Merge remote-tracking branch 'upstream/dev' into 20260218-zigbee-proxy

[ble_device_base] Add platform-neutral GATT client contract (#18128 )
[core] Add StringRef::starts_with (#18142 )
2026-08-23 22:56:19 +00:00 · 2026-08-06 23:27:44 -05:00 · 2026-08-06 21:45:57 -05:00 · 2026-08-06 20:58:41 -05:00 · 2026-08-06 21:46:37 -04:00 · 2026-08-06 21:46:28 -04:00
551 changed files with 35830 additions and 9605 deletions
@@ -8,7 +8,7 @@ contact_links:
    url: https://github.com/esphome/esphome-webserver/issues/new/choose
    about: Report an issue with the ESPHome web server.
  - name: Report an issue with the ESPHome Builder / Dashboard
-    url: https://github.com/esphome/dashboard/issues/new/choose
+    url: https://github.com/esphome/device-builder/issues/new/choose
    about: Report an issue with the ESPHome Builder / Dashboard.
  - name: Report an issue with the ESPHome API client
    url: https://github.com/esphome/aioesphomeapi/issues/new/choose
@@ -13,6 +13,7 @@ module.exports = {
    'merging-to-release',
    'merging-to-beta',
    'chained-pr',
+    'stacked-pr',
    'core',
    'small-pr',
    'medium-pr',
@@ -33,8 +33,41 @@ async function fetchPrFileContent(github, context, path) {
  }
 }

+// Check whether a pull request is part of a GitHub stack.
+//
+// GitHub's stacked pull request feature adds a `stack` object to the pull
+// request resource. It is present on every pull request in the stack -
+// including the bottom one, whose base is already `dev` - and is absent
+// entirely on standalone pull requests.
+//
+// The `pull_request_target` webhook payload is not guaranteed to carry this
+// field, so fall back to asking the API when it is missing. Guessing wrong
+// here is costly: a stacked pull request mistaken for a manually chained one
+// gets a label that blocks merging.
+async function isStackedPr(github, context) {
+  const pr = context.payload.pull_request;
+  if (pr.stack != null) {
+    return true;
+  }
+
+  try {
+    const { owner, repo } = context.repo;
+    const { data } = await github.rest.pulls.get({
+      owner,
+      repo,
+      pull_number: pr.number,
+    });
+    return data.stack != null;
+  } catch (error) {
+    // Treat an API failure as "not stacked" so a chained pull request still
+    // gets its blocking label rather than silently slipping through.
+    console.log('Failed to check stack membership:', error.message);
+    return false;
+  }
+}
+
 // Strategy: Merge branch detection
-async function detectMergeBranch(context) {
+async function detectMergeBranch(github, context) {
  const labels = new Set();
  const baseRef = context.payload.pull_request.base.ref;

@@ -42,7 +75,11 @@ async function detectMergeBranch(context) {
    labels.add('merging-to-release');
  } else if (baseRef === 'beta') {
    labels.add('merging-to-beta');
+  } else if (await isStackedPr(github, context)) {
+    // GitHub manages the merge order for a stack, so these are not blocked.
+    labels.add('stacked-pr');
  } else if (baseRef !== 'dev') {
+    // A chain built by hand: it must not merge until its base branch does.
    labels.add('chained-pr');
  }

@@ -88,7 +88,7 @@ module.exports = async ({ github, context }) => {

  // Early exit for release and beta branches only
  if (baseRef === 'release' || baseRef === 'beta') {
-    const branchLabels = await detectMergeBranch(context);
+    const branchLabels = await detectMergeBranch(github, context);
    const finalLabels = Array.from(branchLabels);

    console.log('Computed labels (merge branch only):', finalLabels.join(', '));
@@ -118,7 +118,7 @@ module.exports = async ({ github, context }) => {
    deprecatedResult,
    maintainerAccess
  ] = await Promise.all([
-    detectMergeBranch(context),
+    detectMergeBranch(github, context),
    detectComponentPlatforms(changedFiles, apiData),
    detectNewComponents(github, context, prFiles),
    detectNewPlatforms(github, context, prFiles, apiData),
@@ -1,6 +1,7 @@
 const { describe, it } = require('node:test');
 const assert = require('node:assert/strict');
 const {
+  detectMergeBranch,
  detectNewPlatforms,
  detectNewComponents,
  detectPRSize,
@@ -36,6 +37,107 @@ const API_DATA = {
 const WITH_SCHEMA = 'CONFIG_SCHEMA = cv.Schema({})';
 const WITHOUT_SCHEMA = 'CODEOWNERS = ["@esphome/core"]';

+// ---------------------------------------------------------------------------
+// detectMergeBranch
+// ---------------------------------------------------------------------------
+
+// Builds a fresh context for detectMergeBranch tests instead of mutating the
+// shared CONTEXT fixture above (which other describe blocks rely on).
+function makeMergeContext(baseRef, { stack } = {}) {
+  const pull_request = { number: 1, base: { ref: baseRef } };
+  if (stack !== undefined) {
+    pull_request.stack = stack;
+  }
+  return {
+    repo: { owner: 'esphome', repo: 'esphome' },
+    payload: { pull_request }
+  };
+}
+
+// A GitHub API mock exposing only rest.pulls.get, with a call counter so
+// tests can assert whether the API fallback was actually invoked.
+function makeStackGithub({ stack = null, error = null } = {}) {
+  const state = { calls: 0 };
+  const github = {
+    rest: {
+      pulls: {
+        get: async () => {
+          state.calls++;
+          if (error) throw error;
+          return { data: { stack } };
+        }
+      }
+    }
+  };
+  return { github, state };
+}
+
+const STACK_INFO = { base: { ref: 'dev' }, id: 71540, number: 17978, position: 3, size: 3 };
+
+describe('detectMergeBranch', () => {
+  it('base ref release adds merging-to-release only and never checks the stack', async () => {
+    const { github, state } = makeStackGithub({ stack: STACK_INFO });
+    const context = makeMergeContext('release', { stack: STACK_INFO });
+    const labels = await detectMergeBranch(github, context);
+    assert.deepEqual(Array.from(labels).sort(), ['merging-to-release']);
+    assert.equal(state.calls, 0);
+  });
+
+  it('base ref beta adds merging-to-beta only and never checks the stack', async () => {
+    const { github, state } = makeStackGithub({ stack: STACK_INFO });
+    const context = makeMergeContext('beta', { stack: STACK_INFO });
+    const labels = await detectMergeBranch(github, context);
+    assert.deepEqual(Array.from(labels).sort(), ['merging-to-beta']);
+    assert.equal(state.calls, 0);
+  });
+
+  it('stack present on the webhook payload adds stacked-pr without calling the API', async () => {
+    const { github, state } = makeStackGithub();
+    const context = makeMergeContext('feature-branch', { stack: STACK_INFO });
+    const labels = await detectMergeBranch(github, context);
+    assert.deepEqual(Array.from(labels).sort(), ['stacked-pr']);
+    assert.equal(state.calls, 0);
+  });
+
+  it('stack absent from payload falls back to the API and adds stacked-pr', async () => {
+    const { github, state } = makeStackGithub({ stack: STACK_INFO });
+    const context = makeMergeContext('feature-branch');
+    const labels = await detectMergeBranch(github, context);
+    assert.deepEqual(Array.from(labels).sort(), ['stacked-pr']);
+    assert.equal(state.calls, 1);
+  });
+
+  it('bottom of a stack (base ref dev, stack present) still adds stacked-pr', async () => {
+    const { github, state } = makeStackGithub();
+    const context = makeMergeContext('dev', { stack: STACK_INFO });
+    const labels = await detectMergeBranch(github, context);
+    assert.deepEqual(Array.from(labels).sort(), ['stacked-pr']);
+    assert.equal(state.calls, 0);
+  });
+
+  it('not stacked, base ref not dev adds chained-pr', async () => {
+    const { github } = makeStackGithub({ stack: null });
+    const context = makeMergeContext('feature-branch');
+    const labels = await detectMergeBranch(github, context);
+    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
+  });
+
+  it('not stacked, base ref dev adds no labels', async () => {
+    const { github } = makeStackGithub({ stack: null });
+    const context = makeMergeContext('dev');
+    const labels = await detectMergeBranch(github, context);
+    assert.deepEqual(Array.from(labels).sort(), []);
+  });
+
+  it('a failed stack lookup falls back to not-stacked, so a feature-branch base adds chained-pr', async () => {
+    const { github, state } = makeStackGithub({ error: new Error('API unavailable') });
+    const context = makeMergeContext('feature-branch');
+    const labels = await detectMergeBranch(github, context);
+    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
+    assert.equal(state.calls, 1);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // detectNewPlatforms
 // ---------------------------------------------------------------------------
@@ -35,7 +35,7 @@ jobs:
          # Scope the minted App token to the minimum needed by auto-label-pr/*.js.
          permission-contents: read       # repos.getContent for CODEOWNERS and file lookups in detectors.js
          permission-issues: write        # listLabelsOnIssue, addLabels, removeLabel, list/createComment
-          permission-pull-requests: write  # pulls.listFiles, list/create/update/dismissReview
+          permission-pull-requests: write  # pulls.get, pulls.listFiles, list/create/update/dismissReview

      - name: Auto Label PR
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -71,11 +71,13 @@ jobs:

      - name: Determine tag and whether to push
        id: tag
+        env:
+          HEAD_REF: ${{ github.head_ref || github.ref_name }}
        run: |
          # Sanitize the branch name into a valid docker tag: replace invalid
          # characters, ensure the first character is valid (tags must start
          # with [A-Za-z0-9_]), and cap the length at 128 characters.
-          branch="${{ github.head_ref || github.ref_name }}"
+          branch="$HEAD_REF"
          tag="${branch//[^a-zA-Z0-9_.-]/-}"
          case "$tag" in
            [a-zA-Z0-9_]*) ;;
@@ -96,7 +98,7 @@ jobs:

      - name: Log in to the GitHub container registry
        if: steps.tag.outputs.push == 'true'
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -154,7 +156,7 @@ jobs:
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to the GitHub container registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -180,8 +182,8 @@ jobs:
      contents: read  # actions/checkout to load the test configs
    strategy:
      fail-fast: false
-      # Cap concurrency so this smoke test doesn't hog all the shared runners.
-      max-parallel: 2
+      # Modest cap so this smoke test leaves room on the shared runner pool.
+      max-parallel: 8
      matrix:
        # One entry per distinct toolchain. ESP32 variants (c3/c6/s2/s3/p4)
        # share a toolchain bundle, so esp32 is exercised on the base variant
@@ -65,203 +65,9 @@ jobs:
          python -m venv venv
          . venv/bin/activate
          python --version
-          uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt pre-commit
+          uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
          uv pip install -e .

-  pylint:
-    name: Check pylint
-    runs-on: ubuntu-24.04
-    needs:
-      - common
-      - determine-jobs
-    if: needs.determine-jobs.outputs.python-linters == 'true'
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Restore Python
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-          cache-key: ${{ needs.common.outputs.cache-key }}
-      - name: Run pylint
-        run: |
-          . venv/bin/activate
-          pylint -f parseable --persistent=n esphome
-      - name: Suggested changes
-        run: script/ci-suggest-changes
-        if: always()
-
-  ci-custom:
-    name: Run script/ci-custom
-    runs-on: ubuntu-24.04
-    needs:
-      - common
-      - determine-jobs
-    if: needs.determine-jobs.outputs.core-ci == 'true'
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Restore Python
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-          cache-key: ${{ needs.common.outputs.cache-key }}
-      - name: Register matcher
-        run: echo "::add-matcher::.github/workflows/matchers/ci-custom.json"
-      - name: Run script/ci-custom
-        run: |
-          . venv/bin/activate
-          script/ci-custom.py
-          script/build_codeowners.py --check
-          script/build_language_schema.py --check
-          script/generate-esp32-boards.py --check
-          script/generate-rp2-boards.py --check
-          script/ci_check_duplicate_test_ids.py
-          script/ci_check_test_fixture_list_form.py
-
-  import-time:
-    name: Check import esphome.__main__ time
-    runs-on: ubuntu-24.04
-    needs:
-      - common
-      - determine-jobs
-    if: needs.determine-jobs.outputs.import-time == 'true'
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Restore Python
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-          cache-key: ${{ needs.common.outputs.cache-key }}
-      - name: Check import time against budget and write waterfall HAR
-        run: |
-          . venv/bin/activate
-          script/check_import_time.py --check --har importtime.har
-      - name: Upload waterfall HAR
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: import-time-waterfall
-          path: importtime.har
-          if-no-files-found: ignore
-          retention-days: 14
-
-  device-builder:
-    name: Test downstream esphome/device-builder
-    runs-on: ubuntu-24.04
-    needs:
-      - common
-      - determine-jobs
-    if: needs.determine-jobs.outputs.device-builder == 'true'
-    steps:
-      - name: Check out esphome (this PR)
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          path: esphome
-      - name: Check out esphome/device-builder
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: esphome/device-builder
-          ref: main
-          path: device-builder
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.13"
-      - name: Set up uv
-        # Mirrors the install shape device-builder's own CI uses
-        # (esphome/device-builder#192): uv replaces pip for the
-        # install step (order-of-magnitude faster on cold boots,
-        # with its own wheel cache). actions/setup-python still
-        # provides the interpreter.
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-        with:
-          enable-cache: true
-          # Pull request saves land in per-PR scopes nothing else can
-          # reuse; dev pushes seed the shared copy instead.
-          save-cache: ${{ github.event_name != 'pull_request' }}
-          # Pin uv version so the action does not have to fetch the
-          # manifest from raw.githubusercontent.com on every cache
-          # miss; that fetch flakes on Windows runners.
-          version: "0.11.15"
-      - name: Install device-builder + esphome from PR
-        # Install device-builder with its esphome + test extras
-        # first so its pinned versions of pytest/etc. land, then
-        # overlay the PR's esphome so the downstream tests run
-        # against this PR's Python code. ``--system`` installs into
-        # the runner's Python instead of a venv.
-        run: |
-          uv pip install --system -e './device-builder[esphome,test]'
-          uv pip install --system -e ./esphome
-      - name: Run device-builder pytest
-        # ``-n auto`` runs under pytest-xdist (matches device-builder's
-        # own CI). No ``--cov`` here -- this is purely a downstream
-        # smoke check against this PR's esphome code. ``tests/e2e/slow``
-        # is excluded: those are real multi-minute toolchain compiles
-        # (LibreTiny SDK clone, native ESP-IDF install) that device-builder
-        # runs in its own dedicated jobs, not this smoke check.
-        working-directory: device-builder
-        run: pytest -q -n auto --maxfail=5 --durations=30 --no-cov --ignore=tests/benchmarks --ignore=tests/e2e/slow
-
-  pytest:
-    name: Run pytest
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version:
-          - "3.12"
-          - "3.13"
-          - "3.14"
-        os:
-          - ubuntu-latest
-          - macOS-latest
-          - windows-latest
-        exclude:
-          # Minimize CI resource usage
-          # by only running the Python version
-          # version used for docker images on Windows and macOS
-          - python-version: "3.13"
-            os: windows-latest
-          - python-version: "3.13"
-            os: macOS-latest
-    runs-on: ${{ matrix.os }}
-    needs:
-      - common
-      - determine-jobs
-    if: needs.determine-jobs.outputs.core-ci == 'true'
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Restore Python
-        id: restore-python
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: ${{ matrix.python-version }}
-          cache-key: ${{ needs.common.outputs.cache-key }}
-      - name: Register matcher
-        run: echo "::add-matcher::.github/workflows/matchers/pytest.json"
-      - name: Run pytest
-        if: matrix.os == 'windows-latest'
-        run: |
-          . ./venv/Scripts/activate.ps1
-          pytest -vv --cov-report=xml --tb=native --durations=30 -n auto tests --ignore=tests/integration/
-      - name: Run pytest
-        if: matrix.os == 'ubuntu-latest' || matrix.os == 'macOS-latest'
-        run: |
-          . venv/bin/activate
-          pytest -vv --cov-report=xml --tb=native --durations=30 -n auto tests --ignore=tests/integration/
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-      - name: Save Python virtual environment cache
-        if: github.ref == 'refs/heads/dev'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: venv
-          key: ${{ runner.os }}-${{ steps.restore-python.outputs.python-version }}-venv-${{ needs.common.outputs.cache-key }}
-
  determine-jobs:
    name: Determine which jobs to run
    runs-on: ubuntu-24.04
@@ -351,6 +157,169 @@ jobs:
          path: .temp/components_graph.json
          key: components-graph-${{ hashFiles('esphome/components/**/*.py') }}

+  ci-custom:
+    name: Run script/ci-custom
+    runs-on: ubuntu-24.04
+    needs:
+      - common
+      - determine-jobs
+    if: needs.determine-jobs.outputs.core-ci == 'true'
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Restore Python
+        uses: ./.github/actions/restore-python
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON }}
+          cache-key: ${{ needs.common.outputs.cache-key }}
+      - name: Register matcher
+        run: echo "::add-matcher::.github/workflows/matchers/ci-custom.json"
+      - name: Run script/ci-custom
+        run: |
+          . venv/bin/activate
+          script/ci-custom.py
+          script/build_codeowners.py --check
+          script/build_language_schema.py --check
+          script/generate-esp32-boards.py --check
+          script/generate-rp2-boards.py --check
+          script/ci_check_duplicate_test_ids.py
+          script/ci_check_test_fixture_list_form.py
+
+  pylint:
+    name: Check pylint
+    runs-on: ubuntu-24.04
+    needs:
+      - common
+      - determine-jobs
+    if: needs.determine-jobs.outputs.python-linters == 'true'
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Restore Python
+        uses: ./.github/actions/restore-python
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON }}
+          cache-key: ${{ needs.common.outputs.cache-key }}
+      - name: Run pylint
+        run: |
+          . venv/bin/activate
+          pylint -f parseable --persistent=n esphome
+      - name: Suggested changes
+        run: script/ci-suggest-changes
+        if: always()
+
+  lint-format:
+    name: Check lint and formatting
+    runs-on: ubuntu-latest
+    needs:
+      - determine-jobs
+    if: github.event_name == 'pull_request' && !startsWith(github.base_ref, 'beta') && !startsWith(github.base_ref, 'release') && needs.determine-jobs.outputs.core-ci == 'true'
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Run prek
+        uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
+        with:
+          # Keep in sync with requirements_test.txt.
+          prek-version: "0.4.11"
+          # This job only runs on pull requests, so nothing ever populates
+          # the cache on dev. Every run would miss and then write a per-pull
+          # request copy, which is what the old seed-cache job existed to
+          # avoid. Building the hooks from scratch takes seconds, so skip it.
+          cache: false
+        env:
+          PREK_SKIP: pylint,ci-custom
+      # Pushes any fixes the hooks made back to the pull request. This step
+      # must keep its default name: the GitHub App that performs the push
+      # locates the workflow run by that name.
+      - uses: pre-commit-ci/lite-action@5d6cc0eb514c891a40562a58a8e71576c5c7fb43 # v1.1.0
+        if: always()
+        with:
+          msg: apply automatic formatting fixes
+
+  pytest:
+    name: Run pytest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version:
+          - "3.12"
+          - "3.13"
+          - "3.14"
+        os:
+          - ubuntu-latest
+          - macOS-latest
+          - windows-latest
+        exclude:
+          # Minimize CI resource usage
+          # by only running the Python version
+          # version used for docker images on Windows and macOS
+          - python-version: "3.13"
+            os: windows-latest
+          - python-version: "3.13"
+            os: macOS-latest
+    runs-on: ${{ matrix.os }}
+    needs:
+      - common
+      - determine-jobs
+    if: needs.determine-jobs.outputs.core-ci == 'true'
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Restore Python
+        id: restore-python
+        uses: ./.github/actions/restore-python
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache-key: ${{ needs.common.outputs.cache-key }}
+      - name: Register matcher
+        run: echo "::add-matcher::.github/workflows/matchers/pytest.json"
+      - name: Run pytest
+        if: matrix.os == 'windows-latest'
+        run: |
+          . ./venv/Scripts/activate.ps1
+          pytest -vv --cov-report=xml --tb=native --durations=30 -n auto tests --ignore=tests/integration/
+      - name: Run pytest
+        if: matrix.os == 'ubuntu-latest' || matrix.os == 'macOS-latest'
+        run: |
+          . venv/bin/activate
+          pytest -vv --cov-report=xml --tb=native --durations=30 -n auto tests --ignore=tests/integration/
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      - name: Save Python virtual environment cache
+        if: github.ref == 'refs/heads/dev'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: venv
+          key: ${{ runner.os }}-${{ steps.restore-python.outputs.python-version }}-venv-${{ needs.common.outputs.cache-key }}
+
+  codecov-empty-upload:
+    name: Report no coverage to Codecov
+    runs-on: ubuntu-24.04
+    needs:
+      - determine-jobs
+    # ``pytest`` is the only job that uploads coverage, and it is skipped when
+    # every changed file is CI-irrelevant (see ``should_run_core_ci`` in
+    # ``script/determine-jobs.py``). With no upload Codecov never reports a
+    # result, so the required ``codecov/patch`` status stays pending forever and
+    # the pull request can never be merged. Tell Codecov up front that this
+    # commit has nothing to cover so it publishes a passing status instead.
+    #
+    # ``force`` skips Codecov's own check that every changed file is ignorable;
+    # ``determine-jobs`` has already decided none of these files can affect
+    # coverage, and Codecov would otherwise fail the status for paths it does
+    # not recognise as non-testable (``docker/**``, ``.yamllint``).
+    if: needs.determine-jobs.outputs.core-ci == 'false'
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Report empty upload to Codecov
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          run_command: empty-upload
+          force: true
+          fail_ci_if_error: true
+
  integration-tests:
    name: Run integration tests (${{ matrix.bucket.name }})
    runs-on: ubuntu-latest
@@ -365,6 +334,24 @@ jobs:
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install ccache
+        # Speeds up the host compiles: tests in a bucket compile overlapping
+        # component sets, so later tests reuse earlier tests' objects.
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends ccache
+      - name: Restore ccache (restore-only)
+        # esphome stores the PlatformIO ccache under the machine-global cache
+        # dir (see _ccache_env() in esphome/platformio/toolchain.py). The
+        # bucket-name prefix prefers a same-bucket seed; the bare prefix falls
+        # back to any seed when the bucket layout differs from dev.
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/esphome/platformio-ccache
+          key: integration-ccache-${{ matrix.bucket.name }}-${{ github.sha }}
+          restore-keys: |
+            integration-ccache-${{ matrix.bucket.name }}-
+            integration-ccache-
      - name: Set up Python 3.13
        id: python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -409,33 +396,46 @@ jobs:
          mapfile -t test_files < <(echo "$BUCKET_TESTS" | jq -r '.[]')
          echo "Bucket ${{ matrix.bucket.name }}: running ${#test_files[@]} integration tests"
          pytest -vv --no-cov --tb=native --durations=30 -n auto "${test_files[@]}"
+      - name: Print ccache statistics
+        # esphome stores the PlatformIO ccache under the machine-global cache
+        # dir (see _ccache_env() in esphome/platformio/toolchain.py).
+        run: CCACHE_DIR="$HOME/.cache/esphome/platformio-ccache" ccache -s
+      - name: Save ccache
+        # Pull request saves land in per-PR scopes nothing else can reuse;
+        # dev pushes seed the shared copy instead.
+        if: github.event_name != 'pull_request'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/esphome/platformio-ccache
+          key: integration-ccache-${{ matrix.bucket.name }}-${{ github.sha }}

-  cpp-unit-tests:
-    name: Run C++ unit tests
+  import-time:
+    name: Check import esphome.__main__ time
    runs-on: ubuntu-24.04
    needs:
      - common
      - determine-jobs
-    if: github.event_name == 'pull_request' && (needs.determine-jobs.outputs.cpp-unit-tests-run-all == 'true' || needs.determine-jobs.outputs.cpp-unit-tests-components != '[]')
+    if: needs.determine-jobs.outputs.import-time == 'true'
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
      - name: Restore Python
        uses: ./.github/actions/restore-python
        with:
          python-version: ${{ env.DEFAULT_PYTHON }}
          cache-key: ${{ needs.common.outputs.cache-key }}
-
-      - name: Run cpp_unit_test.py
+      - name: Check import time against budget and write waterfall HAR
        run: |
          . venv/bin/activate
-          if [ "${{ needs.determine-jobs.outputs.cpp-unit-tests-run-all }}" = "true" ]; then
-            script/cpp_unit_test.py --all
-          else
-            ARGS=$(echo '${{ needs.determine-jobs.outputs.cpp-unit-tests-components }}' | jq -r '.[] | @sh' | xargs)
-            script/cpp_unit_test.py $ARGS
-          fi
+          script/check_import_time.py --check --har importtime.har
+      - name: Upload waterfall HAR
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: import-time-waterfall
+          path: importtime.har
+          if-no-files-found: ignore
+          retention-days: 14

  benchmarks:
    name: Run CodSpeed benchmarks
@@ -466,7 +466,7 @@ jobs:
          echo "binary=$BINARY" >> $GITHUB_OUTPUT

      - name: Run CodSpeed benchmarks
-        uses: CodSpeedHQ/action@f99becdce5e5d51fd556489ebef684f4ecfd6286 # v4.18.5
+        uses: CodSpeedHQ/action@0ca9cbbf4623b599a6c3ed4fc8a922942705d9f1 # v5.0.2
        with:
          run: |
            . venv/bin/activate
@@ -474,6 +474,33 @@ jobs:
            pytest tests/benchmarks/python/ --codspeed --no-cov
          mode: simulation

+  cpp-unit-tests:
+    name: Run C++ unit tests
+    runs-on: ubuntu-24.04
+    needs:
+      - common
+      - determine-jobs
+    if: github.event_name == 'pull_request' && (needs.determine-jobs.outputs.cpp-unit-tests-run-all == 'true' || needs.determine-jobs.outputs.cpp-unit-tests-components != '[]')
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Restore Python
+        uses: ./.github/actions/restore-python
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON }}
+          cache-key: ${{ needs.common.outputs.cache-key }}
+
+      - name: Run cpp_unit_test.py
+        run: |
+          . venv/bin/activate
+          if [ "${{ needs.determine-jobs.outputs.cpp-unit-tests-run-all }}" = "true" ]; then
+            script/cpp_unit_test.py --all
+          else
+            ARGS=$(echo '${{ needs.determine-jobs.outputs.cpp-unit-tests-components }}' | jq -r '.[] | @sh' | xargs)
+            script/cpp_unit_test.py $ARGS
+          fi
+
  clang-tidy-single:
    name: ${{ matrix.name }}
    runs-on: ubuntu-24.04
@@ -489,7 +516,6 @@ jobs:
      ESPHOME_SDK_NRF_PREFIX: ~/.esphome-sdk-nrf
    strategy:
      fail-fast: false
-      max-parallel: 2
      matrix:
        include:
          - id: clang-tidy
@@ -680,7 +706,6 @@ jobs:
      ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf
    strategy:
      fail-fast: false
-      max-parallel: 3
      matrix:
        include:
          - id: clang-tidy
@@ -760,7 +785,6 @@ jobs:
      ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf
    strategy:
      fail-fast: false
-      max-parallel: 3
      matrix:
        include:
          - id: clang-tidy
@@ -847,7 +871,7 @@ jobs:
      ESPHOME_SDK_NRF_PREFIX: ~/.esphome-sdk-nrf
    strategy:
      fail-fast: false
-      max-parallel: ${{ (startsWith(github.base_ref, 'beta') || startsWith(github.base_ref, 'release')) && 8 || 4 }}
+      max-parallel: ${{ (startsWith(github.base_ref, 'beta') || startsWith(github.base_ref, 'release')) && 32 || 16 }}
      matrix:
        batch: ${{ fromJson(needs.determine-jobs.outputs.component-test-batches) }}
    steps:
@@ -1038,69 +1062,62 @@ jobs:
          # Arduino framework via PlatformIO (only components with an esp32-ard test are built):
          python3 script/test_build_components.py -e compile -t esp32-ard -c "$TEST_COMPONENTS" -f --toolchain platformio

-  pre-commit-seed-cache:
-    name: Seed pre-commit cache
-    runs-on: ubuntu-latest
-    needs:
-      - common
-    # Saves a dev-scoped pre-commit cache that pull request runs can
-    # restore, since pre-commit.ci lite itself never runs on dev pushes.
-    if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Restore Python
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-          cache-key: ${{ needs.common.outputs.cache-key }}
-      - name: Cache pre-commit environments
-        id: cache-pre-commit
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ~/.cache/pre-commit
-          # Must match the restore key in pre-commit-ci-lite
-          # yamllint disable-line rule:line-length
-          key: pre-commit-3|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
-      - name: Install pre-commit hook environments
-        if: steps.cache-pre-commit.outputs.cache-hit != 'true'
-        run: |
-          python -m pip install pre-commit
-          pre-commit install-hooks
-
-  pre-commit-ci-lite:
-    name: pre-commit.ci lite
-    runs-on: ubuntu-latest
+  device-builder:
+    name: Test downstream esphome/device-builder
+    runs-on: ubuntu-24.04
    needs:
      - common
      - determine-jobs
-    if: github.event_name == 'pull_request' && !startsWith(github.base_ref, 'beta') && !startsWith(github.base_ref, 'release') && needs.determine-jobs.outputs.core-ci == 'true'
+    if: needs.determine-jobs.outputs.device-builder == 'true'
    steps:
-      - name: Check out code from GitHub
+      - name: Check out esphome (this PR)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Restore Python
-        uses: ./.github/actions/restore-python
        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-          cache-key: ${{ needs.common.outputs.cache-key }}
-      # Inlined from esphome/pre-commit-action with a restore-only cache
-      # step: the pre-commit-seed-cache job owns saving this cache, so
-      # pull request runs never write per-PR copies.
-      - name: Restore pre-commit cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+          path: esphome
+      - name: Check out esphome/device-builder
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
-          path: ~/.cache/pre-commit
-          # Must match the key pre-commit-seed-cache saves
-          # yamllint disable-line rule:line-length
-          key: pre-commit-3|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
-      - name: Run pre-commit
-        env:
-          SKIP: pylint,ci-custom
+          repository: esphome/device-builder
+          ref: main
+          path: device-builder
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+      - name: Set up uv
+        # Mirrors the install shape device-builder's own CI uses
+        # (esphome/device-builder#192): uv replaces pip for the
+        # install step (order-of-magnitude faster on cold boots,
+        # with its own wheel cache). actions/setup-python still
+        # provides the interpreter.
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+          # Pull request saves land in per-PR scopes nothing else can
+          # reuse; dev pushes seed the shared copy instead.
+          save-cache: ${{ github.event_name != 'pull_request' }}
+          # Pin uv version so the action does not have to fetch the
+          # manifest from raw.githubusercontent.com on every cache
+          # miss; that fetch flakes on Windows runners.
+          version: "0.11.15"
+      - name: Install device-builder + esphome from PR
+        # Install device-builder with its esphome + test extras
+        # first so its pinned versions of pytest/etc. land, then
+        # overlay the PR's esphome so the downstream tests run
+        # against this PR's Python code. ``--system`` installs into
+        # the runner's Python instead of a venv.
        run: |
-          python -m pip install pre-commit
-          pre-commit run --show-diff-on-failure --color=always --all-files
-      - uses: pre-commit-ci/lite-action@5d6cc0eb514c891a40562a58a8e71576c5c7fb43 # v1.1.0
-        if: always()
+          uv pip install --system -e './device-builder[esphome,test]'
+          uv pip install --system -e ./esphome
+      - name: Run device-builder pytest
+        # ``-n auto`` runs under pytest-xdist (matches device-builder's
+        # own CI). No ``--cov`` here -- this is purely a downstream
+        # smoke check against this PR's esphome code. ``tests/e2e/slow``
+        # is excluded: those are real multi-minute toolchain compiles
+        # (LibreTiny SDK clone, native ESP-IDF install) that device-builder
+        # runs in its own dedicated jobs, not this smoke check.
+        working-directory: device-builder
+        run: pytest -q -n auto --maxfail=5 --durations=30 --no-cov --ignore=tests/benchmarks --ignore=tests/e2e/slow

  memory-impact-target-branch:
    name: Build target branch for memory impact
@@ -1401,21 +1418,27 @@ jobs:
  ci-status:
    name: CI Status
    runs-on: ubuntu-24.04
+    # Listed in the same order the jobs are defined above. One job is
+    # deliberately left out: "benchmarks" reports through CodSpeed rather than
+    # this check.
    needs:
      - common
+      - determine-jobs
      - ci-custom
      - pylint
+      - lint-format
      - pytest
+      - codecov-empty-upload
      - integration-tests
+      - import-time
+      - cpp-unit-tests
      - clang-tidy-single
      - clang-tidy-nosplit
      - clang-tidy-split
      - clang-tidy-esp32-variants
-      - determine-jobs
-      - device-builder
      - test-build-components-split
      - test-esp32-platformio
-      - pre-commit-ci-lite
+      - device-builder
      - memory-impact-target-branch
      - memory-impact-pr-branch
      - memory-impact-comment
@@ -56,7 +56,7 @@ jobs:

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
@@ -84,6 +84,6 @@ jobs:
          exit 1

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
        with:
          category: "/language:${{matrix.language}}"
@@ -70,7 +70,7 @@ jobs:
          pip3 install build
          python3 -m build
      - name: Publish
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          skip-existing: true

@@ -102,12 +102,12 @@ jobs:
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to docker hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Log in to the GitHub container registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -182,13 +182,13 @@ jobs:

      - name: Log in to docker hub
        if: matrix.registry == 'dockerhub'
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Log in to the GitHub container registry
        if: matrix.registry == 'ghcr'
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -6,61 +6,46 @@ on:
    - cron: "30 0 * * *"
  workflow_dispatch:

-permissions:
-  issues: write         # actions/stale labels, comments on, and closes stale issues
-  pull-requests: write  # actions/stale labels, comments on, and closes stale pull requests
-
-concurrency:
-  group: lock
+# The reusable workflow authenticates as the ESPHome GitHub App, so GITHUB_TOKEN
+# needs no permissions at all.
+permissions: {}

 jobs:
  stale:
    if: github.repository_owner == 'esphome'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Stale
-        uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
-        with:
-          debug-only: ${{ github.ref != 'refs/heads/dev' }} # Dry-run when not run on dev branch
-          remove-stale-when-updated: true
-          operations-per-run: 400
+    # No GITHUB_TOKEN permissions: the reusable workflow mints an ESPHome
+    # GitHub App token so the labels, comments and closures come from
+    # esphome[bot] instead of github-actions[bot].
+    uses: esphome/workflows/.github/workflows/stale.yml@61fd37a044cad4e9aa4303027b2a61b6a34da855  # main
+    secrets:
+      ESPHOME_GITHUB_APP_PRIVATE_KEY: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+    with:
+      # Live only on dev: a workflow_dispatch from any other branch is a dry run
+      dry-run: ${{ github.ref != 'refs/heads/dev' }}
+      days-before-stale: 90
+      days-before-close: 7
+      stale-label: stale
+      exempt-label: not-stale
+      ignored-users: esphbot,codecov-commenter
+      stale-pr-message: >
+        There hasn't been any activity on this pull request recently. This
+        pull request has been automatically marked as stale because of that
+        and will be closed if no further activity occurs within 7 days.

-          # The 90 day stale policy for PRs
-          # - PRs
-          # - No PRs marked as "not-stale"
-          # - No Issues (see below)
-          days-before-pr-stale: 90
-          days-before-pr-close: 7
-          stale-pr-label: "stale"
-          exempt-pr-labels: "not-stale"
-          stale-pr-message: >
-            There hasn't been any activity on this pull request recently. This
-            pull request has been automatically marked as stale because of that
-            and will be closed if no further activity occurs within 7 days.
+        If you are the author of this PR, please leave a comment if you want
+        to keep it open. Also, please rebase your PR onto the latest dev
+        branch to ensure that it's up to date with the latest changes.

-            If you are the author of this PR, please leave a comment if you want
-            to keep it open. Also, please rebase your PR onto the latest dev
-            branch to ensure that it's up to date with the latest changes.
+        Thank you for your contribution!
+      stale-issue-message: >
+        There hasn't been any activity on this issue recently. Due to the
+        high number of incoming GitHub notifications, we have to clean some
+        of the old issues, as many of them have already been resolved with
+        the latest updates.

-            Thank you for your contribution!
+        Please make sure to update to the latest ESPHome version and
+        check if that solves the issue. Let us know if that works for you by
+        adding a comment 👍

-          # The 90 day stale policy for Issues
-          # - Issues
-          # - No Issues marked as "not-stale"
-          # - No PRs (see above)
-          days-before-issue-stale: 90
-          days-before-issue-close: 7
-          stale-issue-label: "stale"
-          exempt-issue-labels: "not-stale"
-          stale-issue-message: >
-            There hasn't been any activity on this issue recently. Due to the
-            high number of incoming GitHub notifications, we have to clean some
-            of the old issues, as many of them have already been resolved with
-            the latest updates.
-
-            Please make sure to update to the latest ESPHome version and
-            check if that solves the issue. Let us know if that works for you by
-            adding a comment 👍
-
-            This issue has now been marked as stale and will be closed if no
-            further activity occurs. Thank you for your contributions.
+        This issue has now been marked as stale and will be closed if no
+        further activity occurs. Thank you for your contributions.
@@ -44,7 +44,7 @@ jobs:
      - name: Set up uv
        # An order of magnitude faster than pip on cold boots, with its
        # own wheel cache. ``--system`` (below) installs into the
-        # setup-python interpreter so subsequent ``pre-commit`` /
+        # setup-python interpreter so subsequent ``prek`` /
        # ``script/run-in-env.py`` steps find the deps without a
        # ``uv run`` prefix.
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
@@ -58,19 +58,19 @@ jobs:
      - name: Install Home Assistant
        run: |
          uv pip install --system -e lib/home-assistant
-          uv pip install --system -r requirements.txt -r requirements_test.txt pre-commit
+          uv pip install --system -r requirements.txt -r requirements_test.txt

      - name: Sync
        run: |
          python ./script/sync-device_class.py

-      - name: Apply pre-commit auto-fixes
+      - name: Apply prek auto-fixes
        # First pass: let formatters (ruff, end-of-file-fixer, etc.) modify
-        # files. pre-commit exits non-zero whenever a hook touches anything,
+        # files. prek exits non-zero whenever a hook touches anything,
        # which would otherwise abort the workflow before the auto-fixes
        # can flow into the sync PR.
        #
-        # SKIP:
+        # PREK_SKIP:
        #   - no-commit-to-branch is a local guard against committing on
        #     dev/release/beta; CI runs on dev by definition, and
        #     peter-evans/create-pull-request creates the branch itself.
@@ -79,25 +79,25 @@ jobs:
        #     the runtime deps (HA + requirements*.txt); main CI already
        #     gates pylint on real PRs.
        env:
-          SKIP: pylint,no-commit-to-branch
-        run: python script/run-in-env.py pre-commit run --all-files || true
+          PREK_SKIP: pylint,no-commit-to-branch
+        run: python script/run-in-env.py prek run --all-files || true

-      - name: Verify pre-commit clean
+      - name: Verify prek clean
        # Second pass: re-run all hooks against the now-fixed tree.
        # Auto-fixers exit 0 (nothing to change); any remaining failure
        # from a check-only hook (flake8 / yamllint / ci-custom) is a
-        # real issue and fails the workflow loudly. Same SKIP list as
+        # real issue and fails the workflow loudly. Same PREK_SKIP list as
        # above for the same reasons.
        env:
-          SKIP: pylint,no-commit-to-branch
-        run: python script/run-in-env.py pre-commit run --all-files
+          PREK_SKIP: pylint,no-commit-to-branch
+        run: python script/run-in-env.py prek run --all-files

      - name: Commit changes
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          commit-message: "Synchronise Device Classes from Home Assistant"
-          committer: esphomebot <esphome@openhomefoundation.org>
-          author: esphomebot <esphome@openhomefoundation.org>
+          committer: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
+          author: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
          branch: sync/device-classes
          delete-branch: true
          title: "Synchronise Device Classes from Home Assistant"
@@ -133,6 +133,8 @@ CTestTestfile.cmake
 .gcc-flags.json

 config/
+# Test fixture config/ directories are tracked (the rule above is the dashboard dir)
+!tests/component_tests/**/config/
 tests/build/
 tests/.esphome/
 /.temp-clang-tidy.cpp
@@ -388,7 +388,10 @@ This document provides essential context for AI models interacting with this pro
        ```
        Register with `@automation.register_condition("my_component.is_active", MyCondition, schema)`.

+*   **Type Hints:** Type-hint all function signatures, including test functions and config validators (e.g. `def validate_x(config: ConfigType) -> ConfigType:`, `def test_x() -> None:`). Import `ConfigType` from `esphome.types`.
+
 *   **Configuration Validation:**
+    *   **Reuse existing validators:** Before writing a custom validator, check for an existing one in `config_validation.py` and compose it in `cv.All(...)` rather than duplicating logic across components. For example, rename a config key with `cv.rename_key(CONF_OLD, CONF_NEW, removed_in="2026.6.0")`, and reject mutually-exclusive keys with `cv.has_at_most_one_key(...)` / `cv.has_exactly_one_key(...)`. See how `api` composes `cv.has_exactly_one_key` + `cv.rename_key`.
    *   **Common Validators:** `cv.int_`, `cv.float_`, `cv.string`, `cv.boolean`, `cv.int_range(min=0, max=100)`, `cv.positive_int`, `cv.percentage`.
    *   **Complex Validation:** `cv.All(cv.string, cv.Length(min=1, max=50))`, `cv.Any(cv.int_, cv.string)`.
    *   **Platform-Specific:** `cv.only_on(["esp32", "esp8266"])`, `esp32.only_on_variant(...)`, `cv.only_on_esp32`, `cv.only_on_esp8266`, `cv.only_on_rp2040`.
@@ -401,6 +404,7 @@ This document provides essential context for AI models interacting with this pro
         .extend(i2c.i2c_device_schema(0x48))
         .extend(spi.spi_device_schema(cs_pin_required=True))
        ```
+    *   **Constants:** `esphome/const.py` is frozen — do not add new `CONF_` constants there. Define a component-local constant in the component's own `.py` (as with `CONF_PARAM` above); for a constant shared by multiple components, add it to `esphome/components/const/__init__.py`. CI (`lint_constants_usage`) fails if the same constant is defined in three or more component files. Constants used in core files (i.e. those not under `esphome/components`) may be added to `esphome/const.py` but will require adjustment to the CI validation check.

