Merge pull request #19334 from esphome/bump-2026.9.0b5

2026.9.0b5

Doxyfile

@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.10.0-dev
+PROJECT_NUMBER         = 2026.9.0b5
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

THREAT_MODEL.md

@@ -125,30 +125,47 @@ design is optimal or that it will not change.
 ## OTA update encryption
 
 The `esphome` OTA platform optionally encrypts updates with the same Noise
-`NNpsk0` pattern the native API uses; one key protects the device. With an
-`encryption:` block configured the guarantees are: the firmware image is
-confidential in transit, the uploader is authenticated by the pre-shared key,
-and the plaintext negotiation preceding the handshake is bound into the
-handshake prologue, so stripping or tampering with it fails the first MAC.
-Both ends fail closed with no override: a device built with a key refuses
+`NNpsk0` pattern the native API uses; one key protects the device. A device
+whose `api:` block has an encryption key, static in the YAML or provisioned at
+runtime, compiles in the transport and offers it on every OTA connection once
+it holds a key, so an uploader presenting that key gets the guarantees below
+even without an `ota: encryption:` block; only that block makes the device
+require encryption. The guarantees are: the firmware image is confidential in
+transit, the uploader is authenticated by the pre-shared key, and the plaintext
+negotiation preceding the handshake is bound into the handshake prologue, so
+stripping or tampering with it fails the first MAC. With `ota: encryption:`
+configured both ends fail closed with no override: the device refuses
 plaintext uploads, and the CLI refuses to send plaintext when a key is
-configured.
+configured. Without that block the CLI tries a static api key when the device
+offers and, until 2027.3.0, falls back to plaintext with a warning when the
+offer is missing or the handshake fails; a runtime provisioned key never
+reaches the CLI, so those uploads stay plaintext.
 
-Defeating any of that without the key is in scope: a keyed device accepting a
-plaintext or downgraded upload, getting past the MAC, or recovering image
-contents from captured traffic.
+Defeating any of that without the key is in scope: a device that requires
+encryption accepting a plaintext or downgraded upload, getting past the MAC,
+or recovering image contents from captured traffic.
 
 The following are **not** vulnerabilities, by design:
 
-- Plaintext OTA on a device with no `encryption:` block. That is the
-  documented default, authenticated (if at all) by the OTA password.
-- The enablement window: turning encryption on takes one last upload of the
-  encryption-enabled firmware over the existing plaintext channel, with the
-  pre-existing plaintext exposure.
-- The web OTA `/update` endpoint alongside encryption. The `web_server`
-  component keeps it always reachable, and `captive_portal:` auto-loads it
-  for the fallback AP window; validation warns about both combinations, and
-  the operator keeps the recovery path.
+- Plaintext OTA on a device with no `ota: encryption:` block, including one
+  that offers encryption because it has an api key. That is the documented
+  default, authenticated (if at all) by the OTA password. An uploader that
+  takes the offer skips the password; the key authenticates it. With a
+  runtime provisioned key and no `provisioning:` window, whoever provisions
+  the key gains that upload path too; validation warns about the pair.
+- The CLI plaintext fallback until 2027.3.0: without `ota: encryption:` an
+  active attacker who strips the offer or breaks the handshake can make a
+  keyed CLI upload plaintext, with the pre-existing plaintext exposure. A
+  device that requires encryption still refuses that upload.
+- The enablement window: firmware built with a static api key already offers
+  encryption, so turning on `ota: encryption:` is itself an encrypted upload.
+  Older firmware needs one last plaintext upload of an offering build, with
+  the pre-existing plaintext exposure.
+- The web OTA `/update` endpoint alongside encryption. With the `web_server`
+  or `prometheus` component the shared listener is always up, so the endpoint
+  stays reachable and validation warns about that combination;
+  `captive_portal:` alone brings the listener up only for the fallback AP
+  window, which is the intended recovery path, so that is not warned about.
 - CLI retry behavior on transport or MAC failures; every attempt renegotiates
   a fresh handshake with fresh ephemerals, so retrying does not weaken
   authentication.

docker/Dockerfile

@@ -22,7 +22,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.14.0
+RUN uv pip install --no-cache-dir esphome-device-builder==1.14.9
 
 RUN \
     platformio settings set enable_telemetry No \

esphome/__main__.py

@@ -1335,12 +1335,14 @@ def _upload_via_native_api(
             break
 
     from esphome import espota2
+    from esphome.components.noise import static_encryption_key
 
     remote_port = int(ota_conf[CONF_PORT])
     password = ota_conf.get(CONF_PASSWORD)
     # Fail closed: an encryption block whose key did not resolve must never
     # fall back to a plaintext upload
     noise_psk = None
+    plaintext_fallback = False
     if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
         noise_psk = encryption_conf.get(CONF_KEY)
         if not noise_psk:
@@ -1351,6 +1353,10 @@ def _upload_via_native_api(
         # Ensure the key is a string, as required by the underlying OTA implementation.
         # It arrives here as a SensitiveStr which aioesphomeapi rejects.
         noise_psk = str(noise_psk)
+    elif api_key := static_encryption_key(config.get(CONF_API) or {}):
+        # Remove before 2027.3.0: the api key is tried, falling back to plaintext
+        noise_psk = str(api_key)
+        plaintext_fallback = True
 
     def check_partition_access(option_string: str) -> None:
         if not ota_conf.get("allow_partition_access"):
@@ -1382,7 +1388,13 @@ def _upload_via_native_api(
         _validate_bootloader_binary(binary)
 
     return espota2.run_ota(
-        network_devices, remote_port, password, binary, ota_type, noise_psk
+        network_devices,
+        remote_port,
+        password,
+        binary,
+        ota_type,
+        noise_psk,
+        plaintext_fallback=plaintext_fallback,
     )
 
 

esphome/components/anova/anova.cpp

@@ -13,7 +13,7 @@ void Anova::dump_config() { LOG_CLIMATE("", "Anova BLE Cooker", this); }
 
 void Anova::setup() {
   this->codec_ = make_unique<AnovaCodec>();
-  this->current_request_ = 0;
+  this->poll_step_ = PollStep::IDLE;
 }
 
 void Anova::loop() {
@@ -22,6 +22,15 @@ void Anova::loop() {
   this->disable_loop();
 }
 
+void Anova::write_request_(AnovaPacket *pkt) {
+  auto status =
+      esp_ble_gattc_write_char(this->parent_->get_gattc_if(), this->parent_->get_conn_id(), this->char_handle_,
+                               pkt->length, pkt->data, ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
+  if (status) {
+    ESP_LOGW(TAG, "[%s] esp_ble_gattc_write_char failed, status=%d", this->parent_->address_str(), status);
+  }
+}
+
 void Anova::control(const ClimateCall &call) {
   auto mode_val = call.get_mode();
   if (mode_val.has_value()) {
@@ -38,22 +47,11 @@ void Anova::control(const ClimateCall &call) {
         ESP_LOGW(TAG, "Unsupported mode: %d", mode);
         return;
     }
-    auto status =
-        esp_ble_gattc_write_char(this->parent_->get_gattc_if(), this->parent_->get_conn_id(), this->char_handle_,
-                                 pkt->length, pkt->data, ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
-    if (status) {
-      ESP_LOGW(TAG, "[%s] esp_ble_gattc_write_char failed, status=%d", this->parent_->address_str(), status);
-    }
+    this->write_request_(pkt);
   }
   auto target_temp = call.get_target_temperature();
   if (target_temp.has_value()) {
-    auto *pkt = this->codec_->get_set_target_temp_request(*target_temp);
-    auto status =
-        esp_ble_gattc_write_char(this->parent_->get_gattc_if(), this->parent_->get_conn_id(), this->char_handle_,
-                                 pkt->length, pkt->data, ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
-    if (status) {
-      ESP_LOGW(TAG, "[%s] esp_ble_gattc_write_char failed, status=%d", this->parent_->address_str(), status);
-    }
+    this->write_request_(this->codec_->get_set_target_temp_request(*target_temp));
   }
 }
 
@@ -62,6 +60,7 @@ void Anova::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_
     case ESP_GATTC_DISCONNECT_EVT: {
       this->current_temperature = NAN;
       this->target_temperature = NAN;
+      this->poll_step_ = PollStep::IDLE;
       this->publish_state();
       break;
     }
@@ -83,8 +82,8 @@ void Anova::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_
     }
     case ESP_GATTC_REG_FOR_NOTIFY_EVT: {
       this->node_state = espbt::ClientState::ESTABLISHED;
-      this->current_request_ = 0;
-      this->update();
+      this->poll_step_ = PollStep::IDLE;
+      this->update();  // begin the first poll cycle immediately
       break;
     }
     case ESP_GATTC_NOTIFY_EVT: {
@@ -101,33 +100,30 @@ void Anova::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_
         this->mode = this->codec_->running_ ? climate::CLIMATE_MODE_HEAT : climate::CLIMATE_MODE_OFF;
       }
       if (this->codec_->has_unit()) {
-        this->fahrenheit_ = (this->codec_->unit_ == 'f');
-        ESP_LOGD(TAG, "Anova units is %s", this->fahrenheit_ ? "fahrenheit" : "celsius");
-        this->current_request_++;
+        ESP_LOGD(TAG, "Anova units is %s", (this->codec_->unit_ == 'f') ? "fahrenheit" : "celsius");
       }
       this->publish_state();
 
-      if (this->current_request_ > 1) {
-        AnovaPacket *pkt = nullptr;
-        switch (this->current_request_++) {
-          case 2:
-            pkt = this->codec_->get_read_target_temp_request();
-            break;
-          case 3:
-            pkt = this->codec_->get_read_current_temp_request();
-            break;
-          default:
-            this->current_request_ = 1;
-            break;
-        }
-        if (pkt != nullptr) {
-          auto status =
-              esp_ble_gattc_write_char(this->parent_->get_gattc_if(), this->parent_->get_conn_id(), this->char_handle_,
-                                       pkt->length, pkt->data, ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
-          if (status) {
-            ESP_LOGW(TAG, "[%s] esp_ble_gattc_write_char failed, status=%d", this->parent_->address_str(), status);
-          }
-        }
+      // Advance the poll cycle to its next request based on the reply we got.
+      switch (this->poll_step_) {
+        case PollStep::SET_UNIT:
+          this->poll_step_ = PollStep::STATUS;
+          this->write_request_(this->codec_->get_read_device_status_request());
+          break;
+        case PollStep::STATUS:
+          this->poll_step_ = PollStep::TARGET;
+          this->write_request_(this->codec_->get_read_target_temp_request());
+          break;
+        case PollStep::TARGET:
+          this->poll_step_ = PollStep::CURRENT;
+          this->write_request_(this->codec_->get_read_current_temp_request());
+          break;
+        case PollStep::CURRENT:
+          this->poll_step_ = PollStep::IDLE;  // full cycle complete
+          break;
+        default:
+          // A reply to an ad-hoc control() write, outside a managed cycle.
+          break;
       }
       break;
     }
@@ -136,27 +132,26 @@ void Anova::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_
   }
 }
 
-void Anova::set_unit_of_measurement(const char *unit) { this->fahrenheit_ = !strncmp(unit, "f", 1); }
+void Anova::set_unit_of_measurement(const char *unit) { this->want_fahrenheit_ = !strncmp(unit, "f", 1); }
 
 void Anova::update() {
   if (this->node_state != espbt::ClientState::ESTABLISHED)
     return;
-
-  if (this->current_request_ < 2) {
-    AnovaPacket *pkt;
-    if (this->current_request_ == 0) {
-      pkt = this->codec_->get_set_unit_request(this->fahrenheit_ ? 'f' : 'c');
-    } else {
-      pkt = this->codec_->get_read_device_status_request();
-    }
-    auto status =
-        esp_ble_gattc_write_char(this->parent_->get_gattc_if(), this->parent_->get_conn_id(), this->char_handle_,
-                                 pkt->length, pkt->data, ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
-    if (status) {
-      ESP_LOGW(TAG, "[%s] esp_ble_gattc_write_char failed, status=%d", this->parent_->address_str(), status);
-    }
-    this->current_request_++;
+  if (this->poll_step_ != PollStep::IDLE) {
+    // The previous cycle never finished within a full polling interval -- a
+    // reply was missed or a write failed. Restart the cycle rather than stall;
+    // the polling interval itself acts as the timeout. A late reply from the
+    // abandoned cycle is harmless: state decoding happens on every notify
+    // regardless of step, and each notify sends at most one follow-up request.
+    ESP_LOGW(TAG, "[%s] Poll cycle incomplete (step %u); restarting cycle", this->parent_->address_str(),
+             static_cast<uint8_t>(this->poll_step_));
   }
+  // Re-assert the configured unit at the start of every poll cycle, then fall
+  // through the status/temperature reads via the notification handler. Always
+  // command the configured unit (want_fahrenheit_) -- never the last value the
+  // device reported, or a drift to 'c' would lock itself in.
+  this->poll_step_ = PollStep::SET_UNIT;
+  this->write_request_(this->codec_->get_set_unit_request(this->want_fahrenheit_ ? 'f' : 'c'));
 }
 
 }  // namespace esphome::anova

esphome/components/anova/anova.h

@@ -37,11 +37,20 @@ class Anova final : public climate::Climate, public esphome::ble_client::BLEClie
   void set_unit_of_measurement(const char *unit);
 
  protected:
+  // A poll cycle re-asserts the configured unit, then reads device state.
+  // Re-asserting every cycle prevents the cooker from silently reverting to
+  // its default (Celsius); previously the unit was only set once on
+  // connection, so a drift persisted (and corrupted the F/C interpretation of
+  // subsequent readings) until the BLE link was re-established.
+  enum class PollStep : uint8_t { SET_UNIT, STATUS, TARGET, CURRENT, IDLE };
+
+  void write_request_(AnovaPacket *pkt);
+
   std::unique_ptr<AnovaCodec> codec_;
   void control(const climate::ClimateCall &call) override;
   uint16_t char_handle_;
-  uint8_t current_request_;
-  bool fahrenheit_;
+  bool want_fahrenheit_{true};  // configured target unit; never overwritten by device replies
+  PollStep poll_step_{PollStep::IDLE};
 };
 
 }  // namespace esphome::anova

esphome/components/api/__init__.py

@@ -14,6 +14,7 @@ from esphome.components.noise import (  # noqa: F401
     ENCRYPTION_SCHEMA,
     decode_encryption_key,
     encryption_schema,
+    new_psk_progmem,
     validate_encryption_key,
 )
 from esphome.config_helpers import filter_source_files_from_defines, get_logger_level
@@ -349,10 +350,9 @@ CONFIG_SCHEMA = cv.All(
                 ln882x=5,  # Moderate RAM
                 nrf52=4,  # ~256KB RAM, BSD sockets, Thread (single HA controller)
             ): cv.int_range(min=1, max=20),
-            # Maximum queued send buffers per connection before dropping connection
-            # Each buffer uses ~8-12 bytes overhead plus actual message size
+            # Max queued messages per connection, and 2 KB of backlog per slot up
+            # to 64 KB (a lone message is exempt), before the connection is dropped
             # Platform defaults based on available RAM and typical message rates:
-            # CONF_MAX_SEND_QUEUE defaults are power of 2 for efficient modulo
             cv.SplitDefault(
                 CONF_MAX_SEND_QUEUE,
                 esp8266=4,  # Limited RAM, need to fail fast
@@ -589,8 +589,7 @@ async def to_code(config: ConfigType) -> None:
 
     if (encryption_config := config.get(CONF_ENCRYPTION, None)) is not None:
         if key := encryption_config.get(CONF_KEY):
-            decoded = decode_encryption_key(key)
-            cg.add(var.set_noise_psk(list(decoded)))
+            cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], key)))
             cg.add_define("USE_API_NOISE_PSK_FROM_YAML")
         else:
             # No key provided, but encryption desired

esphome/components/api/api_buffer.cpp

@@ -1,20 +1,37 @@
 #include "api_buffer.h"
-#include <new>
+#ifdef ESPHOME_DEBUG_API
+#include "esphome/core/log.h"
+#endif
 
 namespace esphome::api {
 
+#ifdef ESPHOME_DEBUG_API
+void APIBuffer::debug_check_drop_(size_t drop) const {
+  if (drop > this->size_) {
+    ESP_LOGE("api.buffer", "drop_front: drop=%zu size=%u", drop, this->size_);
+    abort();
+  }
+}
+#endif
+
 bool APIBuffer::grow_(size_t n) {
-  // nothrow (no zero-fill) so OOM is reportable; plain new aborts instead
-  // (NEW_OOM_ABORT on ESP8266 Arduino, exception stub on ESP-IDF).
-  // RAMAllocator is no fit here: unique_ptr needs delete[]-compatible memory.
-  std::unique_ptr<uint8_t[]> new_data(new (std::nothrow) uint8_t[n]);
-  if (new_data == nullptr)
+  if (n > MAX_SIZE)
     return false;
-  if (this->size_)
-    std::memcpy(new_data.get(), this->data_.get(), this->size_);
-  this->data_ = std::move(new_data);
+  // realloc extends in place when it can, avoiding the copy
+  uint8_t *grown = RAMAllocator<uint8_t>().reallocate(this->data_.get(), n);
+  if (grown == nullptr)
+    return false;
+  (void) this->data_.release();  // realloc already freed or reused the old block
+  this->data_.reset(grown);
   this->capacity_ = n;
   return true;
 }
 
+uint8_t *APIBuffer::append(size_t n) {
+  const size_t old_size = this->size_;
+  if (!this->resize(old_size + n))
+    return nullptr;
+  return this->data_.get() + old_size;
+}
+
 }  // namespace esphome::api

esphome/components/api/api_buffer.h

@@ -25,6 +25,7 @@ namespace esphome::api {
 /// writes in debug builds.
 class APIBuffer {
  public:
+  static constexpr size_t MAX_SIZE = UINT16_MAX;  // API frames carry 16 bit lengths
   void clear() { this->size_ = 0; }
   /// Returns false if allocation fails; the buffer is left unchanged.
   [[nodiscard]] inline bool reserve(size_t n) ESPHOME_ALWAYS_INLINE { return n <= this->capacity_ || this->grow_(n); }
@@ -36,9 +37,19 @@ class APIBuffer {
   [[nodiscard]] inline bool reserve_and_resize(size_t reserve_size, size_t new_size) ESPHOME_ALWAYS_INLINE {
     if (!this->reserve(std::max(reserve_size, new_size)))
       return false;
-    this->size_ = new_size;
+    this->size_ = static_cast<uint16_t>(new_size);
     return true;
   }
+  /// Grow by n bytes; returns the new bytes, or nullptr on allocation failure.
+  [[nodiscard]] uint8_t *append(size_t n);
+  /// Drop the first `drop` bytes, sliding the rest down. Precondition: drop <= size().
+  void drop_front(size_t drop) {
+#ifdef ESPHOME_DEBUG_API
+    this->debug_check_drop_(drop);
+#endif
+    this->size_ -= drop;
+    std::memmove(this->data_.get(), this->data_.get() + drop, this->size_);
+  }
   uint8_t *data() { return this->data_.get(); }
   const uint8_t *data() const { return this->data_.get(); }
   size_t size() const { return this->size_; }
@@ -55,9 +66,14 @@ class APIBuffer {
 
  protected:
   bool grow_(size_t n);
-  std::unique_ptr<uint8_t[]> data_;
-  size_t size_{0};
-  size_t capacity_{0};
+#ifdef ESPHOME_DEBUG_API
+  void debug_check_drop_(size_t drop) const;
+#endif
+  // RAMAllocator: PSRAM when available, and it reports failure where
+  // new (std::nothrow) still aborts on ESP-IDF without exceptions
+  RAMUniquePtr<uint8_t[]> data_;
+  uint16_t size_{0};
+  uint16_t capacity_{0};
 };
 
 }  // namespace esphome::api

esphome/components/api/api_connection.cpp

@@ -364,7 +364,10 @@ void APIConnection::check_keepalive_(uint32_t now) {
     ESP_LOGVV(TAG, "Sending keepalive PING");
     PingRequest req;
     this->flags_.sent_ping = this->send_message(req);
-    if (!this->flags_.sent_ping) {
+    if (this->flags_.sent_ping) {
+      // Quiet for a keepalive period and the ping is on its way: a one-off stall's storage can go
+      this->helper_->release_overflow_buffer();
+    } else {
       // If we can't send the ping request directly (tx_buffer full),
       // schedule it at the front of the batch so it will be sent with priority
       ESP_LOGW(TAG, "Buffer full, ping queued");
@@ -2161,7 +2164,10 @@ void APIConnection::on_homeassistant_action_response(const HomeassistantActionRe
 bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptionSetKeyRequest &msg) {
   NoiseEncryptionSetKeyResponse resp;
   resp.success = false;
-
+#ifdef USE_API_NOISE_PSK_FROM_YAML
+  // A yaml key cannot be changed at runtime, so no decode or save path is built
+  ESP_LOGW(TAG, "Key set in YAML");
+#else
 #ifdef USE_PROVISIONING
   // Refuse to set a key once the provisioning window has closed (defense in depth;
   // such connections are already rejected at hello).
@@ -2196,6 +2202,7 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
     }
 #endif
   }
+#endif  // USE_API_NOISE_PSK_FROM_YAML
 
   return this->send_message(resp);
 }

esphome/components/api/api_frame_helper.cpp

@@ -171,7 +171,7 @@ APIError APIFrameHelper::write_raw_iov_(const struct iovec *iov, int iovcnt, uin
     return APIError::OK;
 
   // Queue unsent data into overflow buffer
-  if (!this->overflow_buf_.enqueue_iov(iov, iovcnt, total_write_len, static_cast<uint16_t>(sent))) {
+  if (!this->overflow_buf_.enqueue_iov(iov, iovcnt, total_write_len, sent)) {
     HELPER_LOG("Overflow buffer full or out of memory, dropping connection");
     this->state_ = State::FAILED;
     return APIError::SOCKET_WRITE_FAILED;

esphome/components/api/api_frame_helper.h

@@ -219,7 +219,10 @@ class APIFrameHelper {
     if (this->rx_buf_len_ == 0) {
       this->rx_buf_.release();
     }
+    this->release_overflow_buffer();
   }
+  // Free the send backlog storage once it has drained
+  void release_overflow_buffer() { this->overflow_buf_.release(); }
 
  protected:
   // Drain backlogged overflow data to the socket and handle errors.

esphome/components/api/api_frame_helper_noise.cpp

@@ -67,15 +67,15 @@ APIError APINoiseFrameHelper::init() {
   }
 
   // init prologue
-  size_t old_size = prologue_.size();
-  if (!prologue_.resize(old_size + PROLOGUE_INIT_LEN)) [[unlikely]] {
+  uint8_t *dst = prologue_.append(PROLOGUE_INIT_LEN);
+  if (dst == nullptr) [[unlikely]] {
     state_ = State::FAILED;
     return APIError::OUT_OF_MEMORY;
   }
 #ifdef USE_ESP8266
-  memcpy_P(prologue_.data() + old_size, PROLOGUE_INIT, PROLOGUE_INIT_LEN);
+  memcpy_P(dst, PROLOGUE_INIT, PROLOGUE_INIT_LEN);
 #else
-  std::memcpy(prologue_.data() + old_size, PROLOGUE_INIT, PROLOGUE_INIT_LEN);
+  std::memcpy(dst, PROLOGUE_INIT, PROLOGUE_INIT_LEN);
 #endif
 
   state_ = State::CLIENT_HELLO;
@@ -272,17 +272,17 @@ APIError APINoiseFrameHelper::state_action_client_hello_() {
     return handle_handshake_frame_error_(aerr);
   }
   // ignore contents, may be used in future for flags
-  // Resize for: existing prologue + 2 size bytes + frame data
-  size_t old_size = this->prologue_.size();
+  // Append 2 size bytes + frame data to the prologue
   size_t rx_size = this->rx_buf_.size();
-  if (!this->prologue_.resize(old_size + 2 + rx_size)) [[unlikely]] {
+  uint8_t *dst = this->prologue_.append(2 + rx_size);
+  if (dst == nullptr) [[unlikely]] {
     state_ = State::FAILED;
     return APIError::OUT_OF_MEMORY;
   }
-  this->prologue_[old_size] = (uint8_t) (rx_size >> 8);
-  this->prologue_[old_size + 1] = (uint8_t) rx_size;
+  dst[0] = (uint8_t) (rx_size >> 8);
+  dst[1] = (uint8_t) rx_size;
   if (rx_size > 0) {
-    std::memcpy(this->prologue_.data() + old_size + 2, this->rx_buf_.data(), rx_size);
+    std::memcpy(dst + 2, this->rx_buf_.data(), rx_size);
   }
 
   state_ = State::SERVER_HELLO;
@@ -548,7 +548,7 @@ APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
  * @return 0 on success, -1 on error (check errno)
  */
 APIError APINoiseFrameHelper::init_handshake_() {
-  int err = this->handshake_.init(this->ctx_.get_psk(), prologue_.data(), prologue_.size());
+  int err = this->handshake_.init(this->ctx_, prologue_.data(), prologue_.size());
   APIError aerr = handle_noise_error_(err, LOG_STR("noise_handshake_init"), APIError::HANDSHAKESTATE_SETUP_FAILED);
   if (aerr != APIError::OK)
     return aerr;

esphome/components/api/api_overflow_buffer.cpp

@@ -1,98 +1,91 @@
 #include "api_overflow_buffer.h"
 #ifdef USE_API
 #include <cstring>
-#include <new>
 
 namespace esphome::api {
 
-APIOverflowBuffer::~APIOverflowBuffer() {
-  for (auto *entry : this->queue_) {
-    if (entry != nullptr)
-      Entry::destroy(entry);
-  }
-}
-
 ssize_t APIOverflowBuffer::try_drain(socket::Socket *socket) {
-  // socket->write() can re-enter this function: a log message emitted from an
-  // lwip callback during the write goes out over the API and lands back in the
-  // frame helper's write/drain path. If a nested drain ran here it would send
-  // and free the entry the outer drain is still holding, causing a double free.
-  // Report "no progress" instead; the outer drain keeps draining, and the
-  // nested send is enqueued behind the existing backlog.
+  // Nested call from inside socket->write(); see draining_
   if (this->draining_)
     return 0;
 
-  // RAII so the flag is cleared on every return path
   struct DrainGuard {
-    explicit DrainGuard(bool &flag) : flag_(flag) { flag_ = true; }
-    ~DrainGuard() { this->flag_ = false; }
-    bool &flag_;
-  } guard(this->draining_);
+    APIOverflowBuffer &owner;
+    ~DrainGuard() { this->owner.draining_ = false; }
+  } guard{*this};
+  this->draining_ = true;
 
   while (this->count_ > 0) {
-    Entry *front = this->queue_[this->head_];
+    uint8_t *msg = this->buf_.data() + this->head_;
+    size_t len = msg[0] | (msg[1] << 8);
 
-    ssize_t sent = socket->write(front->current_data(), front->remaining());
-
-    if (sent <= 0) {
-      // -1 = error (caller checks errno for EWOULDBLOCK vs hard error)
-      // 0 = nothing sent (treat as no progress)
+    ssize_t sent = socket->write(msg + LEN_PREFIX, len);
+    if (sent <= 0)
+      return sent;
+    if (static_cast<size_t>(sent) < len) {
+      // Step past the sent bytes and rewrite the prefix there; it lands on bytes already sent
+      this->head_ += sent;
+      len -= sent;
+      msg += sent;
+      msg[0] = len;
+      msg[1] = len >> 8;
       return sent;
     }
-
-    if (static_cast<uint16_t>(sent) < front->remaining()) {
-      // Partially sent, update offset and stop
-      front->offset += static_cast<uint16_t>(sent);
-      return sent;
-    }
-
-    // Entry fully sent — unlink it before freeing so a freed pointer is never
-    // reachable from the queue
-    this->queue_[this->head_] = nullptr;
-    this->head_ = (this->head_ + 1) % API_MAX_SEND_QUEUE;
+    this->head_ += LEN_PREFIX + len;
     this->count_--;
-    Entry::destroy(front);
   }
 
-  return 0;  // All drained
+  this->head_ = 0;
+  if (this->release_when_drained_) {
+    this->release_when_drained_ = false;
+    this->buf_.release();
+  } else {
+    this->buf_.clear();
+  }
+  return 0;
 }
 
-bool APIOverflowBuffer::enqueue_iov(const struct iovec *iov, int iovcnt, uint16_t total_len, uint16_t skip) {
+bool APIOverflowBuffer::enqueue_iov(const struct iovec *iov, int iovcnt, size_t total_len, size_t skip) {
   if (this->count_ >= API_MAX_SEND_QUEUE)
     return false;
 
-  uint16_t buffer_size = total_len - skip;
-  // nothrow: a failed allocation returns nullptr so the connection is dropped
-  // cleanly instead of plain new's crash or abort on OOM
-  // NOLINTNEXTLINE(cppcoreguidelines-owning-memory)
-  auto *data = new (std::nothrow) uint8_t[buffer_size];
-  if (data == nullptr)
-    return false;
-  // NOLINTNEXTLINE(cppcoreguidelines-owning-memory)
-  auto *entry = new (std::nothrow) Entry{data, buffer_size, 0};
-  if (entry == nullptr) {
-    delete[] data;
+  const size_t new_len = total_len - skip;
+  const size_t new_bytes = LEN_PREFIX + new_len;
+  const size_t live = this->buf_.size() - this->head_;
+  // A lone message is only bound by the buffer; refusing it would just drop the connection
+  if (live + new_bytes > (this->count_ > 0 ? MAX_BYTES : MAX_LONE_BYTES))
     return false;
+
+  if (this->buf_.size() + new_bytes > this->buf_.capacity()) {
+    // Storage would move under an outer drain's write()
+    if (this->draining_)
+      return false;
+    if (this->head_ > 0) {
+      // Reclaim the sent prefix before growing
+      this->buf_.drop_front(this->head_);
+      this->head_ = 0;
+    }
+    if (!this->buf_.reserve(reserve_for(live + new_bytes)))
+      return false;
   }
 
-  uint16_t to_skip = skip;
-  uint16_t write_pos = 0;
-
-  for (int i = 0; i < iovcnt; i++) {
-    if (to_skip >= iov[i].iov_len) {
-      to_skip -= static_cast<uint16_t>(iov[i].iov_len);
+  uint8_t *dst = this->buf_.append(new_bytes);
+  if (dst == nullptr)
+    return false;
+  dst[0] = new_len;
+  dst[1] = new_len >> 8;
+  dst += LEN_PREFIX;
+  for (const struct iovec *end = iov + iovcnt; iov != end; iov++) {
+    if (skip >= iov->iov_len) {
+      skip -= iov->iov_len;
     } else {
-      const uint8_t *src = reinterpret_cast<uint8_t *>(iov[i].iov_base) + to_skip;
-      uint16_t len = static_cast<uint16_t>(iov[i].iov_len) - to_skip;
-      std::memcpy(entry->data + write_pos, src, len);
-      write_pos += len;
-      to_skip = 0;
+      const size_t len = iov->iov_len - skip;
+      std::memcpy(dst, static_cast<const uint8_t *>(iov->iov_base) + skip, len);
+      dst += len;
+      skip = 0;
     }
   }
 
-  // Publish only after the copy completes so a half-built entry is never reachable
-  this->queue_[this->tail_] = entry;
-  this->tail_ = (this->tail_ + 1) % API_MAX_SEND_QUEUE;
   this->count_++;
   return true;
 }

esphome/components/api/api_overflow_buffer.h

@@ -1,5 +1,6 @@
 #pragma once
-#include <array>
+#include <algorithm>
+#include <cstddef>
 #include <cstdint>
 #include <sys/types.h>
 
@@ -8,71 +9,57 @@
 
 #include "esphome/components/socket/headers.h"
 #include "esphome/components/socket/socket.h"
-#include "esphome/core/helpers.h"
+#include "api_buffer.h"
 
 namespace esphome::api {
 
-/// Circular queue of heap-allocated byte buffers used as a TCP send backlog.
-///
-/// Under normal operation this buffer is **never used** — data goes straight
-/// from the frame helper to the socket.  It only fills when the LWIP TCP
-/// send buffer is full (slow client, congested network, heavy logging).
-/// The queue drains automatically on subsequent write/loop calls once the
-/// socket becomes writable again.
-///
-/// Capacity is compile-time-fixed via API_MAX_SEND_QUEUE (set from Python
-/// config).  If the queue fills completely the connection is marked failed.
+/// TCP send backlog, only used when the socket send buffer is full.
+/// One contiguous buffer per connection, allocated on the first stall and
+/// kept at its high-water mark so a lossy link does not churn the heap.
+/// Messages are stored as a 2 byte length prefix plus payload.
+/// API_MAX_SEND_QUEUE bounds queued messages and, at 2 KB per slot, queued
+/// bytes; exceeding either fails the connection.
 class APIOverflowBuffer {
  public:
-  /// A single heap-allocated send-backlog entry.
-  /// Lifetime is manually managed — see destroy().
-  struct Entry {
-    uint8_t *data;
-    uint16_t size;    // Total size of the buffer
-    uint16_t offset;  // Current send offset within the buffer
-
-    uint16_t remaining() const { return this->size - this->offset; }
-    const uint8_t *current_data() const { return this->data + this->offset; }
-
-    /// Free this entry and its data buffer.
-    static ESPHOME_ALWAYS_INLINE void destroy(Entry *entry) {
-      delete[] entry->data;
-      delete entry;  // NOLINT(cppcoreguidelines-owning-memory)
-    }
-  };
-
-  ~APIOverflowBuffer();
-
   /// True when no backlogged data is waiting.
   bool empty() const { return this->count_ == 0; }
 
-  /// True when the queue has no room for another entry.
-  bool full() const { return this->count_ >= API_MAX_SEND_QUEUE; }
-
-  /// Number of entries currently queued.
-  uint8_t count() const { return this->count_; }
-
-  /// Try to drain queued data to the socket.
-  /// Returns bytes-written > 0 on success/partial, 0 if all drained or no progress,
-  /// -1 on error (caller must check errno to distinguish EWOULDBLOCK from hard errors).
-  /// Callers only need to act on -1; 0 and positive values both mean "no error".
-  /// Frees entries as they are fully sent.
+  /// Drain queued messages to the socket.
+  /// Returns bytes written, 0 for a re-entrant call, -1 on error (check errno
+  /// for EWOULDBLOCK); callers only need to act on -1.
   ssize_t try_drain(socket::Socket *socket);
 
-  /// Enqueue unsent IOV data into the backlog.
-  /// Copies iov data starting at byte offset `skip` into a new entry.
-  /// Returns false if the queue is full or allocation fails (caller should fail the connection).
-  bool enqueue_iov(const struct iovec *iov, int iovcnt, uint16_t total_len, uint16_t skip);
+  /// Queue iov data from byte offset `skip` as one message.
+  /// Returns false when a limit is hit, allocation fails, or storage would move
+  /// during a drain; the caller should fail the connection.
+  bool enqueue_iov(const struct iovec *iov, int iovcnt, size_t total_len, size_t skip);
+
+  /// Free the retained storage, now if empty, otherwise once it has drained.
+  void release() {
+    if (this->count_ == 0) {
+      this->buf_.release();
+    } else {
+      this->release_when_drained_ = true;
+    }
+  }
 
  protected:
-  std::array<Entry *, API_MAX_SEND_QUEUE> queue_{};
-  uint8_t head_{0};
-  uint8_t tail_{0};
+  static constexpr size_t LEN_PREFIX = 2;
+  static constexpr size_t BYTES_PER_SLOT = 2048;
+  // Reserve in 256 byte steps so a creeping high-water mark settles quickly
+  static constexpr size_t GROW_QUANTUM = 256;
+  // Lone message ceiling, rounded down so reserve_for() never exceeds the buffer limit
+  static constexpr size_t MAX_LONE_BYTES = APIBuffer::MAX_SIZE & ~(GROW_QUANTUM - 1);
+  static constexpr size_t MAX_BYTES = std::min(API_MAX_SEND_QUEUE * BYTES_PER_SLOT, MAX_LONE_BYTES);
+  static constexpr size_t reserve_for(size_t want) { return (want + GROW_QUANTUM - 1) & ~(GROW_QUANTUM - 1); }
+
+  APIBuffer buf_;
+  uint16_t head_{0};  // offset of the front message's length prefix; bytes before it are sent
   uint8_t count_{0};
-  // Guards against re-entrant drains: socket->write() can re-enter the API
-  // send path (e.g. a log message emitted from an lwip callback), and a nested
-  // drain would free the entry the outer drain is still holding.
-  bool draining_{false};
+  // socket->write() can re-enter the send path (log from an lwip callback):
+  // a nested drain makes no progress and a nested enqueue never moves storage
+  bool draining_ : 1 {false};
+  bool release_when_drained_ : 1 {false};
 };
 
 }  // namespace esphome::api

esphome/components/api/api_server.cpp

@@ -41,13 +41,13 @@ void APIServer::setup() {
   ControllerRegistry::register_controller(this);
 
 #ifdef USE_API_NOISE
+  // Always reserve the slot: flash preferences are positional on esp8266, so
+  // a yaml key build must keep the layout of a runtime key build
   uint32_t hash = 88491486UL;
-
   this->noise_pref_ = global_preferences->make_preference<SavedNoisePsk>(hash, true);
-
 #ifndef USE_API_NOISE_PSK_FROM_YAML
-  // Only load saved PSK if not set from YAML
-  if (this->load_and_apply_noise_psk_()) {
+  // A cleared record loads fine but holds no key
+  if (this->load_and_apply_noise_psk_() && this->noise_ctx_.has_psk()) {
     ESP_LOGD(TAG, "Loaded saved Noise PSK");
   }
 #endif
@@ -550,6 +550,7 @@ const std::vector<APIServer::HomeAssistantStateSubscription> &APIServer::get_sta
 #endif
 
 #ifdef USE_API_NOISE
+#ifndef USE_API_NOISE_PSK_FROM_YAML
 bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString *save_log_msg,
                                   const LogString *fail_log_msg, bool make_active) {
   if (!this->noise_pref_.save(&new_psk)) {
@@ -583,22 +584,19 @@ bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString
 }
 
 bool APIServer::load_and_apply_noise_psk_() {
-  SavedNoisePsk saved{};
-  if (!this->noise_pref_.load(&saved))
+  // Load into a temp so a failed read cannot disturb the key in use
+  SavedNoisePsk loaded{};
+  if (!this->noise_pref_.load(&loaded))
     return false;
-  this->set_noise_psk(saved.psk);
+  this->saved_psk_ = loaded;
+  // An unprovisioned device stores the reserved all-zeros key, which is no key
+  const bool has_key = !noise::NoiseContext::is_all_zeros(this->saved_psk_.psk);
+  this->noise_ctx_.set_psk(has_key ? this->saved_psk_.psk.data() : nullptr);
   return true;
 }
 
 bool APIServer::save_noise_psk(noise::psk_t psk, bool make_active) {
-#ifdef USE_API_NOISE_PSK_FROM_YAML
-  // When PSK is set from YAML, this function should never be called
-  // but if it is, reject the change
-  ESP_LOGW(TAG, "Key set in YAML");
-  return false;
-#else
-  auto &old_psk = this->noise_ctx_.get_psk();
-  if (std::equal(old_psk.begin(), old_psk.end(), psk.begin())) {
+  if (this->saved_psk_.psk == psk) {
     ESP_LOGW(TAG, "New PSK matches old");
     return true;
   }
@@ -614,15 +612,8 @@ bool APIServer::save_noise_psk(noise::psk_t psk, bool make_active) {
   }
 #endif
   return result;
-#endif
 }
 bool APIServer::clear_noise_psk(bool make_active) {
-#ifdef USE_API_NOISE_PSK_FROM_YAML
-  // When PSK is set from YAML, this function should never be called
-  // but if it is, reject the change
-  ESP_LOGW(TAG, "Key set in YAML");
-  return false;
-#else
   SavedNoisePsk empty_psk{};
   bool result = this->update_noise_psk_(empty_psk, LOG_STR("Noise PSK cleared"), LOG_STR("Failed to clear Noise PSK"),
                                         make_active);
@@ -634,8 +625,8 @@ bool APIServer::clear_noise_psk(bool make_active) {
   }
 #endif
   return result;
-#endif
 }
+#endif  // USE_API_NOISE_PSK_FROM_YAML
 #endif
 
