Merge branch 'runtime-image-jpeg-scale' into runtime-image-integer-draw

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.agents/skills/display-test/SKILL.md

@@ -0,0 +1,156 @@
+---
+name: display-test
+description: Test an ESPHome display driver on a real panel with a camera. Use when a task asks to verify a display (LCD, e-paper, OLED, RLCD) on hardware, check orientation/rotation, partial updates, colours, contrast, or that text and shapes render correctly. Covers finding the USB port, flashing a test pattern, capturing the panel with any camera, and reading the photo.
+allowed-tools: Read, Write, Edit, Bash, Glob, Grep
+---
+
+# Display testing with a camera
+
+Point a camera at the panel to get visual evidence that a driver renders correctly. Any camera
+and capture tool works; this skill covers the common ones. `$SKILL` below is this directory
+(`.agents/skills/display-test`).
+
+## Ask before using a camera
+
+A camera can show people and rooms, not only the panel. Before the first capture, ask the user
+for permission and for which camera to use. List the cameras the host has (the commands below
+show how), name the one you intend to use, and wait for the user to confirm it. Do not pick a
+camera yourself, and do not fall back to another camera if the chosen one fails; ask again.
+
+The permission covers this session and the camera the user named. Ask again for a different
+camera or in a new session. If the user declines, stop and report that the display was not
+checked visually.
+
+## Capturing a frame
+
+Grab a still image, skipping the first few frames so auto-exposure and white balance settle.
+Read the JPEG with the Read tool; the image is shown visually.
+
+### macOS
+
+The bundled Swift tool uses AVFoundation and avoids the frame-grabbing problems some USB
+cameras have with other tools:
+
+```bash
+mkdir -p /tmp/camsnap /tmp/display-test
+swiftc -O "$SKILL/scripts/camsnap.swift" -o /tmp/camsnap/camsnap
+/tmp/camsnap/camsnap <camera-name-substring> /tmp/display-test/after.jpg 30
+```
+
+The camera argument is a case-insensitive substring of the name AVFoundation reports. If it does
+not match, the tool lists the cameras it found, so a run with a name that matches nothing lists
+the cameras without capturing. Use a substring that matches only the camera the user approved.
+It creates the output directory if needed and reports encoding or write errors on stderr. Other
+options include `ffmpeg` with `avfoundation` input, `imagesnap`, or Photo Booth's still capture.
+
+### Linux
+
+Use `ffmpeg` with the v4l2 input, `fswebcam`, or `v4l2-ctl`. With `ffmpeg`, `-ss 2` after the
+input discards the first two seconds of frames while exposure settles:
+
+```bash
+mkdir -p /tmp/display-test
+ffmpeg -f v4l2 -i /dev/video0 -ss 2 -frames:v 1 -y /tmp/display-test/after.jpg
+# or
+fswebcam -d /dev/video0 --skip 10 /tmp/display-test/after.jpg
+```
+
+List devices with `v4l2-ctl --list-devices`.
+
+### Windows
+
+Use `ffmpeg` with the DirectShow input (`-ss 2` skips the first frames, as on Linux), or any
+camera application that can save a still image:
+
+```powershell
+mkdir C:\temp -Force | Out-Null
+ffmpeg -f dshow -list_devices true -i dummy   # find the device name
+ffmpeg -f dshow -i video="<device name>" -ss 2 -frames:v 1 -y C:\temp\after.jpg
+```
+
+### Camera caveats
+
+- The board may sit at an angle. Do not trust absolute pixel positions or aspect ratios from the
+  photo; judge orientation, ordering and approximate spacing, using the corner markers as
+  references.
+- Reflections or a glossy cover can brighten one side. Capture again if a region is unclear.
+- A moving pattern is caught at an arbitrary phase. Take several captures, or use a static marker
+  per position.
+
+## Board and port
+
+Find the port; names change on every replug:
+
+```bash
+python3 "$SKILL/../hardware-test/scripts/ports.py"
+```
+
+Native-USB ESP32-S3/C3/C6/H2 boards show up as `USB JTAG/serial debug unit` and need
+`logger: hardware_uart: USB_SERIAL_JTAG`.
+
+## Test pattern
+
+Write a scratch config outside the checkout. Use one `name:` per board and include:
+
+- a white background, a black border and a filled square at the centre, drawn in the first
+  update (full-window check and scale);
+- a 60x20 bar near each corner, one bar per later update with `auto_clear_enabled: false`, so
+  each bar is written by its own partial window. The bars are wider than tall, which shows a
+  90 or 270 degree rotation; the corners exercise the window alignment;
+- a 20x20 square under the left end of the top-left bar, drawn in the same update, which marks
+  the top-left corner and shows a 180 degree rotation or a mirrored image.
+
+Use `Color::BLACK` and `Color::WHITE` in lambdas. Do not use the old `COLOR_OFF`/`COLOR_ON`
+constants; black must mean black.
+
+A ready template is in `$SKILL/templates/display-pattern.yaml`. Substitute the display platform,
+pins and (for a driver with fonts) a font. The marker pattern needs no font.
+
+## Build, flash, capture
+
+Run from the worktree under test so `python -m esphome` imports the checkout, not an installed
+copy:
+
+```bash
+cd <worktree>
+python3 -c "import esphome; print(esphome.__file__)"   # must print the worktree path
+PYTHONUNBUFFERED=1 python3 -m esphome compile /tmp/display-test/display-pattern.yaml
+PYTHONUNBUFFERED=1 python3 -m esphome upload /tmp/display-test/display-pattern.yaml \
+  --device /dev/cu.usbmodemXXXX
+sleep 6   # boot plus a few update intervals
+<capture command> /tmp/display-test/after.jpg
+```
+
+The device path differs by OS and host; use the path printed by `ports.py`. If the USB console
+wedges during flashing (esptool `No serial data received`), replug the board and retry. A board
+powered only by a battery may need the USB cable for flashing; the panel keeps its image when
+power is removed, which is useful for checking that an image is bistable.
+
+## What to check
+
+1. **Orientation**: the extra square sits under the bar in the expected top-left corner. If it is
+   in another corner, the image is rotated or mirrored. Test `rotation:` values with the same
+   pattern. The logical width and height swap at 90 and
+   270 degrees, so the 60x20 corner bars should then appear taller than wide on the physical
+   panel.
+2. **Coverage**: the border touches all four edges, with no dead rows or columns at the edges.
+3. **Partial updates**: with `auto_clear_enabled: false`, draw one marker per update. Each should
+   appear exactly at its requested position with no smearing, offset or mirrored placement.
+   Include all four corners.
+4. **Text and contrast**: sharp glyphs, correct polarity (black text on white, not inverted), no
+   ghosting from the previous frame.
+5. **Speed**: if the driver logs transfer sizes, check that a full refresh and a partial window
+   take the expected times.
+
+Record the build commit, board, config, and the captured image path when reporting results.
+
+## When a partial update looks wrong
+
+Take a marker-only capture before assuming the mapping is wrong: the camera's perspective makes
+absolute positions deceptive. If markers land in mirrored positions, the controller's address
+order (`MADCTL` MX/MY/MV) or the RAM block mapping is inverted for the window; verify the
+full-frame path separately, then fix the window computation.
+
+## Add findings
+
+Add new capture tools, panel quirks, or recovery steps here so the next session starts ahead.

.agents/skills/display-test/scripts/camsnap.swift

@@ -0,0 +1,71 @@
+// camsnap <camera name substring> <output.jpg> [frames to skip]
+// macOS only: grabs one frame from an AVFoundation camera after letting exposure settle.
+// See SKILL.md for capture tools on other systems.
+import AVFoundation
+import AppKit
+import CoreImage
+
+let args = CommandLine.arguments
+guard args.count >= 3 else {
+  FileHandle.standardError.write("usage: camsnap <camera name> <out.jpg> [skip]\n".data(using: .utf8)!)
+  exit(2)
+}
+let wanted = args[1].lowercased()
+let outPath = args[2]
+let skip = args.count > 3 ? Int(args[3]) ?? 30 : 30
+
+let discovery = AVCaptureDevice.DiscoverySession(
+  deviceTypes: [.external, .builtInWideAngleCamera], mediaType: .video, position: .unspecified)
+guard let device = discovery.devices.first(where: { $0.localizedName.lowercased().contains(wanted) }) else {
+  let names = discovery.devices.map { $0.localizedName }.joined(separator: ", ")
+  FileHandle.standardError.write("no camera matching '\(wanted)'; found: \(names)\n".data(using: .utf8)!)
+  exit(1)
+}
+
+final class Grabber: NSObject, AVCaptureVideoDataOutputSampleBufferDelegate {
+  var seen = 0
+  let skip: Int
+  let out: String
+  init(skip: Int, out: String) { self.skip = skip; self.out = out }
+  func captureOutput(_ output: AVCaptureOutput, didOutput sampleBuffer: CMSampleBuffer,
+                     from connection: AVCaptureConnection) {
+    seen += 1
+    guard seen > skip, let pixels = CMSampleBufferGetImageBuffer(sampleBuffer) else { return }
+    let image = CIImage(cvPixelBuffer: pixels)
+    let rep = NSBitmapImageRep(ciImage: image)
+    guard let jpeg = rep.representation(using: .jpeg, properties: [.compressionFactor: 0.9]) else {
+      FileHandle.standardError.write("failed to encode \(out) as JPEG\n".data(using: .utf8)!)
+      exit(1)
+    }
+    let url = URL(fileURLWithPath: out)
+    try? FileManager.default.createDirectory(
+      at: url.deletingLastPathComponent(), withIntermediateDirectories: true)
+    do {
+      try jpeg.write(to: url)
+    } catch {
+      FileHandle.standardError.write("failed to write \(out): \(error)\n".data(using: .utf8)!)
+      exit(1)
+    }
+    print("saved \(out) after \(seen) frames")
+    exit(0)
+  }
+}
+
+let session = AVCaptureSession()
+session.sessionPreset = .high
+guard let input = try? AVCaptureDeviceInput(device: device), session.canAddInput(input) else {
+  FileHandle.standardError.write("cannot open \(device.localizedName)\n".data(using: .utf8)!)
+  exit(1)
+}
+session.addInput(input)
+let output = AVCaptureVideoDataOutput()
+output.videoSettings = [kCVPixelBufferPixelFormatTypeKey as String: kCVPixelFormatType_32BGRA]
+let grabber = Grabber(skip: skip, out: outPath)
+output.setSampleBufferDelegate(grabber, queue: DispatchQueue(label: "camsnap"))
+session.addOutput(output)
+session.startRunning()
+DispatchQueue.main.asyncAfter(deadline: .now() + 15) {
+  FileHandle.standardError.write("timed out waiting for frames\n".data(using: .utf8)!)
+  exit(1)
+}
+RunLoop.main.run()

.agents/skills/display-test/templates/display-pattern.yaml

@@ -0,0 +1,43 @@
+# Display test pattern: corner markers, centre reference and partial-update markers.
+# Replace the display platform and pins with the driver under test.
+esphome:
+  name: display-pattern
+
+esp32:
+  board: esp32-s3-devkitc-1
+  framework:
+    type: esp-idf
+
+logger:
+  hardware_uart: USB_SERIAL_JTAG
+  level: DEBUG
+
+spi:
+  clk_pin: GPIO11
+  mosi_pin: GPIO12
+
+display:
+  - platform: st7305
+    id: test_display
+    cs_pin: GPIO40
+    dc_pin: GPIO5
+    reset_pin: GPIO41
+    update_interval: 1s
+    auto_clear_enabled: false
+    lambda: |-
+      static int frame = 0;
+      if (frame == 0) {
+        it.fill(Color::WHITE);
+        it.rectangle(0, 0, it.get_width(), it.get_height(), Color::BLACK);
+        it.filled_rectangle(it.get_width() / 2 - 10, it.get_height() / 2 - 10, 20, 20, Color::BLACK);
+      } else if (frame == 1) {
+        it.filled_rectangle(20, 20, 60, 20, Color::BLACK);
+        it.filled_rectangle(20, 50, 20, 20, Color::BLACK);
+      } else if (frame == 2) {
+        it.filled_rectangle(20, it.get_height() - 40, 60, 20, Color::BLACK);
+      } else if (frame == 3) {
+        it.filled_rectangle(it.get_width() - 80, 20, 60, 20, Color::BLACK);
+      } else if (frame == 4) {
+        it.filled_rectangle(it.get_width() - 80, it.get_height() - 40, 60, 20, Color::BLACK);
+      }
+      frame++;

.agents/skills/hardware-test/SKILL.md

@@ -115,7 +115,7 @@ Per-topic scripts, each described in the matching `reference/recipes/<component>
 (host driver, Zephyr driver probe), `rtsp_server/` (protocol client, raw rate reader, measurement set,
 API image grab), `cse7766/` (API observer with ping), `zephyr_coredump/` (reader flow, decode with the
 Zephyr tools), `libretiny_prefs/` (rtc preference harness header), `libretiny_crash/` (BK72xx crash probe header and
-capture decoder), `api_outgoing/` (wake cycle and Wi-Fi drop timing readers), `ld2450/` (zone number driver), `dfrobot_sen0395/` (API driver and case runner), `homeassistant_light/` (direct bulb driver, held-report case driver), `usb_audio/` (URL player), `speaker_media_player/` (API player driver, pipeline task case runner), `web_server/` (SSE client, request mix, SSE and HTTPD case runners), `mqtt/` (broker config with WebSocket listeners, test CA, transport case runner).
+capture decoder), `api_outgoing/` (wake cycle and Wi-Fi drop timing readers), `ld2450/` (zone number driver), `dfrobot_sen0395/` (API driver and case runner), `homeassistant_light/` (direct bulb driver, held-report case driver), `usb_audio/` (URL player), `speaker_media_player/` (API player driver, pipeline task case runner), `web_server/` (SSE client, request mix, SSE and HTTPD case runners), `mqtt/` (broker config with TLS, client-certificate and WebSocket listeners, test CA with server and client certificates, transport case runner, flash-and-drive runner, CLI TLS check without a board), `udp/` (datagram recorder, `udp.write` payload checker and case driver), `entity_icons/` (icon and device class readback over the API, MQTT discovery, web_server and dump_config, with a comparer).
 
 ## Templates in `$SKILL/templates`
 
@@ -132,11 +132,14 @@ capture decoder), `api_outgoing/` (wake cycle and Wi-Fi drop timing readers), `l
   `globals-storage-dut.yaml`, `usb-audio-waveshare-s3-eth-dut.yaml`, `usb-audio-sendspin-s3-eth-dut.yaml`,
   `cast-pro-1-sendspin-control.yaml`, `aux-2-preprod-stock-dut.yaml`, `aux-2-preprod-usb-audio-dut.yaml`,
   `dfrobot-sen0395-dut.yaml`, `aux-2-preprod-speaker-player-dut.yaml`, `web-server-sse-dut.yaml`,
-  `mqtt-transport-dut.yaml`.
+  `mqtt-transport-dut.yaml`, `mqtt-tls-dut.yaml`, `udp-write-dut.yaml`, `entity-icon-dut.yaml`.
 
 ## When something looks wrong
 
 - A capture stopped early or a line is missing: check the timestamps before trusting it.
+- A script that pipes into `tee` never ends although its work is done: a background command written as
+  `(cd dir && server & echo $!)` backgrounds the whole `cd && server` list, so a shell stays behind holding the
+  pipe open and `$!` is that shell, not the server. Write `(cd dir && exec server > out 2>&1 < /dev/null) &`.
 - The client never joins the AP: another board may still run an AP with the same SSID, or the device
   booted with saved credentials because the name was reused. One AP device at a time on the bench.
 - Builds come out byte-identical between branches: the wrong tree was imported (rule 3). The reverse

.agents/skills/hardware-test/reference/recipes/README.md

@@ -11,14 +11,14 @@ One file per component, named after it:
 - [`hdmi_cec.md`](hdmi_cec.md): two-board wire
 - [`ld2450.md`](ld2450.md): polygon zones, zone number round trip through the radar's readback
 - [`libretiny.md`](libretiny.md): rtc preference emulation, BK72xx crash report on the next boot
-- [`mqtt.md`](mqtt.md): broker bench, QoS, reconnect, crash log over MQTT, WebSocket transports with a local and a public broker
+- [`mqtt.md`](mqtt.md): broker bench, QoS, reconnect, crash log over MQTT, WebSocket transports with a local and a public broker, TLS trust sources (own CA, client certificate, certificate bundle, no verification) with the CLI check
 - [`nrf52.md`](nrf52.md): dongle board support
 - [`online_image.md`](online_image.md): stalled and malformed downloads
 - [`openthread.md`](openthread.md): border router on the S3 host plus H2 RCP
 - [`ota.md`](ota.md): overlap and lock, timeouts, deflate
 - [`rtsp_server.md`](rtsp_server.md): camera streaming on the Waveshare ESP32-S3-ETH
 - [`scheduler.md`](scheduler.md): loop wake A/B
-- [`udp.md`](udp.md): datagrams, multicast, sockets
+- [`udp.md`](udp.md): datagrams, multicast, sockets, `udp.write` payload shapes
 - [`usb_cdc_acm.md`](usb_cdc_acm.md): nRF52840 dongle host driver
 - [`wifi.md`](wifi.md): reboot_timeout with a fallback AP, DHCP lease cache, Easy Connect (DPP)
 - [`zephyr.md`](zephyr.md): preferences on the nRF52840 dongle
@@ -29,4 +29,4 @@ One file per component, named after it:
 - [`usb_audio.md`](usb_audio.md): USB audio speaker and microphone, the usb_host FIFO split, and Music Assistant playback through sendspin
 - [`dfrobot_sen0395.md`](dfrobot_sen0395.md): SEN0395 mmWave command flow, module quirks and overlong lines through its error reply
 - [`speaker.md`](speaker.md): media player pipeline tasks on the Connect AUX-2 with the `speaker` platform player
-- [`web_server.md`](web_server.md): state SSE stress and the HTTPD task stack on web_server_idf
+- [`web_server.md`](web_server.md): state SSE stress and the HTTPD task stack on web_server_idf, entity icon and device class readback

.agents/skills/hardware-test/reference/recipes/mqtt.md

@@ -20,7 +20,7 @@ the TLS listener's certificate, both run in the scratch directory so keys, logs
 to `NAME/#`, sends a switch command and an `on_message` topic, presses the 3000 byte publish button over the API,
 restarts the local broker when the last argument is `restart` (the PID in `mosquitto.pid`, written when the broker
 was started with `mosquitto -c mosquitto-ws.conf & echo $! > mosquitto.pid` in the working directory next to the
-certificates), checks its three ports answer again, and prints the broker's message counts with the device log. `mosquitto_sub` cannot speak
+certificates), checks every listener in the broker config answers again, and prints the broker's message counts with the device log. `mosquitto_sub` cannot speak
 WebSocket, so it subscribes on the plain listener of the same broker. Cases: `tcp` on 1883, `ws` on 9001, `wss` on
 9002 with `certificate_authority` (the certificate names an address, so `skip_cert_cn_check: true`), `wss` to
 test.mosquitto.org on 8081 with no CA for the certificate bundle, and two negatives that must never connect: a
@@ -29,3 +29,25 @@ different CA (`mbedtls_ssl_handshake returned -0x2700`) and the self-signed serv
 default in the generated sdkconfig. The TLS session costs about 29 kB of internal heap while connected; the public
 broker carries other devices' `esphome/discover` traffic, which is noise. Results:
 https://github.com/esphome/esphome/pull/16056#issuecomment-6301034019
+
+## TLS trust sources on ESP-IDF (#14318)
+
+One build per trust source from `templates/mqtt-tls-dut.yaml`: broker only (port must resolve to 1883),
+`certificate_authority` with no port (must resolve to 8883), `verify_ssl: false` with no CA, the CA plus
+`client_certificate` and `client_certificate_key` on the 8884 listener that requires one, `transport: wss` with the CA,
+`tls: true` to test.mosquitto.org on 8886 for the certificate bundle, and `tls: true` to the local self-signed broker as
+the negative. `scripts/mqtt/mosquitto-ws.conf` now has the 8883 and 8884 listeners and `scripts/mqtt/make_test_ca.sh`
+also writes `client.crt`/`client.key`. Before flashing, check each build's `src/esphome/core/defines.h` for
+`USE_MQTT_TLS`, `USE_MQTT_CERT_BUNDLE` and `USE_MQTT_TLS_INSECURE` and its `sdkconfig.<name>` for
+`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE` and `CONFIG_ESP_TLS_INSECURE`: only the bundle builds may carry the bundle and only
+the unverified build the insecure flags. `scripts/mqtt/flash_and_drive.sh TREE YAML PORT KEY BROKER_HOST
+local|public|neg` runs one build end to end (flash, bounded capture, `cases.sh` with a restart for the local broker,
+counts and the broker's per-listener connection lines) and prints the config dump's `TLS:` line (`CA certificate`,
+`certificate bundle` or `no verification`). The CLI side (`esphome/mqtt.py`) is covered without a board by
+`scripts/mqtt/cli_tls_check.sh TREE [neg] YAML...`, which runs `esphome clean-mqtt` under a timeout: status 124
+after `Connected to MQTT broker!` is a pass, and with `neg` each config must instead fail with
+`CERTIFICATE_VERIFY_FAILED` and never connect. Python's default SSL
+context rejects a CA that lacks a `keyUsage` extension (`CA cert does not include key usage extension`) while mbedTLS
+on the device accepts it, which is why the test CA carries `basicConstraints` and `keyUsage`. A broker kill shows as one
+`Last esp-tls error: 0x8008` on every build, TLS or not. Results:
+https://github.com/esphome/esphome/pull/14318#issuecomment-6311863827