 ## 5. Key Files & Entrypoints

@@ -408,7 +412,7 @@ This document provides essential context for AI models interacting with this pro
 *   **Configuration:**
    *   `pyproject.toml`: Defines the Python project metadata and dependencies.
    *   `platformio.ini`: Configures the PlatformIO build environments for different microcontrollers.
-    *   `.pre-commit-config.yaml`: Configures the pre-commit hooks for linting and formatting.
+    *   `.pre-commit-config.yaml`: Configures the lint and format hooks, run by `prek`.
 *   **CI/CD Pipeline:** Defined in `.github/workflows`.
 *   **Static Analysis & Development:**
    *   `esphome/core/defines.h`: A comprehensive header file containing all `#define` directives that can be added by components using `cg.add_define()` in Python. This file is used exclusively for development, static analysis tools, and CI testing - it is not used during runtime compilation. When developing components that add new defines, they must be added to this file to ensure proper IDE support and static analysis coverage. The file includes feature flags, build configurations, and platform-specific defines that help static analyzers understand the complete codebase without needing to compile for specific platforms.
@@ -416,7 +420,7 @@ This document provides essential context for AI models interacting with this pro
 ## 6. Development & Testing Workflow

 *   **Local Development Environment:** Use the provided Docker container or create a Python virtual environment and install dependencies from `requirements_dev.txt`.
-*   **Running Commands:** Use the `script/run-in-env.py` script to execute commands within the project's virtual environment. For example, to run the linter: `python3 script/run-in-env.py pre-commit run`.
+*   **Running Commands:** Use the `script/run-in-env.py` script to execute commands within the project's virtual environment. For example, to run the linter: `python3 script/run-in-env.py prek run`.
 *   **Testing:**
    *   **Python:** Run unit tests with `pytest`.
    *   **C++:** Use `clang-tidy` for static analysis.
@@ -489,9 +493,9 @@ This document provides essential context for AI models interacting with this pro
    1.  **Fork & Branch:** Create a new branch based on the `dev` branch (always use `git checkout -b <branch-name> dev` to ensure you're branching from `dev`, not the currently checked out branch).
    2.  **Make Changes:** Adhere to all coding conventions and patterns.
    3.  **Test:** Create component tests for all supported platforms and run the full test suite locally.
-    4.  **Lint:** Run `pre-commit` to ensure code is compliant.
+    4.  **Lint:** Run `prek` to ensure code is compliant.
    5.  **Commit:** Commit your changes. There is no strict format for commit messages.
-    6.  **Pull Request:** Submit a PR against the `dev` branch. The Pull Request title should have a prefix of the component being worked on (e.g., `[display] Fix bug`, `[abc123] Add new component`). Update documentation, examples, and add `CODEOWNERS` entries as needed. Pull requests should always be made using the `.github/PULL_REQUEST_TEMPLATE.md` template - fill out all sections completely without removing any parts of the template.
+    6.  **Pull Request:** Submit a PR against the `dev` branch. The Pull Request title must start with a `[tag]` prefix. For component work, use the component name (e.g., `[display] Fix bug`, `[abc123] Add new component`); for changes to shared/core code that isn't tied to a single component, use `[core]` (e.g., `[core] Add validator`). Update documentation, examples, and add `CODEOWNERS` entries as needed. Pull requests should always be made using the `.github/PULL_REQUEST_TEMPLATE.md` template - fill out all sections completely without removing any parts of the template.

 *   **Documentation Contributions:**
    *   Documentation is hosted in the separate `esphome/esphome.io` repository.
@@ -729,6 +733,16 @@ This document provides essential context for AI models interacting with this pro
    ```

 *   **Deprecation Pattern (Python):**
+    For a renamed config key, use the shared `cv.rename_key` validator with `removed_in` (and `component` for context) — it warns and auto-migrates:
+    ```python
+    CONFIG_SCHEMA = cv.All(
+        cv.rename_key(
+            CONF_OLD_KEY, CONF_NEW_KEY, removed_in="2026.6.0", component="my_component"
+        ),
+        cv.Schema({ ... }),
+    )
+    ```
+    For other deprecations, warn manually during validation:
    ```python
    # Remove before 2026.6.0
    if CONF_OLD_KEY in config:
@@ -70,6 +70,7 @@ esphome/components/bh1900nux/* @B48D81EFCC
 esphome/components/binary_sensor/* @esphome/core
 esphome/components/bk72xx/* @kuba2k2
 esphome/components/bk72xx_ble/* @Bl00d-B0b
+esphome/components/bk72xx_ble_tracker/* @Bl00d-B0b
 esphome/components/bl0906/* @athom-tech @jesserockz @tarontop
 esphome/components/bl0939/* @ziceva
 esphome/components/bl0940/* @dan-s-github @tobias-
@@ -287,6 +288,7 @@ esphome/components/ld2412/* @Rihan9
 esphome/components/ld2420/* @descipher
 esphome/components/ld2450/* @hareeshmu
 esphome/components/ld24xx/* @kbx81
+esphome/components/ld6002b/* @hepter
 esphome/components/ledc/* @OttoWinter
 esphome/components/libretiny/* @kuba2k2
 esphome/components/libretiny_pwm/* @kuba2k2
@@ -294,6 +296,8 @@ esphome/components/light/* @esphome/core
 esphome/components/lightwaverf/* @max246
 esphome/components/lilygo_t5_47/touchscreen/* @jesserockz
 esphome/components/lm75b/* @beormund
+esphome/components/ln882h_ble/* @Bl00d-B0b
+esphome/components/ln882h_ble_tracker/* @Bl00d-B0b
 esphome/components/ln882x/* @lamauny
 esphome/components/lock/* @esphome/core
 esphome/components/logger/* @esphome/core
@@ -348,6 +352,7 @@ esphome/components/mlx90393/* @functionpointer
 esphome/components/mlx90614/* @jesserockz
 esphome/components/mmc5603/* @benhoff
 esphome/components/mmc5983/* @agoode
+esphome/components/modbus_client/* @exciton
 esphome/components/modbus_controller/* @martgras
 esphome/components/modbus_controller/binary_sensor/* @martgras
 esphome/components/modbus_controller/number/* @martgras
@@ -436,6 +441,7 @@ esphome/components/rp2/* @jesserockz
 esphome/components/rp2040_ble/* @bdraco
 esphome/components/rp2040_pio_led_strip/* @Papa-DMan
 esphome/components/rp2040_pwm/* @jesserockz
+esphome/components/rp2_ble_tracker/* @bdraco
 esphome/components/rpi_dpi_rgb/* @clydebarrow
 esphome/components/rtl87xx/* @kuba2k2
 esphome/components/rtttl/* @glmnet @ximex
@@ -626,6 +632,7 @@ esphome/components/xpt2046/touchscreen/* @nielsnl68 @numo68
 esphome/components/xxtea/* @clydebarrow
 esphome/components/zephyr/* @tomaszduda23
 esphome/components/zephyr_mcumgr/ota/* @tomaszduda23
+esphome/components/zephyr_pwm/* @wiomoc
 esphome/components/zhlt01/* @cfeenstra1024
 esphome/components/zigbee/* @luar123 @tomaszduda23
 esphome/components/zio_ultrasonic/* @kahrendt
@@ -22,7 +22,7 @@ RUN \
    -r /requirements.txt

 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.7.0
+RUN uv pip install --no-cache-dir esphome-device-builder==1.9.3

 RUN \
    platformio settings set enable_telemetry No \
@@ -2,16 +2,12 @@
 import argparse
 from collections.abc import Callable
 from contextlib import suppress
-from datetime import datetime
 import functools
-import getpass
 import importlib
 import logging
 import os
 from pathlib import Path
 import re
-import shutil
-import subprocess
 import sys
 import time
 from typing import Protocol
@@ -19,16 +15,18 @@ from typing import Protocol
 # Note: Do not import modules from esphome.components here, as this would
 # cause them to be loaded before external components are processed, resulting
 # in the built-in version being used instead of the external component one.
-from esphome import const
+from esphome import const, platform_hooks
 from esphome.const import (
    ALLOWED_NAME_CHARS,
    ARGUMENT_HELP_DEVICE,
+    BUNDLE_EXTENSION,
    CONF_API,
    CONF_AUTH,
    CONF_BAUD_RATE,
    CONF_BROKER,
    CONF_DEASSERT_RTS_DTR,
    CONF_DISABLED,
+    CONF_DISCOVER_IP,
    CONF_ESPHOME,
    CONF_LEVEL,
    CONF_LOG_TOPIC,
@@ -48,6 +46,8 @@ from esphome.const import (
    CONF_WEB_SERVER,
    CONF_WIFI,
    ENV_NOGITIGNORE,
+    KEY_ESP32,
+    KEY_VARIANT,
    SECRETS_FILES,
    Toolchain,
 )
@@ -55,6 +55,7 @@ from esphome.core import CORE, EsphomeError, coroutine
 from esphome.enum import StrEnum
 from esphome.helpers import get_bool_env, indent, is_ip_address
 from esphome.log import AnsiFore, color, setup_log
+from esphome.stacktrace import LogLineProcessor
 from esphome.types import ConfigType
 from esphome.upload_targets import PortType, get_port_type
 from esphome.util import (
@@ -484,8 +485,6 @@ def has_web_server_ota() -> bool:

 def has_mqtt_ip_lookup() -> bool:
    """Check if MQTT is available and IP lookup is supported."""
-    from esphome.components.mqtt import CONF_DISCOVER_IP
-
    if CONF_MQTT not in CORE.config:
        return False
    # Default Enabled
@@ -618,6 +617,8 @@ def _resolve_network_devices(


 def run_miniterm(config: ConfigType, port: str, args) -> int:
+    from datetime import datetime
+
    from aioesphomeapi import LogParser
    import serial

@@ -630,18 +631,9 @@ def run_miniterm(config: ConfigType, port: str, args) -> int:
        return 1
    _LOGGER.info("Starting log output from %s with baud rate %s", port, baud_rate)

-    process_stacktrace = None
-
-    try:
-        module = importlib.import_module("esphome.components." + CORE.target_platform)
-        process_stacktrace = module.process_stacktrace
-    except (AttributeError, ImportError):
-        _LOGGER.info(
-            'Stacktrace analysis is unavailable: no compatible analyzer found for target platform "%s".',
-            CORE.target_platform,
-        )
-
-    backtrace_state = False
+    # Decoder resolution, crash isolation, and disable-after-failure
+    # all live in LogLineProcessor, shared with the API log path.
+    processor = LogLineProcessor(config, CORE.target_platform)
    ser = serial.Serial()
    ser.baudrate = baud_rate
    ser.port = port
@@ -681,11 +673,7 @@ def run_miniterm(config: ConfigType, port: str, args) -> int:
                                "utf8", "backslashreplace"
                            )
                            safe_print(parser.parse_line(line, time_str))
-
-                            if process_stacktrace is not None:
-                                backtrace_state = process_stacktrace(
-                                    config, line, backtrace_state
-                                )
+                            processor.process_line(line)
                    except serial.SerialException:
                        _LOGGER.error("Serial port closed!")
                        return 0
@@ -930,9 +918,10 @@ def upload_using_esptool(

    mcu = "esp8266"
    if CORE.is_esp32:
-        from esphome.components.esp32 import get_esp32_variant
-
-        mcu = get_esp32_variant().lower()
+        # Same lookup as esp32.get_esp32_variant(), read directly so the
+        # serial upload path does not import the esp32 package; both the
+        # validator and the warm-cache apply_to_core populate this key.
+        mcu = CORE.data[KEY_ESP32][KEY_VARIANT].lower()

    line_callbacks: list[Callable[[str], str | None]] = []
    if (
@@ -986,6 +975,8 @@ def upload_using_esptool(


 def upload_using_platformio(config: ConfigType, port: str) -> int:
+    import shutil
+
    from esphome.platformio import toolchain

    # RP2040 platform-raspberrypi build recipe expects firmware.bin.signed for
@@ -1023,6 +1014,8 @@ def upload_using_picotool(config: ConfigType) -> int:
    the mass storage copy approach that causes "disk not ejected properly"
    warnings on macOS.
    """
+    import subprocess
+
    from esphome.platformio import toolchain

    idedata = toolchain.get_idedata(config)
@@ -1129,6 +1122,8 @@ def check_permissions(port: str):
                "the USB cable can be used for data and is not a power-only cable."
            )
        if not (os.access(port, os.R_OK | os.W_OK)):
+            import getpass
+
            raise EsphomeError(
                "You do not have read or write permission on the selected serial port. "
                "To resolve this issue, you can add your user to the dialout group "
@@ -1141,12 +1136,11 @@ def upload_program(
    config: ConfigType, args: ArgsProtocol, devices: list[str]
 ) -> tuple[int, str | None]:
    host = devices[0]
-    try:
-        module = importlib.import_module("esphome.components." + CORE.target_platform)
-        if module.upload_program(config, args, host):
-            return 0, host
-    except AttributeError:
-        pass
+    platform_upload = platform_hooks.get_platform_hook(
+        CORE.target_platform, "upload_program"
+    )
+    if platform_upload is not None and platform_upload(config, args, host):
+        return 0, host

    port_type = get_port_type(host)

@@ -1406,12 +1400,11 @@ def _should_subscribe_states(args: ArgsProtocol) -> bool:


 def show_logs(config: ConfigType, args: ArgsProtocol, devices: list[str]) -> int | None:
-    try:
-        module = importlib.import_module("esphome.components." + CORE.target_platform)
-        if module.show_logs(config, args, devices):
-            return 0
-    except AttributeError:
-        pass
+    platform_show_logs = platform_hooks.get_platform_hook(
+        CORE.target_platform, "show_logs"
+    )
+    if platform_show_logs is not None and platform_show_logs(config, args, devices):
+        return 0

    if "logger" not in config:
        raise EsphomeError("Logger is not configured!")
@@ -1429,7 +1422,7 @@ def show_logs(config: ConfigType, args: ArgsProtocol, devices: list[str]) -> int
    if has_api() and (
        network_devices := _resolve_network_devices(devices, config, args)
    ):
-        from esphome.components.api.client import run_logs
+        from esphome.api_client import run_logs

        return run_logs(
            config,
@@ -1713,7 +1706,7 @@ def command_clean(args: ArgsProtocol, config: ConfigType) -> int | None:


 def command_bundle(args: ArgsProtocol, config: ConfigType) -> int | None:
-    from esphome.bundle import BUNDLE_EXTENSION, ConfigBundleCreator
+    from esphome.bundle import ConfigBundleCreator

    creator = ConfigBundleCreator(config)

@@ -2563,10 +2556,11 @@ def run_esphome(argv):
        return 0

    # Bundle support: if the configuration is a .esphomebundle, extract it
-    # and rewrite conf_path to the extracted YAML config.
-    from esphome.bundle import is_bundle_path, prepare_bundle_for_compile
+    # and rewrite conf_path to the extracted YAML config. The suffix check
+    # stays inline so the ordinary run never imports esphome.bundle.
+    if conf_path.name.lower().endswith(BUNDLE_EXTENSION):
+        from esphome.bundle import prepare_bundle_for_compile

-    if is_bundle_path(conf_path):
        _LOGGER.info("Extracting config bundle %s...", conf_path)
        conf_path = prepare_bundle_for_compile(conf_path)
        # Update the argument so downstream code sees the extracted path
@@ -2607,6 +2601,8 @@ def run_esphome(argv):
        config = read_config(
            command_line_substitutions,
            skip_external_update=skip_external,
+            # Snapshot only needed by `esphome config --no-defaults`.
+            snapshot_user_config=getattr(args, "no_defaults", False),
        )
        # Refresh the cache so the next upload/logs hits the fast path
        # instead of re-running read_config. Skip when the storage
@@ -0,0 +1,117 @@
+from __future__ import annotations
+
+import asyncio
+from contextlib import suppress
+import logging
+from typing import TYPE_CHECKING, Any
+import warnings
+
+# Suppress protobuf version warnings
+with warnings.catch_warnings():
+    warnings.filterwarnings(
+        "ignore", category=UserWarning, message=".*Protobuf gencode version.*"
+    )
+    from aioesphomeapi import APIClient, parse_log_message
+    from aioesphomeapi.log_runner import async_run
+
+from esphome.const import CONF_ENCRYPTION, CONF_KEY, CONF_PORT, __version__
+from esphome.core import CORE
+from esphome.stacktrace import LogLineProcessor
+from esphome.util import safe_print
+
+if TYPE_CHECKING:
+    from aioesphomeapi.api_pb2 import (
+        SubscribeLogsResponse,  # pylint: disable=no-name-in-module
+    )
+
+
+_LOGGER = logging.getLogger(__name__)
+
+
+async def async_run_logs(
+    config: dict[str, Any],
+    addresses: list[str],
+    subscribe_states: bool = True,
+) -> None:
+    """Run the logs command in the event loop."""
+    from datetime import datetime
+
+    conf = config["api"]
+    name = config["esphome"]["name"]
+    port: int = int(conf[CONF_PORT])
+    noise_psk: str | None = None
+    if (encryption := conf.get(CONF_ENCRYPTION)) and (key := encryption.get(CONF_KEY)):
+        noise_psk = key
+
+    _LOGGER.info(
+        "Starting log output from %s using esphome API", " or ".join(addresses)
+    )
+
+    cli = APIClient(
+        addresses[0],  # Primary address for compatibility
+        port,
+        "",  # Password auth removed in 2026.1.0
+        client_info=f"ESPHome Logs {__version__}",
+        noise_psk=noise_psk,
+        addresses=addresses,  # Pass all addresses for automatic retry
+        provide_time=False,
+    )
+
+    # Decoder resolution policy lives in LogLineProcessor.
+    processor = LogLineProcessor(config, CORE.target_platform)
+
+    def on_log(msg: SubscribeLogsResponse) -> None:
+        """Handle a new log message."""
+        time_ = datetime.now().astimezone()
+        message: bytes = msg.message
+        text = message.decode("utf8", "backslashreplace")
+        nanoseconds = time_.microsecond // 1000
+        timestamp = (
+            f"[{time_.hour:02}:{time_.minute:02}:{time_.second:02}.{nanoseconds:03}]"
+        )
+        for parsed_msg in parse_log_message(text, timestamp):
+            # safe_print handles the dashboard \033 escaping and falls back
+            # to backslashreplace encoding on stdouts that can't represent
+            # the wifi signal-bar block characters (Windows redirected
+            # cp1252 pipe).
+            safe_print(parsed_msg)
+        for raw_line in text.splitlines():
+            processor.process_line(raw_line)
+
+    # Safe to fall back to plaintext here only for this diagnostics use
+    # case: the stream is one-way from device to client, and this code
+    # never accepts commands or acts on any message the device sends.
+    # An on-path attacker could still both inject fabricated log lines
+    # and passively read the device's log output (and any state data
+    # delivered when subscribe_states is enabled), so this does lose
+    # confidentiality as well as authentication/integrity. That tradeoff
+    # is acceptable for operator-visible logs, which aioesphomeapi also
+    # warns may come from an unverified device. Never mirror this opt-in
+    # for any connection that sends data to the device or uses Home
+    # Assistant actions.
+    stop = await async_run(
+        cli,
+        on_log,
+        name=name,
+        subscribe_states=subscribe_states,
+        allow_plaintext_fallback=True,
+        # A top-level ``deep_sleep:`` block means the device is only awake
+        # briefly; cap the reconnect backoff so a wake window is not missed.
+        deep_sleep="deep_sleep" in config,
+    )
+    try:
+        await asyncio.Event().wait()
+    finally:
+        await stop()
+
+
+def run_logs(
+    config: dict[str, Any],
+    addresses: list[str],
+    subscribe_states: bool = True,
+) -> None:
+    """Run the logs command."""
+    with suppress(KeyboardInterrupt):
+        asyncio.run(
+            async_run_logs(config, addresses, subscribe_states=subscribe_states)
+        )
@@ -11,43 +11,136 @@ from __future__ import annotations

 import asyncio
 from collections.abc import Awaitable, Callable
+from itertools import count
+import logging
 import threading
+from typing import cast
+
+_LOGGER = logging.getLogger(__name__)
+
+# How long the orphan watcher waits for an abandoned coroutine before giving
+# up, so a hung operation does not park a watcher thread forever.
+ORPHAN_WAIT_TIMEOUT = 300.0
+
+
+_runner_ids = count(1)
+
+
+class AsyncDispatchTimeout(TimeoutError):
+    """The caller stopped waiting; the coroutine was abandoned.
+
+    A subclass so callers can tell the dispatcher's own expiry apart from a
+    ``TimeoutError`` raised inside the coroutine, while existing
+    ``except TimeoutError`` handlers keep working.
+    """


 class AsyncThreadRunner[T](threading.Thread):
    """Run an async coroutine in a daemon thread and expose its result.

-    The runner catches all exceptions from the coroutine and stores them in
-    ``exception`` so ``event`` is always set — this prevents callers waiting
-    on ``event`` from hanging forever when the coroutine crashes.
-
-    Typical usage::
-
-        runner = AsyncThreadRunner(lambda: my_coro(arg))
-        runner.start()
-        if not runner.event.wait(timeout=5.0):
-            ...  # timed out
-        if runner.exception is not None:
-            raise runner.exception
-        result = runner.result
+    ``event`` is always set, even when the coroutine crashes, so waiters
+    never hang; ``completed`` distinguishes a delivered result (even a
+    legitimate ``None``) from a coroutine that never finished. Prefer
+    :func:`run_async`; use this class directly only when a failure should
+    degrade to a default value instead of raising.
    """

    def __init__(self, coro_factory: Callable[[], Awaitable[T]]) -> None:
-        super().__init__(daemon=True)
+        super().__init__(daemon=True, name=f"async-thread-runner-{next(_runner_ids)}")
        self._coro_factory = coro_factory
        self.result: T | None = None
        self.exception: BaseException | None = None
+        self.completed = False
        self.event = threading.Event()

    async def _runner(self) -> None:
        try:
            self.result = await self._coro_factory()
-        except Exception as exc:  # noqa: BLE001  # pylint: disable=broad-except
-            # Capture all exceptions so ``event`` is always set — otherwise a
-            # crash would hang the waiter forever.
+            # Distinguishes a delivered result from "never ran", since None
+            # is a valid result value.
+            self.completed = True
+        except BaseException as exc:  # noqa: BLE001  # pylint: disable=broad-except
+            # Capture everything, including BaseException — otherwise a
+            # cancellation or SystemExit would leave ``exception`` unset and
+            # waiters would mistake the empty ``result`` for success.
            self.exception = exc
        finally:
            self.event.set()

    def run(self) -> None:
-        asyncio.run(self._runner())
+        try:
+            asyncio.run(self._runner())
+        except BaseException as exc:  # noqa: BLE001  # pylint: disable=broad-except
+            # asyncio.run itself can fail before _runner executes (e.g. loop
+            # creation under fd exhaustion); record it so waiters never hang.
+            # A failure during loop cleanup after the coroutine completed
+            # must not clobber the delivered result, hence the guard.
+            if self.exception is None and not self.completed:
+                self.exception = exc
+            else:
+                _LOGGER.debug(
+                    "Event loop teardown failed after outcome recorded",
+                    exc_info=True,
+                )
+        finally:
+            self.event.set()
+
+
+def run_async[T](
+    coro_factory: Callable[[], Awaitable[T]],
+    timeout: float | None = None,
+    on_orphan: Callable[[T], None] | None = None,
+) -> T:
+    """Run a coroutine in a daemon-thread event loop and return its result.
+
+    Raises :class:`AsyncDispatchTimeout` if the coroutine does not finish
+    within ``timeout`` seconds; the thread is abandoned and exits with the
+    interpreter. If the abandoned coroutine later produces a result,
+    ``on_orphan`` (if given) is called with it so resources such as a
+    connected socket can be released; delivery is best effort and bounded
+    by ``ORPHAN_WAIT_TIMEOUT``.
+    """
+    runner: AsyncThreadRunner[T] = AsyncThreadRunner(coro_factory)
+    runner.start()
+    if not runner.event.wait(timeout):
+
+        def _cleanup() -> None:
+            if not runner.event.wait(ORPHAN_WAIT_TIMEOUT):
+                # The one state where a resource can genuinely leak; leave
+                # a trace so a recurring hang is attributable.
+                _LOGGER.info(
+                    "Orphan watcher gave up after %.0fs; a late result may leak",
+                    ORPHAN_WAIT_TIMEOUT,
+                )
+                return
+            if not runner.completed:
+                # The only place an abandoned thread's real error surfaces;
+                # without it a late failure hides behind the TimeoutError.
+                # INFO, not DEBUG: it fires at most once per abandoned
+                # operation and the cause may not reproduce on a rerun.
+                _LOGGER.info(
+                    "Abandoned async operation failed",
+                    exc_info=runner.exception,
+                )
+                return
+            if (result := runner.result) is None:
+                return
+            if on_orphan is None:
+                _LOGGER.debug("Discarding late result; no on_orphan handler")
+                return
+            try:
+                on_orphan(result)
+            except Exception:  # pylint: disable=broad-except
+                # INFO, not DEBUG: a failed release means a real leak, and
+                # it fires at most once per abandoned operation.
+                _LOGGER.info("Error releasing orphaned result", exc_info=True)
+
+        threading.Thread(
+            target=_cleanup, daemon=True, name="async-orphan-cleanup"
+        ).start()
+        raise AsyncDispatchTimeout("Timed out waiting for async operation")
+    if (exc := runner.exception) is not None:
+        raise exc
+    if not runner.completed:
+        raise RuntimeError("Async operation finished without a result or an exception")
+    return cast("T", runner.result)
@@ -20,6 +20,7 @@ from typing import Any

 from esphome import const, yaml_util
 from esphome.const import (
+    BUNDLE_EXTENSION,
    CONF_ESPHOME,
    CONF_EXTERNAL_COMPONENTS,
    CONF_INCLUDES,
@@ -29,12 +30,12 @@ from esphome.const import (
    CONF_TYPE,
 )
 from esphome.core import CORE, EsphomeError
+from esphome.util import filter_yaml_files

 _LOGGER = logging.getLogger(__name__)

 DOMAIN = "bundle"

-BUNDLE_EXTENSION = ".esphomebundle.tar.gz"
 MANIFEST_FILENAME = "manifest.json"
 CURRENT_MANIFEST_VERSION = 1
 MAX_DECOMPRESSED_SIZE = 500 * 1024 * 1024  # 500 MB
@@ -128,6 +129,9 @@ class BundleData:
    """Files components asked to include, keyed under DOMAIN in CORE.data."""

    extra_files: list[Path] = field(default_factory=list)
+    # Directories whose YAML files are scanned for !secret references but
+    # never bundled, e.g. git package checkouts the builder re-fetches.
+    secret_scan_dirs: set[Path] = field(default_factory=set)
    # Original config dir parsed from an extracted bundle's manifest.json,
    # kept in the path flavor of the machine the bundle was created on.
    # The checked flag makes the manifest lookup happen at most once per run;
@@ -155,6 +159,30 @@ def add_bundle_file(path: Path) -> None:
    _get_data().extra_files.append(CORE.relative_config_path(path))


+def add_secret_scan_dir(path: Path) -> None:
+    """Register a directory to scan for ``!secret`` references when bundling.
+
+    The directory's files are not added to the bundle. Components call this
+    for YAML the build consumes without bundling it — such as git-fetched
+    packages, which the builder re-fetches — so the secrets those files
+    reference are still shipped in the filtered secrets file.
+
+    A relative path is taken as relative to the config directory.
+    """
+    if not path.is_absolute():
+        path = CORE.relative_config_path(path)
+    _get_data().secret_scan_dirs.add(path)
+
+
+def _secret_scan_yaml_files() -> list[Path]:
+    """Return the YAML files inside registered secret-scan directories."""
+    return filter_yaml_files(
+        f
+        for scan_dir in _get_data().secret_scan_dirs
+        for f in yaml_util.find_files(scan_dir, "*")
+    )
+
+
 # Windows paths start with a drive letter or contain backslashes; POSIX
 # paths do neither in practice, so this is how the flavor of a recorded
 # path string is recognized on any host.
@@ -310,6 +338,7 @@ class ConfigBundleCreator:
        yaml_sources = [
            bf.source for bf in files if bf.source.suffix in (".yaml", ".yml")
        ]
+        yaml_sources.extend(_secret_scan_yaml_files())
        used_secret_keys = _find_used_secret_keys(yaml_sources)
        filtered_secrets = self._build_filtered_secrets(used_secret_keys)

@@ -394,6 +423,13 @@ class ConfigBundleCreator:
        """
        discovered = yaml_util.discover_user_yaml_files(self._config_path)
        self._secrets_paths.update(discovered.secrets)
+        # A !secret inside a file this re-parse does not reach (for example
+        # a git-fetched package the builder re-fetches) still resolves
+        # against the config-dir secrets.yaml at build time, so always
+        # consider that file; filtering no-ops when no key matches.
+        default_secrets = self._config_dir / yaml_util.SECRET_YAML
+        if default_secrets.is_file():
+            self._secrets_paths.add(default_secrets.resolve())
        config_resolved = self._config_path.resolve()
        for fpath in discovered.files:
            if fpath == config_resolved:
@@ -719,11 +755,6 @@ def _validate_tar_members(tar: tarfile.TarFile, target_dir: Path) -> None:
            )


-def is_bundle_path(path: Path) -> bool:
-    """Check if a path looks like a bundle file."""
-    return path.name.lower().endswith(BUNDLE_EXTENSION)
-
-
 def _add_bytes_to_tar(tar: tarfile.TarFile, name: str, data: bytes) -> None:
    """Add in-memory bytes to a tar archive with deterministic metadata."""
    info = tarfile.TarInfo(name=name)
@@ -49,11 +49,13 @@ from esphome.cpp_helpers import (  # noqa: F401
    build_registry_entry,
    build_registry_list,
    extract_registry_entry_config,
+    get_slot_count,
    gpio_pin_expression,
    past_safe_mode,
    register_component,
    register_parented,
    set_setup_priority,
+    slot_counter,
 )
 from esphome.cpp_types import (  # noqa: F401
    NAN,
@@ -61,7 +61,14 @@ def load_compiled_config(conf_path: Path) -> ConfigType | None:
    from esphome import yaml_util

    try:
-        config = yaml_util.load_yaml(cache_path, clear_secrets=False)
+        # Fast path never validates or generates code - no source ranges
+        # needed (see load_yaml). Callers must not feed this config into
+        # read_config/write_cpp: the esp_range consumers in config.py and
+        # cpp_generator.py are isinstance-guarded and would degrade
+        # silently (wrong error/lambda locations) instead of raising.
+        config = yaml_util.load_yaml(
+            cache_path, clear_secrets=False, track_document_range=False
+        )
    except Exception:  # noqa: BLE001  # pylint: disable=broad-except
        return None

@@ -10,8 +10,8 @@ from esphome.components.esp32 import (
 from esphome.components.nrf52.const import AIN_TO_GPIO, EXTRA_ADC
 from esphome.components.zephyr import (
    zephyr_add_overlay,
+    zephyr_add_overlay_builder,
    zephyr_add_prj_conf,
-    zephyr_add_user,
 )
 from esphome.config_helpers import filter_source_files_from_platform
 import esphome.config_validation as cv
@@ -113,6 +113,18 @@ CONFIG_SCHEMA = cv.All(
 CONF_ADC_CHANNEL_ID = "adc_channel_id"


+def _overlay_io_channels():
+    channel_count = CORE.data[CONF_ADC_CHANNEL_ID]
+    entries = ", ".join(f"<&adc {channel_id}>" for channel_id in range(channel_count))
+    return f"""
+            / {{
+                zephyr,user {{
+                    io-channels = {entries};
+                }};
+            }};
+            """
+
+
 async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
@@ -173,9 +185,8 @@ async def to_code(config):
        if isinstance(pin_number, int):
            GPIO_TO_AIN = {v: k for k, v in AIN_TO_GPIO.items()}
            pin_number = GPIO_TO_AIN[pin_number]
-        zephyr_add_user("io-channels", f"<&adc {channel_id}>")
-        zephyr_add_overlay(
-            f"""
+        zephyr_add_overlay_builder(_overlay_io_channels)
+        zephyr_add_overlay(f"""
                &adc {{
                    #address-cells = <1>;
                    #size-cells = <0>;
@@ -190,8 +201,7 @@ async def to_code(config):
                        zephyr,oversampling = <8>;
                    }};
                }};
-            """
-        )
+            """)


 FILTER_SOURCE_FILES = filter_source_files_from_platform(
@@ -13,6 +13,7 @@ from esphome.const import (
    CONF_CAPTURE_RESPONSE,
    CONF_DATA,
    CONF_DATA_TEMPLATE,
+    CONF_ENCRYPTION,
    CONF_EVENT,
    CONF_ID,
    CONF_KEY,
@@ -102,7 +103,6 @@ SERVICE_ARG_FALLBACK_TYPES: dict[str, MockObj] = {
        for name, t in _SERVICE_ARG_SCALAR_TYPES.items()
    },
 }
-CONF_ENCRYPTION = "encryption"
 CONF_BATCH_DELAY = "batch_delay"
 CONF_CUSTOM_SERVICES = "custom_services"
 CONF_HOMEASSISTANT_SERVICES = "homeassistant_services"
@@ -69,6 +69,8 @@ service APIConnection {
  rpc zwave_proxy_frame(ZWaveProxyFrame) returns (void) {}
  rpc zwave_proxy_request(ZWaveProxyRequest) returns (void) {}

+  rpc zigbee_proxy_request(ZigbeeProxyRequest) returns (void) {}
+
  rpc infrared_rf_transmit_raw_timings(InfraredRFTransmitRawTimingsRequest) returns (void) {}

  rpc serial_proxy_configure(SerialProxyConfigureRequest) returns (void) {}
@@ -76,6 +78,7 @@ service APIConnection {
  rpc serial_proxy_set_modem_pins(SerialProxySetModemPinsRequest) returns (void) {}
  rpc serial_proxy_get_modem_pins(SerialProxyGetModemPinsRequest) returns (void) {}
  rpc serial_proxy_request(SerialProxyRequest) returns (void) {}
+  rpc serial_proxy_set_mode(SerialProxySetModeRequest) returns (void) {}
 }


@@ -315,6 +318,10 @@ message DeviceInfoResponse {
  // all-zeros PSK, so the api encryption key can be provisioned without being
  // sent in plaintext (protects against passive sniffing, not active MITM)
  bool api_encryption_provisionable = 26 [(field_ifdef) = "USE_API_NOISE"];
+
+  // Indicates if Zigbee proxy support is available and features supported
+  uint32 zigbee_proxy_feature_flags = 27 [(field_ifdef) = "USE_ZIGBEE_PROXY"];
+  uint64 zigbee_ieee_address = 28 [(field_ifdef) = "USE_ZIGBEE_PROXY"];
 }

 message ListEntitiesRequest {
@@ -2731,6 +2738,23 @@ message SerialProxyRequestResponse {
  string error_message = 4;            // Additional detail on failure (optional)
 }

+// How a port treats the bytes passing through it. RAW is a plain byte pipe; EZSP_ASH lets
+// a protocol-aware tap acknowledge NCP frames and read network metadata. A client that is
+// about to flash firmware selects RAW first, which definitively disables that injection.
+enum SerialProxyMode {
+  SERIAL_PROXY_MODE_RAW = 0;
+  SERIAL_PROXY_MODE_EZSP_ASH = 1;
+}
+
+message SerialProxySetModeRequest {
+  option (id) = 151;
+  option (source) = SOURCE_CLIENT;
+  option (ifdef) = "USE_SERIAL_PROXY";
+
+  uint32 instance = 1;
+  SerialProxyMode mode = 2;
+}
+
 // ==================== BLUETOOTH CONNECTION PARAMS ====================
 message BluetoothSetConnectionParamsRequest {
  option (id) = 145;
@@ -2752,3 +2776,18 @@ message BluetoothSetConnectionParamsResponse {
  uint64 address = 1;
  int32 error = 2;
 }
+
+// ==================== ZIGBEE ====================
+
+enum ZigbeeProxyRequestType {
+  ZIGBEE_PROXY_REQUEST_TYPE_NETWORK_INFO = 0;
+}
+
+message ZigbeeProxyRequest {
+  option (id) = 150;
+  option (source) = SOURCE_BOTH;
+  option (ifdef) = "USE_ZIGBEE_PROXY";
+
+  ZigbeeProxyRequestType type = 1;
+  bytes data = 2;
+}
@@ -47,6 +47,9 @@
 #ifdef USE_ZWAVE_PROXY
 #include "esphome/components/zwave_proxy/zwave_proxy.h"
 #endif
+#ifdef USE_ZIGBEE_PROXY
+#include "esphome/components/zigbee_proxy/zigbee_proxy.h"
+#endif
 #ifdef USE_WATER_HEATER
 #include "esphome/components/water_heater/water_heater.h"
 #endif
@@ -440,7 +443,7 @@ void APIConnection::on_disconnect_response() {
 uint16_t APIConnection::fill_and_encode_entity_state(EntityBase *entity, StateResponseProtoMessage &msg,
                                                     CalculateSizeFn size_fn, MessageEncodeFn encode_fn,
                                                     APIConnection *conn, uint32_t remaining_size) {
-  msg.key = entity->get_object_id_hash();
+  msg.key = entity->get_entity_key();
 #ifdef USE_DEVICES
  msg.device_id = entity->get_device_id();
 #endif
@@ -451,7 +454,7 @@ uint16_t APIConnection::fill_and_encode_entity_info(EntityBase *entity, InfoResp
                                                    CalculateSizeFn size_fn, MessageEncodeFn encode_fn,
                                                    APIConnection *conn, uint32_t remaining_size) {
  // Set common fields that are shared by all entity types
-  msg.key = entity->get_object_id_hash();
+  msg.key = entity->get_entity_key();

  if (entity->has_own_name()) {
    msg.name = entity->get_name();
@@ -1141,7 +1144,7 @@ void APIConnection::try_send_camera_image_() {
    bool done = this->image_reader_->available() == to_send;

    CameraImageResponse msg;
-    msg.key = camera::Camera::instance()->get_object_id_hash();
+    msg.key = camera::Camera::instance()->get_entity_key();
    msg.set_data(this->image_reader_->peek_data_buffer(), to_send);
    msg.done = done;
 #ifdef USE_DEVICES
@@ -1329,7 +1332,8 @@ void APIConnection::on_voice_assistant_announce_request(const VoiceAssistantAnno
  }
 }

-bool APIConnection::send_voice_assistant_get_configuration_response_(const VoiceAssistantConfigurationRequest &msg) {
+bool APIConnection::send_voice_assistant_get_configuration_response_(
+    const VoiceAssistantConfigurationRequest & /*msg*/) {
  VoiceAssistantConfigurationResponse resp;
  if (!this->check_voice_assistant_api_connection_()) {
    // send_message encodes synchronously, so this stack local outlives the encode
@@ -1349,22 +1353,6 @@ bool APIConnection::send_voice_assistant_get_configuration_response_(const Voice
    }
  }

-  // Filter external wake words
-  for (auto &wake_word : msg.external_wake_words) {
-    if (wake_word.model_type != "micro") {
-      // microWakeWord only
-      continue;
-    }
-
-    resp.available_wake_words.emplace_back();
-    auto &resp_wake_word = resp.available_wake_words.back();
-    resp_wake_word.id = StringRef(wake_word.id);
-    resp_wake_word.wake_word = StringRef(wake_word.wake_word);
-    for (const auto &lang : wake_word.trained_languages) {
-      resp_wake_word.trained_languages.push_back(lang);
-    }
-  }
-
  resp.active_wake_words = &config.active_wake_words;
  resp.max_active_wake_words = config.max_active_wake_words;
  return this->send_message(resp);
@@ -1392,6 +1380,12 @@ void APIConnection::on_z_wave_proxy_request(const ZWaveProxyRequest &msg) {
 }
 #endif

+#ifdef USE_ZIGBEE_PROXY
+void APIConnection::on_zigbee_proxy_request(const ZigbeeProxyRequest &msg) {
+  zigbee_proxy::global_zigbee_proxy->zigbee_proxy_request(this, msg);
+}
+#endif
+
 #ifdef USE_ALARM_CONTROL_PANEL
 bool APIConnection::send_alarm_control_panel_state(alarm_control_panel::AlarmControlPanel *a_alarm_control_panel) {
  return this->send_message_smart_(a_alarm_control_panel, AlarmControlPanelStateResponse::MESSAGE_TYPE,
@@ -1558,8 +1552,8 @@ void APIConnection::on_serial_proxy_configure_request(const SerialProxyConfigure
             static_cast<uint32_t>(proxies.size()));
    return;
  }
-  proxies[msg.instance]->configure(msg.baudrate, msg.flow_control, static_cast<uint8_t>(msg.parity), msg.stop_bits,
-                                   msg.data_size);
+  proxies[msg.instance]->configure(this, msg.baudrate, msg.flow_control, static_cast<uint8_t>(msg.parity),
+                                   msg.stop_bits, msg.data_size);
 }

 void APIConnection::on_serial_proxy_write_request(const SerialProxyWriteRequest &msg) {
@@ -1568,7 +1562,7 @@ void APIConnection::on_serial_proxy_write_request(const SerialProxyWriteRequest
    ESP_LOGW(TAG, "Serial proxy instance %" PRIu32 " out of range", msg.instance);
    return;
  }
-  proxies[msg.instance]->write_from_client(msg.data, msg.data_len);
+  proxies[msg.instance]->write_from_client(this, msg.data, msg.data_len);
 }

 void APIConnection::on_serial_proxy_set_modem_pins_request(const SerialProxySetModemPinsRequest &msg) {
@@ -1577,7 +1571,7 @@ void APIConnection::on_serial_proxy_set_modem_pins_request(const SerialProxySetM
    ESP_LOGW(TAG, "Serial proxy instance %" PRIu32 " out of range", msg.instance);
    return;
  }
-  proxies[msg.instance]->set_modem_pins(msg.line_states);
+  proxies[msg.instance]->set_modem_pins(this, msg.line_states);
 }

 void APIConnection::on_serial_proxy_get_modem_pins_request(const SerialProxyGetModemPinsRequest &msg) {
@@ -1630,6 +1624,15 @@ void APIConnection::on_serial_proxy_request(const SerialProxyRequest &msg) {
  }
 }