 #ifdef USE_HOMEASSISTANT_TIME

esphome/components/api/api_server.h

@@ -76,9 +76,14 @@ class APIServer final : public Component,
   APIBuffer &get_shared_buffer_ref() { return shared_write_buffer_; }
 
 #ifdef USE_API_NOISE
+#ifndef USE_API_NOISE_PSK_FROM_YAML
+  // Runtime key changes exist for the provisioning path only (not lambdas);
+  // with a yaml key they compile out
   bool save_noise_psk(noise::psk_t psk, bool make_active = true);
   bool clear_noise_psk(bool make_active = true);
-  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
+#endif
+  /// psk points at 32 bytes that live in flash for the life of the program
+  void set_noise_psk(const uint8_t *psk) { this->noise_ctx_.set_psk(psk); }
   noise::NoiseContext &get_noise_ctx() { return this->noise_ctx_; }
 #endif  // USE_API_NOISE
 
@@ -275,10 +280,12 @@ class APIServer final : public Component,
 #endif
 
 #ifdef USE_API_NOISE
+#ifndef USE_API_NOISE_PSK_FROM_YAML
   bool update_noise_psk_(const SavedNoisePsk &new_psk, const LogString *save_log_msg, const LogString *fail_log_msg,
                          bool make_active);
   // Load saved PSK from preferences and apply it. Returns true on success.
   bool load_and_apply_noise_psk_();
+#endif  // USE_API_NOISE_PSK_FROM_YAML
 #endif  // USE_API_NOISE
 #ifdef USE_API_HOMEASSISTANT_STATES
   // Helper methods to reduce code duplication
@@ -358,6 +365,9 @@ class APIServer final : public Component,
 
 #ifdef USE_API_NOISE
   noise::NoiseContext noise_ctx_;
+#ifndef USE_API_NOISE_PSK_FROM_YAML
+  SavedNoisePsk saved_psk_{};  // backs noise_ctx_ for a runtime provisioned key
+#endif
   ESPPreferenceObject noise_pref_;
 #endif  // USE_API_NOISE
 };

esphome/components/atm90e32/atm90e32.cpp

@@ -9,6 +9,10 @@ namespace esphome::atm90e32 {
 
 static const char *const TAG = "atm90e32";
 
+static const LogString *offset_calibration_name(bool power_offsets) {
+  return power_offsets ? LOG_STR("Power offset") : LOG_STR("Offset");
+}
+
 static uint32_t pref_hash(const char *prefix, const char *name_space) {
   auto hash = fnv1_hash(prefix);
   return fnv1_hash_extend(hash, name_space);
@@ -203,13 +207,12 @@ void ATM90E32Component::setup() {
 
     // Initialize flash storage for power offset calibrations
     uint32_t po_hash = pref_hash("_power_offset_calibration_", cs);
-    this->power_offset_pref_ = global_preferences->make_preference<PowerOffsetCalibration[3]>(po_hash, true);
+    this->power_offset_pref_ = global_preferences->make_preference<OffsetCalibration[3]>(po_hash, true);
     bool migrated_power_offset = false;
     if (has_distinct_legacy_namespace) {
       uint32_t legacy_po_hash = pref_hash("_power_offset_calibration_", legacy_cs);
-      auto legacy_power_offset_pref =
-          global_preferences->make_preference<PowerOffsetCalibration[3]>(legacy_po_hash, true);
-      PowerOffsetCalibration power_offset_data[3]{};
+      auto legacy_power_offset_pref = global_preferences->make_preference<OffsetCalibration[3]>(legacy_po_hash, true);
+      OffsetCalibration power_offset_data[3]{};
       int migration_status =
           migrate_legacy_pref_if_needed(this->power_offset_pref_, legacy_power_offset_pref, &power_offset_data);
       migrated_power_offset = migration_status > 0;
@@ -224,20 +227,20 @@ void ATM90E32Component::setup() {
       global_preferences->sync();
     }
 
-    this->restore_offset_calibrations_();
-    this->restore_power_offset_calibrations_();
+    this->restore_offset_calibrations_(OffsetCalibrationType::OFFSET_CALIBRATION_TYPE_VOLTAGE_CURRENT);
+    this->restore_offset_calibrations_(OffsetCalibrationType::OFFSET_CALIBRATION_TYPE_POWER);
   } else {
     ESP_LOGI(TAG, "[CALIBRATION][%s] Power & Voltage/Current offset calibration is disabled. Using config file values.",
              cs);
     for (uint8_t phase = 0; phase < 3; ++phase) {
       this->write16_(this->voltage_offset_registers[phase],
-                     static_cast<uint16_t>(this->offset_phase_[phase].voltage_offset_));
+                     static_cast<uint16_t>(this->offset_phase_[phase].first_offset));
       this->write16_(this->current_offset_registers[phase],
-                     static_cast<uint16_t>(this->offset_phase_[phase].current_offset_));
+                     static_cast<uint16_t>(this->offset_phase_[phase].second_offset));
       this->write16_(this->power_offset_registers[phase],
-                     static_cast<uint16_t>(this->power_offset_phase_[phase].active_power_offset));
+                     static_cast<uint16_t>(this->power_offset_phase_[phase].first_offset));
       this->write16_(this->reactive_power_offset_registers[phase],
-                     static_cast<uint16_t>(this->power_offset_phase_[phase].reactive_power_offset));
+                     static_cast<uint16_t>(this->power_offset_phase_[phase].second_offset));
     }
   }
 
@@ -317,8 +320,8 @@ void ATM90E32Component::log_calibration_status_() {
              cs);
     for (uint8_t phase = 0; phase < 3; ++phase) {
       ESP_LOGW(TAG, "[CALIBRATION][%s] |   %c   |  %6d  | %6d  |  %6d  | %6d  |", cs, 'A' + phase,
-               this->config_offset_phase_[phase].voltage_offset_, this->offset_phase_[phase].voltage_offset_,
-               this->config_offset_phase_[phase].current_offset_, this->offset_phase_[phase].current_offset_);
+               this->config_offset_phase_[phase].first_offset, this->offset_phase_[phase].first_offset,
+               this->config_offset_phase_[phase].second_offset, this->offset_phase_[phase].second_offset);
     }
     ESP_LOGW(TAG,
              "[CALIBRATION][%s] ===============================================================================", cs);
@@ -335,10 +338,8 @@ void ATM90E32Component::log_calibration_status_() {
              cs);
     for (uint8_t phase = 0; phase < 3; ++phase) {
       ESP_LOGW(TAG, "[CALIBRATION][%s] |   %c   |  %6d  | %6d  |  %6d  | %6d  |", cs, 'A' + phase,
-               this->config_power_offset_phase_[phase].active_power_offset,
-               this->power_offset_phase_[phase].active_power_offset,
-               this->config_power_offset_phase_[phase].reactive_power_offset,
-               this->power_offset_phase_[phase].reactive_power_offset);
+               this->config_power_offset_phase_[phase].first_offset, this->power_offset_phase_[phase].first_offset,
+               this->config_power_offset_phase_[phase].second_offset, this->power_offset_phase_[phase].second_offset);
     }
     ESP_LOGW(TAG,
              "[CALIBRATION][%s] ===============================================================================", cs);
@@ -372,7 +373,7 @@ void ATM90E32Component::log_calibration_status_() {
     ESP_LOGI(TAG, "[CALIBRATION][%s] --------------------------------------------------------------", cs);
     for (uint8_t phase = 0; phase < 3; phase++) {
       ESP_LOGI(TAG, "[CALIBRATION][%s] |   %c   |     %6d      |     %6d      |", cs, 'A' + phase,
-               this->offset_phase_[phase].voltage_offset_, this->offset_phase_[phase].current_offset_);
+               this->offset_phase_[phase].first_offset, this->offset_phase_[phase].second_offset);
     }
     ESP_LOGI(TAG, "[CALIBRATION][%s] ==============================================================\\n", cs);
   }
@@ -385,8 +386,7 @@ void ATM90E32Component::log_calibration_status_() {
     ESP_LOGI(TAG, "[CALIBRATION][%s] ---------------------------------------------------------------------", cs);
     for (uint8_t phase = 0; phase < 3; phase++) {
       ESP_LOGI(TAG, "[CALIBRATION][%s] |   %c   |       %6d        |        %6d        |", cs, 'A' + phase,
-               this->power_offset_phase_[phase].active_power_offset,
-               this->power_offset_phase_[phase].reactive_power_offset);
+               this->power_offset_phase_[phase].first_offset, this->power_offset_phase_[phase].second_offset);
     }
     ESP_LOGI(TAG, "[CALIBRATION][%s] =====================================================================\n", cs);
   }
@@ -756,36 +756,68 @@ void ATM90E32Component::save_gain_calibration_to_memory_() {
   }
 }
 
-void ATM90E32Component::save_offset_calibration_to_memory_() {
+void ATM90E32Component::finish_offset_calibration_(const OffsetCalibration (&previous)[3], bool previous_restored,
+                                                   bool previous_using_saved, OffsetCalibrationType type) {
+  const bool power_offsets = type == OffsetCalibrationType::OFFSET_CALIBRATION_TYPE_POWER;
   const char *cs = this->get_calibration_id_();
-  bool success = this->offset_pref_.save(&this->offset_phase_);
-  global_preferences->sync();
-  if (success) {
-    this->using_saved_calibrations_ = true;
-    this->restored_offset_calibration_ = true;
-    for (bool &phase : this->offset_calibration_mismatch_)
-      phase = false;
-    ESP_LOGI(TAG, "[CALIBRATION][%s] Offset calibration saved to memory.", cs);
-  } else {
-    this->using_saved_calibrations_ = false;
-    ESP_LOGE(TAG, "[CALIBRATION][%s] Failed to save offset calibration to memory!", cs);
-  }
-}
+  const LogString *name = offset_calibration_name(power_offsets);
+  OffsetCalibration(*offsets)[3] = power_offsets ? &this->power_offset_phase_ : &this->offset_phase_;
+  ESPPreferenceObject *preference = power_offsets ? &this->power_offset_pref_ : &this->offset_pref_;
+  bool *has_stored =
+      power_offsets ? &this->has_stored_power_offset_calibration_ : &this->has_stored_offset_calibration_;
+  bool *restored = power_offsets ? &this->restored_power_offset_calibration_ : &this->restored_offset_calibration_;
+  bool *mismatches = power_offsets ? this->power_offset_calibration_mismatch_ : this->offset_calibration_mismatch_;
 
-void ATM90E32Component::save_power_offset_calibration_to_memory_() {
-  const char *cs = this->get_calibration_id_();
-  bool success = this->power_offset_pref_.save(&this->power_offset_phase_);
-  global_preferences->sync();
-  if (success) {
-    this->using_saved_calibrations_ = true;
-    this->restored_power_offset_calibration_ = true;
-    for (bool &phase : this->power_offset_calibration_mismatch_)
-      phase = false;
-    ESP_LOGI(TAG, "[CALIBRATION][%s] Power offset calibration saved to memory.", cs);
-  } else {
-    this->using_saved_calibrations_ = false;
-    ESP_LOGE(TAG, "[CALIBRATION][%s] Failed to save power offset calibration to memory!", cs);
+  const bool writes_verified = this->verify_offset_writes_(type);
+  bool saved = false;
+  bool synced = false;
+  if (writes_verified) {
+    saved = preference->save(offsets);
+    synced = global_preferences->sync();
   }
+
+  if (writes_verified && saved && synced) {
+    this->using_saved_calibrations_ = true;
+    *has_stored = true;
+    *restored = true;
+    for (uint8_t phase = 0; phase < 3; phase++)
+      mismatches[phase] = false;
+    ESP_LOGI(TAG, "[CALIBRATION][%s] %s calibration saved to memory. %s calibration completed and verified.", cs,
+             LOG_STR_ARG(name), LOG_STR_ARG(name));
+    return;
+  }
+
+  if (writes_verified) {
+    ESP_LOGE(TAG, "[CALIBRATION][%s] Failed to save %s calibration to memory!", cs, LOG_STR_ARG(name));
+  }
+
+  for (uint8_t phase = 0; phase < 3; phase++) {
+    this->write_offsets_to_registers_(phase, previous[phase].first_offset, previous[phase].second_offset, type);
+  }
+  const bool rollback_verified = this->verify_offset_writes_(type);
+
+  bool rollback_persisted = false;
+  if (writes_verified) {
+    OffsetCalibration rollback[3]{};
+    prepare_offset_rollback(previous, previous_restored, rollback);
+    const bool rollback_saved = preference->save(&rollback);
+    const bool rollback_synced = global_preferences->sync();
+    rollback_persisted = rollback_saved && rollback_synced;
+    if (!rollback_saved || !rollback_synced) {
+      ESP_LOGE(TAG, "[CALIBRATION][%s] Failed to persist restored %s calibration values!", cs, LOG_STR_ARG(name));
+    }
+  }
+
+  *restored = previous_restored;
+  if (rollback_persisted)
+    *has_stored = previous_restored;
+  this->using_saved_calibrations_ = previous_using_saved;
+  if (!rollback_verified) {
+    ESP_LOGE(TAG, "[CALIBRATION][%s] %s calibration failed; rollback readback verification failed.", cs,
+             LOG_STR_ARG(name));
+    return;
+  }
+  ESP_LOGE(TAG, "[CALIBRATION][%s] %s calibration failed; previous values restored.", cs, LOG_STR_ARG(name));
 }
 
 void ATM90E32Component::run_offset_calibrations() {
@@ -803,11 +835,16 @@ void ATM90E32Component::run_offset_calibrations() {
   ESP_LOGI(TAG, "[CALIBRATION][%s] | Phase | offset_voltage | offset_current |", cs);
   ESP_LOGI(TAG, "[CALIBRATION][%s] ------------------------------------------------------------------", cs);
 
+  OffsetCalibration previous_offsets[3] = {this->offset_phase_[0], this->offset_phase_[1], this->offset_phase_[2]};
+  const bool previous_restored = this->restored_offset_calibration_;
+  const bool previous_using_saved = this->using_saved_calibrations_;
+
   for (uint8_t phase = 0; phase < 3; phase++) {
     int16_t voltage_offset = calibrate_offset(phase, true);
     int16_t current_offset = calibrate_offset(phase, false);
 
-    this->write_offsets_to_registers_(phase, voltage_offset, current_offset);
+    this->write_offsets_to_registers_(phase, voltage_offset, current_offset,
+                                      OffsetCalibrationType::OFFSET_CALIBRATION_TYPE_VOLTAGE_CURRENT);
 
     ESP_LOGI(TAG, "[CALIBRATION][%s] |   %c   |     %6d      |     %6d      |", cs, 'A' + phase, voltage_offset,
              current_offset);
@@ -815,7 +852,8 @@ void ATM90E32Component::run_offset_calibrations() {
 
   ESP_LOGI(TAG, "[CALIBRATION][%s] ==================================================================\n", cs);
 
-  this->save_offset_calibration_to_memory_();
+  this->finish_offset_calibration_(previous_offsets, previous_restored, previous_using_saved,
+                                   OffsetCalibrationType::OFFSET_CALIBRATION_TYPE_VOLTAGE_CURRENT);
 }
 
 void ATM90E32Component::run_power_offset_calibrations() {
@@ -834,18 +872,25 @@ void ATM90E32Component::run_power_offset_calibrations() {
   ESP_LOGI(TAG, "[CALIBRATION][%s] | Phase | offset_active_power | offset_reactive_power |", cs);
   ESP_LOGI(TAG, "[CALIBRATION][%s] ---------------------------------------------------------------------", cs);
 
+  OffsetCalibration previous_offsets[3] = {this->power_offset_phase_[0], this->power_offset_phase_[1],
+                                           this->power_offset_phase_[2]};
+  const bool previous_restored = this->restored_power_offset_calibration_;
+  const bool previous_using_saved = this->using_saved_calibrations_;
+
   for (uint8_t phase = 0; phase < 3; ++phase) {
     int16_t active_offset = calibrate_power_offset(phase, false);
     int16_t reactive_offset = calibrate_power_offset(phase, true);
 
-    this->write_power_offsets_to_registers_(phase, active_offset, reactive_offset);
+    this->write_offsets_to_registers_(phase, active_offset, reactive_offset,
+                                      OffsetCalibrationType::OFFSET_CALIBRATION_TYPE_POWER);
 
     ESP_LOGI(TAG, "[CALIBRATION][%s] |   %c   |       %6d        |        %6d        |", cs, 'A' + phase, active_offset,
              reactive_offset);
   }
   ESP_LOGI(TAG, "[CALIBRATION][%s] =====================================================================\n", cs);
 
-  this->save_power_offset_calibration_to_memory_();
+  this->finish_offset_calibration_(previous_offsets, previous_restored, previous_using_saved,
+                                   OffsetCalibrationType::OFFSET_CALIBRATION_TYPE_POWER);
 }
 
 void ATM90E32Component::write_gains_to_registers_() {
@@ -859,35 +904,26 @@ void ATM90E32Component::write_gains_to_registers_() {
   this->write16_(ATM90E32_REGISTER_CFGREGACCEN, 0x0000);
 }
 
-void ATM90E32Component::write_offsets_to_registers_(uint8_t phase, int16_t voltage_offset, int16_t current_offset) {
-  // Save to runtime
-  this->offset_phase_[phase].voltage_offset_ = voltage_offset;
-  this->phase_[phase].voltage_offset_ = voltage_offset;
+void ATM90E32Component::write_offsets_to_registers_(uint8_t phase, int16_t first_offset, int16_t second_offset,
+                                                    OffsetCalibrationType type) {
+  const bool power_offsets = type == OffsetCalibrationType::OFFSET_CALIBRATION_TYPE_POWER;
+  OffsetCalibration &offsets = power_offsets ? this->power_offset_phase_[phase] : this->offset_phase_[phase];
+  offsets.first_offset = first_offset;
+  offsets.second_offset = second_offset;
+  if (power_offsets) {
+    this->phase_[phase].active_power_offset_ = first_offset;
+    this->phase_[phase].reactive_power_offset_ = second_offset;
+  } else {
+    this->phase_[phase].voltage_offset_ = first_offset;
+    this->phase_[phase].current_offset_ = second_offset;
+  }
 
-  // Save to flash-storable struct
-  this->offset_phase_[phase].current_offset_ = current_offset;
-  this->phase_[phase].current_offset_ = current_offset;
-
-  // Write to registers
+  const uint16_t *first_registers = power_offsets ? this->power_offset_registers : this->voltage_offset_registers;
+  const uint16_t *second_registers =
+      power_offsets ? this->reactive_power_offset_registers : this->current_offset_registers;
   this->write16_(ATM90E32_REGISTER_CFGREGACCEN, 0x55AA);
-  this->write16_(voltage_offset_registers[phase], static_cast<uint16_t>(voltage_offset));
-  this->write16_(current_offset_registers[phase], static_cast<uint16_t>(current_offset));
-  this->write16_(ATM90E32_REGISTER_CFGREGACCEN, 0x0000);
-}
-
-void ATM90E32Component::write_power_offsets_to_registers_(uint8_t phase, int16_t p_offset, int16_t q_offset) {
-  // Save to runtime
-  this->phase_[phase].active_power_offset_ = p_offset;
-  this->phase_[phase].reactive_power_offset_ = q_offset;
-
-  // Save to flash-storable struct
-  this->power_offset_phase_[phase].active_power_offset = p_offset;
-  this->power_offset_phase_[phase].reactive_power_offset = q_offset;
-
-  // Write to registers
-  this->write16_(ATM90E32_REGISTER_CFGREGACCEN, 0x55AA);
-  this->write16_(this->power_offset_registers[phase], static_cast<uint16_t>(p_offset));
-  this->write16_(this->reactive_power_offset_registers[phase], static_cast<uint16_t>(q_offset));
+  this->write16_(first_registers[phase], static_cast<uint16_t>(first_offset));
+  this->write16_(second_registers[phase], static_cast<uint16_t>(second_offset));
   this->write16_(ATM90E32_REGISTER_CFGREGACCEN, 0x0000);
 }
 
@@ -947,89 +983,78 @@ void ATM90E32Component::restore_gain_calibrations_() {
   ESP_LOGW(TAG, "[CALIBRATION][%s] No stored gain calibrations found. Using config file values.", cs);
 }
 
-void ATM90E32Component::restore_offset_calibrations_() {
+void ATM90E32Component::restore_offset_calibrations_(OffsetCalibrationType type) {
+  const bool power_offsets = type == OffsetCalibrationType::OFFSET_CALIBRATION_TYPE_POWER;
   const char *cs = this->get_calibration_id_();
+  const LogString *name = power_offsets ? LOG_STR("power offset") : LOG_STR("offset");
+  OffsetCalibration(*offsets)[3] = power_offsets ? &this->power_offset_phase_ : &this->offset_phase_;
+  OffsetCalibration(*config_offsets)[3] =
+      power_offsets ? &this->config_power_offset_phase_ : &this->config_offset_phase_;
+  ESPPreferenceObject *preference = power_offsets ? &this->power_offset_pref_ : &this->offset_pref_;
+  bool *has_stored =
+      power_offsets ? &this->has_stored_power_offset_calibration_ : &this->has_stored_offset_calibration_;
+  bool *restored = power_offsets ? &this->restored_power_offset_calibration_ : &this->restored_offset_calibration_;
+  bool *mismatches = power_offsets ? this->power_offset_calibration_mismatch_ : this->offset_calibration_mismatch_;
+  const bool *has_first = power_offsets ? this->has_config_active_power_offset_ : this->has_config_voltage_offset_;
+  const bool *has_second = power_offsets ? this->has_config_reactive_power_offset_ : this->has_config_current_offset_;
+
   for (uint8_t i = 0; i < 3; ++i)
-    this->config_offset_phase_[i] = this->offset_phase_[i];
-
-  bool have_data = this->offset_pref_.load(&this->offset_phase_);
+    (*config_offsets)[i] = (*offsets)[i];
 
+  const bool have_data = preference->load(offsets);
   bool all_zero = true;
   if (have_data) {
-    for (auto &phase : this->offset_phase_) {
-      if (phase.voltage_offset_ != 0 || phase.current_offset_ != 0) {
+    for (const auto &phase : *offsets) {
+      if (phase.first_offset != 0 || phase.second_offset != 0) {
         all_zero = false;
         break;
       }
     }
   }
 
-  if (have_data && !all_zero) {
-    this->restored_offset_calibration_ = true;
-    for (uint8_t phase = 0; phase < 3; phase++) {
-      auto &offset = this->offset_phase_[phase];
-      bool mismatch = false;
-      if (this->has_config_voltage_offset_[phase] &&
-          offset.voltage_offset_ != this->config_offset_phase_[phase].voltage_offset_)
-        mismatch = true;
-      if (this->has_config_current_offset_[phase] &&
-          offset.current_offset_ != this->config_offset_phase_[phase].current_offset_)
-        mismatch = true;
-      if (mismatch)
-        this->offset_calibration_mismatch_[phase] = true;
+  *has_stored = have_data && !all_zero;
+  *restored = false;
+  for (uint8_t phase = 0; phase < 3; phase++) {
+    mismatches[phase] = false;
+    if (*has_stored) {
+      mismatches[phase] =
+          (has_first[phase] && (*offsets)[phase].first_offset != (*config_offsets)[phase].first_offset) ||
+          (has_second[phase] && (*offsets)[phase].second_offset != (*config_offsets)[phase].second_offset);
     }
-  } else {
+  }
+
+  if (!*has_stored) {
     for (uint8_t phase = 0; phase < 3; phase++)
-      this->offset_phase_[phase] = this->config_offset_phase_[phase];
-    ESP_LOGW(TAG, "[CALIBRATION][%s] No stored offset calibrations found. Using default values.", cs);
+      (*offsets)[phase] = (*config_offsets)[phase];
+    ESP_LOGW(TAG, "[CALIBRATION][%s] No stored %s calibrations found. Using default values.", cs, LOG_STR_ARG(name));
   }
 
   for (uint8_t phase = 0; phase < 3; phase++) {
-    write_offsets_to_registers_(phase, this->offset_phase_[phase].voltage_offset_,
-                                this->offset_phase_[phase].current_offset_);
+    this->write_offsets_to_registers_(phase, (*offsets)[phase].first_offset, (*offsets)[phase].second_offset, type);
   }
-}
-
-void ATM90E32Component::restore_power_offset_calibrations_() {
-  const char *cs = this->get_calibration_id_();
-  for (uint8_t i = 0; i < 3; ++i)
-    this->config_power_offset_phase_[i] = this->power_offset_phase_[i];
-
-  bool have_data = this->power_offset_pref_.load(&this->power_offset_phase_);
-
-  bool all_zero = true;
-  if (have_data) {
-    for (auto &phase : this->power_offset_phase_) {
-      if (phase.active_power_offset != 0 || phase.reactive_power_offset != 0) {
-        all_zero = false;
-        break;
-      }
-    }
+  const bool initial_values_verified = this->verify_offset_writes_(type);
+  if (initial_values_verified) {
+    const auto state = resolve_offset_restore_state(*has_stored, true, false);
+    *restored = state.restored;
+    ESP_LOGI(TAG, "[CALIBRATION][%s] %s calibration values verified.", cs, LOG_STR_ARG(name));
+    return;
   }
 
-  if (have_data && !all_zero) {
-    this->restored_power_offset_calibration_ = true;
-    for (uint8_t phase = 0; phase < 3; ++phase) {
-      auto &offset = this->power_offset_phase_[phase];
-      bool mismatch = false;
-      if (this->has_config_active_power_offset_[phase] &&
-          offset.active_power_offset != this->config_power_offset_phase_[phase].active_power_offset)
-        mismatch = true;
-      if (this->has_config_reactive_power_offset_[phase] &&
-          offset.reactive_power_offset != this->config_power_offset_phase_[phase].reactive_power_offset)
-        mismatch = true;
-      if (mismatch)
-        this->power_offset_calibration_mismatch_[phase] = true;
-    }
+  this->using_saved_calibrations_ = false;
+  for (uint8_t phase = 0; phase < 3; phase++)
+    mismatches[phase] = false;
+  for (uint8_t phase = 0; phase < 3; phase++) {
+    (*offsets)[phase] = (*config_offsets)[phase];
+    this->write_offsets_to_registers_(phase, (*offsets)[phase].first_offset, (*offsets)[phase].second_offset, type);
+  }
+  const auto state = resolve_offset_restore_state(*has_stored, false, this->verify_offset_writes_(type));
+  *restored = state.restored;
+  if (state.values_verified) {
+    ESP_LOGE(TAG, "[CALIBRATION][%s] %s calibration restore failed verification; config values verified.", cs,
+             LOG_STR_ARG(name));
   } else {
-    for (uint8_t phase = 0; phase < 3; ++phase)
-      this->power_offset_phase_[phase] = this->config_power_offset_phase_[phase];
-    ESP_LOGW(TAG, "[CALIBRATION][%s] No stored power offsets found. Using default values.", cs);
-  }
-
-  for (uint8_t phase = 0; phase < 3; ++phase) {
-    write_power_offsets_to_registers_(phase, this->power_offset_phase_[phase].active_power_offset,
-                                      this->power_offset_phase_[phase].reactive_power_offset);
+    ESP_LOGE(TAG, "[CALIBRATION][%s] %s calibration restore and config fallback both failed verification.", cs,
+             LOG_STR_ARG(name));
   }
 }
 
@@ -1084,14 +1109,14 @@ void ATM90E32Component::clear_gain_calibrations() {
 
 void ATM90E32Component::clear_offset_calibrations() {
   const char *cs = this->get_calibration_id_();
-  if (!this->restored_offset_calibration_) {
+  if (!this->has_stored_offset_calibration_) {
     ESP_LOGI(TAG, "[CALIBRATION][%s] No stored offset calibrations to clear. Current values:", cs);
     ESP_LOGI(TAG, "[CALIBRATION][%s] --------------------------------------------------------------", cs);
     ESP_LOGI(TAG, "[CALIBRATION][%s] | Phase | offset_voltage | offset_current |", cs);
     ESP_LOGI(TAG, "[CALIBRATION][%s] --------------------------------------------------------------", cs);
     for (uint8_t phase = 0; phase < 3; phase++) {
       ESP_LOGI(TAG, "[CALIBRATION][%s] |   %c   |     %6d      |     %6d      |", cs, 'A' + phase,
-               this->offset_phase_[phase].voltage_offset_, this->offset_phase_[phase].current_offset_);
+               this->offset_phase_[phase].first_offset, this->offset_phase_[phase].second_offset);
     }
     ESP_LOGI(TAG, "[CALIBRATION][%s] ==============================================================\n", cs);
     return;
@@ -1104,10 +1129,11 @@ void ATM90E32Component::clear_offset_calibrations() {
 
   for (uint8_t phase = 0; phase < 3; phase++) {
     int16_t voltage_offset =
-        this->has_config_voltage_offset_[phase] ? this->config_offset_phase_[phase].voltage_offset_ : 0;
+        this->has_config_voltage_offset_[phase] ? this->config_offset_phase_[phase].first_offset : 0;
     int16_t current_offset =
-        this->has_config_current_offset_[phase] ? this->config_offset_phase_[phase].current_offset_ : 0;
-    this->write_offsets_to_registers_(phase, voltage_offset, current_offset);
+        this->has_config_current_offset_[phase] ? this->config_offset_phase_[phase].second_offset : 0;
+    this->write_offsets_to_registers_(phase, voltage_offset, current_offset,
+                                      OffsetCalibrationType::OFFSET_CALIBRATION_TYPE_VOLTAGE_CURRENT);
     ESP_LOGI(TAG, "[CALIBRATION][%s] |   %c   |     %6d      |     %6d      |", cs, 'A' + phase, voltage_offset,
              current_offset);
   }
@@ -1117,6 +1143,7 @@ void ATM90E32Component::clear_offset_calibrations() {
   this->offset_pref_.save(&zero_offsets);  // Clear stored values in flash
   global_preferences->sync();
 
+  this->has_stored_offset_calibration_ = false;
   this->restored_offset_calibration_ = false;
   for (bool &phase : this->offset_calibration_mismatch_)
     phase = false;
@@ -1126,15 +1153,14 @@ void ATM90E32Component::clear_offset_calibrations() {
 
 void ATM90E32Component::clear_power_offset_calibrations() {
   const char *cs = this->get_calibration_id_();
-  if (!this->restored_power_offset_calibration_) {
+  if (!this->has_stored_power_offset_calibration_) {
     ESP_LOGI(TAG, "[CALIBRATION][%s] No stored power offsets to clear. Current values:", cs);
     ESP_LOGI(TAG, "[CALIBRATION][%s] ---------------------------------------------------------------------", cs);
     ESP_LOGI(TAG, "[CALIBRATION][%s] | Phase | offset_active_power | offset_reactive_power |", cs);
     ESP_LOGI(TAG, "[CALIBRATION][%s] ---------------------------------------------------------------------", cs);
     for (uint8_t phase = 0; phase < 3; phase++) {
       ESP_LOGI(TAG, "[CALIBRATION][%s] |   %c   |       %6d        |        %6d        |", cs, 'A' + phase,
-               this->power_offset_phase_[phase].active_power_offset,
-               this->power_offset_phase_[phase].reactive_power_offset);
+               this->power_offset_phase_[phase].first_offset, this->power_offset_phase_[phase].second_offset);
     }
     ESP_LOGI(TAG, "[CALIBRATION][%s] =====================================================================\n", cs);
     return;
@@ -1147,20 +1173,21 @@ void ATM90E32Component::clear_power_offset_calibrations() {
 
   for (uint8_t phase = 0; phase < 3; phase++) {
     int16_t active_offset =
-        this->has_config_active_power_offset_[phase] ? this->config_power_offset_phase_[phase].active_power_offset : 0;
-    int16_t reactive_offset = this->has_config_reactive_power_offset_[phase]
-                                  ? this->config_power_offset_phase_[phase].reactive_power_offset
-                                  : 0;
-    this->write_power_offsets_to_registers_(phase, active_offset, reactive_offset);
+        this->has_config_active_power_offset_[phase] ? this->config_power_offset_phase_[phase].first_offset : 0;
+    int16_t reactive_offset =
+        this->has_config_reactive_power_offset_[phase] ? this->config_power_offset_phase_[phase].second_offset : 0;
+    this->write_offsets_to_registers_(phase, active_offset, reactive_offset,
+                                      OffsetCalibrationType::OFFSET_CALIBRATION_TYPE_POWER);
     ESP_LOGI(TAG, "[CALIBRATION][%s] |   %c   |       %6d        |        %6d        |", cs, 'A' + phase, active_offset,
              reactive_offset);
   }
   ESP_LOGI(TAG, "[CALIBRATION][%s] =====================================================================\n", cs);
 
-  PowerOffsetCalibration zero_power_offsets[3]{{0, 0}, {0, 0}, {0, 0}};
+  OffsetCalibration zero_power_offsets[3]{{0, 0}, {0, 0}, {0, 0}};
   this->power_offset_pref_.save(&zero_power_offsets);
   global_preferences->sync();
 
+  this->has_stored_power_offset_calibration_ = false;
   this->restored_power_offset_calibration_ = false;
   for (bool &phase : this->power_offset_calibration_mismatch_)
     phase = false;
@@ -1215,6 +1242,31 @@ bool ATM90E32Component::verify_gain_writes_() {
   return success;  // Return true if all writes were successful, false otherwise
 }
 
+bool ATM90E32Component::verify_offset_writes_(OffsetCalibrationType type) {
+  const bool power_offsets = type == OffsetCalibrationType::OFFSET_CALIBRATION_TYPE_POWER;
+  const char *cs = this->get_calibration_id_();
+  const LogString *name = offset_calibration_name(power_offsets);
+  const LogString *first_name = power_offsets ? LOG_STR("active") : LOG_STR("voltage");
+  const LogString *second_name = power_offsets ? LOG_STR("reactive") : LOG_STR("current");
+  const OffsetCalibration *offsets = power_offsets ? this->power_offset_phase_ : this->offset_phase_;
+  const uint16_t *first_registers = power_offsets ? this->power_offset_registers : this->voltage_offset_registers;
+  const uint16_t *second_registers =
+      power_offsets ? this->reactive_power_offset_registers : this->current_offset_registers;
+  bool success = true;
+  for (uint8_t phase = 0; phase < 3; phase++) {
+    const uint16_t first = this->read16_(first_registers[phase]);
+    const uint16_t second = this->read16_(second_registers[phase]);
+    if (!offset_register_value_matches(first, offsets[phase].first_offset) ||
+        !offset_register_value_matches(second, offsets[phase].second_offset)) {
+      ESP_LOGE(TAG, "[CALIBRATION][%s] %s readback failed for Phase %s: %s %d/%d, %s %d/%d.", cs, LOG_STR_ARG(name),
+               phase_labels[phase], LOG_STR_ARG(first_name), static_cast<int16_t>(first), offsets[phase].first_offset,
+               LOG_STR_ARG(second_name), static_cast<int16_t>(second), offsets[phase].second_offset);
+      success = false;
+    }
+  }
+  return success;
+}
+
 #ifdef USE_TEXT_SENSOR
 void ATM90E32Component::check_phase_status() {
   uint16_t state0 = this->read16_(ATM90E32_REGISTER_EMMSTATE0);

esphome/components/atm90e32/atm90e32.h

@@ -13,6 +13,40 @@
 
 namespace esphome::atm90e32 {
 
+inline bool offset_register_value_matches(uint16_t actual, int16_t expected) {
+  return actual == static_cast<uint16_t>(expected);
+}
+
+struct OffsetCalibration {
+  int16_t first_offset{0};
+  int16_t second_offset{0};
+};
+
+static_assert(sizeof(OffsetCalibration[3]) == 12, "Offset calibration preference layout must remain compatible");
+
+enum class OffsetCalibrationType : uint8_t {
+  OFFSET_CALIBRATION_TYPE_VOLTAGE_CURRENT,
+  OFFSET_CALIBRATION_TYPE_POWER,
+};
+
+struct OffsetRestoreState {
+  bool restored;
+  bool values_verified;
+};
+
+inline OffsetRestoreState resolve_offset_restore_state(bool has_stored_values, bool initial_values_verified,
+                                                       bool fallback_values_verified) {
+  if (initial_values_verified)
+    return {has_stored_values, true};
+  return {false, fallback_values_verified};
+}
+
+inline void prepare_offset_rollback(const OffsetCalibration (&previous)[3], bool had_stored_values,
+                                    OffsetCalibration (&rollback)[3]) {
+  for (uint8_t phase = 0; phase < 3; phase++)
+    rollback[phase] = had_stored_values ? previous[phase] : OffsetCalibration{};
+}
+
 class ATM90E32Component final : public PollingComponent,
                                 public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_HIGH,
                                                       spi::CLOCK_PHASE_TRAILING, spi::DATA_RATE_1MHZ> {
@@ -71,19 +105,19 @@ class ATM90E32Component final : public PollingComponent,
     this->has_config_current_gain_[phase] = true;
   }
   void set_voltage_offset(uint8_t phase, int16_t offset) {
-    this->offset_phase_[phase].voltage_offset_ = offset;
+    this->offset_phase_[phase].first_offset = offset;
     this->has_config_voltage_offset_[phase] = true;
   }
   void set_current_offset(uint8_t phase, int16_t offset) {
-    this->offset_phase_[phase].current_offset_ = offset;
+    this->offset_phase_[phase].second_offset = offset;
     this->has_config_current_offset_[phase] = true;
   }
   void set_active_power_offset(uint8_t phase, int16_t offset) {
-    this->power_offset_phase_[phase].active_power_offset = offset;
+    this->power_offset_phase_[phase].first_offset = offset;
     this->has_config_active_power_offset_[phase] = true;
   }
   void set_reactive_power_offset(uint8_t phase, int16_t offset) {
-    this->power_offset_phase_[phase].reactive_power_offset = offset;
+    this->power_offset_phase_[phase].second_offset = offset;
     this->has_config_reactive_power_offset_[phase] = true;
   }
   void set_freq_sensor(sensor::Sensor *freq_sensor) { freq_sensor_ = freq_sensor; }
@@ -171,16 +205,16 @@ class ATM90E32Component final : public PollingComponent,
   float get_chip_temperature_();
   bool get_publish_interval_flag_() { return publish_interval_flag_; };
   void set_publish_interval_flag_(bool flag) { publish_interval_flag_ = flag; };
-  void restore_offset_calibrations_();
-  void restore_power_offset_calibrations_();
+  void restore_offset_calibrations_(OffsetCalibrationType type);
   void restore_gain_calibrations_();
-  void save_offset_calibration_to_memory_();
   void save_gain_calibration_to_memory_();
-  void save_power_offset_calibration_to_memory_();
-  void write_offsets_to_registers_(uint8_t phase, int16_t voltage_offset, int16_t current_offset);
-  void write_power_offsets_to_registers_(uint8_t phase, int16_t p_offset, int16_t q_offset);
+  void finish_offset_calibration_(const OffsetCalibration (&previous)[3], bool previous_restored,
+                                  bool previous_using_saved, OffsetCalibrationType type);
+  void write_offsets_to_registers_(uint8_t phase, int16_t first_offset, int16_t second_offset,
+                                   OffsetCalibrationType type);
   void write_gains_to_registers_();
   bool verify_gain_writes_();
+  bool verify_offset_writes_(OffsetCalibrationType type);
   bool validate_spi_read_(uint16_t expected, const char *context = nullptr);
   void log_calibration_status_();
   const char *get_calibration_id_();
@@ -219,19 +253,10 @@ class ATM90E32Component final : public PollingComponent,
     uint32_t cumulative_reverse_active_energy_{0};
   } phase_[3];
 
