while (total < ota_size) {
+    if (millis() - last_data_ms > OTA_SOCKET_TIMEOUT_DATA) {
+      ESP_LOGW(TAG, "No data received for %u ms", (unsigned) OTA_SOCKET_TIMEOUT_DATA);
+      error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
      goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-  } else
-#endif
-  {
-    while (xfer.total < xfer.ota_size) {
-      ssize_t read = this->receive_data_(buf, xfer);
-      if (read < 0) {
+    }
+    size_t remaining = ota_size - total;
+    size_t requested = remaining < OTA_BUFFER_SIZE ? remaining : OTA_BUFFER_SIZE;
+    ssize_t read;
+#ifdef USE_OTA_ENCRYPTION
+    if (this->noise_ != nullptr) {
+      // One frame per call; noise_read_data_ waits internally (readall_), so
+      // there is no would-block retry here and failures are already logged.
+      read = this->noise_read_data_(buf, requested);
+      if (read <= 0) {
+        if (this->remote_closed_)
+          this->log_remote_closed_(LOG_STR("data"));
        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
      }
-      error_code = this->write_flash_(buf, read);
-      if (error_code != ota::OTA_RESPONSE_OK)
+    } else
+#endif
+    {
+      read = this->client_->read(buf, requested);
+      if (read == -1) {
+        const int err = errno;
+        if (this->would_block_(err)) {
+          // read() already waited up to SO_RCVTIMEO for data, just feed WDT
+          App.feed_wdt();
+          continue;
+        }
+        ESP_LOGW(TAG, "Read err %d", err);
+        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-      this->ack_written_(xfer);
+      } else if (read == 0) {
+        ESP_LOGW(TAG, "Remote closed");
+        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
+        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+      }
+    }
+
+    last_data_ms = millis();
+    error_code = this->backend_->write(buf, read);
+    if (error_code != ota::OTA_RESPONSE_OK) {
+      ESP_LOGW(TAG, "Flash write err %d", error_code);
+      goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+    }
+    total += read;
+#if USE_OTA_VERSION == 2
+    while (size_acknowledged + OTA_BLOCK_SIZE <= total || (total == ota_size && size_acknowledged < ota_size)) {
+      this->data_write_byte_(ota::OTA_RESPONSE_CHUNK_OK);
+      size_acknowledged += OTA_BLOCK_SIZE;
+    }
+#endif
+
+    uint32_t now = millis();
+    if (now - last_progress > 1000) {
+      last_progress = now;
+      float percentage = (total * 100.0f) / ota_size;
+      ESP_LOGD(TAG, "Progress: %0.1f%%", percentage);
+#ifdef USE_OTA_STATE_LISTENER
+      this->notify_state_(ota::OTA_IN_PROGRESS, percentage, 0);
+#endif
+      // feed watchdog and give other tasks a chance to run
+      this->yield_and_feed_watchdog_();
    }
  }

@@ -798,90 +815,6 @@ bool ESPHomeOTAComponent::try_write_(size_t to_write, const LogString *desc) {
  return this->handshake_buf_pos_ >= to_write;
 }

-bool ESPHomeOTAComponent::read_size_(uint8_t *buf, size_t &size, const LogString *desc) {
-  if (!this->data_readall_(buf, OTA_SIZE_FIELD_BYTES))
-    return false;
-  size = encode_uint32(buf[0], buf[1], buf[2], buf[3]);
-  ESP_LOGV(TAG, "%s is %zu bytes", LOG_STR_ARG(desc), size);
-  return true;
-}
-
-ota::OTAResponseTypes ESPHomeOTAComponent::write_flash_(uint8_t *data, size_t len) {
-  ota::OTAResponseTypes result = this->backend_->write(data, len);
-  if (result != ota::OTA_RESPONSE_OK) {
-    ESP_LOGW(TAG, "Flash write err %d", result);
-  }
-  return result;
-}
-
-ssize_t ESPHomeOTAComponent::receive_data_(uint8_t *buf, DataTransfer &xfer) {
-  const size_t remaining = xfer.ota_size - xfer.total;
-  const size_t requested = std::min(remaining, OTA_BUFFER_SIZE);
-  ssize_t read;
-  for (;;) {
-    // A silently-vanished peer (no FIN/RST delivered, e.g. uploader killed
-    // mid-transfer or NAT/router dropped state) must not wedge the device:
-    // read() only fails on EOF or a real error, and lwIP TCP keepalive isn't
-    // enabled here.