+void APIConnection::on_serial_proxy_set_mode_request(const SerialProxySetModeRequest &msg) {
+  auto &proxies = App.get_serial_proxies();
+  if (msg.instance >= proxies.size()) {
+    ESP_LOGW(TAG, "Serial proxy instance %" PRIu32 " out of range", msg.instance);
+    return;
+  }
+  proxies[msg.instance]->set_mode(this, msg.mode);
+}
+
 void APIConnection::send_serial_proxy_data(const SerialProxyDataReceived &msg) { this->send_message(msg); }
 #endif

@@ -1737,6 +1740,11 @@ void APIConnection::complete_authentication_() {
    zwave_proxy::global_zwave_proxy->api_connection_authenticated(this);
  }
 #endif
+#ifdef USE_ZIGBEE_PROXY
+  if (zigbee_proxy::global_zigbee_proxy != nullptr) {
+    zigbee_proxy::global_zigbee_proxy->api_connection_authenticated(this);
+  }
+#endif
 }

 bool APIConnection::send_hello_response_(const HelloRequest &msg) {
@@ -1886,6 +1894,10 @@ bool APIConnection::send_device_info_response_() {
    info.port_type = proxy->get_port_type();
  }
 #endif
+#ifdef USE_ZIGBEE_PROXY
+  resp.zigbee_proxy_feature_flags = zigbee_proxy::global_zigbee_proxy->get_feature_flags();
+  resp.zigbee_ieee_address = zigbee_proxy::global_zigbee_proxy->get_ieee_address();
+#endif
 #ifdef USE_API_NOISE
  resp.api_encryption_supported = true;
 #ifndef USE_API_NOISE_PSK_FROM_YAML
@@ -218,6 +218,10 @@ class APIConnection final : public APIServerConnectionBase {
  void on_z_wave_proxy_request(const ZWaveProxyRequest &msg);
 #endif

+#ifdef USE_ZIGBEE_PROXY
+  void on_zigbee_proxy_request(const ZigbeeProxyRequest &msg);
+#endif
+
 #ifdef USE_ALARM_CONTROL_PANEL
  bool send_alarm_control_panel_state(alarm_control_panel::AlarmControlPanel *a_alarm_control_panel);
  void on_alarm_control_panel_command_request(const AlarmControlPanelCommandRequest &msg);
@@ -239,6 +243,7 @@ class APIConnection final : public APIServerConnectionBase {
  void on_serial_proxy_set_modem_pins_request(const SerialProxySetModemPinsRequest &msg);
  void on_serial_proxy_get_modem_pins_request(const SerialProxyGetModemPinsRequest &msg);
  void on_serial_proxy_request(const SerialProxyRequest &msg);
+  void on_serial_proxy_set_mode_request(const SerialProxySetModeRequest &msg);
  void send_serial_proxy_data(const SerialProxyDataReceived &msg);
 #endif

@@ -12,6 +12,22 @@ APIOverflowBuffer::~APIOverflowBuffer() {
 }

 ssize_t APIOverflowBuffer::try_drain(socket::Socket *socket) {
+  // socket->write() can re-enter this function: a log message emitted from an
+  // lwip callback during the write goes out over the API and lands back in the
+  // frame helper's write/drain path. If a nested drain ran here it would send
+  // and free the entry the outer drain is still holding, causing a double free.
+  // Report "no progress" instead; the outer drain keeps draining, and the
+  // nested send is enqueued behind the existing backlog.
+  if (this->draining_)
+    return 0;
+
+  // RAII so the flag is cleared on every return path
+  struct DrainGuard {
+    explicit DrainGuard(bool &flag) : flag_(flag) { flag_ = true; }
+    ~DrainGuard() { this->flag_ = false; }
+    bool &flag_;
+  } guard(this->draining_);
+
  while (this->count_ > 0) {
    Entry *front = this->queue_[this->head_];

@@ -29,11 +45,12 @@ ssize_t APIOverflowBuffer::try_drain(socket::Socket *socket) {
      return sent;
    }

-    // Entry fully sent — free it and advance
-    Entry::destroy(front);
+    // Entry fully sent — unlink it before freeing so a freed pointer is never
+    // reachable from the queue
    this->queue_[this->head_] = nullptr;
    this->head_ = (this->head_ + 1) % API_MAX_SEND_QUEUE;
    this->count_--;
+    Entry::destroy(front);
  }

  return 0;  // All drained
@@ -69,6 +69,10 @@ class APIOverflowBuffer {
  uint8_t head_{0};
  uint8_t tail_{0};
  uint8_t count_{0};
+  // Guards against re-entrant drains: socket->write() can re-enter the API
+  // send path (e.g. a log message emitted from an lwip callback), and a nested
+  // drain would free the entry the outer drain is still holding.
+  bool draining_{false};
 };

 }  // namespace esphome::api
@@ -173,6 +173,12 @@ uint8_t *DeviceInfoResponse::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_
 #endif
 #ifdef USE_API_NOISE
  ProtoEncode::encode_bool(pos PROTO_ENCODE_DEBUG_ARG, 26, this->api_encryption_provisionable);
+#endif
+#ifdef USE_ZIGBEE_PROXY
+  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 27, this->zigbee_proxy_feature_flags);
+#endif
+#ifdef USE_ZIGBEE_PROXY
+  ProtoEncode::encode_uint64(pos PROTO_ENCODE_DEBUG_ARG, 28, this->zigbee_ieee_address);
 #endif
  return pos;
 }
@@ -238,6 +244,12 @@ uint32_t DeviceInfoResponse::calculate_size() const {
 #endif
 #ifdef USE_API_NOISE
  size += ProtoSize::calc_bool(2, this->api_encryption_provisionable);
+#endif
+#ifdef USE_ZIGBEE_PROXY
+  size += ProtoSize::calc_uint32(2, this->zigbee_proxy_feature_flags);
+#endif
+#ifdef USE_ZIGBEE_PROXY
+  size += ProtoSize::calc_uint64(2, this->zigbee_ieee_address);
 #endif
  return size;
 }
@@ -4144,6 +4156,19 @@ uint32_t SerialProxyRequestResponse::calculate_size() const {
  size += ProtoSize::calc_length(1, this->error_message.size());
  return size;
 }
+bool SerialProxySetModeRequest::decode_varint(uint32_t field_id, proto_varint_value_t value) {
+  switch (field_id) {
+    case 1:
+      this->instance = value;
+      break;
+    case 2:
+      this->mode = static_cast<enums::SerialProxyMode>(value);
+      break;
+    default:
+      return false;
+  }
+  return true;
+}
 #endif
 #ifdef USE_BLUETOOTH_PROXY
 bool BluetoothSetConnectionParamsRequest::decode_varint(uint32_t field_id, proto_varint_value_t value) {
@@ -4181,5 +4206,41 @@ uint32_t BluetoothSetConnectionParamsResponse::calculate_size() const {
  return size;
 }
 #endif
+#ifdef USE_ZIGBEE_PROXY
+bool ZigbeeProxyRequest::decode_varint(uint32_t field_id, proto_varint_value_t value) {
+  switch (field_id) {
+    case 1:
+      this->type = static_cast<enums::ZigbeeProxyRequestType>(value);
+      break;
+    default:
+      return false;
+  }
+  return true;
+}
+bool ZigbeeProxyRequest::decode_length(uint32_t field_id, ProtoLengthDelimited value) {
+  switch (field_id) {
+    case 2: {
+      this->data = value.data();
+      this->data_len = value.size();
+      break;
+    }
+    default:
+      return false;
+  }
+  return true;
+}
+uint8_t *ZigbeeProxyRequest::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
+  uint8_t *__restrict__ pos = buffer.get_pos();
+  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 1, static_cast<uint32_t>(this->type));
+  ProtoEncode::encode_bytes(pos PROTO_ENCODE_DEBUG_ARG, 2, this->data, this->data_len);
+  return pos;
+}
+uint32_t ZigbeeProxyRequest::calculate_size() const {
+  uint32_t size = 0;
+  size += this->type ? 2 : 0;
+  size += ProtoSize::calc_length(1, this->data_len);
+  return size;
+}
+#endif

 }  // namespace esphome::api
@@ -351,6 +351,15 @@ enum SerialProxyStatus : uint32_t {
  SERIAL_PROXY_STATUS_TIMEOUT = 3,
  SERIAL_PROXY_STATUS_NOT_SUPPORTED = 4,
 };
+enum SerialProxyMode : uint32_t {
+  SERIAL_PROXY_MODE_RAW = 0,
+  SERIAL_PROXY_MODE_EZSP_ASH = 1,
+};
+#endif
+#ifdef USE_ZIGBEE_PROXY
+enum ZigbeeProxyRequestType : uint32_t {
+  ZIGBEE_PROXY_REQUEST_TYPE_NETWORK_INFO = 0,
+};
 #endif

 }  // namespace enums
@@ -533,7 +542,7 @@ class SerialProxyInfo final : public ProtoMessage {
 class DeviceInfoResponse final : public ProtoMessage {
 public:
  static constexpr uint8_t MESSAGE_TYPE = 10;
-  static constexpr uint16_t ESTIMATED_SIZE = 312;
+  static constexpr uint16_t ESTIMATED_SIZE = 322;
 #ifdef HAS_PROTO_MESSAGE_DUMP
  const LogString *message_name() const override { return LOG_STR("device_info_response"); }
 #endif
@@ -591,6 +600,12 @@ class DeviceInfoResponse final : public ProtoMessage {
 #endif
 #ifdef USE_API_NOISE
  bool api_encryption_provisionable{false};
+#endif
+#ifdef USE_ZIGBEE_PROXY
+  uint32_t zigbee_proxy_feature_flags{0};
+#endif
+#ifdef USE_ZIGBEE_PROXY
+  uint64_t zigbee_ieee_address{0};
 #endif
  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
  uint32_t calculate_size() const;
@@ -3289,6 +3304,22 @@ class SerialProxyRequestResponse final : public ProtoMessage {

 protected:
 };
+class SerialProxySetModeRequest final : public ProtoDecodableMessage {
+ public:
+  static constexpr uint8_t MESSAGE_TYPE = 151;
+  static constexpr uint8_t ESTIMATED_SIZE = 6;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const LogString *message_name() const override { return LOG_STR("serial_proxy_set_mode_request"); }
+#endif
+  uint32_t instance{0};
+  enums::SerialProxyMode mode{};
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *dump_to(DumpBuffer &out) const override;
+#endif
+
+ protected:
+  bool decode_varint(uint32_t field_id, proto_varint_value_t value) override;
+};
 #endif
 #ifdef USE_BLUETOOTH_PROXY
 class BluetoothSetConnectionParamsRequest final : public ProtoDecodableMessage {
@@ -3328,5 +3359,27 @@ class BluetoothSetConnectionParamsResponse final : public ProtoMessage {
 protected:
 };
 #endif
+#ifdef USE_ZIGBEE_PROXY
+class ZigbeeProxyRequest final : public ProtoDecodableMessage {
+ public:
+  static constexpr uint8_t MESSAGE_TYPE = 150;
+  static constexpr uint8_t ESTIMATED_SIZE = 21;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const LogString *message_name() const override { return LOG_STR("zigbee_proxy_request"); }
+#endif
+  enums::ZigbeeProxyRequestType type{};
+  const uint8_t *data{nullptr};
+  uint16_t data_len{0};
+  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
+  uint32_t calculate_size() const;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *dump_to(DumpBuffer &out) const override;
+#endif
+
+ protected:
+  bool decode_length(uint32_t field_id, ProtoLengthDelimited value) override;
+  bool decode_varint(uint32_t field_id, proto_varint_value_t value) override;
+};
+#endif

 }  // namespace esphome::api
@@ -3,10 +3,8 @@
 #pragma once

 #include "esphome/core/defines.h"
-#ifdef USE_BLUETOOTH_PROXY
 #ifndef USE_API_VARINT64
 #define USE_API_VARINT64
 #endif
-#endif

 namespace esphome::api {}  // namespace esphome::api
@@ -856,6 +856,26 @@ template<> const char *proto_enum_to_string<enums::SerialProxyStatus>(enums::Ser
      return ESPHOME_PSTR("UNKNOWN");
  }
 }
+template<> const char *proto_enum_to_string<enums::SerialProxyMode>(enums::SerialProxyMode value) {
+  switch (value) {
+    case enums::SERIAL_PROXY_MODE_RAW:
+      return ESPHOME_PSTR("SERIAL_PROXY_MODE_RAW");
+    case enums::SERIAL_PROXY_MODE_EZSP_ASH:
+      return ESPHOME_PSTR("SERIAL_PROXY_MODE_EZSP_ASH");
+    default:
+      return ESPHOME_PSTR("UNKNOWN");
+  }
+}
+#endif
+#ifdef USE_ZIGBEE_PROXY
+template<> const char *proto_enum_to_string<enums::ZigbeeProxyRequestType>(enums::ZigbeeProxyRequestType value) {
+  switch (value) {
+    case enums::ZIGBEE_PROXY_REQUEST_TYPE_NETWORK_INFO:
+      return ESPHOME_PSTR("ZIGBEE_PROXY_REQUEST_TYPE_NETWORK_INFO");
+    default:
+      return ESPHOME_PSTR("UNKNOWN");
+  }
+}
 #endif

 const char *HelloRequest::dump_to(DumpBuffer &out) const {
@@ -985,6 +1005,12 @@ const char *DeviceInfoResponse::dump_to(DumpBuffer &out) const {
 #endif
 #ifdef USE_API_NOISE
  dump_field(out, ESPHOME_PSTR("api_encryption_provisionable"), this->api_encryption_provisionable);
+#endif
+#ifdef USE_ZIGBEE_PROXY
+  dump_field(out, ESPHOME_PSTR("zigbee_proxy_feature_flags"), this->zigbee_proxy_feature_flags);
+#endif
+#ifdef USE_ZIGBEE_PROXY
+  dump_field(out, ESPHOME_PSTR("zigbee_ieee_address"), this->zigbee_ieee_address);
 #endif
  return out.c_str();
 }
@@ -2714,6 +2740,12 @@ const char *SerialProxyRequestResponse::dump_to(DumpBuffer &out) const {
  dump_field(out, ESPHOME_PSTR("error_message"), this->error_message);
  return out.c_str();
 }
+const char *SerialProxySetModeRequest::dump_to(DumpBuffer &out) const {
+  MessageDumpHelper helper(out, ESPHOME_PSTR("SerialProxySetModeRequest"));
+  dump_field(out, ESPHOME_PSTR("instance"), this->instance);
+  dump_field(out, ESPHOME_PSTR("mode"), static_cast<enums::SerialProxyMode>(this->mode));
+  return out.c_str();
+}
 #endif
 #ifdef USE_BLUETOOTH_PROXY
 const char *BluetoothSetConnectionParamsRequest::dump_to(DumpBuffer &out) const {
@@ -2732,6 +2764,14 @@ const char *BluetoothSetConnectionParamsResponse::dump_to(DumpBuffer &out) const
  return out.c_str();
 }
 #endif
+#ifdef USE_ZIGBEE_PROXY
+const char *ZigbeeProxyRequest::dump_to(DumpBuffer &out) const {
+  MessageDumpHelper helper(out, ESPHOME_PSTR("ZigbeeProxyRequest"));
+  dump_field(out, ESPHOME_PSTR("type"), static_cast<enums::ZigbeeProxyRequestType>(this->type));
+  dump_bytes_field(out, ESPHOME_PSTR("data"), this->data, this->data_len);
+  return out.c_str();
+}
+#endif

 }  // namespace esphome::api

@@ -704,6 +704,28 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
      this->on_bluetooth_set_connection_params_request(msg);
      break;
    }
+#endif
+#ifdef USE_ZIGBEE_PROXY
+    case ZigbeeProxyRequest::MESSAGE_TYPE: {
+      ZigbeeProxyRequest msg;
+      msg.decode(msg_data, msg_size);
+#ifdef HAS_PROTO_MESSAGE_DUMP
+      this->log_receive_message_(LOG_STR("on_zigbee_proxy_request"), msg);
+#endif
+      this->on_zigbee_proxy_request(msg);
+      break;
+    }
+#endif
+#ifdef USE_SERIAL_PROXY
+    case SerialProxySetModeRequest::MESSAGE_TYPE: {
+      SerialProxySetModeRequest msg;
+      msg.decode(msg_data, msg_size);
+#ifdef HAS_PROTO_MESSAGE_DUMP
+      this->log_receive_message_(LOG_STR("on_serial_proxy_set_mode_request"), msg);
+#endif
+      this->on_serial_proxy_set_mode_request(msg);
+      break;
+    }
 #endif
    default:
      break;
@@ -233,9 +233,16 @@ class APIServerConnectionBase {
  void on_serial_proxy_request(const SerialProxyRequest &value){};
 #endif

+#ifdef USE_SERIAL_PROXY
+  void on_serial_proxy_set_mode_request(const SerialProxySetModeRequest &value){};
+#endif
 #ifdef USE_BLUETOOTH_PROXY
  void on_bluetooth_set_connection_params_request(const BluetoothSetConnectionParamsRequest &value){};
 #endif
+
+#ifdef USE_ZIGBEE_PROXY
+  void on_zigbee_proxy_request(const ZigbeeProxyRequest &value){};
+#endif
 };

 }  // namespace esphome::api
@@ -399,6 +399,14 @@ void APIServer::on_zwave_proxy_request(const ZWaveProxyRequest &msg) {
 }
 #endif

+#ifdef USE_ZIGBEE_PROXY
+void APIServer::on_zigbee_proxy_request(const ZigbeeProxyRequest &msg) {
+  // Very infrequent and small - send to all clients rather than tracking a subscription
+  for (auto &c : this->active_clients())
+    c->send_message(msg);
+}
+#endif
+
 #if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
 void APIServer::send_infrared_rf_receive_event([[maybe_unused]] uint32_t device_id, uint32_t key,
                                               const std::vector<int32_t> *timings) {
@@ -186,6 +186,9 @@ class APIServer final : public Component,
 #ifdef USE_ZWAVE_PROXY
  void on_zwave_proxy_request(const ZWaveProxyRequest &msg);
 #endif
+#ifdef USE_ZIGBEE_PROXY
+  void on_zigbee_proxy_request(const ZigbeeProxyRequest &msg);
+#endif
 #if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
  void send_infrared_rf_receive_event(uint32_t device_id, uint32_t key, const std::vector<int32_t> *timings);
 #endif
@@ -1,177 +1,10 @@
-from __future__ import annotations
+"""Backward-compatibility shim; the log client lives in esphome.api_client.

-import asyncio
-from datetime import datetime
-import importlib
-import logging
-from typing import TYPE_CHECKING, Any
-import warnings
+Importing this module executes the whole api component package, which pulls
+in the validation stack. CLI code paths should import esphome.api_client
+directly so the logs fast path stays light.
+"""

-# Suppress protobuf version warnings
-with warnings.catch_warnings():
-    warnings.filterwarnings(
-        "ignore", category=UserWarning, message=".*Protobuf gencode version.*"
-    )
-    from aioesphomeapi import APIClient, parse_log_message
-    from aioesphomeapi.log_runner import async_run
+from esphome.api_client import async_run_logs, run_logs

-import contextlib
-
-from esphome.const import CONF_KEY, CONF_PORT, __version__
-from esphome.core import CORE
-from esphome.util import safe_print
-
-from . import CONF_ENCRYPTION
-
-if TYPE_CHECKING:
-    from aioesphomeapi.api_pb2 import (
-        SubscribeLogsResponse,  # pylint: disable=no-name-in-module
-    )
-
-
-_LOGGER = logging.getLogger(__name__)
-
-
-class _LogLineProcessor:
-    """Feeds incoming log lines to the stack-trace decoder.
-
-    Two responsibilities beyond just calling the decoder:
-    1. Catch everything the decoder can raise. aioesphomeapi isolates
-       exceptions raised by log handlers, so an escaping one no longer
-       kills the session, but it does log a full traceback per line. A
-       crash dump carries a PC line plus one per backtrace frame, so the
-       tracebacks bury the dump the user is trying to read. Decoding is a
-       diagnostic nicety; nothing it raises is worth that noise.
-    2. Disable decoding after the first failure. _decode_pc shells out to
-       the toolchain to resolve addr2line, which is expensive; a single
-       crash dump can contain many PC/BT lines and we don't want to retry
-       the failing subprocess for each one. This only works if every
-       failure is caught, which is why 1 is not narrowed to EsphomeError.
-    """
-
-    def __init__(self, config: dict[str, Any], platform_handler: Any | None) -> None:
-        self._config = config
-        self._platform_handler = platform_handler
-        self._decode_enabled = True
-        self.backtrace_state = False
-
-    def process_line(self, raw_line: str) -> None:
-        if not self._decode_enabled:
-            return
-        try:
-            if self._platform_handler is not None:
-                self.backtrace_state = self._platform_handler(
-                    self._config, raw_line, self.backtrace_state
-                )
-        except Exception as exc:  # noqa: BLE001  # pylint: disable=broad-except
-            self._decode_enabled = False
-            self.backtrace_state = False
-            # _run_idedata raises EsphomeError with no message; fall back
-            # to a generic explanation when str(exc) is empty.
-            detail = str(exc) or "build artifacts not found locally"
-            _LOGGER.debug("Stack-trace decoding failed", exc_info=True)
-            _LOGGER.warning(
-                "Crash trace decoding unavailable: %s. "
-                "Run 'esphome compile' for this device to enable PC decoding.",
-                detail,
-            )
-
-
-async def async_run_logs(
-    config: dict[str, Any],
-    addresses: list[str],
-    subscribe_states: bool = True,
-) -> None:
-    """Run the logs command in the event loop."""
-    conf = config["api"]
-    name = config["esphome"]["name"]
-    port: int = int(conf[CONF_PORT])
-    noise_psk: str | None = None
-    if (encryption := conf.get(CONF_ENCRYPTION)) and (key := encryption.get(CONF_KEY)):
-        noise_psk = key
-
-    if len(addresses) == 1:
-        _LOGGER.info("Starting log output from %s using esphome API", addresses[0])
-    else:
-        _LOGGER.info(
-            "Starting log output from %s using esphome API", " or ".join(addresses)
-        )
-
-    cli = APIClient(
-        addresses[0],  # Primary address for compatibility
-        port,
-        "",  # Password auth removed in 2026.1.0
-        client_info=f"ESPHome Logs {__version__}",
-        noise_psk=noise_psk,
-        addresses=addresses,  # Pass all addresses for automatic retry
-        provide_time=False,
-    )
-
-    # Try platform-specific stacktrace handler first, fall back to generic
-    platform_process_stacktrace = None
-    try:
-        module = importlib.import_module("esphome.components." + CORE.target_platform)
-        platform_process_stacktrace = module.process_stacktrace
-    except (AttributeError, ImportError):
-        _LOGGER.info(
-            'Stacktrace analysis is unavailable: no compatible analyzer found for target platform "%s".',
-            CORE.target_platform,
-        )
-
-    processor = _LogLineProcessor(config, platform_process_stacktrace)
-
-    def on_log(msg: SubscribeLogsResponse) -> None:
-        """Handle a new log message."""
-        time_ = datetime.now().astimezone()
-        message: bytes = msg.message
-        text = message.decode("utf8", "backslashreplace")
-        nanoseconds = time_.microsecond // 1000
-        timestamp = (
-            f"[{time_.hour:02}:{time_.minute:02}:{time_.second:02}.{nanoseconds:03}]"
-        )
-        for parsed_msg in parse_log_message(text, timestamp):
-            # safe_print handles the dashboard \033 escaping and falls back
-            # to backslashreplace encoding on stdouts that can't represent
-            # the wifi signal-bar block characters (Windows redirected
-            # cp1252 pipe).
-            safe_print(parsed_msg)
-        for raw_line in text.splitlines():
-            processor.process_line(raw_line)
-
-    # Safe to fall back to plaintext here only for this diagnostics use
-    # case: the stream is one-way from device to client, and this code
-    # never accepts commands or acts on any message the device sends.
-    # An on-path attacker could still both inject fabricated log lines
-    # and passively read the device's log output (and any state data
-    # delivered when subscribe_states is enabled), so this does lose
-    # confidentiality as well as authentication/integrity. That tradeoff
-    # is acceptable for operator-visible logs, which aioesphomeapi also
-    # warns may come from an unverified device. Never mirror this opt-in
-    # for any connection that sends data to the device or uses Home
-    # Assistant actions.
-    stop = await async_run(
-        cli,
-        on_log,
-        name=name,
-        subscribe_states=subscribe_states,
-        allow_plaintext_fallback=True,
-        # A top-level ``deep_sleep:`` block means the device is only awake
-        # briefly; cap the reconnect backoff so a wake window is not missed.
-        deep_sleep="deep_sleep" in config,
-    )
-    try:
-        await asyncio.Event().wait()
-    finally:
-        await stop()
-
-
-def run_logs(
-    config: dict[str, Any],
-    addresses: list[str],
-    subscribe_states: bool = True,
-) -> None:
-    """Run the logs command."""
-    with contextlib.suppress(KeyboardInterrupt):
-        asyncio.run(
-            async_run_logs(config, addresses, subscribe_states=subscribe_states)
-        )
+__all__ = ["async_run_logs", "run_logs"]
@@ -51,7 +51,11 @@ def _set_core_data(config):
    return config


-CONFIG_SCHEMA = libretiny.BASE_SCHEMA
+# extend({}) makes this platform's own schema instance: BASE_SCHEMA is shared
+# by every LibreTiny platform, and prepending this platform's _set_core_data
+# onto the shared object would run it for every platform's validation once two
+# platform modules are imported in one process (device-builder, tests).
+CONFIG_SCHEMA = libretiny.BASE_SCHEMA.extend({})

 PIN_SCHEMA = libretiny.gpio.BASE_PIN_SCHEMA

@@ -45,6 +45,11 @@ CONFIG_SCHEMA = cv.Schema(
 ).extend(cv.COMPONENT_SCHEMA)


+# Once per registered scan listener; sizes the controller's StaticVector
+# listener storage.
+request_scan_listener_slot = cg.slot_counter("BK72XX_BLE_SCAN_LISTENER_COUNT")
+
+
 async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
@@ -179,8 +179,10 @@ void BK72xxBLE::loop() {
  if (report == nullptr)
    return;
  do {
+#ifdef BK72XX_BLE_SCAN_LISTENER_COUNT
    for (auto *listener : this->scan_listeners_)
      listener->on_scan_report(*report);
+#endif
    this->report_pool_.release(report);
  } while ((report = this->report_queue_.pop()) != nullptr);

@@ -6,10 +6,10 @@

 #include "esphome/core/component.h"
 #include "esphome/core/event_pool.h"
+#include "esphome/core/helpers.h"
 #include "esphome/core/lock_free_queue.h"

 #include <cstdint>
-#include <vector>

 namespace esphome::bk72xx_ble {

@@ -62,8 +62,12 @@ class BK72xxBLE final : public Component {
  /// Controller BLE address, least-significant octet first (BLE convention).
  void get_mac_lsb_first(uint8_t out[6]) const;

+#ifdef BK72XX_BLE_SCAN_LISTENER_COUNT
  /// Register a consumer for scan reports (delivered on the main task via loop()).
+  /// Storage is codegen-sized: the consumer's codegen requests a slot via
+  /// request_scan_listener_slot(), which emits BK72XX_BLE_SCAN_LISTENER_COUNT.
  void register_scan_listener(BLEScanListener *listener) { this->scan_listeners_.push_back(listener); }
+#endif

  /// Start the controller scan. Interval/window are in BLE units (0.625 ms).
  /// Enables the stack first if needed. Returns false on controller failure.
@@ -78,7 +82,11 @@ class BK72xxBLE final : public Component {
 protected:
  void resolve_mac_();