.agents/skills/hardware-test/reference/recipes/udp.md

@@ -9,3 +9,18 @@ listener. Broadcast to boards is lossy under power save, unicast is not. Flood a
 reconnect on the Pico keeps IGMP membership. Set a long loop interval from `wifi.on_connect`
 (`App.set_loop_interval(20000)`), not `on_boot`, or Wi-Fi connect crawls. The `logger.log` action
 rejects `%.*s`; use a lambda.
+
+## udp.write payload shapes (#21263, ApplyBytes)
+
+`templates/udp-write-dut.yaml` puts every payload shape behind a template button (constant 4 bytes twice, 3, 9, 0,
+128, 129 and 600 bytes, a 300 byte lambda, a simple value, a string) plus an `on_receive` that replies with the
+received bytes reversed. `scripts/udp/write_cases.sh DEVICE_IP KEY` records the device's datagrams with
+`udp_listen.py` on the test host, presses the buttons two seconds apart, sends one unicast datagram for the echo and
+compares everything byte for byte with `check.py`; a missing datagram shifts every later one, so read the first
+mismatch. Before flashing, check the generated `main.cpp`: on ESP8266 a constant payload is copied out of its
+`PROGMEM` table into `uint8_t esphome__bytes[N]` up to the stack limit and into `std::make_unique<uint8_t[]>` beyond,
+identical payloads share one table, a lambda is sent from its vector. An empty constant payload is generated as
+`send_packet(nullptr, 0)`, and the raw lwIP UDP `sendto` used on ESP8266 rejected a null buffer with `EINVAL`
+(`sendto() error 22` in the log, no datagram) until it accepted `nullptr` with a zero length; the old
+`TemplatableBytes::visit` had passed a zero length stack buffer instead. Compare sizes against the stacked PR's own
+head when the PR is stacked, not against dev. Results: https://github.com/esphome/esphome/pull/21263

.agents/skills/hardware-test/reference/recipes/web_server.md

@@ -29,3 +29,32 @@ clients. Entity URLs use the entity name, URL encoded, not an object id. The HTT
 request of the boot; compare after the mix and after the SSE round, with two boots when the numbers are close.
 Results: https://github.com/esphome/esphome/pull/21109#issuecomment-6300582328 and
 https://github.com/esphome/esphome/pull/21038#issuecomment-6301310182
+
+## Entity icon and device class readback (#21111)
+
+Covers every path that reads an entity's icon or device class: the native API listing, MQTT discovery, the web_server
+`/events` listing and REST endpoints, and `dump_config`. `templates/entity-icon-dut.yaml` (ESP8266 board with wifi,
+encrypted api, ota, web_server and mqtt against a local broker) carries a sensor with a 63 character icon, one with no
+icon or device class, an internal sensor, and binary_sensor, switch, button, text_sensor, number, select, event, cover
+and text entities with icons and device classes. The per-run file supplies `name` and `broker_ip` through
+substitutions. Flash the PR and base builds under different names, then from the scratch directory:
+
+```sh
+scripts/entity_icons/readback.sh DEVICE_IP KEY NAME BROKER_HOST cap-NAME.txt   # once per build
+scripts/entity_icons/compare.sh ic-base ic-pr                                   # api, web, mqttn, dump all identical
+```
+
+`readback.sh` takes about 25 s once the device is on the network: 12 s of `mosquitto_sub` on `homeassistant/#` and
+`NAME/#`, the API listing (`api_list.py`, one JSON line per entity with icon, device class, unit, options and event
+types) and `web_dump.py` (6 s on `/events`, keeping only the listing rows that carry `domain`, then a GET of each
+listed id with `?detail=all` and one retry, because the ESP8266 async server occasionally leaves a request unanswered
+within 5 s). The web ids are `domain/Name`, not object ids, and `/event/<name>` has no GET handler (404 on every
+build). `mqtt_norm.py` drops the `dev` block (compile time) and the `NAME/debug` topic (heap probe), so a clean run
+differs in nothing. `dump_config` prints icons and device classes only for some domains; button, event and
+binary_sensor icons never appear there.
+
+Found with this flow on 2026-10-21: since #19577 every ESP8266 `web_server` build that lists a cover, climate, lock,
+valve, update, alarm_control_panel or water_heater entity reboots with `Exception (3) LoadStoreErr` in
+`json::linked(const char *)` (the ROM `strlen` on a flash address), fixed by #21316. The cover in the template keeps
+that path covered; before #21316 is merged, apply its one line change to both trees or the web_server comparison
+cannot run.

.agents/skills/hardware-test/scripts/entity_icons/api_list.py

@@ -0,0 +1,56 @@
+"""List every entity over the native API with its icon, device class and unit: one sorted JSON line each.
+
+usage: api_list.py HOST KEY OUT
+"""
+
+import asyncio
+import json
+import pathlib
+import sys
+
+from aioesphomeapi import APIClient
+
+HOST, KEY, OUT = sys.argv[1], sys.argv[2], sys.argv[3]
+
+
+async def main() -> None:
+    c = APIClient(HOST, 6053, None, noise_psk=KEY)
+    await c.connect(login=True)
+    ents, _ = await c.list_entities_services()
+    rows = []
+    for e in ents:
+        row = {
+            "type": type(e).__name__,
+            "name": e.name,
+            "object_id": e.object_id,
+            "icon": e.icon,
+        }
+        for k in (
+            "device_class",
+            "unit_of_measurement",
+            "event_types",
+            "options",
+            "mode",
+        ):
+            if hasattr(e, k):
+                v = getattr(e, k)
+                row[k] = (
+                    list(v)
+                    if isinstance(v, (list, tuple))
+                    else (v.name if hasattr(v, "name") else v)
+                )
+        row["entity_category"] = (
+            e.entity_category.name
+            if hasattr(e.entity_category, "name")
+            else e.entity_category
+        )
+        row["disabled_by_default"] = e.disabled_by_default
+        rows.append(row)
+    rows.sort(key=lambda r: (r["type"], r["name"]))
+    with pathlib.Path(OUT).open("w", encoding="utf-8") as f:
+        f.writelines(json.dumps(r, sort_keys=True) + "\n" for r in rows)
+    print(f"{len(rows)} entities listed")
+    await c.disconnect()
+
+
+asyncio.run(main())

.agents/skills/hardware-test/scripts/entity_icons/compare.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+# compare.sh NAME_A NAME_B : diff the readback.sh outputs of two device names (api, web, mqttn and, when present, dump)
+# after replacing each name with DEV. Exit 1 when any pair differs; the diffs stay in cmp-KIND.diff.
+A=$1; B=$2; rc=0
+[ -n "$A" ] && [ -n "$B" ] || { echo "usage: compare.sh NAME_A NAME_B"; exit 2; }
+for k in api web mqttn dump; do
+  ext=jsonl; [ $k = dump ] && ext=txt
+  [ -f "$PWD/$k-$A.$ext" ] && [ -f "$PWD/$k-$B.$ext" ] || { echo "$k: missing"; [ $k = dump ] || rc=1; continue; }
+  sed "s/$A/DEV/g; s/$(echo "$A" | tr - _)/DEV/g" "$PWD/$k-$A.$ext" > "$PWD/cmp-$k-a.txt"
+  sed "s/$B/DEV/g; s/$(echo "$B" | tr - _)/DEV/g" "$PWD/$k-$B.$ext" > "$PWD/cmp-$k-b.txt"
+  if diff -u "$PWD/cmp-$k-a.txt" "$PWD/cmp-$k-b.txt" > "$PWD/cmp-$k.diff"; then echo "$k: identical ($(wc -l < "$PWD/cmp-$k-b.txt" | tr -d ' ') lines)"; else echo "$k: DIFFERS"; head -20 "$PWD/cmp-$k.diff"; rc=1; fi
+done
+exit $rc

.agents/skills/hardware-test/scripts/entity_icons/mqtt_norm.py

@@ -0,0 +1,37 @@
+"""Normalise mosquitto_sub output (topic TAB payload) for one device: drop other devices, replace the name, drop dev block.
+
+usage: mqtt_norm.py IN NAME OUT
+"""
+
+import json
+import pathlib
+import sys
+
+IN, NAME, OUT = sys.argv[1], sys.argv[2], sys.argv[3]
+rows = {}
+with pathlib.Path(IN).open(encoding="utf-8") as f:
+    for line in f:
+        topic, _, payload = line.rstrip("\n").partition("\t")
+        if (
+            f"/{NAME}/" not in topic and not topic.startswith(f"{NAME}/")
+        ) or topic == f"{NAME}/debug":
+            continue
+        topic = topic.replace(NAME, "DEV")
+        try:
+            obj = json.loads(payload)
+        except ValueError:
+            rows[topic] = payload.replace(NAME, "DEV")
+            continue
+        if isinstance(obj, dict):
+            obj.pop("dev", None)
+            obj = {
+                k: (v.replace(NAME, "DEV") if isinstance(v, str) else v)
+                for k, v in obj.items()
+            }
+        rows[topic] = obj
+with pathlib.Path(OUT).open("w", encoding="utf-8") as f:
+    f.writelines(
+        json.dumps({"topic": t, "payload": rows[t]}, sort_keys=True) + "\n"
+        for t in sorted(rows)
+    )
+print(f"{len(rows)} topics for {NAME}")

.agents/skills/hardware-test/scripts/entity_icons/readback.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# readback.sh DEVICE_IP KEY NAME BROKER_HOST [CAPTURE] : record how a device built from templates/entity-icon-dut.yaml
+# reports its entity icons and device classes: the native API listing (api-NAME.jsonl), the retained MQTT discovery
+# payloads and states (mqtt-NAME.txt, normalised to mqttn-NAME.jsonl with the device name replaced and the debug topic
+# dropped), the web_server /events listing plus every REST endpoint with ?detail=all (web-NAME.jsonl) and, when a
+# serial CAPTURE is given, the dump_config Icon and Device Class lines (dump-NAME.txt, timestamps and line numbers
+# removed). KEY as for api_button.py. Outputs go to the working directory; compare two names with compare.sh.
+HERE=$(cd "$(dirname "$0")" && pwd); PY=${PYTHON:-python3}; DEV=$1; KEY=$2; N=$3; B=$4; CAP=$5; rc=0; TAB=$(printf '\t')
+[ -n "$DEV" ] && [ -n "$KEY" ] && [ -n "$N" ] && [ -n "$B" ] || { echo "usage: readback.sh DEVICE_IP KEY NAME BROKER_HOST [CAPTURE]"; exit 2; }
+timeout 12 mosquitto_sub -h "$B" -v -t 'homeassistant/#' -t "$N/#" -F "%t$TAB%p" > "$PWD/mqtt-$N.txt" 2> "$PWD/mqtt-$N.err"
+$PY "$HERE/mqtt_norm.py" "$PWD/mqtt-$N.txt" "$N" "$PWD/mqttn-$N.jsonl" || rc=1
+$PY "$HERE/api_list.py" "$DEV" "$KEY" "$PWD/api-$N.jsonl" || { echo "API listing failed"; rc=1; }
+$PY "$HERE/web_dump.py" "$DEV" "$PWD/web-$N.jsonl" || { echo "web_server dump failed"; rc=1; }
+if [ -n "$CAP" ]; then
+  LC_ALL=C grep -a '\]:   Icon: \|\]:   Device Class: ' "$CAP" | LC_ALL=C sed 's/\x1b\[[0-9;]*m//g; s/^\[[^]]*\]//; s/:[0-9]*\]:/]:/' | sort > "$PWD/dump-$N.txt"
+  echo "dump_config icon lines $(grep -c 'Icon:' "$PWD/dump-$N.txt"), device class lines $(grep -c 'Device Class:' "$PWD/dump-$N.txt")"
+fi
+exit $rc

.agents/skills/hardware-test/scripts/entity_icons/web_dump.py

@@ -0,0 +1,99 @@
+"""Dump the web_server view of every entity: the /events listing (detail all) and each REST endpoint with ?detail=all.
+
+usage: web_dump.py HOST OUT
+"""
+
+import json
+import pathlib
+import socket
+import sys
+import time
+import urllib.parse
+import urllib.request
+
+HOST, OUT = sys.argv[1], sys.argv[2]
+
+
+def sse_listing(seconds: float) -> list[dict]:
+    s = socket.create_connection((HOST, 80), timeout=5)
+    s.sendall(
+        b"GET /events HTTP/1.1\r\nHost: %s\r\nAccept: text/event-stream\r\n\r\n"
+        % HOST.encode()
+    )
+    buf = b""
+    deadline = time.monotonic() + seconds
+    s.settimeout(1.0)
+    while time.monotonic() < deadline:
+        try:
+            data = s.recv(65536)
+        except TimeoutError:
+            continue
+        if not data:
+            break
+        buf += data
+    s.close()
+    head, _, body = buf.partition(b"\r\n\r\n")
+    if b"chunked" in head.lower():
+        out = b""
+        while True:
+            i = body.find(b"\r\n")
+            if i < 0:
+                break
+            size = int(body[:i].split(b";")[0], 16)
+            out += body[i + 2 : i + 2 + size]
+            body = body[i + 2 + size + 2 :]
+            if size == 0:
+                break
+        body = out
+    rows = []
+    for block in body.decode(errors="replace").split("\n\n"):
+        ev, data = None, None
+        for line in block.split("\n"):
+            line = line.rstrip("\r")
+            if line.startswith("event:"):
+                ev = line[6:].strip()
+            elif line.startswith("data:"):
+                data = line[5:].strip()
+        if ev in ("state", "state_detail_all") and data:
+            try:
+                obj = json.loads(data)
+            except ValueError:
+                rows.append({"event": ev, "invalid": data})
+                continue
+            # bare state updates that land inside the window carry no domain; only the listing rows are kept
+            if "domain" in obj:
+                rows.append({"event": ev, **obj})
+    return rows
+
+
+def get_json(url: str) -> dict:
+    """One retry: the ESP8266 async server occasionally leaves a request unanswered."""
+    for attempt in (1, 2):
+        try:
+            with urllib.request.urlopen(url, timeout=5) as resp:
+                return json.loads(resp.read())
+        except TimeoutError:
+            if attempt == 2:
+                raise
+            print(f"retrying {url}", flush=True)
+    return {}
+
+
+rows = sse_listing(6)
+ids = sorted({r["id"] for r in rows if "id" in r})
+rest = []
+for ident in ids:
+    domain, _, obj = ident.partition("/")
+    url = f"http://{HOST}/{domain}/{urllib.parse.quote(obj)}?detail=all"
+    try:
+        rest.append({"url": url.replace(HOST, "HOST"), **get_json(url)})
+    except Exception as e:  # noqa: BLE001
+        rest.append({"url": url.replace(HOST, "HOST"), "error": str(e)})
+    time.sleep(0.3)
+with pathlib.Path(OUT).open("w", encoding="utf-8") as f:
+    f.writelines(
+        json.dumps(r, sort_keys=True) + "\n"
+        for r in sorted(rows, key=lambda r: (r.get("id", ""), r["event"]))
+    )
+    f.writelines(json.dumps(r, sort_keys=True) + "\n" for r in rest)
+print(f"{len(rows)} sse rows, {len(ids)} ids, {len(rest)} rest rows")

.agents/skills/hardware-test/scripts/mqtt/cases.sh

@@ -24,8 +24,10 @@ if [ "$RESTART" = restart ]; then
   pid=$(cat "$WORK/mosquitto.pid" 2>/dev/null); [ -n "$pid" ] || { echo "no mosquitto.pid in $WORK, cannot restart the broker"; exit 1; }
   kill "$pid" || { echo "broker PID $pid is not running, nothing to restart"; exit 1; }; sleep 8
   nc -z -w 3 "$B" 1883 && { echo "the old broker still answers on 1883 after the kill"; exit 1; }
-  (cd "$WORK" && mosquitto -c mosquitto-ws.conf > mosquitto.out 2>&1 & echo $! > "$WORK/mosquitto.pid"); sleep 25
-  for port in 1883 9001 9002; do nc -z -w 3 "$B" "$port" || { echo "broker port $port not listening after the restart"; exit 1; }; done
+  # exec so the PID is the broker's own and no shell stays behind holding the caller's output pipe open
+  (cd "$WORK" && exec mosquitto -c mosquitto-ws.conf > mosquitto.out 2>&1 < /dev/null) &
+  echo $! > "$WORK/mosquitto.pid"; sleep 25
+  for port in $(awk '/^listener/ {print $2}' "$WORK/mosquitto-ws.conf"); do nc -z -w 3 "$B" "$port" || { echo "broker port $port not listening after the restart"; exit 1; }; done
   tail -n +$((n1+1)) "$LOG" | grep -a -q "MQTT_EVENT_CONNECTED\|\[mqtt:[0-9]*\]: Connected" || { echo "the device did not reconnect after the broker restart"; exit 1; }
 else
   echo "=== $N: no broker restart (pass 'restart' as the 7th argument for a local broker)"

.agents/skills/hardware-test/scripts/mqtt/cli_tls_check.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+# cli_tls_check.sh TREE [neg] YAML... : run `esphome clean-mqtt` from the checkout TREE for each config, which goes
+# through the same TLS setup in esphome/mqtt.py as `esphome logs` over MQTT, without needing a board. clean-mqtt never
+# exits on its own, so it runs under a 25 s timeout: status 124 after "Connected to MQTT broker!" means the CLI
+# connected. With neg every config must instead fail with CERTIFICATE_VERIFY_FAILED and never connect, so a negative
+# that fails for another reason (bad YAML, broker down) is reported as a failure too. A relative YAML path is taken
+# from the working directory, where the cleanmqtt-NAME.log outputs also go. Exit 1 when any config missed its result.
+TREE=$1; shift; PY=${PYTHON:-python3}; NEG=0
+[ "$1" = neg ] && { NEG=1; shift; }
+[ -d "$TREE/esphome" ] && [ -n "$1" ] || { echo "usage: cli_tls_check.sh TREE [neg] YAML..."; exit 2; }
+bad=0
+for y in "$@"; do
+  case $y in /*) ;; *) y=$PWD/$y;; esac
+  n=$(basename "$y" .yaml); log=$PWD/cleanmqtt-$n.log
+  (cd "$TREE" && PYTHONUNBUFFERED=1 timeout 25 $PY -m esphome clean-mqtt "$y" > "$log" 2>&1); rc=$?
+  if [ "$NEG" = 0 ] && [ "$rc" = 124 ] && grep -q "Connected to MQTT broker" "$log"; then
+    echo "$n: connected"
+  elif [ "$NEG" = 1 ] && grep -q "CERTIFICATE_VERIFY_FAILED" "$log" && ! grep -q "Connected to MQTT broker" "$log"; then
+    echo "$n: rejected (CERTIFICATE_VERIFY_FAILED)"
+  else
+    echo "$n: FAILED (status $rc): $(grep -a -m1 -i 'cannot connect\|error' "$log" | cut -c1-160)"; bad=$((bad+1))
+  fi
+done
+[ "$bad" = 0 ]