-  struct OffsetCalibration {
-    int16_t voltage_offset_{0};
-    int16_t current_offset_{0};
-  } offset_phase_[3];
-
+  OffsetCalibration offset_phase_[3];
   OffsetCalibration config_offset_phase_[3];
-
-  struct PowerOffsetCalibration {
-    int16_t active_power_offset{0};
-    int16_t reactive_power_offset{0};
-  } power_offset_phase_[3];
-
-  PowerOffsetCalibration config_power_offset_phase_[3];
+  OffsetCalibration power_offset_phase_[3];
+  OffsetCalibration config_power_offset_phase_[3];
 
   struct GainCalibration {
     uint16_t voltage_gain{1};
@@ -265,6 +290,8 @@ class ATM90E32Component final : public PollingComponent,
   bool enable_offset_calibration_{false};
   bool enable_gain_calibration_{false};
   const char *instance_id_{nullptr};
+  bool has_stored_offset_calibration_{false};
+  bool has_stored_power_offset_calibration_{false};
   bool restored_offset_calibration_{false};
   bool restored_power_offset_calibration_{false};
   bool restored_gain_calibration_{false};

esphome/components/audio/audio_decoder.cpp

@@ -313,9 +313,10 @@ FileDecoderState AudioDecoder::decode_mp3_() {
       this->output_transfer_buffer_->increase_buffer_length(
           this->audio_stream_info_.value().frames_to_bytes(samples_decoded));
     }
-  } else if (result == micro_mp3::MP3_STREAM_INFO_READY) {
-    // First successful header parse: capture stream info and resize the output buffer to fit one full frame.
-    // microMP3 always outputs 16-bit PCM.
+  } else if (result == micro_mp3::MP3_STREAM_INFO_READY || result == micro_mp3::MP3_STREAM_INFO_CHANGED) {
+    // Header parsed: capture stream info and resize the output buffer to fit one full frame.
+    // microMP3 always outputs 16-bit PCM. MP3_STREAM_INFO_CHANGED is handled identically: despite its
+    // negative value it is documented as recoverable, so it must not reach the catch-all below.
     this->audio_stream_info_ =
         audio::AudioStreamInfo(16, this->mp3_decoder_->get_channels(), this->mp3_decoder_->get_sample_rate());
     this->free_buffer_required_ =

esphome/components/audio/audio_reader.cpp

@@ -58,6 +58,9 @@ esp_err_t AudioReader::add_sink(const std::weak_ptr<ring_buffer::RingBuffer> &ou
   if (current_audio_file_ != nullptr) {
     // A transfer buffer isn't ncessary for a local file
     this->file_ring_buffer_ = output_ring_buffer.lock();
+    if (this->file_ring_buffer_ == nullptr) {
+      return ESP_ERR_INVALID_STATE;
+    }
     return ESP_OK;
   }
 

esphome/components/audio/audio_transfer_buffer.cpp

@@ -51,14 +51,14 @@ void AudioTransferBuffer::increase_buffer_length(size_t bytes) { this->buffer_le
 
 void AudioTransferBuffer::clear_buffered_data() {
   this->buffer_length_ = 0;
-  if (this->ring_buffer_.use_count() > 0) {
+  if (this->ring_buffer_ != nullptr) {
     this->ring_buffer_->reset();
   }
 }
 
 void AudioSinkTransferBuffer::clear_buffered_data() {
   this->buffer_length_ = 0;
-  if (this->ring_buffer_.use_count() > 0) {
+  if (this->ring_buffer_ != nullptr) {
     this->ring_buffer_->reset();
   }
 #ifdef USE_SPEAKER
@@ -69,7 +69,7 @@ void AudioSinkTransferBuffer::clear_buffered_data() {
 }
 
 bool AudioTransferBuffer::has_buffered_data() const {
-  if (this->ring_buffer_.use_count() > 0) {
+  if (this->ring_buffer_ != nullptr) {
     return ((this->ring_buffer_->available() > 0) || (this->available() > 0));
   }
   return (this->available() > 0);
@@ -144,7 +144,7 @@ size_t AudioSourceTransferBuffer::transfer_data_from_source(TickType_t ticks_to_
   size_t bytes_to_read = AudioTransferBuffer::free();
   size_t bytes_read = 0;
   if (bytes_to_read > 0) {
-    if (this->ring_buffer_.use_count() > 0) {
+    if (this->ring_buffer_ != nullptr) {
       bytes_read = this->ring_buffer_->read((void *) this->get_buffer_end(), bytes_to_read, ticks_to_wait);
     }
 
@@ -161,7 +161,7 @@ size_t AudioSinkTransferBuffer::transfer_data_to_sink(TickType_t ticks_to_wait,
       bytes_written = this->speaker_->play(this->data_start_, this->available(), ticks_to_wait);
     } else
 #endif
-        if (this->ring_buffer_.use_count() > 0) {
+        if (this->ring_buffer_ != nullptr) {
       bytes_written =
           this->ring_buffer_->write_without_replacement((void *) this->data_start_, this->available(), ticks_to_wait);
     } else if (this->sink_callback_ != nullptr) {
@@ -186,7 +186,7 @@ bool AudioSinkTransferBuffer::has_buffered_data() const {
     return (this->speaker_->has_buffered_data() || (this->available() > 0));
   }
 #endif
-  if (this->ring_buffer_.use_count() > 0) {
+  if (this->ring_buffer_ != nullptr) {
     return ((this->ring_buffer_->available() > 0) || (this->available() > 0));
   }
   return (this->available() > 0);

esphome/components/binary_sensor/__init__.py

@@ -452,7 +452,9 @@ _BINARY_SENSOR_SCHEMA = (
             cv.Optional(
                 CONF_DEVICE_CLASS, visibility=cv.Visibility.ADVANCED
             ): validate_device_class,
-            cv.Optional(CONF_FILTERS): validate_filters,
+            cv.Optional(
+                CONF_FILTERS, visibility=cv.Visibility.ADVANCED
+            ): validate_filters,
             cv.Optional(CONF_ON_PRESS): automation.validate_automation({}),
             cv.Optional(CONF_ON_RELEASE): automation.validate_automation({}),
             cv.Optional(CONF_ON_CLICK): cv.All(

esphome/components/bk72xx_ble/__init__.py

@@ -23,7 +23,7 @@ public ble_api.h.
 import logging
 
 import esphome.codegen as cg
-from esphome.components import libretiny
+from esphome.components import libretiny, wifi
 from esphome.components.libretiny.const import (
     FAMILY_BK7231N,
     FAMILY_BK7231Q,
@@ -84,6 +84,15 @@ def _final_validate(config: ConfigType) -> None:
     # which run on a BLE 4.2 board. The hard error is raised at codegen.
     if msg := _unsupported_family_message(libretiny.get_libretiny_family()):
         _LOGGER.warning("%s (this configuration cannot compile)", msg)
+    # Any wifi power_save_mode other than NONE also arms the Beken SDK's MCU
+    # sleep. With the BLE controller running, that sleep never wakes up once the
+    # station is stopped (adapter restart after failed roams, wifi.disable): the
+    # device is dead until a power cycle (esphome#18592). Keep power save off
+    # until LibreTiny ships the SDK-side fix (libretiny-eu/libretiny#414).
+    wifi.force_power_save_off(
+        "with BLE running, the Beken SDK's MCU sleep halts the device once the "
+        "station is stopped (https://github.com/esphome/esphome/issues/18592)"
+    )
 
 
 FINAL_VALIDATE_SCHEMA = _final_validate

esphome/components/ble_client/automation.h

@@ -22,6 +22,23 @@ class Automation {
   static const char *const TAG;
 };
 
+// Base for nodes that never read the parent's services.
+// The parent releases its services only once every node reports Established, so a node that never
+// reports it keeps that memory allocated for the life of the connection.
+class BLEClientServicelessNode : public BLEClientNode {
+ public:
+  // Final so that Established is always reported on SEARCH_CMPL, before the derived node sees the event.
+  void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if, esp_ble_gattc_cb_param_t *param) final {
+    if (event == ESP_GATTC_SEARCH_CMPL_EVT)
+      this->node_state = espbt::ClientState::ESTABLISHED;
+    this->on_gattc_event(event, gattc_if, param);
+  }
+
+ protected:
+  // Derived nodes handle GATT events here rather than by overriding the handler above.
+  virtual void on_gattc_event(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if, esp_ble_gattc_cb_param_t *param) {}
+};
+
 // implement on_connect automation.
 class BLEClientConnectTrigger final : public Trigger<>, public BLEClientNode {
  public:
@@ -61,7 +78,7 @@ class BLEClientDisconnectTrigger final : public Trigger<>, public BLEClientNode
   }
 };
 
-class BLEClientPasskeyRequestTrigger final : public Trigger<>, public BLEClientNode {
+class BLEClientPasskeyRequestTrigger final : public Trigger<>, public BLEClientServicelessNode {
  public:
   explicit BLEClientPasskeyRequestTrigger(BLEClient *parent) { parent->register_ble_node(this); }
   void loop() override {}
@@ -71,7 +88,7 @@ class BLEClientPasskeyRequestTrigger final : public Trigger<>, public BLEClientN
   }
 };
 
-class BLEClientPasskeyNotificationTrigger final : public Trigger<uint32_t>, public BLEClientNode {
+class BLEClientPasskeyNotificationTrigger final : public Trigger<uint32_t>, public BLEClientServicelessNode {
  public:
   explicit BLEClientPasskeyNotificationTrigger(BLEClient *parent) { parent->register_ble_node(this); }
   void loop() override {}
@@ -82,7 +99,7 @@ class BLEClientPasskeyNotificationTrigger final : public Trigger<uint32_t>, publ
   }
 };
 
-class BLEClientNumericComparisonRequestTrigger final : public Trigger<uint32_t>, public BLEClientNode {
+class BLEClientNumericComparisonRequestTrigger final : public Trigger<uint32_t>, public BLEClientServicelessNode {
  public:
   explicit BLEClientNumericComparisonRequestTrigger(BLEClient *parent) { parent->register_ble_node(this); }
   void loop() override {}
@@ -315,19 +332,17 @@ template<typename... Ts> class BLEClientRemoveBondAction final : public Action<T
   BLEClient *parent_{nullptr};
 };
 
-template<typename... Ts> class BLEClientConnectAction final : public Action<Ts...>, public BLEClientNode {
+template<typename... Ts> class BLEClientConnectAction final : public Action<Ts...>, public BLEClientServicelessNode {
  public:
   BLEClientConnectAction(BLEClient *ble_client) {
     ble_client->register_ble_node(this);
     ble_client_ = ble_client;
   }
-  void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
-                           esp_ble_gattc_cb_param_t *param) override {
+  void on_gattc_event(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if, esp_ble_gattc_cb_param_t *param) override {
     if (this->num_running_ == 0)
       return;
     switch (event) {
       case ESP_GATTC_SEARCH_CMPL_EVT:
-        this->node_state = espbt::ClientState::ESTABLISHED;
         this->parent()->run_later([this]() { this->play_next_tuple_(this->var_); });
         break;
       // if the connection is closed, terminate the automation chain.
@@ -364,14 +379,13 @@ template<typename... Ts> class BLEClientConnectAction final : public Action<Ts..
   std::tuple<Ts...> var_{};
 };
 
-template<typename... Ts> class BLEClientDisconnectAction final : public Action<Ts...>, public BLEClientNode {
+template<typename... Ts> class BLEClientDisconnectAction final : public Action<Ts...>, public BLEClientServicelessNode {
  public:
   BLEClientDisconnectAction(BLEClient *ble_client) {
     ble_client->register_ble_node(this);
     ble_client_ = ble_client;
   }
-  void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
-                           esp_ble_gattc_cb_param_t *param) override {
+  void on_gattc_event(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if, esp_ble_gattc_cb_param_t *param) override {
     if (this->num_running_ == 0)
       return;
     switch (event) {

esphome/components/bluetooth_connection/bluetooth_connection_bluedroid.cpp

@@ -45,15 +45,7 @@ void BluedroidGattClient::setup() {
 
 void BluedroidGattClient::loop() {
   if (!esp32_ble::global_ble->is_active()) {
-    // Stack down: no CLOSE_EVT will come. Settle a live link so the consumer
-    // frees its slot, then re-register the app on the next enable.
-    auto down_st = this->state();
-    if (down_st != ClientState::IDLE && down_st != ClientState::INIT) {
-      this->release_services();
-      this->set_idle_();
-      this->listener_->on_connection_state(false, 0, ble_device_base::GATT_ERR_NOT_CONNECTED);
-    }
-    this->set_state(ClientState::INIT);
+    // ble_before_disabled_event_handler() settles the slot.
     return;
   }
   auto st = this->state();
@@ -65,7 +57,7 @@ void BluedroidGattClient::loop() {
       ESP_LOGE(TAG, "gattc app register failed: app_id=%d code=%d", this->app_id, ret);
       this->mark_failed();
     }
-    // Do not wait for REG_EVT; a dropped event must not wedge the slot.
+    // Do not wait for REG_EVT; connect() rejects until it lands.
     this->set_idle_();
   } else if (st == ClientState::DISCONNECTING || this->disconnect_pending()) {
     // The one teardown safety net: a lost CLOSE_EVT, or a scheduled
@@ -78,8 +70,8 @@ void BluedroidGattClient::loop() {
       this->listener_->on_connection_state(false, 0, ESP_GATT_CONN_TIMEOUT);
     }
   } else {
-    // The loop stays on while a link exists (stack-down watch, pre-started
-    // search flush); it settles only back at IDLE.
+    // The loop stays on while a link exists (pre-started search flush); it
+    // settles only back at IDLE.
     this->deliver_pending_search_();
     if (this->state() == ClientState::IDLE) {
       this->disable_loop();
@@ -87,6 +79,22 @@ void BluedroidGattClient::loop() {
   }
 }
 
+// Stack down: no CLOSE_EVT will come. Settle a live link so the consumer
+// frees its slot, then register the app again on the next enable.
+void BluedroidGattClient::ble_before_disabled_event_handler() {
+  auto st = this->state();
+  if (st != ClientState::IDLE && st != ClientState::INIT) {
+    this->release_services();
+    this->set_idle_();
+    this->listener_->on_connection_state(false, 0, ble_device_base::GATT_ERR_NOT_CONNECTED);
+  }
+  // The interface belongs to the torn-down stack.
+  this->gattc_if_ = ESP_GATT_IF_NONE;
+  this->set_state(ClientState::INIT);
+  // An idle slot runs no loop; the INIT branch must run to register again.
+  this->enable_loop();
+}
+
 void BluedroidGattClient::dump_config() {
   ESP_LOGCONFIG(TAG, "Bluedroid GATT client %d", this->connection_index_);
   if (this->is_failed()) {
@@ -97,6 +105,11 @@ void BluedroidGattClient::dump_config() {
 // ---- contract ops ----
 
 int BluedroidGattClient::connect(uint64_t address, uint8_t addr_type) {
+  if (this->gattc_if_ == ESP_GATT_IF_NONE) {
+    // Bluedroid drops an open on an unknown interface without any event.
+    ESP_LOGW(TAG, "[%d] Connect rejected, GATT app not registered", this->connection_index_);
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  }
   // Only from idle: clobbering DISCONNECTING would open a new link the
   // stale CLOSE_EVT then tears down.
   if (this->state() != ClientState::IDLE) {

esphome/components/bluetooth_connection/bluetooth_connection_bluedroid.h

@@ -56,6 +56,7 @@ class BluedroidGattClient final : public esp32_ble_tracker::ESPBTClient, public
   void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) override;
   void connect() override;
   void disconnect() override;
+  void ble_before_disabled_event_handler() override;
   bool wants_parsed_advertisements() override { return false; }
   void on_scan_end() override {}
   bool parse_device(const ble_device_base::ESPBTDevice &device) override { return false; }

esphome/components/climate/__init__.py

@@ -125,6 +125,19 @@ CLIMATE_SWING_MODES = {
 
 validate_climate_swing_mode = cv.enum(CLIMATE_SWING_MODES, upper=True)
 
+ClimateAction = climate_ns.enum("ClimateAction")
+CLIMATE_ACTIONS = {
+    "OFF": ClimateAction.CLIMATE_ACTION_OFF,
+    "COOLING": ClimateAction.CLIMATE_ACTION_COOLING,
+    "HEATING": ClimateAction.CLIMATE_ACTION_HEATING,
+    "IDLE": ClimateAction.CLIMATE_ACTION_IDLE,
+    "DRYING": ClimateAction.CLIMATE_ACTION_DRYING,
+    "FAN": ClimateAction.CLIMATE_ACTION_FAN,
+    "DEFROSTING": ClimateAction.CLIMATE_ACTION_DEFROSTING,
+}
+
+validate_climate_action = cv.enum(CLIMATE_ACTIONS, upper=True)
+
 CONF_MIN_HUMIDITY = "min_humidity"
 CONF_MAX_HUMIDITY = "max_humidity"
 CONF_TARGET_HUMIDITY = "target_humidity"

esphome/components/dallas_temp/dallas_temp.cpp

@@ -6,6 +6,7 @@ namespace esphome::dallas_temp {
 static const char *const TAG = "dallas.temp.sensor";
 
 static const uint8_t DALLAS_MODEL_DS18S20 = 0x10;
+static const uint8_t DALLAS_MODEL_DS18B20 = 0x28;
 static const uint8_t DALLAS_COMMAND_START_CONVERSION = 0x44;
 static const uint8_t DALLAS_COMMAND_READ_SCRATCH_PAD = 0xBE;
 static const uint8_t DALLAS_COMMAND_WRITE_SCRATCH_PAD = 0x4E;
@@ -154,7 +155,14 @@ float DallasTemperatureSensor::get_temp_c_() {
     default:
       break;
   }
-
+  // undocumented test for powerup measurement of 85
+  // https://github.com/cpetrich/counterfeit_DS18B20#solution-to-the-85-c-problem
+  if ((this->address_ & 0xff) == DALLAS_MODEL_DS18B20) {
+    if ((temp == 85 * 16) && (this->scratch_pad_[6] == 0xc)) {
+      ESP_LOGD(TAG, "dropping reading caused by sensor reset");
+      return NAN;
+    }
+  }
   return temp / 16.0f;
 }
 

esphome/components/debug/debug_esp32.cpp

@@ -66,11 +66,15 @@ const char *DebugComponent::get_reset_reason_(std::span<char, RESET_REASON_BUFFE
 
   unsigned reason = esp_reset_reason();
   if (reason < sizeof(RESET_REASONS) / sizeof(RESET_REASONS[0])) {
-    if (reason == ESP_RST_SW) {
+    if (reason == ESP_RST_SW || reason == ESP_RST_WDT) {
+      // On some ESP32-S3 configurations (e.g. SPIRAM with fetch-instructions/rodata),
+      // esp_restart() intermittently produces RTCWDT_RTC_RST (ESP_RST_WDT) instead of
+      // ESP_RST_SW. Check the stored reboot source for both reset reasons so a software
+      // reboot that ends up as WDT still reports the correct source.
       auto pref = global_preferences->make_preference(REBOOT_MAX_LEN,
                                                       fnv1_hash_extend(fnv1_hash(REBOOT_KEY), App.get_name().c_str()));
       char reboot_source[REBOOT_MAX_LEN]{};
-      if (pref.load(&reboot_source)) {
+      if (pref.load(&reboot_source) && reboot_source[0] != '\0') {
         reboot_source[REBOOT_MAX_LEN - 1] = '\0';
         snprintf(buf, size, "Reboot request from %s", reboot_source);
       } else {

esphome/components/esp32_ble/ble.cpp

@@ -83,18 +83,23 @@ void ESP32BLE::setup() {
   }
 }
 
-void ESP32BLE::enable() {
-  if (this->state_ != BLE_COMPONENT_STATE_DISABLED)
-    return;
-
-  this->state_ = BLE_COMPONENT_STATE_ENABLE;
-}
-
-void ESP32BLE::disable() {
-  if (this->state_ == BLE_COMPONENT_STATE_DISABLED)
-    return;
-
-  this->state_ = BLE_COMPONENT_STATE_DISABLE;
+// Queue the transition for loop(). A pending transition the other way is
+// cancelled instead, since nothing was torn down or brought up yet; any other
+// state is already there or on its way.
+void ESP32BLE::request_state_(bool enable) {
+  if (enable) {
+    if (this->state_ == BLE_COMPONENT_STATE_DISABLED) {
+      this->state_ = BLE_COMPONENT_STATE_ENABLE;
+    } else if (this->state_ == BLE_COMPONENT_STATE_DISABLE) {
+      this->state_ = BLE_COMPONENT_STATE_ACTIVE;
+    }
+  } else {
+    if (this->state_ == BLE_COMPONENT_STATE_ACTIVE) {
+      this->state_ = BLE_COMPONENT_STATE_DISABLE;
+    } else if (this->state_ == BLE_COMPONENT_STATE_ENABLE) {
+      this->state_ = BLE_COMPONENT_STATE_DISABLED;
+    }
+  }
 }
 
 #ifdef USE_ESP32_BLE_ADVERTISING
@@ -580,7 +585,11 @@ void ESP32BLE::loop_handle_state_transition_not_active_() {
       this->mark_failed();
       return;
     }
-    this->state_ = BLE_COMPONENT_STATE_DISABLED;
+    this->drain_ble_events_();
+    // A status callback may have asked for BLE back; the stack is down now, so
+    // that request becomes a bring-up.
+    this->state_ =
+        this->state_ == BLE_COMPONENT_STATE_ACTIVE ? BLE_COMPONENT_STATE_ENABLE : BLE_COMPONENT_STATE_DISABLED;
   } else if (this->state_ == BLE_COMPONENT_STATE_ENABLE) {
     ESP_LOGD(TAG, "Enabling");
     this->state_ = BLE_COMPONENT_STATE_OFF;

esphome/components/esp32_ble/ble.h

@@ -102,8 +102,8 @@ class ESP32BLE final : public Component {
   }
   uint32_t get_advertising_cycle_time() const { return this->advertising_cycle_time_; }
 
-  void enable();
-  void disable();
+  void enable() { this->request_state_(true); }
+  void disable() { this->request_state_(false); }
   ESPHOME_ALWAYS_INLINE bool is_active() { return this->state_ == BLE_COMPONENT_STATE_ACTIVE; }
   void setup() override;
   void loop() override;
@@ -176,6 +176,15 @@ class ESP32BLE final : public Component {
 
   bool ble_setup_();
   bool ble_dismantle_();
+  void request_state_(bool enable);
+  // Drop what the old stack queued; the next stack reuses the same interface ids.
+  void drain_ble_events_() {
+    BLEEvent *ble_event;
+    while ((ble_event = this->ble_events_.pop()) != nullptr) {
+      this->ble_event_pool_.release(ble_event);
+    }
+    this->ble_events_.get_and_reset_dropped_count();
+  }
   bool ble_pre_setup_();
 #ifdef USE_ESP32_BLE_ADVERTISING
   void advertising_init_();

esphome/components/esp32_ble_client/ble_client_base.cpp

@@ -42,7 +42,7 @@ void BLEClientBase::set_state(espbt::ClientState st) {
 
 void BLEClientBase::loop() {
   if (!esp32_ble::global_ble->is_active()) {
-    this->set_state(espbt::ClientState::INIT);
+    // ble_before_disabled_event_handler() resets the client.
     return;
   }
   if (this->state() == espbt::ClientState::INIT) {
@@ -72,6 +72,21 @@ void BLEClientBase::loop() {
 
 float BLEClientBase::get_setup_priority() const { return setup_priority::AFTER_BLUETOOTH; }
 
+void BLEClientBase::ble_before_disabled_event_handler() {
+  auto st = this->state();
+  if (st != espbt::ClientState::IDLE && st != espbt::ClientState::INIT) {
+    // No CLOSE_EVT will come: free the services and settle the link.
+    this->release_services();
+    this->set_idle_();
+    this->on_disconnect_complete(ESP_GATT_CONN_TERMINATE_LOCAL_HOST);
+  }
+  // The interface belongs to the torn-down stack.
+  this->gattc_if_ = ESP_GATT_IF_NONE;
+  this->set_state(espbt::ClientState::INIT);
+  // An idle client runs no loop; the INIT branch must run to register again.
+  this->enable_loop();
+}
+
 void BLEClientBase::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "  Address: %s\n"
@@ -93,6 +108,10 @@ bool BLEClientBase::parse_device(const espbt::ESPBTDevice &device) {
     return false;
   if (this->state() != espbt::ClientState::IDLE)
     return false;
+  // Not registered on this stack yet; promoting now would stop the scan for a
+  // connect that connect() rejects anyway.
+  if (this->gattc_if_ == ESP_GATT_IF_NONE)
+    return false;
 
   this->log_event_("Found device");
   if (ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_DEBUG)
@@ -117,6 +136,15 @@ void BLEClientBase::connect() {
              this->connection_index_, this->address_str_);
     return;
   }
+  if (this->gattc_if_ == ESP_GATT_IF_NONE) {
+    // Bluedroid drops an open on an unknown interface without any event.
+    this->log_warning_("Connect rejected, GATT app not registered");
+    // INIT stays so loop() still registers; only a promoted client goes back.
+    if (this->state() == espbt::ClientState::DISCOVERED) {
+      this->set_state(espbt::ClientState::IDLE);
+    }
+    return;
+  }
   ESP_LOGI(TAG, "[%d] [%s] 0x%02x Connecting", this->connection_index_, this->address_str_, this->remote_addr_type_);
   this->paired_ = false;
   // A registration whose event never arrived must not block this connection's release.
@@ -199,7 +227,10 @@ void BLEClientBase::release_services() {
 #ifndef CONFIG_BT_GATTC_CACHE_NVS_FLASH
   // Only the cache clean makes the stack's database unsafe to walk.
   this->services_released_ = true;
-  esp_ble_gattc_cache_clean(this->remote_bda_);
+  // A stack on its way down frees its own cache.
+  if (esp32_ble::global_ble->is_active()) {
+    esp_ble_gattc_cache_clean(this->remote_bda_);
+  }
 #endif
 }
 

esphome/components/esp32_ble_client/ble_client_base.h

@@ -41,6 +41,7 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
   void connect() override;
   esp_err_t pair();
   void disconnect() override;
+  void ble_before_disabled_event_handler() override;
   void unconditional_disconnect();
   void release_services();
 
@@ -114,7 +115,7 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
 #endif
 
   // Group 3: 4-byte types
-  int gattc_if_;
+  int gattc_if_{ESP_GATT_IF_NONE};
   esp_gatt_status_t status_{ESP_GATT_OK};
 
   // Group 4: Arrays
@@ -139,7 +140,7 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
   uint8_t pending_notify_regs_{0};
   bool auto_connect_{false};
   bool paired_{false};
-  // Set only when release_services() cleans the stack's GATT cache, which no API may then walk
+  // Set by release_services() on RAM-cache builds; the stack's GATT database must not be walked after it
   bool services_released_{false};
   // 8 bytes used, no padding
 
@@ -155,10 +156,11 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
   void log_connection_params_(const char *param_type);
   void handle_connection_result_(esp_err_t ret);
   /// Hook called once a connection has been fully torn down (after release_services() and
-  /// set_idle_()), from both the CLOSE_EVT handler and the DISCONNECTING safety timeout.
+  /// set_idle_()): CLOSE_EVT, the DISCONNECTING safety timeout, or the BLE stack going down.
   /// Subclasses with extra per-connection accounting (e.g. bluetooth_proxy slot state)
-  /// override this to release that state. `reason` is the controller reason code, or
-  /// ESP_GATT_CONN_TIMEOUT for the safety-timeout path.
+  /// override this to release that state. `reason` is the controller reason code,
+  /// ESP_GATT_CONN_TIMEOUT for the safety timeout, or ESP_GATT_CONN_TERMINATE_LOCAL_HOST
+  /// for the stack going down.
   virtual void on_disconnect_complete(esp_err_t reason) {}
   /// Transition to IDLE and reset conn_id — call when the connection is fully dead.
   void set_idle_() {

esphome/components/esp32_ble_tracker/esp32_ble_tracker.cpp

@@ -62,6 +62,11 @@ void ESP32BLETracker::on_ota_global_state(ota::OTAState state, float progress, u
     for (auto *client : this->clients_) {
       client->disconnect();
     }
+#ifdef USE_ESP32_BLE_SOFTWARE_COEXISTENCE
+    // The OTA transfer blocks the main loop, so the revert in loop() cannot run. No
+    // active-connection gate here: every client was just told to disconnect.
+    this->update_coex_preference_(false);
+#endif
 #endif
   } else if ((state == ota::OTA_ERROR || state == ota::OTA_ABORT) && this->scan_continuous_before_ota_) {
     this->scan_continuous_before_ota_ = false;
@@ -74,11 +79,11 @@ void ESP32BLETracker::on_ota_global_state(ota::OTAState state, float progress, u
 
 void ESP32BLETracker::loop() {
   if (!this->parent_->is_active()) {
-    this->ble_was_disabled_ = true;
     return;
-  } else if (this->ble_was_disabled_) {
+  }
+  if (this->ble_was_disabled_) {
     this->ble_was_disabled_ = false;
-    // If the BLE stack was disabled, we need to start the scan again.
+    // First start after boot or after the stack came back.
     if (this->scan_continuous_) {
       this->start_scan();
     }
@@ -218,7 +223,27 @@ void ESP32BLETracker::stop_scan() {
   this->stop_scan_();
 }
 
-void ESP32BLETracker::ble_before_disabled_event_handler() { this->stop_scan_(); }
+void ESP32BLETracker::ble_before_disabled_event_handler() {
+  // Tell the controller to stop; a scan still starting has nothing to stop yet.
+  if (this->scanner_state_ == ScannerState::RUNNING || this->scanner_state_ == ScannerState::FAILED) {
+    this->stop_scan_();
+  }
+#ifdef ESPHOME_ESP32_BLE_TRACKER_CLIENT_COUNT
+  for (auto *client : this->clients_) {
+    client->ble_before_disabled_event_handler();
+  }
+  this->skip_next_scan_end_ = false;
+#endif
+  // The stop above never completes (stack torn down, events dropped); settle
+  // here so start_scan_() sees IDLE once the stack is back.
+  if (this->scanner_state_ != ScannerState::IDLE) {
+    this->cleanup_scan_state_(true);
+  }
+  // A failure latched by the old stack must not be handled against the next.
+  this->scan_start_failed_ = ESP_BT_STATUS_SUCCESS;
+  this->scan_set_param_failed_ = ESP_BT_STATUS_SUCCESS;
+  this->ble_was_disabled_ = true;
+}
 
 bool ESP32BLETracker::stop_scan_() {
   if (this->scanner_state_ != ScannerState::RUNNING && this->scanner_state_ != ScannerState::FAILED) {

esphome/components/esp32_ble_tracker/esp32_ble_tracker.h

@@ -113,6 +113,9 @@ class ESPBTClient : public ESPBTDeviceListener {
   virtual void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) = 0;
   virtual void connect() = 0;
   virtual void disconnect() = 0;
+  /// Called right before the BLE stack is dismantled. Nothing in flight will
+  /// complete, and the GATT app must register again once the stack is back.
+  virtual void ble_before_disabled_event_handler() {}
   bool disconnect_pending() const { return this->want_disconnect_; }
   void cancel_pending_disconnect() { this->want_disconnect_ = false; }
 

esphome/components/esp32_hosted/__init__.py

@@ -37,6 +37,25 @@ CONF_HANDSHAKE_PIN = "handshake_pin"
 CONF_SDIO_FREQUENCY = "sdio_frequency"
 CONF_SPI_MODE = "spi_mode"
 
+# ESP-NOW-over-hosted shim (esp_now_hosted.cpp). esp-hosted proxies esp_wifi.h
+# but not esp_now.h (espressif/esp-hosted-mcu#19), and esp_wifi_remote injects
+# the esp_now.h header on the ESP32-P4 host with no implementation, leaving the
+# esp_now_* symbols undefined at link. On a P4 host, esp_now_hosted.cpp DEFINES
+# those symbols and forwards each call to the co-processor over esp-hosted's
+# CustomRpc "peer data transfer" channel, so ESPHome's `espnow` component links
+# and runs unchanged (proven on a Tab5, 2026-07-20). The .cpp is guarded to
+# CONFIG_IDF_TARGET_ESP32P4 so it compiles to nothing on hosts with a native
+# ESP-NOW stack. CustomRpc needs these two host-side Kconfig options. Host
+# registers 3 handlers (RESP, RECV, SEND); the coprocessor registers 1 (REQ);
+# we ask for 8 to leave room for other CustomRpc extensions alongside.
+#
+# The coprocessor must run the matching custom firmware (a parallel effort in
+# esphome/esp-hosted-firmware). esp_now_hosted_rpc.h here is the canonical copy
+# of the wire contract and MUST stay byte-identical to the copy that coprocessor
+# firmware uses — the packed structs are the on-wire layout, so any divergence
+# silently corrupts every ESP-NOW frame.
+_MAX_CUSTOM_MSG_HANDLERS = 8
+
 # Shared fields for both transport modes
 BASE_SCHEMA = cv.Schema(
     {
@@ -262,6 +281,23 @@ async def to_code(config: ConfigType) -> None:
     else:
         _configure_spi(config)
 
+    # ESP-NOW-over-hosted shim: only the radio-less ESP32-P4 host needs it (see
+    # the note by _MAX_CUSTOM_MSG_HANDLERS). Enabled for every P4 host, not
+    # gated on the `espnow` component being present: the shim is tiny and the
+    # esp_now_* symbols/CustomRpc calls it defines require these Kconfig options
+    # to link whenever esp_now_hosted.cpp compiles (which is on any P4 host), so
+    # coupling the two keeps the build consistent. When `espnow` is absent the
+    # symbols are simply unused and never register a callback at runtime.
+    if esp32.get_esp32_variant() == esp32.VARIANT_ESP32P4:
+        add_define("USE_ESP_NOW_HOSTED")
+        # esp-hosted's CustomRpc ("peer data transfer") path — off by default.
+        esp32.add_idf_sdkconfig_option(
+            "CONFIG_ESP_HOSTED_ENABLE_PEER_DATA_TRANSFER", True
+        )
+        esp32.add_idf_sdkconfig_option(
+            "CONFIG_ESP_HOSTED_MAX_CUSTOM_MSG_HANDLERS", _MAX_CUSTOM_MSG_HANDLERS
+        )
+
     # Place the transport mempool in PSRAM. Required on memory-tight host
     # configurations (e.g. P4 with a large LVGL UI) where the internal-RAM
     # mempool allocation fails at boot with `sdio_mempool_create` assert.