-  std::vector<BLEScanListener *> scan_listeners_;
+#ifdef BK72XX_BLE_SCAN_LISTENER_COUNT
+  // Codegen-sized: no heap allocation, no std::vector template instantiation —
+  // the same StaticVector pattern as the tracker's ble_device_base listeners.
+  StaticVector<BLEScanListener *, BK72XX_BLE_SCAN_LISTENER_COUNT> scan_listeners_;
+#endif
  // Report ring: the BDK notice callback (BLE task) allocates a report from the
  // pool, fills it and pushes the pointer; loop() pops, dispatches and releases.
  // Lock-free SPSC, zero allocation at steady state — the esp32_ble pattern.
@@ -0,0 +1,182 @@
+"""BK72xx BLE Tracker — ESPHome BLE 5.x scanner for the BLE-5.x-capable
+LibreTiny Beken chips (beken-72xx family).
+
+Builds on the bk72xx_ble controller component (stack bring-up, BLE address,
+scan primitives) and implements the platform-neutral ble_device_base BLEHub
+contract: the shared BLE sensors (ble_presence, ble_rssi, ble_scanner,
+bthome_mithermometer, xiaomi_*, …) bind to this tracker through
+cv.use_id(BLEHub) with no BK-specific code.
+
+Scan modes:
+  continuous: true  — scan runs forever; never stops automatically.
+                      Use this when the radio is dedicated to BLE.
+  continuous: false — a started scan runs for `duration` ms, then stops. The
+                      FIRST start is external too: nothing in this component
+                      starts a non-continuous scan on boot — the radio stays
+                      idle until bk72xx_ble_tracker.start_scan fires (e.g.
+                      from an api client-connected automation), so the
+                      single-core radio can service WiFi in between scans.
+"""
+
+from esphome import automation
+import esphome.codegen as cg
+from esphome.components import bk72xx_ble, ble_device_base, ota
+from esphome.components.ble_device_base import automation as ble_automation
+from esphome.components.const import CONF_ON_SCAN_END, CONF_SCAN_PARAMETERS, CONF_WINDOW
+import esphome.config_validation as cv
+from esphome.const import (
+    CONF_CONTINUOUS,
+    CONF_DURATION,
+    CONF_ID,
+    CONF_INTERVAL,
+    CONF_MANUFACTURER_ID,
+    CONF_ON_BLE_ADVERTISE,
+    CONF_ON_BLE_MANUFACTURER_DATA_ADVERTISE,
+    CONF_ON_BLE_SERVICE_DATA_ADVERTISE,
+    CONF_SERVICE_UUID,
+)
+from esphome.core import ID
+from esphome.types import ConfigType
+
+CONF_BK72XX_BLE_ID = "bk72xx_ble_id"
+
+DEPENDENCIES = ["bk72xx"]
+AUTO_LOAD = ["ble_device_base", "bk72xx_ble"]
+CODEOWNERS = ["@Bl00d-B0b"]
+
+ble_device_base.register_hub_provider("bk72xx_ble_tracker")
+
+bk72xx_ble_tracker_ns = cg.esphome_ns.namespace("bk72xx_ble_tracker")
+BK72xxBLETracker = bk72xx_ble_tracker_ns.class_(
+    "BK72xxBLETracker", ble_device_base.BLEHub, cg.Component
+)
+
+StartScanAction = bk72xx_ble_tracker_ns.class_("StartScanAction", automation.Action)
+StopScanAction = bk72xx_ble_tracker_ns.class_("StopScanAction", automation.Action)
+
+ESPBTAdvertiseTrigger = ble_automation.ESPBTAdvertiseTrigger
+BLEServiceDataAdvertiseTrigger = ble_automation.BLEServiceDataAdvertiseTrigger
+BLEManufacturerDataAdvertiseTrigger = ble_automation.BLEManufacturerDataAdvertiseTrigger
+BLEEndOfScanTrigger = ble_automation.BLEEndOfScanTrigger
+
+
+# interval defaults to the BK reference scan rate — 100 ms with the shared 30 ms
+# window, a 30 % duty cycle. Converted to the controller's 0.625 ms BLE units in
+# to_code(). (LN882H's SDK recommends a different 100 / 50 ms = 50 %.)
+SCAN_PARAMETERS_SCHEMA = ble_device_base.scan_parameters_schema("100ms")
+
+CONFIG_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(): cv.declare_id(BK72xxBLETracker),
+        cv.GenerateID(CONF_BK72XX_BLE_ID): cv.use_id(bk72xx_ble.BK72xxBLE),
+        cv.Optional(CONF_SCAN_PARAMETERS, default={}): SCAN_PARAMETERS_SCHEMA,
+        cv.Optional(CONF_ON_BLE_ADVERTISE): ble_automation.advertise_trigger_schema(
+            ESPBTAdvertiseTrigger
+        ),
+        cv.Optional(
+            CONF_ON_BLE_SERVICE_DATA_ADVERTISE
+        ): ble_automation.uuid_trigger_schema(
+            BLEServiceDataAdvertiseTrigger,
+            {cv.Required(CONF_SERVICE_UUID): ble_device_base.bt_uuid},
+        ),
+        cv.Optional(
+            CONF_ON_BLE_MANUFACTURER_DATA_ADVERTISE
+        ): ble_automation.uuid_trigger_schema(
+            BLEManufacturerDataAdvertiseTrigger,
+            {cv.Required(CONF_MANUFACTURER_ID): ble_device_base.bt_uuid},
+        ),
+        cv.Optional(CONF_ON_SCAN_END): ble_automation.scan_end_trigger_schema(
+            BLEEndOfScanTrigger
+        ),
+    }
+).extend(cv.COMPONENT_SCHEMA)
+
+
+@automation.register_action(
+    "bk72xx_ble_tracker.start_scan",
+    StartScanAction,
+    cv.Schema(
+        {
+            cv.GenerateID(): cv.use_id(BK72xxBLETracker),
+            # Optional with no default, unlike esp32_ble_tracker: omitting it
+            # keeps whatever scan_parameters.continuous configured, instead of
+            # silently forcing one-shot.
+            cv.Optional(CONF_CONTINUOUS): cv.templatable(cv.boolean),
+        }
+    ),
+    synchronous=True,
+)
+async def start_scan_action_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: list,
+) -> cg.MockObj:
+    var = cg.new_Pvariable(action_id, template_arg)
+    await cg.register_parented(var, config[CONF_ID])
+    if (continuous := config.get(CONF_CONTINUOUS)) is not None:
+        template_ = await cg.templatable(continuous, args, cg.bool_)
+        cg.add(var.set_continuous(template_))
+    return var
+
+
+@automation.register_action(
+    "bk72xx_ble_tracker.stop_scan",
+    StopScanAction,
+    automation.maybe_simple_id(
+        cv.Schema(
+            {
+                cv.GenerateID(): cv.use_id(BK72xxBLETracker),
+            }
+        )
+    ),
+    synchronous=True,
+)
+async def stop_scan_action_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: list,
+) -> cg.MockObj:
+    var = cg.new_Pvariable(action_id, template_arg)
+    await cg.register_parented(var, config[CONF_ID])
+    return var
+
+
+async def to_code(config: ConfigType) -> None:
+    var = cg.new_Pvariable(config[CONF_ID])
+    await cg.register_component(var, config)
+
+    parent = await cg.get_variable(config[CONF_BK72XX_BLE_ID])
+    cg.add(var.set_parent(parent))
+    # The tracker registers itself as a controller scan listener in setup();
+    # request the codegen-sized StaticVector slot for it.
+    bk72xx_ble.request_scan_listener_slot()
+
+    # Get notified when an OTA update starts, to pause scanning (esp32_ble_tracker parity)
+    ota.request_ota_state_listeners()
+
+    scan = config[CONF_SCAN_PARAMETERS]
+    cg.add(var.set_scan_interval(ble_device_base.to_ble_units(scan[CONF_INTERVAL])))
+    cg.add(var.set_scan_window(ble_device_base.to_ble_units(scan[CONF_WINDOW])))
+    cg.add(var.set_scan_duration(scan[CONF_DURATION].total_milliseconds))
+    cg.add(var.set_configured_continuous(scan[CONF_CONTINUOUS]))
+
+    for conf in config.get(CONF_ON_BLE_ADVERTISE, []):
+        await ble_automation.advertise_trigger_to_code(conf, var)
+
+    for trigger_key, uuid_key, setter_prefix in (
+        (CONF_ON_BLE_SERVICE_DATA_ADVERTISE, CONF_SERVICE_UUID, "set_service_uuid"),
+        (
+            CONF_ON_BLE_MANUFACTURER_DATA_ADVERTISE,
+            CONF_MANUFACTURER_ID,
+            "set_manufacturer_uuid",
+        ),
+    ):
+        for conf in config.get(trigger_key, []):
+            await ble_automation.uuid_trigger_to_code(
+                conf, var, uuid_key, setter_prefix
+            )
+
+    for conf in config.get(CONF_ON_SCAN_END, []):
+        await ble_automation.scan_end_trigger_to_code(conf, var)
@@ -0,0 +1,48 @@
+// Automation triggers and actions for bk72xx_ble_tracker: triggers are the
+// neutral ble_device_base classes; only the scan-control actions are
+// platform-specific.
+
+#pragma once
+
+#ifdef USE_LIBRETINY
+
+#include "bk72xx_ble_tracker.h"
+
+#include "esphome/core/automation.h"
+#include "esphome/core/helpers.h"
+
+namespace esphome::bk72xx_ble_tracker {
+
+template<typename... Ts> class StartScanAction final : public Action<Ts...>, public Parented<BK72xxBLETracker> {
+ public:
+  TEMPLATABLE_VALUE(bool, continuous)
+  void play(const Ts &...x) override {
+    // With continuous: set, the action wins. Without it, the configured value
+    // is used - stop_scan() clears the runtime flag permanently, so a bare
+    // stop_scan/start_scan pair would otherwise never resume continuous mode.
+    const bool want =
+        this->continuous_.has_value() ? this->continuous_.value(x...) : this->parent_->configured_continuous();
+    if (this->parent_->scan_running()) {
+      // Same mode on a running scan is a no-op (esp32 parity): re-anchoring
+      // the duration window here would let a repeated action keep a one-shot
+      // scan alive forever. A real mode switch re-anchors so a change to
+      // one-shot runs a full duration from now.
+      if (want != this->parent_->scan_continuous()) {
+        this->parent_->set_scan_continuous(want);
+        this->parent_->restart_scan_duration();
+      }
+      return;
+    }
+    this->parent_->set_scan_continuous(want);
+    this->parent_->start_scan();
+  }
+};
+
+template<typename... Ts> class StopScanAction final : public Action<Ts...>, public Parented<BK72xxBLETracker> {
+ public:
+  void play(const Ts &...x) override { this->parent_->stop_scan(); }
+};
+
+}  // namespace esphome::bk72xx_ble_tracker
+
+#endif  // USE_LIBRETINY
@@ -0,0 +1,277 @@
+// bk72xx_ble_tracker.cpp
+//
+// BLE scan policy for the BK72xx BLE-5.x chips: parameters, duration/period
+// timers and the rate-limited start retry. All controller access (stack
+// bring-up, scan primitives, the BLE-task → main-task report queue) goes
+// through the bk72xx_ble component — no SDK calls and no cross-task state here.
+
+#ifdef USE_LIBRETINY
+
+#include "bk72xx_ble_tracker.h"
+
+#include <algorithm>
+#include <cinttypes>
+
+#include "esphome/core/hal.h"
+#include "esphome/core/log.h"
+
+namespace esphome::bk72xx_ble_tracker {
+
+static const char *const TAG = "bk72xx_ble_tracker";
+
+// Minimum interval between scan (re)start attempts, so a failing controller start
+// cannot be retried every main-loop iteration (single-core CPU starvation). The
+// interval doubles with consecutive failed starts (1 s up to 64 s) so a controller
+// that never comes up — the controller logs each failure at ERROR — settles into a
+// slow, quiet poll instead of an error line every second for the rest of uptime;
+// a single WARN is emitted when the retry interval first saturates.
+static constexpr uint32_t SCAN_START_RETRY_MS = 1000;
+static constexpr uint8_t SCAN_START_RETRY_MAX_DOUBLINGS = 6;  // 1 s << 6 = 64 s
+
+// ---------------------------------------------------------------------------
+// Component lifecycle
+// ---------------------------------------------------------------------------
+
+void BK72xxBLETracker::setup() {
+  // Receive the controller's scan reports; the controller queues them from the
+  // BLE task and delivers here on the main task.
+  this->parent_->register_scan_listener(this);
+#ifdef USE_OTA_STATE_LISTENER
+  // Pause scanning while an OTA update is in flight — on the single-core BK72xx the
+  // BLE scan competes with the OTA flash writes. Mirrors esp32_ble_tracker.
+  ota::get_global_ota_callback()->add_global_state_listener(this);
+#endif
+}
+
+#ifdef USE_OTA_STATE_LISTENER
+void BK72xxBLETracker::on_ota_global_state(ota::OTAState state, float progress, uint8_t error,
+                                           ota::OTAComponent *comp) {
+  if (state == ota::OTA_STARTED) {
+    this->scan_continuous_before_ota_ = this->scan_continuous_;
+    this->scan_requested_before_ota_ = this->scan_requested_;
+    this->stop_scan();
+  } else if (state == ota::OTA_ERROR || state == ota::OTA_ABORT) {
+    // On success the device reboots, so restore only on a failed/aborted update;
+    // loop() restarts the scan on its next iteration (continuous idle branch).
+    if (this->scan_continuous_before_ota_) {
+      this->scan_continuous_before_ota_ = false;
+      this->scan_continuous_ = true;
+    }
+    // A one-shot request that was still pending (latched, retrying) when the
+    // OTA paused scanning is re-latched, not dropped — loop() resumes the retry.
+    if (this->scan_requested_before_ota_) {
+      this->scan_requested_before_ota_ = false;
+      this->scan_requested_ = true;
+    }
+  }
+}
+#endif  // USE_OTA_STATE_LISTENER
+
+void BK72xxBLETracker::loop() {
+  const uint32_t now = millis();
+  if (this->scan_continuous_) {
+    if (!this->scan_running_) {
+      // A start that succeeded re-anchored the period timer from a later millis(),
+      // so the stale `now` below would underflow the comparison and fire
+      // on_scan_end() for a scan that just began. Resume next iteration.
+      if (this->try_start_with_backoff_(now))
+        return;
+    }
+    // Period timer: fire on_scan_end() once per scan_duration_ window, mirroring
+    // esp32_ble_tracker::cleanup_scan_state_(). Gated on scan_started_once_ so a scan
+    // that never came up (start kept failing) does not fire spurious on_scan_end events.
+    if (this->scan_started_once_ && now - this->scan_period_start_ >= this->scan_duration_) {
+#ifdef ESPHOME_BLE_DEVICE_BASE_LISTENER_COUNT
+      for (auto *listener : this->listeners_)
+        listener->on_scan_end();
+      this->discovered_log_.clear();  // reset per-scan "Found device" dedup (esp32_ble_tracker parity)
+#endif
+      this->scan_period_start_ = now;
+    }
+    return;
+  }
+
+  // Non-continuous mode: run for scan_duration_ ms, then stop and fire on_scan_end.
+  // Restart is driven externally (e.g. api: on_client_connected:).
+  //
+  // A requested start that failed (same controller failures the continuous branch
+  // absorbs) is retried with the same backoff — otherwise a failed one-shot start
+  // would be silent: the scan never runs, stop_scan_() is never reached and
+  // on_scan_end() never fires, leaving period-keyed consumers waiting forever.
+  if (this->scan_requested_ && !this->scan_running_) {
+    // Same stale-`now` hazard as the continuous branch: start_scan_() stamps
+    // scan_start_time_ from a later millis(), so the duration check below would
+    // underflow and stop the scan in the iteration that started it.
+    if (this->try_start_with_backoff_(now))
+      return;
+  }
+  if (this->scan_running_ && now - this->scan_start_time_ >= this->scan_duration_) {
+    this->stop_scan_();
+  }
+}
+
+bool BK72xxBLETracker::try_start_with_backoff_(uint32_t now, bool force) {
+  // Rate-limit (re)start attempts. The controller start can fail (no idle activity
+  // handle, WiFi/BLE coexistence) and leave scan_running_ false; retrying every
+  // main-loop iteration would spin the single-core CPU and starve WiFi (device
+  // becomes unresponsive). The interval backs off with consecutive failures so a
+  // controller that never comes up polls slowly and quietly.
+  //
+  // force bypasses the gate for an explicit user start (start_scan()) — but
+  // only while the failure streak is clean. Once the controller is failing,
+  // even user-initiated attempts respect the backoff, so a start_scan() action
+  // on a short cadence cannot hammer a failing controller; the attempt stays
+  // inside the failure accounting below either way.
+  const uint8_t doublings = std::min<uint8_t>(this->failed_start_count_, SCAN_START_RETRY_MAX_DOUBLINGS);
+  if ((!force || this->failed_start_count_ != 0) &&
+      now - this->last_scan_start_attempt_ < (SCAN_START_RETRY_MS << doublings))
+    return false;
+  this->last_scan_start_attempt_ = now;
+  this->start_scan_();
+  if (!this->scan_running_ && this->failed_start_count_ < SCAN_START_RETRY_MAX_DOUBLINGS) {
+    ++this->failed_start_count_;
+    if (this->failed_start_count_ == SCAN_START_RETRY_MAX_DOUBLINGS) {
+      ESP_LOGW(TAG, "Scan start keeps failing; retrying every %" PRIu32 " s",
+               (SCAN_START_RETRY_MS << SCAN_START_RETRY_MAX_DOUBLINGS) / 1000);
+    }
+  }
+  return this->scan_running_;
+}
+
+void BK72xxBLETracker::dump_config() {
+  ESP_LOGCONFIG(TAG,
+                "BK72xx BLE Tracker:\n"
+                "  Scan Duration: %" PRIu32 " s\n"
+                "  Scan Interval: %.0f ms (%" PRIu32 " BLE units)\n"
+                "  Scan Window: %.0f ms (%" PRIu32 " BLE units)\n"
+                "  Scan Type: PASSIVE\n"
+                "  Continuous Scanning: %s",
+                this->scan_duration_ / 1000, this->scan_interval_ * 0.625f, this->scan_interval_,
+                this->scan_window_ * 0.625f, this->scan_window_, YESNO(this->scan_continuous_));
+}
+
+// ---------------------------------------------------------------------------
+// Scan report — delivered by the controller's loop() on the ESPHome main task
+// (the controller queues reports from the BLE task), so publish_state() and
+// listener dispatch run in main-loop context with no cross-task handling here.
+// ---------------------------------------------------------------------------
+
+void BK72xxBLETracker::on_scan_report(const bk72xx_ble::BLEScanReport &report) {
+  // Raw callback (the raw-advertisement path).
+  if (this->raw_advertisement_callback_.is_set()) {
+    const ble_device_base::RawAdvertisement adv{.mac = report.mac,
+                                                .data = report.data,
+                                                .data_len = report.data_len,
+                                                .rssi = report.rssi,
+                                                .addr_type = report.addr_type};
+    this->raw_advertisement_callback_.invoke(adv);
+  }
+
+#ifdef ESPHOME_BLE_DEVICE_BASE_LISTENER_COUNT
+  ble_device_base::ESPBTDevice device;
+  device.from_scan_result(report.mac, report.rssi, report.addr_type, report.data, report.data_len);
+  bool found = false;
+  for (auto *listener : this->listeners_) {
+    if (listener->parse_device(device)) {
+      found = true;
+    }
+  }
+  // Mirror esp32_ble_tracker: log a newly-seen device only when nothing claimed
+  // it and the scan is one-shot (continuous scans would spam).
+  if (!found && !this->scan_continuous_)
+    this->discovered_log_.log_device(TAG, device);
+#endif  // ESPHOME_BLE_DEVICE_BASE_LISTENER_COUNT
+}
+
+// ---------------------------------------------------------------------------
+// Public scan control
+// ---------------------------------------------------------------------------
+
+void BK72xxBLETracker::start_scan() {
+  // Mirrors esp32_ble_tracker::start_scan(): caller sets scan_continuous_ via
+  // set_scan_continuous() first, then calls start_scan() to begin scanning.
+  //
+  // Nothing to do while a scan is already running: latching here would leave
+  // scan_requested_ set after that scan ends and silently restart a one-shot
+  // scan nobody asked for.
+  if (this->scan_running_)
+    return;
+
+  // The request is latched: if this immediate attempt fails (controller busy,
+  // WiFi/BLE coexistence), loop() keeps retrying it with backoff even in
+  // non-continuous mode, so a one-shot start cannot fail silently.
+  //
+  // Routed through the backoff helper (forced: the user asked for an immediate
+  // attempt) so a failure here still counts toward the backoff escalation and
+  // its WARN. The force bypass only applies while the failure streak is clean —
+  // against a failing controller, repeated start_scan() calls are rate-limited
+  // like any other attempt.
+  this->scan_requested_ = true;
+  this->try_start_with_backoff_(millis(), /* force= */ true);
+}
+
+void BK72xxBLETracker::restart_scan_duration() {
+  if (!this->scan_running_)
+    return;
+  // Re-anchor only the one-shot duration clock. scan_period_start_ (the
+  // continuous-mode on_scan_end period) is deliberately left alone: a
+  // start_scan action fired more often than scan_duration_ would otherwise
+  // suppress on_scan_end indefinitely — and absence detection (ble_rssi's NAN
+  // publish) rides on that period.
+  this->scan_start_time_ = millis();
+}
+
+void BK72xxBLETracker::stop_scan() {
+  this->scan_continuous_ = false;
+  this->scan_requested_ = false;  // also cancels a pending (not yet successful) start
+  this->stop_scan_();
+}
+
+// ---------------------------------------------------------------------------
+// Internal scan start / stop
+// ---------------------------------------------------------------------------
+
+void BK72xxBLETracker::start_scan_() {
+  if (this->scan_running_)
+    return;
+
+  if (!this->parent_->scan_start(static_cast<uint16_t>(this->scan_interval_),
+                                 static_cast<uint16_t>(this->scan_window_)))
+    return;
+
+  const uint32_t now = millis();
+  this->scan_running_ = true;
+  this->scan_requested_ = false;  // the latched one-shot request is satisfied
+  this->failed_start_count_ = 0;  // reset here so direct starts clear the backoff too
+  this->scan_start_time_ = now;
+  // Log every explicit start at DEBUG — stop_scan_() logs every stop at DEBUG, and
+  // in non-continuous mode each period is an explicit start, so asymmetric logging
+  // would read as the scanner failing to come back up.
+  ESP_LOGD(TAG, "Scan started (passive, window=%.0fms, interval=%.0fms)", this->scan_window_ * 0.625f,
+           this->scan_interval_ * 0.625f);
+  // Re-anchor the on_scan_end period to every successful start — first start (so the
+  // period counts from the scan, not from boot) and every restart after a stop (so
+  // resuming after longer than scan_duration, e.g. a failed OTA restoring continuous
+  // mode 10 minutes later, does not fire on_scan_end before an advertisement can
+  // arrive). scan_started_once_ purely gates the period timer.
+  this->scan_period_start_ = now;
+  this->scan_started_once_ = true;
+}
+
+void BK72xxBLETracker::stop_scan_() {
+  if (!this->scan_running_)
+    return;
+  this->parent_->scan_stop();
+  this->scan_running_ = false;
+  ESP_LOGD(TAG, "Scan stopped");
+#ifdef ESPHOME_BLE_DEVICE_BASE_LISTENER_COUNT
+  for (auto *listener : this->listeners_)
+    listener->on_scan_end();
+  this->discovered_log_.clear();  // reset per-scan "Found device" dedup (esp32_ble_tracker parity)
+#endif
+  this->scan_period_start_ = millis();  // reset period clock so on_scan_end does not double-fire
+}
+
+}  // namespace esphome::bk72xx_ble_tracker
+
+#endif  // USE_LIBRETINY
@@ -0,0 +1,181 @@
+// bk72xx_ble_tracker.h
+//
+// ESPHome BLE scanner for the BK72xx BLE-5.x chips (LibreTiny beken-72xx family).
+// Implements the platform-neutral ble_device_base::BLEHub contract on top of the
+// bk72xx_ble controller component: parsed ESPBTDevice objects go to registered
+// listeners (bthome_mithermometer, ble_presence, …) and every raw frame to the
+// hub's raw-advertisement callback.
+//
+// This component contains no Beken SDK calls and no cross-task state: the
+// controller (stack bring-up, BLE address, scan primitives, and the BLE-task →
+// main-task report queue) is owned by bk72xx_ble, which delivers every scan
+// report on the ESPHome main task. The tracker owns scan policy — parameters,
+// duration/period timers and the rate-limited start retry.
+//
+// YAML config (values shown are the defaults; interval/window are a 30 % duty
+// cycle, the BK reference scan rate):
+//
+//   bk72xx_ble_tracker:
+//     scan_parameters:
+//       interval:   100ms
+//       window:      30ms
+//       duration:    5min
+//       continuous:  true
+
+#pragma once
+
+#ifdef USE_LIBRETINY
+
+#include "esphome/components/bk72xx_ble/bk72xx_ble.h"
+#include "esphome/components/ble_device_base/ble_device.h"
+#include "esphome/components/ble_device_base/ble_hub.h"
+#include "esphome/core/component.h"
+#include "esphome/core/helpers.h"
+
+#include <cstdint>
+
+#ifdef USE_OTA_STATE_LISTENER
+#include "esphome/components/ota/ota_backend.h"
+#endif
+
+namespace esphome::bk72xx_ble_tracker {
+
+// ---------------------------------------------------------------------------
+// BK72xxBLETracker
+// ---------------------------------------------------------------------------
+
+class BK72xxBLETracker : public Component,
+                         public ble_device_base::BLEHub,
+                         public bk72xx_ble::BLEScanListener,
+                         public Parented<bk72xx_ble::BK72xxBLE>
+#ifdef USE_OTA_STATE_LISTENER
+    ,
+                         public ota::OTAGlobalStateListener
+#endif
+{
+ public:
+  // ---- ESPHome Component ----
+  void setup() override;
+  void loop() override;
+  void dump_config() override;
+  float get_setup_priority() const override { return setup_priority::AFTER_WIFI; }
+
+#ifdef USE_OTA_STATE_LISTENER
+  // Pause scanning while an OTA update runs (single-core WiFi/BLE/flash contention);
+  // mirrors esp32_ble_tracker.
+  void on_ota_global_state(ota::OTAState state, float progress, uint8_t error, ota::OTAComponent *comp) override;
+#endif
+
+  // ---- YAML configuration setters ----
+  void set_scan_interval(uint32_t scan_interval) { this->scan_interval_ = scan_interval; }
+  void set_scan_window(uint32_t scan_window) { this->scan_window_ = scan_window; }
+  void set_scan_duration(uint32_t scan_duration) { this->scan_duration_ = scan_duration; }
+  /// Set from YAML (scan_parameters.continuous); also the value
+  /// configured_continuous() reports and a bare start_scan action restores.
+  void set_configured_continuous(bool scan_continuous) {
+    this->scan_continuous_ = scan_continuous;
+    this->scan_continuous_configured_ = scan_continuous;
+  }
+  /// Runtime control (esp32_ble_tracker lambda parity): does not change the
+  /// configured value, so configured_continuous() still reports what YAML
+  /// asked for.
+  void set_scan_continuous(bool scan_continuous) { this->scan_continuous_ = scan_continuous; }
+  bool scan_continuous() const { return this->scan_continuous_; }
+  bool configured_continuous() const { return this->scan_continuous_configured_; }
+  /// Re-anchor the one-shot duration clock of a running scan to now — used
+  /// when an action changes the scan mode without stopping the radio. The
+  /// continuous-mode on_scan_end period is deliberately not touched.
+  void restart_scan_duration();
+
+  // ---- Public scan control ----
+  // Mirrors esp32_ble_tracker: set_scan_continuous() + start_scan() / stop_scan().
+  void start_scan();
+  void stop_scan();
+
+  // ---- ble_device_base::BLEHub contract ----
+  void register_listener(ble_device_base::ESPBTDeviceListener *listener) override {
+#ifdef ESPHOME_BLE_DEVICE_BASE_LISTENER_COUNT
+    this->listeners_.push_back(listener);
+#endif
+  }
+  void set_raw_advertisement_callback(ble_device_base::RawAdvertisementCallback callback) override {
+    this->raw_advertisement_callback_ = callback;
+  }
+  ble_device_base::HubCapabilities get_capabilities() const override {
+    // The Beken BDK exposes no active-scan path (passive scanning only), so the
+    // controller never solicits scan responses and never merges them; consumers
+    // relying on scan-response fields (device names) get them only where the
+    // receiver merges per address (Home Assistant does). No GATT client either.
+    // scan_mode_switch stays false for the same reason: with no active-scan
+    // path there is no mode to switch to.
+    return {.active_scan = false, .merges_scan_response = false, .gatt = false, .scan_mode_switch = false};
+  }
+  bool request_scan_mode(bool active) override {
+    // Passive-only controller: a passive request is already honored, an active
+    // one cannot be.
+    return !active;
+  }
+  // The controller stores the address LSB-first (BLE convention); the contract
+  // wants printable (MSB-first) order.
+  void get_adapter_mac(uint8_t out[6]) override {
+    uint8_t mac[6];
+    this->parent_->get_mac_lsb_first(mac);
+    for (int i = 0; i < 6; i++)
+      out[i] = mac[5 - i];
+  }
+  bool scan_running() override { return this->scan_running_; }
+  bool scan_active() override { return false; }  // BK72xx scan is passive-only
+
+  // ---- bk72xx_ble::BLEScanListener ----
+  // Delivered by the controller's loop() on the ESPHome main task — the
+  // BLE-task → main-task handoff already happened in the controller's queue.
+  void on_scan_report(const bk72xx_ble::BLEScanReport &report) override;
+
+ protected:
+  void start_scan_();
+  void stop_scan_();
+  /// Attempt a rate-limited (re)start; returns true when the scan is running,
+  /// which means the caller must not compare its cached millis() against the
+  /// timestamps start_scan_() just refreshed. force bypasses the rate gate for
+  /// an explicit user start only while the failure streak is clean; a failing
+  /// controller rate-limits forced attempts too. Failure accounting always runs.
+  bool try_start_with_backoff_(uint32_t now, bool force = false);
+
+  bool scan_running_{false};
+  bool scan_requested_{false};  // latched start_scan() request not yet running; loop() retries with backoff
+  // Defaults: the BK reference — 30 % duty cycle
+  // (interval 100 ms / window 30 ms), in 0.625 ms BLE units.
+  uint32_t scan_interval_{160};  // 160 × 0.625 ms = 100 ms
+  uint32_t scan_window_{48};     // 48 × 0.625 ms = 30 ms (30/100 = 30 %)
+  uint32_t scan_duration_{300000};
+  bool scan_continuous_{true};
+  bool scan_continuous_configured_{true};  // YAML value; stop_scan() must not lose it
+#ifdef USE_OTA_STATE_LISTENER
+  bool scan_continuous_before_ota_{false};  // continuous mode saved at OTA start, restored on OTA failure
+  bool scan_requested_before_ota_{false};   // pending one-shot latch saved at OTA start, re-latched on OTA failure
+#endif
+  uint32_t scan_start_time_{0};
+
+  uint32_t last_scan_start_attempt_{0};  // millis() of last start_scan_() attempt; rate-limits retries
+  uint8_t failed_start_count_{0};        // consecutive failed starts; drives the retry backoff (reset on success)
+  uint32_t scan_period_start_{0};        // millis() at start of current scan period; used to rate-limit on_scan_end()
+  bool scan_started_once_{false};        // true after first successful scan start; gates the period timer
+
+  ble_device_base::RawAdvertisementCallback raw_advertisement_callback_{};
+#ifdef ESPHOME_BLE_DEVICE_BASE_LISTENER_COUNT
+  // Parsed-advertisement consumers registered through ble_device_base.
+  // Codegen-sized: no heap allocation, no std::vector template instantiations.
+  StaticVector<ble_device_base::ESPBTDeviceListener *, ESPHOME_BLE_DEVICE_BASE_LISTENER_COUNT> listeners_;
+#endif
+
+#ifdef ESPHOME_BLE_DEVICE_BASE_LISTENER_COUNT
+  // Per-period "Found device" DEBUG log with MAC dedup — shared implementation
+  // in ble_device_base, identical output on every tracker backend. Guarded like
+  // its only writer so a no-listener build does not carry an unused vector.
+  ble_device_base::DiscoveredDeviceLog discovered_log_{};
+#endif
+};
+
+}  // namespace esphome::bk72xx_ble_tracker
+
+#endif  // USE_LIBRETINY
@@ -9,6 +9,7 @@ from esphome.const import (
    CONF_ID,
    CONF_MAC_ADDRESS,
    CONF_NAME,
+    CONF_NOTIFY,
    CONF_ON_CONNECT,
    CONF_ON_DISCONNECT,
    CONF_SERVICE_UUID,
@@ -16,11 +17,46 @@ from esphome.const import (
    CONF_VALUE,
 )
 from esphome.core import ID
+from esphome.types import ConfigType

 AUTO_LOAD = ["esp32_ble_client"]
 CODEOWNERS = ["@buxtronix", "@clydebarrow"]
 DEPENDENCIES = ["esp32_ble_tracker"]

+CONF_DESCRIPTOR_UUID = "descriptor_uuid"
+CONF_ON_NOTIFY = "on_notify"
+
+
+def validate_descriptor_not_notify(config: ConfigType) -> ConfigType:
+    """Reject descriptor_uuid combined with notify or on_notify.
+
+    BLE descriptors cannot send notifications; only characteristics can, and
+    ESP-IDF has no descriptor variant of esp_ble_gattc_register_for_notify.
+    """
+    if CONF_DESCRIPTOR_UUID in config and (
+        config.get(CONF_NOTIFY) or CONF_ON_NOTIFY in config
+    ):
+        raise cv.Invalid(
+            f"'{CONF_DESCRIPTOR_UUID}' cannot be used with '{CONF_NOTIFY}' or "
+            f"'{CONF_ON_NOTIFY}': BLE descriptors cannot send notifications; remove "
+            f"'{CONF_DESCRIPTOR_UUID}' to receive characteristic notifications, or "
+            f"remove '{CONF_NOTIFY}' and '{CONF_ON_NOTIFY}' to poll the descriptor"
+        )
+    return config
+
+
+def notify_from_on_notify(config: ConfigType) -> ConfigType:
+    """Enable notifications when an on_notify automation is configured.
+
+    The triggers have no registration path of their own; without notify the
+    automation would validate but never fire.
+    """
+    if CONF_ON_NOTIFY in config and not config[CONF_NOTIFY]:
+        config = config.copy()
+        config[CONF_NOTIFY] = True
+    return config
+
+
 ble_client_ns = cg.esphome_ns.namespace("ble_client")
 BLEClient = ble_client_ns.class_("BLEClient", esp32_ble_client.BLEClientBase)
 BLEClientNode = ble_client_ns.class_("BLEClientNode")
@@ -51,7 +51,9 @@ bool BLEClient::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t es
  for (auto *node : this->nodes_)
    node->gattc_event_handler(event, esp_gattc_if, param);

-  if (!this->services_.empty() && this->all_nodes_established_()) {
+  // The release frees the GATT cache that BLEClientBase's CCCD lookup still needs.
+  // The last REG_FOR_NOTIFY event clears the counter before node dispatch, so the release still runs here.
+  if (!this->services_.empty() && !this->notify_registration_pending() && this->all_nodes_established_()) {
    this->release_services();
    ESP_LOGD(TAG, "All clients established, services released");
  }
@@ -34,6 +34,11 @@ class BLEClientNode {
  // This should be transitioned to Established once the node no longer needs
  // the services/descriptors/characteristics of the parent client. This will
  // allow some memory to be freed.
+  // The parent frees the peer's GATT cache once every node reports Established.
+  // Never report Established while an operation that reads that cache is outstanding.
+  // - esp_ble_gattc_register_for_notify() completes asynchronously.
+  // - Register from ESP_GATTC_SEARCH_CMPL_EVT, then set this from ESP_GATTC_REG_FOR_NOTIFY_EVT.
+  // - BLEClientBase::register_for_notify() holds the release until the registration completes.
  espbt::ClientState node_state;

  BLEClient *parent() { return this->parent_; }
@@ -14,13 +14,16 @@ from esphome.const import (
    UNIT_DECIBEL_MILLIWATT,
 )

-from .. import ble_client_ns
+from .. import (
+    CONF_DESCRIPTOR_UUID,
+    CONF_ON_NOTIFY,
+    ble_client_ns,
+    notify_from_on_notify,
+    validate_descriptor_not_notify,
+)

 DEPENDENCIES = ["ble_client"]

-CONF_DESCRIPTOR_UUID = "descriptor_uuid"
-
-CONF_ON_NOTIFY = "on_notify"
 TYPE_CHARACTERISTIC = "characteristic"
 TYPE_RSSI = "rssi"

@@ -85,6 +88,8 @@ CONFIG_SCHEMA = cv.All(
        },
        lower=True,
    ),
+    validate_descriptor_not_notify,
+    notify_from_on_notify,
 )


@@ -61,7 +61,7 @@ void BLESensor::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t ga
        break;
      }
      this->handle = chr->handle;
-      if (this->descr_uuid_.get_uuid().len > 0) {
+      if (this->descr_uuid_.is_set()) {
        auto *descr = chr->get_descriptor(this->descr_uuid_);
        if (descr == nullptr) {
          this->status_set_warning();
@@ -77,8 +77,7 @@ void BLESensor::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t ga
        this->handle = descr->handle;
      }
      if (this->notify_) {
-        auto status = esp_ble_gattc_register_for_notify(this->parent()->get_gattc_if(),
-                                                        this->parent()->get_remote_bda(), chr->handle);
+        auto status = this->parent()->register_for_notify(chr->handle);
        if (status) {
          ESP_LOGW(TAG, "esp_ble_gattc_register_for_notify failed, status=%d", status);
        }
@@ -9,13 +9,16 @@ from esphome.const import (
    CONF_TRIGGER_ID,
 )

-from .. import ble_client_ns
+from .. import (
+    CONF_DESCRIPTOR_UUID,
+    CONF_ON_NOTIFY,
+    ble_client_ns,
+    notify_from_on_notify,
+    validate_descriptor_not_notify,
+)

 DEPENDENCIES = ["ble_client"]

-CONF_DESCRIPTOR_UUID = "descriptor_uuid"
-
-CONF_ON_NOTIFY = "on_notify"

 adv_data_t = cg.std_vector.template(cg.uint8)
 adv_data_t_const_ref = adv_data_t.operator("ref").operator("const")
@@ -48,7 +51,9 @@ CONFIG_SCHEMA = cv.All(
        }
    )
    .extend(cv.polling_component_schema("60s"))
-    .extend(ble_client.BLE_CLIENT_SCHEMA)
+    .extend(ble_client.BLE_CLIENT_SCHEMA),
+    validate_descriptor_not_notify,
+    notify_from_on_notify,
 )


@@ -61,7 +61,7 @@ void BLETextSensor::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_
        break;
      }
      this->handle = chr->handle;
-      if (this->descr_uuid_.get_uuid().len > 0) {
+      if (this->descr_uuid_.is_set()) {
        auto *descr = chr->get_descriptor(this->descr_uuid_);
        if (descr == nullptr) {
          this->status_set_warning();
@@ -77,8 +77,7 @@ void BLETextSensor::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_
        this->handle = descr->handle;
      }
      if (this->notify_) {
-        auto status = esp_ble_gattc_register_for_notify(this->parent()->get_gattc_if(),
-                                                        this->parent()->get_remote_bda(), chr->handle);
+        auto status = this->parent()->register_for_notify(chr->handle);
        if (status) {
          ESP_LOGW(TAG, "esp_ble_gattc_register_for_notify failed, status=%d", status);
        }
@@ -8,30 +8,43 @@ ESPBLEiBeacon / ESPBTDeviceListener, in ble_device.h) and the tracker contract
 BLE consumers (sensor components, bluetooth_proxy) bind to whichever tracker the
 configuration declares via `cv.use_id(BLEHub)` — ESPHome resolves any declared
 subclass, so there is no platform table here and no dependency in either
-direction. A sensor appends inject_ble_hub to its CONFIG_SCHEMA (via cv.All) and
-calls register_ble_device() in to_code; a tracker component subclasses BLEHub
-(C++ and codegen class). Adding a new BLE chip requires only a new tracker
-component.
+direction. A sensor extends BLE_DEVICE_SCHEMA in its CONFIG_SCHEMA (so an
+explicit ble_hub_id: is a declared key even on strict schemas) and calls
+register_ble_device() in to_code; a tracker component subclasses BLEHub (C++
+and codegen class) and MUST call register_hub_provider() at import time —
+without it _require_hub rejects configs that bind through the generated id
+(an explicit ble_hub_id: bypasses the registry). Adding a new BLE chip
+requires only a new in-tree tracker component; out-of-tree BLE hubs are
+not supported.

 AES-CCM decryption for encrypted advertisements is provided portably in
 ble_aes_ccm.h.
 """

+from collections.abc import Callable
 import re

 import esphome.codegen as cg
+from esphome.components.const import CONF_WINDOW
 import esphome.config_validation as cv
-from esphome.core import CORE
+from esphome.const import (
+    CONF_ACTIVE,
+    CONF_CONTINUOUS,
+    CONF_DURATION,
+    CONF_INTERVAL,
+    KEY_TARGET_PLATFORM,
+)
+from esphome.core import CORE, ID, KEY_CORE
 from esphome.types import ConfigType

 CODEOWNERS = ["@Bl00d-B0b"]

 CONF_BLE_HUB_ID = "ble_hub_id"

-# CORE.data key: number of parsed-advertisement listeners registered in this
-# build. Trackers whose codegen sizes storage at compile time (esp32's
-# StaticVector count define) read it in their final coroutine.
-KEY_BLE_LISTENER_COUNT = "ble_device_base_listener_count"
+# Number of parsed-advertisement listeners registered in this build; read via
+# cg.get_slot_count() by esp32_ble_tracker's feature coupling.
+LISTENER_COUNT_DEFINE = "ESPHOME_BLE_DEVICE_BASE_LISTENER_COUNT"
+

 ble_device_base_ns = cg.esphome_ns.namespace("ble_device_base")

@@ -43,17 +56,92 @@ BLEHub = ble_device_base_ns.class_("BLEHub")
 ESPBTDeviceListener = ble_device_base_ns.class_("ESPBTDeviceListener")


-def inject_ble_hub(config: ConfigType) -> ConfigType:
-    """Validator: auto-resolve the configured BLE tracker into the config.
+# Config keys that provide a BLEHub, registered by each tracker component at
+# import time (a tracker's module is imported iff it can end up in the build).
+# Used only to phrase an actionable error when a BLE consumer is configured
+# without any tracker — the binding itself resolves any BLEHub subclass and
+# needs no platform table. Out-of-tree BLE hubs are not supported; the
+# registry and the messages below deal in in-tree trackers only.
+_HUB_PROVIDERS: set[str] = set()

-    Append via cv.All to a BLE consumer's CONFIG_SCHEMA. Uses cv.GenerateID +
-    cv.use_id(BLEHub): an omitted id resolves to the single declared tracker on
-    any platform; multiple trackers can be disambiguated with an explicit
-    ble_hub_id.
-    """
-    return cv.Schema(
-        {cv.GenerateID(CONF_BLE_HUB_ID): cv.use_id(BLEHub)}, extra=cv.ALLOW_EXTRA
-    )(config)
+# The in-tree trackers per target platform, so the missing-tracker error names
+# them even in a fresh process where no tracker module has been imported yet (a
+# consumer imports only ble_device_base, so the registry is empty exactly in
+# the most common failure: the tracker was simply forgotten). Filtered by the
+# current platform so an esp32 config is not told to add a Beken tracker; an
+# unknown/absent platform falls back to every in-tree name.
+_IN_TREE_HUB_PROVIDERS: dict[str, str] = {
+    "esp32": "esp32_ble_tracker",
+    "bk72xx": "bk72xx_ble_tracker",
+    "rp2": "rp2_ble_tracker",
+    "ln882x": "ln882h_ble_tracker",
+}
+
+
+def register_hub_provider(component: str) -> None:
+    """Called at import time by every component whose config key declares a BLEHub."""
+    _HUB_PROVIDERS.add(component)
+
+
+def _require_hub(value: ID) -> ID:
+    # Without this check a missing tracker surfaces at ID resolution as
+    # "Couldn't find any component that can be used for 'ble_device_base::BLEHub'"
+    # — a C++ class name the user never types. Component final validation cannot
+    # phrase it better: the ID pass runs first and its error skips all later
+    # steps. All explicitly configured components are loaded before any schema
+    # validates, so a registered provider in loaded_integrations is exact here.
+    if value.id is not None:
+        # Explicit ble_hub_id: — the user is pointing at a specific hub (the
+        # multi-hub disambiguation case). Let the ID pass judge it; its error
+        # names the missing id, which is accurate.
+        return value
+    if not _HUB_PROVIDERS & CORE.loaded_integrations:
+        # Defensive lookup rather than CORE.target_platform: the property
+        # raises when no platform is registered, and this message must never
+        # be the thing that crashes. In a real run the platform is always set
+        # (LoadTargetPlatformValidationStep runs before any other domain), so
+        # the unfiltered all-platforms fallback is reachable only from tests.
+        platform = CORE.data.get(KEY_CORE, {}).get(KEY_TARGET_PLATFORM)
+        if platform is not None and platform not in _IN_TREE_HUB_PROVIDERS:
+            # Known platform with no in-tree hub (esp8266, host, rtl87xx, …):
+            # listing the other platforms' trackers would misdirect, and
+            # out-of-tree BLE hubs are not supported.
+            raise cv.Invalid(
+                f"No BLE tracker exists for {platform}; BLE components are "
+                "not supported on this platform"
+            )
+        in_tree = (
+            {tracker}
+            if (tracker := _IN_TREE_HUB_PROVIDERS.get(platform))
+            else set(_IN_TREE_HUB_PROVIDERS.values())
+        )
+        # in_tree only: _HUB_PROVIDERS is import-time state that outlives
+        # CORE.reset() in a long-lived process (dashboard), so a tracker from
+        # an earlier build of another platform must not leak into the message.
+        # The gate above is immune — loaded_integrations resets per run.
+        names = ", ".join(sorted(in_tree))
+        raise cv.Invalid(f"No BLE tracker configured — add one of: {names}")
+    return value
+
+
+# Schema fragment binding a consumer to the configured BLE tracker: extend a
+# consumer's CONFIG_SCHEMA with this so ble_hub_id: is a declared key — a
+# trailing validator after a PREVENT_EXTRA schema would reject the explicit
+# form before ever running. An omitted id resolves to the single declared
+# tracker on any platform; multiple trackers are disambiguated with an
+# explicit ble_hub_id.
+BLE_DEVICE_SCHEMA = cv.Schema(
+    {cv.GenerateID(CONF_BLE_HUB_ID): cv.All(cv.use_id(BLEHub), _require_hub)}
+)
+
+
+def rename_legacy_hub_id(component: str) -> Callable[[ConfigType], ConfigType]:
+    """Transitional alias for the pre-migration binding key: esp32_ble_id ->
+    ble_hub_id. Warns and auto-migrates until removal; every migrated platform
+    prepends this to its CONFIG_SCHEMA so existing configs keep validating."""
+    return cv.rename_key(
+        "esp32_ble_id", CONF_BLE_HUB_ID, removed_in="2027.2.0", component=component
+    )


 def request_irk_support() -> None:
@@ -62,20 +150,119 @@ def request_irk_support() -> None:
    cg.add_define("USE_BLE_DEVICE_IRK")


-def get_listener_count() -> int:
-    """Number of parsed listeners registered so far (for tracker codegen)."""
-    return CORE.data.get(KEY_BLE_LISTENER_COUNT, 0)
+# Number of GATT client connection slots in this build; sizes the platform
+# backend's connection storage.
+GATT_CLIENT_COUNT_DEFINE = "ESPHOME_BLE_GATT_CLIENT_COUNT"
+
+_request_gatt_connection_slot = cg.slot_counter(GATT_CLIENT_COUNT_DEFINE)
+
+
+def request_gatt_client() -> None:
+    """Compile in the neutral GATT client contract (ble_gatt_client.h) and
+    claim one connection slot. Called by bluetooth_proxy once per connection
+    it instantiates on a hub platform."""
+    cg.add_define("USE_BLE_GATT_CLIENT")
+    _request_gatt_connection_slot()
+
+
+_request_listener_slot = cg.slot_counter(LISTENER_COUNT_DEFINE)


 async def register_ble_device(var: cg.MockObj, config: ConfigType) -> cg.MockObj:
    """Register `var` as a parsed-advertisement listener on the configured hub."""
    hub = await cg.get_variable(config[CONF_BLE_HUB_ID])
    cg.add(hub.register_listener(var))
-    CORE.data[KEY_BLE_LISTENER_COUNT] = CORE.data.get(KEY_BLE_LISTENER_COUNT, 0) + 1
+    _request_listener_slot()
    return var


 # ---- shared validation / codegen helpers (platform-neutral) ----
+
+
+def to_ble_units(value: cv.TimePeriod) -> int:
+    """Convert a scan time to the controller's 0.625 ms units.
+
+    Used by both validation and codegen so what is validated is exactly what is
+    programmed — the truncation here is what makes the duty-cycle check below
+    meaningful.
+    """
+    return value.total_microseconds // 625
+
+
+def validate_scan_parameters(config: ConfigType) -> ConfigType:
+    """Reject impossible window/interval/duration combinations at config time.
+
+    The controller cannot scan for longer than the interval, and a too-short
+    duration would end the scan period almost immediately. Catching it here
+    gives a clear error instead of a runtime controller failure and a retry
+    loop.
+    """
+    duration = config[CONF_DURATION]
+    interval = config[CONF_INTERVAL]
+    window = config[CONF_WINDOW]
+
+    if window > interval:
+        raise cv.Invalid(
+            f"Scan window ({window}) needs to be smaller than scan interval ({interval})"
+        )
+
+    # BLE scan interval/window are programmed in 0.625 ms units as a 16-bit value; the
+    # controller only accepts 2.5 ms .. 10240 ms (0x0004 .. 0x4000). Reject out-of-range
+    # values here instead of letting the unit conversion silently overflow.
+    for name, value in (("interval", interval), ("window", window)):
+        if value.total_microseconds < 2500 or value.total_microseconds > 10_240_000:
+            raise cv.Invalid(
+                f"Scan {name} ({value}) must be between 2.5 ms and 10240 ms"
+            )
+
+    # Validate what actually reaches the controller: both values are truncated to
+    # whole 0.625 ms units, so a window/interval pair that differs by less than one
+    # unit collapses to the same value — silently programming a 100 % duty cycle
+    # (radio permanently on) from a config that asked for less.
+    interval_units = to_ble_units(interval)
+    window_units = to_ble_units(window)
+    if window_units == interval_units and window < interval:
+        raise cv.Invalid(
+            f"Scan window ({window}) and interval ({interval}) both truncate to "
+            f"{interval_units} x 0.625 ms, which the controller scans at a 100 % duty "
+            f"cycle. Separate them by at least 0.625 ms."
+        )
+
+    if interval.total_microseconds * 3 > duration.total_microseconds:
+        raise cv.Invalid(
+            f"Scan duration ({duration}) must cover at least three scan intervals "
+            f"({interval}): the scanner listens on one of the three BLE advertising "
+            f"channels per interval, so a shorter duration can miss devices entirely."
+        )
+
+    return config
+
+
+def scan_parameters_schema(
+    interval_default: str,
+    *,
+    window_default: str = "30ms",
+    supports_active: bool = False,
+) -> cv.All:
+    """Build the scan_parameters value schema shared by all BLE trackers.
+
+    interval_default and window_default are per chip (e.g. esp32 320/30 ms,
+    bk72xx/rp2 100/30 ms — the reference scan rates of the respective stacks;
+    LN882H's SDK recommends 100/50 ms). Pass supports_active=True only when
+    the tracker supports active scanning; it exposes the `active` option
+    (whose own default is on, esp32_ble_tracker behavior).
+    """
+    schema = {
+        cv.Optional(CONF_DURATION, default="5min"): cv.positive_time_period_seconds,
+        cv.Optional(CONF_INTERVAL, default=interval_default): cv.positive_time_period,
+        cv.Optional(CONF_WINDOW, default=window_default): cv.positive_time_period,
+        cv.Optional(CONF_CONTINUOUS, default=True): cv.boolean,
+    }
+    if supports_active:
+        schema[cv.Optional(CONF_ACTIVE, default=True)] = cv.boolean
+    return cv.All(cv.Schema(schema), validate_scan_parameters)
+
+
 BT_UUID16_FORMAT = "XXXX"
 BT_UUID32_FORMAT = "XXXXXXXX"
 BT_UUID128_FORMAT = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
@@ -132,3 +319,25 @@ def as_hex_array(value: str) -> cg.RawExpression:

 def as_reversed_hex_array(value: str) -> cg.RawExpression:
    return _hex_array_expression(value, reverse=True)
+
+
+def add_service_uuid(var: cg.MockObj, service_uuid: str) -> None:
+    """Emit the width-matched service-UUID setter for a consumer.
+
+    16-/32-bit UUIDs go out as plain hex literals, 128-bit as a reversed byte
+    array (BLE wire order). Shared here so every sensor platform dispatches the
+    same way instead of carrying its own if/elif copy.
+    """
+    if len(service_uuid) == len(BT_UUID16_FORMAT):
+        cg.add(var.set_service_uuid16(as_hex(service_uuid)))
+    elif len(service_uuid) == len(BT_UUID32_FORMAT):
+        cg.add(var.set_service_uuid32(as_hex(service_uuid)))
+    elif len(service_uuid) == len(BT_UUID128_FORMAT):
+        cg.add(var.set_service_uuid128(as_reversed_hex_array(service_uuid)))
+    else:
+        # bt_uuid restricts lengths to exactly these three formats; if that
+        # ever loosens, fail the build instead of emitting no setter (a
+        # sensor whose match_by_ is unset silently never matches). ValueError,
+        # not cv.Invalid: this runs from to_code, after validation, where
+        # voluptuous errors surface as raw tracebacks.
+        raise ValueError(f"Unsupported UUID format: {service_uuid}")
@@ -0,0 +1,117 @@
+// Platform-neutral BLE advertisement triggers: ESPBTDeviceListener subclasses
+// registered on a BLEHub, exposed by each tracker under its own automation
+// names. parse_device()'s return feeds the "Found device" suppression.
+
+#pragma once
+
+#include "ble_device.h"
+#include "ble_hub.h"
+
+#include "esphome/core/automation.h"
+#include "esphome/core/helpers.h"
+
+#include <algorithm>
+#include <initializer_list>
+
+namespace esphome::ble_device_base {
+
+// on_ble_advertise: fires on every BLE advertisement, optionally filtered to one or more MACs.
+class ESPBTAdvertiseTrigger final : public Trigger<const ESPBTDevice &>, public ESPBTDeviceListener {
+ public:
+  explicit ESPBTAdvertiseTrigger(BLEHub *parent) { parent->register_listener(this); }
+
+  void set_addresses(std::initializer_list<uint64_t> addresses) { this->addresses_ = addresses; }
+
+  bool parse_device(const ESPBTDevice &device) override {
+    if (!this->addresses_.empty() && std::find(this->addresses_.begin(), this->addresses_.end(),
+                                               device.address_uint64()) == this->addresses_.end()) {
+      return false;
+    }
+    this->trigger(device);
+    return true;
+  }
+
+ protected:
+  FixedVector<uint64_t> addresses_;
+};
+
+// on_ble_service_data_advertise: fires when an advertisement contains service
+// data for the given UUID. Optional single-MAC filter.
+class BLEServiceDataAdvertiseTrigger final : public Trigger<const adv_data_t &>, public ESPBTDeviceListener {
+ public:
+  explicit BLEServiceDataAdvertiseTrigger(BLEHub *parent) { parent->register_listener(this); }
+
+  void set_service_uuid16(uint64_t uuid) { this->uuid_ = ESPBTUUID::from_uint16(static_cast<uint16_t>(uuid)); }
+  void set_service_uuid32(uint64_t uuid) { this->uuid_ = ESPBTUUID::from_uint32(static_cast<uint32_t>(uuid)); }
+  void set_service_uuid128(const uint8_t *uuid) { this->uuid_ = ESPBTUUID::from_raw(uuid); }
+
+  void set_address(uint64_t address) {
+    this->address_ = address;
+    this->has_address_ = true;
+  }
+
+  bool parse_device(const ESPBTDevice &device) override {
+    if (this->has_address_ && device.address_uint64() != this->address_) {
+      return false;
+    }
+    for (const auto &sd : device.get_service_datas()) {
+      if (sd.uuid == this->uuid_) {
+        this->trigger(sd.data);
+        return true;
+      }
+    }
+    return false;
+  }
+
+ protected:
+  ESPBTUUID uuid_{};
+  uint64_t address_{0};
+  bool has_address_{false};
+};
+
+// on_ble_manufacturer_data_advertise: fires when an advertisement contains
+// manufacturer data for the given ID. Optional single-MAC filter.
+class BLEManufacturerDataAdvertiseTrigger final : public Trigger<const adv_data_t &>, public ESPBTDeviceListener {
+ public:
+  explicit BLEManufacturerDataAdvertiseTrigger(BLEHub *parent) { parent->register_listener(this); }
+
+  void set_manufacturer_uuid16(uint64_t uuid) { this->uuid_ = ESPBTUUID::from_uint16(static_cast<uint16_t>(uuid)); }
+  void set_manufacturer_uuid32(uint64_t uuid) { this->uuid_ = ESPBTUUID::from_uint32(static_cast<uint32_t>(uuid)); }
+  void set_manufacturer_uuid128(const uint8_t *uuid) { this->uuid_ = ESPBTUUID::from_raw(uuid); }
+
+  void set_address(uint64_t address) {
+    this->address_ = address;
+    this->has_address_ = true;
+  }
+
+  bool parse_device(const ESPBTDevice &device) override {
+    if (this->has_address_ && device.address_uint64() != this->address_) {
+      return false;
+    }
+    for (const auto &md : device.get_manufacturer_datas()) {
+      if (md.uuid == this->uuid_) {
+        this->trigger(md.data);
+        return true;
+      }
+    }
+    return false;
+  }
+
+ protected:
+  ESPBTUUID uuid_{};
+  uint64_t address_{0};
+  bool has_address_{false};
+};
+
+// on_scan_end: fires whenever a scan period ends (duration elapsed or stop
+// requested). A listener whose on_scan_end() hook fires the trigger — never
+// claims devices (parse_device always returns false).
+class BLEEndOfScanTrigger final : public Trigger<>, public ESPBTDeviceListener {
+ public:
+  explicit BLEEndOfScanTrigger(BLEHub *parent) { parent->register_listener(this); }
+
+  bool parse_device(const ESPBTDevice &device) override { return false; }
+  void on_scan_end() override { this->trigger(); }
+};
+
+}  // namespace esphome::ble_device_base
@@ -0,0 +1,128 @@
+"""Shared codegen for the neutral BLE advertisement triggers (automation.h)."""
+
+from typing import Any
+
+from esphome import automation
+import esphome.codegen as cg
+import esphome.config_validation as cv
+from esphome.const import CONF_MAC_ADDRESS, CONF_TRIGGER_ID
+from esphome.cpp_generator import MockObjClass
+from esphome.types import ConfigType
+
+from . import (
+    BT_UUID16_FORMAT,
+    BT_UUID32_FORMAT,
+    BT_UUID128_FORMAT,
+    LISTENER_COUNT_DEFINE,
+    as_hex,
+    as_reversed_hex_array,
+    ble_device_base_ns,
+)
+
+adv_data_t = cg.std_vector.template(cg.uint8)
+adv_data_t_const_ref = adv_data_t.operator("ref").operator("const")
+ESPBTDeviceConstRef = (
+    ble_device_base_ns.class_("ESPBTDevice").operator("ref").operator("const")
+)
+
+ESPBTAdvertiseTrigger = ble_device_base_ns.class_(
+    "ESPBTAdvertiseTrigger", automation.Trigger.template(ESPBTDeviceConstRef)
+)
+BLEServiceDataAdvertiseTrigger = ble_device_base_ns.class_(
+    "BLEServiceDataAdvertiseTrigger", automation.Trigger.template(adv_data_t_const_ref)
+)
+BLEManufacturerDataAdvertiseTrigger = ble_device_base_ns.class_(
+    "BLEManufacturerDataAdvertiseTrigger",
+    automation.Trigger.template(adv_data_t_const_ref),
+)
+BLEEndOfScanTrigger = ble_device_base_ns.class_(
+    "BLEEndOfScanTrigger", automation.Trigger.template()
+)
+
+# UUID string length -> setter width. 16/32-bit go out as plain hex literals,
+# 128-bit as a reversed byte array (BLE wire order). Keyed exhaustively so an
+# impossible length fails as a KeyError instead of silently picking a width
+# (bt_uuid validation upstream only ever produces these three).
+_UUID_WIDTHS = {
+    len(BT_UUID16_FORMAT): "16",
+    len(BT_UUID32_FORMAT): "32",
+    len(BT_UUID128_FORMAT): "128",
+}
+
+
+def uuid_trigger_schema(
+    trigger_class: MockObjClass, extra: dict[Any, Any] | None = None
+):
+    """Schema for a UUID-filtered trigger — pairs with uuid_trigger_to_code().
+
+    `extra` carries the required UUID key (a cv marker, so a dict rather than
+    **kwargs); the optional single-mac filter is what uuid_trigger_to_code()
+    reads back.
+    """
+    return automation.validate_automation(
+        {
+            cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(trigger_class),
+            cv.Optional(CONF_MAC_ADDRESS): cv.mac_address,
+            **(extra or {}),
+        }
+    )
+
+
+def advertise_trigger_schema(trigger_class: MockObjClass):
+    """on_ble_advertise schema: multi-mac list filter, unlike the single-mac
+    uuid_trigger_schema() — pairs with advertise_trigger_to_code()."""
+    return automation.validate_automation(
+        {
+            cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(trigger_class),
+            cv.Optional(CONF_MAC_ADDRESS): cv.ensure_list(cv.mac_address),
+        }
+    )
+
+
+def scan_end_trigger_schema(trigger_class: MockObjClass):
+    """on_scan_end schema: id only — pairs with scan_end_trigger_to_code()."""
+    return automation.validate_automation(
+        {cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(trigger_class)}
+    )
+
+
+# Triggers register as ble_device_base listeners in their constructors; count
+# them where they are created so no backend can undercount the StaticVector
+# (push_back past capacity drops silently). Shares the define with
+# register_ble_device() via the core slot-counter factory.
+_count_listener = cg.slot_counter(LISTENER_COUNT_DEFINE)
+
+
+async def advertise_trigger_to_code(conf: ConfigType, var: cg.MockObj) -> None:
+    """Build an on_ble_advertise trigger (optional multi-mac filter)."""
+    trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
+    if (macs := conf.get(CONF_MAC_ADDRESS)) is not None:
+        cg.add(trigger.set_addresses([it.as_hex for it in macs]))
+    await automation.build_automation(trigger, [(ESPBTDeviceConstRef, "x")], conf)
+    _count_listener()
+
+
+async def scan_end_trigger_to_code(conf: ConfigType, var: cg.MockObj) -> None:
+    """Build an on_scan_end trigger."""
+    trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
+    await automation.build_automation(trigger, [], conf)
+    _count_listener()
+
+
+async def uuid_trigger_to_code(
+    conf: ConfigType, var: cg.MockObj, key: str, setter_prefix: str
+) -> None:
+    """Build a UUID-filtered advertise trigger.
+
+    The UUID width picks the setter: 16-/32-bit go out as a plain hex literal,
+    128-bit as a reversed byte array (BLE wire order).
+    """
+    trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
+    uuid = conf[key]
+    width = _UUID_WIDTHS[len(uuid)]
+    value = as_hex(uuid) if width != "128" else as_reversed_hex_array(uuid)
+    cg.add(getattr(trigger, f"{setter_prefix}{width}")(value))
+    if (mac := conf.get(CONF_MAC_ADDRESS)) is not None:
+        cg.add(trigger.set_address(mac.as_hex))
+    await automation.build_automation(trigger, [(adv_data_t_const_ref, "x")], conf)
+    _count_listener()
@@ -0,0 +1,26 @@
+#include "ble_client_state.h"
+
+namespace esphome::ble_device_base {
+
+const char *client_state_to_string(ClientState state) {
+  switch (state) {
+    case ClientState::INIT:
+      return "INIT";
+    case ClientState::DISCONNECTING:
+      return "DISCONNECTING";
+    case ClientState::IDLE:
+      return "IDLE";
+    case ClientState::DISCOVERED:
+      return "DISCOVERED";
+    case ClientState::CONNECTING:
+      return "CONNECTING";
+    case ClientState::CONNECTED:
+      return "CONNECTED";
+    case ClientState::ESTABLISHED:
+      return "ESTABLISHED";
+    default:
+      return "UNKNOWN";
+  }
+}
+
+}  // namespace esphome::ble_device_base
@@ -0,0 +1,53 @@
+// ble_client_state.h
+//
+// Platform-neutral GATT client connection state types, shared by every
+// platform's GATT client implementation (esp32_ble_client, bluetooth_connection
+// backends). Moved here from esp32_ble_tracker, which re-exports them under its
+// own namespace for backward compatibility.
+
+#pragma once
+
+#include <cstdint>
+
+namespace esphome::ble_device_base {
+
+/// ESPHome-private errors for the API's plain-int error fields, outside the
+/// ATT code range so they cannot be mistaken for spec errors. -1 is
+/// understood by API clients as "not connected". Shared by every GATT
+/// client backend.
+static constexpr int GATT_ERR_NOT_CONNECTED = -1;
+static constexpr int GATT_ERR_NO_MEMORY = -2;
+
+enum class ClientState : uint8_t {
+  // Connection is allocated
+  INIT,
+  // Client is disconnecting
+  DISCONNECTING,
+  // Connection is idle, no device detected.
+  IDLE,
+  // Device advertisement found.
+  DISCOVERED,
+  // Connection in progress.
+  CONNECTING,
+  // Initial connection established.
+  CONNECTED,
+  // The client and sub-clients have completed setup.
+  ESTABLISHED,
+};
+
+// Helper function to convert ClientState to string
+const char *client_state_to_string(ClientState state);
+
+enum class ConnectionType : uint8_t {
+  // The default connection type, we hold all the services in ram
+  // for the duration of the connection.
+  V1,
+  // The client has a cache of the services and mtu so we should not
+  // fetch them again
+  V3_WITH_CACHE,
+  // The client does not need the services and mtu once we send them
+  // so we should wipe them from memory as soon as we send them
+  V3_WITHOUT_CACHE
+};
+
+}  // namespace esphome::ble_device_base
@@ -8,6 +8,7 @@
 #include "ble_aes_ccm.h"

 #include "esphome/core/defines.h"
+#include "esphome/core/hal.h"
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"

@@ -98,6 +99,8 @@ ESPBTUUID ESPBTUUID::from_raw(const char *data, size_t length) {

 #ifdef USE_ESP32
 ESPBTUUID ESPBTUUID::from_uuid(esp_bt_uuid_t uuid) {
+  if (uuid.len == 0)  // the unset sentinel get_uuid() emits
+    return {};
  if (uuid.len == ESP_UUID_LEN_16)
    return ESPBTUUID::from_uint16(uuid.uuid.uuid16);
  if (uuid.len == ESP_UUID_LEN_32)
@@ -108,6 +111,10 @@ ESPBTUUID ESPBTUUID::from_uuid(esp_bt_uuid_t uuid) {
 esp_bt_uuid_t ESPBTUUID::get_uuid() const {
  esp_bt_uuid_t ret;
  switch (this->type_) {
+    case Type::UNSET:
+      ret.len = 0;
+      memset(&ret.uuid, 0, sizeof(ret.uuid));
+      break;
    case Type::UUID16:
      ret.len = ESP_UUID_LEN_16;
      ret.uuid.uuid16 = this->uuid_.uuid16;
@@ -129,7 +136,7 @@ void ESPBTDevice::parse_scan_rst(const esp32_ble::BLEScanResult &scan_result) {
  this->scan_result_ = &scan_result;
  // BLEScanResult's bda is most-significant octet first; the neutral ingest
  // takes the BLE controller (LSB-first) order, so reverse — address_uint64()/
-  // address_str() then produce exactly the historical esp32 values.
+  // address_str_to() then produce exactly the historical esp32 values.
  uint8_t mac_lsb_first[6];
  for (uint8_t i = 0; i < 6; i++)
    mac_lsb_first[i] = scan_result.bda[5 - i];
@@ -139,7 +146,8 @@ void ESPBTDevice::parse_scan_rst(const esp32_ble::BLEScanResult &scan_result) {
 #endif  // USE_ESP32

 ESPBTUUID ESPBTUUID::as_128bit() const {
-  if (this->type_ == Type::UUID128)
+  // Widening an unset UUID stays unset; expanding it would produce a set 0x0000 base UUID.
+  if (this->type_ == Type::UNSET || this->type_ == Type::UUID128)
    return *this;
  uint8_t data[16];
  this->to_128bit_(data);
@@ -149,6 +157,8 @@ ESPBTUUID ESPBTUUID::as_128bit() const {
 bool ESPBTUUID::contains(uint8_t data1, uint8_t data2) const {
  // Adjacent byte-pair search — identical semantics to esp32_ble::ESPBTUUID::contains.
  switch (this->type_) {
+    case Type::UNSET:
+      return false;
    case Type::UUID16:
      return (this->uuid_.uuid16 >> 8) == data2 && (this->uuid_.uuid16 & 0xFF) == data1;
    case Type::UUID32:
@@ -173,6 +183,9 @@ const char *ESPBTUUID::to_str(char *buf) const {
  // Identical output format to esp32_ble::ESPBTUUID::to_str.
  char *pos = buf;
  switch (this->type_) {
+    case Type::UNSET:
+      memcpy(buf, "None", 5);
+      return buf;
    case Type::UUID16:
      *pos++ = '0';
      *pos++ = 'x';
@@ -207,6 +220,7 @@ const char *ESPBTUUID::to_str(char *buf) const {
 void ESPBTUUID::to_128bit_(uint8_t out[16]) const {
  // Bluetooth Base UUID 00000000-0000-1000-8000-00805F9B34FB (LSB-first), with the 16/32-bit
  // value placed at bytes 12..; identical expansion to esp32_ble::ESPBTUUID::as_128bit().
+  // Callers screen out UNSET first (operator==, as_128bit); it would expand like 0x0000.
  static const uint8_t BASE[16] = {0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
                                   0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
  if (this->type_ == Type::UUID128) {
@@ -223,6 +237,8 @@ void ESPBTUUID::to_128bit_(uint8_t out[16]) const {
 bool ESPBTUUID::operator==(const ESPBTUUID &other) const {
  if (this->type_ == other.type_) {
    switch (this->type_) {
+      case Type::UNSET:
+        return true;
      case Type::UUID16:
        return this->uuid_.uuid16 == other.uuid_.uuid16;
      case Type::UUID32:
@@ -232,6 +248,9 @@ bool ESPBTUUID::operator==(const ESPBTUUID &other) const {
    }
    return false;
  }
+  // Unset never equals a set UUID; 0x0000 is a valid value, distinct from "not configured".
+  if (this->type_ == Type::UNSET || other.type_ == Type::UNSET)
+    return false;
  // Different widths: expand both to the 128-bit Bluetooth Base UUID form and compare, so a
  // configured 16/32-bit UUID matches the equivalent 128-bit advertisement (esp32 parity).
  uint8_t a[16];
@@ -247,16 +266,21 @@ bool ESPBTUUID::operator==(const ESPBTUUID &other) const {

 ESPBLEiBeacon::ESPBLEiBeacon(const uint8_t *data) { memcpy(&this->beacon_data_, data, sizeof(this->beacon_data_)); }

-optional<ESPBLEiBeacon> ESPBLEiBeacon::from_manufacturer_data(const ServiceData &data) {
+optional<ESPBLEiBeacon> ESPBLEiBeacon::from_manufacturer_data(const ServiceData &data, bool *prefix_rejected) {
  // iBeacon manufacturer specific data (after company-ID bytes have been stripped):
  //   [0x02][0x15][16-byte UUID][2-byte major][2-byte minor][1-byte power] = exactly 23 bytes
-  // Parity with esp32_ble_tracker: gate on the Apple company ID and length only.
-  // (Checking the 0x02/0x15 sub-type prefix would be stricter, but is a behavior
-  // change; it belongs to a follow-up, not this refactor.)
  if (!data.uuid.contains(0x4C, 0x00))  // Apple company ID 0x004C
    return {};
  if (data.data.size() != 23)
    return {};
+  // Require the iBeacon sub-type/length prefix — stricter than the legacy
+  // esp32 parser, which accepted any 23-byte Apple payload and surfaced
+  // non-iBeacon frames as garbage beacons.
+  if (data.data[0] != 0x02 || data.data[1] != 0x15) {
+    if (prefix_rejected != nullptr)
+      *prefix_rejected = true;
+    return {};
+  }
  return ESPBLEiBeacon(data.data.data());
 }

@@ -264,6 +288,44 @@ optional<ESPBLEiBeacon> ESPBLEiBeacon::from_manufacturer_data(const ServiceData
 // ESPBTDevice
 // ---------------------------------------------------------------------------

+optional<ESPBLEiBeacon> ESPBTDevice::get_ibeacon() const {
+  bool prefix_rejected = false;
+  uint8_t rejected_sub_type = 0;
+  uint8_t rejected_len = 0;
+  for (const auto &it : this->manufacturer_datas_) {
+    bool rejected = false;
+    auto res = ESPBLEiBeacon::from_manufacturer_data(it, &rejected);
+    if (res.has_value())
+      return res;
+    if (rejected && !prefix_rejected) {
+      prefix_rejected = true;
+      rejected_sub_type = it.data[0];
+      rejected_len = it.data[1];
+    }
+  }
+  if (prefix_rejected) {
+    // Only when no beacon was found at all: these frames were accepted before
+    // the prefix check, so their disappearance must be observable at the
+    // default log level. Throttled so a chatty non-iBeacon Apple advertiser
+    // cannot flood the log; a different address may bypass the shared window
+    // so that advertiser cannot mask the device that actually regressed — but
+    // with a 1 s floor, or two alternating advertisers log every frame.
+    static uint32_t last_log = 0;
+    static uint64_t last_addr = 0;
+    const uint32_t now = millis();
+    const uint64_t addr = this->address_uint64();
+    const uint32_t since = now - last_log;
+    if (last_log == 0 || since > 60000 || (addr != last_addr && since > 1000)) {
+      last_log = now;
+      last_addr = addr;
+      char addr_buf[MAC_ADDRESS_PRETTY_BUFFER_SIZE];
+      ESP_LOGD(TAG, "%s: 23-byte Apple frame without iBeacon prefix ignored (sub-type 0x%02X len 0x%02X)",
+               this->address_str_to(addr_buf), rejected_sub_type, rejected_len);
+    }
+  }
+  return {};
+}
+
 const char *ESPBTDevice::address_type_str() const {
  switch (this->address_type_) {
    case BLE_ADDR_TYPE_PUBLIC:
@@ -287,7 +349,8 @@ void ESPBTDevice::from_scan_result(const uint8_t *mac, int rssi, uint8_t addr_ty
    this->address_[i] = mac[5 - i];
  this->address_type_ = addr_type;
  this->rssi_ = rssi;
-  this->name_.clear();
+  this->name_len_ = 0;
+  this->name_[0] = '\0';
  this->service_uuids_.clear();
  this->manufacturer_datas_.clear();
  this->service_datas_.clear();
@@ -303,7 +366,7 @@ void ESPBTDevice::from_scan_result(const uint8_t *mac, int rssi, uint8_t addr_ty
            "  Address: %s (%s)\n"
            "  RSSI: %d\n"
            "  Name: '%s'",
-            this->address_str_to(addr_buf), this->address_type_str(), this->rssi_, this->name_.c_str());
+            this->address_str_to(addr_buf), this->address_type_str(), this->rssi_, this->name_);
  for (auto &it : this->tx_powers_) {
    ESP_LOGVV(TAG, "  TX Power: %d", it);
  }
@@ -346,6 +409,7 @@ void ESPBTDevice::from_scan_result(const uint8_t *mac, int rssi, uint8_t addr_ty
 #endif  // ESPHOME_LOG_HAS_VERY_VERBOSE
 }

+// Remove before 2027.2.0
 std::string ESPBTDevice::address_str() const {
  char buf[MAC_ADDRESS_PRETTY_BUFFER_SIZE];
  return std::string(this->address_str_to(buf));
@@ -414,8 +478,12 @@ void ESPBTDevice::parse_adv_(const uint8_t *payload, uint16_t len) {
        // Keep the longest name seen — a merged adv + scan-response frame may carry both the
        // shortened and the complete name, and the shortened form must never replace the
        // complete one (same rule as esp32_ble_tracker's parse_adv_).
-        if (ad_data_len > this->name_.length())
-          this->name_.assign(reinterpret_cast<const char *>(ad_data), ad_data_len);
+        if (ad_data_len > this->name_len_) {
+          uint8_t name_len = ad_data_len > MAX_ADV_NAME_LEN ? MAX_ADV_NAME_LEN : static_cast<uint8_t>(ad_data_len);
+          memcpy(this->name_, ad_data, name_len);
+          this->name_[name_len] = '\0';
+          this->name_len_ = name_len;
+        }
        break;

      case 0x0A:  // TX Power Level
@@ -14,6 +14,7 @@

 #include "esphome/core/defines.h"
 #include "esphome/core/helpers.h"
+#include "esphome/core/string_ref.h"

 #include <cstdint>
 #include <cstring>
@@ -85,14 +86,17 @@ class ESPBTUUID {
  bool operator==(const ESPBTUUID &other) const;
  bool operator!=(const ESPBTUUID &other) const { return !(*this == other); }

-  /// Write "0xABCD" / "0xABCDEF01" / the dashed 128-bit form into buf
-  /// (>= UUID_STR_LEN bytes) and return buf.
+  /// Write "0xABCD" / "0xABCDEF01" / the dashed 128-bit form, or "None" for an
+  /// unset UUID, into buf (>= UUID_STR_LEN bytes) and return buf.
  const char *to_str(char *buf) const;
 #if defined(__cpp_lib_span)
  const char *to_str(std::span<char, UUID_STR_LEN> output) const { return this->to_str(output.data()); }
 #endif
-  enum class Type : uint8_t { UUID16, UUID32, UUID128 };
+  // UNSET is the default-constructed state; get_uuid() reports it as len 0 (the historical sentinel).
+  enum class Type : uint8_t { UNSET, UUID16, UUID32, UUID128 };
  Type type() const { return this->type_; }
+  /// True if a UUID has been configured (not default-constructed).
+  bool is_set() const { return this->type_ != Type::UNSET; }
  uint16_t uuid16() const { return this->uuid_.uuid16; }
  uint32_t uuid32() const { return this->uuid_.uuid32; }
  const uint8_t *uuid128() const { return this->uuid_.uuid128; }
@@ -101,7 +105,7 @@ class ESPBTUUID {
  // Expand to the 128-bit Bluetooth Base UUID byte form (out is 16 bytes, little-endian).
  void to_128bit_(uint8_t out[16]) const;

-  Type type_{Type::UUID16};
+  Type type_{Type::UNSET};
  union {
    uint16_t uuid16;
    uint32_t uuid32;
@@ -126,7 +130,12 @@ class ESPBLEiBeacon {
 public:
  ESPBLEiBeacon() { memset(&this->beacon_data_, 0, sizeof(this->beacon_data_)); }
  explicit ESPBLEiBeacon(const uint8_t *data);
-  static optional<ESPBLEiBeacon> from_manufacturer_data(const ServiceData &data);
+  /// prefix_rejected: caller must initialise to false; set to true ONLY when a
+  /// 23-byte Apple frame was refused for lacking the 0x02/0x15 iBeacon prefix —
+  /// the case the legacy esp32 parser accepted. Never written on accept or on
+  /// the non-Apple/wrong-size rejects. The caller with the device address does
+  /// the logging (see ESPBTDevice::get_ibeacon()).
+  static optional<ESPBLEiBeacon> from_manufacturer_data(const ServiceData &data, bool *prefix_rejected = nullptr);

  uint16_t get_major() const { return byteswap(this->beacon_data_.major); }
  uint16_t get_minor() const { return byteswap(this->beacon_data_.minor); }
@@ -144,6 +153,27 @@ class ESPBLEiBeacon {
  } beacon_data_;
 };

+/// Pack a controller-order (LSB-first) MAC into the uint64 the API speaks.
+///
+/// The result is the printable-order value esp32 has always sent
+/// (esp32_ble::ble_addr_to_uint64), so both proxy paths agree on the wire.
+/// This takes the raw controller order delivered by BLEHub's raw-advertisement
+/// callback; ESPBTDevice::address_uint64() is the equivalent for an already
+/// parsed device, whose address is stored MSB-first.
+inline uint64_t mac_lsb_first_to_uint64(const uint8_t *mac) {
+  uint64_t addr = 0;
+  for (int i = 0; i < 6; i++)
+    addr |= static_cast<uint64_t>(mac[i]) << (i * 8);
+  return addr;
+}
+
+/// Unpack a uint64 BLE address into printable (MSB-first) byte order —
+/// the order bd_addr_t / esp_bd_addr_t style APIs expect.
+inline void uint64_to_mac_msb_first(uint64_t address, uint8_t out[6]) {
+  for (int i = 0; i < 6; i++)
+    out[i] = (address >> ((5 - i) * 8)) & 0xFF;
+}
+
 // ---------------------------------------------------------------------------
 // ESPBTDevice — parsed BLE advertisement
 // ---------------------------------------------------------------------------
@@ -158,8 +188,9 @@ class ESPBTDevice {
  static constexpr size_t MAC_ADDRESS_PRETTY_BUFFER_SIZE = esphome::MAC_ADDRESS_PRETTY_BUFFER_SIZE;

  /// Return MAC as "XX:XX:XX:XX:XX:XX" string.
+  ESPDEPRECATED("Use address_str_to() instead. Removed in 2027.2.0.", "2026.8.0")
  std::string address_str() const;
-  /// Buffer overload: writes "XX:XX:XX:XX:XX:XX\0" into buf (>= 18 bytes), returns buf.
+  /// Writes "XX:XX:XX:XX:XX:XX\0" into buf (>= MAC_ADDRESS_PRETTY_BUFFER_SIZE bytes), returns buf.
  const char *address_str_to(char *buf) const;
 #if defined(__cpp_lib_span)
  const char *address_str_to(std::span<char, MAC_ADDRESS_PRETTY_BUFFER_SIZE> buf) const {
@@ -175,6 +206,8 @@ class ESPBTDevice {
  // Historical esp32 signature: consumers assign the result to esp_ble_addr_type_t.
  esp_ble_addr_type_t get_address_type() const { return static_cast<esp_ble_addr_type_t>(this->address_type_); }
  /// Historical esp32 ingest (esp32 builds only): parse an ESP-IDF scan result.
+  /// Prefer ESPBTDevice::from_scan_result(); deprecation is a follow-up pending
+  /// consumer feedback on the raw scan-result fields.
  void parse_scan_rst(const esp32_ble::BLEScanResult &scan_result);
  // Exposed through a function for use in lambdas
  const esp32_ble::BLEScanResult &get_scan_result() const { return *scan_result_; }
@@ -186,7 +219,9 @@ class ESPBTDevice {
  const char *address_type_str() const;

  int get_rssi() const { return rssi_; }
-  const std::string &get_name() const { return name_; }
+  /// Advertised name as a view into the fixed buffer (always NUL-terminated,
+  /// so c_str() is safe); converts implicitly to std::string where needed.
+  StringRef get_name() const { return StringRef(this->name_, this->name_len_); }

  const std::vector<ESPBTUUID> &get_service_uuids() const { return service_uuids_; }
  const std::vector<ServiceData> &get_manufacturer_datas() const { return manufacturer_datas_; }
@@ -200,22 +235,22 @@ class ESPBTDevice {
  /// decryptor; compiled only when a sensor configures irk: (request_irk_support).
  bool resolve_irk(const uint8_t *irk) const;

-  optional<ESPBLEiBeacon> get_ibeacon() const {
-    for (const auto &it : this->manufacturer_datas_) {
-      auto res = ESPBLEiBeacon::from_manufacturer_data(it);
-      if (res.has_value())
-        return res;
-    }
-    return {};
-  }
+  optional<ESPBLEiBeacon> get_ibeacon() const;

 protected:
  void parse_adv_(const uint8_t *payload, uint16_t len);

+  // Max name bytes in a legacy advertisement AD element (31-byte PDU minus
+  // the 2-byte element header); every in-tree tracker scans legacy PDUs only.
+  static constexpr uint8_t MAX_ADV_NAME_LEN = 29;
+
  uint8_t address_[6]{0};
  uint8_t address_type_{0};
  int rssi_{0};
-  std::string name_{};
+  // Fixed buffer instead of std::string: no per-advertisement heap churn on
+  // the scan path, and no libstdc++ string/exception machinery in the image.
+  char name_[MAX_ADV_NAME_LEN + 1]{};
+  uint8_t name_len_{0};
  std::vector<ESPBTUUID> service_uuids_{};
  std::vector<ServiceData> manufacturer_datas_{};
  std::vector<ServiceData> service_datas_{};
@@ -0,0 +1,140 @@
+// ble_gatt_client.h
+//
+// Platform-neutral GATT client connection contract.
+//
+// A platform's GATT client backend (bluetooth_connection/esp32,
+// bluetooth_connection/rp2) implements BLEGattConnection; consumers
+// (bluetooth_proxy) drive it through this interface and receive
+// completions through GattClientEventListener. All listener callbacks are
+// delivered on the ESPHome main loop; borrowed data pointers are valid only
+// for the duration of the call.
+//
+// Error domain (plain int, forwarded to the API without translation):
+//   0            success
+//   1..0x11      ATT error codes (Bluetooth spec; BTstack and Bluedroid agree)
+//   GATT_ERR_NOT_CONNECTED (-1)  no connection to the peer (on esp32 a raw
+//                ESP_FAIL from the stack shares this value; both read as a
+//                failed, unusable connection on the client side)
+//   GATT_ERR_NO_MEMORY (-2)      backend storage exhausted
+//   anything else: platform stack error/status code, surfaced opaquely.
+// Connection events carry HCI status/disconnect reason codes (same code
+// space on every controller).
+
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#ifdef USE_BLE_GATT_CLIENT
+
+#include "ble_client_state.h"
+#include "ble_device.h"
+
+#include <cstdint>
+
+namespace esphome::ble_device_base {
+
+// Materialized GATT database of a connected peer, discovered by the backend
+// and streamed to the API by the consumer. Flat arrays with index ranges
+// (not pointers): a service owns characteristics
+// [first_characteristic, first_characteristic + characteristic_count) and a
+// characteristic owns descriptors [first_descriptor, ...) — discovery is
+// depth-first, so the ranges are naturally contiguous.
+struct GattDescriptor {
+  ESPBTUUID uuid;
+  uint16_t handle;
+};
+
+struct GattCharacteristic {
+  ESPBTUUID uuid;
+  uint16_t value_handle;
+  // Needed to rebuild the stack's characteristic object for CCCD operations.
+  uint16_t end_handle;
+  uint8_t properties;  // Bluetooth spec property bitfield
+  uint16_t first_descriptor;
+  uint16_t descriptor_count;
+};
+
+struct GattService {
+  ESPBTUUID uuid;
+  uint16_t start_handle;
+  uint16_t end_handle;
+  uint16_t first_characteristic;
+  uint16_t characteristic_count;
+};
+
+/// Borrowed view of the backend-owned service table. Valid from a successful
+/// on_service_discovery_done() until release_services(). Characteristics and
+/// descriptors are reached through the per-service/per-characteristic index
+/// ranges; the array totals let a consumer bounds-check those ranges instead
+/// of trusting the backend's discovery bookkeeping blindly.
+struct GattServiceTable {
+  const GattService *services{nullptr};
+  const GattCharacteristic *characteristics{nullptr};
+  const GattDescriptor *descriptors{nullptr};
+  uint16_t service_count{0};
+  uint16_t characteristic_count{0};
+  uint16_t descriptor_count{0};
+};
+
+/// Completion/event sink for a GATT connection. Implemented by the consumer
+/// (bluetooth_proxy's connection wrapper). Every callback runs on the main loop.
+class GattClientEventListener {
+ public:
+  virtual ~GattClientEventListener() = default;
+
+  /// Connected (with negotiated MTU) or disconnected/connect-failed
+  /// (error = HCI status or disconnect reason).
+  virtual void on_connection_state(bool connected, uint16_t mtu, int error) = 0;
+  /// Service discovery finished; on success the service table is populated.
+  virtual void on_service_discovery_done(int error) = 0;
+  /// Characteristic or descriptor read finished. data/len valid during the call.
+  virtual void on_read_result(uint16_t handle, const uint8_t *data, uint16_t len, int error) = 0;
+  /// Characteristic write-with-response or descriptor write finished.
+  virtual void on_write_result(uint16_t handle, int error) = 0;
+  /// Notification/indication registration state changed.
+  virtual void on_notify_state(uint16_t handle, bool enabled, int error) = 0;
+  /// Notification/indication data from the peer. data/len valid during the call.
+  virtual void on_notify_data(uint16_t handle, const uint8_t *data, uint16_t len) = 0;
+};
+
+/// One GATT client connection slot. Operations return 0 when accepted
+/// (completion arrives via the listener) or a synchronous error code
+/// (busy, not connected, stack rejection). One operation may be outstanding
+/// at a time; callers see a synchronous error otherwise.
+class BLEGattConnection {
+ public:
+  virtual ~BLEGattConnection() = default;
+
+  void set_listener(GattClientEventListener *listener) { this->listener_ = listener; }
+
+  /// Start connecting to a peer. addr_type is a BLE_ADDR_TYPE_* constant
+  /// (ble_device.h). Completion: on_connection_state().
+  virtual int connect(uint64_t address, uint8_t addr_type) = 0;
+  /// Disconnect (or cancel a connect in progress). Completion: on_connection_state().
+  virtual int disconnect() = 0;
+  /// Discover the peer's services/characteristics/descriptors into the
+  /// service table. Completion: on_service_discovery_done().
+  virtual int discover_services() = 0;
+  virtual int read_characteristic(uint16_t handle) = 0;
+  virtual int write_characteristic(uint16_t handle, const uint8_t *data, uint16_t len, bool response) = 0;
+  virtual int read_descriptor(uint16_t handle) = 0;
+  virtual int write_descriptor(uint16_t handle, const uint8_t *data, uint16_t len) = 0;
+  /// Enable/disable delivery of on_notify_data() for a characteristic value
+  /// handle. Local registration only — the CCCD write is the API client's
+  /// responsibility (it arrives as a plain write_descriptor).
+  virtual int notify_characteristic(uint16_t handle, bool enable) = 0;
+  virtual int update_connection_params(uint16_t min_interval, uint16_t max_interval, uint16_t latency,
+                                       uint16_t timeout) = 0;
+
+  /// Backend-owned service table (see GattServiceTable lifetime).
+  virtual GattServiceTable get_service_table() = 0;
+  /// Free the transient service table storage. Call after streaming.
+  virtual void release_services() = 0;
+
+ protected:
+  GattClientEventListener *listener_{nullptr};
+};
+
+}  // namespace esphome::ble_device_base
+
+#endif  // USE_BLE_GATT_CLIENT
@@ -17,15 +17,36 @@
 #include "ble_device.h"

 #include <cstdint>
-#include <functional>

 namespace esphome::ble_device_base {

-/// Callback for raw advertisements (the bluetooth_proxy path).
-/// mac[] is least-significant octet first (BLE controller convention);
-/// the hub delivers on the ESPHome main loop.
-using RawAdvertisementCallback =
-    std::function<void(const uint8_t *mac, int rssi, uint8_t addr_type, const uint8_t *data, uint16_t data_len)>;
+/// One raw advertisement as delivered by the controller — a borrowed view,
+/// valid only for the duration of the invoke() callback.
+struct RawAdvertisement {
+  /// Least-significant octet first (BLE controller convention).
+  const uint8_t *mac;
+  const uint8_t *data;
+  uint16_t data_len;
+  int8_t rssi;  // signed dBm
+  uint8_t addr_type;
+};
+
+/// Subscriber slot for the raw-advertisement stream (the bluetooth_proxy
+/// path). The hub delivers on the ESPHome main loop. Same shape as
+/// logger.h's LogCallback: an instance pointer plus a plain function
+/// pointer — no virtuals, no std::function.
+///
+/// Usage:
+///   hub->set_raw_advertisement_callback({this, [](void *self, const RawAdvertisement &adv) {
+///     static_cast<MyComponent *>(self)->on_raw_advertisement(adv);
+///   }});
+struct RawAdvertisementCallback {
+  void *instance{nullptr};
+  void (*fn)(void *instance, const RawAdvertisement &adv){nullptr};
+  /// A default-constructed slot is "no subscriber"; hubs must guard on this.
+  bool is_set() const { return this->fn != nullptr; }
+  void invoke(const RawAdvertisement &adv) const { this->fn(this->instance, adv); }
+};

 /// What a tracker's controller/SDK can do — consumers branch on data, not #ifdefs.
 struct HubCapabilities {
@@ -35,9 +56,15 @@ struct HubCapabilities {
  /// frame. When false, consumers relying on scan-response fields (e.g. names)
  /// may only see them where the receiver merges per address (Home Assistant does).
  bool merges_scan_response;
-  /// GATT client connections are available (today: esp32 only, but a chip SDK
-  /// gaining GATT support only has to flip this bit).
+  /// GATT client connections are available: the platform has a
+  /// bluetooth_connection backend implementing ble_device_base::BLEGattConnection
+  /// (ble_gatt_client.h). Today: esp32; rp2 follows with its BTstack backend.
  bool gatt;
+  /// request_scan_mode() is honored at runtime. Distinct from active_scan:
+  /// a passive-only controller (bk72xx) can never switch, and a hub may
+  /// support active scanning yet still refuse the runtime switch
+  /// (esp32_ble_tracker drives its mode through its own tracker API).
+  bool scan_mode_switch;
 };

 class BLEHub {
@@ -48,7 +75,7 @@ class BLEHub {
  virtual void register_listener(ESPBTDeviceListener *listener) = 0;

  /// Wire the raw-advertisement stream (bluetooth_proxy). One consumer at a time.
-  virtual void set_raw_advertisement_callback(RawAdvertisementCallback cb) = 0;
+  virtual void set_raw_advertisement_callback(RawAdvertisementCallback callback) = 0;

  virtual HubCapabilities get_capabilities() const = 0;

@@ -58,6 +85,17 @@ class BLEHub {
  virtual bool scan_running() = 0;
  /// True when the current/configured scan mode is active (scan requests sent).
  virtual bool scan_active() = 0;
+  /// Request a scan-mode change (active = send scan requests). Returns false
+  /// when the hub cannot honor the request; the caller reports the real state
+  /// back to its subscriber. A hub that returns true applies the mode
+  /// immediately: a running scan is restarted with the new mode, an idle one
+  /// picks it up on its next start. The default cannot-change keeps hubs
+  /// without a mode switch (and out-of-tree trackers) building unchanged.
+  /// Independent of HubCapabilities::active_scan: that bit describes what the
+  /// CONTROLLER can do; whether this method honors requests is advertised by
+  /// HubCapabilities::scan_mode_switch, so consumers can gate features on the
+  /// switch without probing.
+  virtual bool request_scan_mode(bool active) { return false; }
 };

 }  // namespace esphome::ble_device_base
@@ -5,6 +5,8 @@
 #include <ctime>

 #include "esphome/core/component.h"
+#include "esphome/core/helpers.h"
+#include "esphome/core/string_ref.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 #include "esphome/components/text_sensor/text_sensor.h"

@@ -18,22 +20,10 @@ class BLEScanner final : public text_sensor::TextSensor,
 public:
  bool parse_device(const esp32_ble_tracker::ESPBTDevice &device) override {
    char addr_buf[MAC_ADDRESS_PRETTY_BUFFER_SIZE];
-    // Escape special characters in the device name for valid JSON
-    const char *name = device.get_name().c_str();
+    // Escape special characters in the device name for valid JSON. Control characters stay in the \u00XX form this
+    // sensor has always published.
    char escaped_name[128];
-    size_t pos = 0;
-    for (; *name != '\0' && pos < sizeof(escaped_name) - 7; name++) {
-      uint8_t c = static_cast<uint8_t>(*name);
-      if (c == '"' || c == '\\') {
-        escaped_name[pos++] = '\\';
-        escaped_name[pos++] = c;
-      } else if (c < 0x20) {
-        pos += snprintf(escaped_name + pos, sizeof(escaped_name) - pos, "\\u%04x", c);
-      } else {
-        escaped_name[pos++] = c;
-      }
-    }
-    escaped_name[pos] = '\0';
+    json_escape_into_buffer(escaped_name, device.get_name(), /*short_control_escapes=*/false);

    char buf[256];
    snprintf(buf, sizeof(buf), "{\"timestamp\":%" PRId64 ",\"address\":\"%s\",\"rssi\":%d,\"name\":\"%s\"}",
@@ -1,14 +1,50 @@
+import functools
 import logging

 import esphome.codegen as cg
-from esphome.components import esp32_ble, esp32_ble_client, esp32_ble_tracker
-from esphome.components.esp32 import add_idf_sdkconfig_option
-from esphome.components.esp32_ble import BTLoggers
+from esphome.components import ble_device_base
 import esphome.config_validation as cv
-from esphome.const import CONF_ACTIVE, CONF_ID
+from esphome.const import CONF_ACTIVE, CONF_ID, PLATFORM_LN882X, PLATFORM_RP2
+from esphome.core import CORE
+from esphome.schema_extractors import SCHEMA_EXTRACT, schema_extractor
+from esphome.types import ConfigType