.agents/skills/hardware-test/scripts/mqtt/flash_and_drive.sh

@@ -0,0 +1,53 @@
+#!/bin/sh
+# flash_and_drive.sh TREE YAML PORT KEY BROKER_HOST MODE [SUB_PORT] : flash YAML from the checkout TREE over the serial
+# PORT, capture the serial log (cap-NAME.txt in the working directory), wait for the first MQTT connect or TLS error,
+# then drive the device with cases.sh (KEY as for cases.sh, - for a plaintext API). MODE local runs cases.sh with a
+# broker restart (the working directory must hold mosquitto-ws.conf and mosquitto.pid), public runs it without a
+# restart, neg only watches for 100 s (a build that must never connect). SUB_PORT is the plain listener cases.sh
+# subscribes on (default 1883). Ends with connect, disconnect, handshake error and crash counts, the config dump's
+# TLS line, the probe heap lines and the broker listener each connection used. Exit 1 when the capture did not start,
+# the device reached no MQTT event within 90 s (local and public), it crashed, or the mode's own check failed.
+TREE=$1; YAML=$2; PORT=$3; KEY=$4; B=$5; MODE=$6; SP=${7:-1883}
+case $YAML in /*) ;; *) YAML=$PWD/$YAML;; esac
+HERE=$(cd "$(dirname "$0")" && pwd); PY=${PYTHON:-python3}; N=$(basename "$YAML" .yaml); CAP=$PWD/cap-$N.txt; ULOG=$PWD/upload-$N.log
+[ -d "$TREE/esphome" ] && [ -e "$PORT" ] && [ -n "$KEY" ] && [ -n "$B" ] || { echo "usage: flash_and_drive.sh TREE YAML PORT KEY BROKER_HOST local|public|neg [SUB_PORT]"; exit 2; }
+case $MODE in local|public|neg) ;; *) echo "MODE must be local, public or neg"; exit 2;; esac
+pkill -f "[s]erial_capture.py $PORT "; sleep 1
+echo "=== $N: flash ($(date +%T))"
+(cd "$TREE" && PYTHONUNBUFFERED=1 timeout 300 $PY -m esphome upload "$YAML" --device "$PORT" > "$ULOG" 2>&1) || { echo "upload failed"; tail -5 "$ULOG"; exit 1; }
+SECS=200; [ "$MODE" = neg ] && SECS=100
+# a stale capture from an earlier run must not satisfy the wait below
+rm -f "$CAP"
+$PY "$HERE/../serial_capture.py" "$PORT" $SECS "$CAP" > "$PWD/cap-$N.stderr" 2>&1 &
+cap_pid=$!
+i=0; until grep -a -q "MQTT_EVENT_CONNECTED\|\[mqtt:[0-9]*\]: Connected\|mbedtls_ssl_handshake returned\|Failed to verify" "$CAP" 2>/dev/null || [ $i -ge 45 ]; do sleep 2; i=$((i+1)); done
+kill -0 $cap_pid 2>/dev/null && [ -f "$CAP" ] || { echo "serial capture is not running on $PORT"; tail -3 "$PWD/cap-$N.stderr"; exit 1; }
+DEV=$(grep -a -o 'IP Address: [0-9.]*' "$CAP" | head -1 | awk '{print $3}')
+if [ $i -ge 45 ] || [ -z "$DEV" ]; then
+  echo "=== $N: no MQTT event or no IP within 90 s ($(date +%T))"
+  [ "$MODE" = neg ] || { pkill -f "[s]erial_capture.py $PORT "; exit 1; }
+else
+  echo "=== $N: first MQTT event after $((i*2)) s, device $DEV ($(date +%T))"
+fi
+grep -a 'ESPHome version\|\]:   Transport\|\]:   TLS:' "$CAP" | sed 's/\x1b\[[0-9;]*m//g' | cut -c1-120
+rc=0
+case $MODE in
+  local)  PYTHON=$PY sh "$HERE/cases.sh" "$N" "$KEY" "$B" "$SP" "$CAP" "$DEV" restart; rc=$?;;
+  public) PYTHON=$PY sh "$HERE/cases.sh" "$N" "$KEY" "$B" "$SP" "$CAP" "$DEV"; rc=$?;;
+  neg)    sleep 70;;
+esac
+wait $cap_pid
+strip() { sed 's/\x1b\[[0-9;]*m//g'; }
+# count the backend's own events so the result does not depend on on_connect/on_disconnect log lines in the config
+connects=$(grep -a -c 'MQTT_EVENT_CONNECTED' "$CAP"); errors=$(grep -a -c 'mbedtls_ssl_handshake returned\|Failed to verify certificate' "$CAP")
+crashes=$(grep -a -c 'Guru\|abort()\|Backtrace' "$CAP")
+echo "=== $N: connects $connects, disconnects $(grep -a -c 'MQTT_EVENT_DISCONNECTED' "$CAP"), handshake errors $errors, crashes $crashes"
+grep -a 'mbedtls_ssl_handshake returned\|Failed to verify\|esp-tls' "$CAP" | strip | sed 's/^\[[^]]*\]//' | sort | uniq -c | sort -rn | head -4 | cut -c1-150
+grep -a '\[probe:' "$CAP" | strip | sed 's/.*\[probe:[0-9]*\]: //' | sed -n '1p;$p'
+[ -f "$PWD/mosquitto.log" ] && [ -n "$DEV" ] && echo "broker listeners used by $DEV: $(grep "New connection from $DEV" "$PWD/mosquitto.log" | sed 's/.*on port //' | sort | uniq -c | tr '\n' ';')"
+[ "$crashes" = 0 ] || { echo "device crashed $crashes time(s)"; exit 1; }
+if [ "$MODE" = neg ]; then
+  [ "$connects" = 0 ] && [ "$errors" -gt 0 ] || { echo "negative case: expected no connect and a handshake error"; exit 1; }
+else
+  [ "$rc" = 0 ] || { echo "cases.sh failed with status $rc"; exit 1; }
+fi

.agents/skills/hardware-test/scripts/mqtt/make_test_ca.sh

@@ -1,13 +1,21 @@
 #!/bin/sh
-# make_test_ca.sh BROKER_IP : a throwaway CA and a server certificate for the broker address (30 days), written into
-# the working directory; run it in the scratch directory where a copy of mosquitto-ws.conf lives. The device
-# config takes ca.crt as certificate_authority (skip_cert_cn_check: true, the name check does not match an address);
-# other-ca.crt is a second CA for the negative case.
+# make_test_ca.sh BROKER_IP : a throwaway CA, a server certificate for the broker address and a client certificate
+# (30 days), written into the working directory; run it in the scratch directory where a copy of mosquitto-ws.conf
+# lives. The device config takes ca.crt as certificate_authority (skip_cert_cn_check: true, the name check does not
+# match an address) and client.crt/client.key as client_certificate/client_certificate_key for the listener that
+# requires one; other-ca.crt is a second CA for the negative case. The CA carries basicConstraints and keyUsage
+# because Python's default SSL context (esphome logs, esphome clean-mqtt) rejects a CA without them.
 set -e
 IP=$1
-openssl req -x509 -newkey rsa:2048 -nodes -keyout ca.key -out ca.crt -days 30 -subj "/CN=hwtest-ca"
+[ -n "$IP" ] || { echo "usage: make_test_ca.sh BROKER_IP"; exit 2; }
+openssl req -x509 -newkey rsa:2048 -nodes -keyout ca.key -out ca.crt -days 30 -subj "/CN=hwtest-ca" \
+  -addext "basicConstraints=critical,CA:TRUE" -addext "keyUsage=critical,keyCertSign,cRLSign"
 openssl req -newkey rsa:2048 -nodes -keyout server.key -out server.csr -subj "/CN=hwtest-broker"
 printf "subjectAltName=IP:%s\nextendedKeyUsage=serverAuth\n" "$IP" > san.ext
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 30 -extfile san.ext
-openssl req -x509 -newkey rsa:2048 -nodes -keyout other-ca.key -out other-ca.crt -days 30 -subj "/CN=other-ca"
-openssl verify -CAfile ca.crt server.crt
+openssl req -newkey rsa:2048 -nodes -keyout client.key -out client.csr -subj "/CN=hwtest-client"
+printf "extendedKeyUsage=clientAuth\n" > client.ext
+openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 30 -extfile client.ext
+openssl req -x509 -newkey rsa:2048 -nodes -keyout other-ca.key -out other-ca.crt -days 30 -subj "/CN=other-ca" \
+  -addext "basicConstraints=critical,CA:TRUE" -addext "keyUsage=critical,keyCertSign,cRLSign"
+openssl verify -CAfile ca.crt server.crt client.crt

.agents/skills/hardware-test/scripts/mqtt/mosquitto-ws.conf

@@ -1,8 +1,20 @@
 # Copy next to the certificates in the scratch directory and start it there with
-# `mosquitto -c mosquitto-ws.conf & echo $! > mosquitto.pid` (cases.sh restarts that PID): plain MQTT, MQTT over WebSocket, and MQTT over WebSocket with TLS (server.crt and
-# server.key from make_test_ca.sh in the same directory). log_type all gives the listener port per connection.
+# `mosquitto -c mosquitto-ws.conf & echo $! > mosquitto.pid` (cases.sh restarts that PID): plain MQTT, MQTT over TLS,
+# MQTT over TLS that requires a client certificate, MQTT over WebSocket, and MQTT over WebSocket with TLS
+# (server.crt, server.key, ca.crt from make_test_ca.sh in the same directory). log_type all gives the listener port
+# per connection.
 listener 1883
 protocol mqtt
+listener 8883
+protocol mqtt
+certfile server.crt
+keyfile server.key
+listener 8884
+protocol mqtt
+certfile server.crt
+keyfile server.key
+cafile ca.crt
+require_certificate true
 listener 9001
 protocol websockets
 listener 9002

.agents/skills/hardware-test/scripts/udp/check.py

@@ -0,0 +1,40 @@
+"""Compare the listener log (JSON lines from udp_listen.py) against the udp-write-dut.yaml payload sequence.
+
+usage: check.py LISTEN_JSONL ECHO_HEX  (ECHO_HEX is the datagram sent to the device for the echo case)
+"""
+
+import json
+import pathlib
+import sys
+
+with pathlib.Path(sys.argv[1]).open(encoding="utf-8") as f:
+    log = [json.loads(line) for line in f if line.strip()]
+echo_in = bytes.fromhex(sys.argv[2])
+small = bytes([0xAA, 0x55, 0x01, 0x02])
+expected = [
+    ("small 1/2", small),
+    ("small 2/2", small),
+    ("simple", bytes([1, 2, 3])),
+    ("text", b"hello udp"),
+    ("empty", b""),
+    ("stack128", bytes((0x10 + i) & 0xFF for i in range(128))),
+    ("heap129", bytes((0x20 + i) & 0xFF for i in range(129))),
+    ("heap600", bytes((0x30 + i) & 0xFF for i in range(600))),
+    ("lambda300", bytes((i * 7) & 0xFF for i in range(300))),
+    ("echo", echo_in[::-1]),
+]
+got = [bytes.fromhex(e["hex"]) for e in log]
+ok = 0
+for i, (name, want) in enumerate(expected):
+    have = got[i] if i < len(got) else None
+    res = (
+        "OK"
+        if have == want
+        else f"MISMATCH got {None if have is None else have[:16].hex() + '... len ' + str(len(have))}"
+    )
+    ok += res == "OK"
+    print(f"{name:10s} {len(want):4d} B  {res}")
+print(
+    f"{ok}/{len(expected)} payloads byte-exact, {len(got)} datagrams received, sources {sorted({e['src'] for e in log})}"
+)
+sys.exit(0 if ok == len(expected) and len(got) == len(expected) else 1)

.agents/skills/hardware-test/scripts/udp/udp_listen.py

@@ -0,0 +1,32 @@
+"""Log every datagram on PORT for SECONDS as one JSON line: time, source, length, hex payload."""
+
+import json
+import pathlib
+import socket
+import sys
+import time
+
+port, secs, out = int(sys.argv[1]), float(sys.argv[2]), sys.argv[3]
+s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+s.bind(("", port))
+s.settimeout(1.0)
+end = time.monotonic() + secs
+with pathlib.Path(out).open("w", encoding="utf-8") as f:
+    while time.monotonic() < end:
+        try:
+            data, (ip, sport) = s.recvfrom(65535)
+        except TimeoutError:
+            continue
+        f.write(
+            json.dumps(
+                {
+                    "t": time.strftime("%H:%M:%S"),
+                    "src": ip,
+                    "len": len(data),
+                    "hex": data.hex(),
+                }
+            )
+            + "\n"
+        )
+        f.flush()

.agents/skills/hardware-test/scripts/udp/write_cases.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+# write_cases.sh DEVICE_IP KEY [PORT] : drive a device built from templates/udp-write-dut.yaml. Records every datagram
+# the device sends to PORT (the udp component's port, default 18511) with udp_listen.py in the working directory,
+# presses the eight payload buttons over the API two seconds apart (KEY as for api_button.py, - for a plaintext API),
+# sends one 16 byte unicast datagram to the device for the echo case, then compares the recorded datagrams with
+# check.py. The recorder runs until the driver stops it. Exit 1 when the recorder did not start or a payload is
+# missing or differs; listen.jsonl stays in the working directory.
+HERE=$(cd "$(dirname "$0")" && pwd); PY=${PYTHON:-python3}; DEV=$1; KEY=$2; PORT=${3:-18511}
+[ -n "$DEV" ] && [ -n "$KEY" ] || { echo "usage: write_cases.sh DEVICE_IP KEY [PORT]"; exit 2; }
+ECHO=0102030405060708090a0b0c0d0e0f10
+rm -f "$PWD/listen.jsonl"
+$PY "$HERE/udp_listen.py" "$PORT" 600 "$PWD/listen.jsonl" &
+lst=$!
+sleep 2
+kill -0 $lst 2>/dev/null || { echo "udp_listen.py is not running on port $PORT"; exit 1; }
+for b in Small Simple Text Empty Stack128 Heap129 Heap600 Lambda300; do
+  $PY "$HERE/../api_button.py" "$DEV" "$KEY" press "$b" > /dev/null || echo "press $b failed"; sleep 2
+done
+$PY -c "import socket; socket.socket(socket.AF_INET, socket.SOCK_DGRAM).sendto(bytes.fromhex('$ECHO'), ('$DEV', $PORT))"
+sleep 5
+kill $lst 2>/dev/null; wait $lst 2>/dev/null
+$PY "$HERE/check.py" "$PWD/listen.jsonl" "$ECHO"

.agents/skills/hardware-test/templates/entity-icon-dut.yaml

@@ -0,0 +1,148 @@
+# Entity icon and device class readback (esphome#21111): the per-run file supplies name and broker_ip through substitutions and includes this file as a package. Every readback path is covered: API listing, MQTT discovery, web_server JSON and dump_config. See reference/recipes/web_server.md.
+esp8266:
+  board: d1_mini
+
+logger:
+  level: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  power_save_mode: none
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+web_server:
+  port: 80
+
+mqtt:
+  broker: ${broker_ip}
+  reboot_timeout: 0s
+
+interval:
+  - interval: 10s
+    then:
+      - lambda: |-
+          ESP_LOGI("probe", "free heap %u, max block %u", (unsigned) ESP.getFreeHeap(), (unsigned) ESP.getMaxFreeBlockSize());
+
+esphome:
+  name: ${name}
+
+sensor:
+  - platform: template
+    name: Temp
+    id: temp
+    device_class: temperature
+    unit_of_measurement: "°C"
+    icon: mdi:thermometer
+    accuracy_decimals: 1
+    lambda: return 21.5;
+    update_interval: 30s
+  - platform: template
+    name: Long Icon
+    id: long_icon
+    icon: mdi:this-icon-name-is-exactly-sixty-three-characters-long-abcde
+    device_class: humidity
+    unit_of_measurement: "%"
+    lambda: return 40.0;
+    update_interval: 30s
+  - platform: template
+    name: Plain
+    id: plain
+    lambda: return 1.0;
+    update_interval: 30s
+  - platform: template
+    name: Hidden
+    id: hidden
+    internal: true
+    icon: mdi:eye-off
+    device_class: power
+    lambda: return 2.0;
+    update_interval: 30s
+
+binary_sensor:
+  - platform: template
+    name: Motion
+    id: motion
+    device_class: motion
+    icon: mdi:motion-sensor
+    lambda: return false;
+
+switch:
+  - platform: template
+    name: Relay
+    id: relay
+    device_class: outlet
+    icon: mdi:power-plug
+    optimistic: true
+
+button:
+  - platform: template
+    name: Reboot
+    id: reboot_btn
+    device_class: restart
+    icon: mdi:restart
+    on_press:
+      - logger.log: "Reboot pressed"
+
+text_sensor:
+  - platform: template
+    name: Version
+    id: version
+    device_class: timestamp
+    icon: mdi:tag
+    lambda: return {"2026-10-21T00:00:00+00:00"};
+    update_interval: 30s
+
+number:
+  - platform: template
+    name: Level
+    id: level
+    device_class: battery
+    icon: mdi:knob
+    unit_of_measurement: "%"
+    min_value: 0
+    max_value: 100
+    step: 1
+    optimistic: true
+    initial_value: 50
+
+select:
+  - platform: template
+    name: Mode
+    id: mode
+    icon: mdi:format-list-bulleted
+    options: [a, b, c]
+    optimistic: true
+    initial_option: a
+
+event:
+  - platform: template
+    name: Doorbell
+    id: doorbell
+    device_class: doorbell
+    icon: mdi:doorbell
+    event_types: [ring, knock]
+
+cover:
+  - platform: template
+    name: Garage
+    id: garage
+    device_class: garage
+    icon: mdi:garage
+    optimistic: true
+
+text:
+  - platform: template
+    name: Secret Note
+    id: note
+    mode: password
+    icon: mdi:form-textbox-password
+    optimistic: true
+    initial_value: "x"

.agents/skills/hardware-test/templates/mqtt-tls-dut.yaml

@@ -0,0 +1,99 @@
+# MQTT TLS trust-source test (#14318, needs that PR's tree for tls and verify_ssl): one build per trust source, with
+# the name and the mqtt block edited per file (see reference/recipes/mqtt.md). Secrets: broker_ip (the local broker
+# from make_test_ca.sh), mqtt_ca, mqtt_client_cert and mqtt_client_key as block scalars from the same run.
+esp32:
+  board: esp32dev
+  framework:
+    type: esp-idf
+
+logger:
+  level: VERBOSE
+  logs:
+    wifi: DEBUG
+    api: DEBUG
+    api.connection: DEBUG
+    scheduler: DEBUG
+    component: DEBUG
+    sensor: DEBUG
+    esp32: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  power_save_mode: none
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+interval:
+  - interval: 10s
+    then:
+      - lambda: |-
+          ESP_LOGI("probe", "mqtt connected %d, internal free %u, largest block %u", id(mq).is_connected(),
+                   (unsigned) heap_caps_get_free_size(MALLOC_CAP_INTERNAL),
+                   (unsigned) heap_caps_get_largest_free_block(MALLOC_CAP_INTERNAL));
+
+sensor:
+  - platform: template
+    name: Counter
+    update_interval: 2s
+    accuracy_decimals: 0
+    lambda: |-
+      static uint32_t n = 0;
+      return n++;
+
+switch:
+  - platform: template
+    name: Relay
+    id: relay
+    optimistic: true
+    on_turn_on:
+      - logger.log: "Relay ON"
+    on_turn_off:
+      - logger.log: "Relay OFF"
+
+button:
+  - platform: template
+    name: Publish big
+    on_press:
+      - mqtt.publish:
+          topic: ${name}/big
+          payload: !lambda |-
+            return std::string(3000, 'q');
+
+substitutions:
+  name: mqtt-dut
+
+esphome:
+  name: ${name}
+
+mqtt:
+  id: mq
+  broker: !secret broker_ip        # test.mosquitto.org for the bundle run
+  # No port: it must resolve to 1883 without TLS options and to 8883 with them. Spell it out only for the
+  # client-certificate listener (8884), wss (9002) and the public bundle broker (8886).
+  # The next two lines are the own-CA build. Remove both for the broker-only build (skip_cert_cn_check alone turns
+  # TLS on), replace both with verify_ssl: false for the unverified build (the flag is rejected next to it), or with
+  # tls: true for the bundle builds (public broker, and the local one as the negative).
+  skip_cert_cn_check: true         # with the local CA: the certificate names an address
+  certificate_authority: !secret mqtt_ca
+  # client_certificate: !secret mqtt_client_cert       # with the CA, port 8884
+  # client_certificate_key: !secret mqtt_client_key
+  # transport: wss                                     # with the CA, port 9002
+  reboot_timeout: 0s
+  discovery: false
+  on_message:
+    - topic: ${name}/cmd
+      then:
+        - logger.log:
+            format: "cmd payload: %s"
+            args: ["x.c_str()"]
+  on_connect:
+    - logger.log: "MQTT on_connect"
+  on_disconnect:
+    - logger.log: "MQTT on_disconnect"