esphome/components/esp32_hosted/esp_now_hosted.cpp

@@ -0,0 +1,467 @@
+/*
+ * esp_now_hosted — host-side shim implementing <esp_now.h> over esp-hosted
+ * CustomRpc, so ESPHome's `espnow` component can run on a radio-less host
+ * (e.g. the ESP32-P4) whose radio lives on an esp-hosted co-processor.
+ *
+ * A radio-less host has no native ESP-NOW. esp_wifi_remote INJECTS the full
+ * esp_now.h header (types + declarations) but ships NO implementation, so every
+ * esp_now_* symbol is an undefined reference at link time. This translation
+ * unit provides those definitions; each forwards to the co-processor over
+ * CustomRpc (see esphome/esp-hosted-firmware for the matching coprocessor
+ * handlers). No esp-hosted or esp_wifi_remote source is patched, and there is no
+ * duplicate-symbol clash because nothing else defines these symbols here.
+ *
+ * See esp_now_hosted_rpc.h for the wire protocol.
+ */
+
+#include "sdkconfig.h"
+
+// Only build the shim on the radio-less host. On chips with a native ESP-NOW
+// stack (S3, C6, …) the real symbols exist and this file must stay empty to
+// avoid duplicate definitions.
+#if defined(CONFIG_IDF_TARGET_ESP32P4)
+
+#include <cstring>
+
+#include "freertos/FreeRTOS.h"
+#include "freertos/semphr.h"
+
+#include "esp_idf_version.h"
+#include "esp_log.h"
+#include "esp_timer.h"
+
+#include <esp_now.h>         // injected declarations we are now DEFINING
+#include <esp_wifi_types.h>  // wifi_pkt_rx_ctrl_t, wifi_tx_info_t
+
+// esp_hosted_misc.h (host) ships WITHOUT an extern "C" guard, so including it
+// from C++ would give its declarations C++ linkage and the real C symbols in
+// libesp_hosted would go unresolved at link. Wrap it. (Verified vs
+// esp_hosted 2.12.9.)
+extern "C" {
+#include "esp_hosted_misc.h"  // esp_hosted_{send_custom_data,register_custom_callback}
+}
+
+#include "esp_now_hosted_rpc.h"
+
+namespace {
+
+const char *const TAG = "esp_now_hosted";
+
+// One outstanding request at a time. ESPHome drives esp_now_* from the main
+// loop; the matching response and the async RECV/SEND events all arrive on the
+// single esp-hosted RPC RX thread. Serializing requests keeps the shared
+// response slot race-free; a sequence number stops a late/stale response from
+// being mistaken for ours.
+SemaphoreHandle_t g_req_mutex = nullptr;
+SemaphoreHandle_t g_resp_sem = nullptr;  // given when the matching RESP lands
+bool g_setup_done = false;               // set only after setup fully succeeds
+uint8_t g_seq = 0;
+volatile uint8_t g_expect_seq = 0;
+volatile int32_t g_resp_status = 0;
+uint8_t g_resp_ret[16];
+volatile uint16_t g_resp_ret_len = 0;
+
+// Written from the main loop (register/unregister/deinit), read from the
+// esp-hosted RX thread (on_recv/on_send). volatile for the same reason the
+// g_resp_* globals are: force the RX thread to observe an updated pointer
+// (e.g. a nulling by esp_now_deinit) rather than a cached one.
+volatile esp_now_recv_cb_t g_recv_cb = nullptr;
+volatile esp_now_send_cb_t g_send_cb = nullptr;
+
+// Local mirror of the co-processor's peer table. ESPHome's espnow component
+// calls esp_now_is_peer_exist() on the main loop for every received frame
+// (twice) and every send; forwarding each as a blocking RPC round-trip stalls
+// the loop. The shim is the only path that mutates the co-processor peer table
+// (add/del/deinit all go through here), so this mirror is authoritative and
+// esp_now_is_peer_exist() can answer from it with no round-trip.
+//
+// esp_now_* are public C symbols: any component or user lambda may call them,
+// and although ESPHome's espnow touches peers only from the main loop today
+// (its RX/TX callbacks merely enqueue), the shim cannot rely on that. A short
+// spinlock keeps the mirror consistent from any task/core, matching native
+// esp_now_*'s own internal thread-safety. The critical sections are a bounded
+// (<=20-entry) scan, so they stay tiny. ESP_NOW_MAX_TOTAL_PEER_NUM is 20.
+constexpr size_t ESP_NOW_HOSTED_MAX_PEERS = 20;
+uint8_t g_peer_cache[ESP_NOW_HOSTED_MAX_PEERS][6];
+size_t g_peer_count = 0;
+portMUX_TYPE g_peer_lock = portMUX_INITIALIZER_UNLOCKED;
+
+// Caller must hold g_peer_lock.
+int peer_cache_find_locked(const uint8_t *mac) {
+  for (size_t i = 0; i < g_peer_count; i++) {
+    if (memcmp(g_peer_cache[i], mac, 6) == 0)
+      return static_cast<int>(i);
+  }
+  return -1;
+}
+
+bool peer_cache_contains(const uint8_t *mac) {
+  portENTER_CRITICAL(&g_peer_lock);
+  const bool found = peer_cache_find_locked(mac) >= 0;
+  portEXIT_CRITICAL(&g_peer_lock);
+  return found;
+}
+
+void peer_cache_add(const uint8_t *mac) {
+  portENTER_CRITICAL(&g_peer_lock);
+  if (peer_cache_find_locked(mac) < 0 && g_peer_count < ESP_NOW_HOSTED_MAX_PEERS)
+    memcpy(g_peer_cache[g_peer_count++], mac, 6);
+  portEXIT_CRITICAL(&g_peer_lock);
+}
+
+void peer_cache_remove(const uint8_t *mac) {
+  portENTER_CRITICAL(&g_peer_lock);
+  const int idx = peer_cache_find_locked(mac);
+  if (idx >= 0) {
+    g_peer_count--;
+    if (static_cast<size_t>(idx) != g_peer_count)  // move the last entry into the gap
+      memcpy(g_peer_cache[idx], g_peer_cache[g_peer_count], 6);
+  }
+  portEXIT_CRITICAL(&g_peer_lock);
+}
+
+void peer_cache_clear() {
+  portENTER_CRITICAL(&g_peer_lock);
+  g_peer_count = 0;
+  portEXIT_CRITICAL(&g_peer_lock);
+}
+
+// ── CustomRpc event handlers (run on the esp-hosted RPC RX thread) ──────────
+// Keep them short and non-blocking. In particular they MUST NOT call back into
+// any esp_now_* shim function: that would try to take g_req_mutex / wait on the
+// RX thread that delivers the response, and deadlock.
+
+void on_resp(uint32_t /*msg_id*/, const uint8_t *data, size_t len, void * /*ctx*/) {
+  if (len < sizeof(esp_now_hosted_resp_t)) {
+    ESP_LOGW(TAG, "RESP too short: %u bytes", static_cast<unsigned>(len));
+    return;
+  }
+  const auto *r = reinterpret_cast<const esp_now_hosted_resp_t *>(data);
+  if (r->seq != g_expect_seq) {  // late response from a timed-out request (expected)
+    ESP_LOGV(TAG, "dropping stale RESP seq %u (want %u)", r->seq, g_expect_seq);
+    return;
+  }
+  g_resp_status = r->status;
+  uint16_t rl = r->ret_len;
+  if (rl > sizeof(g_resp_ret)) {
+    // Larger than any real opcode return — a likely wire-format drift signal.
+    ESP_LOGW(TAG, "RESP ret_len %u exceeds buffer, clamping (wire drift?)", rl);
+    rl = sizeof(g_resp_ret);
+  }
+  if (len >= sizeof(esp_now_hosted_resp_t) + rl) {
+    memcpy(g_resp_ret, r->ret, rl);
+  } else {
+    // Truncated frame: fail closed. Never hand the caller stale bytes left in
+    // g_resp_ret by a previous response, and don't let request() report a
+    // zeroed payload as success — override the status to an error.
+    ESP_LOGW(TAG, "RESP truncated: claims %u ret bytes, frame too short", rl);
+    rl = 0;
+    g_resp_status = ESP_ERR_INVALID_RESPONSE;
+  }
+  g_resp_ret_len = rl;
+  xSemaphoreGive(g_resp_sem);
+}
+
+void on_recv(uint32_t /*msg_id*/, const uint8_t *data, size_t len, void * /*ctx*/) {
+  // Read the volatile pointer once: esp_now_unregister_recv_cb()/deinit() (via
+  // the espnow component's disable()) can null it on the main loop between the
+  // guard and the call, which would otherwise turn the call into a null-deref.
+  const esp_now_recv_cb_t cb = g_recv_cb;
+  if (cb == nullptr)
+    return;
+  if (len < sizeof(esp_now_hosted_recv_evt_t)) {
+    ESP_LOGW(TAG, "RECV too short: %u bytes", static_cast<unsigned>(len));
+    return;
+  }
+  const auto *e = reinterpret_cast<const esp_now_hosted_recv_evt_t *>(data);
+  if (len < sizeof(esp_now_hosted_recv_evt_t) + e->data_len) {
+    ESP_LOGW(TAG, "RECV data_len %u exceeds frame", e->data_len);
+    return;
+  }
+
+  // ESPHome dereferences info->rx_ctrl->{rssi,timestamp}; give it a real one.
+  wifi_pkt_rx_ctrl_t rx_ctrl;
+  memset(&rx_ctrl, 0, sizeof(rx_ctrl));
+  rx_ctrl.rssi = e->rssi;
+  rx_ctrl.channel = e->channel;
+  rx_ctrl.timestamp = static_cast<uint32_t>(esp_timer_get_time());
+
+  esp_now_recv_info_t info;
+  info.src_addr = const_cast<uint8_t *>(e->src_addr);
+  info.des_addr = const_cast<uint8_t *>(e->des_addr);
+  info.rx_ctrl = &rx_ctrl;
+  cb(&info, e->data, static_cast<int>(e->data_len));
+}
+
+void on_send(uint32_t /*msg_id*/, const uint8_t *data, size_t len, void * /*ctx*/) {
+  // Read the volatile pointer once (see on_recv): disable()/deinit() can null it
+  // on the main loop concurrently with this RX-thread callback.
+  const esp_now_send_cb_t cb = g_send_cb;
+  if (cb == nullptr)
+    return;
+  if (len < sizeof(esp_now_hosted_send_evt_t)) {
+    ESP_LOGW(TAG, "SEND evt too short: %u bytes", static_cast<unsigned>(len));
+    return;
+  }
+  const auto *e = reinterpret_cast<const esp_now_hosted_send_evt_t *>(data);
+#if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 5, 0)
+  // IDF >= 5.5: esp_now_send_cb_t takes esp_now_send_info_t (== wifi_tx_info_t),
+  // whose des_addr is a POINTER (not an inline array). Point it at the event's
+  // MAC (valid for this callback) — do NOT memcpy into it (that writes NULL and
+  // faults). ESPHome reads only info->des_addr.
+  esp_now_send_info_t si;
+  memset(&si, 0, sizeof(si));
+  si.des_addr = const_cast<uint8_t *>(e->des_addr);
+  cb(&si, static_cast<esp_now_send_status_t>(e->status));
+#else
+  cb(e->des_addr, static_cast<esp_now_send_status_t>(e->status));
+#endif
+}
+
+esp_err_t ensure_setup() {
+  // Gate on g_setup_done, not on g_req_mutex: a failure part-way through (a
+  // semaphore that did not allocate, a callback that did not register) must not
+  // leave a later call thinking setup completed. Semaphore creation is guarded
+  // so a retry after a partial failure does not leak the earlier handles.
+  if (g_setup_done)
+    return ESP_OK;
+  if (g_req_mutex == nullptr)
+    g_req_mutex = xSemaphoreCreateMutex();
+  if (g_resp_sem == nullptr)
+    g_resp_sem = xSemaphoreCreateBinary();
+  if (g_req_mutex == nullptr || g_resp_sem == nullptr)
+    return ESP_ERR_NO_MEM;
+  esp_err_t err;
+  if ((err = esp_hosted_register_custom_callback(ESP_NOW_HOSTED_MSG_RESP, on_resp, nullptr)) != ESP_OK)
+    return err;
+  if ((err = esp_hosted_register_custom_callback(ESP_NOW_HOSTED_MSG_RECV, on_recv, nullptr)) != ESP_OK)
+    return err;
+  if ((err = esp_hosted_register_custom_callback(ESP_NOW_HOSTED_MSG_SEND, on_send, nullptr)) != ESP_OK)
+    return err;
+  g_setup_done = true;
+  return ESP_OK;
+}
+
+// Send one request envelope. With wait=true (default) block until the matching
+// response (or timeout); with wait=false return as soon as the frame is handed
+// to the transport (fire-and-forget, used by esp_now_send).
+//
+// `tail` is an optional second chunk written straight after `payload`. Callers
+// with a fixed header plus a bulk body (esp_now_send) pass the two separately
+// so they never need a build buffer of their own: both chunks are laid into the
+// request buffer here, under g_req_mutex, which keeps concurrent callers from
+// racing and saves a full copy of the body on every transmit.
+esp_err_t request(uint8_t opcode, const void *payload, uint16_t plen, void *ret, uint16_t ret_cap, uint16_t *ret_len,
+                  bool wait = true, const void *tail = nullptr, uint16_t tail_len = 0) {
+  esp_err_t err = ensure_setup();
+  if (err != ESP_OK)
+    return err;
+  if (plen > ESP_NOW_HOSTED_MAX_PAYLOAD || tail_len > ESP_NOW_HOSTED_MAX_PAYLOAD - plen)
+    return ESP_ERR_INVALID_SIZE;
+  const uint16_t total_len = static_cast<uint16_t>(plen + tail_len);
+
+  if (xSemaphoreTake(g_req_mutex, portMAX_DELAY) != pdTRUE)
+    return ESP_FAIL;
+
+  static uint8_t buf[sizeof(esp_now_hosted_req_t) + ESP_NOW_HOSTED_MAX_PAYLOAD];  // guarded by g_req_mutex
+  auto *req = reinterpret_cast<esp_now_hosted_req_t *>(buf);
+  req->opcode = opcode;
+  req->seq = ++g_seq;
+  req->payload_len = total_len;
+  if (plen != 0)
+    memcpy(req->payload, payload, plen);
+  if (tail_len != 0)
+    memcpy(req->payload + plen, tail, tail_len);
+  g_expect_seq = req->seq;
+
+  xSemaphoreTake(g_resp_sem, 0);  // drain any stale signal before sending
+  err = esp_hosted_send_custom_data(ESP_NOW_HOSTED_MSG_REQ, buf, sizeof(esp_now_hosted_req_t) + total_len);
+  if (err != ESP_OK) {
+    xSemaphoreGive(g_req_mutex);
+    return err;
+  }
+  if (!wait) {
+    // Fire-and-forget (esp_now_send): the co-processor enqueues the frame and
+    // reports the real TX result later via the async SEND event, exactly like
+    // native esp_now_send. Returning here keeps the main loop off the ~100 ms+
+    // RPC round-trip. The matching RESP is ignored (seq won't match the next
+    // waited request, so on_resp drops it).
+    xSemaphoreGive(g_req_mutex);
+    return ESP_OK;
+  }
+  if (xSemaphoreTake(g_resp_sem, pdMS_TO_TICKS(ESP_NOW_HOSTED_TIMEOUT_MS)) != pdTRUE) {
+    ESP_LOGW(TAG, "opcode %u timed out", opcode);
+    xSemaphoreGive(g_req_mutex);
+    return ESP_ERR_TIMEOUT;
+  }
+
+  const int32_t status = g_resp_status;
+  if (ret != nullptr && ret_cap != 0) {
+    uint16_t n = g_resp_ret_len < ret_cap ? g_resp_ret_len : ret_cap;
+    memcpy(ret, const_cast<const uint8_t *>(g_resp_ret), n);
+    if (ret_len != nullptr)
+      *ret_len = n;
+  }
+  xSemaphoreGive(g_req_mutex);
+  return static_cast<esp_err_t>(status);
+}
+
+}  // namespace
+
+// ── The <esp_now.h> surface, defined for the radio-less host ────────────────
+extern "C" {
+
+esp_err_t esp_now_init(void) { return request(ESP_NOW_HOSTED_OP_INIT, nullptr, 0, nullptr, 0, nullptr); }
+
+esp_err_t esp_now_deinit(void) {
+  g_recv_cb = nullptr;
+  g_send_cb = nullptr;
+  peer_cache_clear();  // the co-processor drops all peers on deinit
+  return request(ESP_NOW_HOSTED_OP_DEINIT, nullptr, 0, nullptr, 0, nullptr);
+}
+
+esp_err_t esp_now_get_version(uint32_t *version) {
+  uint32_t v = 0;
+  uint16_t rl = 0;
+  esp_err_t err = request(ESP_NOW_HOSTED_OP_GET_VERSION, nullptr, 0, &v, sizeof(v), &rl);
+  if (version != nullptr)
+    *version = v;
+  return err;
+}
+
+esp_err_t esp_now_register_recv_cb(esp_now_recv_cb_t cb) {
+  // Only arm the callback once the CustomRpc handlers are actually registered,
+  // so a failed setup leaves g_recv_cb null rather than falsely "registered".
+  esp_err_t err = ensure_setup();
+  if (err != ESP_OK)
+    return err;
+  g_recv_cb = cb;
+  return ESP_OK;
+}
+esp_err_t esp_now_unregister_recv_cb(void) {
+  g_recv_cb = nullptr;
+  return ESP_OK;
+}
+esp_err_t esp_now_register_send_cb(esp_now_send_cb_t cb) {
+  esp_err_t err = ensure_setup();
+  if (err != ESP_OK)
+    return err;
+  g_send_cb = cb;
+  return ESP_OK;
+}
+esp_err_t esp_now_unregister_send_cb(void) {
+  g_send_cb = nullptr;
+  return ESP_OK;
+}
+
+static esp_err_t add_or_mod_peer(uint8_t opcode, const esp_now_peer_info_t *peer, bool wait) {
+  if (peer == nullptr)
+    return ESP_ERR_ESPNOW_ARG;
+  esp_now_hosted_peer_t p;
+  memset(&p, 0, sizeof(p));
+  memcpy(p.peer_addr, peer->peer_addr, 6);
+  memcpy(p.lmk, peer->lmk, 16);
+  p.channel = peer->channel;
+  p.ifidx = static_cast<uint8_t>(peer->ifidx);
+  p.encrypt = peer->encrypt ? 1 : 0;
+  return request(opcode, &p, sizeof(p), nullptr, 0, nullptr, wait);
+}
+esp_err_t esp_now_add_peer(const esp_now_peer_info_t *peer) {
+  // Fire-and-forget (wait=false): adding a peer is a blocking RPC round-trip,
+  // and ESPHome's espnow calls it on the main loop when a device joins the mesh
+  // — under co-processor load that stalls the UI (peer-churn stutter). Issue it
+  // without waiting and mirror it locally. Safe against a following
+  // esp_now_send to the same peer: both ride the same in-order CustomRpc
+  // channel (mutex-serialized on the host) and the co-processor processes REQs
+  // FIFO, so ADD_PEER is applied before the SEND. Trade-off: a co-processor-side
+  // failure (e.g. peer table full) is no longer reported synchronously — the
+  // same limitation as esp_now_send — but ESPHome only adds peers it validated.
+  esp_err_t err = add_or_mod_peer(ESP_NOW_HOSTED_OP_ADD_PEER, peer, /*wait=*/false);
+  if (err == ESP_OK)
+    peer_cache_add(peer->peer_addr);  // keep the local mirror in sync
+  return err;
+}
+esp_err_t esp_now_mod_peer(const esp_now_peer_info_t *peer) {
+  // mod_peer changes a peer's parameters, not its existence, so the cache is
+  // unaffected. Kept synchronous — it is not on any hot path (espnow never
+  // calls it), so the extra round-trip does not matter and the status is useful.
+  return add_or_mod_peer(ESP_NOW_HOSTED_OP_MOD_PEER, peer, /*wait=*/true);
+}
+
+esp_err_t esp_now_del_peer(const uint8_t *peer_addr) {
+  if (peer_addr == nullptr)
+    return ESP_ERR_ESPNOW_ARG;
+  // Fire-and-forget for the same reason as add_peer (peer churn on the main
+  // loop). Removal is order-independent, so this is strictly safe.
+  esp_err_t err = request(ESP_NOW_HOSTED_OP_DEL_PEER, peer_addr, 6, nullptr, 0, nullptr, /*wait=*/false);
+  if (err == ESP_OK)
+    peer_cache_remove(peer_addr);  // keep the local mirror in sync
+  return err;
+}
+
+bool esp_now_is_peer_exist(const uint8_t *peer_addr) {
+  if (peer_addr == nullptr)
+    return false;
+  // Answered from the local mirror — no RPC round-trip. ESPHome's espnow calls
+  // this on the main loop for every received frame and every send, so a
+  // blocking round-trip here would stall rendering under mesh traffic.
+  return peer_cache_contains(peer_addr);
+}
+
+esp_err_t esp_now_send(const uint8_t *peer_addr, const uint8_t *data, size_t len) {
+  if (len > ESP_NOW_HOSTED_MAX_FRAME)
+    return ESP_ERR_ESPNOW_ARG;
+  if (data == nullptr && len != 0)  // native esp_now_send treats this as an arg error
+    return ESP_ERR_ESPNOW_ARG;
+  // Only the small fixed header is built here; the caller's frame goes over as
+  // the request tail, so request() lays both into its own buffer under
+  // g_req_mutex. esp_now_send is a public C symbol and may be called from any
+  // task, and a shared build buffer here would let two callers corrupt each
+  // other's frame. Passing the body through also drops a full-frame copy per
+  // transmit, on the path this shim exists to keep quick.
+  uint8_t hdr[sizeof(esp_now_hosted_send_req_t)];
+  auto *s = reinterpret_cast<esp_now_hosted_send_req_t *>(hdr);
+  s->has_addr = peer_addr != nullptr ? 1 : 0;
+  if (peer_addr != nullptr)
+    memcpy(s->peer_addr, peer_addr, 6);
+  else
+    memset(s->peer_addr, 0, 6);
+  s->data_len = static_cast<uint16_t>(len);
+  // Fire-and-forget (wait=false): native esp_now_send returns once the frame is
+  // queued, with the real TX result delivered later through the send callback.
+  // The co-processor mirrors that — it acks enqueue immediately and reports the
+  // outcome via the async SEND event (on_send -> on_send_report). Waiting for
+  // the RPC RESP here would block the main loop for the full round-trip on
+  // every transmit.
+  return request(ESP_NOW_HOSTED_OP_SEND, hdr, sizeof(hdr), nullptr, 0, nullptr, /*wait=*/false, data,
+                 static_cast<uint16_t>(len));
+}
+
+esp_err_t esp_now_set_pmk(const uint8_t *pmk) {
+  if (pmk == nullptr)
+    return ESP_ERR_ESPNOW_ARG;
+  return request(ESP_NOW_HOSTED_OP_SET_PMK, pmk, 16, nullptr, 0, nullptr);
+}
+
+// Remainder of the <esp_now.h> surface. Not used by ESPHome's espnow component
+// today; provided so the whole header links and future callers get a defined
+// (if unimplemented) symbol rather than a link error. Wire them through
+// CustomRpc if a use case appears.
+esp_err_t esp_now_get_peer(const uint8_t * /*peer_addr*/, esp_now_peer_info_t * /*peer*/) {
+  return ESP_ERR_NOT_SUPPORTED;
+}
+esp_err_t esp_now_fetch_peer(bool /*from_head*/, esp_now_peer_info_t * /*peer*/) { return ESP_ERR_NOT_SUPPORTED; }
+esp_err_t esp_now_get_peer_num(esp_now_peer_num_t * /*num*/) { return ESP_ERR_NOT_SUPPORTED; }
+esp_err_t esp_now_set_wake_window(uint16_t /*window*/) {
+  return ESP_ERR_NOT_SUPPORTED;  // power-save wake window is not forwarded; don't claim success
+}
+esp_err_t esp_now_set_peer_rate_config(const uint8_t * /*peer_addr*/, esp_now_rate_config_t * /*cfg*/) {
+  return ESP_ERR_NOT_SUPPORTED;
+}
+esp_err_t esp_wifi_config_espnow_rate(wifi_interface_t /*ifx*/, wifi_phy_rate_t /*rate*/) {
+  return ESP_ERR_NOT_SUPPORTED;
+}
+
+}  // extern "C"
+
+#endif  // CONFIG_IDF_TARGET_ESP32P4

esphome/components/esp32_hosted/esp_now_hosted_rpc.h

@@ -0,0 +1,128 @@
+/*
+ * esp_now_hosted — ESP-NOW-over-CustomRpc wire protocol.
+ *
+ * Shared, byte-for-byte-identical contract between:
+ *   - the host shim         (esphome/components/esp32_hosted/esp_now_hosted.cpp)
+ *   - the coprocessor firmware (esphome/esp-hosted-firmware)
+ *
+ * It rides esp-hosted's CustomRpc channel (RPC ID 388, "peer data transfer",
+ * available since esp-hosted v2.8.1), teaching the radio-less host <-> radio
+ * co-processor link to carry esp_now.h, which esp-hosted itself does not proxy
+ * (Espressif issue espressif/esp-hosted-mcu#19).
+ *
+ * KEEP THE TWO COPIES IN SYNC. The canonical copy lives here; the coprocessor
+ * firmware uses a verbatim copy. Both sides are little-endian, so these packed
+ * structs are wire-compatible with no byte-swapping.
+ */
+
+#ifndef ESP_NOW_HOSTED_RPC_H
+#define ESP_NOW_HOSTED_RPC_H
+
+#ifdef __cplusplus
+#include <cstdint>
+#else
+#include <stdint.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* ── CustomRpc message IDs (any uint32_t except 0xFFFFFFFF) ──────────────────
+ * One REQ handler slot on the device; three event handler slots on the host.
+ * The bytes spell "now" + index, a private range unlikely to clash with other
+ * CustomRpc users (e.g. the stock peer_data_transfer example's 1..6).         */
+#define ESP_NOW_HOSTED_MSG_REQ 0x6E6F7701u  /* host   -> device : request envelope */
+#define ESP_NOW_HOSTED_MSG_RESP 0x6E6F7702u /* device -> host   : reply to a REQ   */
+#define ESP_NOW_HOSTED_MSG_RECV 0x6E6F7703u /* device -> host   : async RX frame   */
+#define ESP_NOW_HOSTED_MSG_SEND 0x6E6F7704u /* device -> host   : async TX status  */
+
+/* ── Request opcodes ────────────────────────────────────────────────────── */
+enum {
+  ESP_NOW_HOSTED_OP_INIT = 1,          /* esp_now_init + register device recv/send cbs */
+  ESP_NOW_HOSTED_OP_DEINIT = 2,        /* unregister cbs + esp_now_deinit             */
+  ESP_NOW_HOSTED_OP_ADD_PEER = 3,      /* payload: esp_now_hosted_peer_t              */
+  ESP_NOW_HOSTED_OP_DEL_PEER = 4,      /* payload: 6-byte peer MAC                    */
+  ESP_NOW_HOSTED_OP_IS_PEER_EXIST = 5, /* payload: 6-byte MAC; ret: 1 byte bool       */
+  ESP_NOW_HOSTED_OP_SEND = 6,          /* payload: esp_now_hosted_send_req_t          */
+  ESP_NOW_HOSTED_OP_GET_VERSION = 7,   /* ret: uint32 version                        */
+  ESP_NOW_HOSTED_OP_SET_PMK = 8,       /* payload: 16-byte PMK                        */
+  ESP_NOW_HOSTED_OP_MOD_PEER = 9,      /* payload: esp_now_hosted_peer_t              */
+};
+
+/* Largest ESP-NOW payload we forward. ESP-NOW v2 (IDF >= 5.4) is 1470 B; well
+ * under esp-hosted's 8166 B CustomRpc cap, so the shim never truncates.        */
+#define ESP_NOW_HOSTED_MAX_FRAME 1470u
+/* Envelope slack for the largest opcode payload (a SEND req wrapping a frame). */
+#define ESP_NOW_HOSTED_MAX_PAYLOAD (ESP_NOW_HOSTED_MAX_FRAME + 16u)
+/* Host request/response round-trip timeout over the transport. Generous:
+ * normal RTT is sub-millisecond, but Wi-Fi/BLE contention on the co-processor
+ * can stall the RX thread.                                                     */
+#define ESP_NOW_HOSTED_TIMEOUT_MS 2000
+
+/* ── Envelopes ──────────────────────────────────────────────────────────── */
+
+/* These payloads are shared verbatim with the C co-processor firmware, so they
+ * use C's `typedef struct {...} name;` idiom rather than C++ `using` aliases,
+ * which would not compile there. Silence clang-tidy's modernize-use-using for
+ * the shared struct block. */
+// NOLINTBEGIN(modernize-use-using)
+typedef struct {
+  uint8_t opcode;       /* one of ESP_NOW_HOSTED_OP_*                        */
+  uint8_t seq;          /* wraps 0..255; echoed in the response for matching */
+  uint16_t payload_len; /* bytes of opcode-specific payload that follow      */
+  uint8_t payload[];    /* flexible                                          */
+} __attribute__((packed)) esp_now_hosted_req_t;
+
+typedef struct {
+  uint8_t opcode;   /* echoes the request opcode                         */
+  uint8_t seq;      /* echoes the request seq                            */
+  int32_t status;   /* esp_err_t from the native call on the co-processor */
+  uint16_t ret_len; /* bytes of return payload that follow               */
+  uint8_t ret[];    /* flexible (e.g. version u32, is_peer_exist bool)   */
+} __attribute__((packed)) esp_now_hosted_resp_t;
+
+/* ── Opcode payloads ────────────────────────────────────────────────────── */
+
+/* esp_now_peer_info_t minus the host-only `priv` pointer, which is meaningless
+ * across the transport and never set by ESPHome's espnow component.           */
+typedef struct {
+  uint8_t peer_addr[6];
+  uint8_t lmk[16];
+  uint8_t channel; /* 0 = current channel                              */
+  uint8_t ifidx;   /* wifi_interface_t (0=STA, 1=AP)                    */
+  uint8_t encrypt; /* bool                                             */
+} __attribute__((packed)) esp_now_hosted_peer_t;
+
+typedef struct {
+  uint8_t has_addr; /* 0 => peer_addr is NULL (broadcast to all peers)   */
+  uint8_t peer_addr[6];
+  uint16_t data_len;
+  uint8_t data[]; /* flexible, up to ESP_NOW_HOSTED_MAX_FRAME          */
+} __attribute__((packed)) esp_now_hosted_send_req_t;
+
+/* ── Async events (device -> host) ──────────────────────────────────────── */
+
+/* Reconstructed on the host into an esp_now_recv_info_t + a minimal
+ * wifi_pkt_rx_ctrl_t. ESPHome's espnow reads info->src_addr, info->des_addr,
+ * info->rx_ctrl->rssi and info->rx_ctrl->timestamp.                           */
+typedef struct {
+  uint8_t src_addr[6];
+  uint8_t des_addr[6];
+  int8_t rssi;
+  uint8_t channel;
+  uint16_t data_len;
+  uint8_t data[]; /* flexible                                          */
+} __attribute__((packed)) esp_now_hosted_recv_evt_t;
+
+typedef struct {
+  uint8_t des_addr[6];
+  uint8_t status; /* esp_now_send_status_t (0 = success)               */
+} __attribute__((packed)) esp_now_hosted_send_evt_t;
+// NOLINTEND(modernize-use-using)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* ESP_NOW_HOSTED_RPC_H */

esphome/components/esp8266/__init__.py

@@ -321,7 +321,6 @@ async def to_code(config: ConfigType) -> None:
         "pre:exclude_updater.py",
         "pre:exclude_waveform.py",
         "pre:relocate_ratetable.py",
-        "pre:relocate_sodium_sha256.py",
     ]
     if not enable_scanf_float:
         extra_scripts.append("pre:remove_float_scanf.py")
@@ -464,7 +463,6 @@ def copy_files() -> None:
         "exclude_waveform",
         "remove_float_scanf",
         "relocate_ratetable",
-        "relocate_sodium_sha256",
     ):
         copy_file_if_changed(
             dir / f"{script}.py.script",

esphome/components/esp8266/build_surgery.py

@@ -24,40 +24,6 @@ _RATETABLE_COMMENT = (
 # "_dport0_data_start" line in the earlier .dport0.data section
 _RATETABLE_ANCHOR = re.compile(r"^\s*_data_start = ABSOLUTE\(\.\);", re.MULTILINE)
 
-# Move libsodium's SHA-256 round constants from DRAM to flash. The Arduino
-# core keeps .rodata in DRAM because flash only allows aligned 32-bit reads,
-# but Krnd is a uint32_t[64] that the transform only ever reads word-wise, so
-# it is safe in flash and frees 256 bytes of DRAM on every build that links
-# libsodium (api or ota encryption). The rule goes inside .irom0.text, which
-# the linker script places before the DRAM .rodata rules, so it wins.
-SODIUM_SHA256_RULE = "*hash_sha256_cp.c.o(.rodata.Krnd)"
-_SODIUM_SHA256_COMMENT = "/* ESPHome: libsodium SHA-256 round constants are read word-wise, keep them in flash */"
-_SODIUM_SHA256_ANCHOR = re.compile(
-    r"^\s*_irom0_text_start = ABSOLUTE\(\.\);", re.MULTILINE
-)
-
-
-def relocate_sodium_sha256(content: str) -> str:
-    """Insert the libsodium round-constant flash rule into a generated common
-    linker script."""
-    if SODIUM_SHA256_RULE in content:
-        return content
-    match = _SODIUM_SHA256_ANCHOR.search(content)
-    if match is None:
-        raise RuntimeError(
-            "'_irom0_text_start' anchor not found in the generated linker script; "
-            "cannot move the libsodium SHA-256 constants to flash "
-            "(has the Arduino core linker script changed?)"
-        )
-    insert_pos = match.end()
-    return (
-        content[:insert_pos]
-        + f"\n    {_SODIUM_SHA256_COMMENT}"
-        + f"\n    {SODIUM_SHA256_RULE}"
-        + content[insert_pos:]
-    )
-
-
 # Memory sizes for testing mode (allow larger builds for CI component grouping)
 TESTING_IRAM_SIZE = "0x200000"  # 2MB
 TESTING_DRAM_SIZE = "0x200000"  # 2MB

esphome/components/esp8266/relocate_sodium_sha256.py.script

@@ -1,57 +0,0 @@
-# pylint: disable=E0602
-Import("env")  # noqa
-
-# Move libsodium's SHA-256 round constants from DRAM to flash
-#
-# The Arduino core linker script keeps every .rodata input section in DRAM,
-# because flash-mapped memory only allows aligned 32-bit reads and most
-# tables are read byte-wise. libsodium's Krnd (crypto_hash/sha256) is a
-# uint32_t[64] that SHA256_Transform only reads word-wise, so it is safe in
-# flash; every build that links libsodium (api or ota encryption) gets 256
-# bytes of DRAM back. The rule is placed inside the .irom0.text output
-# section, which the linker script lists before the DRAM .rodata rules, so it
-# claims the section first. Mirrored in build_surgery.py for the native
-# toolchain; keep both in sync.
-
-import re
-from os.path import join
-
-RULE = "*hash_sha256_cp.c.o(.rodata.Krnd)"
-ANCHOR = re.compile(r"^\s*_irom0_text_start = ABSOLUTE\(\.\);", re.MULTILINE)
-
-
-def relocate_sodium_sha256(source, target, env):
-    """Insert the flash rule into the generated linker script.
-
-    Runs as a pre-action of the link step; the linker script is a declared
-    dependency of the elf, so it has already been generated at this point.
-    """
-    ld_path = join(env.subst("$BUILD_DIR"), "ld", "local.eagle.app.v6.common.ld")
-    with open(ld_path, encoding="utf-8") as f:
-        contents = f.read()
-
-    if RULE in contents:
-        return  # Already patched (incremental build)
-
-    match = ANCHOR.search(contents)
-    if match is None:
-        raise RuntimeError(
-            f"ESPHome: '_irom0_text_start' anchor not found in {ld_path}; "
-            "cannot move the libsodium SHA-256 constants to flash "
-            "(has the Arduino core linker script changed?)"
-        )
-
-    insert_pos = match.end()
-    patched = (
-        contents[:insert_pos]
-        + "\n    /* ESPHome: libsodium SHA-256 round constants are read word-wise, keep them in flash */"
-        + f"\n    {RULE}"
-        + contents[insert_pos:]
-    )
-    with open(ld_path, "w", encoding="utf-8") as f:
-        f.write(patched)
-    print("ESPHome: Moved libsodium SHA-256 constants to flash (256 bytes of DRAM)")
-
-
-# Register the callback to run before the link step
-env.AddPreAction("$BUILD_DIR/${PROGNAME}.elf", relocate_sodium_sha256)

esphome/components/esp8266_pwm/esp8266_pwm.h

@@ -29,7 +29,7 @@ class ESP8266PWM final : public output::FloatOutput, public Component {
   void write_state(float state) override;
 
   InternalGPIOPin *pin_;
-  float frequency_{1000.0};
+  float frequency_{1000.0};  // Keep in sync with DEFAULT_FREQUENCY in output.py
   /// Cache last output level for dynamic frequency updating
   float last_output_{0.0};
 };

esphome/components/esp8266_pwm/output.py

@@ -22,6 +22,10 @@ ESP8266PWM = esp8266_pwm_ns.class_("ESP8266PWM", output.FloatOutput, cg.Componen
 SetFrequencyAction = esp8266_pwm_ns.class_("SetFrequencyAction", automation.Action)
 validate_frequency = cv.All(cv.frequency, cv.float_range(min=1.0e-6))
 
+# Schema default that also matches the C++ initializer in esp8266_pwm.h; codegen
+# skips the setter when the config equals it.
+DEFAULT_FREQUENCY = 1000.0
+
 CONFIG_SCHEMA = cv.All(
     output.FLOAT_OUTPUT_SCHEMA.extend(
         {
@@ -29,7 +33,7 @@ CONFIG_SCHEMA = cv.All(
             cv.Required(CONF_PIN): cv.All(
                 pins.internal_gpio_output_pin_schema, valid_pwm_pin
             ),
-            cv.Optional(CONF_FREQUENCY, default="1kHz"): validate_frequency,
+            cv.Optional(CONF_FREQUENCY, default=DEFAULT_FREQUENCY): validate_frequency,
         }
     ).extend(cv.COMPONENT_SCHEMA),
     cv.require_framework_version(
@@ -48,7 +52,9 @@ async def to_code(config: ConfigType) -> None:
     pin = await cg.gpio_pin_expression(config[CONF_PIN])
     cg.add(var.set_pin(pin))
 
-    cg.add(var.set_frequency(config[CONF_FREQUENCY]))
+    # Skip the setter when the config matches the C++ initializer (DEFAULT_FREQUENCY).
+    if (frequency := config[CONF_FREQUENCY]) != DEFAULT_FREQUENCY:
+        cg.add(var.set_frequency(frequency))
 
 
 @automation.register_action(

esphome/components/esphome/ota/__init__.py

@@ -2,12 +2,12 @@ import logging
 
 import esphome.codegen as cg
 from esphome.components.noise import (
-    decode_encryption_key,
     encryption_schema,
-    is_reserved_key,
+    new_psk_progmem,
+    static_encryption_key,
 )
 from esphome.components.ota import BASE_OTA_SCHEMA, OTAComponent, ota_to_code
-from esphome.config_helpers import merge_config
+from esphome.config_helpers import filter_source_files_from_defines, merge_config
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_API,
@@ -31,7 +31,6 @@ import esphome.final_validate as fv
 from esphome.types import ConfigType
 
 CONF_ALLOW_PARTITION_ACCESS = "allow_partition_access"
-CONF_CAPTIVE_PORTAL = "captive_portal"
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -41,11 +40,10 @@ DEPENDENCIES = ["network"]
 
 
 def AUTO_LOAD(config: ConfigType) -> list[str]:
-    """Auto-load noise only when encryption is configured."""
+    """Auto-load noise only when encryption is configured; the api key offer
+    inherits it from the api component."""
     base = ["sha256", "socket"]
-    # A falsy config is a tooling probe for the maximal set (None from
-    # dependency resolution, {} from the components-graph platform probe);
-    # a validated config always carries defaults, never empty
+    # A falsy config is a tooling probe for the maximal set
     if not config or CONF_ENCRYPTION in config:
         return base + ["noise"]
     return base
@@ -132,12 +130,56 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
         _validate_no_password_with_encryption(ota_conf)
         if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
             _resolve_encryption_key(encryption_conf, api_conf)
-    if any(
-        conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf
-    ) and any(
-        CONF_ENCRYPTION in conf for conf in merged_ota_esphome_configs_by_port.values()
+        elif CONF_PASSWORD in ota_conf and static_encryption_key(api_conf) is not None:
+            _LOGGER.warning(
+                "'%s' %s wastes significant flash and RAM (about 3.5 KB and 60 "
+                "bytes plus the password on the heap): the device already offers "
+                "encryption with the '%s' %s %s, which authenticates any uploader "
+                "that takes it, and a password only matters for uploaders without "
+                "encryption support; remove '%s' and add '%s' under '%s' so "
+                "uploads use the key and encryption is required",
+                CONF_OTA,
+                CONF_PASSWORD,
+                CONF_API,
+                CONF_ENCRYPTION,
+                CONF_KEY,
+                CONF_PASSWORD,
+                CONF_ENCRYPTION,
+                CONF_OTA,
+            )
+        elif (
+            CONF_PASSWORD in ota_conf
+            and CONF_ENCRYPTION in api_conf
+            and not api_conf[CONF_ENCRYPTION].get(CONF_KEY)
+        ):
+            # The CLI still needs the password; whoever provisions the key skips it
+            _LOGGER.warning(
+                "The '%s' %s %s provisioned at runtime also authenticates OTA "
+                "uploads once provisioned; '%s' %s then only guards plaintext "
+                "uploads. Whoever provisions the key can upload firmware "
+                "without the password, so add a 'provisioning:' block to limit "
+                "when that is possible",
+                CONF_API,
+                CONF_ENCRYPTION,
+                CONF_KEY,
+                CONF_OTA,
+                CONF_PASSWORD,
+            )
+    # web_server and prometheus keep the shared listener up; the captive
+    # portal's copy only exists on the fallback AP and is the recovery path
+    if (
+        (CONF_WEB_SERVER in full_conf or "prometheus" in full_conf)
+        and any(conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf)
+        and any(
+            CONF_ENCRYPTION in conf
+            for conf in merged_ota_esphome_configs_by_port.values()
+        )
     ):
-        _warn_web_server_ota(full_conf)
+        _LOGGER.warning(
+            "OTA encryption does not cover the %s OTA platform; its "
+            "plaintext /update endpoint accepts the same image",
+            CONF_WEB_SERVER,
+        )
 
     full_conf[CONF_OTA] = new_ota_conf
     fv.full_config.set(full_conf)
@@ -152,33 +194,11 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
         )
 
 
-def _warn_web_server_ota(full_conf: ConfigType) -> None:
-    """The web_server ota platform accepts the same image over plaintext HTTP
-    with basic auth, bypassing the encryption; warn rather than fail so the
-    operator keeps the recovery path."""
-    if CONF_CAPTIVE_PORTAL in full_conf and CONF_WEB_SERVER not in full_conf:
-        # The captive_portal auto-load: the endpoint only exists while the
-        # fallback AP is active
-        _LOGGER.warning(
-            "OTA encryption does not cover the %s OTA platform (auto-loaded "
-            "by captive_portal); the plaintext /update endpoint stays "
-            "reachable while the fallback AP is active",
-            CONF_WEB_SERVER,
-        )
-    else:
-        _LOGGER.warning(
-            "OTA encryption does not cover the %s OTA platform; its "
-            "plaintext /update endpoint accepts the same image",
-            CONF_WEB_SERVER,
-        )
-
-
 def _resolve_encryption_key(encryption_conf: ConfigType, api_conf: ConfigType) -> None:
     """Resolve the one encryption key per device into the ota block.
 