-AUTO_LOAD = ["esp32_ble_client", "esp32_ble_tracker"]
-DEPENDENCIES = ["api", "esp32"]
+# The esp32 BLE stack (esp32_ble, esp32_ble_client, esp32_ble_tracker) is
+# imported lazily inside _esp32_config_schema()/_to_code_esp32(): importing
+# those modules registers esp32-only automations (ble.enable, ble.disable, ...)
+# as a side effect, and a module-scope import would leak them into every
+# platform's registry the moment a config declares `bluetooth_proxy:` —
+# degrading "Unable to find action" config errors into C++ compile failures.
+
+
+def AUTO_LOAD(config: ConfigType | None = None) -> list[str]:
+    """Components to auto-load for the platform being compiled.
+
+    Callable with no argument so tooling that resolves AUTO_LOAD without a
+    target platform (the device-builder catalog sync does exactly this) gets
+    the union of every arm instead of an empty list — which is what lets it
+    keep cross-referencing the esp32 BLE stack. A real build always has a
+    target platform set, so it takes one of the concrete branches.
+    """
+    if CORE.is_esp32:
+        return ["esp32_ble_client", "esp32_ble_tracker"]
+    if CORE.target_platform in _HUB_PLATFORMS:
+        return ["ble_device_base"]
+    # No target platform, or one this component does not support: tooling
+    # resolving the manifest (including the host-pinned dependency resolver) —
+    # expose every arm so the closure keeps the esp32 BLE stack.
+    return ["ble_device_base", "esp32_ble_client", "esp32_ble_tracker"]
+
+
+# Platforms with an in-tree ble_device_base BLE tracker hub whose controller
+# supports active scanning. Passive-only hubs (bk72xx) are deliberately NOT
+# admitted yet: every current client (aioesphomeapi, bleak-esphome, Home
+# Assistant) assumes an ESPHome proxy can scan actively, so a passive-only
+# proxy would be misdriven — bk72xx follows once the API carries a feature
+# flag clients can trust (FEATURE_ACTIVE_SCAN + a version flag, separate PRs).
+_HUB_PLATFORMS = (PLATFORM_LN882X, PLATFORM_RP2)
+
+DEPENDENCIES = ["api"]
 CODEOWNERS = ["@jesserockz", "@bdraco"]

 _LOGGER = logging.getLogger(__name__)
@@ -20,65 +56,209 @@ DEFAULT_CONNECTION_SLOTS = 3

 bluetooth_proxy_ns = cg.esphome_ns.namespace("bluetooth_proxy")

-BluetoothProxy = bluetooth_proxy_ns.class_(
-    "BluetoothProxy", esp32_ble_tracker.ESPBTDeviceListener, cg.Component
-)
-BluetoothConnection = bluetooth_proxy_ns.class_(
-    "BluetoothConnection", esp32_ble_client.BLEClientBase
-)
+BluetoothProxy = bluetooth_proxy_ns.class_("BluetoothProxy", cg.Component)

-CONNECTION_SCHEMA = esp32_ble_tracker.ESP_BLE_DEVICE_SCHEMA.extend(
-    {
-        cv.GenerateID(): cv.declare_id(BluetoothConnection),
-    }
-).extend(cv.COMPONENT_SCHEMA)
+# Mirrors esp32_ble.IDF_MAX_CONNECTIONS as a literal so the statically walkable
+# CONFIG_SCHEMA below can state the connection_slots range without importing the
+# esp32 BLE stack. tests/component_tests/bluetooth_proxy/ pins the two together.
+_IDF_MAX_CONNECTIONS = 9


-def validate_connections(config):
-    if CONF_CONNECTIONS in config:
-        if not config[CONF_ACTIVE]:
-            raise cv.Invalid(
-                "Connections can only be used if the proxy is set to active"
-            )
-    elif config[CONF_ACTIVE]:
-        connection_slots: int = config[CONF_CONNECTION_SLOTS]
-        esp32_ble.consume_connection_slots(connection_slots, "bluetooth_proxy")(config)
+@functools.cache
+def _esp32_config_schema() -> cv.All:
+    """Build the esp32 schema, importing the esp32 BLE stack only when used."""
+    from esphome.components import esp32_ble, esp32_ble_client, esp32_ble_tracker

-        return {
-            **config,
-            CONF_CONNECTIONS: [CONNECTION_SCHEMA({}) for _ in range(connection_slots)],
+    if esp32_ble.IDF_MAX_CONNECTIONS != _IDF_MAX_CONNECTIONS:
+        raise cv.Invalid(
+            f"bluetooth_proxy's connection-slot limit mirror "
+            f"({_IDF_MAX_CONNECTIONS}) is out of sync with "
+            f"esp32_ble.IDF_MAX_CONNECTIONS ({esp32_ble.IDF_MAX_CONNECTIONS}); "
+            f"update _IDF_MAX_CONNECTIONS in bluetooth_proxy/__init__.py"
+        )
+
+    BluetoothConnection = bluetooth_proxy_ns.class_(
+        "BluetoothConnection", esp32_ble_client.BLEClientBase
+    )
+    CONNECTION_SCHEMA = esp32_ble_tracker.ESP_BLE_DEVICE_SCHEMA.extend(
+        {
+            cv.GenerateID(): cv.declare_id(BluetoothConnection),
        }
+    ).extend(cv.COMPONENT_SCHEMA)
+
+    def validate_connections(config):
+        if CONF_CONNECTIONS in config:
+            if not config[CONF_ACTIVE]:
+                raise cv.Invalid(
+                    "Connections can only be used if the proxy is set to active"
+                )
+        elif config[CONF_ACTIVE]:
+            connection_slots: int = config[CONF_CONNECTION_SLOTS]
+            esp32_ble.consume_connection_slots(connection_slots, "bluetooth_proxy")(
+                config
+            )
+
+            return {
+                **config,
+                CONF_CONNECTIONS: [
+                    CONNECTION_SCHEMA({}) for _ in range(connection_slots)
+                ],
+            }
+        return config
+
+    return cv.All(
+        (
+            cv.Schema(
+                {
+                    **_COMMON_SCHEMA_KEYS,
+                    cv.Optional(CONF_ACTIVE, default=True): cv.boolean,
+                    cv.Optional(CONF_CACHE_SERVICES, default=True): cv.boolean,
+                    cv.Optional(
+                        CONF_CONNECTION_SLOTS,
+                        default=DEFAULT_CONNECTION_SLOTS,
+                    ): cv.All(
+                        cv.positive_int,
+                        cv.Range(min=1, max=esp32_ble.IDF_MAX_CONNECTIONS),
+                    ),
+                    cv.Optional(CONF_CONNECTIONS): cv.All(
+                        cv.ensure_list(CONNECTION_SCHEMA),
+                        cv.Length(min=1, max=esp32_ble.IDF_MAX_CONNECTIONS),
+                    ),
+                }
+            )
+            .extend(esp32_ble_tracker.ESP_BLE_DEVICE_SCHEMA)
+            .extend(cv.COMPONENT_SCHEMA)
+        ),
+        validate_connections,
+    )
+
+
+def _validate_no_active(config: ConfigType) -> ConfigType:
+    if config[CONF_ACTIVE]:
+        raise cv.Invalid(
+            "Active connections are not supported on this platform; the proxy "
+            "forwards advertisements only (set active: false)"
+        )
    return config


-CONFIG_SCHEMA = cv.All(
-    (
-        cv.Schema(
-            {
-                cv.GenerateID(): cv.declare_id(BluetoothProxy),
-                cv.Optional(CONF_ACTIVE, default=True): cv.boolean,
-                cv.Optional(CONF_CACHE_SERVICES, default=True): cv.boolean,
-                cv.Optional(
-                    CONF_CONNECTION_SLOTS,
-                    default=DEFAULT_CONNECTION_SLOTS,
-                ): cv.All(
-                    cv.positive_int,
-                    cv.Range(min=1, max=esp32_ble.IDF_MAX_CONNECTIONS),
-                ),
-                cv.Optional(CONF_CONNECTIONS): cv.All(
-                    cv.ensure_list(CONNECTION_SCHEMA),
-                    cv.Length(min=1, max=esp32_ble.IDF_MAX_CONNECTIONS),
-                ),
-            }
-        )
-        .extend(esp32_ble_tracker.ESP_BLE_DEVICE_SCHEMA)
-        .extend(cv.COMPONENT_SCHEMA)
-    ),
-    validate_connections,
+# Advertisement-only proxy on a neutral BLE hub: the hub's raw-advertisement
+# callback feeds the same API batching. GATT/active connections are excluded at
+# compile time — only the esp32 build compiles the connection stack; nothing
+# reads HubCapabilities::gatt at runtime for this today.
+# Keys both platform schemas must declare identically; each arm spreads this
+# dict so the shared surface cannot drift. CONF_ACTIVE deliberately stays
+# per-arm: its default differs (esp32 True, hub arms False — no GATT).
+_COMMON_SCHEMA_KEYS = {
+    cv.GenerateID(): cv.declare_id(BluetoothProxy),
+}
+
+_BLE_HUB_CONFIG_SCHEMA = cv.All(
+    cv.Schema(
+        {
+            **_COMMON_SCHEMA_KEYS,
+            # Declared directly (BLE_DEVICE_SCHEMA-style): appending a validator
+            # after a strict schema rejects an explicit `ble_hub_id` before it
+            # runs, and that key is the documented way to disambiguate once a
+            # platform has two trackers.
+            cv.GenerateID(ble_device_base.CONF_BLE_HUB_ID): cv.use_id(
+                ble_device_base.BLEHub
+            ),
+            cv.Optional(CONF_ACTIVE, default=False): cv.boolean,
+        }
+    ).extend(cv.COMPONENT_SCHEMA),
+    _validate_no_active,
 )


-async def to_code(config):
+@schema_extractor("schema")
+def _validate_platform(config: ConfigType) -> ConfigType:
+    """Apply the schema for the platform actually being compiled.
+
+    esp32 keeps the full GATT proxy; every other platform gets the
+    advertisement-only shape, which rejects the connection-oriented options
+    above because its schema does not define them.
+    """
+    if config is SCHEMA_EXTRACT:
+        # The language-schema dumper runs without a platform. Expose the esp32
+        # shape so `connections`, the ids and every default stay in the
+        # generated schema the editor and dashboard consume.
+        return _esp32_config_schema()
+    if CORE.is_esp32:
+        return _esp32_config_schema()(config)
+    if CORE.target_platform not in _HUB_PLATFORMS:
+        # Fail here with the actual reason. Without this gate the error surfaces
+        # later as an unresolvable hub ID ("Are you missing a hub declaration?")
+        # on platforms where no hub component can be declared.
+        raise cv.Invalid(
+            f"bluetooth_proxy is not supported on {CORE.target_platform}: no "
+            "active-scan-capable BLE tracker hub is available for this "
+            "platform. It runs on esp32 (full proxy), and the ln882x and rp2 "
+            "families (advertisement-only)."
+        )
+    return _BLE_HUB_CONFIG_SCHEMA(config)
+
+
+def _reject_connection_keys_off_esp32(config: ConfigType) -> ConfigType:
+    """Reject connection-oriented options by name on hub-only platforms.
+
+    Runs before the walkable schema below so the user gets "this option does
+    not exist here" instead of the option's esp32 value range (which would
+    imply a smaller number is accepted).
+    """
+    if not isinstance(config, dict) or CORE.is_esp32 or CORE.target_platform is None:
+        return config
+    if CORE.target_platform not in _HUB_PLATFORMS:
+        # No proxy of any kind exists here: fall through so _validate_platform
+        # reports "not supported on {platform}" instead of a key-level message
+        # implying an advertisement-only proxy is available.
+        return config
+    for key in (CONF_CONNECTION_SLOTS, CONF_CACHE_SERVICES, CONF_CONNECTIONS):
+        if key in config:
+            raise cv.Invalid(
+                f"'{key}' requires active connection support, which needs the "
+                "esp32 GATT stack; this platform runs the advertisement-only "
+                "proxy and has no such option",
+                path=[key],
+            )
+    return config
+
+
+# CONFIG_SCHEMA stays a statically walkable schema: tooling (the dashboard's
+# field-range extractor among others) introspects it to discover options and
+# their bounds, which a bare dispatch function would hide. It carries the scalar
+# keys with no defaults; _validate_platform then runs the real per-platform
+# schema, which applies the defaults and rejects options the platform does not
+# support.
+#
+# It deliberately does NOT declare `connections`: this outer schema runs before
+# the per-platform one, so any key it transforms is transformed twice. Running
+# CONNECTION_SCHEMA twice re-validates an already-generated ID through
+# declare_id(), which (unlike use_id) has no guard for an ID instance and
+# rejects it as empty. extra=ALLOW_EXTRA passes `connections` through untouched
+# for _ESP32_CONFIG_SCHEMA to validate exactly once.
+CONFIG_SCHEMA = cv.All(
+    _reject_connection_keys_off_esp32,
+    cv.Schema(
+        {
+            cv.Optional(CONF_ACTIVE): cv.boolean,
+            cv.Optional(CONF_CACHE_SERVICES): cv.boolean,
+            cv.Optional(CONF_CONNECTION_SLOTS): cv.All(
+                cv.positive_int,
+                cv.Range(min=1, max=_IDF_MAX_CONNECTIONS),
+            ),
+        },
+        extra=cv.ALLOW_EXTRA,
+    ),
+    _validate_platform,
+)
+
+
+async def _to_code_esp32(config: ConfigType) -> None:
+    from esphome.components import esp32_ble, esp32_ble_tracker
+    from esphome.components.esp32 import add_idf_sdkconfig_option
+    from esphome.components.esp32_ble import BTLoggers
+
    # Register the loggers this component needs
    esp32_ble.register_bt_logger(BTLoggers.GATT, BTLoggers.L2CAP, BTLoggers.SMP)

@@ -87,17 +267,12 @@ async def to_code(config):

    cg.add(var.set_active(config[CONF_ACTIVE]))
    await esp32_ble_tracker.register_raw_ble_device(var, config)
+    await esp32_ble_tracker.register_scanner_state_listener(var, config)

    # Define max connections for protobuf fixed array
    connection_count = len(config.get(CONF_CONNECTIONS, []))
    cg.add_define("BLUETOOTH_PROXY_MAX_CONNECTIONS", connection_count)

-    # Define batch size for BLE advertisements
-    # Each advertisement is up to 80 bytes when packaged (including protocol overhead)
-    # 16 advertisements × 80 bytes (worst case) = 1280 bytes out of ~1320 bytes usable payload
-    # This achieves ~97% WiFi MTU utilization while staying under the limit
-    cg.add_define("BLUETOOTH_PROXY_ADVERTISEMENT_BATCH_SIZE", 16)
-
    for connection_conf in config.get(CONF_CONNECTIONS, []):
        connection_var = cg.new_Pvariable(connection_conf[CONF_ID])
        await cg.register_component(connection_var, connection_conf)
@@ -107,4 +282,30 @@ async def to_code(config):
    if config.get(CONF_CACHE_SERVICES):
        add_idf_sdkconfig_option("CONFIG_BT_GATTC_CACHE_NVS_FLASH", True)

+
+async def _to_code_ble_hub(config: ConfigType) -> None:
+    var = cg.new_Pvariable(config[CONF_ID])
+    await cg.register_component(var, config)
+
+    cg.add(var.set_active(config[CONF_ACTIVE]))
+    hub = await cg.get_variable(config[ble_device_base.CONF_BLE_HUB_ID])
+    cg.add(var.set_ble_hub(hub))
+
+    # The api component sizes BluetoothConnectionsFreeResponse.allocated with
+    # this define whenever a proxy is present; no connections off-esp32.
+    cg.add_define("BLUETOOTH_PROXY_MAX_CONNECTIONS", 0)
+
+
+async def to_code(config: ConfigType) -> None:
+    if CORE.is_esp32:
+        await _to_code_esp32(config)
+    else:
+        await _to_code_ble_hub(config)
+
+    # Define batch size for BLE advertisements
+    # Each advertisement is up to 80 bytes when packaged (including protocol overhead)
+    # 16 advertisements × 80 bytes (worst case) = 1280 bytes out of ~1320 bytes usable payload
+    # This achieves ~97% WiFi MTU utilization while staying under the limit
+    cg.add_define("BLUETOOTH_PROXY_ADVERTISEMENT_BATCH_SIZE", 16)
+
    cg.add_define("USE_BLUETOOTH_PROXY")
@@ -1,6 +1,9 @@
 #include "bluetooth_proxy.h"

+#ifdef USE_BLUETOOTH_PROXY
+
 #include "esphome/components/api/api_server.h"
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "esphome/core/macros.h"
 #include "esphome/core/application.h"
@@ -8,8 +11,6 @@
 #include <cstring>
 #include <limits>

-#ifdef USE_ESP32
-
 namespace esphome::bluetooth_proxy {

 static const char *const TAG = "bluetooth_proxy";
@@ -23,14 +24,14 @@ static_assert(sizeof(((api::BluetoothLERawAdvertisement *) nullptr)->data) == 62

 BluetoothProxy::BluetoothProxy() { global_bluetooth_proxy = this; }

+#ifdef USE_ESP32
+
 void BluetoothProxy::setup() {
  this->connections_free_response_.limit = BLUETOOTH_PROXY_MAX_CONNECTIONS;
  this->connections_free_response_.free = BLUETOOTH_PROXY_MAX_CONNECTIONS;

  // Capture the configured scan mode from YAML before any API changes
  this->configured_scan_active_ = this->parent_->get_scan_active();
-
-  this->parent_->add_scanner_state_listener(this);
 }

 void BluetoothProxy::on_scanner_state(esp32_ble_tracker::ScannerState state) {
@@ -50,6 +51,62 @@ void BluetoothProxy::send_bluetooth_scanner_state_(esp32_ble_tracker::ScannerSta
  this->api_connection_->send_message(resp);
 }

+#else  // !USE_ESP32
+
+void BluetoothProxy::setup() {
+  this->connections_free_response_.limit = 0;
+  this->connections_free_response_.free = 0;
+
+  // Capture the configured scan mode from YAML before any API changes
+  this->configured_scan_active_ = this->hub_->scan_active();
+  this->last_scan_running_ = this->hub_->scan_running();
+
+  // The hub delivers raw advertisements on the ESPHome main loop:
+  // mac is least-significant octet first (BLE controller convention).
+  this->hub_->set_raw_advertisement_callback({this, [](void *self, const ble_device_base::RawAdvertisement &adv) {
+                                                static_cast<BluetoothProxy *>(self)->on_raw_advertisement_(adv);
+                                              }});
+}
+
+void BluetoothProxy::on_raw_advertisement_(const ble_device_base::RawAdvertisement &raw) {
+  if (!api::global_api_server->is_connected() || this->api_connection_ == nullptr)
+    return;
+
+  auto &adv = this->response_.advertisements[this->response_.advertisements_len];
+  // raw.mac is LSB-first; this yields the same uint64 the esp32 proxy sends.
+  adv.address = ble_device_base::mac_lsb_first_to_uint64(raw.mac);
+  adv.rssi = raw.rssi;
+  adv.address_type = raw.addr_type;
+  uint8_t length = raw.data_len > sizeof(adv.data) ? sizeof(adv.data) : static_cast<uint8_t>(raw.data_len);
+  adv.data_len = length;
+  std::memcpy(adv.data, raw.data, length);
+
+  this->response_.advertisements_len++;
+
+  ESP_LOGV(TAG, "Queuing raw packet from %02X:%02X:%02X:%02X:%02X:%02X, length %d. RSSI: %d dB", raw.mac[5], raw.mac[4],
+           raw.mac[3], raw.mac[2], raw.mac[1], raw.mac[0], length, raw.rssi);
+
+  // Flush if we have reached BLUETOOTH_PROXY_ADVERTISEMENT_BATCH_SIZE
+  if (this->response_.advertisements_len >= BLUETOOTH_PROXY_ADVERTISEMENT_BATCH_SIZE) {
+    this->flush_pending_advertisements_();
+  }
+}
+
+void BluetoothProxy::send_bluetooth_scanner_state_() {
+  api::BluetoothScannerStateResponse resp;
+  resp.state = this->hub_->scan_running() ? api::enums::BluetoothScannerState::BLUETOOTH_SCANNER_STATE_RUNNING
+                                          : api::enums::BluetoothScannerState::BLUETOOTH_SCANNER_STATE_IDLE;
+  resp.mode = this->hub_->scan_active() ? api::enums::BluetoothScannerMode::BLUETOOTH_SCANNER_MODE_ACTIVE
+                                        : api::enums::BluetoothScannerMode::BLUETOOTH_SCANNER_MODE_PASSIVE;
+  resp.configured_mode = this->configured_scan_active_
+                             ? api::enums::BluetoothScannerMode::BLUETOOTH_SCANNER_MODE_ACTIVE
+                             : api::enums::BluetoothScannerMode::BLUETOOTH_SCANNER_MODE_PASSIVE;
+  this->api_connection_->send_message(resp);
+}
+
+#endif  // USE_ESP32
+
+#ifdef USE_ESP32
 void BluetoothProxy::log_connection_request_ignored_(BluetoothConnection *connection, espbt::ClientState state) {
  ESP_LOGW(TAG, "[%d] [%s] Connection request ignored, state: %s", connection->get_connection_index(),
           connection->address_str(), espbt::client_state_to_string(state));
@@ -58,6 +115,7 @@ void BluetoothProxy::log_connection_request_ignored_(BluetoothConnection *connec
 void BluetoothProxy::log_connection_info_(BluetoothConnection *connection, const char *message) {
  ESP_LOGI(TAG, "[%d] [%s] Connecting %s", connection->get_connection_index(), connection->address_str(), message);
 }
+#endif  // USE_ESP32

 void BluetoothProxy::log_not_connected_gatt_(const char *action, const char *type) {
  ESP_LOGW(TAG, "Cannot %s GATT %s, not connected", action, type);
@@ -69,6 +127,8 @@ void BluetoothProxy::handle_gatt_not_connected_(uint64_t address, uint16_t handl
  this->send_gatt_error(address, handle, ESP_GATT_NOT_CONNECTED);
 }

+#ifdef USE_ESP32
+
 #ifdef USE_ESP32_BLE_DEVICE
 bool BluetoothProxy::parse_device(const esp32_ble_tracker::ESPBTDevice &device) {
  // This method should never be called since bluetooth_proxy always uses raw advertisements
@@ -109,18 +169,38 @@ bool BluetoothProxy::parse_devices(const esp32_ble::BLEScanResult *scan_results,
  return true;
 }

+#endif  // USE_ESP32
+
 void BluetoothProxy::log_advertisement_flush_() {
  ESP_LOGV(TAG, "Sent batch of %u BLE advertisements", this->response_.advertisements_len);
 }

 void BluetoothProxy::dump_config() {
+#ifdef USE_ESP32
  ESP_LOGCONFIG(TAG,
                "Bluetooth Proxy:\n"
                "  Active: %s\n"
                "  Connections: %d",
                YESNO(this->active_), this->connection_count_);
+#else
+  // Advertisement-only: print configured facts. dump_config runs right after
+  // setup, before the radio is up, so live scan state would always read
+  // "stopped" here — the loop's BluetoothScannerStateResponse carries the
+  // changing value instead.
+  char mac_str[18];
+  this->get_bluetooth_mac_address_pretty(mac_str);
+  ESP_LOGCONFIG(TAG,
+                "Bluetooth Proxy:\n"
+                "  Mode: advertisement-only (no GATT connections)\n"
+                "  Configured scan: %s\n"
+                "  Adapter MAC: %s",
+                this->configured_scan_active_ ? "active" : "passive",
+                mac_str[0] != '\0' ? mac_str : "unavailable (adapter not up yet)");
+#endif
 }

+#ifdef USE_ESP32
+
 void BluetoothProxy::loop() {
  // Run advertisement flush / connection cleanup every 100ms
  uint32_t now = App.get_loop_component_start_time();
@@ -247,20 +327,15 @@ void BluetoothProxy::bluetooth_device_request(const api::BluetoothDeviceRequest
      esp_bd_addr_t address;
      uint64_to_bd_addr(msg.address, address);
      esp_err_t ret = esp_ble_remove_bond_device(address);
-      this->send_device_pairing(msg.address, ret == ESP_OK, ret);
+      this->send_device_unpairing(msg.address, ret == ESP_OK, ret);
      break;
    }
    case api::enums::BLUETOOTH_DEVICE_REQUEST_TYPE_CLEAR_CACHE: {
      esp_bd_addr_t address;
      uint64_to_bd_addr(msg.address, address);
      esp_err_t ret = esp_ble_gattc_cache_clean(address);
-      api::BluetoothDeviceClearCacheResponse call;
-      call.address = msg.address;
-      call.success = ret == ESP_OK;
-      call.error = ret;
-
-      this->api_connection_->send_message(call);
-
+      // Shares the sender with the neutral path, which also null-checks api_connection_.
+      this->send_device_clear_cache(msg.address, ret == ESP_OK, ret);
      break;
    }
    case api::enums::BLUETOOTH_DEVICE_REQUEST_TYPE_CONNECT: {
@@ -378,6 +453,124 @@ void BluetoothProxy::bluetooth_set_connection_params(const api::BluetoothSetConn
  this->api_connection_->send_message(resp);
 }

+void BluetoothProxy::bluetooth_scanner_set_mode(bool active) {
+  if (this->parent_->get_scan_active() == active) {
+    return;
+  }
+  ESP_LOGD(TAG, "Setting scanner mode to %s", active ? "active" : "passive");
+  this->parent_->set_scan_active(active);
+  this->parent_->stop_scan();
+  this->parent_->set_scan_continuous(
+      true);  // Set this to true to automatically start scanning again when it has cleaned up.
+}
+
+#else  // !USE_ESP32
+
+// Advertisement-only proxy. GATT client connections are excluded at compile
+// time — this whole arm is selected by #ifdef USE_ESP32, and nothing consults
+// HubCapabilities at runtime today — so every connection-oriented request is
+// answered with a clean error instead of silence, and Home Assistant treats
+// the proxy as passive.
+
+void BluetoothProxy::loop() {
+  // Run advertisement flush / scanner-state poll every 100ms
+  uint32_t now = App.get_loop_component_start_time();
+  if (now - this->last_advertisement_flush_time_ < 100)
+    return;
+  this->last_advertisement_flush_time_ = now;
+
+  if (!api::global_api_server->is_connected() || this->api_connection_ == nullptr)
+    return;
+
+  // The hub has no scanner-state listener interface; poll and report on change.
+  bool running = this->hub_->scan_running();
+  if (running != this->last_scan_running_) {
+    this->last_scan_running_ = running;
+    this->send_bluetooth_scanner_state_();
+  }
+
+  this->flush_pending_advertisements_();
+}
+
+void BluetoothProxy::bluetooth_device_request(const api::BluetoothDeviceRequest &msg) {
+  switch (msg.request_type) {
+    case api::enums::BLUETOOTH_DEVICE_REQUEST_TYPE_CONNECT_V3_WITH_CACHE:
+    case api::enums::BLUETOOTH_DEVICE_REQUEST_TYPE_CONNECT_V3_WITHOUT_CACHE:
+    case api::enums::BLUETOOTH_DEVICE_REQUEST_TYPE_CONNECT:
+      ESP_LOGW(TAG, "Active connections are not supported on this platform");
+      this->send_device_connection(msg.address, false, 0, ESP_GATT_NOT_CONNECTED);
+      break;
+    case api::enums::BLUETOOTH_DEVICE_REQUEST_TYPE_DISCONNECT:
+      // Not an error: the device is already disconnected, which is the requested state.
+      this->send_device_connection(msg.address, false);
+      this->send_connections_free();
+      break;
+    case api::enums::BLUETOOTH_DEVICE_REQUEST_TYPE_PAIR:
+      this->send_device_pairing(msg.address, false, ESP_GATT_NOT_CONNECTED);
+      break;
+    case api::enums::BLUETOOTH_DEVICE_REQUEST_TYPE_UNPAIR:
+      this->send_device_unpairing(msg.address, false, ESP_GATT_NOT_CONNECTED);
+      break;
+    case api::enums::BLUETOOTH_DEVICE_REQUEST_TYPE_CLEAR_CACHE:
+      this->send_device_clear_cache(msg.address, false, ESP_GATT_NOT_CONNECTED);
+      break;
+  }
+}
+
+void BluetoothProxy::bluetooth_gatt_read(const api::BluetoothGATTReadRequest &msg) {
+  this->handle_gatt_not_connected_(msg.address, msg.handle, "read", "characteristic");
+}
+
+void BluetoothProxy::bluetooth_gatt_write(const api::BluetoothGATTWriteRequest &msg) {
+  this->handle_gatt_not_connected_(msg.address, msg.handle, "write", "characteristic");
+}
+
+void BluetoothProxy::bluetooth_gatt_read_descriptor(const api::BluetoothGATTReadDescriptorRequest &msg) {
+  this->handle_gatt_not_connected_(msg.address, msg.handle, "read", "descriptor");
+}
+
+void BluetoothProxy::bluetooth_gatt_write_descriptor(const api::BluetoothGATTWriteDescriptorRequest &msg) {
+  this->handle_gatt_not_connected_(msg.address, msg.handle, "write", "descriptor");
+}
+
+void BluetoothProxy::bluetooth_gatt_send_services(const api::BluetoothGATTGetServicesRequest &msg) {
+  this->handle_gatt_not_connected_(msg.address, 0, "get", "services");
+}
+
+void BluetoothProxy::bluetooth_gatt_notify(const api::BluetoothGATTNotifyRequest &msg) {
+  this->handle_gatt_not_connected_(msg.address, msg.handle, "notify", "characteristic");
+}
+
+void BluetoothProxy::bluetooth_set_connection_params(const api::BluetoothSetConnectionParamsRequest &msg) {
+  if (this->api_connection_ == nullptr)
+    return;
+  api::BluetoothSetConnectionParamsResponse resp;
+  resp.address = msg.address;
+  resp.error = ESP_GATT_NOT_CONNECTED;
+  this->api_connection_->send_message(resp);
+}
+
+void BluetoothProxy::bluetooth_scanner_set_mode(bool active) {
+  if (this->hub_->scan_active() != active) {
+    ESP_LOGD(TAG, "Setting scanner mode to %s", active ? "active" : "passive");
+    if (!this->hub_->request_scan_mode(active)) {
+      // Passive-only controller asked for active scanning; the state report
+      // below carries the real, unchanged mode so the subscriber does not
+      // assume the change happened.
+      ESP_LOGW(TAG, "Scanner mode %s not supported by this tracker", active ? "active" : "passive");
+    }
+  }
+  if (this->api_connection_ != nullptr) {
+    // Keep loop()'s change detector in step with the state sent here, so a
+    // failed restart (scan_running_ dropped by the tracker) is not reported
+    // twice — once now and again on the next tick.
+    this->last_scan_running_ = this->hub_->scan_running();
+    this->send_bluetooth_scanner_state_();
+  }
+}
+
+#endif  // USE_ESP32
+
 void BluetoothProxy::subscribe_api_connection(api::APIConnection *api_connection, uint32_t flags) {
  if (this->api_connection_ != nullptr && this->api_connection_ != api_connection) {
    // A previous subscriber still holds the slot. This is almost always a stale
@@ -392,9 +585,13 @@ void BluetoothProxy::subscribe_api_connection(api::APIConnection *api_connection
             this->api_connection_->get_peername_to(old_peername));
  }
  this->api_connection_ = api_connection;
+#ifdef USE_ESP32
  this->parent_->recalculate_advertisement_parser_types();
-
  this->send_bluetooth_scanner_state_(this->parent_->get_scanner_state());
+#else
+  this->last_scan_running_ = this->hub_->scan_running();
+  this->send_bluetooth_scanner_state_();
+#endif
 }

 void BluetoothProxy::unsubscribe_api_connection(api::APIConnection *api_connection) {
@@ -403,10 +600,12 @@ void BluetoothProxy::unsubscribe_api_connection(api::APIConnection *api_connecti
    return;
  }
  this->api_connection_ = nullptr;
+#ifdef USE_ESP32
  this->parent_->recalculate_advertisement_parser_types();
+#endif
 }

-void BluetoothProxy::send_device_connection(uint64_t address, bool connected, uint16_t mtu, esp_err_t error) {
+void BluetoothProxy::send_device_connection(uint64_t address, bool connected, uint16_t mtu, proxy_err_t error) {
  if (this->api_connection_ == nullptr)
    return;
  api::BluetoothDeviceConnectionResponse call;
@@ -434,7 +633,7 @@ void BluetoothProxy::send_gatt_services_done(uint64_t address) {
  this->api_connection_->send_message(call);
 }

-void BluetoothProxy::send_gatt_error(uint64_t address, uint16_t handle, esp_err_t error) {
+void BluetoothProxy::send_gatt_error(uint64_t address, uint16_t handle, proxy_err_t error) {
  if (this->api_connection_ == nullptr)
    return;
  api::BluetoothGATTErrorResponse call;
@@ -444,7 +643,7 @@ void BluetoothProxy::send_gatt_error(uint64_t address, uint16_t handle, esp_err_
  this->api_connection_->send_message(call);
 }

-void BluetoothProxy::send_device_pairing(uint64_t address, bool paired, esp_err_t error) {
+void BluetoothProxy::send_device_pairing(uint64_t address, bool paired, proxy_err_t error) {
  if (this->api_connection_ == nullptr)
    return;
  api::BluetoothDevicePairingResponse call;
@@ -455,7 +654,7 @@ void BluetoothProxy::send_device_pairing(uint64_t address, bool paired, esp_err_
  this->api_connection_->send_message(call);
 }

-void BluetoothProxy::send_device_unpairing(uint64_t address, bool success, esp_err_t error) {
+void BluetoothProxy::send_device_unpairing(uint64_t address, bool success, proxy_err_t error) {
  if (this->api_connection_ == nullptr)
    return;
  api::BluetoothDeviceUnpairingResponse call;
@@ -466,19 +665,21 @@ void BluetoothProxy::send_device_unpairing(uint64_t address, bool success, esp_e
  this->api_connection_->send_message(call);
 }

-void BluetoothProxy::bluetooth_scanner_set_mode(bool active) {
-  if (this->parent_->get_scan_active() == active) {
+// Shared by both platform paths: the neutral bluetooth_device_request() uses it to
+// answer a clear-cache request with a clean error, so it must not be esp32-guarded.
+void BluetoothProxy::send_device_clear_cache(uint64_t address, bool success, proxy_err_t error) {
+  if (this->api_connection_ == nullptr)
    return;
-  }
-  ESP_LOGD(TAG, "Setting scanner mode to %s", active ? "active" : "passive");
-  this->parent_->set_scan_active(active);
-  this->parent_->stop_scan();
-  this->parent_->set_scan_continuous(
-      true);  // Set this to true to automatically start scanning again when it has cleaned up.
+  api::BluetoothDeviceClearCacheResponse call;
+  call.address = address;
+  call.success = success;
+  call.error = error;
+
+  this->api_connection_->send_message(call);
 }

 BluetoothProxy *global_bluetooth_proxy = nullptr;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)

 }  // namespace esphome::bluetooth_proxy

-#endif  // USE_ESP32
+#endif  // USE_BLUETOOTH_PROXY
@@ -1,6 +1,8 @@
 #pragma once

-#ifdef USE_ESP32
+#include "esphome/core/defines.h"
+
+#ifdef USE_BLUETOOTH_PROXY

 #include <array>
 #include <map>
@@ -8,11 +10,14 @@

 #include "esphome/components/api/api_connection.h"
 #include "esphome/components/api/api_pb2.h"
-#include "esphome/components/esp32_ble_client/ble_client_base.h"
-#include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 #include "esphome/core/automation.h"
 #include "esphome/core/component.h"
-#include "esphome/core/defines.h"
+
+#include "esphome/components/ble_device_base/ble_client_state.h"
+
+#ifdef USE_ESP32
+#include "esphome/components/esp32_ble_client/ble_client_base.h"
+#include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"

 #include "bluetooth_connection.h"

@@ -20,14 +25,31 @@
 #include <esp_bt.h>
 #endif
 #include <esp_bt_device.h>
+#else
+#include "esphome/components/ble_device_base/ble_hub.h"
+#endif  // USE_ESP32

 namespace esphome::bluetooth_proxy {

-static constexpr esp_err_t ESP_GATT_NOT_CONNECTED = -1;
+// Proxy-owned error type for the API error fields, which are plain integers on
+// the wire. Aliases esp_err_t on esp32 (where the values come from IDF calls);
+// a bare int elsewhere. Owning the name instead of probing for esp_err_t keeps
+// the header independent of how a hub platform's SDK spells its error type.
+#ifdef USE_ESP32
+using proxy_err_t = esp_err_t;
+static constexpr proxy_err_t PROXY_OK = ESP_OK;
+#else
+using proxy_err_t = int;
+static constexpr proxy_err_t PROXY_OK = 0;
+#endif
+
+static constexpr proxy_err_t ESP_GATT_NOT_CONNECTED = ble_device_base::GATT_ERR_NOT_CONNECTED;
 static constexpr int DONE_SENDING_SERVICES = -2;
 static constexpr int INIT_SENDING_SERVICES = -3;

+#ifdef USE_ESP32
 using namespace esp32_ble_client;
+#endif

 // Legacy versions:
 // Version 1: Initial version without active connections
@@ -53,21 +75,28 @@ enum BluetoothProxySubscriptionFlag : uint32_t {
  SUBSCRIPTION_RAW_ADVERTISEMENTS = 1 << 0,
 };

+#ifdef USE_ESP32
 class BluetoothProxy final : public esp32_ble_tracker::ESPBTDeviceListener,
                             public esp32_ble_tracker::BLEScannerStateListener,
                             public Component {
  friend class BluetoothConnection;  // Allow connection to update connections_free_response_
+#else
+class BluetoothProxy final : public Component {
+#endif
 public:
  BluetoothProxy();
+#ifdef USE_ESP32
 #ifdef USE_ESP32_BLE_DEVICE
  bool parse_device(const esp32_ble_tracker::ESPBTDevice &device) override;
 #endif
  bool parse_devices(const esp32_ble::BLEScanResult *scan_results, size_t count) override;
+  esp32_ble_tracker::AdvertisementParserType get_advertisement_parser_type() override;
+#endif  // USE_ESP32
  void dump_config() override;
  void setup() override;
  void loop() override;
-  esp32_ble_tracker::AdvertisementParserType get_advertisement_parser_type() override;

+#ifdef USE_ESP32
  // maybe_unused: in a passive proxy (active: false) MAX is 0, the body below is removed, and connection is unused.
  void register_connection([[maybe_unused]] BluetoothConnection *connection) {
    // Guard the always-false comparison (-Wtype-limits) in a passive proxy (active: false), where MAX is 0.
@@ -78,6 +107,14 @@ class BluetoothProxy final : public esp32_ble_tracker::ESPBTDeviceListener,
    }
 #endif
  }
+#else
+  void set_ble_hub(ble_device_base::BLEHub *hub) { this->hub_ = hub; }
+  // Run after the hub's setup() (the trackers use AFTER_WIFI): setup() below
+  // snapshots scan_active()/scan_running() and installs the raw callback, and
+  // the BLEHub contract does not promise those are settled any earlier than
+  // the hub's own setup().
+  float get_setup_priority() const override { return setup_priority::AFTER_WIFI - 1.0f; }
+#endif  // USE_ESP32

  void bluetooth_device_request(const api::BluetoothDeviceRequest &msg);
  void bluetooth_gatt_read(const api::BluetoothGATTReadRequest &msg);
@@ -92,17 +129,18 @@ class BluetoothProxy final : public esp32_ble_tracker::ESPBTDeviceListener,
  void unsubscribe_api_connection(api::APIConnection *api_connection);
  api::APIConnection *get_api_connection() { return this->api_connection_; }

-  void send_device_connection(uint64_t address, bool connected, uint16_t mtu = 0, esp_err_t error = ESP_OK);
+  void send_device_connection(uint64_t address, bool connected, uint16_t mtu = 0, proxy_err_t error = PROXY_OK);
  void send_connections_free();
  void send_connections_free(api::APIConnection *api_connection);
  void send_gatt_services_done(uint64_t address);
-  void send_gatt_error(uint64_t address, uint16_t handle, esp_err_t error);
-  void send_device_pairing(uint64_t address, bool paired, esp_err_t error = ESP_OK);
-  void send_device_unpairing(uint64_t address, bool success, esp_err_t error = ESP_OK);
-  void send_device_clear_cache(uint64_t address, bool success, esp_err_t error = ESP_OK);
+  void send_gatt_error(uint64_t address, uint16_t handle, proxy_err_t error);
+  void send_device_pairing(uint64_t address, bool paired, proxy_err_t error = PROXY_OK);
+  void send_device_unpairing(uint64_t address, bool success, proxy_err_t error = PROXY_OK);
+  void send_device_clear_cache(uint64_t address, bool success, proxy_err_t error = PROXY_OK);

  void bluetooth_scanner_set_mode(bool active);

+#ifdef USE_ESP32
  static void uint64_to_bd_addr(uint64_t address, esp_bd_addr_t bd_addr) {
    bd_addr[0] = (address >> 40) & 0xff;
    bd_addr[1] = (address >> 32) & 0xff;
@@ -111,12 +149,15 @@ class BluetoothProxy final : public esp32_ble_tracker::ESPBTDeviceListener,
    bd_addr[4] = (address >> 8) & 0xff;
    bd_addr[5] = (address >> 0) & 0xff;
  }
+#endif

  void set_active(bool active) { this->active_ = active; }
  bool has_active() { return this->active_; }