.agents/skills/hardware-test/templates/udp-write-dut.yaml

@@ -0,0 +1,93 @@
+# udp.write payload shapes (#21263): every shape the action takes behind a template button, plus an on_receive that
+# replies with the received bytes reversed through a lambda. Per run file: substitutions name and listener_ip (the test
+# host that runs scripts/udp/udp_listen.py), then packages: common: !include this file. Drive it with
+# scripts/udp/write_cases.sh DEVICE_IP KEY, which presses the buttons, sends the echo datagram and checks every payload.
+esp8266:
+  board: d1_mini
+
+logger:
+  level: VERBOSE
+  logs:
+    wifi: DEBUG
+    api: DEBUG
+    api.connection: DEBUG
+    scheduler: DEBUG
+    component: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  power_save_mode: none
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+interval:
+  - interval: 10s
+    then:
+      - lambda: |-
+          ESP_LOGI("probe", "free heap %u, max block %u", (unsigned) ESP.getFreeHeap(), (unsigned) ESP.getMaxFreeBlockSize());
+
+esphome:
+  name: ${name}
+
+udp:
+  id: u
+  addresses:
+    - ${listener_ip}
+  on_receive:
+    - lambda: ESP_LOGI("echo", "received %u bytes", (unsigned) data.size());
+    - udp.write: !lambda |-
+        std::vector<uint8_t> v(data.rbegin(), data.rend());
+        return v;
+
+button:
+  - platform: template
+    name: Small
+    on_press:
+      - logger.log: "case small"
+      - udp.write: [0xAA, 0x55, 0x01, 0x02]
+      - udp.write: [0xAA, 0x55, 0x01, 0x02]
+  - platform: template
+    name: Simple
+    on_press:
+      - logger.log: "case simple"
+      - udp.write: [1, 2, 3]
+  - platform: template
+    name: Text
+    on_press:
+      - logger.log: "case text"
+      - udp.write: "hello udp"
+  - platform: template
+    name: Empty
+    on_press:
+      - logger.log: "case empty"
+      - udp.write: []
+  - platform: template
+    name: Stack128
+    on_press:
+      - logger.log: "case stack128"
+      - udp.write: [0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8E, 0x8F]
+  - platform: template
+    name: Heap129
+    on_press:
+      - logger.log: "case heap129"
+      - udp.write: [0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8E, 0x8F, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9A, 0x9B, 0x9C, 0x9D, 0x9E, 0x9F, 0xA0]
+  - platform: template
+    name: Heap600
+    on_press:
+      - logger.log: "case heap600"
+      - udp.write: [0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8E, 0x8F, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9A, 0x9B, 0x9C, 0x9D, 0x9E, 0x9F, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5, 0xA6, 0xA7, 0xA8, 0xA9, 0xAA, 0xAB, 0xAC, 0xAD, 0xAE, 0xAF, 0xB0, 0xB1, 0xB2, 0xB3, 0xB4, 0xB5, 0xB6, 0xB7, 0xB8, 0xB9, 0xBA, 0xBB, 0xBC, 0xBD, 0xBE, 0xBF, 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF, 0xD0, 0xD1, 0xD2, 0xD3, 0xD4, 0xD5, 0xD6, 0xD7, 0xD8, 0xD9, 0xDA, 0xDB, 0xDC, 0xDD, 0xDE, 0xDF, 0xE0, 0xE1, 0xE2, 0xE3, 0xE4, 0xE5, 0xE6, 0xE7, 0xE8, 0xE9, 0xEA, 0xEB, 0xEC, 0xED, 0xEE, 0xEF, 0xF0, 0xF1, 0xF2, 0xF3, 0xF4, 0xF5, 0xF6, 0xF7, 0xF8, 0xF9, 0xFA, 0xFB, 0xFC, 0xFD, 0xFE, 0xFF, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8E, 0x8F, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9A, 0x9B, 0x9C, 0x9D, 0x9E, 0x9F, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5, 0xA6, 0xA7, 0xA8, 0xA9, 0xAA, 0xAB, 0xAC, 0xAD, 0xAE, 0xAF, 0xB0, 0xB1, 0xB2, 0xB3, 0xB4, 0xB5, 0xB6, 0xB7, 0xB8, 0xB9, 0xBA, 0xBB, 0xBC, 0xBD, 0xBE, 0xBF, 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF, 0xD0, 0xD1, 0xD2, 0xD3, 0xD4, 0xD5, 0xD6, 0xD7, 0xD8, 0xD9, 0xDA, 0xDB, 0xDC, 0xDD, 0xDE, 0xDF, 0xE0, 0xE1, 0xE2, 0xE3, 0xE4, 0xE5, 0xE6, 0xE7, 0xE8, 0xE9, 0xEA, 0xEB, 0xEC, 0xED, 0xEE, 0xEF, 0xF0, 0xF1, 0xF2, 0xF3, 0xF4, 0xF5, 0xF6, 0xF7, 0xF8, 0xF9, 0xFA, 0xFB, 0xFC, 0xFD, 0xFE, 0xFF, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87]
+  - platform: template
+    name: Lambda300
+    on_press:
+      - logger.log: "case lambda300"
+      - udp.write: !lambda |-
+          std::vector<uint8_t> v(300);
+          for (size_t i = 0; i < v.size(); i++) v[i] = (uint8_t) (i * 7);
+          return v;

.clang-tidy

@@ -12,6 +12,7 @@ Checks: >-
   -bugprone-multi-level-implicit-pointer-conversion,
   -bugprone-narrowing-conversions,
   -bugprone-tagged-union-member-count,
+  -bugprone-signed-bitwise,
   -bugprone-signed-char-misuse,
   -bugprone-switch-missing-default-case,
   -cert-dcl50-cpp,
@@ -39,6 +40,7 @@ Checks: >-
   -cppcoreguidelines-avoid-const-or-ref-data-members,
   -cppcoreguidelines-avoid-do-while,
   -cppcoreguidelines-avoid-magic-numbers,
+  -cppcoreguidelines-explicit-constructor,
   -cppcoreguidelines-init-variables,
   -cppcoreguidelines-macro-to-enum,
   -cppcoreguidelines-macro-usage,
@@ -84,6 +86,7 @@ Checks: >-
   -llvm-use-ranges,
   -llvmlibc-*,
   -misc-const-correctness,
+  -misc-explicit-constructor,
   -misc-include-cleaner,
   -misc-multiple-inheritance,
   -misc-no-recursion,
@@ -113,6 +116,7 @@ Checks: >-
   -objc-*,
   -performance-enum-size,
   -portability-avoid-pragma-once,
+  -portability-no-assembler,
   -portability-template-virtual-member-function,
   -readability-ambiguous-smartptr-reset-call,
   -readability-avoid-nested-conditional-operator,
@@ -129,9 +133,13 @@ Checks: >-
   -readability-named-parameter,
   -readability-redundant-casting,
   -readability-redundant-inline-specifier,
+  -readability-redundant-lambda-parameter-list,
   -readability-redundant-member-init,
+  -readability-redundant-nested-if,
   -readability-redundant-parentheses,
   -readability-redundant-typename,
+  -readability-trailing-comma,
+  -readability-trivial-switch,
   -readability-uppercase-literal-suffix,
   -readability-use-anyofallof,
   -readability-use-std-min-max,

.github/scripts/auto-label-pr/constants.js

@@ -21,6 +21,7 @@ module.exports = {
     'github-actions',
     'by-code-owner',
     'has-tests',
+    'api.proto',
     'needs-tests',
     'needs-docs',
     'needs-developer-docs',

.github/scripts/auto-label-pr/detectors.js

@@ -272,6 +272,18 @@ async function detectTests(changedFiles) {
   return labels;
 }
 
+// Strategy: API protocol change detection
+// aioesphomeapi carries copies of both files, so every change here needs a sync there
+const API_PROTO_FILES = ['esphome/components/api/api.proto', 'esphome/components/api/api_options.proto'];
+
+async function detectApiProto(changedFiles) {
+  const labels = new Set();
+  if (changedFiles.some(file => API_PROTO_FILES.includes(file))) {
+    labels.add('api.proto');
+  }
+  return labels;
+}
+
 // Strategy: PR Template Checkbox detection
 async function detectPRTemplateCheckboxes(context) {
   const labels = new Set();
@@ -460,6 +472,7 @@ module.exports = {
   detectGitHubActionsChanges,
   detectCodeOwner,
   detectTests,
+  detectApiProto,
   detectPRTemplateCheckboxes,
   detectDeprecatedComponents,
   detectMaintainerAccess,

.github/scripts/auto-label-pr/index.js

@@ -10,6 +10,7 @@ const {
   detectGitHubActionsChanges,
   detectCodeOwner,
   detectTests,
+  detectApiProto,
   detectPRTemplateCheckboxes,
   detectDeprecatedComponents,
   detectMaintainerAccess,
@@ -114,6 +115,7 @@ module.exports = async ({ github, context }) => {
     actionsLabels,
     codeOwnerLabels,
     testLabels,
+    apiProtoLabels,
     checkboxLabels,
     deprecatedResult,
     maintainerAccess
@@ -128,6 +130,7 @@ module.exports = async ({ github, context }) => {
     detectGitHubActionsChanges(changedFiles),
     detectCodeOwner(github, context, changedFiles),
     detectTests(changedFiles),
+    detectApiProto(changedFiles),
     detectPRTemplateCheckboxes(context),
     detectDeprecatedComponents(github, context, changedFiles),
     detectMaintainerAccess(context)
@@ -156,6 +159,7 @@ module.exports = async ({ github, context }) => {
     ...actionsLabels,
     ...codeOwnerLabels,
     ...testLabels,
+    ...apiProtoLabels,
     ...checkboxLabels,
     ...deprecatedLabels
   ]);

.github/scripts/auto-label-pr/tests/detectors.test.js

@@ -1,6 +1,7 @@
 const { describe, it } = require('node:test');
 const assert = require('node:assert/strict');
 const {
+  detectApiProto,
   detectMergeBranch,
   detectNewPlatforms,
   detectNewComponents,
@@ -375,6 +376,27 @@ describe('detectRequirements', () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// detectApiProto
+// ---------------------------------------------------------------------------
+
+describe('detectApiProto', () => {
+  it('labels a PR that changes api.proto', async () => {
+    const labels = await detectApiProto(['esphome/components/api/api.proto', 'esphome/components/api/api_pb2.cpp']);
+    assert.deepEqual(Array.from(labels), ['api.proto']);
+  });
+
+  it('labels a PR that changes only api_options.proto', async () => {
+    const labels = await detectApiProto(['esphome/components/api/api_options.proto']);
+    assert.deepEqual(Array.from(labels), ['api.proto']);
+  });
+
+  it('ignores the generated protocol files and other components', async () => {
+    const labels = await detectApiProto(['esphome/components/api/api_pb2.cpp', 'esphome/components/uart/api.proto']);
+    assert.equal(labels.size, 0);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // MANAGED_LABELS
 // ---------------------------------------------------------------------------
@@ -387,6 +409,10 @@ describe('MANAGED_LABELS', () => {
   it('includes needs-developer-docs so the workflow syncs it', () => {
     assert.ok(MANAGED_LABELS.includes('needs-developer-docs'));
   });
+
+  it('includes api.proto so the workflow removes it when the file drops out of the diff', () => {
+    assert.ok(MANAGED_LABELS.includes('api.proto'));
+  });
 });
 
 // ---------------------------------------------------------------------------

.pre-commit-config.yaml

@@ -38,7 +38,7 @@ repos:
       - id: yamllint
         exclude: ^(\.clang-format|\.clang-tidy)$
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: v22.1.8
+    rev: v23.1.3
     hooks:
       - id: clang-format
         types_or: [c, c++]

CODEOWNERS

@@ -700,6 +700,7 @@ esphome/components/veml7700/* @latonita
 esphome/components/version/* @esphome/core
 esphome/components/vevor_dtx/* @Bofr5555
 esphome/components/vl53l1x/* @will-tm
+esphome/components/vnc/* @MindFreeze
 esphome/components/voice_assistant/* @jesserockz @kahrendt
 esphome/components/wake_on_lan/* @clydebarrow @willwill2will54
 esphome/components/watchdog/* @oarcher

esphome/components/adc/adc_sensor_zephyr.cpp

@@ -111,6 +111,8 @@ static const LogString *input_to_str(uint8_t input) {
       return LOG_STR("VDD");
     case NRF_SAADC_INPUT_VDDHDIV5:
       return LOG_STR("VDDHDIV5");
+    default:
+      break;
   }
   return LOG_STR("undefined input");
 }

esphome/components/airton/airton.cpp

@@ -261,6 +261,8 @@ void AirtonClimate::parse_state_frame_(const uint8_t *frame) {
     case AIRTON_FAN_AUTO:
       this->fan_mode = climate::CLIMATE_FAN_AUTO;
       break;
+    default:
+      break;
   }
 
   this->target_temperature = (frame[3] & 0b00001111) + AIRTON_TEMP_MIN;

esphome/components/api/api.proto

@@ -607,6 +607,8 @@ message ListEntitiesCoverResponse {
   EntityCategory entity_category = 11;
   bool supports_stop = 12;
   uint32 device_id = 13 [(field_ifdef) = "USE_DEVICES"];
+  bool supports_stop_tilt = 14;
+  bool supports_toggle = 15;
 }
 
 // Deprecated in API version 1.1
@@ -668,6 +670,8 @@ message CoverCommandRequest {
   float tilt = 7;
   bool stop = 8;
   uint32 device_id = 9 [(field_ifdef) = "USE_DEVICES"];
+  bool stop_tilt = 10;
+  bool toggle = 11;
 }
 
 // ==================== FAN ====================
@@ -1781,6 +1785,8 @@ message MediaPlayerSupportedFormat {
   uint32 num_channels = 3;
   MediaPlayerFormatPurpose purpose = 4;
   uint32 sample_bytes = 5;
+  // Constant bitrate in kbps for lossy formats; 0 means no preference
+  uint32 bitrate = 6;
 }
 message ListEntitiesMediaPlayerResponse {
   option (id) = 63;

esphome/components/api/api_connection.cpp

@@ -554,6 +554,8 @@ uint16_t APIConnection::try_send_cover_info(EntityBase *entity, APIConnection *c
   msg.supports_position = traits.get_supports_position();
   msg.supports_tilt = traits.get_supports_tilt();
   msg.supports_stop = traits.get_supports_stop();
+  msg.supports_stop_tilt = traits.get_supports_stop_tilt();
+  msg.supports_toggle = traits.get_supports_toggle();
   return fill_and_encode_entity_info_with_device_class(cover, msg, msg.device_class, conn, remaining_size);
 }
 void APIConnection::on_cover_command_request(const CoverCommandRequest &msg) {
@@ -564,6 +566,10 @@ void APIConnection::on_cover_command_request(const CoverCommandRequest &msg) {
     call.set_tilt(msg.tilt);
   if (msg.stop)
     call.set_command_stop();
+  if (msg.stop_tilt)
+    call.set_command_stop_tilt();
+  if (msg.toggle)
+    call.set_command_toggle();
   call.perform();
 }
 #endif
@@ -1125,6 +1131,7 @@ uint16_t APIConnection::try_send_media_player_info(EntityBase *entity, APIConnec
     media_format.num_channels = supported_format.num_channels;
     media_format.purpose = static_cast<enums::MediaPlayerFormatPurpose>(supported_format.purpose);
     media_format.sample_bytes = supported_format.sample_bytes;
+    media_format.bitrate = supported_format.bitrate;
   }
   return fill_and_encode_entity_info(media_player, msg, conn, remaining_size);
 }