     An explicit ota key must match the api key, a bare block inherits it,
-    a runtime provisioned api key cannot be inherited, and the all-zeros
-    provisioning sentinel is rejected (the device treats it as no key).
+    a runtime provisioned api key cannot be inherited.
     """
     api_key = api_conf.get(CONF_ENCRYPTION, {}).get(CONF_KEY)
     if ota_key := encryption_conf.get(CONF_KEY):
@@ -201,11 +221,6 @@ def _resolve_encryption_key(encryption_conf: ConfigType, api_conf: ConfigType) -
         )
     else:
         encryption_conf[CONF_KEY] = api_key
-    if is_reserved_key(encryption_conf[CONF_KEY]):
-        raise cv.Invalid(
-            f"The all-zeros {CONF_KEY} is reserved and provides no protection; "
-            f"generate a real key with: openssl rand -base64 32"
-        )
 
 
 # Also called on merged same-port configs in final validate, where schemas
@@ -267,15 +282,9 @@ CONFIG_SCHEMA = cv.All(
 FINAL_VALIDATE_SCHEMA = ota_esphome_final_validate
 
 
-def FILTER_SOURCE_FILES() -> list[str]:
-    """Filter out the noise transport when no ota entry configures encryption."""
-    for ota_conf in CORE.config.get(CONF_OTA, []):
-        if (
-            ota_conf.get(CONF_PLATFORM) == CONF_ESPHOME
-            and ota_conf.get(CONF_ENCRYPTION) is not None
-        ):
-            return []
-    return ["ota_esphome_noise.cpp"]
+FILTER_SOURCE_FILES = filter_source_files_from_defines(
+    {"ota_esphome_noise.cpp": "USE_OTA_ENCRYPTION"}
+)
 
 
 @coroutine_with_priority(CoroPriority.OTA_UPDATES)
@@ -296,11 +305,24 @@ async def to_code(config: ConfigType) -> None:
     if config.get(CONF_ALLOW_PARTITION_ACCESS):
         cg.add_define("USE_OTA_PARTITIONS")
 
-    if (encryption_conf := config.get(CONF_ENCRYPTION)) is not None:
-        # A missing key was resolved from the api component in final validate.
-        key = encryption_conf[CONF_KEY]
+    # One key per device: an api encryption block supplies it (static or
+    # runtime) and offers; the ota block only adds the requirement
+    api_conf = CORE.config.get(CONF_API) or {}
+    encryption_conf = config.get(CONF_ENCRYPTION)
+    own_key = None
+    if encryption_conf is not None and static_encryption_key(api_conf) is None:
+        own_key = encryption_conf[CONF_KEY]
+    if own_key is not None:
         cg.add_define("USE_OTA_ENCRYPTION")
-        cg.add(var.set_noise_psk(list(decode_encryption_key(key))))
+        cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], own_key)))
+    elif CONF_ENCRYPTION in api_conf:
+        cg.add_define("USE_OTA_ENCRYPTION")
+        cg.add_define("USE_OTA_ENCRYPTION_FROM_API")
+        if static_encryption_key(api_conf) is None:
+            # The key arrives at runtime, so the offer has to look for it
+            cg.add_define("USE_OTA_ENCRYPTION_PROVISIONED")
+    if encryption_conf is not None:
+        cg.add_define("USE_OTA_ENCRYPTION_REQUIRED")
 
     # Build flag so lwip_fast_select.c (a .c file that can't include defines.h) sees it.
     cg.add_build_flag("-DUSE_OTA_PLATFORM_ESPHOME")

esphome/components/esphome/ota/ota_esphome.cpp

@@ -1,4 +1,7 @@
 #include "ota_esphome.h"
+#ifdef USE_OTA_ENCRYPTION_FROM_API
+#include "esphome/components/api/api_server.h"
+#endif
 #ifdef USE_OTA
 #ifdef USE_OTA_PASSWORD
 #include "esphome/components/sha256/sha256.h"
@@ -26,9 +29,22 @@
 namespace esphome {
 
 static const char *const TAG = "esphome.ota";
+
+#ifdef USE_OTA_ENCRYPTION
+const noise::NoiseContext &ESPHomeOTAComponent::noise_context_() const {
+#ifdef USE_OTA_ENCRYPTION_FROM_API
+  return api::global_api_server->get_noise_ctx();
+#else
+  return this->noise_ctx_;
+#endif
+}
+#endif
 static constexpr uint16_t OTA_BLOCK_SIZE = 8192;
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_HANDSHAKE = 20000;  // milliseconds for initial handshake
-static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 90000;       // milliseconds for data transfer
+// Milliseconds for data transfer. Covers the lwIP retransmit run seen in
+// practice for a lost chunk ack (1.5 + 3 + 6 + 12 + 24 + 48 s); the CLI waits
+// longer (espota2.DATA_PHASE_TIMEOUT) so the device is free before it retries
+static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 105000;
 
 // Single-instance pointer — multi-port configs are rejected in final_validate.
 // NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables)
@@ -97,18 +113,30 @@ void ESPHomeOTAComponent::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "Over-The-Air updates:\n"
                 "  Address: %s:%u\n"
-                "  Version: %d",
-                network::get_use_address_to(addr_buf), this->port_, USE_OTA_VERSION);
+                "  Version: %d"
+#ifdef USE_OTA_ENCRYPTION
+                "\n  Encryption: %s"
+#endif
+                ,
+                network::get_use_address_to(addr_buf), this->port_, USE_OTA_VERSION
+#ifdef USE_OTA_ENCRYPTION_REQUIRED
+                ,
+                LOG_STR_LITERAL("required")
+#elif defined(USE_OTA_ENCRYPTION_PROVISIONED)
+                // A runtime provisioned key may not exist yet
+                ,
+                this->noise_context_().has_psk() ? LOG_STR_LITERAL("offered, plaintext accepted")
+                                                 : LOG_STR_LITERAL("offered once the api key is provisioned")
+#elif defined(USE_OTA_ENCRYPTION)
+                ,
+                LOG_STR_LITERAL("offered, plaintext accepted")
+#endif
+  );
 #ifdef USE_OTA_PASSWORD
   if (!this->password_.empty()) {
     ESP_LOGCONFIG(TAG, "  Password configured");
   }
 #endif
-#ifdef USE_OTA_ENCRYPTION
-  if (this->noise_ctx_.has_psk()) {
-    ESP_LOGCONFIG(TAG, "  Encryption configured");
-  }
-#endif
 #ifdef USE_OTA_PARTITIONS
   ESP_LOGCONFIG(TAG,
                 "  Partition access allowed\n"
@@ -154,10 +182,22 @@ static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_NOISE = 0x08;
+// Noise needs the extended protocol: the prologue binds the 2-byte feature ack
+static constexpr uint8_t CLIENT_NOISE_FEATURES =
+    CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_NOISE = 0x04;
 
+inline bool ESPHomeOTAComponent::extended_proto_() const {
+#ifdef USE_OTA_ENCRYPTION_REQUIRED
+  // FEATURE_READ already refused every client without the extended protocol
+  return true;
+#else
+  return (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL) != 0;
+#endif
+}
+
 void ESPHomeOTAComponent::handle_handshake_() {
   /// Handle the OTA handshake and authentication.
   ///
@@ -241,12 +281,9 @@ void ESPHomeOTAComponent::handle_handshake_() {
       this->ota_features_ = this->handshake_buf_[0];
       ESP_LOGV(TAG, "Features: 0x%02X", this->ota_features_);
 
-#ifdef USE_OTA_ENCRYPTION
-      // Fail closed: with a PSK configured the client must negotiate encryption
-      // (which requires the extended protocol); refuse plaintext uploads.
-      static constexpr uint8_t NOISE_REQUIRED_FEATURES =
-          CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
-      if (this->noise_ctx_.has_psk() && (this->ota_features_ & NOISE_REQUIRED_FEATURES) != NOISE_REQUIRED_FEATURES) {
+#ifdef USE_OTA_ENCRYPTION_REQUIRED
+      // `ota: encryption:` requires the client to negotiate encryption
+      if ((this->ota_features_ & CLIENT_NOISE_FEATURES) != CLIENT_NOISE_FEATURES) {
         ESP_LOGW(TAG, "Client does not support encryption");
         this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_ENCRYPTION_REQUIRED);
         return;
@@ -261,18 +298,21 @@ void ESPHomeOTAComponent::handle_handshake_() {
       // Compose the feature-ack response. When the client negotiates the extended protocol we emit
       // a 2-byte response (marker + server feature flags); otherwise we emit the single-byte
       // legacy response.
-      this->extended_proto_ = (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL) != 0;
-      if (this->extended_proto_) {
+      if (this->extended_proto_()) {
         static_assert(HANDSHAKE_BUF_SIZE >= 2, "handshake_buf_ must hold the 2-byte extended-protocol feature ack");
         this->handshake_buf_[0] = ota::OTA_RESPONSE_FEATURE_FLAGS;
         this->handshake_buf_[1] = (supports_compression ? SERVER_FEATURE_SUPPORTS_COMPRESSION : 0);
 #ifdef USE_OTA_PARTITIONS
         this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS;
 #endif
-#ifdef USE_OTA_ENCRYPTION
-        if (this->noise_ctx_.has_psk()) {
+#ifdef USE_OTA_ENCRYPTION_PROVISIONED
+        // A runtime provisioned key may not exist yet
+        if (this->noise_context_().has_psk()) {
           this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
         }
+#elif defined(USE_OTA_ENCRYPTION)
+        // A yaml key always exists: validation rejects the all-zeros key
+        this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
 #endif
       } else {
         this->handshake_buf_[0] =
@@ -284,15 +324,15 @@ void ESPHomeOTAComponent::handle_handshake_() {
     case OTAState::FEATURE_ACK: {
       static constexpr size_t STANDARD_PROTO_ACK_SIZE = 1;
       static constexpr size_t EXTENDED_PROTO_ACK_SIZE = 2;
-      const size_t ack_size = this->extended_proto_ ? EXTENDED_PROTO_ACK_SIZE : STANDARD_PROTO_ACK_SIZE;
+      const size_t ack_size = this->extended_proto_() ? EXTENDED_PROTO_ACK_SIZE : STANDARD_PROTO_ACK_SIZE;
       if (!this->try_write_(ack_size, LOG_STR("ack feature"))) {
         return;
       }
 #ifdef USE_OTA_ENCRYPTION
-      // With a PSK configured the rest of the session runs inside the noise
-      // transport; the client sends the first handshake frame next, so there
-      // is nothing to do until data arrives.
-      if (this->noise_ctx_.has_psk()) {
+      // Latch the offer actually sent: a key activating between the two
+      // states must not start a session the client never expects
+      if ((this->handshake_buf_[1] & SERVER_FEATURE_SUPPORTS_NOISE) != 0 &&
+          (this->ota_features_ & CLIENT_NOISE_FEATURES) == CLIENT_NOISE_FEATURES) {
         // handshake_buf_ still holds the feature ack composed above; a
         // would-block re-entry lands here without rebuilding it
         if (!this->noise_start_session_(this->handshake_buf_[1])) {
@@ -412,7 +452,7 @@ void ESPHomeOTAComponent::handle_data_() {
   // Acknowledge auth OK - 1 byte
   this->data_write_byte_(ota::OTA_RESPONSE_AUTH_OK);
 
-  if (this->extended_proto_) {
+  if (this->extended_proto_()) {
     // Read ota type, 1 byte
     if (!this->data_readall_(buf, 1)) {
       this->log_read_error_(LOG_STR("OTA type"));
@@ -802,7 +842,14 @@ bool ESPHomeOTAComponent::handle_auth_send_() {
     const size_t hex_size = hasher.get_size() * 2;
     const size_t nonce_len = hasher.get_size() / 4;
     const size_t auth_buf_size = 1 + 3 * hex_size;
-    this->auth_buf_ = std::make_unique<uint8_t[]>(auth_buf_size);
+    // Internal RAM first: 128 of these bytes go straight into the hardware SHA engine
+    this->auth_buf_ =
+        RAMAllocator<uint8_t>(RAMAllocator<uint8_t>::PREFER_INTERNAL).make_unique_array_for_overwrite(auth_buf_size);
+    if (!this->auth_buf_) {
+      this->log_auth_warning_(LOG_STR("No memory"));
+      this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_UNKNOWN);
+      return false;
+    }
     this->auth_buf_pos_ = 0;
 
     char *buf = reinterpret_cast<char *>(this->auth_buf_.get() + 1);

esphome/components/esphome/ota/ota_esphome.h

@@ -44,8 +44,9 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   }
 #endif  // USE_OTA_PASSWORD
 
-#ifdef USE_OTA_ENCRYPTION
-  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
+#if defined(USE_OTA_ENCRYPTION) && !defined(USE_OTA_ENCRYPTION_FROM_API)
+  /// psk points at 32 bytes that live in flash for the life of the program
+  void set_noise_psk(const uint8_t *psk) { this->noise_ctx_.set_psk(psk); }
 #endif
 
   /// Manually set the port OTA should listen on
@@ -85,9 +86,12 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
     bool writing{false};    // a produced handshake frame is still being flushed
     uint8_t frame_buf[noise::FRAME_HEADER_SIZE + 1 + noise::MAX_HANDSHAKE_SIZE];
   };
+  // The api server's live context when the api has encryption, else our own
+  const noise::NoiseContext &noise_context_() const;
   bool noise_start_session_(uint8_t server_feature_flags);
   bool handle_noise_handshake_();
   bool noise_try_read_frame_();
+  size_t noise_frame_payload_len_(const uint8_t *header, size_t min_len, size_t max_len);
   bool noise_try_write_frame_();
   void noise_send_reject_(const LogString *reason);
   ssize_t noise_decrypt_(uint8_t *buf, size_t len);
@@ -141,11 +145,13 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
 
 #ifdef USE_OTA_PASSWORD
   std::string password_;
-  std::unique_ptr<uint8_t[]> auth_buf_;
+  RAMUniquePtr<uint8_t[]> auth_buf_;
 #endif  // USE_OTA_PASSWORD
 #ifdef USE_OTA_ENCRYPTION
+#ifndef USE_OTA_ENCRYPTION_FROM_API
   noise::NoiseContext noise_ctx_;
-  std::unique_ptr<NoiseSession> noise_;
+#endif
+  RAMUniquePtr<NoiseSession> noise_;
 #endif  // USE_OTA_ENCRYPTION
 
   socket::ListenSocket *server_{nullptr};
@@ -166,6 +172,8 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
                 "OTA_BUFFER_SIZE must fit a full encrypted data frame");
 #endif
   static constexpr uint8_t MAGIC_BYTES[5] = {0x6C, 0x26, 0xF7, 0x5C, 0x45};
+  // Derived from the feature byte; storing it would pad the trailing bytes
+  bool extended_proto_() const;
 #ifdef USE_OTA_PARTITIONS
   uint32_t running_app_offset_{0};
   size_t running_app_size_{0};
@@ -179,7 +187,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   uint8_t auth_buf_pos_{0};
   uint8_t auth_type_{0};  // Store auth type to know which hasher to use
 #endif                    // USE_OTA_PASSWORD
-  bool extended_proto_{false};
 };
 
 }  // namespace esphome

esphome/components/esphome/ota/ota_esphome_noise.cpp

@@ -3,10 +3,10 @@
 #ifdef USE_OTA_ENCRYPTION
 #include "esphome/components/noise/noise.h"
 #include "esphome/components/ota/ota_backend.h"
+#include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
 #include <cstring>
-#include <new>
 
 #ifdef USE_ESP8266
 #include <pgmspace.h>
@@ -40,24 +40,16 @@ ESPHomeOTAComponent::NoiseSession::~NoiseSession() {
  *   "NoiseOTAInit" | magic(5) | OK,version | client_features | FEATURE_FLAGS,server_flags
  */
 bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
-  // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks)
-  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession());
-  if (this->noise_ == nullptr) {
-    ESP_LOGW(TAG, "Session allocation failed");
-    this->cleanup_connection_();
-    return false;
-  }
-
+  // A provisioned key cleared between the offer and here is not guarded: the
+  // session runs on the zero key load_psk fills in and fails the client's MAC.
+  // Default placement, PSRAM first where present: the session only lives for one upload
+  this->noise_ = RAMAllocator<NoiseSession>().make_unique();
   static constexpr size_t PROLOGUE_ACK_LEN = 2;  // OTA_RESPONSE_OK + version
   static constexpr size_t PROLOGUE_CLIENT_FEATURES_LEN = 1;
   static constexpr size_t PROLOGUE_FEATURE_ACK_LEN = 2;  // OTA_RESPONSE_FEATURE_FLAGS + server flags
   uint8_t prologue[OTA_NOISE_PROLOGUE_INIT_LEN + sizeof(MAGIC_BYTES) + PROLOGUE_ACK_LEN + PROLOGUE_CLIENT_FEATURES_LEN +
                    PROLOGUE_FEATURE_ACK_LEN];
-#ifdef USE_ESP8266
-  memcpy_P(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
-#else
-  std::memcpy(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
-#endif
+  progmem_memcpy(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
   uint8_t *p = prologue + OTA_NOISE_PROLOGUE_INIT_LEN;
   // Magic bytes, already validated in MAGIC_READ
   std::memcpy(p, MAGIC_BYTES, sizeof(MAGIC_BYTES));
@@ -71,9 +63,13 @@ bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
   *p++ = ota::OTA_RESPONSE_FEATURE_FLAGS;
   *p++ = server_feature_flags;
 
-  int err = this->noise_->handshake.init(this->noise_ctx_.get_psk(), prologue, sizeof(prologue));
+  // The caller only starts a session when the context holds a key
+  int err = this->noise_ == nullptr ? NOISE_ERROR_NO_MEMORY
+                                    : this->noise_->handshake.init(this->noise_context_(), prologue, sizeof(prologue));
   if (err != 0) {
-    ESP_LOGW(TAG, "Handshake init: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    // Raw noise codes throughout: the name table would cost flash in builds
+    // where only the OTA uses noise
+    ESP_LOGW(TAG, "Session init: %d", err);
     this->cleanup_connection_();
     return false;
   }
@@ -105,14 +101,16 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
         s.frame_pos = 0;
         s.frame_len = 0;
         if (s.frame_buf[noise::FRAME_HEADER_SIZE] != noise::HANDSHAKE_STATUS_OK) {
-          ESP_LOGW(TAG, "Bad handshake error byte: %u", s.frame_buf[noise::FRAME_HEADER_SIZE]);
+          ESP_LOGW(TAG, "Client rejected the handshake: %u", s.frame_buf[noise::FRAME_HEADER_SIZE]);
           this->cleanup_connection_();
           return false;
         }
         int err = s.handshake.read_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, payload_len - 1);
         if (err != 0) {
-          ESP_LOGW(TAG, "Handshake read: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-          this->noise_send_reject_(noise::reject_reason_for(err));
+          // A MAC failure here almost always means the uploader has a different key
+          const LogString *reason = noise::reject_reason_for(err);
+          ESP_LOGW(TAG, "Handshake read: %s (%d)", LOG_STR_ARG(reason), err);
+          this->noise_send_reject_(reason);
           this->cleanup_connection_();
           return false;
         }
@@ -123,7 +121,7 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
         int err =
             s.handshake.write_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, noise::MAX_HANDSHAKE_SIZE, msg_len);
         if (err != 0) {
-          ESP_LOGW(TAG, "Handshake write: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+          ESP_LOGW(TAG, "Handshake write: %d", err);
           this->cleanup_connection_();
           return false;
         }
@@ -138,7 +136,7 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
       case noise::NoiseResponderHandshake::Action::ACTION_SPLIT: {
         int err = s.handshake.split(s.send_cipher, s.recv_cipher);
         if (err != 0) {
-          ESP_LOGW(TAG, "Handshake split: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+          ESP_LOGW(TAG, "Handshake split: %d", err);
           this->cleanup_connection_();
           return false;
         }
@@ -154,33 +152,41 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
   }
 }
 
+/// Payload length from a frame header, or 0 (logged) when the indicator or
+/// the length is out of range. Callers pass min_len >= 1 so 0 is never valid.
+size_t ESPHomeOTAComponent::noise_frame_payload_len_(const uint8_t *header, size_t min_len, size_t max_len) {
+  const size_t payload_len = encode_uint16(header[1], header[2]);
+  if (header[0] != noise::FRAME_INDICATOR || payload_len < min_len || payload_len > max_len) {
+    ESP_LOGW(TAG, "Bad frame: 0x%02X, %zu bytes", header[0], payload_len);
+    return 0;
+  }
+  return payload_len;
+}
+
 /// Non-blocking read of one handshake frame into the session buffer.
 bool ESPHomeOTAComponent::noise_try_read_frame_() {
   NoiseSession &s = *this->noise_;
-  while (s.frame_pos < noise::FRAME_HEADER_SIZE) {
-    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, noise::FRAME_HEADER_SIZE - s.frame_pos);
-    if (!this->handle_read_error_(read, LOG_STR("read noise header"))) {
-      return false;
+  while (true) {
+    // The header first, then the body once the header says how long it is
+    const uint16_t want = s.frame_len == 0 ? noise::FRAME_HEADER_SIZE : s.frame_len;
+    if (s.frame_pos < want) {
+      ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, want - s.frame_pos);
+      if (!this->handle_read_error_(read, LOG_STR("read noise"))) {
+        return false;
+      }
+      s.frame_pos += read;
+      continue;
     }
-    s.frame_pos += read;
-  }
-  if (s.frame_len == 0) {
-    const uint16_t payload_len = encode_uint16(s.frame_buf[1], s.frame_buf[2]);
-    if (s.frame_buf[0] != noise::FRAME_INDICATOR || payload_len < 1 || payload_len > 1 + noise::MAX_HANDSHAKE_SIZE) {
-      ESP_LOGW(TAG, "Bad handshake frame: 0x%02X, %u bytes", s.frame_buf[0], payload_len);
+    if (s.frame_len != 0) {
+      return true;
+    }
+    const size_t payload_len = this->noise_frame_payload_len_(s.frame_buf, 1, 1 + noise::MAX_HANDSHAKE_SIZE);
+    if (payload_len == 0) {
       this->cleanup_connection_();
       return false;
     }
     s.frame_len = noise::FRAME_HEADER_SIZE + payload_len;
   }
-  while (s.frame_pos < s.frame_len) {
-    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, s.frame_len - s.frame_pos);
-    if (!this->handle_read_error_(read, LOG_STR("read noise frame"))) {
-      return false;
-    }
-    s.frame_pos += read;
-  }
-  return true;
 }
 
 /// Non-blocking write of the pending session-buffer frame.
@@ -214,7 +220,7 @@ ssize_t ESPHomeOTAComponent::noise_decrypt_(uint8_t *buf, size_t len) {
   noise_buffer_set_inout(mbuf, buf, len, len);
   int err = noise_cipherstate_decrypt(this->noise_->recv_cipher, &mbuf);
   if (err != 0) {
-    ESP_LOGW(TAG, "Decrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    ESP_LOGW(TAG, "Decrypt: %d", err);
     return -1;
   }
   return mbuf.size;
@@ -229,9 +235,8 @@ ssize_t ESPHomeOTAComponent::noise_read_frame_blocking_(uint8_t *buf, size_t min
   if (!this->readall_(header, sizeof(header))) {
     return -1;
   }
-  const size_t ciphertext_len = encode_uint16(header[1], header[2]);
-  if (header[0] != noise::FRAME_INDICATOR || ciphertext_len < min_ciphertext || ciphertext_len > max_ciphertext) {
-    ESP_LOGW(TAG, "Bad frame: 0x%02X, %zu bytes", header[0], ciphertext_len);
+  const size_t ciphertext_len = this->noise_frame_payload_len_(header, min_ciphertext, max_ciphertext);
+  if (ciphertext_len == 0) {
     return -1;
   }
   if (!this->readall_(buf, ciphertext_len)) {
@@ -267,7 +272,7 @@ bool ESPHomeOTAComponent::noise_write_byte_(uint8_t byte) {
   noise_buffer_set_inout(mbuf, frame + noise::FRAME_HEADER_SIZE, 1, 1 + noise::MAC_SIZE);
   int err = noise_cipherstate_encrypt(this->noise_->send_cipher, &mbuf);
   if (err != 0) {
-    ESP_LOGW(TAG, "Encrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    ESP_LOGW(TAG, "Encrypt: %d", err);
     return false;
   }
   noise::write_frame_header(frame, mbuf.size);

esphome/components/espnow/__init__.py

@@ -3,6 +3,7 @@ from typing import Any
 from esphome import automation, core
 import esphome.codegen as cg
 from esphome.components import wifi
+from esphome.components.esp32 import VARIANT_ESP32P4, get_esp32_variant
 from esphome.components.udp import CONF_ON_RECEIVE
 import esphome.config_validation as cv
 from esphome.const import (
@@ -17,6 +18,7 @@ from esphome.const import (
 )
 from esphome.core import CORE, HexInt
 from esphome.cpp_generator import MockObj, TemplateArgsType
+import esphome.final_validate as fv
 from esphome.types import ConfigType
 
 CODEOWNERS = ["@jesserockz"]
@@ -132,6 +134,24 @@ CONFIG_SCHEMA = cv.All(
 )
 
 
+def _validate_variant(config: ConfigType) -> ConfigType:
+    # ESP-NOW rides the Wi-Fi PHY. Radio-less esp32 variants have no native
+    # ESP-NOW; only the ESP32-P4 has a path, via the esp32_hosted shim that
+    # supplies the esp_now_* symbols. Fail here with a clear message instead of
+    # letting the build reach an "undefined reference to esp_now_*" link error.
+    variant = get_esp32_variant()
+    if wifi.variant_has_wifi(variant):
+        return config
+    if variant != VARIANT_ESP32P4:
+        raise cv.Invalid(f"ESP-NOW is not supported on {variant} (no Wi-Fi radio)")
+    if "esp32_hosted" not in fv.full_config.get():
+        raise cv.Invalid(f"ESP-NOW on {variant} requires the esp32_hosted component")
+    return config
+
+
+FINAL_VALIDATE_SCHEMA = _validate_variant
+
+
 async def _trigger_to_code(config: ConfigType) -> MockObj:
     if address := config.get(CONF_ADDRESS):
         address = address.parts

esphome/components/ethernet/__init__.py

@@ -420,7 +420,9 @@ def _validate(config: ConfigType) -> ConfigType:
 BASE_SCHEMA = cv.Schema(
     {
         cv.GenerateID(): cv.declare_id(EthernetComponent),
-        cv.Optional(CONF_MANUAL_IP): MANUAL_IP_SCHEMA,
+        cv.Optional(
+            CONF_MANUAL_IP, visibility=cv.Visibility.ADVANCED
+        ): MANUAL_IP_SCHEMA,
         cv.Optional(CONF_DOMAIN, default=".local"): cv.domain_name,
         cv.Optional(CONF_USE_ADDRESS): cv.string_strict,
         cv.Optional(CONF_MAC_ADDRESS): cv.mac_address,

esphome/components/ethernet/w5500_custom_spi.cpp

@@ -6,17 +6,21 @@
 #include <freertos/FreeRTOS.h>
 #include <freertos/semphr.h>
 #include <cstring>
-#include <new>
 
 namespace esphome::ethernet {
 
 namespace {
 
-// Per-device context returned by init() and handed back to read/write/deinit.
+// Context returned by init() and handed back to read/write/deinit. There is one W5500 per device, so a
+// single static instance replaces a heap allocation that could fail. It is always clear when init() runs:
+// esp_eth_mac_new_w5500() calls deinit() on every failure after init() succeeded, and nothing else
+// uninstalls the driver
 struct W5500CustomSpiContext {
   spi_device_handle_t handle;
   SemaphoreHandle_t lock;
 };
+// NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables) - intentional mutable state
+W5500CustomSpiContext w5500_context{};
 
 // Transfers up to the ESP32 SPI hardware FIFO size (64 bytes) stay on the polling path; larger
 // transfers (the frame payloads) use the blocking, DMA-backed transmit.
@@ -25,23 +29,20 @@ constexpr uint32_t W5500_SPI_LOCK_TIMEOUT_MS = 50;
 
 void *w5500_custom_spi_init(const void *spi_config) {
   const auto *config = static_cast<const eth_w5500_config_t *>(spi_config);
-  auto *ctx = new (std::nothrow) W5500CustomSpiContext{};
-  if (ctx == nullptr) {
-    return nullptr;
-  }
+  auto *ctx = &w5500_context;
   // The W5500 SPI frame carries the 16-bit address in the command phase and the 8-bit control
   // byte in the address phase; mirror what the stock driver configures.
   spi_device_interface_config_t devcfg = *config->spi_devcfg;
   devcfg.command_bits = 16;
   devcfg.address_bits = 8;
   if (spi_bus_add_device(config->spi_host_id, &devcfg, &ctx->handle) != ESP_OK) {
-    delete ctx;
+    ctx->handle = nullptr;
     return nullptr;
   }
   ctx->lock = xSemaphoreCreateMutex();
   if (ctx->lock == nullptr) {
     spi_bus_remove_device(ctx->handle);
-    delete ctx;
+    ctx->handle = nullptr;
     return nullptr;
   }
   return ctx;
@@ -51,7 +52,7 @@ esp_err_t w5500_custom_spi_deinit(void *spi_ctx) {
   auto *ctx = static_cast<W5500CustomSpiContext *>(spi_ctx);
   spi_bus_remove_device(ctx->handle);
   vSemaphoreDelete(ctx->lock);
-  delete ctx;
+  *ctx = {};
   return ESP_OK;
 }
 

esphome/components/file/image.py

@@ -42,7 +42,7 @@ from esphome.const import (
     CONF_TYPE,
     CONF_URL,
 )
-from esphome.core import CORE, HexInt
+from esphome.core import HexInt
 from esphome.cpp_generator import MockObj, MockObjClass
 from esphome.external_files import RemoteFile
 from esphome.types import ConfigType
@@ -76,16 +76,18 @@ def compute_local_image_path(value: str | ConfigType) -> Path:
     return external_files.compute_local_file_path(DOMAIN, url)
 
 
-def local_path(value: str | ConfigType) -> str:
-    value = value[CONF_PATH] if isinstance(value, dict) else value
-    return str(CORE.relative_config_path(value))
+def local_path(value: Path | ConfigType) -> Path:
+    # cv.file_ has already resolved the path against the config dir.
+    return value[CONF_PATH] if isinstance(value, dict) else value
 
 
-def download_file(url: str, path: Path) -> str:
+def download_file(url: str, path: Path) -> Path:
     # The shared NETWORK_TIMEOUT applies; a per-caller timeout would be
     # silently ignored on a per-run memo hit anyway (memos key by path).
     external_files.download_content(url, path)
-    return str(path)
+    # Keep the Path: config-hash normalizes Path values under the data dir,
+    # which a str would dump verbatim and break the CLI/add-on comparison.
+    return path
 
 
 def _gh_svg_url_path(mdi_id: str, source: str) -> tuple[str, Path]:
@@ -93,13 +95,13 @@ def _gh_svg_url_path(mdi_id: str, source: str) -> tuple[str, Path]:
     return MDI_SOURCES[source] + mdi_id + ".svg", base_dir / f"{mdi_id}.svg"
 
 
-def download_gh_svg(value: str | ConfigType, source: str) -> str:
+def download_gh_svg(value: str | ConfigType, source: str) -> Path:
     mdi_id = value[CONF_ICON] if isinstance(value, dict) else value
     url, path = _gh_svg_url_path(mdi_id, source)
     return download_file(url, path)
 
 
-def download_image(value: str | ConfigType) -> str:
+def download_image(value: str | ConfigType) -> Path:
     value = value[CONF_URL] if isinstance(value, dict) else value
     return download_file(value, compute_local_image_path(value))
 
@@ -147,7 +149,7 @@ def _extract_entry_ref(entry: ConfigType) -> RemoteFile | None:
 PREFETCH_FILES = external_files.single_stage_prefetch(_extract_entry_ref)
 
 
-def validate_file_shorthand(value: Any) -> str:
+def validate_file_shorthand(value: Any) -> Path:
     value = cv.string_strict(value)
     if (remote := _parse_remote_shorthand(value)) is not None:
         return download_file(remote.url, remote.path)
@@ -165,7 +167,7 @@ LOCAL_SCHEMA = cv.All(
 
 
 def mdi_schema(source: str) -> cv.All:
-    def validate_mdi(value: ConfigType) -> str:
+    def validate_mdi(value: ConfigType) -> Path:
         return download_gh_svg(value, source)
 
     return cv.All(

esphome/components/gpio/switch/__init__.py

@@ -15,9 +15,13 @@ CONFIG_SCHEMA = (
     .extend(
         {
             cv.Required(CONF_PIN): pins.gpio_output_pin_schema,
-            cv.Optional(CONF_INTERLOCK): cv.ensure_list(cv.use_id(switch.Switch)),
             cv.Optional(
-                CONF_INTERLOCK_WAIT_TIME, default="0ms"
+                CONF_INTERLOCK, visibility=cv.Visibility.ADVANCED
+            ): cv.ensure_list(cv.use_id(switch.Switch)),
+            cv.Optional(
+                CONF_INTERLOCK_WAIT_TIME,
+                default="0ms",
+                visibility=cv.Visibility.ADVANCED,
             ): cv.positive_time_period_milliseconds,
         }
     )

esphome/components/i2s_audio/speaker/i2s_audio_speaker.cpp

@@ -53,6 +53,13 @@ void I2SAudioSpeakerBase::dump_config() {
 void I2SAudioSpeakerBase::loop() {
   uint32_t event_group_bits = xEventGroupGetBits(this->event_group_);
 
+  // A stop that arrives while stopped cancels any start that has not been processed yet
+  constexpr uint32_t stop_bits = SpeakerEventGroupBits::COMMAND_STOP | SpeakerEventGroupBits::COMMAND_STOP_GRACEFULLY;
+  if ((event_group_bits & stop_bits) && (this->state_ == speaker::STATE_STOPPED)) {
+    xEventGroupClearBits(this->event_group_, stop_bits | SpeakerEventGroupBits::COMMAND_START);
+    event_group_bits &= ~(stop_bits | SpeakerEventGroupBits::COMMAND_START);
+  }
+
   if ((event_group_bits & SpeakerEventGroupBits::COMMAND_START) && (this->state_ == speaker::STATE_STOPPED)) {
     this->state_ = speaker::STATE_STARTING;
     xEventGroupClearBits(this->event_group_, SpeakerEventGroupBits::COMMAND_START);
@@ -91,7 +98,14 @@ void I2SAudioSpeakerBase::loop() {
     this->speaker_task_handle_ = nullptr;
 
     this->stop_i2s_driver_();
-    xEventGroupClearBits(this->event_group_, SpeakerEventGroupBits::ALL_BITS);
+    // ALL_BITS includes COMMAND_START. Take the bits from the clear itself, not from the snapshot at
+    // the top of loop(): the audio source's task can raise a start at any point above, including
+    // during stop_i2s_driver_(), and nothing would ever re-issue it.
+    const EventBits_t bits_before_clear = xEventGroupClearBits(this->event_group_, SpeakerEventGroupBits::ALL_BITS);
+    if (bits_before_clear & SpeakerEventGroupBits::COMMAND_START) {
+      ESP_LOGD(TAG, "Start requested while stopping; keeping the request");
+      xEventGroupSetBits(this->event_group_, SpeakerEventGroupBits::COMMAND_START);
+    }
     this->status_clear_error();
 
     this->on_task_stopped();
@@ -111,21 +125,24 @@ void I2SAudioSpeakerBase::loop() {
         break;
       }
 
+      // Still starting up or winding down from a previous run
+      if ((this->tx_handle_ != nullptr) || (this->speaker_task_handle_ != nullptr)) {
+        break;
+      }
+
       if (this->start_i2s_driver(this->audio_stream_info_) != ESP_OK) {
         ESP_LOGE(TAG, "Driver failed to start; retrying in 1 second");
         this->status_momentary_error("driver-failure", 1000);
         break;
       }
 
-      if (this->speaker_task_handle_ == nullptr) {
-        xTaskCreate(I2SAudioSpeakerBase::speaker_task, "speaker_task", TASK_STACK_SIZE, (void *) this, TASK_PRIORITY,
-                    &this->speaker_task_handle_);
+      xTaskCreate(I2SAudioSpeakerBase::speaker_task, "speaker_task", TASK_STACK_SIZE, (void *) this, TASK_PRIORITY,
+                  &this->speaker_task_handle_);
 
-        if (this->speaker_task_handle_ == nullptr) {
-          ESP_LOGE(TAG, "Task failed to start, retrying in 1 second");
-          this->status_momentary_error("task-failure", 1000);
-          this->stop_i2s_driver_();  // Stops the driver to return the lock; will be reloaded in next attempt
-        }
+      if (this->speaker_task_handle_ == nullptr) {
+        ESP_LOGE(TAG, "Task failed to start, retrying in 1 second");
+        this->status_momentary_error("task-failure", 1000);
+        this->stop_i2s_driver_();  // Stops the driver to return the lock; will be reloaded in next attempt
       }
       break;
     case speaker::STATE_RUNNING:   // Intentional fallthrough
@@ -211,8 +228,8 @@ size_t I2SAudioSpeakerBase::play(const uint8_t *data, size_t length, TickType_t
 }
 
 bool I2SAudioSpeakerBase::has_buffered_data() const {
-  if (this->audio_ring_buffer_.use_count() > 0) {
-    std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->audio_ring_buffer_.lock();
+  std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->audio_ring_buffer_.lock();
+  if (temp_ring_buffer != nullptr) {
     return temp_ring_buffer->available() > 0;
   }
   return false;
@@ -229,8 +246,6 @@ void I2SAudioSpeakerBase::start() {
   if ((this->state_ == speaker::STATE_STARTING) || (this->state_ == speaker::STATE_RUNNING))
     return;
 