+#ifdef USE_ESP32
  /// BLEScannerStateListener interface
  void on_scanner_state(esp32_ble_tracker::ScannerState state) override;
+#endif

  uint32_t get_legacy_version() const {
    if (this->active_) {
@@ -129,7 +170,17 @@ class BluetoothProxy final : public esp32_ble_tracker::ESPBTDeviceListener,
    uint32_t flags = 0;
    flags |= BluetoothProxyFeature::FEATURE_PASSIVE_SCAN;
    flags |= BluetoothProxyFeature::FEATURE_RAW_ADVERTISEMENTS;
+#ifdef USE_ESP32
    flags |= BluetoothProxyFeature::FEATURE_STATE_AND_MODE;
+#else
+    // Advertise mode switching only where the hub honors request_scan_mode();
+    // scan_mode_switch is the capability bit for exactly that (#18079) —
+    // active_scan alone is not enough, a hub may support active scanning yet
+    // refuse the runtime switch.
+    if (this->hub_->get_capabilities().scan_mode_switch) {
+      flags |= BluetoothProxyFeature::FEATURE_STATE_AND_MODE;
+    }
+#endif
    if (this->active_) {
      flags |= BluetoothProxyFeature::FEATURE_ACTIVE_CONNECTIONS;
      flags |= BluetoothProxyFeature::FEATURE_REMOTE_CACHING;
@@ -142,16 +193,37 @@ class BluetoothProxy final : public esp32_ble_tracker::ESPBTDeviceListener,
  }

  void get_bluetooth_mac_address_pretty(std::span<char, 18> output) {
+#ifdef USE_ESP32
    const uint8_t *mac = esp_bt_dev_get_address();
    if (mac != nullptr) {
      format_mac_addr_upper(mac, output.data());
    } else {
      output[0] = '\0';
    }
+#else
+    uint8_t mac[6] = {};
+    this->hub_->get_adapter_mac(mac);
+    // Mirror the esp32 arm's unavailable -> empty-string fallback: some hubs
+    // (rp2040's BTstack) only learn the address once the link layer is up, and
+    // report all-zero until then.
+    bool nonzero = false;
+    for (uint8_t b : mac)
+      nonzero |= b != 0;
+    if (nonzero) {
+      format_mac_addr_upper(mac, output.data());
+    } else {
+      output[0] = '\0';
+    }
+#endif
  }

 protected:
+#ifdef USE_ESP32
  void send_bluetooth_scanner_state_(esp32_ble_tracker::ScannerState state);
+#else
+  void send_bluetooth_scanner_state_();
+  void on_raw_advertisement_(const ble_device_base::RawAdvertisement &raw);
+#endif

  /// Caller must ensure api_connection_ is non-null and API server is connected.
  void flush_pending_advertisements_() {
@@ -165,9 +237,11 @@ class BluetoothProxy final : public esp32_ble_tracker::ESPBTDeviceListener,
  }
  void log_advertisement_flush_();

+#ifdef USE_ESP32
  BluetoothConnection *get_connection_(uint64_t address, bool reserve);
  void log_connection_request_ignored_(BluetoothConnection *connection, espbt::ClientState state);
  void log_connection_info_(BluetoothConnection *connection, const char *message);
+#endif
  void log_not_connected_gatt_(const char *action, const char *type);
  void handle_gatt_not_connected_(uint64_t address, uint16_t handle, const char *action, const char *type);

@@ -175,8 +249,12 @@ class BluetoothProxy final : public esp32_ble_tracker::ESPBTDeviceListener,
  // Group 1: Pointers (4 bytes each, naturally aligned)
  api::APIConnection *api_connection_{nullptr};

+#ifdef USE_ESP32
  // Group 2: Fixed-size array of connection pointers
  std::array<BluetoothConnection *, BLUETOOTH_PROXY_MAX_CONNECTIONS> connections_{};
+#else
+  ble_device_base::BLEHub *hub_{nullptr};
+#endif

  // BLE advertisement batching
  api::BluetoothLERawAdvertisementsResponse response_;
@@ -191,11 +269,13 @@ class BluetoothProxy final : public esp32_ble_tracker::ESPBTDeviceListener,
  bool active_;
  uint8_t connection_count_{0};
  bool configured_scan_active_{false};  // Configured scan mode from YAML
-  // 3 bytes used, 1 byte padding
+#ifndef USE_ESP32
+  bool last_scan_running_{false};  // Last scanner state reported to the subscriber
+#endif
 };

 extern BluetoothProxy *global_bluetooth_proxy;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)

 }  // namespace esphome::bluetooth_proxy

-#endif  // USE_ESP32
+#endif  // USE_BLUETOOTH_PROXY
@@ -25,6 +25,9 @@ static constexpr size_t BTHOME_NONCE_SIZE = 13;
 static constexpr size_t BTHOME_MIC_SIZE = 4;
 static constexpr size_t BTHOME_COUNTER_SIZE = 4;

+// Both callers are log macros (LOGCONFIG / LOGVV); below CONFIG level they
+// compile away and an ungated helper trips -Wunused-function.
+#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_CONFIG
 static const char *format_mac_address(std::span<char, MAC_ADDRESS_PRETTY_BUFFER_SIZE> buffer, uint64_t address) {
  std::array<uint8_t, MAC_ADDRESS_SIZE> mac{};
  for (size_t i = 0; i < MAC_ADDRESS_SIZE; i++) {
@@ -34,6 +37,7 @@ static const char *format_mac_address(std::span<char, MAC_ADDRESS_PRETTY_BUFFER_
  format_mac_addr_upper(mac.data(), buffer.data());
  return buffer.data();
 }
+#endif  // ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_CONFIG

 static bool get_bthome_value_length(uint8_t obj_type, size_t &value_length) {
  switch (obj_type) {
@@ -7,145 +7,146 @@ namespace esphome::captive_portal {

 #ifdef USE_CAPTIVE_PORTAL_GZIP
 constexpr uint8_t INDEX_GZ[] PROGMEM = {
-    0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x95, 0x16, 0x6b, 0x8f, 0xdb, 0x36, 0xf2, 0x7b, 0x7e,
-    0x05, 0x8f, 0x49, 0xbb, 0x52, 0xb3, 0x7a, 0x7a, 0xed, 0x6c, 0x24, 0x51, 0x45, 0x9a, 0xbb, 0xa2, 0x05, 0x9a, 0x36,
-    0xc0, 0x6e, 0x73, 0x1f, 0x82, 0x00, 0x4b, 0x53, 0x23, 0x8b, 0x31, 0x45, 0xea, 0x48, 0xca, 0x8f, 0x18, 0xbe, 0xdf,
-    0x7e, 0xa0, 0x24, 0x7b, 0x9d, 0x45, 0x73, 0xb8, 0xb3, 0x60, 0x61, 0x38, 0xef, 0x19, 0xcd, 0x83, 0xc5, 0xdf, 0x2a,
-    0xc5, 0xec, 0xbe, 0x03, 0xd4, 0xd8, 0x56, 0x94, 0x85, 0x7b, 0x23, 0x41, 0xe5, 0x8a, 0x80, 0x2c, 0x8b, 0x06, 0x68,
-    0x55, 0x16, 0x2d, 0x58, 0x8a, 0x58, 0x43, 0xb5, 0x01, 0x4b, 0xfe, 0xbc, 0xff, 0x39, 0xb8, 0x2d, 0x0b, 0xc1, 0xe5,
-    0x1a, 0x69, 0x10, 0x84, 0x33, 0x25, 0x51, 0xa3, 0xa1, 0x26, 0x15, 0xb5, 0x34, 0xe3, 0x2d, 0x5d, 0xc1, 0x24, 0x22,
-    0x69, 0x0b, 0x64, 0xc3, 0x61, 0xdb, 0x29, 0x6d, 0x11, 0x53, 0xd2, 0x82, 0xb4, 0x04, 0x6f, 0x79, 0x65, 0x1b, 0x52,
-    0xc1, 0x86, 0x33, 0x08, 0x86, 0xc3, 0x35, 0x97, 0xdc, 0x72, 0x2a, 0x02, 0xc3, 0xa8, 0x00, 0x92, 0x5c, 0xf7, 0x06,
-    0xf4, 0x70, 0xa0, 0x4b, 0x01, 0x44, 0x2a, 0x5c, 0x16, 0x86, 0x69, 0xde, 0x59, 0xe4, 0x5c, 0x25, 0xad, 0xaa, 0x7a,
-    0x01, 0x65, 0x14, 0x51, 0x63, 0xc0, 0x9a, 0x88, 0xcb, 0x0a, 0x76, 0xe1, 0x32, 0x66, 0x2c, 0x86, 0xdb, 0xdb, 0xf0,
-    0xb3, 0x79, 0x56, 0x29, 0xd6, 0xb7, 0x20, 0x6d, 0x28, 0x14, 0xa3, 0x96, 0x2b, 0x19, 0x1a, 0xa0, 0x9a, 0x35, 0x84,
-    0x10, 0xfc, 0xa3, 0xa1, 0x1b, 0xc0, 0xdf, 0x7f, 0xef, 0x9d, 0x99, 0x56, 0x60, 0xff, 0x21, 0xc0, 0x81, 0xe6, 0xa7,
-    0xfd, 0x3d, 0x5d, 0xfd, 0x4e, 0x5b, 0xf0, 0x30, 0x35, 0xbc, 0x02, 0xec, 0x7f, 0x8c, 0x3f, 0x85, 0xc6, 0xee, 0x05,
-    0x84, 0x15, 0x37, 0x9d, 0xa0, 0x7b, 0x82, 0x97, 0x42, 0xb1, 0x35, 0xf6, 0xf3, 0xba, 0x97, 0xcc, 0x29, 0x47, 0xc6,
-    0x03, 0xff, 0x20, 0xc0, 0x22, 0x4b, 0xde, 0x51, 0xdb, 0x84, 0x2d, 0xdd, 0x79, 0x23, 0xc0, 0xa5, 0x97, 0xfe, 0xe0,
-    0xc1, 0xcb, 0x24, 0x8e, 0xfd, 0xeb, 0xe1, 0x15, 0xfb, 0x51, 0x12, 0xc7, 0xb9, 0x06, 0xdb, 0x6b, 0x89, 0xa8, 0xf7,
-    0x50, 0x74, 0xd4, 0x36, 0xa8, 0x22, 0xf8, 0x5d, 0x92, 0xa2, 0xe4, 0x75, 0x98, 0xce, 0x7f, 0x0b, 0x5f, 0xa1, 0x9b,
-    0x30, 0x9d, 0xb3, 0x57, 0xc1, 0x1c, 0x25, 0x37, 0xc1, 0x1c, 0xa5, 0x69, 0x38, 0x47, 0xf1, 0x17, 0x8c, 0x6a, 0x2e,
-    0x04, 0xc1, 0x52, 0x49, 0xc0, 0xc8, 0x58, 0xad, 0xd6, 0x40, 0x30, 0xeb, 0xb5, 0x06, 0x69, 0xdf, 0x2a, 0xa1, 0x34,
-    0x8e, 0xca, 0x67, 0xff, 0x97, 0x42, 0xab, 0xa9, 0x34, 0xb5, 0xd2, 0x2d, 0xc1, 0x43, 0xf6, 0xbd, 0x17, 0x07, 0x7b,
-    0x44, 0xee, 0xe5, 0x5f, 0x10, 0x03, 0xa5, 0xf9, 0x8a, 0x4b, 0x82, 0x9d, 0xc6, 0x5b, 0x1c, 0x95, 0x0f, 0xfe, 0xf1,
-    0x1c, 0x3d, 0x75, 0xd1, 0x4f, 0xf1, 0x28, 0xef, 0xe3, 0x43, 0x61, 0x36, 0x2b, 0xb4, 0x6b, 0x85, 0x34, 0x04, 0x37,
-    0xd6, 0x76, 0x59, 0x14, 0x6d, 0xb7, 0xdb, 0x70, 0x3b, 0x0b, 0x95, 0x5e, 0x45, 0x69, 0x1c, 0xc7, 0x91, 0xd9, 0xac,
-    0x30, 0x1a, 0x0b, 0x01, 0xa7, 0x37, 0x18, 0x35, 0xc0, 0x57, 0x8d, 0x1d, 0xe0, 0xf2, 0xc5, 0x01, 0x8e, 0x85, 0xe3,
-    0x28, 0x1f, 0x3e, 0x5d, 0x58, 0xe1, 0x17, 0x56, 0xe0, 0x47, 0xea, 0xe1, 0x53, 0x98, 0x57, 0x43, 0x98, 0xaf, 0x68,
-    0x8a, 0x52, 0x14, 0x0f, 0x4f, 0x1a, 0x38, 0x78, 0x3a, 0x05, 0x4f, 0x4e, 0xe8, 0xe2, 0xe4, 0xa0, 0x76, 0x11, 0xbc,
-    0x3e, 0xcb, 0x26, 0x0e, 0xb3, 0x49, 0xe2, 0x47, 0x84, 0x13, 0xf8, 0x65, 0x71, 0x79, 0x0e, 0xd2, 0x0f, 0x97, 0x0c,
-    0xce, 0x5a, 0x93, 0x7c, 0x58, 0xd0, 0x39, 0x9a, 0x4f, 0x98, 0x79, 0xe0, 0xe0, 0xf3, 0x09, 0xcd, 0x37, 0x69, 0x93,
-    0xb4, 0xc1, 0x22, 0x98, 0xd3, 0x19, 0x9a, 0x4d, 0x8e, 0xcc, 0xd0, 0x6c, 0x93, 0x36, 0x8b, 0x0f, 0x8b, 0x4b, 0x5c,
-    0x30, 0xfb, 0x72, 0x15, 0x95, 0xd8, 0xcf, 0x30, 0x7e, 0x8c, 0x5c, 0x5d, 0x46, 0x1e, 0x7e, 0x56, 0x5c, 0x7a, 0x18,
-    0xfb, 0xc7, 0x1a, 0x2c, 0x6b, 0x3c, 0x1c, 0x31, 0x25, 0x6b, 0xbe, 0x0a, 0x3f, 0x1b, 0x25, 0xb1, 0x1f, 0xda, 0x06,
-    0xa4, 0x77, 0x12, 0x75, 0x82, 0x30, 0x50, 0xbc, 0xa7, 0x14, 0xeb, 0x1f, 0xce, 0xf5, 0x6f, 0xb9, 0x15, 0x40, 0x6c,
-    0xe8, 0x1a, 0xf6, 0xfa, 0x8c, 0x5d, 0xaa, 0x6a, 0xff, 0x8d, 0xd6, 0x68, 0x92, 0xb1, 0x2f, 0xb8, 0x94, 0xa0, 0xef,
-    0x61, 0x67, 0x09, 0x7e, 0xf7, 0xe6, 0x2d, 0x7a, 0x53, 0x55, 0x1a, 0x8c, 0xc9, 0x10, 0x7e, 0x69, 0xc3, 0x96, 0xb2,
-    0xff, 0x5d, 0x57, 0xf2, 0x95, 0xae, 0x7f, 0xf2, 0x9f, 0x39, 0xfa, 0x1d, 0xec, 0x56, 0xe9, 0xf5, 0xa4, 0xcd, 0xb9,
-    0x96, 0xbb, 0x0e, 0xd3, 0xc4, 0x86, 0xb4, 0x33, 0xa1, 0x11, 0x9c, 0x81, 0x97, 0xf8, 0x61, 0x4b, 0xbb, 0xc7, 0xa8,
-    0xe4, 0x29, 0x51, 0x0f, 0x45, 0xc5, 0x37, 0x88, 0x09, 0x6a, 0x0c, 0xc1, 0x72, 0x54, 0x85, 0xd1, 0x33, 0x34, 0xfc,
-    0x94, 0x64, 0x82, 0xb3, 0x35, 0xc1, 0x7f, 0x31, 0x01, 0x7e, 0xda, 0xff, 0x5a, 0x79, 0x57, 0xc6, 0xf0, 0xea, 0xca,
-    0x0f, 0x37, 0x54, 0xf4, 0x80, 0x08, 0xb2, 0x0d, 0x37, 0x8f, 0x0e, 0xe6, 0xdf, 0x14, 0xeb, 0xcc, 0xfa, 0xca, 0x0f,
-    0x6b, 0xc5, 0x7a, 0xe3, 0xf9, 0xb8, 0x9c, 0xcc, 0x15, 0x74, 0x1c, 0x90, 0xf8, 0x39, 0x7e, 0xe2, 0x51, 0x20, 0xa0,
-    0xb6, 0x67, 0x3e, 0x84, 0x5e, 0x1c, 0x8c, 0x27, 0x43, 0x6d, 0x0c, 0xf7, 0x8f, 0x67, 0x64, 0x61, 0x3a, 0x2a, 0x9f,
-    0x0a, 0x3a, 0x07, 0x5d, 0xab, 0xc8, 0xd0, 0x41, 0xae, 0x5f, 0x3a, 0x2a, 0xcf, 0x06, 0x23, 0x7a, 0x02, 0x5f, 0x1c,
-    0xb8, 0x27, 0xdd, 0x14, 0x5c, 0x9f, 0x35, 0x16, 0x51, 0xc5, 0x37, 0xe5, 0xc3, 0xd1, 0x7f, 0x8c, 0xe3, 0x5f, 0x3d,
-    0xe8, 0xfd, 0x1d, 0x08, 0x60, 0x56, 0x69, 0x0f, 0x3f, 0x97, 0x60, 0xb1, 0x3f, 0x06, 0xfc, 0xcb, 0xfd, 0xbb, 0xdf,
-    0x88, 0xf2, 0xb4, 0x7f, 0xfd, 0x2d, 0x6e, 0xb7, 0x0a, 0x3e, 0x6a, 0x10, 0xff, 0x26, 0x57, 0x6e, 0x19, 0x5c, 0x7d,
-    0xc2, 0x7e, 0x38, 0xc4, 0xfb, 0xf0, 0xb8, 0x11, 0x5c, 0x3b, 0xbf, 0xdc, 0xb5, 0xe2, 0xda, 0x45, 0x18, 0x2c, 0xe6,
-    0xfe, 0xf1, 0xe1, 0xe8, 0x1f, 0xfd, 0xbc, 0x88, 0xc6, 0xb9, 0x5e, 0x16, 0xc3, 0x88, 0x2d, 0x7f, 0x38, 0x2c, 0xd5,
-    0x2e, 0x30, 0xfc, 0x0b, 0x97, 0xab, 0x8c, 0xcb, 0x06, 0x34, 0xb7, 0xc7, 0x8a, 0x6f, 0xae, 0xb9, 0xec, 0x7a, 0x7b,
-    0xe8, 0x68, 0x55, 0x39, 0xca, 0xbc, 0xdb, 0xe5, 0xb5, 0x92, 0xd6, 0x71, 0x42, 0x96, 0x40, 0x7b, 0x1c, 0xe9, 0xc3,
-    0x44, 0xc9, 0x5e, 0xcf, 0xbf, 0x3b, 0xba, 0x82, 0x3b, 0x58, 0xd8, 0xd9, 0x80, 0x0a, 0xbe, 0x92, 0x19, 0x03, 0x69,
-    0x41, 0x8f, 0x42, 0x35, 0x6d, 0xb9, 0xd8, 0x67, 0x86, 0x4a, 0x13, 0x18, 0xd0, 0xbc, 0x3e, 0x2e, 0x7b, 0x6b, 0x95,
-    0x3c, 0x2c, 0x95, 0xae, 0x40, 0x67, 0x71, 0x3e, 0x02, 0x81, 0xa6, 0x15, 0xef, 0x4d, 0x16, 0xce, 0x34, 0xb4, 0xf9,
-    0x92, 0xb2, 0xf5, 0x4a, 0xab, 0x5e, 0x56, 0x01, 0x73, 0x93, 0x36, 0x7b, 0x9e, 0xd4, 0x74, 0x06, 0x2c, 0x9f, 0x4e,
-    0x75, 0x5d, 0xe7, 0x82, 0x4b, 0x08, 0xc6, 0x59, 0x96, 0xa5, 0xe1, 0x8d, 0x13, 0xbb, 0x70, 0x33, 0x4c, 0x1d, 0x62,
-    0xf4, 0x31, 0x89, 0xe3, 0xef, 0xf2, 0x53, 0x38, 0x71, 0xce, 0x7a, 0x6d, 0x94, 0xce, 0x3a, 0xc5, 0x9d, 0x9b, 0xc7,
-    0x96, 0x72, 0x79, 0xe9, 0xbd, 0x2b, 0x93, 0x7c, 0x5a, 0x3f, 0x19, 0x97, 0x83, 0x99, 0x61, 0x09, 0xe5, 0x2d, 0x97,
-    0xe3, 0x0e, 0xcd, 0xd2, 0x45, 0xdc, 0xed, 0x8e, 0xe1, 0x54, 0x20, 0x87, 0x13, 0x77, 0x2d, 0x60, 0x97, 0x7f, 0xee,
-    0x8d, 0xe5, 0xf5, 0x3e, 0x98, 0x76, 0x70, 0x66, 0x3a, 0xca, 0x20, 0x58, 0x82, 0xdd, 0x02, 0xc8, 0x7c, 0xb0, 0x11,
-    0x70, 0x0b, 0xad, 0x99, 0xf2, 0x74, 0x56, 0x33, 0x14, 0xe8, 0xd7, 0xba, 0xfe, 0x1b, 0xb7, 0xab, 0xc5, 0x43, 0x4b,
-    0xf5, 0x8a, 0xcb, 0x60, 0xa9, 0xac, 0x55, 0x6d, 0x16, 0xbc, 0xea, 0x76, 0xf9, 0x84, 0x72, 0xca, 0xb2, 0xc4, 0xb9,
-    0x39, 0xec, 0xd6, 0x53, 0xbe, 0x93, 0x6e, 0x87, 0x8c, 0x12, 0xbc, 0x9a, 0xf8, 0x06, 0x16, 0x14, 0x9f, 0xd3, 0x93,
-    0xcc, 0xbb, 0x1d, 0x72, 0xb8, 0x53, 0xaa, 0x6f, 0xea, 0x5b, 0x9a, 0xc4, 0x7f, 0xf1, 0x45, 0xaa, 0xba, 0x4e, 0x97,
-    0xf5, 0x39, 0x53, 0x6e, 0x4d, 0xba, 0xd6, 0x18, 0x4a, 0xab, 0x88, 0xc6, 0xdb, 0x8c, 0xab, 0x8c, 0xb2, 0x70, 0x19,
-    0x2e, 0x8b, 0x26, 0x41, 0xbc, 0x22, 0x2d, 0x65, 0xe5, 0xc5, 0xf8, 0x2a, 0xa2, 0x26, 0x39, 0x91, 0x9a, 0xa4, 0xfc,
-    0x6a, 0x18, 0x8d, 0xb4, 0xc1, 0xfb, 0xf2, 0xad, 0x92, 0x12, 0x98, 0xe5, 0x72, 0x85, 0xac, 0x42, 0x53, 0x0a, 0xc2,
-    0x30, 0x2c, 0x96, 0xba, 0x7c, 0x2f, 0x80, 0x1a, 0x40, 0x5b, 0xca, 0x6d, 0x58, 0x44, 0x23, 0xff, 0xd8, 0xc7, 0xbc,
-    0x22, 0x12, 0x6c, 0x39, 0x35, 0x6c, 0xd1, 0xcc, 0x46, 0x03, 0x77, 0x60, 0x9d, 0x26, 0x67, 0x60, 0x56, 0x16, 0x6e,
-    0xe5, 0x22, 0x3a, 0x8c, 0x34, 0x12, 0x6d, 0x79, 0xcd, 0xdd, 0x95, 0xa5, 0x2c, 0x86, 0x22, 0x77, 0x1a, 0x5c, 0x9e,
-    0xc7, 0xeb, 0xd5, 0x00, 0x09, 0x90, 0x2b, 0xdb, 0x90, 0x59, 0x8a, 0x3a, 0x41, 0x19, 0x34, 0x4a, 0x54, 0xa0, 0xc9,
-    0xdd, 0xdd, 0xaf, 0x7f, 0x2f, 0x9d, 0x33, 0x8f, 0x72, 0x9d, 0x59, 0x8f, 0x62, 0x0e, 0x98, 0xa4, 0x16, 0x37, 0xe3,
-    0xa5, 0xaa, 0xa3, 0xc6, 0x6c, 0x95, 0xae, 0xbe, 0xd2, 0xf1, 0x7e, 0x42, 0x8e, 0x7a, 0x86, 0xff, 0xd0, 0x2a, 0xe5,
-    0x1d, 0xdd, 0x40, 0x11, 0x4d, 0x87, 0x22, 0x72, 0x0e, 0x8f, 0xf4, 0x66, 0xe2, 0x6b, 0x92, 0xf2, 0x8f, 0xfb, 0x37,
-    0xe8, 0xcf, 0xae, 0xa2, 0x16, 0xc6, 0xb4, 0x0d, 0x51, 0xb5, 0x60, 0x1b, 0x55, 0x91, 0xf7, 0x7f, 0xdc, 0xdd, 0x9f,
-    0x23, 0xec, 0x07, 0x26, 0x04, 0x92, 0x8d, 0xd7, 0xbb, 0x5e, 0x58, 0xde, 0x51, 0x6d, 0x07, 0xb5, 0x81, 0x9b, 0x22,
-    0xa7, 0x18, 0x06, 0x7a, 0xcd, 0x05, 0x8c, 0x61, 0x8c, 0x82, 0x25, 0x3a, 0x79, 0x75, 0xb2, 0xf6, 0xc4, 0xaf, 0x68,
-    0xfc, 0xda, 0xd1, 0xf8, 0xe9, 0xa3, 0xe1, 0xa6, 0xfb, 0x1f, 0x53, 0x58, 0x46, 0xb2, 0xf9, 0x0a, 0x00, 0x00};
+    0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x95, 0x16, 0x6b, 0x8f, 0xdb, 0x36, 0xf2, 0x7b, 0x7f,
+    0x05, 0x8f, 0x4d, 0x1b, 0xa9, 0xb1, 0xa8, 0x87, 0xd7, 0xde, 0x44, 0x96, 0x54, 0xa4, 0x7b, 0x2d, 0x5a, 0xa0, 0x69,
+    0x03, 0xec, 0x36, 0xf7, 0x21, 0x08, 0xb0, 0x34, 0x39, 0xb2, 0x98, 0xa5, 0x48, 0x1d, 0x49, 0xbf, 0x62, 0xf8, 0x7e,
+    0xfb, 0x81, 0x92, 0xec, 0xf5, 0x2e, 0x9a, 0x03, 0x0e, 0x86, 0x85, 0x19, 0xce, 0x7b, 0x38, 0x0f, 0x16, 0xff, 0xe0,
+    0x9a, 0xb9, 0x7d, 0x07, 0xa8, 0x71, 0xad, 0xac, 0x0a, 0xff, 0x45, 0x92, 0xaa, 0x55, 0x09, 0xaa, 0x2a, 0x1a, 0xa0,
+    0xbc, 0x2a, 0x5a, 0x70, 0x14, 0xb1, 0x86, 0x1a, 0x0b, 0xae, 0xfc, 0xeb, 0xee, 0x97, 0xe8, 0x75, 0x55, 0x48, 0xa1,
+    0x1e, 0x90, 0x01, 0x59, 0x0a, 0xa6, 0x15, 0x6a, 0x0c, 0xd4, 0x25, 0xa7, 0x8e, 0xe6, 0xa2, 0xa5, 0x2b, 0x18, 0x45,
+    0x14, 0x6d, 0xa1, 0xdc, 0x08, 0xd8, 0x76, 0xda, 0x38, 0xc4, 0xb4, 0x72, 0xa0, 0x5c, 0x89, 0xb7, 0x82, 0xbb, 0xa6,
+    0xe4, 0xb0, 0x11, 0x0c, 0xa2, 0x1e, 0x99, 0x08, 0x25, 0x9c, 0xa0, 0x32, 0xb2, 0x8c, 0x4a, 0x28, 0xd3, 0xc9, 0xda,
+    0x82, 0xe9, 0x11, 0xba, 0x94, 0x50, 0x2a, 0x8d, 0xab, 0xc2, 0x32, 0x23, 0x3a, 0x87, 0xbc, 0xab, 0x65, 0xab, 0xf9,
+    0x5a, 0x42, 0x15, 0xc7, 0xd4, 0x5a, 0x70, 0x36, 0x16, 0x8a, 0xc3, 0x8e, 0xd0, 0x6b, 0xb8, 0xa6, 0x2c, 0x4d, 0xc8,
+    0x67, 0xfb, 0x0d, 0xd7, 0x6c, 0xdd, 0x82, 0x72, 0x44, 0x6a, 0x46, 0x9d, 0xd0, 0x8a, 0x58, 0xa0, 0x86, 0x35, 0x65,
+    0x59, 0xe2, 0x1f, 0x2d, 0xdd, 0x00, 0xfe, 0xfe, 0xfb, 0xe0, 0xcc, 0xb4, 0x02, 0xf7, 0xb3, 0x04, 0x0f, 0xda, 0x9f,
+    0xf6, 0x77, 0x74, 0xf5, 0x07, 0x6d, 0x21, 0xc0, 0xd4, 0x0a, 0x0e, 0x38, 0xfc, 0x98, 0x7c, 0x22, 0xd6, 0xed, 0x25,
+    0x10, 0x2e, 0x6c, 0x27, 0xe9, 0xbe, 0xc4, 0x4b, 0xa9, 0xd9, 0x03, 0x0e, 0x17, 0xf5, 0x5a, 0x31, 0xaf, 0x1c, 0xe9,
+    0x00, 0xc2, 0x83, 0x04, 0x87, 0x5c, 0xf9, 0x8e, 0xba, 0x86, 0xb4, 0x74, 0x17, 0x0c, 0x80, 0x50, 0x41, 0xf6, 0x43,
+    0x00, 0xaf, 0xd2, 0x24, 0x09, 0x27, 0xfd, 0x27, 0x09, 0xe3, 0x34, 0x49, 0x16, 0x06, 0xdc, 0xda, 0x28, 0x44, 0x83,
+    0xfb, 0xa2, 0xa3, 0xae, 0x41, 0xbc, 0xc4, 0xef, 0xd2, 0x0c, 0xa5, 0x6f, 0x48, 0x36, 0xfb, 0x9d, 0x5c, 0xa3, 0x2b,
+    0x92, 0xcd, 0xd8, 0x75, 0x34, 0x43, 0xe9, 0x55, 0x34, 0x43, 0x59, 0x46, 0x66, 0x28, 0xf9, 0x82, 0x51, 0x2d, 0xa4,
+    0x2c, 0xb1, 0xd2, 0x0a, 0x30, 0xb2, 0xce, 0xe8, 0x07, 0x28, 0x31, 0x5b, 0x1b, 0x03, 0xca, 0xdd, 0x68, 0xa9, 0x0d,
+    0x8e, 0xab, 0x6f, 0xfe, 0x2f, 0x85, 0xce, 0x50, 0x65, 0x6b, 0x6d, 0xda, 0x12, 0xf7, 0xd9, 0x0f, 0x5e, 0x1c, 0xdc,
+    0x11, 0xf9, 0x4f, 0x78, 0x41, 0x8c, 0xb4, 0x11, 0x2b, 0xa1, 0x4a, 0xec, 0x35, 0xbe, 0xc6, 0x71, 0x75, 0x1f, 0x1e,
+    0xcf, 0xd1, 0x53, 0x1f, 0xfd, 0x18, 0x0f, 0x0f, 0x3e, 0xde, 0x17, 0x76, 0xb3, 0x42, 0xbb, 0x56, 0x2a, 0x5b, 0xe2,
+    0xc6, 0xb9, 0x2e, 0x8f, 0xe3, 0xed, 0x76, 0x4b, 0xb6, 0x53, 0xa2, 0xcd, 0x2a, 0xce, 0x92, 0x24, 0x89, 0xed, 0x66,
+    0x85, 0xd1, 0x50, 0x08, 0x38, 0xbb, 0xc2, 0xa8, 0x01, 0xb1, 0x6a, 0x5c, 0x0f, 0x57, 0x2f, 0x0e, 0x70, 0x2c, 0x3c,
+    0x47, 0x75, 0xff, 0xe9, 0xc2, 0x8a, 0xb9, 0xb0, 0x02, 0x3f, 0xd2, 0x00, 0x9f, 0xc2, 0x7c, 0xd9, 0x87, 0x79, 0x4d,
+    0x33, 0x94, 0xa1, 0xa4, 0xff, 0x65, 0x91, 0x87, 0x47, 0x2c, 0x7a, 0x86, 0xa1, 0x0b, 0xcc, 0x43, 0xed, 0x3c, 0x7a,
+    0x73, 0x96, 0x4d, 0xfd, 0xc9, 0x26, 0x4d, 0x1e, 0x0f, 0xbc, 0xc0, 0xaf, 0xf3, 0x4b, 0x3c, 0xca, 0x3e, 0x5c, 0x32,
+    0x78, 0x6b, 0x4d, 0xfa, 0x61, 0x4e, 0x67, 0x68, 0x36, 0x9e, 0xcc, 0x22, 0x0f, 0x9f, 0x31, 0x34, 0xdb, 0x64, 0x4d,
+    0xda, 0x46, 0xf3, 0x68, 0x46, 0xa7, 0x68, 0x3a, 0x3a, 0x32, 0x45, 0xd3, 0x4d, 0xd6, 0xcc, 0x3f, 0xcc, 0x2f, 0xcf,
+    0xa2, 0xe9, 0x97, 0x97, 0x71, 0x85, 0xc3, 0x1c, 0xe3, 0xc7, 0xc8, 0xf9, 0x65, 0xe4, 0xe4, 0xb3, 0x16, 0x2a, 0xc0,
+    0x38, 0x3c, 0xd6, 0xe0, 0x58, 0x13, 0xe0, 0x98, 0x69, 0x55, 0x8b, 0x15, 0xf9, 0x6c, 0xb5, 0xc2, 0x21, 0x71, 0x0d,
+    0xa8, 0xe0, 0x24, 0xea, 0x05, 0xa1, 0xa7, 0x04, 0xcf, 0x29, 0x2e, 0x3c, 0x9c, 0xeb, 0xdf, 0x09, 0x27, 0xa1, 0x74,
+    0xc4, 0x37, 0xec, 0xe4, 0x6f, 0xba, 0xe2, 0xa7, 0xfd, 0x6f, 0x3c, 0xc0, 0x2d, 0x65, 0x38, 0x24, 0x42, 0x29, 0x30,
+    0x77, 0xb0, 0x73, 0x25, 0x7e, 0xf7, 0xf6, 0x06, 0xbd, 0xe5, 0xdc, 0x80, 0xb5, 0x39, 0xc2, 0xaf, 0x1c, 0x69, 0x29,
+    0xfb, 0xba, 0x78, 0x93, 0x3e, 0x95, 0xfe, 0x97, 0xf8, 0x45, 0xa0, 0x3f, 0xc0, 0x6d, 0xb5, 0x79, 0x18, 0xe5, 0xbd,
+    0xfd, 0x85, 0x6f, 0x23, 0x56, 0x7e, 0x55, 0x8d, 0x02, 0x87, 0xc3, 0x89, 0xf8, 0x3a, 0x83, 0xb5, 0x82, 0xe3, 0x70,
+    0x22, 0xbf, 0xce, 0xd1, 0x59, 0xdf, 0xbc, 0x8e, 0xd0, 0xce, 0x12, 0x2b, 0x05, 0x83, 0x20, 0x0d, 0x49, 0xad, 0xcd,
+    0xcf, 0x94, 0x35, 0x8f, 0x09, 0xb2, 0x43, 0x47, 0xab, 0x47, 0x3d, 0xcc, 0x00, 0x75, 0x30, 0xaa, 0x0a, 0x30, 0x17,
+    0x1b, 0x1c, 0x2e, 0x14, 0x61, 0x92, 0x5a, 0xeb, 0x47, 0x46, 0xe9, 0x9d, 0xf3, 0xe1, 0xe0, 0x89, 0x1a, 0x22, 0xfd,
+    0xf5, 0xee, 0xdd, 0xef, 0xe5, 0x7d, 0x41, 0x87, 0x01, 0x89, 0xbf, 0xc5, 0xa8, 0x67, 0x3e, 0x33, 0x46, 0x12, 0x6a,
+    0xe7, 0x2b, 0x5e, 0x07, 0x96, 0x18, 0x6b, 0x45, 0x78, 0x2c, 0x6c, 0x47, 0xd5, 0x73, 0xb6, 0x3e, 0xa6, 0xaa, 0x88,
+    0x3d, 0xad, 0x2a, 0x62, 0x5a, 0xbd, 0x38, 0x98, 0xc0, 0xfa, 0xe1, 0xf6, 0x10, 0x1e, 0xef, 0x27, 0x8a, 0xfc, 0x7b,
+    0x0d, 0x66, 0x7f, 0x0b, 0x12, 0x98, 0xd3, 0x26, 0xc0, 0xe4, 0x89, 0x60, 0x48, 0x1c, 0xec, 0xdc, 0xcd, 0x38, 0x7f,
+    0x2d, 0xf1, 0x87, 0x13, 0x45, 0xb4, 0x62, 0x52, 0xb0, 0x87, 0xf2, 0x1c, 0x71, 0x78, 0x10, 0x64, 0x43, 0xe5, 0x1a,
+    0x4e, 0x3c, 0x92, 0xd4, 0x9a, 0xad, 0x6d, 0x10, 0x1e, 0x27, 0x8c, 0xd0, 0xae, 0x03, 0xc5, 0x6f, 0x1a, 0x21, 0x79,
+    0xa0, 0xc2, 0x63, 0xf8, 0x78, 0xd3, 0xcf, 0x8c, 0xfb, 0xd5, 0xf0, 0xd1, 0x80, 0xfc, 0x4f, 0xf9, 0xd2, 0x2f, 0x87,
+    0x97, 0x9f, 0x70, 0x48, 0xfa, 0xf8, 0xef, 0x1f, 0x37, 0x84, 0x6f, 0xef, 0x57, 0xbb, 0x56, 0x4e, 0x7c, 0xe8, 0xd1,
+    0x7c, 0x16, 0x1e, 0xef, 0x8f, 0xe1, 0x31, 0x5c, 0x14, 0xf1, 0x30, 0xe7, 0xab, 0xa2, 0x1f, 0xb9, 0xd5, 0x0f, 0x87,
+    0xa5, 0xde, 0x45, 0x56, 0x7c, 0x11, 0x6a, 0x95, 0x0b, 0xd5, 0x80, 0x11, 0xee, 0xc8, 0xc5, 0x66, 0x22, 0x54, 0xb7,
+    0x76, 0x87, 0x8e, 0x72, 0xee, 0x29, 0xb3, 0x6e, 0xb7, 0xa8, 0xb5, 0x72, 0x9e, 0x13, 0xf2, 0x14, 0xda, 0xe3, 0x40,
+    0xef, 0x27, 0x4c, 0xfe, 0x66, 0xf6, 0xdd, 0x71, 0xa9, 0xf9, 0xfe, 0xe0, 0xd3, 0x10, 0x51, 0x29, 0x56, 0x2a, 0x67,
+    0xa0, 0x1c, 0x98, 0x41, 0xa8, 0xa6, 0xad, 0x90, 0xfb, 0xdc, 0x52, 0x65, 0x23, 0x0b, 0x46, 0xd4, 0xc7, 0xe5, 0xda,
+    0x39, 0xad, 0x0e, 0x4b, 0x6d, 0x38, 0x98, 0x3c, 0x59, 0x0c, 0x40, 0x64, 0x28, 0x17, 0x6b, 0x9b, 0x93, 0xa9, 0x81,
+    0x76, 0xb1, 0xa4, 0xec, 0x61, 0x65, 0xf4, 0x5a, 0xf1, 0x88, 0xf9, 0xc9, 0x9b, 0x7f, 0x9b, 0xd6, 0x74, 0x0a, 0x6c,
+    0x31, 0x62, 0x75, 0x5d, 0x2f, 0xa4, 0x50, 0x10, 0x0d, 0xb3, 0x2d, 0xcf, 0xc8, 0x95, 0x17, 0xbb, 0x70, 0x93, 0x64,
+    0xfe, 0x60, 0xf0, 0x31, 0x4d, 0x92, 0xef, 0x16, 0xa7, 0x70, 0x92, 0x05, 0x5b, 0x1b, 0xab, 0x4d, 0xde, 0x69, 0xe1,
+    0xdd, 0x3c, 0xb6, 0x54, 0xa8, 0x4b, 0xef, 0x7d, 0xd9, 0x2c, 0xc6, 0x75, 0x94, 0x0b, 0xd5, 0x9b, 0xe9, 0x97, 0xd2,
+    0xa2, 0x15, 0x6a, 0xd8, 0xa9, 0x79, 0x36, 0x4f, 0xba, 0xdd, 0xf1, 0x54, 0x09, 0x87, 0x13, 0x77, 0x2d, 0x61, 0xb7,
+    0xf8, 0xbc, 0xb6, 0x4e, 0xd4, 0xfb, 0x68, 0xdc, 0xc9, 0xb9, 0xed, 0x28, 0x83, 0x68, 0x09, 0x6e, 0x0b, 0xa0, 0x16,
+    0xbd, 0x8d, 0x48, 0x38, 0x68, 0xed, 0x98, 0xa7, 0xb3, 0x9a, 0xbe, 0x60, 0x9f, 0xea, 0xfa, 0x5f, 0xdc, 0xbe, 0x8a,
+    0x0e, 0x2d, 0x35, 0x2b, 0xa1, 0xa2, 0xa5, 0x76, 0x4e, 0xb7, 0x79, 0x74, 0xdd, 0xed, 0x16, 0xe3, 0x91, 0x57, 0x96,
+    0xa7, 0xde, 0xcd, 0x7e, 0xd7, 0x9e, 0xf2, 0x9d, 0x76, 0x3b, 0x64, 0xb5, 0x14, 0x7c, 0xe4, 0xeb, 0x59, 0x50, 0x72,
+    0x4e, 0x4f, 0x3a, 0xeb, 0x76, 0xc8, 0x9f, 0x9d, 0x52, 0x7d, 0x55, 0xbf, 0xa6, 0x69, 0xf2, 0x37, 0x37, 0xc2, 0xeb,
+    0x3a, 0x5b, 0xd6, 0xe7, 0x4c, 0xf9, 0xb5, 0xe9, 0x57, 0x4b, 0x5f, 0x5a, 0x45, 0x3c, 0xbc, 0x6e, 0x7c, 0x65, 0x54,
+    0x85, 0xcf, 0x70, 0x55, 0x34, 0x29, 0x12, 0xbc, 0x6c, 0x29, 0xab, 0x2e, 0x66, 0x5b, 0x11, 0x37, 0xe9, 0x89, 0xd4,
+    0xa4, 0xd5, 0x93, 0xb9, 0x35, 0xd0, 0x7a, 0xef, 0xab, 0x1b, 0xad, 0x14, 0x30, 0x27, 0xd4, 0x0a, 0x39, 0x8d, 0xc6,
+    0x14, 0x10, 0x42, 0x8a, 0xa5, 0xa9, 0xde, 0x4b, 0xa0, 0x16, 0xd0, 0x96, 0x0a, 0x47, 0x8a, 0x78, 0xe0, 0x1f, 0x3a,
+    0x5d, 0xf0, 0x52, 0x81, 0x3b, 0xf7, 0x76, 0x33, 0x1d, 0x0c, 0xdc, 0x82, 0xf3, 0x9a, 0xbc, 0x81, 0x69, 0x55, 0xf8,
+    0x15, 0x8c, 0x68, 0xdf, 0xa5, 0x65, 0xbc, 0x15, 0xb5, 0xf0, 0x4f, 0x98, 0xaa, 0xe8, 0x8b, 0xdc, 0x6b, 0xf0, 0x79,
+    0x1e, 0x9e, 0x5b, 0x3d, 0x24, 0x41, 0xad, 0x5c, 0x53, 0x4e, 0x33, 0xd4, 0x49, 0xca, 0xa0, 0xd1, 0x92, 0x83, 0x29,
+    0x6f, 0x6f, 0x7f, 0xfb, 0x67, 0xe5, 0x9d, 0x79, 0x94, 0xeb, 0xec, 0xc3, 0x20, 0xe6, 0x81, 0x51, 0x6a, 0x7e, 0x35,
+    0x3c, 0xb2, 0x3a, 0x6a, 0xed, 0x56, 0x1b, 0xfe, 0x44, 0xc7, 0xfb, 0xf1, 0x70, 0xd0, 0xd3, 0xff, 0xfb, 0x56, 0xa9,
+    0x6e, 0xe9, 0x06, 0x8a, 0x78, 0x44, 0x8a, 0xd8, 0x3b, 0x3c, 0xd0, 0x9b, 0x91, 0xaf, 0x49, 0xab, 0x3f, 0xef, 0xde,
+    0xa2, 0xbf, 0x3a, 0x4e, 0x1d, 0x0c, 0x69, 0xeb, 0xa3, 0x6a, 0xc1, 0x35, 0x9a, 0x97, 0xef, 0xff, 0xbc, 0xbd, 0x3b,
+    0x47, 0xb8, 0xee, 0x99, 0x10, 0x28, 0x36, 0x3c, 0xf7, 0xd6, 0xd2, 0x89, 0x8e, 0x1a, 0xd7, 0xab, 0x8d, 0xfc, 0x14,
+    0x39, 0xc5, 0xd0, 0xd3, 0x6b, 0x21, 0x61, 0x08, 0x63, 0x10, 0xac, 0xd0, 0xc9, 0xab, 0x93, 0xb5, 0x67, 0x7e, 0xc5,
+    0xc3, 0x6d, 0xc7, 0xc3, 0xd5, 0xc7, 0xfd, 0xcb, 0xf7, 0xbf, 0x81, 0xdb, 0x13, 0xb5, 0x09, 0x0b, 0x00, 0x00};