esphome/components/api/api_pb2.cpp

@@ -25,6 +25,8 @@ void HelloRequest::decode_field(void *self, uint32_t tag, const uint8_t *data, p
       msg.outgoing_connection_target = value.as_bool();
       break;
 #endif
+    default:
+      break;
   }
 }
 uint8_t *HelloResponse::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -51,6 +53,8 @@ void DisconnectRequest::decode_field(void *self, uint32_t tag, const uint8_t *da
     case proto_tag(1, WIRE_TYPE_VARINT):
       msg.reason = static_cast<enums::DisconnectReason>(value.as_varint());
       break;
+    default:
+      break;
   }
 }
 uint8_t *DisconnectRequest::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -396,6 +400,8 @@ void WizardInputSetRequest::decode_field(void *self, uint32_t tag, const uint8_t
     case proto_tag(2, WIRE_TYPE_LENGTH_DELIMITED):
       msg.entity_id = StringRef(value.data(), value.size());
       break;
+    default:
+      break;
   }
 }
 #endif
@@ -477,6 +483,8 @@ uint8_t *ListEntitiesCoverResponse::encode_msg(const void *self, uint8_t *__rest
 #ifdef USE_DEVICES
   pos = ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 13, msg.device_id);
 #endif
+  pos = ProtoEncode::encode_bool(pos PROTO_ENCODE_DEBUG_ARG, 14, msg.supports_stop_tilt);
+  pos = ProtoEncode::encode_bool(pos PROTO_ENCODE_DEBUG_ARG, 15, msg.supports_toggle);
   return pos;
 }
 uint32_t ListEntitiesCoverResponse::calc_size_msg(const void *self) {
@@ -498,6 +506,8 @@ uint32_t ListEntitiesCoverResponse::calc_size_msg(const void *self) {
 #ifdef USE_DEVICES
   size += ProtoSize::calc_uint32(1, msg.device_id);
 #endif
+  size += ProtoSize::calc_bool(1, msg.supports_stop_tilt);
+  size += ProtoSize::calc_bool(1, msg.supports_toggle);
   return size;
 }
 uint8_t *CoverStateResponse::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -554,6 +564,14 @@ void CoverCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *
       msg.device_id = value.as_varint();
       break;
 #endif
+    case proto_tag(10, WIRE_TYPE_VARINT):
+      msg.stop_tilt = value.as_bool();
+      break;
+    case proto_tag(11, WIRE_TYPE_VARINT):
+      msg.toggle = value.as_bool();
+      break;
+    default:
+      break;
   }
 }
 #endif
@@ -674,6 +692,8 @@ void FanCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *da
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -880,6 +900,8 @@ void LightCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -1023,6 +1045,8 @@ void SwitchCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -1093,6 +1117,8 @@ void SubscribeLogsRequest::decode_field(void *self, uint32_t tag, const uint8_t
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.dump_config = value.as_bool();
       break;
+    default:
+      break;
   }
 }
 __attribute__((optimize("O2")))  // NOLINT(clang-diagnostic-unknown-attributes)
@@ -1122,6 +1148,8 @@ void NoiseEncryptionSetKeyRequest::decode_field(void *self, uint32_t tag, const
       msg.key = value.data();
       msg.key_len = value.size();
       break;
+    default:
+      break;
   }
 }
 uint8_t *NoiseEncryptionSetKeyResponse::encode_msg(const void *self,
@@ -1228,6 +1256,8 @@ void HomeassistantActionResponse::decode_field(void *self, uint32_t tag, const u
       msg.response_data_len = value.size();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -1262,6 +1292,8 @@ void HomeAssistantStateResponse::decode_field(void *self, uint32_t tag, const ui
     case proto_tag(3, WIRE_TYPE_LENGTH_DELIMITED):
       msg.attribute = StringRef(value.data(), value.size());
       break;
+    default:
+      break;
   }
 }
 #endif
@@ -1287,6 +1319,8 @@ void DSTRule::decode_field(void *self, uint32_t tag, const uint8_t *data, proto_
     case proto_tag(6, WIRE_TYPE_VARINT):
       msg.day_of_week = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 void ParsedTimezone::decode_field(void *self, uint32_t tag, const uint8_t *data, proto_varint_value_t scalar) {
@@ -1305,6 +1339,8 @@ void ParsedTimezone::decode_field(void *self, uint32_t tag, const uint8_t *data,
     case proto_tag(4, WIRE_TYPE_LENGTH_DELIMITED):
       value.decode_to_message(msg.dst_end);
       break;
+    default:
+      break;
   }
 }
 void GetTimeResponse::decode_field(void *self, uint32_t tag, const uint8_t *data, proto_varint_value_t scalar) {
@@ -1318,6 +1354,8 @@ void GetTimeResponse::decode_field(void *self, uint32_t tag, const uint8_t *data
       value.decode_to_message(msg.parsed_timezone);
       msg.has_parsed_timezone = true;
       break;
+    default:
+      break;
   }
 }
 #ifdef USE_API_USER_DEFINED_ACTIONS
@@ -1408,6 +1446,8 @@ void ExecuteServiceArgument::decode_field(void *self, uint32_t tag, const uint8_
     case proto_tag(9, WIRE_TYPE_LENGTH_DELIMITED):
       msg.string_array.push_back(value.as_string());
       break;
+    default:
+      break;
   }
 }
 void ExecuteServiceArgument::decode(const uint8_t *buffer, size_t length) {
@@ -1442,6 +1482,8 @@ void ExecuteServiceRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.return_response = value.as_bool();
       break;
 #endif
+    default:
+      break;
   }
 }
 void ExecuteServiceRequest::decode(const uint8_t *buffer, size_t length) {
@@ -1536,6 +1578,8 @@ void CameraImageRequest::decode_field(void *self, uint32_t tag, const uint8_t *d
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.stream = value.as_bool();
       break;
+    default:
+      break;
   }
 }
 #endif
@@ -1772,6 +1816,8 @@ void ClimateCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -1900,6 +1946,8 @@ void WaterHeaterCommandRequest::decode_field(void *self, uint32_t tag, const uin
     case proto_tag(8, WIRE_TYPE_FIXED32):
       msg.target_temperature_high = value.as_float();
       break;
+    default:
+      break;
   }
 }
 #endif
@@ -1991,6 +2039,8 @@ void NumberCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -2070,6 +2120,8 @@ void SelectCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -2172,6 +2224,8 @@ void SirenCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -2255,6 +2309,8 @@ void LockCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *d
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -2304,6 +2360,8 @@ void ButtonCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -2315,6 +2373,7 @@ uint8_t *MediaPlayerSupportedFormat::encode_msg(const void *self, uint8_t *__res
   pos = ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 3, msg.num_channels);
   pos = ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 4, static_cast<uint32_t>(msg.purpose));
   pos = ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 5, msg.sample_bytes);
+  pos = ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 6, msg.bitrate);
   return pos;
 }
 uint32_t MediaPlayerSupportedFormat::calc_size_msg(const void *self) {
@@ -2325,6 +2384,7 @@ uint32_t MediaPlayerSupportedFormat::calc_size_msg(const void *self) {
   size += ProtoSize::calc_uint32(1, msg.num_channels);
   size += msg.purpose ? 2 : 0;
   size += ProtoSize::calc_uint32(1, msg.sample_bytes);
+  size += ProtoSize::calc_uint32(1, msg.bitrate);
   return size;
 }
 uint8_t *ListEntitiesMediaPlayerResponse::encode_msg(const void *self,
@@ -2431,6 +2491,8 @@ void MediaPlayerCommandRequest::decode_field(void *self, uint32_t tag, const uin
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -2443,6 +2505,8 @@ void SubscribeBluetoothLEAdvertisementsRequest::decode_field(void *self, uint32_
     case proto_tag(1, WIRE_TYPE_VARINT):
       msg.flags = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 __attribute__((optimize("O2")))  // NOLINT(clang-diagnostic-unknown-attributes)
@@ -2501,6 +2565,8 @@ void BluetoothDeviceRequest::decode_field(void *self, uint32_t tag, const uint8_
     case proto_tag(4, WIRE_TYPE_VARINT):
       msg.address_type = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 uint8_t *BluetoothDeviceConnectionResponse::encode_msg(const void *self,
@@ -2529,6 +2595,8 @@ void BluetoothGATTGetServicesRequest::decode_field(void *self, uint32_t tag, con
     case proto_tag(1, WIRE_TYPE_VARINT):
       msg.address = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 uint8_t *BluetoothGATTDescriptor::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -2655,6 +2723,8 @@ void BluetoothGATTReadRequest::decode_field(void *self, uint32_t tag, const uint
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.handle = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 uint8_t *BluetoothGATTReadResponse::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -2690,6 +2760,8 @@ void BluetoothGATTWriteRequest::decode_field(void *self, uint32_t tag, const uin
       msg.data = value.data();
       msg.data_len = value.size();
       break;
+    default:
+      break;
   }
 }
 void BluetoothGATTReadDescriptorRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -2703,6 +2775,8 @@ void BluetoothGATTReadDescriptorRequest::decode_field(void *self, uint32_t tag,
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.handle = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 void BluetoothGATTWriteDescriptorRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -2720,6 +2794,8 @@ void BluetoothGATTWriteDescriptorRequest::decode_field(void *self, uint32_t tag,
       msg.data = value.data();
       msg.data_len = value.size();
       break;
+    default:
+      break;
   }
 }
 void BluetoothGATTNotifyRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -2736,6 +2812,8 @@ void BluetoothGATTNotifyRequest::decode_field(void *self, uint32_t tag, const ui
     case proto_tag(3, WIRE_TYPE_VARINT):
       msg.enable = value.as_bool();
       break;
+    default:
+      break;
   }
 }
 uint8_t *BluetoothGATTNotifyDataResponse::encode_msg(const void *self,
@@ -2893,6 +2971,8 @@ void BluetoothScannerSetModeRequest::decode_field(void *self, uint32_t tag, cons
     case proto_tag(1, WIRE_TYPE_VARINT):
       msg.mode = static_cast<enums::BluetoothScannerMode>(value.as_varint());
       break;
+    default:
+      break;
   }
 }
 #endif
@@ -2908,6 +2988,8 @@ void SubscribeVoiceAssistantRequest::decode_field(void *self, uint32_t tag, cons
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.flags = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 uint8_t *VoiceAssistantAudioSettings::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -2956,6 +3038,8 @@ void VoiceAssistantResponse::decode_field(void *self, uint32_t tag, const uint8_
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.error = value.as_bool();
       break;
+    default:
+      break;
   }
 }
 void VoiceAssistantEventData::decode_field(void *self, uint32_t tag, const uint8_t *data, proto_varint_value_t scalar) {
@@ -2968,6 +3052,8 @@ void VoiceAssistantEventData::decode_field(void *self, uint32_t tag, const uint8
     case proto_tag(2, WIRE_TYPE_LENGTH_DELIMITED):
       msg.value = StringRef(value.data(), value.size());
       break;
+    default:
+      break;
   }
 }
 void VoiceAssistantEventResponse::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -2982,6 +3068,8 @@ void VoiceAssistantEventResponse::decode_field(void *self, uint32_t tag, const u
       msg.data.emplace_back();
       value.decode_to_message(msg.data.back());
       break;
+    default:
+      break;
   }
 }
 void VoiceAssistantAudio::decode_field(void *self, uint32_t tag, const uint8_t *data, proto_varint_value_t scalar) {
@@ -2999,6 +3087,8 @@ void VoiceAssistantAudio::decode_field(void *self, uint32_t tag, const uint8_t *
       msg.data2 = value.data();
       msg.data2_len = value.size();
       break;
+    default:
+      break;
   }
 }
 uint8_t *VoiceAssistantAudio::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -3039,6 +3129,8 @@ void VoiceAssistantTimerEventResponse::decode_field(void *self, uint32_t tag, co
     case proto_tag(6, WIRE_TYPE_VARINT):
       msg.is_active = value.as_bool();
       break;
+    default:
+      break;
   }
 }
 void VoiceAssistantAnnounceRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -3058,6 +3150,8 @@ void VoiceAssistantAnnounceRequest::decode_field(void *self, uint32_t tag, const
     case proto_tag(4, WIRE_TYPE_VARINT):
       msg.start_conversation = value.as_bool();
       break;
+    default:
+      break;
   }
 }
 uint8_t *VoiceAssistantAnnounceFinished::encode_msg(const void *self,
@@ -3119,6 +3213,8 @@ void VoiceAssistantExternalWakeWord::decode_field(void *self, uint32_t tag, cons
     case proto_tag(7, WIRE_TYPE_LENGTH_DELIMITED):
       msg.url = StringRef(value.data(), value.size());
       break;
+    default:
+      break;
   }
 }
 void VoiceAssistantConfigurationRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -3130,6 +3226,8 @@ void VoiceAssistantConfigurationRequest::decode_field(void *self, uint32_t tag,
       msg.external_wake_words.emplace_back();
       value.decode_to_message(msg.external_wake_words.back());
       break;
+    default:
+      break;
   }
 }
 uint8_t *VoiceAssistantConfigurationResponse::encode_msg(const void *self,
@@ -3168,6 +3266,8 @@ void VoiceAssistantSetConfiguration::decode_field(void *self, uint32_t tag, cons
     case proto_tag(1, WIRE_TYPE_LENGTH_DELIMITED):
       msg.active_wake_words.push_back(value.as_string());
       break;
+    default:
+      break;
   }
 }
 #endif
@@ -3249,6 +3349,8 @@ void AlarmControlPanelCommandRequest::decode_field(void *self, uint32_t tag, con
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3328,6 +3430,8 @@ void TextCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *d
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3409,6 +3513,8 @@ void DateCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *d
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3490,6 +3596,8 @@ void TimeCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *d
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3639,6 +3747,8 @@ void ValveCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3713,6 +3823,8 @@ void DateTimeCommandRequest::decode_field(void *self, uint32_t tag, const uint8_
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3802,6 +3914,8 @@ void UpdateCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3814,6 +3928,8 @@ void ZWaveProxyFrame::decode_field(void *self, uint32_t tag, const uint8_t *data
       msg.data = value.data();
       msg.data_len = value.size();
       break;
+    default:
+      break;
   }
 }
 __attribute__((optimize("O2")))  // NOLINT(clang-diagnostic-unknown-attributes)
@@ -3840,6 +3956,8 @@ void ZWaveProxyRequest::decode_field(void *self, uint32_t tag, const uint8_t *da
       msg.data = value.data();
       msg.data_len = value.size();
       break;
+    default:
+      break;
   }
 }
 uint8_t *ZWaveProxyRequest::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -3935,6 +4053,8 @@ void InfraredRFTransmitRawTimingsRequest::decode_field(void *self, uint32_t tag,
     case proto_tag(6, WIRE_TYPE_VARINT):
       msg.modulation = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 __attribute__((optimize("O2")))  // NOLINT(clang-diagnostic-unknown-attributes)
@@ -4051,6 +4171,8 @@ void SerialProxyConfigureRequest::decode_field(void *self, uint32_t tag, const u
     case proto_tag(6, WIRE_TYPE_VARINT):
       msg.data_size = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 __attribute__((optimize("O2")))  // NOLINT(clang-diagnostic-unknown-attributes)
@@ -4079,6 +4201,8 @@ void SerialProxyWriteRequest::decode_field(void *self, uint32_t tag, const uint8
       msg.data = value.data();
       msg.data_len = value.size();
       break;
+    default:
+      break;
   }
 }
 void SerialProxySetModemPinsRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -4092,6 +4216,8 @@ void SerialProxySetModemPinsRequest::decode_field(void *self, uint32_t tag, cons
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.line_states = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 void SerialProxyGetModemPinsRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -4102,6 +4228,8 @@ void SerialProxyGetModemPinsRequest::decode_field(void *self, uint32_t tag, cons
     case proto_tag(1, WIRE_TYPE_VARINT):
       msg.instance = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 uint8_t *SerialProxyGetModemPinsResponse::encode_msg(const void *self,
@@ -4130,6 +4258,8 @@ void SerialProxyRequest::decode_field(void *self, uint32_t tag, const uint8_t *d
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.type = static_cast<enums::SerialProxyRequestType>(value.as_varint());
       break;
+    default:
+      break;
   }
 }
 uint8_t *SerialProxyRequestResponse::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -4160,6 +4290,8 @@ void SerialProxySetModeRequest::decode_field(void *self, uint32_t tag, const uin
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.mode = static_cast<enums::SerialProxyMode>(value.as_varint());
       break;
+    default:
+      break;
   }
 }
 uint8_t *UsbDeviceDescriptor::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -4228,6 +4360,8 @@ void BluetoothSetConnectionParamsRequest::decode_field(void *self, uint32_t tag,
     case proto_tag(5, WIRE_TYPE_VARINT):
       msg.timeout = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 uint8_t *BluetoothSetConnectionParamsResponse::encode_msg(const void *self,

esphome/components/api/api_pb2.h

@@ -911,7 +911,7 @@ class BinarySensorStateResponse final : public StateResponseProtoMessage {
 class ListEntitiesCoverResponse final : public InfoResponseProtoMessage {
  public:
   static constexpr uint16_t MESSAGE_TYPE = 13;
-  static constexpr uint8_t ESTIMATED_SIZE = 57;
+  static constexpr uint8_t ESTIMATED_SIZE = 61;
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const LogString *message_name() const override { return LOG_STR("list_entities_cover_response"); }
 #endif
@@ -920,6 +920,8 @@ class ListEntitiesCoverResponse final : public InfoResponseProtoMessage {
   bool supports_tilt{false};
   ProgmemStringRef device_class{};
   bool supports_stop{false};
+  bool supports_stop_tilt{false};
+  bool supports_toggle{false};
   static uint8_t *encode_msg(const void *self, uint8_t *pos PROTO_ENCODE_DEBUG_PARAM);
   uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
     return encode_msg(this, buffer.get_pos() PROTO_ENCODE_DEBUG_ARG);
@@ -957,7 +959,7 @@ class CoverStateResponse final : public StateResponseProtoMessage {
 class CoverCommandRequest final : public CommandProtoMessage {
  public:
   static constexpr uint16_t MESSAGE_TYPE = 30;
-  static constexpr uint8_t ESTIMATED_SIZE = 25;
+  static constexpr uint8_t ESTIMATED_SIZE = 29;
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const LogString *message_name() const override { return LOG_STR("cover_command_request"); }
 #endif
@@ -966,6 +968,8 @@ class CoverCommandRequest final : public CommandProtoMessage {
   bool has_tilt{false};
   float tilt{0.0f};
   bool stop{false};
+  bool stop_tilt{false};
+  bool toggle{false};
   void decode(const uint8_t *buffer, size_t length) {
     ProtoDecodableMessage::decode_fields(this, buffer, length, &decode_field);
   }
@@ -2259,6 +2263,7 @@ class MediaPlayerSupportedFormat final : public ProtoMessage {
   uint32_t num_channels{0};
   enums::MediaPlayerFormatPurpose purpose{};
   uint32_t sample_bytes{0};
+  uint32_t bitrate{0};
   static uint8_t *encode_msg(const void *self, uint8_t *pos PROTO_ENCODE_DEBUG_PARAM);
   uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
     return encode_msg(this, buffer.get_pos() PROTO_ENCODE_DEBUG_ARG);

esphome/components/api/api_pb2_dump.cpp

@@ -1245,6 +1245,8 @@ const char *ListEntitiesCoverResponse::dump_to(DumpBuffer &out) const {
 #ifdef USE_DEVICES
   dump_field(out, ESPHOME_PSTR("device_id"), this->device_id);
 #endif
+  dump_field(out, ESPHOME_PSTR("supports_stop_tilt"), this->supports_stop_tilt);
+  dump_field(out, ESPHOME_PSTR("supports_toggle"), this->supports_toggle);
   return out.c_str();
 }
 const char *CoverStateResponse::dump_to(DumpBuffer &out) const {
@@ -1269,6 +1271,8 @@ const char *CoverCommandRequest::dump_to(DumpBuffer &out) const {
 #ifdef USE_DEVICES
   dump_field(out, ESPHOME_PSTR("device_id"), this->device_id);
 #endif
+  dump_field(out, ESPHOME_PSTR("stop_tilt"), this->stop_tilt);
+  dump_field(out, ESPHOME_PSTR("toggle"), this->toggle);
   return out.c_str();
 }
 #endif
@@ -2095,6 +2099,7 @@ const char *MediaPlayerSupportedFormat::dump_to(DumpBuffer &out) const {
   dump_field(out, ESPHOME_PSTR("num_channels"), this->num_channels);
   dump_field(out, ESPHOME_PSTR("purpose"), static_cast<enums::MediaPlayerFormatPurpose>(this->purpose));
   dump_field(out, ESPHOME_PSTR("sample_bytes"), this->sample_bytes);
+  dump_field(out, ESPHOME_PSTR("bitrate"), this->bitrate);
   return out.c_str();
 }
 const char *ListEntitiesMediaPlayerResponse::dump_to(DumpBuffer &out) const {

esphome/components/api/proto.h

@@ -301,7 +301,7 @@ constexpr uint32_t VARINT_MAX_1_BYTE = 1 << 7;   // 128
 constexpr uint32_t VARINT_MAX_2_BYTE = 1 << 14;  // 16384
 
 /// Generated encode body: writes the fields at pos, returns the cursor past them.
-using ProtoEncodeFn = uint8_t *(*) (const void *, uint8_t *PROTO_ENCODE_DEBUG_PARAM);
+using ProtoEncodeFn = uint8_t *(*)(const void *, uint8_t *PROTO_ENCODE_DEBUG_PARAM);
 
 /// Static encode helpers for the generated encode bodies. Each takes the write cursor by value and
 /// returns it advanced, so outlined calls at -Os chain through the return register instead of a

esphome/components/ballu/ballu.cpp

@@ -168,6 +168,8 @@ bool BalluClimate::on_receive(remote_base::RemoteReceiveData data) {
       case BALLU_AUTO:
         this->mode = climate::CLIMATE_MODE_AUTO;
         break;
+      default:
+        break;
     }
   }
 

esphome/components/bl0906/constants.h

@@ -111,10 +111,9 @@ static const uint8_t BL0906_USR_WRPROT = 0x9E;
 // Reset Register
 static const uint8_t BL0906_SOFT_RESET = 0x9F;
 
-const uint8_t BL0906_INIT[2][6] = {
-    // Reset to default
-    {BL0906_WRITE_COMMAND, BL0906_SOFT_RESET, 0x5A, 0x5A, 0x5A, 0x52},
-    // Enable User Operation Write
-    {BL0906_WRITE_COMMAND, BL0906_USR_WRPROT, 0x55, 0x55, 0x00, 0xB7}};
+const uint8_t BL0906_INIT[2][6] = {// Reset to default
+                                   {BL0906_WRITE_COMMAND, BL0906_SOFT_RESET, 0x5A, 0x5A, 0x5A, 0x52},
+                                   // Enable User Operation Write
+                                   {BL0906_WRITE_COMMAND, BL0906_USR_WRPROT, 0x55, 0x55, 0x00, 0xB7}};
 
 }  // namespace esphome::bl0906

esphome/components/bluetooth_connection/bluetooth_connection_bluedroid.cpp

@@ -268,6 +268,7 @@ int BluedroidGattClient::discover_services() {
     case SearchState::REPORT_PENDING:
       return 0;  // One completion is already owed to this claimant.
     case SearchState::NONE:
+    default:
       break;
   }
   int err = this->check_and_log_error_("esp_ble_gattc_search_service",

esphome/components/bluetooth_connection/bluetooth_connection_hub.h

@@ -22,8 +22,8 @@ class BluetoothProxy;
 
 namespace esphome::bluetooth_connection {
 
-using ClientState = ble_device_base::ClientState;
-using ConnectionType = ble_device_base::ConnectionType;
+using ble_device_base::ClientState;
+using ble_device_base::ConnectionType;
 
 /// A refused GATT reply owed to the current subscriber. Payload-free only:
 /// these rebuild from address + handle + error, so a retry costs no buffered

esphome/components/bluetooth_proxy/bluetooth_proxy.h

@@ -30,8 +30,8 @@ using bluetooth_connection::INIT_SENDING_SERVICES;
 using bluetooth_connection::SERVICES_DONE_PENDING;
 