-  // Mark STARTING immediately to avoid transient STOPPED observations before loop() processes COMMAND_START.
-  this->state_ = speaker::STATE_STARTING;
   xEventGroupSetBits(this->event_group_, SpeakerEventGroupBits::COMMAND_START);
 }
 
@@ -239,11 +254,10 @@ void I2SAudioSpeakerBase::stop() { this->stop_(false); }
 void I2SAudioSpeakerBase::finish() { this->stop_(true); }
 
 void I2SAudioSpeakerBase::stop_(bool wait_on_empty) {
-  if (this->is_failed())
-    return;
-  if (this->state_ == speaker::STATE_STOPPED)
+  if (!this->is_ready() || this->is_failed())
     return;
 
+  // Always set the bit, even when stopped, so loop() can cancel a start that is still pending
   if (wait_on_empty) {
     xEventGroupSetBits(this->event_group_, SpeakerEventGroupBits::COMMAND_STOP_GRACEFULLY);
   } else {

esphome/components/light/__init__.py

@@ -340,6 +340,10 @@ RESTORE_MODES = {
     "RESTORE_AND_ON": LightRestoreMode.LIGHT_RESTORE_AND_ON,
 }
 
+# Schema default that also matches the C++ initializer in light_state.h; codegen
+# skips the setter when the config equals it.
+DEFAULT_FLASH_TRANSITION_LENGTH = "0s"
+
 LIGHT_SCHEMA = (
     cv.ENTITY_BASE_SCHEMA.extend(web_server.WEBSERVER_SORTING_SCHEMA)
     .extend(cv.MQTT_COMMAND_COMPONENT_SCHEMA)
@@ -387,7 +391,7 @@ BRIGHTNESS_ONLY_LIGHT_SCHEMA = LIGHT_SCHEMA.extend(
             CONF_DEFAULT_TRANSITION_LENGTH, default="1s"
         ): cv.positive_time_period_milliseconds,
         cv.Optional(
-            CONF_FLASH_TRANSITION_LENGTH, default="0s"
+            CONF_FLASH_TRANSITION_LENGTH, default=DEFAULT_FLASH_TRANSITION_LENGTH
         ): cv.positive_time_period_milliseconds,
         cv.Optional(CONF_EFFECTS): validate_effects(MONOCHROMATIC_EFFECTS),
     }
@@ -502,9 +506,12 @@ async def setup_light_core_(light_var, config, output_var):
         default_transition_length := config.get(CONF_DEFAULT_TRANSITION_LENGTH)
     ) is not None:
         cg.add(light_var.set_default_transition_length(default_transition_length))
+    # Skip the setter when the config matches the C++ initializer.
     if (
         flash_transition_length := config.get(CONF_FLASH_TRANSITION_LENGTH)
-    ) is not None:
+    ) is not None and flash_transition_length != cv.time_period(
+        DEFAULT_FLASH_TRANSITION_LENGTH
+    ):
         cg.add(light_var.set_flash_transition_length(flash_transition_length))
     if (gamma_correct := config.get(CONF_GAMMA_CORRECT)) is not None:
         cg.add(light_var.set_gamma_correct(gamma_correct))
@@ -514,7 +521,8 @@ async def setup_light_core_(light_var, config, output_var):
     effects = await cg.build_registry_list(
         EFFECTS_REGISTRY, config.get(CONF_EFFECTS, [])
     )
-    cg.add(light_var.add_effects(effects))
+    if effects:
+        cg.add(light_var.add_effects(effects))
 
     for conf in config.get(CONF_ON_TURN_ON, []):
         trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], light_var)

esphome/components/light/light_state.h

@@ -356,7 +356,7 @@ class LightState : public EntityBase, public Component {
   /// Default transition length for all transitions in ms.
   uint32_t default_transition_length_{};
   /// Transition length to use for flash transitions.
-  uint32_t flash_transition_length_{};
+  uint32_t flash_transition_length_{};  // Keep in sync with DEFAULT_FLASH_TRANSITION_LENGTH in __init__.py
   /// Gamma correction factor for the light.
   float gamma_correct_{};
 #ifdef USE_LIGHT_GAMMA_LUT

esphome/components/logger/__init__.py

@@ -362,12 +362,13 @@ async def to_code(config: ConfigType) -> None:
     # pre_setup() switches on uart_ to decide which hardware to initialize
     # (e.g. UART0 vs USB_SERIAL_JTAG). Without this, uart_ is still the
     # default UART_SELECTION_UART0 and the wrong hardware gets initialized.
-    if CONF_HARDWARE_UART in config:
-        cg.add(
-            log.set_uart_selection(
-                HARDWARE_UART_TO_UART_SELECTION[config[CONF_HARDWARE_UART]]
-            )
-        )
+    # uart_ is UART0 in C++ except on LibreTiny where it is DEFAULT; skip the
+    # setter when the config matches it.
+    cpp_default_uart = DEFAULT if CORE.is_libretiny else UART0
+    if (
+        hardware_uart := config.get(CONF_HARDWARE_UART)
+    ) is not None and hardware_uart != cpp_default_uart:
+        cg.add(log.set_uart_selection(HARDWARE_UART_TO_UART_SELECTION[hardware_uart]))
     # pre_setup() sets global_logger and must run before any other code
     # that may call ESP_LOG* (e.g. setup_preferences contains ESP_LOGVV).
     cg.add(log.pre_setup())

esphome/components/logger/logger.h

@@ -352,10 +352,10 @@ class Logger final : public Component {
   // Group smaller types together at the end
   uint8_t current_level_{ESPHOME_LOG_LEVEL_VERY_VERBOSE};
 #if defined(USE_ESP32) || defined(USE_ESP8266) || defined(USE_RP2) || defined(USE_ZEPHYR)
-  UARTSelection uart_{UART_SELECTION_UART0};
+  UARTSelection uart_{UART_SELECTION_UART0};  // Must match cpp_default_uart in __init__.py
 #endif
 #ifdef USE_LIBRETINY
-  UARTSelection uart_{UART_SELECTION_DEFAULT};
+  UARTSelection uart_{UART_SELECTION_DEFAULT};  // Must match cpp_default_uart in __init__.py
 #endif
 #if defined(USE_ESP32) || defined(USE_HOST) || defined(USE_LIBRETINY) || defined(USE_ZEPHYR)
   bool main_task_recursion_guard_{false};

esphome/components/logger/logger_esp32.cpp

@@ -5,6 +5,7 @@
 #include <esp_log.h>
 
 #include <driver/uart.h>
+#include <soc/soc_caps.h>
 
 #ifdef USE_LOGGER_UART_SELECTION_USB_SERIAL_JTAG
 #include <driver/usb_serial_jtag.h>
@@ -76,7 +77,11 @@ void init_uart(uart_port_t uart_num, uint32_t baud_rate, int tx_buffer_size) {
   uart_config.parity = UART_PARITY_DISABLE;
   uart_config.stop_bits = UART_STOP_BITS_1;
   uart_config.flow_ctrl = UART_HW_FLOWCTRL_DISABLE;
+#if SOC_UART_SUPPORT_XTAL_CLK
+  uart_config.source_clk = UART_SCLK_XTAL;
+#else
   uart_config.source_clk = UART_SCLK_DEFAULT;
+#endif
   uart_param_config(uart_num, &uart_config);
   // The logger only writes to UART, never reads, so use the minimum RX buffer.
   // ESP-IDF requires rx_buffer_size > UART_HW_FIFO_LEN (128 bytes).

esphome/components/lvgl/widgets/keyboard.py

@@ -15,6 +15,7 @@ from ..defines import (
 from ..types import LvCompound, LvType
 from . import Widget, WidgetType, get_widgets
 from .buttonmatrix import CONF_BUTTONMATRIX
+from .label import CONF_LABEL
 from .textarea import CONF_TEXTAREA, lv_textarea_t
 
 CONF_KEYBOARD = "keyboard"
@@ -49,7 +50,7 @@ class KeyboardType(WidgetType):
         )
 
     def get_uses(self):
-        return CONF_KEYBOARD, CONF_TEXTAREA, CONF_BUTTONMATRIX
+        return CONF_KEYBOARD, CONF_TEXTAREA, CONF_BUTTONMATRIX, CONF_LABEL
 
     async def to_code(self, w: Widget, config: dict):
         add_lv_use("KEY_LISTENER")

esphome/components/lvgl/widgets/lv_list.py

@@ -227,6 +227,7 @@ LIST_ID_SCHEMA = cv.Schema({cv.Required(CONF_ID): cv.use_id(lv_list_t)})
 )
 async def list_add_text_to_code(config, action_id, template_arg, args):
     widgets = await get_widgets(config)
+    await _wait_list_triggers_completed()
 
     async def do_add_text(w: Widget):
         text = await lv_text.process(config[CONF_TEXT])
@@ -370,6 +371,7 @@ async def list_add_to_code(config, action_id, template_arg, args):
     _register_lv_uses(w_type_name, w_conf)
     _register_dynamic_widget_style_uses(w_conf)
     widgets = await get_widgets(config)
+    await _wait_list_triggers_completed()
 
     async def do_add(w: Widget):
         index = None
@@ -503,6 +505,7 @@ LIST_REMOVE_SCHEMA = LIST_ID_SCHEMA.extend(
 )
 async def list_remove_to_code(config, action_id, template_arg, args):
     widgets = await get_widgets(config)
+    await _wait_list_triggers_completed()
 
     async def do_remove(w: Widget):
         index = await lv_int.process(config[CONF_INDEX])
@@ -536,6 +539,7 @@ async def list_remove_to_code(config, action_id, template_arg, args):
 )
 async def list_clear_to_code(config, action_id, template_arg, args):
     widgets = await get_widgets(config)
+    await _wait_list_triggers_completed()
 
     async def do_clear(w: Widget):
         await _wait_list_triggers_completed()

esphome/components/lvgl/widgets/qrcode.py

@@ -10,6 +10,7 @@ from ..types import lv_obj_t
 from . import Widget, WidgetType
 from .canvas import CONF_CANVAS
 from .img import CONF_IMAGE
+from .label import CONF_LABEL
 
 CONF_QRCODE = "qrcode"
 CONF_DARK_COLOR = "dark_color"
@@ -41,7 +42,7 @@ class QrCodeType(WidgetType):
         )
 
     def get_uses(self):
-        return CONF_CANVAS, CONF_IMAGE
+        return CONF_CANVAS, CONF_IMAGE, CONF_LABEL
 
     async def to_code(self, w: Widget, config):
         await w.set_property(

esphome/components/lvgl/widgets/tabview.py

@@ -28,6 +28,7 @@ from ..types import LV_EVENT, LvType, ObjUpdateAction, lv_obj_t, lv_obj_t_ptr
 from . import Widget, WidgetType, add_widgets, get_widgets, set_obj_properties
 from .button import button_spec
 from .buttonmatrix import CONF_BUTTONMATRIX, buttonmatrix_spec
+from .label import CONF_LABEL
 from .obj import obj_spec
 
 CONF_TABVIEW = "tabview"
@@ -74,7 +75,7 @@ class TabviewType(WidgetType):
         )
 
     def get_uses(self):
-        return CONF_BUTTONMATRIX, TYPE_FLEX, CONF_BUTTON
+        return CONF_BUTTONMATRIX, TYPE_FLEX, CONF_BUTTON, CONF_LABEL
 
     async def to_code(self, w: Widget, config: dict):
         await w.set_property(

esphome/components/mdns/__init__.py

@@ -192,6 +192,8 @@ async def to_code(config: ConfigType) -> None:
     if CORE.using_arduino:
         if CORE.is_esp8266:
             cg.add_library("ESP8266mDNS", None)
+            # No MDNS global in the build; mdns_esp8266.cpp owns a guarded MDNSResponder
+            cg.add_build_flag("-DNO_GLOBAL_MDNS")
         elif CORE.is_rp2:
             cg.add_library("LEAmDNS", None)
 

esphome/components/mdns/mdns_esp8266.cpp

@@ -13,8 +13,47 @@
 
 namespace esphome::mdns {
 
+// Main-loop calls into LEAmDNS that send (update() and close(); begin(), addService() and
+// the scheduled restart never reach a send) can yield inside UdpContext::sendTimeout(); a
+// packet arriving then re-enters LEAmDNS from lwIP on the same UdpContext and both sides
+// free the same tx pbufs (#18760). Received packets stay queued during such a call and are
+// processed from the main loop afterwards.
+class GuardedMDNSResponder : public ::esp8266::MDNSImplementation::MDNSResponder {
+ public:
+  void update_guarded() { this->run_guarded_(&GuardedMDNSResponder::update); }
+  void close_guarded() { this->run_guarded_(&GuardedMDNSResponder::close); }
+
+ private:
+  void run_guarded_(bool (GuardedMDNSResponder::*fn)()) {
+    UdpContext *ctx = this->m_pUDPContext;
+    if (ctx == nullptr) {
+      (this->*fn)();
+      return;
+    }
+    // Set every time: a restart replaces the context together with its stock handler. Only
+    // begin() and the scheduled netif callback restart, never update() or close(), so the
+    // context cannot change underneath this call.
+    ctx->onRx([this]() {
+      if (!this->in_loop_call_) {
+        this->_callProcess();
+      }
+    });
+    this->in_loop_call_ = true;
+    (this->*fn)();
+    // close() releases the context; a yield in here queues further packets for this loop too
+    while (this->m_pUDPContext != nullptr && this->m_pUDPContext->next()) {
+      this->_parseMessage();
+    }
+    this->in_loop_call_ = false;
+  }
+
+  volatile bool in_loop_call_{false};
+};
+
+static GuardedMDNSResponder mdns_responder;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
+
 static void register_esp8266(MDNSComponent *, StaticVector<MDNSService, MDNS_SERVICE_COUNT> &services) {
-  MDNS.begin(App.get_name().c_str());
+  mdns_responder.begin(App.get_name().c_str());
 
   for (const auto &service : services) {
     // Strip the leading underscore from the proto and service_type. While it is
@@ -30,10 +69,10 @@ static void register_esp8266(MDNSComponent *, StaticVector<MDNSService, MDNS_SER
       service_type++;
     }
     uint16_t port = service.port.value();
-    MDNS.addService(FPSTR(service_type), FPSTR(proto), port);
+    mdns_responder.addService(FPSTR(service_type), FPSTR(proto), port);
     for (const auto &record : service.txt_records) {
-      MDNS.addServiceTxt(FPSTR(service_type), FPSTR(proto), FPSTR(MDNS_STR_ARG(record.key)),
-                         FPSTR(MDNS_STR_ARG(record.value)));
+      mdns_responder.addServiceTxt(FPSTR(service_type), FPSTR(proto), FPSTR(MDNS_STR_ARG(record.key)),
+                                   FPSTR(MDNS_STR_ARG(record.value)));
     }
   }
 }
@@ -52,7 +91,7 @@ void MDNSComponent::start_polling_window_() {
     if (wifi->is_roaming() || (!wifi->is_connected() && !wifi->is_ap_active()))
       return;
 #endif
-    MDNS.update();
+    mdns_responder.update_guarded();
   });
   this->set_timeout(MDNS_POLL_STOP_ID, MDNS_POLL_WINDOW_MS, [this]() { this->cancel_interval(MDNS_POLL_ID); });
 }
@@ -81,7 +120,7 @@ void MDNSComponent::on_ip_state(const network::IPAddresses &ips, const network::
 #endif
 
 void MDNSComponent::on_shutdown() {
-  MDNS.close();
+  mdns_responder.close_guarded();
   delay(10);
 }
 

esphome/components/micro_wake_word/micro_wake_word.cpp

@@ -129,7 +129,7 @@ void MicroWakeWord::setup() {
       return;
     }
     std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (this->ring_buffer_.use_count() > 1) {
+    if (temp_ring_buffer != nullptr) {
       // Producer-only write: never touches consumer state. If the buffer is full, ask the inference task
       // to drain it - reset() is a consumer operation and must run on the inference task's thread.
       // Disable partial writes so audio chunks are either fully accepted or rejected and handled below.
@@ -446,9 +446,9 @@ void MicroWakeWord::loop() {
     xEventGroupClearBits(this->event_group_, EventGroupBits::TASK_STOPPING);
   }
 
-  if ((event_group_bits & EventGroupBits::TASK_STOPPED)) {
+  // Retries on a subsequent loop if the task is still running on the other core
+  if ((event_group_bits & EventGroupBits::TASK_STOPPED) && this->inference_task_.deallocate()) {
     ESP_LOGD(TAG, "Inference task is finished, freeing task resources");
-    this->inference_task_.deallocate();
     xEventGroupClearBits(this->event_group_, ALL_BITS);
     xQueueReset(this->detection_queue_);
     this->set_state_(State::STOPPED);

esphome/components/microphone/microphone_source.h

@@ -48,7 +48,7 @@ class MicrophoneSource final {
   template<typename F> void add_data_callback(F &&data_callback) {
     this->mic_->add_data_callback([this, data_callback](const std::vector<uint8_t> &data) {
       if (this->enabled_ || this->passive_) {
-        if (this->processed_samples_.use_count() == 0) {
+        if (this->processed_samples_ == nullptr) {
           // Create vector if its unused
           this->processed_samples_ = std::make_shared<std::vector<uint8_t>>();
         }

esphome/components/mixer/speaker/mixer_speaker.cpp

@@ -218,7 +218,7 @@ size_t SourceSpeaker::play(const uint8_t *data, size_t length, TickType_t ticks_
   }
   size_t bytes_written = 0;
   std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-  if (temp_ring_buffer.use_count() > 0) {
+  if (temp_ring_buffer != nullptr) {
     // Only write to the ring buffer if the reference is valid
     bytes_written = temp_ring_buffer->write_without_replacement(data, length, ticks_to_wait);
     if (bytes_written > 0) {
@@ -250,14 +250,14 @@ esp_err_t SourceSpeaker::start_() {
   // avoids unnecessary single-frame splices.
   const size_t ring_buffer_size =
       (this->audio_stream_info_.ms_to_bytes(this->buffer_duration_ms_) / bytes_per_frame) * bytes_per_frame;
-  if (this->audio_source_.use_count() == 0) {
+  if (this->audio_source_ == nullptr) {
     std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (!temp_ring_buffer) {
+    if (temp_ring_buffer == nullptr) {
       temp_ring_buffer = ring_buffer::RingBuffer::create(ring_buffer_size);
       this->ring_buffer_ = temp_ring_buffer;
     }
 
-    if (!temp_ring_buffer) {
+    if (temp_ring_buffer == nullptr) {
       return ESP_ERR_NO_MEM;
     }
 
@@ -278,7 +278,7 @@ void SourceSpeaker::stop() { this->send_command_(SOURCE_SPEAKER_COMMAND_STOP); }
 void SourceSpeaker::finish() { this->send_command_(SOURCE_SPEAKER_COMMAND_FINISH); }
 
 bool SourceSpeaker::has_buffered_data() const {
-  return ((this->audio_source_.use_count() > 0) && this->audio_source_->has_buffered_data());
+  return ((this->audio_source_ != nullptr) && this->audio_source_->has_buffered_data());
 }
 
 void SourceSpeaker::set_mute_state(bool mute_state) {
@@ -382,8 +382,8 @@ void MixerSpeaker::loop() {
     ESP_LOGV(TAG, "Stopping");
     xEventGroupClearBits(this->event_group_, MIXER_TASK_STATE_STOPPING);
   }
-  if (event_group_bits & MIXER_TASK_STATE_STOPPED) {
-    this->task_.deallocate();
+  // Retries on a subsequent loop if the task is still running on the other core
+  if ((event_group_bits & MIXER_TASK_STATE_STOPPED) && this->task_.deallocate()) {
     ESP_LOGD(TAG, "Stopped");
     xEventGroupClearBits(this->event_group_, MIXER_TASK_ALL_BITS);
     this->all_stopped_since_ms_ = 0;
@@ -496,7 +496,7 @@ void MixerSpeaker::audio_mixer_task(void *params) {
         if (speaker->is_running() && !speaker->get_pause_state()) {
           // Speaker is running and not paused, so it possibly can provide audio data
           std::shared_ptr<audio::RingBufferAudioSource> audio_source = speaker->get_audio_source().lock();
-          if (audio_source.use_count() == 0) {
+          if (audio_source == nullptr) {
             // No audio source allocated, so skip processing this speaker
             continue;
           }

esphome/components/modbus/__init__.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from collections.abc import Callable
 import logging
 from typing import Any, Literal, NamedTuple
 
@@ -48,6 +49,8 @@ ModbusServerDevice = modbus_ns.class_("ModbusServerDevice")
 CommandOptions = modbus_ns.struct("CommandOptions")
 MULTI_CONF = True
 
+CONF_ALLOW_BROADCAST_READ = "allow_broadcast_read"
+CONF_EXPECT_BROADCAST_WRITE_RESPONSE = "expect_broadcast_write_response"
 CONF_ROLE = "role"
 CONF_MODBUS_ID = "modbus_id"
 CONF_SEND_WAIT_TIME = "send_wait_time"
@@ -56,6 +59,28 @@ CONF_TURNAROUND_TIME = "turnaround_time"
 MODBUS_ROLES = ["client", "server"]
 
 
+# The write (mutating) function codes, matching modbus::helpers::is_function_code_write(). 0x17
+# (read/write multiple) is included: it mutates, so the hub treats it as a write despite its read half.
+_WRITE_FUNCTION_CODES = frozenset({0x05, 0x06, 0x0F, 0x10, 0x16, 0x17})
+
+# Codes the hub refuses at address 0; keep in sync with modbus::helpers::is_function_code_broadcastable().
+_NON_BROADCASTABLE_FUNCTION_CODES = frozenset(
+    {0x01, 0x02, 0x03, 0x04, 0x14, 0x15, 0x17, 0x18}
+)
+
+
+def is_function_code_write(function_code: int) -> bool:
+    """True if the Modbus function code writes (mutates). The exception bit (0x80) is masked off first,
+    so an exception-flagged code still classifies by its base code (the runtime hub never queues one:
+    queue_pdu() refuses them). Keep in sync with modbus::helpers::is_function_code_write()."""
+    return function_code & 0x7F in _WRITE_FUNCTION_CODES
+
+
+def is_function_code_broadcastable(function_code: int) -> bool:
+    """True if the hub accepts the function code at address 0 without allow_broadcast_read."""
+    return function_code & 0x7F not in _NON_BROADCASTABLE_FUNCTION_CODES
+
+
 class _CommandOption(NamedTuple):
     """One per-command option forwarded to the hub (modbus::CommandOptions)."""
 
@@ -64,14 +89,47 @@ class _CommandOption(NamedTuple):
     validator: Any  # the static (non-templatable) validator for the key
     cpp_type: Any  # the C++ type the value is generated as
     default: Any
+    # Function codes the hub honours the option on; it is stripped from any other.
+    applies_to: Callable[[int], bool]
+    requires_broadcast_address: bool = False
 
 
-# Per-direction command options. Single-sourcing the schema and the setter generation here keeps
-# them from drifting; the C++ side must add the matching field per the rules documented on
-# CommandOptions (modbus.h).
+def _not_write(function_code: int) -> bool:
+    return not is_function_code_write(function_code)
+
+
+def _not_broadcastable(function_code: int) -> bool:
+    return not is_function_code_broadcastable(function_code)
+
+
+# Per-direction command options, single-sourced so the schema, setters and applicability rule cannot
+# drift; the C++ side adds the matching field per the rules on CommandOptions (modbus.h).
 _COMMAND_OPTIONS: dict[str, list[_CommandOption]] = {
-    "read": [_CommandOption(CONF_CONTINUOUS, "continuous", cv.boolean, bool, False)],
-    "write": [],
+    "read": [
+        _CommandOption(
+            CONF_CONTINUOUS, "continuous", cv.boolean, bool, False, _not_write
+        ),
+        _CommandOption(
+            CONF_ALLOW_BROADCAST_READ,
+            "allow_broadcast_read",
+            cv.boolean,
+            bool,
+            False,
+            _not_broadcastable,
+            requires_broadcast_address=True,
+        ),
+    ],
+    "write": [
+        _CommandOption(
+            CONF_EXPECT_BROADCAST_WRITE_RESPONSE,
+            "expect_broadcast_write_response",
+            cv.boolean,
+            bool,
+            False,
+            is_function_code_broadcastable,
+            requires_broadcast_address=True,
+        ),
+    ],
 }
 
 
@@ -82,32 +140,75 @@ def _command_options(direction: str) -> list[_CommandOption]:
         raise ValueError(f"unknown command-options direction {direction!r}") from None
 
 
-# The write (mutating) function codes, matching modbus::helpers::is_function_code_write(). 0x17
-# (read/write multiple) is included: it mutates, so the hub treats it as a write despite its read half.
-_WRITE_FUNCTION_CODES = frozenset({0x05, 0x06, 0x0F, 0x10, 0x16, 0x17})
+def broadcast_only_option_keys() -> list[str]:
+    return [
+        option.conf_key
+        for options in _COMMAND_OPTIONS.values()
+        for option in options
+        if option.requires_broadcast_address
+    ]
 
 
-def is_function_code_write(function_code: int) -> bool:
-    """True if the Modbus function code writes (mutates). The exception bit (0x80) is masked off first,
-    so an exception-flagged code still classifies by its base code (the runtime hub never queues one:
-    queue_pdu() refuses them). Keep in sync with modbus::helpers::is_function_code_write()."""
-    return function_code & 0x7F in _WRITE_FUNCTION_CODES
+def reject_broadcast_options_for_unicast(
+    address_key: str,
+) -> Callable[[ConfigType], ConfigType]:
+    """Reject a broadcast-only option set true on a literal address other than 0."""
+
+    def validator(config: ConfigType) -> ConfigType:
+        address = config.get(address_key)
+        if not isinstance(address, int) or address == BROADCAST_ADDRESS:
+            return config
+        for key in broadcast_only_option_keys():
+            if config.get(key) is True:
+                raise cv.Invalid(
+                    f"'{key}' only applies to the broadcast address; set '{address_key}: 0' or "
+                    f"remove the option.",
+                    path=[key],
+                )
+        return config
+
+    return validator
+
+
+def reject_inapplicable_command_options(
+    pdu_key: str,
+) -> Callable[[ConfigType], ConfigType]:
+    """Reject an option set true that the hub would strip from a literal PDU's function code."""
+
+    def validator(config: ConfigType) -> ConfigType:
+        pdu = config[pdu_key]
+        if not isinstance(pdu, list):
+            return config
+        for direction in _COMMAND_OPTIONS:
+            for option in _command_options(direction):
+                if config.get(option.conf_key) is True and not option.applies_to(
+                    pdu[0]
+                ):
+                    raise cv.Invalid(
+                        f"'{option.conf_key}: true' does not apply to function code "
+                        f"0x{pdu[0]:02X}",
+                        path=[option.conf_key],
+                    )
+        return config
+
+    return validator
 
 
 def command_options_schema(
-    *, direction: Literal["read", "write"], templatable: bool = False
+    *,
+    direction: Literal["read", "write"],
+    templatable: bool = False,
+    function_code: int | None = None,
 ) -> dict[cv.Optional, Any]:
-    """Schema fragment for the per-command options a component forwards to the hub
-    (modbus::CommandOptions). Extend this into any schema that queues commands. Keys are
-    direction-specific so a schema never offers an option the hub would strip (e.g.
-    continuous on a write); the write side has no options yet. For actions (templatable=True the
-    keys also accept lambdas), register the values with register_templatable_command_options().
+    """Schema fragment for the per-command options of one direction; `function_code` (a typed
+    action's fixed code) leaves out the options that do not apply to it.
     """
     return {
         cv.Optional(option.conf_key, default=option.default): (
             cv.templatable(option.validator) if templatable else option.validator
         )
         for option in _command_options(direction)
+        if function_code is None or option.applies_to(function_code)
     }
 
 
@@ -130,6 +231,25 @@ def command_options_expression(
     )
 
 
+def add_command_options(
+    var: MockObj,
+    setter: str,
+    config: ConfigType,
+    *,
+    direction: Literal["read", "write"],
+) -> None:
+    """Emit `var.<setter>(<options>)` for a config validated with command_options_schema() of the
+    same direction, skipped when every option is at its C++ default."""
+    if all(
+        config.get(option.conf_key, option.default) == option.default
+        for option in _command_options(direction)
+    ):
+        return
+    cg.add(
+        getattr(var, setter)(command_options_expression(config, direction=direction))
+    )
+
+
 async def register_templatable_command_options(
     var: MockObj, config: ConfigType, args: TemplateArgsType, direction: str
 ) -> None:

esphome/components/modbus/modbus.cpp

@@ -832,7 +832,7 @@ void ModbusClientHub::send_next_frame_() {
   }
 
   cmd->sent();
-  if (cmd->frame.address() == BROADCAST_ADDRESS) {
+  if (cmd->fire_and_forget()) {
     // A broadcast (address 0) is never answered (Modbus 4.1), so it is fire-and-forget: on_sent above
     // reports the transmission, and the entry then retires with no terminal callback instead of
     // occupying the waiting slot until the send-wait timeout expires. The turnaround delay already
@@ -1074,11 +1074,6 @@ bool ModbusClientHub::queue_pdu(uint8_t address, std::span<const uint8_t> pdu, M
     return false;
   }
 
-  if (address == BROADCAST_ADDRESS && !helpers::is_function_code_broadcastable(pdu[0])) {
-    ESP_LOGW(TAG, "Broadcast refused for function 0x%X: a broadcast (address 0) is never answered", pdu[0]);
-    return false;
-  }
-
   // Normalize the caller's options in place (the param is a by-value copy) so everything stored or
   // merged below carries effective options, never the raw request.
   // continuous is ignored for every mutating code (re-writing a value forever is never intended).
@@ -1086,6 +1081,24 @@ bool ModbusClientHub::queue_pdu(uint8_t address, std::span<const uint8_t> pdu, M
     ESP_LOGW(TAG, "continuous is ignored for a mutating function (0x%X, address %" PRIu8 ")", pdu[0], address);
     options.continuous = false;
   }
+  if (address != BROADCAST_ADDRESS) {
+    options.allow_broadcast_read = false;
+    options.expect_broadcast_write_response = false;
+  } else {
+    const bool broadcastable = helpers::is_function_code_broadcastable(pdu[0]);
+    if (options.allow_broadcast_read && broadcastable) {
+      ESP_LOGV(TAG, "allow_broadcast_read is ignored for function 0x%X: it is broadcastable", pdu[0]);
+      options.allow_broadcast_read = false;
+    }
+    if (options.expect_broadcast_write_response && !broadcastable) {
+      ESP_LOGV(TAG, "expect_broadcast_write_response is ignored for function 0x%X: it is not broadcastable", pdu[0]);
+      options.expect_broadcast_write_response = false;
+    }
+    if (!broadcastable && !options.allow_broadcast_read) {
+      ESP_LOGW(TAG, "Broadcast refused for function 0x%X: a broadcast (address 0) is never answered", pdu[0]);
+      return false;
+    }
+  }
 
   // A duplicate of a live entry with the same owner is not queued twice; it resolves against that
   // entry: anonymous -> dropped; continuous incoming -> convert the entry to a poll; one-shot onto a
@@ -1126,6 +1139,7 @@ bool ModbusClientHub::queue_pdu(uint8_t address, std::span<const uint8_t> pdu, M
       ESP_LOGV(TAG, "Frame already active for %" PRIu8 ", request absorbed (pending %" PRIu8 ")", address,
                item.pending);
     }
+    item.options.expect_broadcast_write_response |= options.expect_broadcast_write_response;
     return true;
   }
 

esphome/components/modbus/modbus.h

@@ -111,11 +111,15 @@ enum class FrameState : uint8_t {
 // Per-command send options. Append-only; pass via designated initializers ({.continuous = true}).
 // A new field reaches the queue with no plumbing but arrives inert until it defines three rules:
 // normalization in queue_pdu(), a merge rule for duplicate absorption, and teardown in
-// retire()/silent_retire().
+// retire()/silent_retire(). Bit-packed: stored per entry, controller and writer entity, passed by value.
 struct CommandOptions {
   // A continuous poll lives in the queue until cancelled or failed; ignored for mutating codes.
-  bool continuous{false};
+  bool continuous : 1 {false};
+  // Wait for the reply to a read sent to address 0, for a device that answers the broadcast address.
+  bool allow_broadcast_read : 1 {false};
+  bool expect_broadcast_write_response : 1 {false};
 };
+static_assert(sizeof(CommandOptions) == 1, "CommandOptions must stay one byte");
 
 struct ModbusDeviceCommand {
   ModbusClientDevice *device;
@@ -158,6 +162,10 @@ struct ModbusDeviceCommand {
     this->pending = 0;
     this->device = nullptr;
   }
+  bool fire_and_forget() const {
+    return this->frame.address() == BROADCAST_ADDRESS && !this->options.allow_broadcast_read &&
+           !this->options.expect_broadcast_write_response;
+  }
   // Fire-and-forget completion for a broadcast (address 0): the frame was transmitted (on_sent already
   // fired), but a broadcast is never answered (Modbus 4.1), so the entry retires with no terminal callback.
   void complete_broadcast() {
@@ -191,7 +199,8 @@ struct ModbusDeviceCommand {
     } else if (!this->waiting_state()) {  // an already-retired shell stays put; off the wire -> RETIRED
       this->state = FrameState::RETIRED;
     }
-    this->options = {};  // reset every option
+    // Only continuous ends with the clear; the delivery flags must survive for a granted retry.
+    this->options.continuous = false;
   }
 
   // True while the entry is still waiting for a response
@@ -534,27 +543,27 @@ class ModbusClientDevice {
     return this->queue_pdu(
         helpers::create_read_pdu(FunctionCode::READ_DISCRETE_INPUTS, start_address, number_of_inputs), options);
   }
-  bool write_single_register(uint16_t start_address, uint16_t value) {
-    return this->queue_pdu(helpers::create_write_single_register_pdu(start_address, value));
+  bool write_single_register(uint16_t start_address, uint16_t value, CommandOptions options = {}) {
+    return this->queue_pdu(helpers::create_write_single_register_pdu(start_address, value), options);
   }
-  bool write_single_coil(uint16_t address, bool value) {
-    return this->queue_pdu(helpers::create_write_single_coil_pdu(address, value));
+  bool write_single_coil(uint16_t address, bool value, CommandOptions options = {}) {
+    return this->queue_pdu(helpers::create_write_single_coil_pdu(address, value), options);
   }
-  bool write_multiple_registers(uint16_t start_address, std::span<const uint16_t> values) {
+  bool write_multiple_registers(uint16_t start_address, std::span<const uint16_t> values, CommandOptions options = {}) {
     // Empty goes to the full-size builder so the rejection log names this method's limit, not the small one's.
     if (!values.empty() && values.size() <= helpers::MAX_FEW_REGISTERS)
-      return this->queue_pdu(helpers::create_write_few_registers_pdu(start_address, values));
-    return this->queue_pdu(helpers::create_write_registers_pdu(start_address, values));
+      return this->queue_pdu(helpers::create_write_few_registers_pdu(start_address, values), options);
+    return this->queue_pdu(helpers::create_write_registers_pdu(start_address, values), options);
   }
   /// Note: std::vector<bool> cannot bind to std::span<const bool>; use a contiguous bool container or the packed
   /// overload.
-  bool write_multiple_coils(uint16_t start_address, std::span<const bool> values) {
-    return this->queue_pdu(helpers::create_write_coils_pdu(start_address, values));
+  bool write_multiple_coils(uint16_t start_address, std::span<const bool> values, CommandOptions options = {}) {
+    return this->queue_pdu(helpers::create_write_coils_pdu(start_address, values), options);
   }
   /// Packed variant: a PackedBits view (the same layout on_read_coils() delivers), so
   /// read-modify-write needs no unpack/repack.
-  bool write_multiple_coils(uint16_t start_address, PackedBits bits) {
-    return this->queue_pdu(helpers::create_write_coils_pdu(start_address, bits));
+  bool write_multiple_coils(uint16_t start_address, PackedBits bits, CommandOptions options = {}) {
+    return this->queue_pdu(helpers::create_write_coils_pdu(start_address, bits), options);
   }
   /// FC 0x17: the read-back is delivered through on_read_holding_registers(), and a device exception
   /// (typically a rejected write half) arrives there too via its status - one callback handles both

esphome/components/modbus_client/__init__.py

@@ -7,7 +7,6 @@ from esphome.components import modbus
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_ADDRESS,
-    CONF_CONTINUOUS,
     CONF_COUNT,
     CONF_ID,
     CONF_ON_ERROR,
@@ -158,24 +157,6 @@ _ACTION_BASE_SCHEMA = cv.Schema(
 )
 
 
-def _no_continuous_on_write(config: ConfigType) -> ConfigType:
-    """Reject `continuous: true` on a static write PDU: continuous polling only applies to reads.
-    Only the fully-static case is decidable here; the hub strips the flag from mutating PDUs at
-    runtime, so a templated pdu or continuous falls through to that backstop."""
-    pdu = config[CONF_PDU]
-    if (
-        isinstance(pdu, list)
-        and config.get(CONF_CONTINUOUS) is True
-        and modbus.is_function_code_write(pdu[0])
-    ):
-        raise cv.Invalid(
-            f"'{CONF_CONTINUOUS}: true' does not apply to a write PDU (function code "
-            f"0x{pdu[0]:02X}); continuous polling only applies to reads",
-            path=[CONF_CONTINUOUS],
-        )
-    return config
-
-
 MODBUS_CLIENT_SEND_SCHEMA = cv.All(
     _ACTION_BASE_SCHEMA.extend(
         {
@@ -186,10 +167,12 @@ MODBUS_CLIENT_SEND_SCHEMA = cv.All(
                 )
             ),
             **modbus.command_options_schema(direction="read", templatable=True),
+            **modbus.command_options_schema(direction="write", templatable=True),
             cv.Optional(CONF_ON_RESPONSE): _handler_schema(),
         }
     ),
-    _no_continuous_on_write,
+    modbus.reject_inapplicable_command_options(CONF_PDU),
+    modbus.reject_broadcast_options_for_unicast(CONF_ADDRESS),
 )
 