-    if (millis() - xfer.last_data_ms > OTA_SOCKET_TIMEOUT_DATA) {
-      ESP_LOGW(TAG, "No data received for %u ms", (unsigned) OTA_SOCKET_TIMEOUT_DATA);
-      return -1;
-    }
-#ifdef USE_OTA_ENCRYPTION
-    if (this->noise_ != nullptr) {
-      // One frame per call; noise_read_data_ waits internally (readall_), so
-      // there is no would-block retry here and failures are already logged.
-      read = this->noise_read_data_(buf, requested);
-      if (read <= 0) {
-        if (this->remote_closed_)
-          this->log_remote_closed_(LOG_STR("data"));
-        return -1;
-      }
-      break;
-    }
-#endif
-    read = this->client_->read(buf, requested);
-    if (read > 0)
-      break;
-    if (read == 0) {
-      this->log_remote_closed_(LOG_STR("data"));
-      return -1;
-    }
-    if (!this->would_block_(errno)) {
-      this->log_socket_error_(LOG_STR("data"));
-      return -1;
-    }
-    // read() already waited up to SO_RCVTIMEO for data, just feed WDT
-    App.feed_wdt();
-  }
-
-  const uint32_t now = millis();
-  xfer.last_data_ms = now;
-  xfer.total += read;
-  this->ack_received_(xfer);
-  if (now - xfer.last_progress > OTA_PROGRESS_INTERVAL_MS) {
-    xfer.last_progress = now;
-    float percentage = (xfer.total * 100.0f) / xfer.ota_size;
-    ESP_LOGD(TAG, "Progress: %0.1f%%", percentage);
-#ifdef USE_OTA_STATE_LISTENER
-    this->notify_state_(ota::OTA_IN_PROGRESS, percentage, 0);
-#endif
-    // feed watchdog and give other tasks a chance to run
-    this->yield_and_feed_watchdog_();
-  }
-  return read;
-}
-
-void ESPHomeOTAComponent::send_chunk_acks_(DataTransfer &xfer) {
-#if USE_OTA_VERSION == 2
-  while (xfer.acknowledged + OTA_BLOCK_SIZE <= xfer.total ||
-         (xfer.total == xfer.ota_size && xfer.acknowledged < xfer.ota_size)) {
-    this->data_write_byte_(ota::OTA_RESPONSE_CHUNK_OK);
-    xfer.acknowledged += OTA_BLOCK_SIZE;
-  }
-#endif
-}
-
 void ESPHomeOTAComponent::cleanup_connection_() {
  this->client_->close();
  this->client_ = nullptr;
@@ -896,9 +829,6 @@ void ESPHomeOTAComponent::cleanup_connection_() {
 #endif
 #ifdef USE_OTA_ENCRYPTION
  this->noise_ = nullptr;
-#endif
-#ifdef USE_OTA_DEFLATE
-  this->inflate_ = nullptr;
 #endif
  // Intentionally no disable_loop() — letting loop() run one more iteration catches
  // any connection that queued on the listener mid-session (otherwise the wake flag,
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
J. Nick Koston	10ab94e198	[socket] Rename the filter test so pytest collection stays unique The bare test_init module name collided with the external components test; the both defines case now also checks the resolver stays in the build.	2026-10-02 06:49:15 -05:00
J. Nick Koston	9e9d8646a7	[socket] Compile the helper files only for components that require them	2026-10-02 06:38:13 -05:00