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
-using BluetoothConnection = bluetooth_connection::BluetoothConnection;
-using ClientState = ble_device_base::ClientState;
+using bluetooth_connection::BluetoothConnection;
+using ble_device_base::ClientState;
 #endif
 
 // Legacy versions:

esphome/components/bmi160/bmi160.cpp

@@ -123,7 +123,7 @@ void BMI160Component::internal_setup_(int stage) {
 
 bool BMI160Component::setup_stage_(int stage) {
   switch (stage) {
-    case 0:
+    case 0: {
       uint8_t chipid;
       if (!this->read_byte(BMI160_REGISTER_CHIPID, &chipid) || (chipid != 0b11010001)) {
         return false;
@@ -138,7 +138,7 @@ bool BMI160Component::setup_stage_(int stage) {
       // min 5ms, 10ms
       this->set_timeout(10, [this]() { this->internal_setup_(1); });
       break;
-
+    }
     case 1:
       ESP_LOGV(TAG, "  Bringing gyroscope out of sleep");
       if (!this->write_byte(BMI160_REGISTER_CMD, (uint8_t) Cmd::GYRO_SET_PMU_MODE | (uint8_t) GyroPmuMode::NORMAL)) {
@@ -149,7 +149,7 @@ bool BMI160Component::setup_stage_(int stage) {
       this->set_timeout(GYRO_WAKEUP_TIMEOUT_MS, [this]() { this->internal_setup_(2); });
       break;
 
-    case 2:
+    case 2: {
       ESP_LOGV(TAG, "  Setting up Gyro Config");
       uint8_t gyro_config = (uint8_t) GyroBandwidth::OSR4 | (uint8_t) GyroOuputDataRate::HZ_25;
       ESP_LOGV(TAG, "  Output gyro_config: 0b" BYTE_TO_BINARY_PATTERN, BYTE_TO_BINARY(gyro_config));
@@ -178,6 +178,10 @@ bool BMI160Component::setup_stage_(int stage) {
       }
 
       this->setup_complete_ = true;
+      break;
+    }
+    default:
+      break;
   }
   return true;
 }

esphome/components/cc1101/cc1101.h

@@ -108,7 +108,7 @@ class CC1101Component final : public Component,
 
   // GDO pin for packet reception
   InternalGPIOPin *gdo0_pin_{nullptr};
-  static void IRAM_ATTR gpio_intr(CC1101Component *arg);
+  static void gpio_intr(CC1101Component *arg);
 
   // Packet handling
   void call_listeners_(const std::vector<uint8_t> &packet, float freq_offset, float rssi, uint8_t lqi);

esphome/components/const/__init__.py

@@ -60,6 +60,7 @@ CONF_ON_RECEIVE = "on_receive"
 CONF_ON_SCAN_END = "on_scan_end"
 CONF_ON_STATE_CHANGE = "on_state_change"
 CONF_ON_STOP = "on_stop"
+CONF_OUT_PIN = "out_pin"
 CONF_OUT_PIN_LEVEL = "out_pin_level"
 CONF_PARITY = "parity"
 CONF_PROVIDER = "provider"

esphome/components/copy/cover/copy_cover.cpp

@@ -31,12 +31,14 @@ cover::CoverTraits CopyCover::get_traits() {
   traits.set_supports_position(base.get_supports_position());
   traits.set_supports_tilt(base.get_supports_tilt());
   traits.set_supports_toggle(base.get_supports_toggle());
+  traits.set_supports_stop_tilt(base.get_supports_stop_tilt());
   return traits;
 }
 
 void CopyCover::control(const cover::CoverCall &call) {
   auto call2 = source_->make_call();
   call2.set_stop(call.get_stop());
+  call2.set_stop_tilt(call.get_stop_tilt());
   auto tilt = call.get_tilt();
   if (tilt.has_value())
     call2.set_tilt(*tilt);

esphome/components/cover/__init__.py

@@ -99,6 +99,7 @@ CONF_ON_CLOSED = "on_closed"
 CONF_ON_OPENED = "on_opened"
 CONF_ON_OPENING = "on_opening"
 CONF_ON_CLOSING = "on_closing"
+CONF_STOP_TILT = "stop_tilt"
 
 TRIGGERS = {
     CONF_ON_OPEN: CoverOpenedTrigger,  # Deprecated, use on_opened
@@ -248,6 +249,7 @@ for _name, _command in (
     ("cover.open", "set_command_open()"),
     ("cover.close", "set_command_close()"),
     ("cover.stop", "set_command_stop()"),
+    ("cover.stop_tilt", "set_command_stop_tilt()"),
     ("cover.toggle", "set_command_toggle()"),
 ):
     automation.register_apply_action(
@@ -259,6 +261,7 @@ COVER_CONTROL_ACTION_SCHEMA = cv.Schema(
     {
         cv.Required(CONF_ID): cv.use_id(Cover),
         cv.Optional(CONF_STOP): cv.templatable(cv.boolean),
+        cv.Optional(CONF_STOP_TILT): cv.templatable(cv.boolean),
         cv.Exclusive(CONF_STATE, "pos"): cv.templatable(validate_cover_state),
         cv.Exclusive(CONF_POSITION, "pos"): cv.templatable(cv.percentage),
         cv.Optional(CONF_TILT): cv.templatable(cv.percentage),
@@ -272,6 +275,7 @@ automation.register_apply_action(
     "cover.control",
     COVER_CONTROL_ACTION_SCHEMA,
     automation.ApplyField(CONF_STOP, "set_stop", cg.bool_),
+    automation.ApplyField(CONF_STOP_TILT, "set_stop_tilt", cg.bool_),
     automation.ApplyField(CONF_STATE, "set_position", cg.float_),
     automation.ApplyField(CONF_POSITION, "set_position", cg.float_),
     automation.ApplyField(CONF_TILT, "set_tilt", cg.float_),

esphome/components/cover/cover.cpp

@@ -55,6 +55,10 @@ CoverCall &CoverCall::set_command_stop() {
   this->stop_ = true;
   return *this;
 }
+CoverCall &CoverCall::set_command_stop_tilt() {
+  this->stop_tilt_ = true;
+  return *this;
+}
 CoverCall &CoverCall::set_command_toggle() {
   this->toggle_ = true;
   return *this;
@@ -74,6 +78,9 @@ void CoverCall::perform() {
   if (this->stop_) {
     ESP_LOGV(TAG, "  Command: STOP");
   }
+  if (this->stop_tilt_) {
+    ESP_LOGV(TAG, "  Command: STOP_TILT");
+  }
   if (this->position_.has_value()) {
     if (traits.get_supports_position()) {
       ESP_LOGV(TAG, "  Position: %.0f%%", *this->position_ * 100.0f);
@@ -122,6 +129,15 @@ void CoverCall::validate_() {
       this->toggle_.reset();
     }
   }
+  if (this->stop_tilt_) {
+    if (!traits.get_supports_stop_tilt()) {
+      ESP_LOGW(TAG, "'%s': stop tilt unsupported", name);
+      this->stop_tilt_ = false;
+    } else if (this->tilt_.has_value()) {
+      ESP_LOGW(TAG, "'%s': cannot tilt when stopping tilt", name);
+      this->tilt_.reset();
+    }
+  }
   if (this->stop_) {
     if (this->position_.has_value() || this->tilt_.has_value() || this->toggle_.has_value()) {
       ESP_LOGW(TAG, "'%s': cannot position/tilt/toggle when stopping", name);
@@ -135,6 +151,10 @@ CoverCall &CoverCall::set_stop(bool stop) {
   this->stop_ = stop;
   return *this;
 }
+CoverCall &CoverCall::set_stop_tilt(bool stop_tilt) {
+  this->stop_tilt_ = stop_tilt;
+  return *this;
+}
 void Cover::publish_state(bool save) {
   this->position = clamp(this->position, 0.0f, 1.0f);
   this->tilt = clamp(this->tilt, 0.0f, 1.0f);

esphome/components/cover/cover.h

@@ -36,6 +36,8 @@ class CoverCall {
   CoverCall &set_command_close();
   /// Set the command to stop the cover.
   CoverCall &set_command_stop();
+  /// Set the command to stop the cover tilt.
+  CoverCall &set_command_stop_tilt();
   /// Set the command to toggle the cover.
   CoverCall &set_command_toggle();
   /// Set the call to a certain target position.
@@ -44,12 +46,15 @@ class CoverCall {
   CoverCall &set_tilt(float tilt);
   /// Set whether this cover call should stop the cover.
   CoverCall &set_stop(bool stop);
+  /// Set whether this cover call should stop the cover tilt.
+  CoverCall &set_stop_tilt(bool stop_tilt);
 
   /// Perform the cover call.
   void perform();
 
   const optional<float> &get_position() const;
   bool get_stop() const { return this->stop_; }
+  bool get_stop_tilt() const { return this->stop_tilt_; }
   const optional<float> &get_tilt() const;
   const optional<bool> &get_toggle() const;
 
@@ -58,6 +63,7 @@ class CoverCall {
 
   Cover *parent_;
   bool stop_{false};
+  bool stop_tilt_{false};
   optional<float> position_{};
   optional<float> tilt_{};
   optional<bool> toggle_{};

esphome/components/cover/cover_traits.h

@@ -16,6 +16,8 @@ class CoverTraits {
   void set_supports_toggle(bool supports_toggle) { this->supports_toggle_ = supports_toggle; }
   bool get_supports_stop() const { return this->supports_stop_; }
   void set_supports_stop(bool supports_stop) { this->supports_stop_ = supports_stop; }
+  bool get_supports_stop_tilt() const { return this->supports_stop_tilt_; }
+  void set_supports_stop_tilt(bool supports_stop_tilt) { this->supports_stop_tilt_ = supports_stop_tilt; }
 
  protected:
   bool is_assumed_state_{false};
@@ -23,6 +25,7 @@ class CoverTraits {
   bool supports_tilt_{false};
   bool supports_toggle_{false};
   bool supports_stop_{false};
+  bool supports_stop_tilt_{false};
 };
 
 }  // namespace esphome::cover

esphome/components/cse7761/cse7761.cpp

@@ -175,6 +175,8 @@ uint32_t CSE7761Component::coefficient_by_unit_(uint32_t unit) {
     case POWER_PAC:
       coeff = this->data_.coefficient[POWER_PAC] * scale;
       return coeff ? 0x80000000 / coeff : 0;
+    default:
+      break;
   }
   return 0;
 }

esphome/components/debug/debug_zephyr.cpp

@@ -156,6 +156,8 @@ static const char *regout0_to_str(uint32_t value) {
       return "3.0V";
     case (UICR_REGOUT0_VOUT_3V3):
       return "3.3V";
+    default:
+      break;
   }
   return "???V";
 }
@@ -337,6 +339,8 @@ size_t DebugComponent::get_device_info_(std::span<char, DEVICE_INFO_BUFFER_SIZE>
         return "QFxx - 6x6 48-pin QFN";
       case 0x2005:
         return "CKxx - 3.544 x 3.607 WLCSP";
+      default:
+        break;
     }
     return "Unspecified";
   };

esphome/components/delonghi/delonghi.cpp

@@ -143,6 +143,8 @@ bool DelonghiClimate::parse_state_frame_(const uint8_t frame[]) {
     case DELONGHI_FAN_AUTO:
       this->fan_mode = climate::CLIMATE_FAN_AUTO;
       break;
+    default:
+      break;
   }
   this->publish_state();
   return true;

esphome/components/dfplayer/dfplayer.cpp

@@ -250,6 +250,8 @@ void DFPlayer::loop() {
                   ESP_LOGE(TAG, "Entered into sleep mode");
                   this->is_playing_ = false;
                   break;
+                default:
+                  break;
               }
               break;
             case 0x41:

esphome/components/duty_time/duty_time_sensor.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <cinttypes>
+#include <utility>
 
 #include "esphome/core/component.h"
 #include "esphome/core/preferences.h"
@@ -26,7 +27,7 @@ class DutyTimeSensor final : public sensor::Sensor, public PollingComponent {
 #ifdef USE_BINARY_SENSOR
   void set_sensor(binary_sensor::BinarySensor *sensor);
 #endif
-  void set_lambda(std::function<bool()> &&func) { this->func_ = func; }
+  void set_lambda(std::function<bool()> &&func) { this->func_ = std::move(func); }
   void set_last_duty_time_sensor(sensor::Sensor *sensor) { this->last_duty_time_sensor_ = sensor; }
   void set_restore(bool restore) { this->restore_ = restore; }
 

esphome/components/epaper_spi/epaper_goodisplay_3c.cpp

@@ -0,0 +1,12 @@
+#include "epaper_goodisplay_3c.h"
+
+namespace esphome::epaper_spi {
+
+void EPaperGoodDisplay3C::power_on() {}
+
+void EPaperGoodDisplay3C::refresh_screen(bool partial) {
+  EPaperWeAct3C::refresh_screen(partial);
+  this->next_delay_ = REFRESH_START_MS;
+}
+
+}  // namespace esphome::epaper_spi

esphome/components/epaper_spi/epaper_goodisplay_3c.h

@@ -0,0 +1,28 @@
+#pragma once
+
+#include "epaper_weact_3c.h"
+
+namespace esphome::epaper_spi {
+
+/**
+ * Good Display 3-color e-paper displays (SSD1680 controller), e.g. GDEY029Z95.
+ *
+ * Driven as EPaperWeAct3C, except that there is no separate power-on: the full refresh (0xF7) powers the panel
+ * up itself. Busy then only goes high a little after the refresh starts, so the next state waits before
+ * checking it.
+ */
+class EPaperGoodDisplay3C : public EPaperWeAct3C {
+ public:
+  using EPaperWeAct3C::EPaperWeAct3C;
+
+ protected:
+  // Time from master activation (0x20) until busy can be relied on
+  static constexpr uint16_t REFRESH_START_MS = 50;
+
+  // With EPaperWeAct3C's power-on (0x22 0xF8) first, this panel's refresh ends almost at once and the image
+  // does not change.
+  void power_on() override;
+  void refresh_screen(bool partial) override;
+};
+
+}  // namespace esphome::epaper_spi

esphome/components/epaper_spi/models/weact_bwr.py

@@ -4,11 +4,17 @@ Supported models:
 - weact-2.13in-3c: 122x250 pixels (2.13" display)
 - weact-2.9in-3c: 128x296 pixels (2.9" display)
 - weact-4.2in-3c: 400x300 pixels (4.2" display)
+- goodisplay-gdey029z95-2.9: 128x296 pixels (Good Display GDEY029Z95 2.9" display)
 
 These displays use SSD1680 or SSD1683 controller and require a specific initialization
 sequence. The DRV_OUT_CTL command is calculated from the display height.
+The Good Display panel is driven as the WeAct ones, except that it must not get the
+separate power-on before the refresh, so it has its own driver class, EPaperGoodDisplay3C.
 """
 
+import esphome.config_validation as cv
+from esphome.const import CONF_BUSY_PIN, CONF_RESET_PIN
+
 from . import EpaperModel
 
 
@@ -17,8 +23,10 @@ class WeActBWR(EpaperModel):
 
     source_files = ("epaper_weact_3c.cpp",)
 
-    def __init__(self, name, **defaults):
-        super().__init__(name, "EPaperWeAct3C", **defaults)
+    def __init__(
+        self, name: str, class_name: str = "EPaperWeAct3C", **defaults: object
+    ) -> None:
+        super().__init__(name, class_name, **defaults)
 
     def get_init_sequence(self, config):
         """Generate initialization sequence for WeAct BWR displays.
@@ -75,3 +83,27 @@ weact_4p2in3c = WeActBWR(
     data_rate="10MHz",
     minimum_update_interval="10s",
 )
+
+
+class GoodDisplayBWR(WeActBWR):
+    """Good Display Black/White/Red displays using SSD1680 controller."""
+
+    source_files = ("epaper_weact_3c.cpp", "epaper_goodisplay_3c.cpp")
+
+    def __init__(self, name: str, **defaults: object) -> None:
+        super().__init__(name, "EPaperGoodDisplay3C", **defaults)
+
+    def option(self, name, fallback=cv.UNDEFINED) -> cv.Optional | cv.Required:
+        # Only a hardware reset wakes the panel from deep sleep, and refreshes are timed by busy
+        if name in (CONF_RESET_PIN, CONF_BUSY_PIN):
+            return cv.Required(name)
+        return super().option(name, fallback)
+
+
+# Model: Good Display GDEY029Z95 2.9" BWR - 128x296 pixels, SSD1680 controller
+GoodDisplayBWR(
+    "goodisplay-gdey029z95-2.9",
+    width=128,
+    height=296,
+    minimum_update_interval="10s",
+)

esphome/components/esp32_ble/ble_uuid.h

@@ -15,7 +15,7 @@
 namespace esphome::esp32_ble {
 
 using ble_device_base::UUID_STR_LEN;
-using ESPBTUUID = ble_device_base::ESPBTUUID;
+using ble_device_base::ESPBTUUID;
 
 }  // namespace esphome::esp32_ble
 

esphome/components/esp32_ble_tracker/esp32_ble_tracker.h

@@ -33,18 +33,18 @@ namespace esphome::esp32_ble_tracker {
 
 using namespace esp32_ble;
 
-using adv_data_t = ble_device_base::adv_data_t;
+using ble_device_base::adv_data_t;
 
 #ifdef USE_ESP32_BLE_UUID
-using ServiceData = ble_device_base::ServiceData;
+using ble_device_base::ServiceData;
 #endif
 
 #ifdef USE_ESP32_BLE_DEVICE
 // The advertisement device types are owned by the platform-neutral
 // ble_device_base layer; re-exported here (esp32 only) for backward
 // compatibility. ESPBTDevice::parse_scan_rst() (esp32-only) adapts BLEScanResult.
-using ESPBLEiBeacon = ble_device_base::ESPBLEiBeacon;
-using ESPBTDevice = ble_device_base::ESPBTDevice;
+using ble_device_base::ESPBLEiBeacon;
+using ble_device_base::ESPBTDevice;
 #endif  // USE_ESP32_BLE_DEVICE
 
 class ESP32BLETracker;
@@ -82,12 +82,12 @@ struct ClientStateCounts {
 
 // The client connection state types are owned by the platform-neutral
 // ble_device_base layer; re-exported here for backward compatibility.
-using ClientState = ble_device_base::ClientState;
-using ConnectionType = ble_device_base::ConnectionType;
+using ble_device_base::ClientState;
+using ble_device_base::ConnectionType;
 using ble_device_base::client_state_to_string;
 
 // Neutral scanner lifecycle re-exported for backward compatibility.
-using ScannerState = ble_device_base::ScannerState;
+using ble_device_base::ScannerState;
 
 /// Base class for BLE GATT clients that connect to remote devices.
 ///

esphome/components/esp32_hosted/esp_now_hosted.cpp

@@ -425,7 +425,7 @@ esp_err_t esp_now_send(const uint8_t *peer_addr, const uint8_t *data, size_t len
   // task, and a shared build buffer here would let two callers corrupt each
   // other's frame. Passing the body through also drops a full-frame copy per
   // transmit, on the path this shim exists to keep quick.
-  uint8_t hdr[sizeof(esp_now_hosted_send_req_t)];
+  uint8_t hdr[sizeof(esp_now_hosted_send_req_t)] = {};
   auto *s = reinterpret_cast<esp_now_hosted_send_req_t *>(hdr);
   s->has_addr = peer_addr != nullptr ? 1 : 0;
   if (peer_addr != nullptr) {

esphome/components/esp8266/preferences.cpp

@@ -48,7 +48,8 @@ static inline bool esp_rtc_user_mem_read(uint32_t index, uint32_t *dest) {
   if (index >= ESP_RTC_USER_MEM_SIZE_WORDS) {
     return false;
   }
-  *dest = ESP_RTC_USER_MEM[index];  // NOLINT(performance-no-int-to-ptr,clang-analyzer-core.FixedAddressDereference)
+  // NOLINTNEXTLINE(performance-no-int-to-ptr,clang-analyzer-core.FixedAddressDereference,clang-analyzer-optin.core.FixedAddressDereference)
+  *dest = ESP_RTC_USER_MEM[index];
   return true;
 }
 