 
@@ -261,8 +244,7 @@ async def register_client_action(
             var.get_not_sent_trigger(), [(_PDU_SPAN, "request")], not_sent_conf
         )
     # Wire any command options the action's schema opted into (e.g. continuous on reads). Pass the
-    # matching direction so a write action never generates a read option's setter; the write side
-    # has no options yet, so this is a no-op there.
+    # matching direction so a write action never generates a read option's setter.
     await modbus.register_templatable_command_options(
         var, config, args, command_direction
     )
@@ -279,6 +261,8 @@ async def modbus_client_send_to_code(config, action_id, template_arg, args):
     var = cg.new_Pvariable(action_id, template_arg)
     template_ = await cg.templatable(config[CONF_PDU], args, _PDU_BUFFER)
     cg.add(var.set_pdu(template_))
+    # The read set is wired by register_client_action() below.
+    await modbus.register_templatable_command_options(var, config, args, "write")
     return await register_client_action(
         var,
         config,
@@ -353,6 +337,7 @@ def _read_schema(max_count: int) -> cv.All:
             }
         ),
         _no_address_overflow(CONF_COUNT),
+        modbus.reject_broadcast_options_for_unicast(CONF_ADDRESS),
     )
 
 
@@ -364,21 +349,35 @@ def _write_multiple_schema(item: Callable[[Any], Any], max_values: int) -> cv.Al
                 cv.Required(CONF_VALUES): cv.templatable(
                     cv.All(cv.ensure_list(item), cv.Length(min=1, max=max_values))
                 ),
+                **modbus.command_options_schema(direction="write", templatable=True),
             }
         ),
         _no_address_overflow(CONF_VALUES),
+        modbus.reject_broadcast_options_for_unicast(CONF_ADDRESS),
     )
 
 
 _READ_REGISTERS_SCHEMA = _read_schema(modbus.MAX_NUM_OF_REGISTERS_TO_READ)
 
-_WRITE_SINGLE_REGISTER_SCHEMA = _TYPED_ACTION_SCHEMA.extend(
-    {cv.Required(CONF_VALUE): cv.templatable(cv.hex_uint16_t)}
+_WRITE_SINGLE_REGISTER_SCHEMA = cv.All(
+    _TYPED_ACTION_SCHEMA.extend(
+        {
+            cv.Required(CONF_VALUE): cv.templatable(cv.hex_uint16_t),
+            **modbus.command_options_schema(direction="write", templatable=True),
+        }
+    ),
+    modbus.reject_broadcast_options_for_unicast(CONF_ADDRESS),
 )
 
 # A coil is one bit, so the value is a boolean - the wire only carries 0x0000 or 0xFF00.
-_WRITE_SINGLE_COIL_SCHEMA = _TYPED_ACTION_SCHEMA.extend(
-    {cv.Required(CONF_VALUE): cv.templatable(cv.boolean)}
+_WRITE_SINGLE_COIL_SCHEMA = cv.All(
+    _TYPED_ACTION_SCHEMA.extend(
+        {
+            cv.Required(CONF_VALUE): cv.templatable(cv.boolean),
+            **modbus.command_options_schema(direction="write", templatable=True),
+        }
+    ),
+    modbus.reject_broadcast_options_for_unicast(CONF_ADDRESS),
 )
 
 
@@ -542,10 +541,15 @@ _READ_WRITE_MULTIPLE_REGISTERS_SCHEMA = cv.All(
                     cv.Length(min=1, max=modbus.MAX_NUM_OF_REGISTERS_TO_WRITE_RW),
                 )
             ),
+            # 0x17 counts as a read at address 0, so it takes allow_broadcast_read only.
+            **modbus.command_options_schema(
+                direction="read", templatable=True, function_code=0x17
+            ),
         }
     ),
     _no_address_overflow(CONF_READ_COUNT, CONF_READ_ADDRESS),
     _no_address_overflow(CONF_VALUES, CONF_WRITE_ADDRESS),
+    modbus.reject_broadcast_options_for_unicast(CONF_ADDRESS),
 )
 
 

esphome/components/modbus_client/modbus_client.h

@@ -85,18 +85,36 @@ template<typename... Ts> class ClientActionBase : public Action<Ts...>, public m
 /// builds its static struct; declaring the values here instead of per action means a new read option
 /// costs one TEMPLATABLE_VALUE plus one field below, and every read action picks it up.
 /// The read/write split mirrors _COMMAND_OPTIONS in the modbus component's Python
-/// (command_options_schema(direction="read") adds exactly these keys). When a write-side option
-/// arrives it gets a WriteCommandOptions twin, so write actions never carry read-only members.
+/// (command_options_schema(direction="read") adds exactly these keys); WriteCommandOptions is the twin.
 template<typename... Ts> class ReadCommandOptions {
  public:
   // Poll: re-queue after each success until downgraded (replay with false) or failed. The hub strips
   // it for mutating function codes at the door (see modbus::CommandOptions).
   TEMPLATABLE_VALUE(bool, continuous)
+  TEMPLATABLE_VALUE(bool, allow_broadcast_read)
 
  protected:
   /// The options for this send, with every templatable value resolved against the action's arguments.
   modbus::CommandOptions command_options_(const Ts &...x) const {
-    return {.continuous = this->continuous_.value(x...)};
+    return {.continuous = this->continuous_.value(x...),
+            .allow_broadcast_read = this->allow_broadcast_read_.value(x...)};
+  }
+};
+
+/// The write-side per-command options (command_options_schema(direction="write") adds exactly these keys).
+template<typename... Ts> class WriteCommandOptions {
+ public:
+  TEMPLATABLE_VALUE(bool, expect_broadcast_write_response)
+
+ protected:
+  /// Resolves every write option into `options`, so send's merge of both sets stays exhaustive.
+  void apply_write_command_options_(modbus::CommandOptions &options, const Ts &...x) const {
+    options.expect_broadcast_write_response = this->expect_broadcast_write_response_.value(x...);
+  }
+  modbus::CommandOptions write_command_options_(const Ts &...x) const {
+    modbus::CommandOptions options{};
+    this->apply_write_command_options_(options, x...);
+    return options;
   }
 };
 
@@ -107,8 +125,11 @@ template<typename... Ts> class ReadCommandOptions {
 /// modbus::helpers::create_*_pdu() builders and return it directly (smaller builder results convert).
 /// A PduBuffer drops bytes past modbus::MAX_PDU_SIZE without reporting it (the hub's oversize check
 /// cannot fire - that limit is the capacity), so an over-long lambda-built PDU is silently truncated.
+/// A raw PDU may be a read or a write, so this action carries both option sets.
 template<typename... Ts>
-class ModbusClientSendAction : public ClientActionBase<Ts...>, public ReadCommandOptions<Ts...> {
+class ModbusClientSendAction : public ClientActionBase<Ts...>,
+                               public ReadCommandOptions<Ts...>,
+                               public WriteCommandOptions<Ts...> {
  public:
   TEMPLATABLE_VALUE(modbus::helpers::PduBuffer, pdu)
 
@@ -116,7 +137,11 @@ class ModbusClientSendAction : public ClientActionBase<Ts...>, public ReadComman
     return &this->response_trigger_;
   }
 
-  void play(const Ts &...x) override { this->send_or_resolve_(this->pdu_.value(x...), this->command_options_(x...)); }
+  void play(const Ts &...x) override {
+    modbus::CommandOptions options = this->command_options_(x...);
+    this->apply_write_command_options_(options, x...);
+    this->send_or_resolve_(this->pdu_.value(x...), options);
+  }
 
   void on_response(std::span<const uint8_t> request_pdu, std::span<const uint8_t> response_pdu) override {
     this->response_trigger_.trigger(request_pdu, response_pdu);
@@ -218,7 +243,8 @@ template<typename... Ts> class ReadBitsAction : public TypedClientActionBase<Ts.
 
 /// modbus_client.write_single_register: on_response is the acknowledgement (the ack only echoes the
 /// request, so it carries no arguments).
-template<typename... Ts> class WriteSingleRegisterAction : public TypedClientActionBase<Ts...> {
+template<typename... Ts>
+class WriteSingleRegisterAction : public TypedClientActionBase<Ts...>, public WriteCommandOptions<Ts...> {
  public:
   TEMPLATABLE_VALUE(uint16_t, start_address)
   TEMPLATABLE_VALUE(uint16_t, value)
@@ -227,7 +253,8 @@ template<typename... Ts> class WriteSingleRegisterAction : public TypedClientAct
 
   void play(const Ts &...x) override {
     this->send_or_resolve_(
-        modbus::helpers::create_write_single_register_pdu(this->start_address_.value(x...), this->value_.value(x...)));
+        modbus::helpers::create_write_single_register_pdu(this->start_address_.value(x...), this->value_.value(x...)),
+        this->write_command_options_(x...));
   }
   void on_write_single_register(uint16_t address, uint16_t value, modbus::ResponseStatus status) override {
     if (modbus::succeeded(status))
@@ -240,7 +267,8 @@ template<typename... Ts> class WriteSingleRegisterAction : public TypedClientAct
 
 /// modbus_client.write_single_coil: on_response is the acknowledgement (no arguments). A coil holds one
 /// bit, so the value is a bool - the wire only ever carries 0x0000 or 0xFF00.
-template<typename... Ts> class WriteSingleCoilAction : public TypedClientActionBase<Ts...> {
+template<typename... Ts>
+class WriteSingleCoilAction : public TypedClientActionBase<Ts...>, public WriteCommandOptions<Ts...> {
  public:
   TEMPLATABLE_VALUE(uint16_t, start_address)
   TEMPLATABLE_VALUE(bool, value)
@@ -249,7 +277,8 @@ template<typename... Ts> class WriteSingleCoilAction : public TypedClientActionB
 
   void play(const Ts &...x) override {
     this->send_or_resolve_(
-        modbus::helpers::create_write_single_coil_pdu(this->start_address_.value(x...), this->value_.value(x...)));
+        modbus::helpers::create_write_single_coil_pdu(this->start_address_.value(x...), this->value_.value(x...)),
+        this->write_command_options_(x...));
   }
   void on_write_single_coil(uint16_t address, bool value, modbus::ResponseStatus status) override {
     if (modbus::succeeded(status))
@@ -264,7 +293,8 @@ template<typename... Ts> class WriteSingleCoilAction : public TypedClientActionB
 /// A `values:` list is emitted as a flash array and sent straight from there; only a lambda builds a
 /// vector, and only when it runs. Same split as canbus's send action, and for the same reason: a static
 /// list must not allocate on every play().
-template<typename... Ts> class WriteMultipleRegistersAction : public TypedClientActionBase<Ts...> {
+template<typename... Ts>
+class WriteMultipleRegistersAction : public TypedClientActionBase<Ts...>, public WriteCommandOptions<Ts...> {
  public:
   TEMPLATABLE_VALUE(uint16_t, start_address)
 
@@ -288,11 +318,13 @@ template<typename... Ts> class WriteMultipleRegistersAction : public TypedClient
     // the empty PDU then resolves via on_not_sent like any refused send.
     if (this->len_ >= 0) {
       this->send_or_resolve_(modbus::helpers::create_write_registers_pdu(
-          start, std::span<const uint16_t>(this->values_.data, static_cast<size_t>(this->len_))));
+                                 start, std::span<const uint16_t>(this->values_.data, static_cast<size_t>(this->len_))),
+                             this->write_command_options_(x...));
       return;
     }
     const std::vector<uint16_t> values = this->values_.func(x...);
-    this->send_or_resolve_(modbus::helpers::create_write_registers_pdu(start, std::span<const uint16_t>(values)));
+    this->send_or_resolve_(modbus::helpers::create_write_registers_pdu(start, std::span<const uint16_t>(values)),
+                           this->write_command_options_(x...));
   }
   void on_write_multiple_registers(uint16_t start_address, std::span<const uint16_t> registers,
                                    modbus::ResponseStatus status) override {
@@ -313,7 +345,8 @@ template<typename... Ts> class WriteMultipleRegistersAction : public TypedClient
 /// A `values:` list is packed into wire layout at code-generation time and stored in flash, so play()
 /// neither allocates nor packs. A lambda returns std::vector<bool> - already a bit per coil rather than
 /// a byte - and is packed into a stack buffer on the way to the builder.
-template<typename... Ts> class WriteMultipleCoilsAction : public TypedClientActionBase<Ts...> {
+template<typename... Ts>
+class WriteMultipleCoilsAction : public TypedClientActionBase<Ts...>, public WriteCommandOptions<Ts...> {
  public:
   TEMPLATABLE_VALUE(uint16_t, start_address)
 
@@ -334,13 +367,16 @@ template<typename... Ts> class WriteMultipleCoilsAction : public TypedClientActi
     const uint16_t start = this->start_address_.value(x...);
     if (this->count_ >= 0) {
       const auto count = static_cast<uint16_t>(this->count_);
-      this->send_or_resolve_(modbus::helpers::create_write_coils_pdu(
-          start,
-          modbus::PackedBits(std::span<const uint8_t>(this->values_.packed, modbus::packed_bit_bytes(count)), count)));
+      this->send_or_resolve_(
+          modbus::helpers::create_write_coils_pdu(
+              start, modbus::PackedBits(std::span<const uint8_t>(this->values_.packed, modbus::packed_bit_bytes(count)),
+                                        count)),
+          this->write_command_options_(x...));
       return;
     }
     // The builder packs and bound-checks; an over-long set is rejected and logged there.
-    this->send_or_resolve_(modbus::helpers::create_write_coils_pdu(start, this->values_.func(x...)));
+    this->send_or_resolve_(modbus::helpers::create_write_coils_pdu(start, this->values_.func(x...)),
+                           this->write_command_options_(x...));
   }
   void on_write_multiple_coils(uint16_t start_address, modbus::PackedBits bits,
                                modbus::ResponseStatus status) override {
@@ -359,7 +395,8 @@ template<typename... Ts> class WriteMultipleCoilsAction : public TypedClientActi
 
 /// modbus_client.read_write_multiple_registers (FC 0x17): writes one register block and reads another back in
 /// one transaction (write first, per Modbus 6.17). on_response delivers the read-back words as `values`.
-template<typename... Ts> class ReadWriteMultipleRegistersAction : public TypedClientActionBase<Ts...> {
+template<typename... Ts>
+class ReadWriteMultipleRegistersAction : public TypedClientActionBase<Ts...>, public ReadCommandOptions<Ts...> {
  public:
   TEMPLATABLE_VALUE(uint16_t, read_address)
   TEMPLATABLE_VALUE(uint16_t, read_count)
@@ -385,13 +422,15 @@ template<typename... Ts> class ReadWriteMultipleRegistersAction : public TypedCl
     // An out-of-range read/write count builds an empty PDU (the builder logs why), resolving via on_not_sent.
     if (this->len_ >= 0) {
       this->send_or_resolve_(modbus::helpers::create_read_write_multiple_registers_pdu(
-          read_start, read_count, write_start,
-          std::span<const uint16_t>(this->values_.data, static_cast<size_t>(this->len_))));
+                                 read_start, read_count, write_start,
+                                 std::span<const uint16_t>(this->values_.data, static_cast<size_t>(this->len_))),
+                             this->command_options_(x...));
       return;
     }
     const std::vector<uint16_t> values = this->values_.func(x...);
     this->send_or_resolve_(modbus::helpers::create_read_write_multiple_registers_pdu(
-        read_start, read_count, write_start, std::span<const uint16_t>(values)));
+                               read_start, read_count, write_start, std::span<const uint16_t>(values)),
+                           this->command_options_(x...));
   }
   // The 0x17 response carries only the read block, so the hub dispatch delivers it as a holding-register read.
   void on_read_registers(modbus::EntityType entity_type, uint16_t start_address, std::span<const uint16_t> registers,

esphome/components/modbus_controller/__init__.py

@@ -103,12 +103,20 @@ def _warn_removed_options(config: ConfigType) -> ConfigType:
 
 
 def _reject_broadcast_address(config: ConfigType) -> ConfigType:
-    """A modbus_controller polls one device, so its address cannot be the broadcast address (0):
-    a broadcast is never answered (Modbus 4.1), so no register could ever read back."""
+    """Address 0 is rejected unless allow_broadcast_read, which in turn requires address 0."""
+    if config[modbus.CONF_ALLOW_BROADCAST_READ]:
+        if config.get(CONF_ADDRESS) != modbus.BROADCAST_ADDRESS:
+            raise cv.Invalid(
+                f"'{modbus.CONF_ALLOW_BROADCAST_READ}' only applies to the broadcast address; "
+                f"set 'address: 0' or remove the option.",
+                [modbus.CONF_ALLOW_BROADCAST_READ],
+            )
+        return config
     modbus.reject_broadcast_address(
         config.get(CONF_ADDRESS),
         "a modbus_controller device address",
-        "Assign the unit address of the device you want to poll.",
+        "Assign the unit address of the device you want to poll, or set allow_broadcast_read if "
+        "it answers address 0.",
         [CONF_ADDRESS],
     )
     return config
@@ -346,12 +354,52 @@ def _reject_continuous_write_custom_pdu(config: ConfigType) -> None:
         )
 
 
+def _reject_broadcastable_custom_pdu(config: ConfigType) -> None:
+    """A broadcastable custom_pdu under an address-0 controller is a real broadcast, never answered."""
+    pdu = config.get(CONF_CUSTOM_PDU)
+    if pdu is None or not modbus.is_function_code_broadcastable(pdu[0]):
+        return
+    fconf = fv.full_config.get()
+    path = fconf.get_path_for_id(config[CONF_MODBUS_CONTROLLER_ID])[:-1]
+    controller = fconf.get_config_for_path(path)
+    if (
+        controller.get(CONF_ADDRESS) == modbus.BROADCAST_ADDRESS
+        and controller.get(modbus.CONF_ALLOW_BROADCAST_READ) is True
+    ):
+        raise cv.Invalid(
+            f"a '{CONF_CUSTOM_PDU}' with function code 0x{pdu[0] & 0x7F:02X} is a real broadcast at "
+            f"address 0 and is never answered, so it can't be polled through the "
+            f"'{controller[CONF_ID]}' modbus_controller; use a read function code.",
+            [CONF_CUSTOM_PDU],
+        )
+
+
 def validate_custom_pdu_item(config: ConfigType) -> None:
-    """Final-validate for the read platforms that accept custom_pdu (sensor, binary_sensor,
-    text_sensor): migrate the deprecated custom_command, then reject a write-coded custom_pdu under a
-    continuously-polling controller."""
+    """Final-validate for the platforms that accept custom_pdu."""
     migrate_custom_command(config)
     _reject_continuous_write_custom_pdu(config)
+    _reject_broadcastable_custom_pdu(config)
+
+
+def _reject_write_option_off_broadcast(config: ConfigType) -> None:
+    if not any(config.get(key) is True for key in modbus.broadcast_only_option_keys()):
+        return
+    fconf = fv.full_config.get()
+    path = fconf.get_path_for_id(config[CONF_MODBUS_CONTROLLER_ID])[:-1]
+    controller = fconf.get_config_for_path(path)
+    if controller.get(CONF_ADDRESS) != modbus.BROADCAST_ADDRESS:
+        raise cv.Invalid(
+            f"'{modbus.CONF_EXPECT_BROADCAST_WRITE_RESPONSE}' only applies when the "
+            f"'{controller[CONF_ID]}' modbus_controller is at address 0; remove the option.",
+            [modbus.CONF_EXPECT_BROADCAST_WRITE_RESPONSE],
+        )
+
+
+def validate_writer_item(config: ConfigType) -> None:
+    """Final-validate for the writer platforms (number, output, select, switch)."""
+    if CONF_CUSTOM_PDU in config or CONF_CUSTOM_COMMAND in config:
+        validate_custom_pdu_item(config)
+    _reject_write_option_off_broadcast(config)
 
 
 def _final_validate(config: ConfigType) -> None:
@@ -448,11 +496,7 @@ async def to_code(config: ConfigType) -> None:
     await cg.register_component(var, config)
     cg.add(var.set_max_cmd_retries(config[CONF_MAX_CMD_RETRIES]))
     cg.add(var.set_offline_skip_updates(config[CONF_OFFLINE_SKIP_UPDATES]))
-    cg.add(
-        var.set_read_options(
-            modbus.command_options_expression(config, direction="read")
-        )
-    )
+    modbus.add_command_options(var, "set_read_options", config, direction="read")
     await automation.build_callback_automations(var, config, _CALLBACK_AUTOMATIONS)
 
 

esphome/components/modbus_controller/modbus_controller.cpp

@@ -24,7 +24,7 @@ void WriterDevice::warn_write_buffer_deprecated(const LogString *platform, uint1
 bool WriterDevice::send_raw_frame_deprecated(std::span<const uint8_t> frame) {
   if (frame.empty())
     return false;
-  return this->parent_->queue_pdu(frame[0], frame.subspan(1), this);
+  return this->parent_->queue_pdu(frame[0], frame.subspan(1), this, this->write_options_);
 }
 
 void ControllerDevice::set_controller(ModbusController *controller) {
@@ -234,10 +234,13 @@ void ModbusCommandItem::on_sent(std::span<const uint8_t> request_pdu) {
   // (frame[0]), which may differ from this controller's. (unqueue_command() is a no-op for a poll.)
   // A custom polling command sends its PDU to this controller's own address, so only a factory custom
   // command (a raw frame staged in payload) can carry a different address byte.
+  // An address-0 read with allow_broadcast_read is answered, so it keeps its terminal callback.
   uint8_t wire_address = this->address_;
   if (this->function_code_ == FunctionCode::CUSTOM && !this->payload.empty())
     wire_address = this->payload.data()[0];
-  if (wire_address == modbus::BROADCAST_ADDRESS)
+  const bool answered = this->controller_->read_options().allow_broadcast_read &&
+                        !modbus::helpers::is_function_code_broadcastable(request_pdu[0]);
+  if (wire_address == modbus::BROADCAST_ADDRESS && !answered)
     this->controller_->unqueue_command(this);
 }
 
@@ -285,8 +288,8 @@ void ModbusController::queue_command(ModbusCommandItem command) {
   this->one_shot_command_items_.push_back(make_unique<ModbusCommandItem>(std::move(command)));
   // A refused frame gets no terminal callback (see the hub contract), so reclaim the item here.
   auto &item = this->one_shot_command_items_.back();
-  // We intentionally do not pass read_options_ here, because one-shot commands are usually writes, and are non-polling.
-  if (!item->send()) {
+  // One-shots never poll, so only the broadcast flag is passed (the hub strips it from writes).
+  if (!item->send({.allow_broadcast_read = this->read_options_.allow_broadcast_read})) {
     // The caller (e.g. a write entity) has usually already published optimistically - surface the loss.
     ESP_LOGW(TAG, "Command refused by hub: type=0x%X address=0x%X", static_cast<uint8_t>(item->register_type()),
              item->register_address());
@@ -340,7 +343,7 @@ void ModbusController::update() {
   if (this->can_send()) {
     for (auto &poll : this->polling_devices_) {
       ESP_LOGVV(TAG, "Updating range 0x%X", poll.register_address());
-      // read_options_ carries the controller's continuous flag (the offline probe above sends it too).
+      // read_options_ carries the controller's read-side flags (the offline probe above sends them too).
       // A refusal is already logged by the hub; note the affected range for controller-level diagnostics.
       if (!poll.queue(this->read_options_)) {
         ESP_LOGD(TAG, "Poll refused by hub for range 0x%X", poll.register_address());

esphome/components/modbus_controller/modbus_controller.h

@@ -280,10 +280,11 @@ class ControllerDevice : protected modbus::ModbusClientDevice {
 
   void notify_online_(std::span<const uint8_t> request_pdu);
 
-  /// Write-path state owned by WriterEntity's forwarders, stored here so both bools land in the base's
-  /// tail padding instead of adding a word to every writer entity. The warn flag leaves in 2027.3.0.
-  bool dispatched_{false};
-  bool write_buffer_deprecated_warned_{false};
+  /// Write-path state for WriterEntity's forwarders, packed into the base's tail padding. The warn flag
+  /// leaves in 2027.3.0.
+  bool dispatched_ : 1 {false};
+  bool write_buffer_deprecated_warned_ : 1 {false};
+  modbus::CommandOptions write_options_{};
   ModbusController *controller_{nullptr};
 };
 
@@ -305,6 +306,8 @@ class WriterDevice final : public ControllerDevice {
   bool dispatched() const { return this->dispatched_; }
   void set_dispatched() { this->dispatched_ = true; }
   void clear_dispatched() { this->dispatched_ = false; }
+  modbus::CommandOptions write_options() const { return this->write_options_; }
+  void set_write_options(modbus::CommandOptions options) { this->write_options_ = options; }
   /// Warn once per entity that filling the write_lambda buffer parameter is deprecated (the entity is now the
   /// command - call a write helper / queue_pdu() on `item` instead). The buffer parameter is removed in 2027.3.0.
   void warn_write_buffer_deprecated(const LogString *platform, uint16_t address);
@@ -326,27 +329,29 @@ class WriterEntity {
   /// Whether the lambda called a request helper since the last clear_dispatched_(). Deliberately records
   /// the call, not the hub's accept/refuse: a refused lambda write must not fall through to the default write.
   bool dispatched() const { return this->device_.dispatched(); }
+  void set_write_options(modbus::CommandOptions options) { this->device_.set_write_options(options); }
   bool write_single_register(uint16_t address, uint16_t value) {
     this->device_.set_dispatched();
-    return this->device_.write_single_register(address, value);
+    return this->device_.write_single_register(address, value, this->device_.write_options());
   }
   bool write_single_coil(uint16_t address, bool value) {
     this->device_.set_dispatched();
-    return this->device_.write_single_coil(address, value);
+    return this->device_.write_single_coil(address, value, this->device_.write_options());
   }
   bool write_multiple_registers(uint16_t address, std::span<const uint16_t> values) {
     this->device_.set_dispatched();
-    return this->device_.write_multiple_registers(address, values);
+    return this->device_.write_multiple_registers(address, values, this->device_.write_options());
   }
   bool write_multiple_coils(uint16_t address, std::span<const bool> values) {
     this->device_.set_dispatched();
-    return this->device_.write_multiple_coils(address, values);
+    return this->device_.write_multiple_coils(address, values, this->device_.write_options());
   }
   bool write_multiple_coils(uint16_t address, modbus::PackedBits bits) {
     this->device_.set_dispatched();
-    return this->device_.write_multiple_coils(address, bits);
+    return this->device_.write_multiple_coils(address, bits, this->device_.write_options());
   }
-  bool queue_pdu(std::span<const uint8_t> pdu, modbus::CommandOptions options = {}) {
+  bool queue_pdu(std::span<const uint8_t> pdu) { return this->queue_pdu(pdu, this->device_.write_options()); }
+  bool queue_pdu(std::span<const uint8_t> pdu, modbus::CommandOptions options) {
     this->device_.set_dispatched();
     return this->device_.queue_pdu(pdu, options);
   }

esphome/components/modbus_controller/number/__init__.py

@@ -1,5 +1,5 @@
 import esphome.codegen as cg
-from esphome.components import number
+from esphome.components import modbus, number
 from esphome.components.modbus.helpers import (
     MODBUS_WRITE_REGISTER_TYPE,
     SENSOR_VALUE_TYPE,
@@ -23,8 +23,8 @@ from .. import (
     add_modbus_base_properties,
     modbus_calc_properties,
     modbus_controller_ns,
-    validate_custom_pdu_item,
     validate_range_reuse_migration,
+    validate_writer_item,
 )
 from ..const import (
     CONF_BITMASK,
@@ -84,6 +84,7 @@ CONFIG_SCHEMA = cv.All(
             cv.Optional(CONF_STEP, default=1): cv.positive_float,
             cv.Optional(CONF_MULTIPLY, default=1.0): cv.float_,
             cv.Optional(CONF_USE_WRITE_MULTIPLE, default=False): cv.boolean,
+            **modbus.command_options_schema(direction="write"),
         }
     ),
     validate_min_max,
@@ -91,7 +92,7 @@ CONFIG_SCHEMA = cv.All(
     validate_range_reuse_migration,
 )
 
-FINAL_VALIDATE_SCHEMA = validate_custom_pdu_item
+FINAL_VALIDATE_SCHEMA = validate_writer_item
 
 
 async def to_code(config: ConfigType) -> None:
@@ -122,6 +123,7 @@ async def to_code(config: ConfigType) -> None:
     cg.add(parent.add_sensor_item(var))
     await add_modbus_base_properties(var, config, ModbusNumber)
     cg.add(var.set_use_write_mutiple(config[CONF_USE_WRITE_MULTIPLE]))
+    modbus.add_command_options(var, "set_write_options", config, direction="write")
     if CONF_WRITE_LAMBDA in config:
         template_ = await cg.process_lambda(
             config[CONF_WRITE_LAMBDA],

esphome/components/modbus_controller/output/__init__.py

@@ -1,7 +1,7 @@
 import logging
 
 import esphome.codegen as cg
-from esphome.components import output
+from esphome.components import modbus, output
 from esphome.components.modbus.helpers import (
     SENSOR_VALUE_TYPE,
     PduBuffer,
@@ -18,6 +18,7 @@ from .. import (
     modbus_calc_properties,
     modbus_controller_ns,
     reject_odd_holding_write_offset,
+    validate_writer_item,
 )
 from ..const import (
     CONF_CUSTOM_COMMAND,
@@ -79,6 +80,7 @@ CONFIG_SCHEMA = cv.All(
                     ),
                     cv.Optional(CONF_WRITE_LAMBDA): cv.returning_lambda,
                     cv.Optional(CONF_USE_WRITE_MULTIPLE, default=False): cv.boolean,
+                    **modbus.command_options_schema(direction="write"),
                 }
             ),
             "holding": cv.All(
@@ -98,6 +100,7 @@ CONFIG_SCHEMA = cv.All(
                         cv.Optional(CONF_WRITE_LAMBDA): cv.returning_lambda,
                         cv.Optional(CONF_MULTIPLY, default=1.0): cv.float_,
                         cv.Optional(CONF_USE_WRITE_MULTIPLE, default=False): cv.boolean,
+                        **modbus.command_options_schema(direction="write"),
                     }
                 ),
                 reject_odd_holding_write_offset,
@@ -111,6 +114,9 @@ CONFIG_SCHEMA = cv.All(
 )
 
 
+FINAL_VALIDATE_SCHEMA = validate_writer_item
+
+
 async def to_code(config: ConfigType) -> None:
     byte_offset = modbus_calc_properties(config)
     # Binary Output
@@ -153,6 +159,7 @@ async def to_code(config: ConfigType) -> None:
     await output.register_output(var, config)
     parent = await cg.get_variable(config[CONF_MODBUS_CONTROLLER_ID])
     cg.add(var.set_use_write_mutiple(config[CONF_USE_WRITE_MULTIPLE]))
+    modbus.add_command_options(var, "set_write_options", config, direction="write")
     cg.add(var.set_parent(parent))
     if write_template:
         cg.add(var.set_write_template(write_template))

esphome/components/modbus_controller/select/__init__.py

@@ -2,7 +2,7 @@ from collections.abc import Callable
 from typing import Any
 
 import esphome.codegen as cg
-from esphome.components import select
+from esphome.components import modbus, select
 from esphome.components.modbus.helpers import SENSOR_VALUE_TYPE, RegisterValues
 import esphome.config_validation as cv
 from esphome.const import CONF_ADDRESS, CONF_ID, CONF_LAMBDA, CONF_OPTIMISTIC
@@ -15,6 +15,7 @@ from .. import (
     modbus_controller_ns,
     validate_range_reuse_migration,
     validate_skip_updates_deprecated,
+    validate_writer_item,
 )
 from ..const import (
     CONF_FORCE_NEW_RANGE,
@@ -77,6 +78,7 @@ CONFIG_SCHEMA = cv.All(
             cv.Optional(CONF_REGISTER_COUNT): cv.positive_int,
             cv.Required(CONF_OPTIONSMAP): ensure_option_map(),
             cv.Optional(CONF_USE_WRITE_MULTIPLE, default=False): cv.boolean,
+            **modbus.command_options_schema(direction="write"),
             cv.Optional(CONF_OPTIMISTIC, default=False): cv.boolean,
             cv.Optional(CONF_LAMBDA): cv.returning_lambda,
             cv.Optional(CONF_WRITE_LAMBDA): cv.returning_lambda,
@@ -86,6 +88,9 @@ CONFIG_SCHEMA = cv.All(
 )
 
 
+FINAL_VALIDATE_SCHEMA = validate_writer_item
+
+
 async def to_code(config: ConfigType) -> None:
     options_map = config[CONF_OPTIONSMAP]
 
@@ -104,6 +109,7 @@ async def to_code(config: ConfigType) -> None:
     cg.add(parent.add_sensor_item(var))
     cg.add(var.set_parent(parent))
     cg.add(var.set_use_write_mutiple(config[CONF_USE_WRITE_MULTIPLE]))
+    modbus.add_command_options(var, "set_write_options", config, direction="write")
     cg.add(var.set_optimistic(config[CONF_OPTIMISTIC]))
 
     if CONF_LAMBDA in config:

esphome/components/modbus_controller/switch/__init__.py

@@ -1,5 +1,5 @@
 import esphome.codegen as cg
-from esphome.components import switch
+from esphome.components import modbus, switch
 from esphome.components.modbus.helpers import MODBUS_REGISTER_TYPE, PduBuffer
 import esphome.config_validation as cv
 from esphome.const import CONF_ADDRESS, CONF_ASSUMED_STATE, CONF_ID
@@ -13,9 +13,9 @@ from .. import (
     modbus_calc_properties,
     modbus_controller_ns,
     reject_odd_holding_write_offset,
-    validate_custom_pdu_item,
     validate_modbus_register,
     validate_range_reuse_migration,
+    validate_writer_item,
 )
 from ..const import (
     CONF_BITMASK,
@@ -51,6 +51,7 @@ CONFIG_SCHEMA = cv.All(
             cv.Optional(CONF_ASSUMED_STATE, default=False): cv.boolean,
             cv.Optional(CONF_REGISTER_TYPE): cv.enum(MODBUS_REGISTER_TYPE),
             cv.Optional(CONF_USE_WRITE_MULTIPLE, default=False): cv.boolean,
+            **modbus.command_options_schema(direction="write"),
             cv.Optional(CONF_WRITE_LAMBDA): cv.returning_lambda,
         }
     ),
@@ -59,7 +60,7 @@ CONFIG_SCHEMA = cv.All(
     validate_range_reuse_migration,
 )
 
-FINAL_VALIDATE_SCHEMA = validate_custom_pdu_item
+FINAL_VALIDATE_SCHEMA = validate_writer_item
 
 
 async def to_code(config: ConfigType) -> None:
@@ -78,6 +79,7 @@ async def to_code(config: ConfigType) -> None:
     paren = await cg.get_variable(config[CONF_MODBUS_CONTROLLER_ID])
     cg.add(var.set_parent(paren))
     cg.add(var.set_use_write_mutiple(config[CONF_USE_WRITE_MULTIPLE]))
+    modbus.add_command_options(var, "set_write_options", config, direction="write")
     assumed_state = config[CONF_ASSUMED_STATE]
     cg.add(var.set_assumed_state(assumed_state))
     if not assumed_state:

esphome/components/mqtt/mqtt_light.cpp

@@ -67,6 +67,9 @@ void MQTTJSONLightComponent::send_discovery(JsonObject root, mqtt::SendDiscovery
   if (traits.supports_color_mode(ColorMode::RGB_COLD_WARM_WHITE))
     color_modes.add(ESPHOME_F("rgbww"));
 
+  if (traits.supports_color_capability(ColorCapability::BRIGHTNESS))
+    root[ESPHOME_F("brightness")] = true;
+
   if (traits.supports_color_mode(ColorMode::COLOR_TEMPERATURE) ||
       traits.supports_color_mode(ColorMode::COLD_WARM_WHITE)) {
     root[MQTT_MIN_MIREDS] = traits.get_min_mireds();

esphome/components/network/util.h

@@ -26,30 +26,34 @@ namespace esphome::network {
 
 /// Return whether the node is connected to the network (through wifi, eth, ...)
 ESPHOME_ALWAYS_INLINE inline bool is_connected() {
+  // With a single interface enabled the checks below collapse to `if (x) return true; return false;`, which
+  // clang-tidy wants folded into one return. Keep the per-interface form so every enabled interface is checked.
+  // NOLINTBEGIN(readability-simplify-boolean-expr)
 #ifdef USE_ETHERNET
   if (ethernet::global_eth_component != nullptr && ethernet::global_eth_component->is_connected())
     return true;
 #endif
 
 #ifdef USE_MODEM
-  if (modem::global_modem_component != nullptr)
-    return modem::global_modem_component->is_connected();
+  if (modem::global_modem_component != nullptr && modem::global_modem_component->is_connected())
+    return true;
 #endif
 
 #ifdef USE_WIFI
-  if (wifi::global_wifi_component != nullptr)
-    return wifi::global_wifi_component->is_connected();
+  if (wifi::global_wifi_component != nullptr && wifi::global_wifi_component->is_connected())
+    return true;
 #endif
 
 #ifdef USE_OPENTHREAD
-  if (openthread::global_openthread_component != nullptr)
-    return openthread::global_openthread_component->is_connected();
+  if (openthread::global_openthread_component != nullptr && openthread::global_openthread_component->is_connected())
+    return true;
 #endif
 
 #ifdef USE_HOST
   return true;  // Assume it's connected
 #endif
   return false;
+  // NOLINTEND(readability-simplify-boolean-expr)
 }
 
 /// Return whether the network is disabled: every configured interface with a

esphome/components/nextion/nextion.cpp

@@ -13,6 +13,11 @@ namespace esphome::nextion {
 
 static const char *const TAG = "nextion";
 
+// A user entity may be named sleep_wake too; only the internal NO_RESULT command clears the sleeping flag
+static bool is_sleep_wake_command(const NextionComponentBase *component) {
+  return component->get_queue_type() == NextionQueueType::NO_RESULT && component->get_variable_name() == "sleep_wake";
+}
+
 // Nextion command terminator: three consecutive 0xFF bytes (per Nextion Instruction Set v1.1).
 static constexpr uint8_t COMMAND_DELIMITER[3] = {0xFF, 0xFF, 0xFF};
 static constexpr size_t DELIMITER_SIZE = sizeof(COMMAND_DELIMITER);
@@ -163,6 +168,17 @@ bool Nextion::check_connect_() {
 #endif  // USE_NEXTION_CONFIG_SKIP_CONNECTION_HANDSHAKE
 }
 
+// NO_RESULT components are owned by their entry; every other component is a user entity. Entry and
+// component storage comes from RAMAllocator, so delete is not valid for either.
+void Nextion::release_queue_entry_(NextionQueue *nb) {
+  if (nb->component != nullptr && nb->component->get_queue_type() == NextionQueueType::NO_RESULT) {
+    nb->component->~NextionComponentBase();
+    RAMAllocator<NextionComponentBase>().deallocate(nb->component, 1);
+  }
+  nb->~NextionQueue();
+  RAMAllocator<NextionQueue>().deallocate(nb, 1);
+}
+
 void Nextion::reset_(bool reset_nextion) {
   uint8_t d;
 
@@ -170,15 +186,12 @@ void Nextion::reset_(bool reset_nextion) {
     this->read_byte(&d);
   }
   for (auto *entry : this->nextion_queue_) {
-    if (entry->component != nullptr && entry->component->get_queue_type() == NextionQueueType::NO_RESULT) {
-      delete entry->component;  // NOLINT(cppcoreguidelines-owning-memory)
-    }
-    delete entry;  // NOLINT(cppcoreguidelines-owning-memory)
+    this->release_queue_entry_(entry);
   }
   this->nextion_queue_.clear();
 #ifdef USE_NEXTION_WAVEFORM
   for (auto *entry : this->waveform_queue_) {
-    delete entry;  // NOLINT(cppcoreguidelines-owning-memory)
+    this->release_queue_entry_(entry);
   }
   this->waveform_queue_.clear();
 #endif  // USE_NEXTION_WAVEFORM
@@ -421,6 +434,9 @@ bool Nextion::remove_from_q_(bool report_empty) {
   NextionQueue *nb = this->nextion_queue_.front();
   if (!nb || !nb->component) {
     ESP_LOGE(TAG, "Invalid queue");
+    if (nb != nullptr) {
+      this->release_queue_entry_(nb);
+    }
     this->nextion_queue_.pop_front();
     return false;
   }
@@ -428,13 +444,10 @@ bool Nextion::remove_from_q_(bool report_empty) {
 
   ESP_LOGN(TAG, "Removed: %s", component->get_variable_name().c_str());
 
-  if (component->get_queue_type() == NextionQueueType::NO_RESULT) {
-    if (component->get_variable_name() == "sleep_wake") {
-      this->is_sleeping_ = false;
-    }
-    delete component;  // NOLINT(cppcoreguidelines-owning-memory)
+  if (is_sleep_wake_command(component)) {
+    this->is_sleeping_ = false;
   }
-  delete nb;  // NOLINT(cppcoreguidelines-owning-memory)
+  this->release_queue_entry_(nb);
   this->nextion_queue_.pop_front();
   return true;
 }
@@ -544,7 +557,7 @@ void Nextion::process_nextion_commands_() {
           ESP_LOGW(TAG, "Invalid waveform ID %d/ch %d", component->get_component_id(),
                    component->get_wave_channel_id());
           ESP_LOGN(TAG, "Remove waveform ID %d/ch %d", component->get_component_id(), component->get_wave_channel_id());
-          delete nb;  // NOLINT(cppcoreguidelines-owning-memory)
+          this->release_queue_entry_(nb);
           this->waveform_queue_.pop();
         }
 #else   // USE_NEXTION_WAVEFORM
@@ -647,6 +660,9 @@ void Nextion::process_nextion_commands_() {
         NextionQueue *nb = this->nextion_queue_.front();
         if (!nb || !nb->component) {
           ESP_LOGE(TAG, "Invalid queue entry");
+          if (nb != nullptr) {
+            this->release_queue_entry_(nb);
+          }
           this->nextion_queue_.pop_front();
           return;
         }
@@ -660,7 +676,7 @@ void Nextion::process_nextion_commands_() {
           component->set_state_from_string(to_process, true, false);
         }
 
-        delete nb;  // NOLINT(cppcoreguidelines-owning-memory)
+        this->release_queue_entry_(nb);
         this->nextion_queue_.pop_front();
 
         break;
@@ -687,6 +703,9 @@ void Nextion::process_nextion_commands_() {
         NextionQueue *nb = this->nextion_queue_.front();
         if (!nb || !nb->component) {
           ESP_LOGE(TAG, "Invalid queue");
+          if (nb != nullptr) {
+            this->release_queue_entry_(nb);
+          }
           this->nextion_queue_.pop_front();
           return;
         }
@@ -703,7 +722,7 @@ void Nextion::process_nextion_commands_() {
           component->set_state_from_int(value, true, false);
         }
 
-        delete nb;  // NOLINT(cppcoreguidelines-owning-memory)
+        this->release_queue_entry_(nb);
         this->nextion_queue_.pop_front();
 
         break;
@@ -890,7 +909,7 @@ void Nextion::process_nextion_commands_() {
         ESP_LOGN(TAG, "Send waveform: component id %d, waveform id %d, size %zu", component->get_component_id(),
                  component->get_wave_channel_id(), buffer_to_send);
         component->clear_wave_buffer(buffer_to_send);
-        delete nb;  // NOLINT(cppcoreguidelines-owning-memory)
+        this->release_queue_entry_(nb);
         this->waveform_queue_.pop();
 #else   // USE_NEXTION_WAVEFORM
         ESP_LOGW(TAG, "Waveform transmit ready but waveform not enabled");
@@ -920,14 +939,10 @@ void Nextion::purge_stale_queue_entries_() {
         ESP_LOGV(TAG, "Remove old queue '%s':'%s'", component->get_queue_type_string(),
                  component->get_variable_name().c_str());
 
-        if (component->get_queue_type() == NextionQueueType::NO_RESULT) {
-          if (component->get_variable_name() == "sleep_wake") {
-            this->is_sleeping_ = false;
-          }
-          delete component;  // NOLINT(cppcoreguidelines-owning-memory)
+        if (is_sleep_wake_command(component)) {
+          this->is_sleeping_ = false;
         }
-
-        delete *it;  // NOLINT(cppcoreguidelines-owning-memory)
+        this->release_queue_entry_(*it);
         it = this->nextion_queue_.erase(it);
 
       } else {
@@ -1079,6 +1094,34 @@ uint16_t Nextion::recv_ret_string_(std::string &response, uint32_t timeout, bool
   return response.length();
 }
 
+// Allocates a queue entry owning a bare NO_RESULT component; nullptr when the queue is full or memory is out
+NextionQueue *Nextion::make_no_result_entry_(const std::string &variable_name) {
+#ifdef USE_NEXTION_MAX_QUEUE_SIZE
+  if (this->max_queue_size_ > 0 && this->nextion_queue_.size() >= this->max_queue_size_) {
+    ESP_LOGW(TAG, "Queue full (%zu), drop: %s", this->nextion_queue_.size(), variable_name.c_str());
+    return nullptr;
+  }
+#endif
+
+  auto *nextion_queue = RAMAllocator<nextion::NextionQueue>().allocate(1);
+  if (nextion_queue == nullptr) {
+    ESP_LOGW(TAG, "Queue alloc failed");
+    return nullptr;
+  }
+  new (nextion_queue) nextion::NextionQueue;
+
+  nextion_queue->component = RAMAllocator<nextion::NextionComponentBase>().allocate(1);
+  if (nextion_queue->component == nullptr) {
+    ESP_LOGW(TAG, "Component alloc failed");
+    this->release_queue_entry_(nextion_queue);
+    return nullptr;
+  }
+  new (nextion_queue->component) nextion::NextionComponentBase;
+  nextion_queue->component->set_variable_name(variable_name);
+  nextion_queue->queue_time = App.get_loop_component_start_time();
+  return nextion_queue;
+}
+
 /**
  * @brief Add a command to the Nextion queue that expects no response.
  *
@@ -1090,36 +1133,11 @@ uint16_t Nextion::recv_ret_string_(std::string &response, uint32_t timeout, bool
  * @param variable_name Name of the variable or component associated with the command.
  */
 void Nextion::add_no_result_to_queue_(const std::string &variable_name) {
-#ifdef USE_NEXTION_MAX_QUEUE_SIZE
-  if (this->max_queue_size_ > 0 && this->nextion_queue_.size() >= this->max_queue_size_) {
-    ESP_LOGW(TAG, "Queue full (%zu), drop: %s", this->nextion_queue_.size(), variable_name.c_str());
+  auto *nextion_queue = this->make_no_result_entry_(variable_name);
+  if (nextion_queue == nullptr)
     return;
-  }
-#endif
-
-  RAMAllocator<nextion::NextionQueue> allocator;
-  nextion::NextionQueue *nextion_queue = allocator.allocate(1);
-  if (nextion_queue == nullptr) {
-    ESP_LOGW(TAG, "Queue alloc failed");
-    return;
-  }
-  new (nextion_queue) nextion::NextionQueue();
-
-  // NOLINTNEXTLINE(cppcoreguidelines-owning-memory)
-  nextion_queue->component = new (std::nothrow) nextion::NextionComponentBase;
-  if (nextion_queue->component == nullptr) {
-    ESP_LOGW(TAG, "Component alloc failed");
-    nextion_queue->~NextionQueue();
-    allocator.deallocate(nextion_queue, 1);
-    return;
-  }
-  nextion_queue->component->set_variable_name(variable_name);
-
-  nextion_queue->queue_time = App.get_loop_component_start_time();
-
   this->nextion_queue_.push_back(nextion_queue);
-
-  ESP_LOGN(TAG, "Queue NORESULT: %s", nextion_queue->component->get_variable_name().c_str());
+  ESP_LOGN(TAG, "Queue NORESULT: %s", variable_name.c_str());
 }
 
 /**
@@ -1153,32 +1171,10 @@ void Nextion::add_no_result_to_queue_with_command_(const std::string &variable_n
 #ifdef USE_NEXTION_COMMAND_SPACING
 void Nextion::add_no_result_to_queue_with_pending_command_(const std::string &variable_name,
                                                            const std::string &command) {
-#ifdef USE_NEXTION_MAX_QUEUE_SIZE
-  if (this->max_queue_size_ > 0 && this->nextion_queue_.size() >= this->max_queue_size_) {
-    ESP_LOGW(TAG, "Queue full (%zu), drop: %s", this->nextion_queue_.size(), variable_name.c_str());
+  auto *nextion_queue = this->make_no_result_entry_(variable_name);
+  if (nextion_queue == nullptr)
     return;
-  }
-#endif
-
-  RAMAllocator<nextion::NextionQueue> allocator;
-  nextion::NextionQueue *nextion_queue = allocator.allocate(1);
-  if (nextion_queue == nullptr) {
-    ESP_LOGW(TAG, "Queue alloc failed");
-    return;
-  }
-  new (nextion_queue) nextion::NextionQueue();
-
-  nextion_queue->component = new (std::nothrow) nextion::NextionComponentBase;
-  if (nextion_queue->component == nullptr) {
-    ESP_LOGW(TAG, "Component alloc failed");
-    nextion_queue->~NextionQueue();
-    allocator.deallocate(nextion_queue, 1);
-    return;
-  }
-  nextion_queue->component->set_variable_name(variable_name);
-  nextion_queue->queue_time = App.get_loop_component_start_time();
   nextion_queue->pending_command = command;  // Store command for retry
-
   this->nextion_queue_.push_back(nextion_queue);
   ESP_LOGVV(TAG, "Queue with pending command: %s", variable_name.c_str());
 }
@@ -1312,7 +1308,7 @@ void Nextion::add_to_get_queue(NextionComponentBase *component) {
     ESP_LOGW(TAG, "Queue alloc failed");
     return;
   }
-  new (nextion_queue) nextion::NextionQueue();
+  new (nextion_queue) nextion::NextionQueue;
 
   nextion_queue->component = component;
   nextion_queue->queue_time = App.get_loop_component_start_time();
@@ -1334,7 +1330,7 @@ void Nextion::add_to_get_queue(NextionComponentBase *component) {
   if (this->send_command_(command)) {
     this->nextion_queue_.push_back(nextion_queue);
   } else {
-    delete nextion_queue;  // NOLINT(cppcoreguidelines-owning-memory)
+    this->release_queue_entry_(nextion_queue);
   }
 #endif  // USE_NEXTION_COMMAND_SPACING
 }
@@ -1355,14 +1351,14 @@ void Nextion::add_addt_command_to_queue(NextionComponentBase *component) {
     ESP_LOGW(TAG, "Queue alloc failed");
     return;
   }
-  new (nextion_queue) nextion::NextionQueue();
+  new (nextion_queue) nextion::NextionQueue;
 
   nextion_queue->component = component;
   nextion_queue->queue_time = App.get_loop_component_start_time();
 
   if (!this->waveform_queue_.push(nextion_queue)) {
     ESP_LOGW(TAG, "Waveform queue full, drop");
-    delete nextion_queue;  // NOLINT(cppcoreguidelines-owning-memory)
+    this->release_queue_entry_(nextion_queue);
     return;
   }
   if (this->waveform_queue_.size() == 1)

esphome/components/nextion/nextion.h

@@ -1469,6 +1469,8 @@ class Nextion final : public NextionBase, public PollingComponent, public uart::
   void all_components_send_state_(bool force_update = false);
   uint32_t comok_sent_ = 0;
   bool remove_from_q_(bool report_empty = true);
+  void release_queue_entry_(NextionQueue *nb);
+  NextionQueue *make_no_result_entry_(const std::string &variable_name);
 
   /**
    * @brief Status flags for Nextion display state management

esphome/components/nextion/nextion_component_base.h

@@ -23,8 +23,7 @@ class NextionComponentBase;
 
 class NextionQueue {
  public:
-  virtual ~NextionQueue() = default;
-  NextionComponentBase *component;
+  NextionComponentBase *component{nullptr};
   uint32_t queue_time = 0;
 
   // Store command for retry if spacing blocked it
@@ -105,6 +104,6 @@ class NextionComponentBase {
   int wave_max_length_ = 255;
 #endif  // USE_NEXTION_WAVEFORM
 
-  bool needs_to_send_update_;
+  bool needs_to_send_update_{false};
 };
 }  // namespace esphome::nextion

esphome/components/noise/__init__.py

@@ -4,7 +4,9 @@ from typing import Any
 
 import esphome.codegen as cg
 import esphome.config_validation as cv
-from esphome.const import CONF_KEY
+from esphome.const import CONF_ENCRYPTION, CONF_KEY
+from esphome.core import ID
+from esphome.cpp_generator import MockObj
 from esphome.types import ConfigType
 
 CODEOWNERS = ["@esphome/core"]
@@ -23,6 +25,14 @@ def validate_encryption_key(value: Any) -> str:
 
     if len(decoded) != 32:
         raise cv.Invalid("Encryption key must be base64 and 32 bytes long")
+    if not any(decoded):
+        # The device treats the all-zeros key as no key at all (it is the
+        # provisioning sentinel), so it must never reach a build
+        raise cv.Invalid(
+            f"The all-zeros {CONF_KEY} is reserved and provides no protection; "
+            f"omit the {CONF_KEY} to provision it at runtime, or generate a real "
+            "key with: openssl rand -base64 32"
+        )
 
     # Return original data for roundtrip conversion
     return value
@@ -45,15 +55,6 @@ def decode_encryption_key(value: str) -> bytes:
     return decoded
 
 
-def is_reserved_key(value: str) -> bool:
-    """Whether the key is the reserved all-zeros provisioning sentinel.
-
-    The device treats it as no key configured, so consumers that require a
-    real key must reject it.
-    """
-    return not any(decode_encryption_key(value))
-
-
 ENCRYPTION_SCHEMA = cv.Schema(
     {
         cv.Optional(CONF_KEY): cv.sensitive(validate_encryption_key),
@@ -61,6 +62,21 @@ ENCRYPTION_SCHEMA = cv.Schema(
 )
 
 
+def static_encryption_key(conf: ConfigType) -> str | None:
+    """The build time key of a component config; None without one or when
+    the key is provisioned at runtime."""
+    return (conf.get(CONF_ENCRYPTION) or {}).get(CONF_KEY) or None
+
+
+def new_psk_progmem(parent_id: ID, key: str) -> MockObj:
+    """Emit the decoded key as a PROGMEM array; the component keeps a pointer
+    so the key never occupies RAM."""
+    return cg.progmem_array(
+        ID(f"{parent_id.id}_psk", is_declaration=True, type=cg.uint8),
+        list(decode_encryption_key(key)),
+    )
+
+
 def encryption_schema(config: ConfigType | None) -> ConfigType:
     # A bare `encryption:` block is valid; a missing key means the consumer
     # falls back to its keyless behavior (api provisioning, ota inheriting
@@ -72,12 +88,12 @@ def encryption_schema(config: ConfigType | None) -> ConfigType:
 
 async def to_code(config: ConfigType) -> None:
     cg.add_define("USE_NOISE")
-    cg.add_library("esphome/noise-c", "0.1.21")
+    cg.add_library("esphome/noise-c", "0.1.30")
     # noise-c depends on libsodium, but declaring it here too lets the
     # library manager see the full set up front instead of discovering
     # libsodium only after noise-c has downloaded, so the two can download
     # in parallel. The version must match noise-c's library.json.
-    cg.add_library("esphome/libsodium", "1.10021.4")
+    cg.add_library("esphome/libsodium", "1.10021.11")
     # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
     cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
     cg.add_build_flag("-DHAVE_INLINE_ASM=1")

esphome/components/noise/noise.cpp

@@ -1,5 +1,6 @@
 #include "noise.h"
 #ifdef USE_NOISE
+#include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
 #include <algorithm>
@@ -15,6 +16,14 @@ namespace esphome::noise {
 
 static const char *const TAG = "noise";
 
+void NoiseContext::load_psk(psk_t &out) const {
+  if (this->psk_ == nullptr) {
+    out.fill(0);
+    return;
+  }
+  progmem_memcpy(out.data(), this->psk_, out.size());
+}
+
 const LogString *noise_err_to_logstr(int err) {
   if (err == NOISE_ERROR_NO_MEMORY)
     return LOG_STR("NO_MEMORY");

esphome/components/noise/noise.h

@@ -23,16 +23,16 @@ class NoiseContext {
     }
     return acc == 0;
   }
-  void set_psk(psk_t psk) {
-    this->psk_ = psk;
-    this->has_psk_ = !is_all_zeros(psk);
-  }
-  const psk_t &get_psk() const { return this->psk_; }
-  bool has_psk() const { return this->has_psk_; }
+  /// psk points at 32 bytes that outlive the context (PROGMEM or caller owned
+  /// RAM); nullptr means no key. Runtime callers map the all-zeros key to
+  /// nullptr themselves; validation keeps it out of yaml.
+  void set_psk(const uint8_t *psk) { this->psk_ = psk; }
+  /// Copy the key out (flash-aware on ESP8266); all zeros when none is set.
+  void load_psk(psk_t &out) const;
+  bool has_psk() const { return this->psk_ != nullptr; }
 
  protected:
-  psk_t psk_{};
-  bool has_psk_{false};
+  const uint8_t *psk_{nullptr};
 };
 
 /// Convert a noise error code to a readable error

esphome/components/noise/noise_handshake.cpp

@@ -20,7 +20,7 @@ NoiseResponderHandshake::~NoiseResponderHandshake() {
   }
 }
 
-int NoiseResponderHandshake::init(const psk_t &psk, const uint8_t *prologue, size_t prologue_len) {
+int NoiseResponderHandshake::init(const NoiseContext &ctx, const uint8_t *prologue, size_t prologue_len) {
   if (this->handshake_ != nullptr) {
     noise_handshakestate_free(this->handshake_);
     this->handshake_ = nullptr;
@@ -44,6 +44,9 @@ int NoiseResponderHandshake::init(const psk_t &psk, const uint8_t *prologue, siz
     HANDSHAKE_STEP_LOG("noise_handshakestate_new_by_id", err);
     return err;
   }
+  // noise-c keeps its own copy, so the key only passes through the stack here
+  psk_t psk;
+  ctx.load_psk(psk);
   err = noise_handshakestate_set_pre_shared_key(this->handshake_, psk.data(), psk.size());
   if (err != 0) {
     HANDSHAKE_STEP_LOG("noise_handshakestate_set_pre_shared_key", err);

esphome/components/noise/noise_handshake.h

@@ -36,9 +36,9 @@ class NoiseResponderHandshake {
   NoiseResponderHandshake(const NoiseResponderHandshake &) = delete;
   NoiseResponderHandshake &operator=(const NoiseResponderHandshake &) = delete;
 
-  /// Create and start the handshake with the given PSK and prologue. A
-  /// repeated call frees the previous handshake state and starts over.
-  [[nodiscard]] int init(const psk_t &psk, const uint8_t *prologue, size_t prologue_len);
+  /// Create and start the handshake with the context's PSK and the prologue.
+  /// A repeated call frees the previous handshake state and starts over.
+  [[nodiscard]] int init(const NoiseContext &ctx, const uint8_t *prologue, size_t prologue_len);
   /// ACTION_FAILED is the catch-all: returned before init(), after split()
   /// has released the state, and when noise-c reports a failed handshake.
   [[nodiscard]] Action action() const;

esphome/components/number/__init__.py

@@ -174,6 +174,10 @@ NumberInRangeCondition = number_ns.class_(
 
 NumberMode = number_ns.enum("NumberMode")
 
+# Schema default that also matches the C++ initializer in number_traits.h; codegen
+# skips the setter when the config equals it.
+DEFAULT_MODE = "AUTO"
+
 NUMBER_MODES = {
     "AUTO": NumberMode.NUMBER_MODE_AUTO,
     "BOX": NumberMode.NUMBER_MODE_BOX,
@@ -216,7 +220,7 @@ _NUMBER_SCHEMA = (
                 CONF_UNIT_OF_MEASUREMENT, visibility=cv.Visibility.ADVANCED
             ): validate_unit_of_measurement,
             cv.Optional(
-                CONF_MODE, default="AUTO", visibility=cv.Visibility.ADVANCED
+                CONF_MODE, default=DEFAULT_MODE, visibility=cv.Visibility.ADVANCED
             ): cv.enum(NUMBER_MODES, upper=True),
             cv.Optional(
                 CONF_DEVICE_CLASS, visibility=cv.Visibility.ADVANCED
@@ -286,10 +290,10 @@ async def setup_number_core_(
     cg.add(var.traits.set_max_value(max_value))
     cg.add(var.traits.set_step(step))
 
-    # Only set if non-default to avoid bloating setup() function
-    # (mode_ is initialized to NUMBER_MODE_AUTO in the header)
-    if config[CONF_MODE] != NumberMode.NUMBER_MODE_AUTO:
-        cg.add(var.traits.set_mode(config[CONF_MODE]))
+    # Skip the setter when the config matches the C++ initializer (DEFAULT_MODE).
+    # The validated value is the enum key string, not the C++ enum expression.
+    if (mode := config[CONF_MODE]) != DEFAULT_MODE:
+        cg.add(var.traits.set_mode(mode))
 
     CORE.add_job(_build_number_automations, var, config)
 

esphome/components/number/number_traits.h

@@ -31,7 +31,7 @@ class NumberTraits {
   float min_value_ = NAN;
   float max_value_ = NAN;
   float step_ = NAN;
-  NumberMode mode_{NUMBER_MODE_AUTO};
+  NumberMode mode_{NUMBER_MODE_AUTO};  // Keep in sync with DEFAULT_MODE in __init__.py
 };
 
 }  // namespace esphome::number

esphome/components/ota/ota_signature_esp_idf.cpp

@@ -9,7 +9,6 @@
 #include <array>
 #include <cstring>
 #include <memory>
-#include <new>
 #include <esp_image_format.h>
 #include <esp_partition.h>
 #include <esp_rom_crc.h>
@@ -235,9 +234,11 @@ bool IDFOTABackend::verify_signed_image_(const esp_partition_t *incoming) {
   // runs mid-OTA on the loop task, on top of the caller's live 1 KB OTA buffer
   // and mbedtls's own ~1 KB verify scratch, so keeping it off the stack widens
   // a thin margin. One short-lived allocation right before reboot is not the
-  // fragmentation pattern the project guards against. nothrow so an OOM here
-  // fails closed like every other error path, rather than aborting.
-  std::unique_ptr<uint8_t[]> block(new (std::nothrow) uint8_t[SIG_BLOCK_SIZE]);
+  // fragmentation pattern the project guards against. An OOM returns nullptr
+  // and fails closed like every other error path. Internal RAM first: the
+  // block is an esp_partition_read target.
+  auto block =
+      RAMAllocator<uint8_t>(RAMAllocator<uint8_t>::PREFER_INTERNAL).make_unique_array_for_overwrite(SIG_BLOCK_SIZE);
   if (!block) {
     OTA_IDF_SIG_LOG(ESP_LOGE, "out of memory");
     return false;

esphome/components/output/__init__.py

@@ -53,12 +53,17 @@ async def setup_output_platform_(obj, config):
     if CONF_POWER_SUPPLY in config:
         power_supply_ = await cg.get_variable(config[CONF_POWER_SUPPLY])
         cg.add(obj.set_power_supply(power_supply_))
-    if CONF_MAX_POWER in config:
+    # The C++ initializers are max_power 1.0 and min_power 0.0; skip the setter when
+    # the config matches them. The define stays whenever the key is present because
+    # platforms such as ac_dimmer read the scaling fields directly.
+    if (max_power := config.get(CONF_MAX_POWER)) is not None:
         cg.add_define("USE_OUTPUT_FLOAT_POWER_SCALING")
-        cg.add(obj.set_max_power(config[CONF_MAX_POWER]))
-    if CONF_MIN_POWER in config:
+        if max_power != 1.0:
+            cg.add(obj.set_max_power(max_power))
+    if (min_power := config.get(CONF_MIN_POWER)) is not None:
         cg.add_define("USE_OUTPUT_FLOAT_POWER_SCALING")
-        cg.add(obj.set_min_power(config[CONF_MIN_POWER]))
+        if min_power != 0.0:
+            cg.add(obj.set_min_power(min_power))
     # Only emit when zero_means_zero is actually enabled. The schema defaults to False
     # so this key is always present; emitting unconditionally would force
     # USE_OUTPUT_FLOAT_POWER_SCALING on for every output, defeating the gate.

esphome/components/output/float_output.h

@@ -123,6 +123,7 @@ class FloatOutput : public BinaryOutput {
   virtual void write_state(float state) = 0;
 
 #ifdef USE_OUTPUT_FLOAT_POWER_SCALING
+  // Codegen skips the setters for these values; keep in sync with output/__init__.py
   float max_power_{1.0f};
   float min_power_{0.0f};
   bool zero_means_zero_{false};

esphome/components/pmsa003i/pmsa003i.cpp

@@ -88,7 +88,11 @@ void PMSA003IComponent::update() {
 bool PMSA003IComponent::read_data_(PM25AQIData *data) {
   uint8_t buffer[COUNT_DATA_BYTES];
 
-  this->read_bytes_raw(buffer, COUNT_DATA_BYTES);
+  const i2c::ErrorCode error = this->read(buffer, COUNT_DATA_BYTES);
+  if (error != i2c::ERROR_OK) {
+    ESP_LOGW(TAG, "I2C error %d", error);
+    return false;
+  }
 
   // https://github.com/adafruit/Adafruit_PM25AQI
 

esphome/components/resampler/speaker/resampler_speaker.cpp

@@ -153,8 +153,8 @@ void ResamplerSpeaker::loop() {
     ESP_LOGV(TAG, "Stopping");
     xEventGroupClearBits(this->event_group_, ResamplingEventGroupBits::STATE_STOPPING);
   }
-  if (event_group_bits & ResamplingEventGroupBits::STATE_STOPPED) {
-    this->task_.deallocate();
+  // Retries on a subsequent loop if the task is still running on the other core
+  if ((event_group_bits & ResamplingEventGroupBits::STATE_STOPPED) && this->task_.deallocate()) {
     ESP_LOGD(TAG, "Stopped");
     xEventGroupClearBits(this->event_group_, ResamplingEventGroupBits::ALL_BITS);
   }
@@ -235,7 +235,7 @@ size_t ResamplerSpeaker::play(const uint8_t *data, size_t length, TickType_t tic
     bytes_written = this->output_speaker_->play(data, length, ticks_to_wait);
   } else {
     std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (temp_ring_buffer) {
+    if (temp_ring_buffer != nullptr) {
       // Only write to the ring buffer if the reference is valid
       bytes_written = temp_ring_buffer->write_without_replacement(data, length, ticks_to_wait);
     } else {
@@ -299,7 +299,7 @@ bool ResamplerSpeaker::has_buffered_data() const {
   bool has_ring_buffer_data = false;
   if (this->requires_resampling_()) {
     std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (temp_ring_buffer) {
+    if (temp_ring_buffer != nullptr) {
       has_ring_buffer_data = (temp_ring_buffer->available() > 0);
     }
   }
@@ -342,7 +342,7 @@ void ResamplerSpeaker::resample_task(void *params) {
       std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = ring_buffer::RingBuffer::create(
           this_resampler->audio_stream_info_.ms_to_bytes(this_resampler->buffer_duration_ms_));
 
-      if (!temp_ring_buffer) {
+      if (temp_ring_buffer == nullptr) {
         err = ESP_ERR_NO_MEM;
       } else {
         this_resampler->ring_buffer_ = temp_ring_buffer;

esphome/components/rf_bridge/rf_bridge.cpp

@@ -18,6 +18,16 @@ void RFBridgeComponent::ack_() {
 }
 
 bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) {
+  if (this->bucket_frame_candidate_ && byte == RF_CODE_START) {
+    // A queued next frame proves the trailing 0x55 really was the bucket
+    // frame's terminator: Portisch builds pulse entries from alternating
+    // signal edges, so the two level bits inside one pulse byte are always
+    // opposite — 0xAA (two high-level nibbles) cannot occur in pulse data.
+    // Finalize before this byte starts the new frame, so back-to-back
+    // deliveries are split even when loop() never observed a quiet gap
+    // between them.
+    this->finish_bucket_frame_();
+  }
   size_t at = this->rx_buffer_.size();
   this->rx_buffer_.push_back(byte);
   const uint8_t *raw = &this->rx_buffer_[0];
@@ -84,26 +94,21 @@ bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) {
       break;
     }
     case RF_CODE_RFIN_BUCKET: {
-      if (byte != RF_CODE_STOP) {
-        return true;
+      if (at == 2) {
+        // The count byte: Portisch sends at most 7 buckets + sync, so 0 or
+        // >8 cannot be a genuine capture — reject before it can occupy the
+        // buffer for a full frame timeout.
+        return byte != 0 && byte <= B1_MAX_BUCKET_COUNT;
       }
-
-      uint8_t buckets = raw[2] << 1;
-      std::string str;
-      char next_byte[3];  // 2 hex chars + null
-
-      for (uint32_t i = 0; i <= at; i++) {
-        buf_append_printf(next_byte, sizeof(next_byte), 0, "%02X", raw[i]);
-        str += next_byte;
-        if ((i > 3) && buckets) {
-          buckets--;
-        }
-        if ((i < 3) || (buckets % 2) || (i == at - 1)) {
-          str += " ";
-        }
-      }
-      ESP_LOGI(TAG, "Received RFBridge Bucket: %s", str.c_str());
-      break;
+      // 0x55 is legal DATA inside a B1 frame: bucket durations are sent
+      // with only their HIGH byte masked to 7 bits, so a duration such as
+      // 0x0155 puts a raw 0x55 low byte inside the table — the first 0x55
+      // must therefore not end the capture. The header declares the table
+      // length (raw[2] pairs), so a 0x55 there is always data; one at or
+      // past the first pulse index is a terminator CANDIDATE, confirmed
+      // once the UART goes quiet (finish_bucket_frame_ in loop()).
+      this->bucket_frame_candidate_ = byte == RF_CODE_STOP && at >= 3 + static_cast<size_t>(raw[2]) * 2;
+      return true;
     }
     default:
       ESP_LOGW(TAG, "Unknown action: 0x%02X", action);
@@ -119,6 +124,47 @@ bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) {
   return false;
 }
 
+void RFBridgeComponent::finish_bucket_frame_() {
+  if (this->rx_buffer_.size() < 4) {
+    // The candidate flag requires a header + non-empty bucket table, so
+    // this cannot happen while flag and buffer stay consistent; guard the
+    // raw[2] / size-1 reads against any future divergence anyway.
+    this->rx_buffer_.clear();
+    this->bucket_frame_candidate_ = false;
+    return;
+  }
+  const uint8_t *raw = this->rx_buffer_.data();
+  const size_t at = this->rx_buffer_.size() - 1;
+
+  uint8_t buckets = raw[2] << 1;
+  std::string str;
+  char next_byte[3];  // 2 hex chars + null
+
+  for (uint32_t i = 0; i <= at; i++) {
+    buf_append_printf(next_byte, sizeof(next_byte), 0, "%02X", raw[i]);
+    str += next_byte;
+    if ((i > 3) && buckets) {
+      buckets--;
+    }
+    if ((i < 3) || (buckets % 2) || (i == at - 1)) {
+      str += " ";
+    }
+  }
+  ESP_LOGI(TAG, "Received RFBridge Bucket: %s", str.c_str());
+
+  // Deliberately NOT ACKed: Portisch's B1 command handler leaves its
+  // last_sniffing_command at the previous mode (RF_CODE_RFIN), and its
+  // host-ACK handler re-arms sniffing from that stale value — so ACKing a
+  // bucket delivery silently reverts the radio to standard sniffing and
+  // ends bucket capture. Its delivery path is fire-and-forget and never
+  // waits for a host ACK. Stock Itead firmware never sends B1 frames, so
+  // suppressing this ACK cannot change stock-firmware behavior.
+  // https://github.com/esphome/esphome/issues/17682
+
+  this->rx_buffer_.clear();
+  this->bucket_frame_candidate_ = false;
+}
+
 void RFBridgeComponent::write_byte_str_(const std::string &codes) {
   uint8_t code;
   int size = codes.length();
@@ -130,12 +176,31 @@ void RFBridgeComponent::write_byte_str_(const std::string &codes) {
 
 void RFBridgeComponent::loop() {
   const uint32_t now = App.get_loop_component_start_time();
-  if (now - this->last_bridge_byte_ > 50) {
+  size_t avail = this->available();
+  if (avail == 0 && this->bucket_frame_candidate_ && now - this->last_bridge_byte_ > BUCKET_CANDIDATE_QUIET_MS) {
+    // The trailing 0x55 was followed by UART quiet, so it really was the
+    // frame terminator and not an interior data byte.
+    this->finish_bucket_frame_();
+    this->last_bridge_byte_ = now;
+  }
+  const bool receiving_bucket = this->rx_buffer_.size() >= 2 && this->rx_buffer_[1] == RF_CODE_RFIN_BUCKET;
+  if (receiving_bucket) {
+    // Never declare an in-progress bucket frame dead while its continuation
+    // bytes are already queued: a stalled loop() otherwise discards a live
+    // frame that the UART buffer proves is still arriving.
+    if (avail == 0 && now - this->last_bridge_byte_ > BUCKET_FRAME_TIMEOUT_MS) {
+      ESP_LOGD(TAG, "Discarding incomplete RFBridge Bucket frame (%u bytes)",
+               static_cast<unsigned>(this->rx_buffer_.size()));
+      this->rx_buffer_.clear();
+      this->bucket_frame_candidate_ = false;
+      this->last_bridge_byte_ = now;
+    }
+  } else if (now - this->last_bridge_byte_ > 50) {
     this->rx_buffer_.clear();
+    this->bucket_frame_candidate_ = false;
     this->last_bridge_byte_ = now;
   }
 
-  size_t avail = this->available();
   while (avail > 0) {
     uint8_t buf[64];
     size_t to_read = std::min(avail, sizeof(buf));
@@ -146,12 +211,14 @@ void RFBridgeComponent::loop() {
     for (size_t i = 0; i < to_read; i++) {
       if (this->rx_buffer_.size() > MAX_RX_BUFFER_SIZE) {
         this->rx_buffer_.clear();
+        this->bucket_frame_candidate_ = false;
       }
       if (this->parse_bridge_byte_(buf[i])) {
         ESP_LOGVV(TAG, "Parsed: 0x%02X", buf[i]);
         this->last_bridge_byte_ = now;
       } else {
         this->rx_buffer_.clear();
+        this->bucket_frame_candidate_ = false;
       }
     }
   }

esphome/components/rf_bridge/rf_bridge.h

@@ -30,6 +30,17 @@ static const uint8_t RF_CODE_BEEP = 0xC0;
 static const uint8_t RF_CODE_STOP = 0x55;
 static const uint8_t RF_DEBOUNCE = 200;
 static const size_t MAX_RX_BUFFER_SIZE = 512;
+// ~10 byte times at 19200 baud: long enough to prove the UART went quiet
+// after a possible bucket-frame terminator, short enough to finish well
+// before the next radio capture can be delivered.
+static const uint32_t BUCKET_CANDIDATE_QUIET_MS = 5;
+// Portisch drains a B1 frame's header, bucket table, and pulse data as
+// separate UART writes, so an in-progress bucket frame tolerates a longer
+// inter-region gap than the generic 50 ms inter-byte timeout.
+static const uint32_t BUCKET_FRAME_TIMEOUT_MS = 250;
+// Portisch's uart_put_RF_buckets sends at most 7 buckets plus the sync
+// bucket, so a B1 count byte above 8 (or 0) is malformed for any protocol.
+static const uint8_t B1_MAX_BUCKET_COUNT = 8;
 
 struct RFBridgeData {
   uint16_t sync;
@@ -67,10 +78,12 @@ class RFBridgeComponent final : public uart::UARTDevice, public Component {
   void ack_();
   void decode_();
   bool parse_bridge_byte_(uint8_t byte);
+  void finish_bucket_frame_();
   void write_byte_str_(const std::string &codes);
 
   std::vector<uint8_t> rx_buffer_;
   uint32_t last_bridge_byte_{0};
+  bool bucket_frame_candidate_{false};
 
   CallbackManager<void(RFBridgeData)> data_callback_;
   CallbackManager<void(RFBridgeAdvancedData)> advanced_data_callback_;

esphome/components/router/speaker/router_speaker.cpp

@@ -2,6 +2,8 @@
 
 #ifdef USE_ESP32
 
+#include "esphome/core/application.h"
+#include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
 #include "esp_timer.h"
@@ -12,6 +14,9 @@ namespace esphome::router {
 
 static const char *const TAG = "router.speaker";
 
+// Maximum time to wait for the active output to report running after start() before giving up
+static const uint32_t STATE_TRANSITION_TIMEOUT_MS = 5000;
+
 static inline uint32_t atomic_subtract_clamped(std::atomic<uint32_t> &var, uint32_t amount) {
   uint32_t current = var.load(std::memory_order_acquire);
   uint32_t subtracted = 0;
@@ -72,6 +77,7 @@ void Router::loop() {
 
       this->apply_cached_state_to_active_();
       this->state_ = speaker::STATE_STARTING;
+      this->state_start_ms_ = App.get_loop_component_start_time();
       active->start();
     }
     return;
@@ -86,10 +92,17 @@ void Router::loop() {
   // set_audio_stream_info() and never reaches the output on its own; if the format
   // changed while stopped, only start()'s apply_cached_state_to_active_() pushes it
   // down before the output's play()-side auto-start locks in the stale format.
-  if (active->is_stopped()) {
+  // While STARTING, ignore a transient stopped report as speaker running state
+  // is set asynchronously from start(). Timeout if the speaker never transitions.
+  if (this->state_ == speaker::STATE_STARTING) {
+    if (active->is_running()) {
+      this->state_ = speaker::STATE_RUNNING;
+    } else if ((App.get_loop_component_start_time() - this->state_start_ms_) > STATE_TRANSITION_TIMEOUT_MS) {
+      ESP_LOGW(TAG, "Active output did not start; giving up");
+      this->state_ = speaker::STATE_STOPPED;
+    }
+  } else if (active->is_stopped()) {
     this->state_ = speaker::STATE_STOPPED;
-  } else if (this->state_ == speaker::STATE_STARTING && active->is_running()) {
-    this->state_ = speaker::STATE_RUNNING;
   }
 }
 
@@ -133,6 +146,8 @@ void Router::start() {
   this->frames_in_pipeline_.store(0, std::memory_order_release);
   this->apply_cached_state_to_active_();
   this->state_ = speaker::STATE_STARTING;
+  // May run on a producer task, so the cached loop timestamp is not usable here
+  this->state_start_ms_ = millis();
   this->get_active_output()->start();
 }