@@ -61,7 +62,8 @@ static inline bool esp_rtc_user_mem_write(uint32_t index, uint32_t value) {
   }
 
   auto *ptr = &ESP_RTC_USER_MEM[index];  // NOLINT(performance-no-int-to-ptr)
-  *ptr = value;                          // NOLINT(clang-analyzer-core.FixedAddressDereference)
+  // NOLINTNEXTLINE(clang-analyzer-core.FixedAddressDereference,clang-analyzer-optin.core.FixedAddressDereference)
+  *ptr = value;
   return true;
 }
 

esphome/components/ethernet/__init__.py

@@ -46,6 +46,7 @@ from esphome.const import (
     CONF_TYPE,
     CONF_USE_ADDRESS,
     CONF_VALUE,
+    CONF_WIFI,
     KEY_CORE,
     KEY_FRAMEWORK_VERSION,
     Platform,
@@ -562,6 +563,25 @@ CONFIG_SCHEMA = cv.All(
 )
 
 
+def _final_validate_wifi(config: ConfigType) -> None:
+    """A wifi station competes with ethernet for the primary interface, so both must be in network: priority:."""
+    full_config = fv.full_config.get()
+    if (wifi_config := full_config.get(CONF_WIFI)) is None:
+        return
+
+    from esphome.components.wifi import wifi_stays_ap_only
+
+    if wifi_stays_ap_only(wifi_config, full_config):
+        return  # an access point does not claim the primary interface
+
+    priority_ifaces = get_priority_interfaces_from_full_config(full_config)
+    if missing := [i for i in (DOMAIN, CONF_WIFI) if i not in priority_ifaces]:
+        raise cv.Invalid(
+            "When ethernet and a wifi station are used together, 'network: priority:' "
+            f"must list both interfaces; missing: {', '.join(missing)}"
+        )
+
+
 def _final_validate_spi(config: ConfigType) -> None:
     if not CORE.is_esp32:
         return  # SPI interface validation is ESP32-only
@@ -846,22 +866,7 @@ def _final_validate_rmii_pins(config: ConfigType) -> None:
 
 def _final_validate(config: ConfigType) -> None:
     """Final validation for Ethernet component."""
-    # Allow ethernet + wifi coexistence only when both are declared in network: priority:.
-    if "wifi" in fv.full_config.get():
-        priority_ifaces = get_priority_interfaces_from_full_config(fv.full_config.get())
-        missing = [i for i in ("ethernet", "wifi") if i not in priority_ifaces]
-        if missing and priority_ifaces:
-            # A priority list exists but is incomplete: point at what to add.
-            raise cv.Invalid(
-                "When ethernet and wifi are used together, 'network: priority:' must "
-                f"list both interfaces; missing: {', '.join(missing)}"
-            )
-        if missing:
-            raise cv.Invalid(
-                "Component ethernet cannot be used together with component wifi "
-                "unless both are listed under 'network: priority:'"
-            )
-
+    _final_validate_wifi(config)
     _final_validate_spi(config)
     _final_validate_rmii_pins(config)
 

esphome/components/ezo_pmp/ezo_pmp.cpp

@@ -175,6 +175,8 @@ void EzoPMP::read_command_result_() {
           third_parameter_buffer[position_in_parameter_buffer] = current_char;
           third_parameter_buffer[position_in_parameter_buffer + 1] = '\0';
           break;
+        default:
+          break;
       }
       position_in_parameter_buffer++;
     }

esphome/components/fingerprint_grow/fingerprint_grow.cpp

@@ -194,6 +194,8 @@ uint8_t FingerprintGrowComponent::scan_image_(uint8_t buffer) {
       ESP_LOGE(TAG, "Could not find fingerprint features");
       this->finger_scan_invalid_callback_.call();
       break;
+    default:
+      break;
   }
   return send_result;
 }

esphome/components/haier/haier_base.cpp

@@ -318,20 +318,21 @@ void HaierClimateBase::process_protocol_reset() {
 
 bool HaierClimateBase::prepare_pending_action() {
   if (this->action_request_.has_value()) {
-    switch (this->action_request_.value().action) {
+    PendingAction &request = this->action_request_.value();
+    switch (request.action) {
       case ActionRequest::SEND_CUSTOM_COMMAND:
         return true;
       case ActionRequest::TURN_POWER_ON:
-        this->action_request_.value().message = this->get_power_message(true);
+        request.message = this->get_power_message(true);
         return true;
       case ActionRequest::TURN_POWER_OFF:
-        this->action_request_.value().message = this->get_power_message(false);
+        request.message = this->get_power_message(false);
         return true;
       case ActionRequest::TOGGLE_POWER:
-        this->action_request_.value().message = this->get_power_message(this->mode == ClimateMode::CLIMATE_MODE_OFF);
+        request.message = this->get_power_message(this->mode == ClimateMode::CLIMATE_MODE_OFF);
         return true;
       default:
-        ESP_LOGW(TAG, "Unsupported action: %d", (uint8_t) this->action_request_.value().action);
+        ESP_LOGW(TAG, "Unsupported action: %d", (uint8_t) request.action);
         this->action_request_.reset();
         return false;
     }

esphome/components/haier/hon_climate.cpp

@@ -1071,6 +1071,8 @@ haier_protocol::HandlerError HonClimate::process_status_message_(const uint8_t *
       case (uint8_t) hon_protocol::FanMode::FAN_HIGH:
         this->fan_mode = CLIMATE_FAN_HIGH;
         break;
+      default:
+        break;
     }
     should_publish = should_publish || (!old_fan_mode.has_value()) ||
                      (old_fan_mode.value_or(CLIMATE_FAN_ON) != this->fan_mode.value_or(CLIMATE_FAN_ON));
@@ -1144,6 +1146,8 @@ haier_protocol::HandlerError HonClimate::process_status_message_(const uint8_t *
         case (uint8_t) hon_protocol::ConditioningMode::AUTO:
           this->mode = CLIMATE_MODE_HEAT_COOL;
           break;
+        default:
+          break;
       }
     }
     should_publish = should_publish || (old_mode != this->mode);

esphome/components/heatpumpir/receiver_mitsubishi_heavy_zmp.cpp

@@ -40,6 +40,8 @@ void decode_mitsubishi_heavy_zmp(const uint8_t frame[MITSUBISHI_HEAVY_FRAME_LENG
     case MITSUBISHI_HEAVY_ZMP_ECONO:
       climate.preset = climate::CLIMATE_PRESET_ECO;
       break;
+    default:
+      break;
   }
 
   uint8_t swing_h = frame[BYTE_SWING_H] & HORIZONTAL_SWING_MASK;

esphome/components/hitachi_ac344/hitachi_ac344.cpp

@@ -260,6 +260,8 @@ bool HitachiClimate::parse_mode_(const uint8_t remote_state[]) {
       case HITACHI_AC344_MODE_FAN:
         this->mode = climate::CLIMATE_MODE_FAN_ONLY;
         break;
+      default:
+        break;
     }
   } else {
     this->mode = climate::CLIMATE_MODE_OFF;
@@ -294,6 +296,8 @@ bool HitachiClimate::parse_fan_(const uint8_t remote_state[]) {
     case HITACHI_AC344_FAN_AUTO:
       this->fan_mode = climate::CLIMATE_FAN_AUTO;
       break;
+    default:
+      break;
   }
   return true;
 }

esphome/components/hitachi_ac424/hitachi_ac424.cpp

@@ -255,6 +255,8 @@ bool HitachiClimate::parse_mode_(const uint8_t remote_state[]) {
       case HITACHI_AC424_MODE_FAN:
         this->mode = climate::CLIMATE_MODE_FAN_ONLY;
         break;
+      default:
+        break;
     }
   } else {
     this->mode = climate::CLIMATE_MODE_OFF;
@@ -289,6 +291,8 @@ bool HitachiClimate::parse_fan_(const uint8_t remote_state[]) {
     case HITACHI_AC424_FAN_AUTO:
       this->fan_mode = climate::CLIMATE_FAN_AUTO;
       break;
+    default:
+      break;
   }
   return true;
 }

esphome/components/improv_base/improv_base.cpp

@@ -69,7 +69,7 @@ size_t ImprovBase::get_formatted_next_url_(char *buffer, size_t buffer_size) {
 void ImprovBase::add_next_url_(improv::RpcResponseBuilder &builder, size_t max_len) {
   // The builder rejects strings above 254 bytes, so anything longer than this
   // buffer could never be sent anyway
-  char url_buffer[256];
+  char url_buffer[256] = {};
   size_t len = this->get_formatted_next_url_(url_buffer, sizeof(url_buffer));
   if (len == 0) {
     return;

esphome/components/json/json_util.h

@@ -4,6 +4,7 @@
 #include <cstddef>
 #include <cstring>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "esphome/core/defines.h"
@@ -50,15 +51,15 @@ template<size_t STACK_SIZE = 640> class SerializationBuffer {
   ~SerializationBuffer() { delete[] heap_buffer_; }
 
   // Move constructor - works with same template instantiation
-  SerializationBuffer(SerializationBuffer &&other) noexcept : heap_buffer_(other.heap_buffer_), size_(other.size_) {
+  SerializationBuffer(SerializationBuffer &&other) noexcept
+      : heap_buffer_(std::exchange(other.heap_buffer_, nullptr)), size_(other.size_) {
     if (other.buffer_ == other.stack_buffer_) {
       // Stack buffer - must copy content
       std::memcpy(stack_buffer_, other.stack_buffer_, size_ + 1);
       buffer_ = stack_buffer_;
     } else {
-      // Heap buffer - steal ownership
+      // Heap buffer - ownership was taken above
       buffer_ = heap_buffer_;
-      other.heap_buffer_ = nullptr;
     }
     // Leave moved-from object in valid empty state
     other.stack_buffer_[0] = '\0';
@@ -70,14 +71,13 @@ template<size_t STACK_SIZE = 640> class SerializationBuffer {
   SerializationBuffer &operator=(SerializationBuffer &&other) noexcept {
     if (this != &other) {
       delete[] heap_buffer_;
-      heap_buffer_ = other.heap_buffer_;
+      heap_buffer_ = std::exchange(other.heap_buffer_, nullptr);
       size_ = other.size_;
       if (other.buffer_ == other.stack_buffer_) {
         std::memcpy(stack_buffer_, other.stack_buffer_, size_ + 1);
         buffer_ = stack_buffer_;
       } else {
         buffer_ = heap_buffer_;
-        other.heap_buffer_ = nullptr;
       }
       // Leave moved-from object in valid empty state
       other.stack_buffer_[0] = '\0';

esphome/components/kuntze/kuntze.cpp

@@ -61,6 +61,8 @@ void Kuntze::on_read_holding_registers(uint16_t start_address, std::span<const u
       if (this->oci_sensor_ != nullptr)
         this->oci_sensor_->publish_state(value);
       break;
+    default:
+      break;
   }
 }
 

esphome/components/ld2410/ld2410.cpp

@@ -407,12 +407,10 @@ void LD2410Component::handle_periodic_data_() {
 }
 
 #ifdef USE_NUMBER
-std::function<void(void)> set_number_value(number::Number *n, float value) {
+void set_number_value(number::Number *n, float value) {
   if (n != nullptr && (!n->has_state() || n->state != value)) {
-    n->state = value;
-    return [n, value]() { n->publish_state(value); };
+    n->publish_state(value);
   }
-  return []() {};
 }
 #endif
 
@@ -560,29 +558,24 @@ bool LD2410Component::handle_ack_data_() {
         Moving distance range: 13th byte
         Still distance range: 14th byte
       */
-      std::vector<std::function<void(void)>> updates;
-      updates.push_back(set_number_value(this->max_move_distance_gate_number_, this->buffer_data_[12]));
-      updates.push_back(set_number_value(this->max_still_distance_gate_number_, this->buffer_data_[13]));
+      set_number_value(this->max_move_distance_gate_number_, this->buffer_data_[12]);
+      set_number_value(this->max_still_distance_gate_number_, this->buffer_data_[13]);
       /*
         Moving Sensitivities: 15~23th bytes
       */
-      for (std::vector<number::Number *>::size_type i = 0; i != this->gate_move_threshold_numbers_.size(); i++) {
-        updates.push_back(set_number_value(this->gate_move_threshold_numbers_[i], this->buffer_data_[14 + i]));
+      for (size_t i = 0; i < TOTAL_GATES; i++) {
+        set_number_value(this->gate_move_threshold_numbers_[i], this->buffer_data_[14 + i]);
       }
       /*
         Still Sensitivities: 24~32th bytes
       */
-      for (std::vector<number::Number *>::size_type i = 0; i != this->gate_still_threshold_numbers_.size(); i++) {
-        updates.push_back(set_number_value(this->gate_still_threshold_numbers_[i], this->buffer_data_[23 + i]));
+      for (size_t i = 0; i < TOTAL_GATES; i++) {
+        set_number_value(this->gate_still_threshold_numbers_[i], this->buffer_data_[23 + i]);
       }
       /*
         None Duration: 33~34th bytes
       */
-      updates.push_back(
-          set_number_value(this->timeout_number_, encode_uint16(this->buffer_data_[33], this->buffer_data_[32])));
-      for (auto &update : updates) {
-        update();
-      }
+      set_number_value(this->timeout_number_, encode_uint16(this->buffer_data_[33], this->buffer_data_[32]));
 #endif
       break;
     }

esphome/components/libretiny/preferences.cpp

@@ -230,7 +230,8 @@ bool LibreTinyPreferences::is_changed_(fdb_kvdb_t db, const NVSData &to_save, co
     return true;
   }
 
-  // Compare the actual data
+  // Compare the actual data. fdb_kv_get_blob filled stored_data through this->blob, which the analyzer cannot see.
+  // NOLINTNEXTLINE(clang-analyzer-unix.cstring.UninitializedRead)
   return memcmp(to_save.data.data(), stored_data.get(), kv.value_len) != 0;
 }
 

esphome/components/lightwaverf/LwRx.cpp

@@ -218,6 +218,8 @@ bool LwRx::lwrx_getmessage(uint8_t *buf, uint8_t len) {
         case 10:
           buf[i] = j;
           break;
+        default:
+          break;
       }
     }
   } else {

esphome/components/mcp23016/mcp23016.h

@@ -38,7 +38,7 @@ class MCP23016 final : public Component, public i2c::I2CDevice, public gpio_expa
   void set_interrupt_pin(InternalGPIOPin *pin) { this->interrupt_pin_ = pin; }
 
  protected:
-  static void IRAM_ATTR gpio_intr(MCP23016 *arg);
+  static void gpio_intr(MCP23016 *arg);
   // Virtual methods from CachedGpioExpander
   bool digital_read_hw(uint8_t pin) override;
   bool digital_read_cache(uint8_t pin) override;

esphome/components/mcp23xxx_base/mcp23xxx_base.h

@@ -10,7 +10,7 @@ enum MCP23XXXInterruptMode : uint8_t { MCP23XXX_NO_INTERRUPT = 0, MCP23XXX_CHANG
 
 // Not a template member: GCC 10 (ESP8266) ignores section attributes on template instantiations, leaving the
 // ISR in flash.
-void IRAM_ATTR mcp23xxx_gpio_intr(Component *arg);
+void mcp23xxx_gpio_intr(Component *arg);
 
 template<uint8_t N> class MCP23XXXBase : public Component, public gpio_expander::CachedGpioExpander<uint8_t, N> {
  public:

esphome/components/mcp4461/mcp4461.cpp

@@ -81,6 +81,8 @@ void Mcp4461Component::initialize_terminal_disabled(Mcp4461WiperIdx wiper, char
     case 'w':
       this->reg_[wiper_idx].terminal_w = false;
       break;
+    default:
+      break;
   }
 }
 

esphome/components/media_player/__init__.py

@@ -3,6 +3,7 @@ from collections.abc import Callable
 from esphome import automation
 import esphome.codegen as cg
 from esphome.components import audio
+from esphome.components.const import CONF_BITRATE
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_ENTITY_CATEGORY,
@@ -55,6 +56,30 @@ FORMAT_MAPPING = {
 }
 
 
+# MP3 constant bitrates in kbps; the encoder rounds anything else to the nearest one
+MP3_BITRATES = (
+    8,
+    16,
+    24,
+    32,
+    40,
+    48,
+    56,
+    64,
+    80,
+    96,
+    112,
+    128,
+    144,  # MPEG-2 only, at 16, 22.05 and 24 kHz
+    160,
+    192,
+    224,
+    256,
+    320,
+)
+validate_mp3_bitrate = cv.one_of(*MP3_BITRATES, int=True)
+
+
 def build_supported_format_struct(
     format_config: ConfigType, purpose: MockObj
 ) -> cg.StructInitializer:
@@ -75,6 +100,10 @@ def build_supported_format_struct(
     if format_config[CONF_FORMAT] != "MP3":
         args.append(("sample_bytes", 2))
 
+    # Omitted means no preference, and the client keeps encoding as it always has.
+    if bitrate := format_config.get(CONF_BITRATE):
+        args.append(("bitrate", bitrate))
+
     return cg.StructInitializer(*args)
 
 
@@ -91,6 +120,14 @@ def validate_preferred_format(
         inherit_property_from(CONF_NUM_CHANNELS, audio_device_key)(config)
         inherit_property_from(CONF_SAMPLE_RATE, audio_device_key)(config)
 
+        # A constant bitrate is only meaningful for the one lossy format whose
+        # encoder Home Assistant can be told to fix
+        if CONF_BITRATE in config and config.get(CONF_FORMAT) != "MP3":
+            raise cv.Invalid(
+                f"{CONF_BITRATE} is only supported for the MP3 format",
+                path=[CONF_BITRATE],
+            )
+
         # Opus only supports 48 kHz
         if config.get(CONF_FORMAT) == "OPUS" and config.get(CONF_SAMPLE_RATE) != 48000:
             raise cv.Invalid("Opus only supports a sample rate of 48000 Hz")

esphome/components/media_player/media_player.h

@@ -77,6 +77,7 @@ struct MediaPlayerSupportedFormat {
   uint32_t num_channels;
   MediaPlayerFormatPurpose purpose;
   uint32_t sample_bytes;
+  uint32_t bitrate;
 };
 
 // Base features always reported for all media players

esphome/components/mipi_spi/mipi_spi.h

@@ -244,9 +244,9 @@ class MipiSpi : public display::Display,
     char hex_buf[format_hex_pretty_size(MIPI_SPI_MAX_CMD_LOG_BYTES)];
     // Don't spam the log after setup
     if (this->init_sequence_len_ == 0) {
-      esph_log_v(TAG, "Command %02X, length %d, bytes %s", cmd, len, format_hex_pretty_to(hex_buf, bytes, len));
+      esph_log_v(TAG, "Command %02X, length %zu, bytes %s", cmd, len, format_hex_pretty_to(hex_buf, bytes, len));
     } else {
-      esph_log_d(TAG, "Command %02X, length %d, bytes %s", cmd, len, format_hex_pretty_to(hex_buf, bytes, len));
+      esph_log_d(TAG, "Command %02X, length %zu, bytes %s", cmd, len, format_hex_pretty_to(hex_buf, bytes, len));
     }
     if constexpr (BUS_TYPE == BUS_TYPE_QUAD) {
       this->enable();

esphome/components/modbus_controller/modbus_controller.cpp

@@ -652,7 +652,7 @@ ModbusCommandItem ModbusCommandItem::create_custom_command(
       ESP_LOGI(TAG, "Custom Command sent");
     };
   } else {
-    cmd.on_data_func = handler;
+    cmd.on_data_func = std::move(handler);
   }
   cmd.payload.set(values.data(), values.size());
 
@@ -669,7 +669,7 @@ ModbusCommandItem ModbusCommandItem::create_custom_command(
       ESP_LOGI(TAG, "Custom Command sent");
     };
   } else {
-    cmd.on_data_func = handler;
+    cmd.on_data_func = std::move(handler);
   }
   uint8_t *p = cmd.payload.init(values.size() * 2);
   for (auto v : values) {

esphome/components/mt6701_i2c/__init__.py

@@ -3,7 +3,7 @@ from typing import Any
 from esphome import automation
 import esphome.codegen as cg
 from esphome.components import i2c
-from esphome.components.const import CONF_PWM_FREQUENCY
+from esphome.components.const import CONF_OUT_PIN, CONF_PWM_FREQUENCY
 import esphome.config_validation as cv
 from esphome.const import CONF_DIRECTION, CONF_HYSTERESIS, CONF_ID, CONF_MODE
 from esphome.types import ConfigType
@@ -28,7 +28,6 @@ CONF_PULSES_PER_REVOLUTION = "pulses_per_revolution"
 CONF_Z_PULSE_WIDTH = "z_pulse_width"
 CONF_UVW = "uvw"
 CONF_POLE_PAIRS = "pole_pairs"
-CONF_OUT_PIN = "out_pin"
 CONF_PWM_POLARITY = "pwm_polarity"
 CONF_ANALOG_START = "analog_start"
 CONF_ANALOG_STOP = "analog_stop"

esphome/components/nfc/nfc_helpers.cpp

@@ -28,12 +28,12 @@ std::string get_random_ha_tag_ndef() {
   for (int i = 0; i < 8; i++) {
     uri += ALPHANUM[random_uint32() % (sizeof(ALPHANUM) - 1)];
   }
-  uri += "-";
+  uri += '-';
   for (int j = 0; j < 3; j++) {
     for (int i = 0; i < 4; i++) {
       uri += ALPHANUM[random_uint32() % (sizeof(ALPHANUM) - 1)];
     }
-    uri += "-";
+    uri += '-';
   }
   for (int i = 0; i < 12; i++) {
     uri += ALPHANUM[random_uint32() % (sizeof(ALPHANUM) - 1)];

esphome/components/noblex/noblex.cpp

@@ -254,6 +254,8 @@ bool NoblexClimate::on_receive(remote_base::RemoteReceiveData data) {
       case IRNoblexMode::IR_NOBLEX_MODE_HEAT:
         this->mode = climate::CLIMATE_MODE_HEAT;
         break;
+      default:
+        break;
     }
   }
 

esphome/components/online_image/download_buffer.cpp

@@ -1,5 +1,6 @@
 #include "download_buffer.h"
 #include "esphome/core/log.h"
+#include <algorithm>
 #include <cstring>
 
 namespace esphome::online_image {
@@ -34,6 +35,46 @@ size_t DownloadBuffer::read(size_t len) {
   return this->unread_;
 }
 
+void DownloadSource::compact() {
+  if (this->keep_read_ || this->pos_ == this->start_)
+    return;
+  this->buffer_.read(this->pos_ - this->start_);
+  this->start_ = this->pos_;
+}
+
+int32_t DownloadSource::read(uint8_t *buf, uint32_t len) {
+  const size_t offset = this->pos_ - this->start_;
+  const size_t n = std::min<size_t>(len, this->buffer_.unread() - offset);
+  memcpy(buf, this->buffer_.data(offset), n);
+  this->pos_ += n;
+  return static_cast<int32_t>(n);
+}
+
+bool DownloadSource::seek(uint32_t position) {
+  // Only what is still in the buffer can be read again; a decoder never skips ahead of the download
+  if (position < this->start_ || position > this->start_ + this->buffer_.unread())
+    return false;
+  this->pos_ = position;
+  return true;
+}
+
+bool DownloadBuffer::grow(size_t size) {
+  if (this->size_ >= size)
+    return true;
+  RAMAllocator<uint8_t> allocator;
+  uint8_t *buffer = allocator.allocate(size);
+  if (buffer == nullptr) {
+    ESP_LOGE(TAG, "allocation of %zu bytes failed. Biggest block in heap: %zu Bytes", size,
+             allocator.get_max_free_block_size());
+    return false;
+  }
+  memcpy(buffer, this->buffer_, this->unread_);
+  allocator.deallocate(this->buffer_, this->size_);
+  this->buffer_ = buffer;
+  this->size_ = size;
+  return true;
+}
+
 size_t DownloadBuffer::resize(size_t size) {
   if (this->size_ >= size) {
     // Avoid useless reallocations; if the buffer is big enough, don't reallocate.

esphome/components/online_image/download_buffer.h

@@ -1,5 +1,6 @@
 #pragma once
 
+#include "esphome/components/runtime_image/image_decoder.h"
 #include "esphome/core/helpers.h"
 #include <cstddef>
 #include <cstdint>
@@ -35,6 +36,8 @@ class DownloadBuffer {
 
   void reset() { this->unread_ = 0; }
   size_t resize(size_t size);
+  /// Make the buffer at least size bytes, keeping the unread data. Returns false if the allocation failed.
+  bool grow(size_t size);
 
  protected:
   uint8_t *buffer_;
@@ -43,4 +46,35 @@ class DownloadBuffer {
   size_t unread_;
 };
 
+/**
+ * @brief Lets a decoder read a download as it arrives, from the download buffer.
+ *
+ * The decoder reads at its own position in the buffer. Bytes it has read stay there until compact() drops
+ * them, and compact() keeps everything while set_keep_read(true) is in effect, so the decoder can seek back
+ * while it reads the headers.
+ */
+class DownloadSource : public runtime_image::DecodeSource {
+ public:
+  explicit DownloadSource(DownloadBuffer &buffer) : buffer_(buffer) {}
+
+  /// Start again at the beginning of a new download, keeping what is read
+  void reset() {
+    this->start_ = 0;
+    this->pos_ = 0;
+    this->keep_read_ = true;
+  }
+  void set_keep_read(bool keep) { this->keep_read_ = keep; }
+  /// Drop the bytes the decoder has read, to make room for more of the download
+  void compact();
+
+  int32_t read(uint8_t *buf, uint32_t len) override;
+  bool seek(uint32_t position) override;
+
+ protected:
+  DownloadBuffer &buffer_;
+  size_t start_{0};  // Position in the download of the first byte in the buffer
+  size_t pos_{0};    // Position in the download the decoder reads next
+  bool keep_read_{true};
+};
+
 }  // namespace esphome::online_image

esphome/components/online_image/image.py

@@ -22,6 +22,8 @@ DEPENDENCIES = ["http_request"]
 CODEOWNERS = ["@guillempages", "@clydebarrow"]
 
 CONF_ON_DOWNLOAD_FINISHED = "on_download_finished"
+CONF_ON_DOWNLOAD_STARTED = "on_download_started"
+CONF_ON_DOWNLOAD_PROGRESS = "on_download_progress"
 CONF_UPDATE = "update"
 
 online_image_ns = cg.esphome_ns.namespace("online_image")
@@ -43,7 +45,9 @@ ONLINE_IMAGE_SCHEMA = (
             cv.Optional(CONF_REQUEST_HEADERS): cv.All(
                 cv.Schema({cv.string: cv.templatable(cv.string)})
             ),
+            cv.Optional(CONF_ON_DOWNLOAD_STARTED): automation.validate_automation({}),
             cv.Optional(CONF_ON_DOWNLOAD_FINISHED): automation.validate_automation({}),
+            cv.Optional(CONF_ON_DOWNLOAD_PROGRESS): automation.validate_automation({}),
             cv.Optional(CONF_ON_ERROR): automation.validate_automation({}),
         }
     )
@@ -96,9 +100,17 @@ automation.register_apply_action(
 
 
 _CALLBACK_AUTOMATIONS = (
+    automation.CallbackAutomation(
+        CONF_ON_DOWNLOAD_STARTED, "add_on_download_started_callback"
+    ),
     automation.CallbackAutomation(
         CONF_ON_DOWNLOAD_FINISHED, "add_on_finished_callback", [(bool, "cached")]
     ),
+    automation.CallbackAutomation(
+        CONF_ON_DOWNLOAD_PROGRESS,
+        "add_on_progress_callback",
+        [(float, "progress"), (cg.size_t, "bytes_read")],
+    ),
     automation.CallbackAutomation(CONF_ON_ERROR, "add_on_error_callback"),
 )
 

esphome/components/online_image/online_image.cpp

@@ -4,6 +4,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include <algorithm>
+#include <cmath>
 #include <cstdio>
 
 ESPHOME_LOG_TAG(TAG, "online_image");
@@ -15,6 +16,11 @@ static const char *const IF_MODIFIED_SINCE_HEADER_NAME = "if-modified-since";
 
 namespace esphome::online_image {
 
+// Time one loop pass may spend decoding a JPEG as it downloads
+static constexpr uint32_t STREAM_PASS_BUDGET_MS = 20;
+// Shortest time between two on_download_progress calls
+static constexpr uint32_t PROGRESS_INTERVAL_MS = 100;
+
 OnlineImage::OnlineImage(const std::string &url, int width, int height, runtime_image::ImageFormat format,
                          image::ImageType type, image::Transparency transparency, image::Image *placeholder,
                          uint32_t buffer_size, bool is_big_endian)
@@ -140,8 +146,12 @@ void OnlineImage::update() {
     return;
   }
 
-  // JPEG requires the complete image in the download buffer before decoding
-  if (format == runtime_image::JPEG && total_size > this->download_buffer_.size() &&
+  // A JPEG of known size is decoded as it arrives, so the download buffer only has to hold its headers.
+  // Otherwise the decoder needs the complete image in the buffer.
+  this->streaming_ = total_size > 0 && total_size <= INT32_MAX && this->decoder_supports_source();
+  this->stream_started_ = false;
+  this->source_.reset();
+  if (!this->streaming_ && format == runtime_image::JPEG && total_size > this->download_buffer_.size() &&
       this->download_buffer_.resize(total_size) == 0) {
     // resize() logged the failed allocation; the next update() allocates the configured buffer again
     this->end_connection_();
@@ -152,6 +162,8 @@ void OnlineImage::update() {
   ESP_LOGI(TAG, "Downloading image (Size: %zu)", total_size);
   this->start_time_ = millis();
   this->last_data_time_ = this->start_time_;
+  this->download_started_callback_.call();
+  this->report_progress_(true);
   this->enable_loop();
 }
 
@@ -169,6 +181,11 @@ void OnlineImage::loop() {
     return;
   }
 
+  if (this->streaming_) {
+    this->loop_stream_();
+    return;
+  }
+
   // Check if download is complete — use decoder's format-specific completion check
   // to handle both known content-length and chunked transfer encoding
   if (this->is_decode_finished() || (this->downloader_->content_length > 0 &&
@@ -188,6 +205,7 @@ void OnlineImage::loop() {
     if (len > 0) {
       this->last_data_time_ = App.get_loop_component_start_time();
       this->download_buffer_.write(len);
+      this->report_progress_(false);
 
       // Feed data to decoder
       auto consumed = this->feed_data(this->download_buffer_.data(), this->download_buffer_.unread());
@@ -255,6 +273,104 @@ void OnlineImage::loop() {
   }
 }
 
+void OnlineImage::loop_stream_() {
+  const uint32_t now = App.get_loop_component_start_time();
+  const size_t total = this->downloader_->content_length;
+  if (this->stream_started_)
+    this->source_.compact();
+
+  if (this->downloader_->get_bytes_read() < total) {
+    const size_t available = std::min(this->download_buffer_.free_capacity(), this->download_buffer_initial_size_);
+    if (available == 0) {
+      // Waiting for the decoder, not the network
+      this->last_data_time_ = now;
+    } else {
+      const int len = this->downloader_->read(this->download_buffer_.append(), available);
+      if (len > 0) {
+        this->last_data_time_ = now;
+        this->download_buffer_.write(len);
+        this->report_progress_(false);
+      } else if (len < 0) {
+        ESP_LOGE(TAG, "Error downloading image: %d", len);
+        this->fail_download_();
+        return;
+      } else if (now - this->last_data_time_ >= this->parent_->get_timeout()) {
+        ESP_LOGE(TAG, "No data received for %" PRIu32 " ms", this->parent_->get_timeout());
+        this->fail_download_();
+        return;
+      }
+    }
+  }
+  const bool arrived = this->downloader_->get_bytes_read() >= total;
+
+  if (!this->stream_started_) {
+    // The decoder reads the headers when it opens the image, so wait until they are in the buffer
+    if (!arrived && this->download_buffer_.free_capacity() != 0)
+      return;
+    const int err = this->begin_source(&this->source_);
+    if (err != 0) {
+      // Headers cut short by a full buffer fail to parse, or make the decoder seek past the buffer. Such an image
+      // still decodes once it is all in memory, as it did before JPEG images were decoded as they download.
+      if (!arrived && (err == runtime_image::DECODE_ERROR_INVALID_TYPE || err == runtime_image::DECODE_ERROR_READ)) {
+        ESP_LOGW(TAG,
+                 "The image headers do not fit the %zu byte download buffer, so the whole image is downloaded "
+                 "before it is decoded; increase buffer_size to decode it as it downloads",
+                 this->download_buffer_.size());
+        // grow() logs a failed allocation
+        if (this->download_buffer_.grow(total)) {
+          this->streaming_ = false;
+        } else {
+          this->fail_download_();
+        }
+        return;
+      }
+      ESP_LOGE(TAG, "Error decoding image: %s", runtime_image::decode_error_to_string(err));
+      this->fail_download_();
+      return;
+    }
+    this->source_.set_keep_read(false);
+    this->stream_started_ = true;
+    // Opening the image and allocating its buffer is enough for one pass
+    return;
+  }
+
+  do {
+    const int result = this->decode_step();
+    if (result == runtime_image::DECODE_STEP_MORE)
+      continue;
+    if (result == runtime_image::DECODE_STEP_DONE) {
+      this->finish_download_();
+    } else if (result == runtime_image::DECODE_STEP_NEED_DATA) {
+      if (!arrived)
+        return;
+      // JPEGDEC only waits for bytes short of the size it was given, so this guards against a hang
+      ESP_LOGE(TAG, "Download ended before the image was complete");
+      this->fail_download_();
+    } else {
+      ESP_LOGE(TAG, "Error decoding image: %s", runtime_image::decode_error_to_string(result));
+      this->fail_download_();
+    }
+    return;
+  } while (millis() - now < STREAM_PASS_BUDGET_MS);
+}
+
+void OnlineImage::report_progress_(bool force) {
+  const uint32_t now = App.get_loop_component_start_time();
+  const size_t bytes = this->downloader_->get_bytes_read();
+  const size_t total = this->downloader_->content_length;
+  // The last bytes are always reported, so a progress bar reaches 100%
+  if (!force && now - this->last_progress_time_ < PROGRESS_INTERVAL_MS && (total == 0 || bytes < total))
+    return;
+  this->last_progress_time_ = now;
+  const float progress = total > 0 ? std::min(100.0f, bytes * 100.0f / total) : NAN;
+  this->download_progress_callback_.call(progress, bytes);
+}
+
+void OnlineImage::fail_download_() {
+  this->end_connection_();
+  this->download_error_callback_.call();
+}
+
 void OnlineImage::finish_download_() {
   // Must be read before end_decode() ends the decoding session
   bool decoder_finished = this->is_decode_finished();
@@ -288,6 +404,8 @@ void OnlineImage::end_connection_() {
     this->downloader_ = nullptr;
   }
   this->download_buffer_.reset();
+  this->streaming_ = false;
+  this->stream_started_ = false;
   this->disable_loop();
 }
 

esphome/components/online_image/online_image.h

@@ -70,9 +70,17 @@ class OnlineImage final : public PollingComponent,
    */
   void release();
 
+  /// Called when the server has accepted the request and the image starts to download
+  template<typename F> void add_on_download_started_callback(F &&callback) {
+    this->download_started_callback_.add(std::forward<F>(callback));
+  }
   template<typename F> void add_on_finished_callback(F &&callback) {
     this->download_finished_callback_.add(std::forward<F>(callback));
   }
+  /// Called with the percentage downloaded (NAN when the server did not send the size) and the bytes read so far
+  template<typename F> void add_on_progress_callback(F &&callback) {
+    this->download_progress_callback_.add(std::forward<F>(callback));
+  }
   template<typename F> void add_on_error_callback(F &&callback) {
     this->download_error_callback_.add(std::forward<F>(callback));
   }
@@ -81,12 +89,20 @@ class OnlineImage final : public PollingComponent,
   bool validate_url_(const std::string &url);
   void end_connection_();
   void finish_download_();
+  /// loop() for a JPEG that is decoded as it downloads
+  void loop_stream_();
+  void fail_download_();
+  /// Reports download progress, at most every PROGRESS_INTERVAL_MS unless force is set
+  void report_progress_(bool force);
 
   CallbackManager<void(bool)> download_finished_callback_{};
   CallbackManager<void()> download_error_callback_{};
+  LazyCallbackManager<void()> download_started_callback_{};
+  LazyCallbackManager<void(float, size_t)> download_progress_callback_{};
 
   std::shared_ptr<http_request::HttpContainer> downloader_{nullptr};
   DownloadBuffer download_buffer_;
+  DownloadSource source_{download_buffer_};
   /**
    * This is the *initial* size of the download buffer, not the current size.
    * The download buffer can be resized at runtime; the download_buffer_initial_size_
@@ -109,6 +125,9 @@ class OnlineImage final : public PollingComponent,
 
   uint32_t start_time_{0};
   uint32_t last_data_time_{0};
+  uint32_t last_progress_time_{0};
+  bool streaming_{false};       // The decoder reads the download itself, as it arrives
+  bool stream_started_{false};  // The decoder has read the headers
 };
 
 }  // namespace esphome::online_image

esphome/components/opentherm/__init__.py

@@ -3,6 +3,7 @@ from typing import Any
 from esphome import automation, pins
 import esphome.codegen as cg
 from esphome.components import sensor
+from esphome.components.const import CONF_OUT_PIN
 from esphome.components.esp32 import include_builtin_idf_component
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, PLATFORM_ESP32, PLATFORM_ESP8266
@@ -15,7 +16,6 @@ DOMAIN = "opentherm"
 MULTI_CONF = True
 
 CONF_IN_PIN = "in_pin"
-CONF_OUT_PIN = "out_pin"
 CONF_CH_ENABLE = "ch_enable"
 CONF_DHW_ENABLE = "dhw_enable"
 CONF_COOLING_ENABLE = "cooling_enable"

esphome/components/pca6416a/pca6416a.h

@@ -27,7 +27,7 @@ class PCA6416AComponent final : public Component,
   void set_interrupt_pin(InternalGPIOPin *pin) { this->interrupt_pin_ = pin; }
 
  protected:
-  static void IRAM_ATTR gpio_intr(PCA6416AComponent *arg);
+  static void gpio_intr(PCA6416AComponent *arg);
   // Virtual methods from CachedGpioExpander
   bool digital_read_hw(uint8_t pin) override;
   bool digital_read_cache(uint8_t pin) override;

esphome/components/pca9505/pca9505.h

@@ -29,7 +29,7 @@ class PCA9505Component final : public Component,
   void dump_config() override;
 
  protected:
-  static void IRAM_ATTR gpio_intr(PCA9505Component *arg);
+  static void gpio_intr(PCA9505Component *arg);
 
   bool digital_read_hw(uint8_t pin) override;
   bool digital_read_cache(uint8_t pin) override;

esphome/components/pca9554/pca9554.h

@@ -38,7 +38,7 @@ class PCA9554Component final : public Component,
 #endif
 
  protected:
-  static void IRAM_ATTR gpio_intr(PCA9554Component *arg);
+  static void gpio_intr(PCA9554Component *arg);
 
   bool read_inputs_();
   bool write_register_(uint8_t reg, uint16_t value) { return this->write_address_(reg * this->reg_width_, value); }

esphome/components/pcf8574/pcf8574.h

@@ -33,7 +33,7 @@ class PCF8574Component final : public Component,
   void dump_config() override;
 
  protected:
-  static void IRAM_ATTR gpio_intr(PCF8574Component *arg);
+  static void gpio_intr(PCF8574Component *arg);
 
   bool digital_read_hw(uint8_t pin) override;
   bool digital_read_cache(uint8_t pin) override;

esphome/components/pi4ioe5v6408/pi4ioe5v6408.h

@@ -25,7 +25,7 @@ class PI4IOE5V6408Component final : public Component,
   void set_interrupt_pin(InternalGPIOPin *pin) { this->interrupt_pin_ = pin; }
 
  protected:
-  static void IRAM_ATTR gpio_intr(PI4IOE5V6408Component *arg);
+  static void gpio_intr(PI4IOE5V6408Component *arg);
 
   bool digital_read_hw(uint8_t pin) override;
   bool digital_read_cache(uint8_t pin) override;

esphome/components/pipsolar/pipsolar.cpp

@@ -656,6 +656,8 @@ void Pipsolar::handle_qpiws_(const char *message) {
         this->publish_binary_sensor_(enabled, this->warning_battery_equalization_);
         value_warnings_present |= enabled.value_or(false);
         break;
+      default:
+        break;
     }
   }