 #else  // Brotli (default, smaller)
 constexpr uint8_t INDEX_BR[] PROGMEM = {
-    0x1b, 0xf8, 0x0a, 0x00, 0x64, 0x5a, 0xd3, 0xfa, 0xe7, 0xf3, 0x62, 0xd8, 0x06, 0x1b, 0xe9, 0x6a, 0x8a, 0x81, 0x2b,
-    0xb5, 0x49, 0x14, 0x37, 0xdc, 0x9e, 0x1a, 0xcb, 0x56, 0x87, 0xfb, 0xff, 0xf7, 0x73, 0x75, 0x12, 0x0a, 0xd6, 0x48,
-    0x84, 0xc6, 0x21, 0xa4, 0x6d, 0xb5, 0x71, 0xef, 0x13, 0xbe, 0x4e, 0x54, 0xf1, 0x64, 0x8f, 0x3f, 0xcc, 0x9a, 0x78,
-    0xa5, 0x89, 0x25, 0xb3, 0xda, 0x2c, 0xa2, 0x32, 0x9c, 0x57, 0x07, 0x56, 0xbc, 0x34, 0x13, 0xff, 0x5c, 0x0a, 0xa1,
-    0x67, 0x82, 0xb8, 0x6b, 0x4c, 0x76, 0x31, 0x6c, 0xe3, 0x40, 0x46, 0xea, 0xb0, 0xd4, 0xf4, 0x3b, 0x02, 0x65, 0x18,
-    0xa4, 0xaf, 0xac, 0x6d, 0x55, 0xd6, 0xbe, 0x59, 0x66, 0x7a, 0x7c, 0x60, 0xb2, 0x83, 0x33, 0x23, 0xc9, 0x79, 0x82,
-    0x47, 0xb4, 0x28, 0xf4, 0x24, 0xb5, 0x23, 0x5a, 0x44, 0xe1, 0xc3, 0x27, 0x04, 0xe8, 0x0c, 0xdd, 0xb4, 0xd0, 0x8c,
-    0xfb, 0x10, 0x39, 0x93, 0x04, 0x2a, 0x66, 0x18, 0x4b, 0x74, 0xca, 0x31, 0x7f, 0xb2, 0xe5, 0x45, 0xc1, 0xdd, 0x72,
-    0x49, 0xff, 0x0e, 0xb3, 0xf0, 0x93, 0x18, 0xab, 0x68, 0xad, 0xe1, 0x9d, 0xe4, 0x29, 0xc0, 0xe3, 0x63, 0x54, 0x61,
-    0x1b, 0x45, 0xb9, 0x6c, 0x23, 0x0f, 0x99, 0x7f, 0x8e, 0x69, 0xaa, 0xc1, 0xb8, 0x4e, 0x42, 0x9c, 0xc5, 0x6e, 0x69,
-    0x40, 0x0e, 0x4f, 0x97, 0xd3, 0x23, 0x18, 0xf5, 0xc8, 0x75, 0x73, 0xb5, 0xbd, 0x46, 0x8a, 0x97, 0x7d, 0x83, 0xe4,
-    0x29, 0x72, 0x73, 0xc1, 0x39, 0x8e, 0x7e, 0x84, 0x39, 0x66, 0x57, 0xc6, 0x85, 0x19, 0x8b, 0xf2, 0x4d, 0xd9, 0xfe,
-    0x75, 0xa9, 0xe1, 0x2b, 0x21, 0x81, 0x58, 0x51, 0x99, 0xbc, 0xa4, 0x0b, 0x10, 0x6f, 0x86, 0x17, 0x0b, 0x92, 0x00,
-    0x11, 0x6f, 0x3b, 0xa4, 0xa4, 0x11, 0x7e, 0x0b, 0x97, 0x85, 0x23, 0x0c, 0x01, 0x6f, 0x2a, 0x18, 0xc6, 0xbe, 0x3d,
-    0x77, 0x1a, 0xe6, 0x00, 0x5c, 0x1a, 0x14, 0x47, 0xc6, 0xcc, 0xcc, 0x52, 0xbe, 0x04, 0x19, 0x31, 0x05, 0x46, 0xa0,
-    0xc3, 0x69, 0x0c, 0x60, 0xb7, 0x14, 0x57, 0xa0, 0x92, 0xbf, 0xb7, 0x0c, 0xd8, 0x3a, 0x79, 0x09, 0x99, 0xc9, 0x71,
-    0x88, 0x01, 0x8b, 0xa5, 0x61, 0x0a, 0xb5, 0xe8, 0xc7, 0x71, 0xe7, 0x70, 0x79, 0xb6, 0xe4, 0x01, 0xfc, 0x1a, 0x4a,
-    0x7b, 0x60, 0x6e, 0xef, 0x95, 0x62, 0x59, 0x28, 0xb5, 0x25, 0x56, 0x15, 0xe7, 0xca, 0xad, 0x32, 0xe6, 0xf7, 0x01,
-    0x31, 0x34, 0x87, 0x93, 0x0b, 0x9b, 0x9d, 0x26, 0xff, 0xe5, 0x92, 0xad, 0x6f, 0xb8, 0x3b, 0x16, 0xc1, 0xa0, 0x5a,
-    0x4f, 0x52, 0x0b, 0x2b, 0xc1, 0xa7, 0x95, 0x7b, 0x24, 0x51, 0xd3, 0xb3, 0x23, 0x62, 0x0b, 0xcc, 0xa0, 0x58, 0xa7,
-    0x64, 0x45, 0x2f, 0x0b, 0xdd, 0x1d, 0x97, 0x82, 0x1f, 0xcc, 0x64, 0xdb, 0xd3, 0xf4, 0xb0, 0x8b, 0xc8, 0xcf, 0x15,
-    0x81, 0x8b, 0xa1, 0x9d, 0xf8, 0xfc, 0xec, 0x49, 0x40, 0x12, 0x01, 0x09, 0x51, 0xf3, 0x73, 0x18, 0x24, 0x97, 0x55,
-    0x85, 0x6a, 0x92, 0x1a, 0xf5, 0x5a, 0x05, 0x54, 0x1f, 0x27, 0x0a, 0xa8, 0xa1, 0x94, 0x58, 0x78, 0x7d, 0x87, 0xa8,
-    0xdb, 0x13, 0x66, 0x20, 0x5e, 0x43, 0x18, 0x7a, 0xbb, 0x16, 0x16, 0x07, 0xc8, 0xab, 0x10, 0xe2, 0x50, 0xb9, 0xb1,
-    0xd8, 0x21, 0xc8, 0x4a, 0x2e, 0x99, 0x0e, 0x23, 0x52, 0xc6, 0xcb, 0x29, 0x84, 0x91, 0x03, 0xb1, 0xe2, 0x4c, 0x1d,
-    0x22, 0xd3, 0xc8, 0x79, 0x00, 0x8b, 0x8b, 0x88, 0x1e, 0x29, 0xd3, 0xae, 0x10, 0x15, 0x22, 0x6d, 0xb0, 0x87, 0x6f,
-    0x27, 0x2e, 0x7c, 0xc2, 0x7a, 0x61, 0xbd, 0x22, 0xe5, 0x5f, 0xdd, 0x7b, 0x00, 0x04, 0xf2, 0x7d, 0x5a, 0x03, 0x38,
-    0x1f, 0x69, 0x6d, 0x0b, 0xfb, 0xec, 0x45, 0xfe, 0x8b, 0x7f, 0xec, 0x7b, 0xad, 0xc2, 0x33, 0xf1, 0x9e, 0x9c, 0x71,
-    0xd9, 0xe8, 0x5e, 0x8f, 0xd4, 0xee, 0x87, 0x45, 0x6c, 0xe2, 0x12, 0xf8, 0xb8, 0xc5, 0xee, 0x43, 0xa6, 0x37, 0x91,
-    0xb5, 0x2c, 0x2f, 0xe9, 0xe8, 0x24, 0xd0, 0x45, 0xc1, 0x0c, 0x7c, 0xf0, 0xb2, 0xb5, 0x2d, 0x10, 0x36, 0x7e, 0x18,
-    0x7c, 0x79, 0x82, 0x69, 0x3d, 0x35, 0xca, 0x52, 0xee, 0xc9, 0xb5, 0x65, 0xa4, 0xa1, 0xfd, 0x70, 0x7e, 0xe0, 0x7d,
-    0x67, 0xf9, 0xa1, 0x71, 0xd2, 0x08, 0x74, 0x33, 0x5f, 0x69, 0xa4, 0x59, 0x03, 0xfd, 0xf8, 0xf0, 0x70, 0x1a, 0x50,
-    0x43, 0xfb, 0x61, 0xf0, 0x38, 0x18, 0x88, 0x85, 0x36, 0x23, 0x06, 0x4f, 0x02, 0xbb, 0x78, 0x1a, 0xaa, 0xd2, 0x02,
-    0x5e, 0xa0, 0x74, 0x30, 0xc8, 0x7a, 0x66, 0xab, 0xd9, 0x43, 0x99, 0x45, 0xb7, 0x0c, 0x5c, 0xec, 0xc8, 0x03, 0x0e,
-    0x0b, 0xca, 0x4a, 0x22, 0x48, 0xfb, 0xb7, 0x3d, 0x82, 0x07, 0x8d, 0x1b, 0x21, 0x87, 0x4d, 0x57, 0xa4, 0x5b, 0xd4,
-    0xe3, 0x88, 0x02, 0xc4, 0x81, 0xf9, 0x47, 0xe4, 0xbf, 0x3e, 0x39, 0xbb, 0x4f, 0x7e, 0x91, 0x63, 0x98, 0x97, 0xe4,
-    0x52, 0x01, 0x58, 0xba, 0x32, 0xbf, 0xae, 0xff, 0x45, 0xa1, 0xbc, 0x9b, 0xa4, 0x09, 0x0e, 0x79, 0xc0, 0x41, 0x86,
-    0x52, 0x88, 0x55, 0x39, 0x9d, 0xb6, 0xed, 0x35, 0x68, 0x29, 0xfa, 0xe6, 0x6c, 0x3d, 0x0a, 0xcd, 0x6a, 0x28, 0xfd,
-    0x65, 0x24, 0xce, 0x38, 0x98, 0x01, 0xd9, 0x3f, 0x1b, 0x4c, 0xc4, 0x5c, 0x1d, 0xaa, 0x21, 0x78, 0x67, 0xaf, 0x55,
-    0x72, 0x34, 0xf8, 0x1b, 0x03, 0x21, 0x27, 0x08, 0xbd, 0x59, 0x60, 0x48, 0x0d, 0xe2, 0x56, 0x9b, 0x30, 0x92, 0x8f,
-    0x67, 0x8a, 0x7f, 0x20, 0xbd, 0x2d, 0xfd, 0xc5, 0xb0, 0xa6, 0xaa, 0x77, 0x75, 0x26, 0x33, 0x2f, 0x20, 0x2a, 0xab,
-    0x5c, 0xd1, 0x3b, 0xda, 0xb2, 0x4c, 0xa4, 0x86, 0x25, 0x8d, 0x49, 0x05, 0xaf, 0x7a, 0xa8, 0xd4, 0x9c, 0x0d, 0xd3,
-    0x38, 0xa6, 0x5c, 0x29, 0x6b, 0x16, 0x27, 0x07, 0xf1, 0xbe, 0xe2, 0x24, 0xc1, 0x8d, 0x25, 0x76, 0xbc, 0xf6, 0x0d,
-    0xc2, 0x94, 0x25, 0xb8, 0xf3, 0x07, 0x9a, 0x49, 0xf4, 0x89, 0x82, 0x4d, 0x51, 0xb1, 0x96, 0x61, 0x62, 0x8d, 0xc8,
-    0x61, 0x65, 0x0d, 0x14, 0x34, 0x02, 0x65, 0x94, 0xcc, 0x1d, 0x85, 0x00, 0x0f, 0x1a, 0x57, 0x68, 0x15, 0xcf, 0xa4,
-    0xa2, 0x7d, 0x6d, 0x53, 0x60, 0xce, 0x5c, 0x61, 0x82, 0x17, 0x32, 0xc1, 0x87, 0x02, 0x0c, 0x91, 0x85, 0x57, 0x51,
-    0xbe, 0xb2, 0x38, 0x9f, 0x3d, 0x2a, 0x52, 0x5a, 0xad, 0xba, 0x46, 0x9e, 0x3c, 0x8a, 0xa0, 0x46, 0x15, 0xf4, 0x59,
-    0x74, 0x5f, 0x2a, 0xae, 0x96, 0x56, 0xf0, 0x54, 0x39, 0xaf, 0xac, 0x2a, 0xb9, 0xad, 0x32, 0x50, 0xc9, 0xc1, 0xee,
-    0xd2, 0x0d, 0x34, 0xaa, 0x98, 0x4d, 0x6d, 0x3d, 0xc6, 0xb9, 0x5b, 0x00, 0x5f, 0xea, 0xda, 0x16, 0xa6, 0x08, 0x43,
-    0x58, 0x4d, 0x8d, 0x07, 0x55, 0x62, 0x81, 0x44, 0xcc, 0x31, 0x04, 0x4b, 0x4c, 0x8b, 0x3e, 0xff, 0xd8, 0xf6, 0x65,
-    0x19, 0xa1, 0x94, 0x62, 0x65, 0x0a, 0xdd, 0x60, 0x38, 0xd3, 0xbe, 0x0d, 0xa3, 0x99, 0xd5, 0x37, 0x68, 0xa1, 0x71,
-    0xa3, 0x41, 0xe7, 0xbe, 0x9d, 0x72, 0x84, 0x75, 0xb6, 0x8d, 0x98, 0xd6, 0xb8, 0x2d, 0x43, 0x85, 0x5d, 0xf9, 0xca,
-    0xc3, 0x96, 0xa5, 0xa6, 0xe7, 0x50, 0x88, 0x6b, 0x84, 0x58, 0x44, 0x45, 0x20, 0xdf, 0x1e, 0x5a, 0xc9, 0xce, 0x42,
-    0x2a, 0x1f, 0x3e, 0x3c, 0x7b, 0x68, 0x3c, 0x34, 0x8b, 0x36, 0xba, 0x1f, 0xce, 0x0f, 0xa0, 0x60, 0x37, 0x5f, 0x1a,
-    0x03, 0x2b, 0x86, 0x29, 0x45, 0x7b, 0xb4, 0xb7, 0x06, 0x68, 0x17, 0x7e, 0x13, 0x76, 0x91, 0x4d, 0x27, 0xee, 0xbc,
-    0x7e, 0x80, 0xc2, 0x66, 0xac, 0xc6, 0xbf, 0xeb, 0x7f, 0xd7, 0x84, 0x79, 0xf3, 0xf1, 0xde, 0xec, 0xa6, 0x93, 0xa8,
-    0x13, 0x3b, 0x4a, 0x81, 0xfa, 0x11, 0x1e, 0x4a, 0xd2, 0x50, 0x2a, 0xea, 0x9a, 0xc2, 0x37, 0x08, 0xed, 0x01, 0xf5,
-    0xa2, 0xd5, 0x32, 0x29, 0x49, 0xc4, 0x1a, 0x11, 0xc0, 0xda, 0x24, 0x28, 0x84, 0x38, 0x60, 0x80, 0xcf, 0xd0, 0x45,
-    0x83, 0xa7, 0xca, 0x52, 0x5c, 0xac, 0x23, 0x01};
+    0x1b, 0x08, 0x0b, 0x00, 0xe4, 0x7f, 0x9b, 0xad, 0xbb, 0x97, 0x53, 0xde, 0xb7, 0x25, 0x0e, 0x69, 0xd4, 0x69, 0x89,
+    0xba, 0xa5, 0x55, 0x22, 0x04, 0x27, 0xeb, 0x00, 0x52, 0xac, 0xbc, 0xec, 0x5f, 0xfb, 0xb5, 0x7a, 0x12, 0x0a, 0xd6,
+    0x48, 0x84, 0x4a, 0x48, 0x5a, 0xcb, 0xbd, 0xb7, 0x72, 0x66, 0x4e, 0x62, 0xd8, 0xbd, 0x7f, 0x88, 0x68, 0x86, 0x28,
+    0xd6, 0xf1, 0xda, 0x2c, 0xa2, 0x32, 0x5c, 0xdd, 0xab, 0xb2, 0x15, 0xbc, 0x24, 0x13, 0xe6, 0xbd, 0x0c, 0x52, 0x63,
+    0x82, 0x88, 0x6d, 0x74, 0x71, 0x51, 0x9c, 0xe2, 0x40, 0x56, 0xea, 0xb0, 0x5c, 0xb7, 0x1d, 0x81, 0x3a, 0x0c, 0xf2,
+    0xd7, 0xa8, 0x5c, 0x35, 0x2d, 0x43, 0xb3, 0x42, 0x37, 0x7c, 0x60, 0xd8, 0xc1, 0x95, 0x91, 0x94, 0x3c, 0x29, 0x20,
+    0x96, 0x20, 0xf6, 0x24, 0xb7, 0x83, 0x4a, 0x06, 0xf1, 0xc3, 0x2f, 0x88, 0x50, 0x55, 0x35, 0x2d, 0xe8, 0xb6, 0x21,
+    0x38, 0x61, 0x8e, 0x44, 0x2a, 0xac, 0x39, 0xcf, 0x74, 0xaa, 0x31, 0x7f, 0x62, 0x32, 0x9b, 0x99, 0x42, 0x0a, 0xf6,
+    0x6f, 0xd8, 0x89, 0x3f, 0x49, 0xb1, 0xa2, 0x52, 0x0a, 0x8e, 0xb3, 0x27, 0x0b, 0x07, 0x07, 0x58, 0xb0, 0x8f, 0xaa,
+    0xdc, 0x68, 0x12, 0x0f, 0x95, 0xbf, 0xc7, 0x36, 0xd5, 0x60, 0x5a, 0xc7, 0x80, 0xac, 0x52, 0xf7, 0xa7, 0x2d, 0xb6,
+    0x64, 0xda, 0xda, 0x11, 0x8d, 0x6a, 0xe5, 0xba, 0xe9, 0xda, 0xdc, 0x62, 0xc3, 0xcb, 0xae, 0xc1, 0xe1, 0x11, 0xb6,
+    0x33, 0x29, 0x04, 0x09, 0xfe, 0x09, 0x08, 0xc2, 0x1f, 0x98, 0x16, 0x26, 0x0d, 0xce, 0xd7, 0x75, 0xfb, 0xd7, 0xa5,
+    0x82, 0xd7, 0x32, 0x44, 0x72, 0xc1, 0xc2, 0xe4, 0x15, 0xcb, 0x50, 0xfc, 0xd3, 0x58, 0x64, 0x34, 0x41, 0x32, 0xbe,
+    0x1f, 0x08, 0x43, 0x16, 0x14, 0xf7, 0x70, 0x2c, 0x1c, 0x61, 0x09, 0x78, 0x73, 0xd1, 0x30, 0xf6, 0xed, 0x85, 0x55,
+    0x50, 0x02, 0xf0, 0x68, 0x50, 0x5c, 0x1a, 0xd7, 0x3b, 0x8e, 0xf2, 0x23, 0xc8, 0x88, 0x39, 0xd0, 0x84, 0xf7, 0xa6,
+    0xd1, 0xa3, 0xfb, 0xe5, 0x44, 0xc0, 0x4c, 0x2f, 0x6f, 0x19, 0x70, 0x75, 0xf6, 0x1c, 0xb8, 0xce, 0x89, 0x4f, 0x01,
+    0x8d, 0xa1, 0x71, 0xf2, 0x97, 0xf8, 0xe7, 0xd3, 0xf1, 0xe1, 0xfa, 0xfc, 0xc8, 0x03, 0x78, 0x14, 0xa0, 0x3d, 0x28,
+    0xb7, 0xeb, 0x26, 0x52, 0x59, 0xa8, 0xb5, 0x0d, 0x5c, 0x8a, 0x6b, 0xe5, 0xf6, 0x30, 0xd6, 0xf7, 0x71, 0x31, 0xe8,
+    0xbd, 0xc9, 0xfa, 0xf5, 0x71, 0x9d, 0xff, 0xf6, 0x69, 0x62, 0x5f, 0xb5, 0xc7, 0x06, 0x43, 0x54, 0xb5, 0x87, 0xf1,
+    0xcc, 0x84, 0xe8, 0xb7, 0x56, 0x38, 0x43, 0x6a, 0xa6, 0x2f, 0x53, 0xd1, 0x89, 0x48, 0x8d, 0x72, 0x75, 0x4a, 0x17,
+    0xf6, 0x8d, 0xb2, 0xeb, 0xb1, 0x6b, 0x29, 0x1e, 0xd5, 0x74, 0xc7, 0xb3, 0xf4, 0xf1, 0x04, 0x0d, 0xbf, 0x08, 0x81,
+    0x8f, 0xfe, 0x8d, 0xfc, 0xf2, 0x35, 0x92, 0xa0, 0x24, 0x88, 0x12, 0x6a, 0xe6, 0x2f, 0x01, 0x94, 0x5c, 0x4b, 0xf9,
+    0x6b, 0x9a, 0xf6, 0x1a, 0x35, 0x11, 0x8a, 0xc6, 0x04, 0x8d, 0x50, 0x64, 0x48, 0x2d, 0x8b, 0xdf, 0xdf, 0xa1, 0xd1,
+    0xfd, 0x21, 0xd7, 0x40, 0x96, 0x00, 0xb1, 0x9f, 0x54, 0xc2, 0xe1, 0x00, 0x79, 0x15, 0x80, 0xf8, 0xca, 0x8e, 0xc5,
+    0x06, 0x03, 0xdf, 0x72, 0x49, 0xc0, 0x08, 0x27, 0x90, 0xe3, 0x14, 0xc2, 0xac, 0xc3, 0x83, 0xc9, 0xf6, 0x9d, 0x12,
+    0xab, 0x46, 0xae, 0x03, 0x74, 0x1d, 0x27, 0xce, 0x91, 0x1d, 0x4e, 0xb4, 0xbe, 0x80, 0xe7, 0x6a, 0x6d, 0x0a, 0x20,
+    0x47, 0x6b, 0x00, 0x4e, 0x25, 0x52, 0xe6, 0xf5, 0xe9, 0x43, 0x84, 0xc1, 0x0d, 0x4b, 0x04, 0xb3, 0x91, 0x49, 0xf5,
+    0xe9, 0xc4, 0x2e, 0x1b, 0xf9, 0x98, 0xf9, 0xea, 0x9e, 0xb8, 0xf6, 0x53, 0xf8, 0x42, 0xc2, 0x60, 0x5c, 0xa9, 0xd2,
+    0xfe, 0x0a, 0xe5, 0xd4, 0x7d, 0x36, 0x76, 0x04, 0x12, 0x38, 0xa1, 0xc4, 0x30, 0xb8, 0xf2, 0x69, 0x86, 0x5b, 0xe7,
+    0xe5, 0xa0, 0xc0, 0xfe, 0x91, 0x19, 0x03, 0x1e, 0xa9, 0x93, 0x26, 0x49, 0x58, 0xd5, 0xf6, 0x33, 0x4e, 0x0a, 0x89,
+    0x64, 0x1e, 0xb4, 0x7a, 0x5d, 0x0d, 0x12, 0xcf, 0x2b, 0xdd, 0x35, 0x90, 0x55, 0xc3, 0x0e, 0xcd, 0x0e, 0xad, 0x6b,
+    0x8f, 0x43, 0xd0, 0xb4, 0x6a, 0xdb, 0x4b, 0xe5, 0xa4, 0x9b, 0x09, 0x23, 0x1a, 0x43, 0xa9, 0xff, 0x61, 0x8b, 0x07,
+    0xd6, 0x0f, 0x83, 0x23, 0xbe, 0x8a, 0x66, 0xa2, 0x10, 0x2f, 0x11, 0x01, 0x0d, 0xc6, 0x96, 0xba, 0x87, 0xaa, 0xa8,
+    0x44, 0x7c, 0x1e, 0x34, 0xdb, 0xba, 0x41, 0x90, 0xf0, 0x7a, 0xdb, 0x63, 0x60, 0x96, 0x8d, 0x64, 0xcb, 0x2f, 0x28,
+    0x96, 0x04, 0xd5, 0xc0, 0x7a, 0xe8, 0xec, 0xd1, 0x61, 0x1b, 0x09, 0x4b, 0x4c, 0x6e, 0x1b, 0x31, 0x98, 0x9c, 0x6d,
+    0xdb, 0xd0, 0xec, 0xa4, 0x0f, 0x0a, 0xe0, 0xc8, 0x35, 0xc4, 0x93, 0xdc, 0xee, 0x19, 0x00, 0x80, 0x07, 0xf5, 0xcf,
+    0xe0, 0x7f, 0x75, 0xf8, 0x52, 0x3a, 0xfc, 0x0d, 0x84, 0xa5, 0xc1, 0xb2, 0x1c, 0x25, 0x40, 0xc5, 0x8b, 0xb3, 0xdb,
+    0x7a, 0x1b, 0x44, 0xff, 0x79, 0x9a, 0x26, 0xc4, 0xe7, 0x9e, 0x78, 0x4c, 0xa5, 0x94, 0xab, 0x78, 0x34, 0x9d, 0xb5,
+    0xb7, 0x24, 0x26, 0xe7, 0x9a, 0xf3, 0xe5, 0x2a, 0x35, 0x4b, 0xbe, 0x74, 0xd7, 0x01, 0xbc, 0x71, 0x72, 0x03, 0x5c,
+    0x40, 0x24, 0x17, 0x61, 0x5b, 0x7b, 0x19, 0xc2, 0x7f, 0x4e, 0x5b, 0x24, 0xfb, 0x8b, 0xc3, 0x51, 0x00, 0x3d, 0x09,
+    0x04, 0x05, 0x72, 0x64, 0xf6, 0xf0, 0x6b, 0x99, 0x38, 0x93, 0x5b, 0xac, 0x0c, 0xff, 0x40, 0x7b, 0x53, 0xba, 0xab,
+    0x61, 0xc9, 0xa2, 0xde, 0xd6, 0x2b, 0x0c, 0xbd, 0x85, 0xac, 0x4c, 0x64, 0x8b, 0xe6, 0x69, 0x2b, 0x56, 0x10, 0x1b,
+    0x08, 0x59, 0x6c, 0x55, 0x0a, 0xaa, 0x93, 0x85, 0x1d, 0x45, 0xda, 0xc6, 0x39, 0xe6, 0x6a, 0xab, 0x71, 0x73, 0x46,
+    0x0f, 0xf7, 0xab, 0x4e, 0x88, 0xae, 0x8c, 0xe0, 0x91, 0xda, 0x35, 0x8c, 0xd3, 0x18, 0x92, 0x3d, 0xab, 0x2f, 0x0d,
+    0xd6, 0xc9, 0x06, 0xdb, 0xc2, 0x62, 0xcb, 0x8a, 0x23, 0x5b, 0x28, 0x2e, 0x9b, 0x96, 0xc4, 0xc1, 0x42, 0xa9, 0x8d,
+    0x69, 0xe5, 0x8f, 0x89, 0x12, 0x11, 0x9a, 0x56, 0x3b, 0x3c, 0x2b, 0xb4, 0xb2, 0x7b, 0xfd, 0xdb, 0x80, 0x92, 0xb4,
+    0xca, 0x44, 0x37, 0x8c, 0x94, 0x2f, 0x4a, 0xb4, 0xc4, 0x28, 0x83, 0x8a, 0x78, 0xcb, 0xd2, 0x5c, 0x5c, 0x35, 0x29,
+    0x95, 0x35, 0x2f, 0x99, 0x28, 0x4f, 0x22, 0x18, 0x70, 0x85, 0xee, 0x2c, 0xb9, 0xef, 0x14, 0x57, 0x73, 0x23, 0x45,
+    0xae, 0xdc, 0x54, 0x56, 0x55, 0x78, 0x56, 0xad, 0x48, 0x26, 0x27, 0xbf, 0xcb, 0xd7, 0x54, 0xa9, 0xa8, 0xd7, 0xb5,
+    0x71, 0x9c, 0xe7, 0x79, 0x89, 0x5c, 0xa9, 0x6a, 0x53, 0xe8, 0xfa, 0x0d, 0x69, 0x36, 0xed, 0xad, 0x33, 0xc9, 0x75,
+    0x17, 0xe9, 0x8f, 0x31, 0x58, 0xa6, 0x27, 0xfc, 0x79, 0xc6, 0xb6, 0xd5, 0x65, 0x90, 0x31, 0xc6, 0x9d, 0x29, 0x95,
+    0x83, 0xe5, 0x4e, 0xbb, 0xd7, 0xdc, 0x8e, 0xd0, 0x3a, 0x54, 0x27, 0xce, 0xf5, 0xdb, 0xbd, 0x89, 0x3c, 0x61, 0xb3,
+    0x71, 0x23, 0xc7, 0x55, 0x9e, 0xea, 0x50, 0xe4, 0x37, 0xae, 0x72, 0x34, 0x66, 0xb9, 0x6e, 0x2c, 0x0a, 0x69, 0x8d,
+    0x94, 0x8b, 0x98, 0x08, 0x05, 0x3c, 0x45, 0x45, 0xe1, 0x6c, 0x22, 0xc5, 0x8f, 0x1f, 0x9f, 0x3f, 0xd2, 0x01, 0x12,
+    0xec, 0x86, 0x2f, 0x87, 0x8b, 0x47, 0x30, 0xd0, 0x77, 0x77, 0x1a, 0x13, 0x2d, 0xc6, 0x31, 0x65, 0x77, 0xd8, 0x8c,
+    0xe7, 0xe0, 0x16, 0xf9, 0x4b, 0xd4, 0xc5, 0xa8, 0x67, 0x79, 0xe7, 0xc3, 0x07, 0x94, 0x46, 0xa3, 0x8c, 0x67, 0xd3,
+    0xff, 0x5f, 0x96, 0xfa, 0xed, 0xa7, 0xd3, 0xdd, 0x4f, 0x27, 0x49, 0x27, 0xcf, 0xa4, 0x02, 0xc3, 0x27, 0x3c, 0x96,
+    0x64, 0x24, 0x55, 0xc8, 0x36, 0x45, 0x68, 0x90, 0xea, 0x03, 0x0b, 0x46, 0xa7, 0x8d, 0xb4, 0x26, 0x91, 0x07, 0x4c,
+    0x80, 0x7b, 0x93, 0xa8, 0x10, 0xcb, 0x5e, 0x8d, 0x42, 0x86, 0x3e, 0x2a, 0x7c, 0x99, 0x79, 0x8e, 0xcb, 0x43, 0x28};

 // Backwards compatibility alias
 #define INDEX_GZ INDEX_BR
@@ -2,9 +2,10 @@
 #ifdef USE_CAPTIVE_PORTAL
 #include "esphome/core/log.h"
 #include "esphome/core/application.h"
+#include "esphome/core/helpers.h"
+#include "esphome/core/string_ref.h"
 #include "esphome/components/wifi/wifi_component.h"
 #include "captive_index.h"
-#include "json_escape.h"

 namespace esphome::captive_portal {

@@ -1,85 +0,0 @@
-#pragma once
-#include <cstddef>
-#include <cstdint>
-#include <span>
-
-#include "esphome/core/helpers.h"
-#include "esphome/core/string_ref.h"
-
-namespace esphome::captive_portal {
-
-/// Largest number of output bytes a single input byte can expand to (a \u00XX sequence).
-static constexpr size_t JSON_ESCAPE_MAX_EXPANSION = 6;
-
-/// Copy value into buf, escaping the characters that cannot appear raw inside a JSON string literal.
-///
-/// Escapes " and \ along with the control characters below 0x20, using the short forms where JSON defines one and
-/// \u00XX otherwise. Bytes >= 0x20 are copied verbatim, so text containing valid UTF-8 survives intact. The result is
-/// always null terminated; anything that would not fit is dropped rather than written partially. Returns buf so the
-/// call can be used directly as an argument.
-///
-/// To size buf so that no input is ever dropped, allow JSON_ESCAPE_MAX_EXPANSION bytes per input byte plus one for
-/// the null terminator.
-inline const char *json_escape_into_buffer(std::span<char> buf, StringRef value) {
-  if (buf.empty())
-    return "";
-  // Reserve one byte for the null terminator.
-  const size_t limit = buf.size() - 1;
-  size_t pos = 0;
-  for (char ch : value) {
-    auto c = static_cast<unsigned char>(ch);
-    // Every short form is a backslash followed by a single character, so only that character is needed here. Keeping
-    // it a char rather than a string avoids putting the sequences in read only data, which is RAM on the ESP8266.
-    char escape = '\0';
-    switch (c) {
-      case '"':
-        escape = '"';
-        break;
-      case '\\':
-        escape = '\\';
-        break;
-      case '\n':
-        escape = 'n';
-        break;
-      case '\r':
-        escape = 'r';
-        break;
-      case '\t':
-        escape = 't';
-        break;
-      case '\b':
-        escape = 'b';
-        break;
-      case '\f':
-        escape = 'f';
-        break;
-      default:
-        break;
-    }
-    if (escape != '\0') {
-      if (pos + 2 > limit)
-        break;
-      buf[pos++] = '\\';
-      buf[pos++] = escape;
-    } else if (c < 0x20) {
-      // Remaining control characters have no short form and must be written as \u00XX. The value is below 0x20, so
-      // the two high hex digits are always zero.
-      if (pos + JSON_ESCAPE_MAX_EXPANSION > limit)
-        break;
-      buf[pos++] = '\\';
-      buf[pos++] = 'u';
-      buf[pos++] = '0';
-      buf[pos++] = '0';
-      buf[pos++] = format_hex_char(static_cast<uint8_t>(c >> 4));
-      buf[pos++] = format_hex_char(static_cast<uint8_t>(c & 0x0F));
-    } else {
-      if (pos + 1 > limit)
-        break;
-      buf[pos++] = static_cast<char>(c);
-    }
-  }
-  buf[pos] = '\0';
-  return buf.data();
-}
-
-}  // namespace esphome::captive_portal
@@ -24,21 +24,27 @@ CONF_IAQ = "iaq"
 CONF_IGNORE_NOT_FOUND = "ignore_not_found"
 CONF_LIBRETINY = "libretiny"
 CONF_LOOP = "loop"
+CONF_NOX_INDEX = "nox_index"
 CONF_ON_PACKET = "on_packet"
 CONF_ON_RECEIVE = "on_receive"
+CONF_ON_SCAN_END = "on_scan_end"
 CONF_ON_STATE_CHANGE = "on_state_change"
 CONF_PARITY = "parity"
 CONF_RECEIVER_FREQUENCY = "receiver_frequency"
 CONF_REQUEST_HEADERS = "request_headers"
 CONF_ROWS = "rows"
+CONF_SCAN_PARAMETERS = "scan_parameters"
 CONF_SHA256 = "sha256"
 CONF_STATE_SAVE_INTERVAL = "state_save_interval"
 CONF_STOP_BITS = "stop_bits"
+CONF_TARGET_COUNT = "target_count"
 CONF_USE_PSRAM = "use_psram"
+CONF_VOC_INDEX = "voc_index"
 CONF_VOLUME_INCREMENT = "volume_increment"
 CONF_VOLUME_INITIAL = "volume_initial"
 CONF_VOLUME_MAX = "volume_max"
 CONF_VOLUME_MIN = "volume_min"
+CONF_WINDOW = "window"

 ICON_CURRENT_DC = "mdi:current-dc"
 ICON_SOLAR_PANEL = "mdi:solar-panel"
@@ -81,4 +81,134 @@ constexpr NATIVE_COLOR color_to_bwr(Color color, NATIVE_COLOR hw_black, NATIVE_C
  return color_to_bwyr<NATIVE_COLOR>(color, hw_black, hw_white, /*hw_yellow=*/hw_white, hw_red);
 }

+/** Map RGB color to discrete BWYRGB hex 6 color key
+ *
+ * Divides the RGB cube into 8 corners by which components are "on" (over 128), same as
+ * color_to_bwyr, but also resolves the green and blue corners instead of folding them into
+ * white/black.
+ *
+ * @tparam NATIVE_COLOR  Type of native hardware color values
+ * @param color     RGB color to convert from
+ * @param hw_black  Native value for black
+ * @param hw_white  Native value for white
+ * @param hw_yellow Native value for yellow
+ * @param hw_red    Native value for red
+ * @param hw_green  Native value for green
+ * @param hw_blue   Native value for blue
+ * @return          Converted native hardware color value
+ * @internal Constexpr. Does not depend on side effects ("pure").
+ */
+template<typename NATIVE_COLOR>
+constexpr NATIVE_COLOR color_to_bwyrgb(Color color, NATIVE_COLOR hw_black, NATIVE_COLOR hw_white,
+                                       NATIVE_COLOR hw_yellow, NATIVE_COLOR hw_red, NATIVE_COLOR hw_green,
+                                       NATIVE_COLOR hw_blue) {
+  const auto [min_rgb, max_rgb] = std::minmax({color.r, color.g, color.b});
+
+  if ((max_rgb - min_rgb) < COLORCONV_GRAY_THRESHOLD) {
+    if ((static_cast<int>(color.r) + color.g + color.b) > 382) {
+      return hw_white;
+    }
+    return hw_black;
+  }
+
+  const bool r_on = (color.r > 128);
+  const bool g_on = (color.g > 128);
+  const bool b_on = (color.b > 128);
+
+  if (r_on && g_on && !b_on) {
+    return hw_yellow;
+  }
+  if (r_on && !g_on && !b_on) {
+    return hw_red;
+  }
+  if (!r_on && g_on && !b_on) {
+    return hw_green;
+  }
+  if (!r_on && !g_on && b_on) {
+    return hw_blue;
+  }
+  // Handle "impure" colors (cyan, magenta) by folding into the closest primary.
+  if (!r_on && g_on && b_on) {
+    return hw_green;  // cyan
+  }
+  if (r_on && !g_on) {
+    return hw_red;  // magenta
+  }
+  if (r_on) {
+    // All high (but not gray) -> white
+    return hw_white;
+  }
+  // !r_on && !g_on && !b_on
+  // All low (but not gray) -> black
+  return hw_black;
+}
+
+/** Map RGB color to discrete BWYRGBO hex 7 color key
+ *
+ * Same corner logic as color_to_bwyrgb, except the red/yellow corner is split three ways
+ * instead of two, for panels with a dedicated orange ink.
+ *
+ * @tparam NATIVE_COLOR  Type of native hardware color values
+ * @param color     RGB color to convert from
+ * @param hw_black  Native value for black
+ * @param hw_white  Native value for white
+ * @param hw_yellow Native value for yellow
+ * @param hw_red    Native value for red
+ * @param hw_green  Native value for green
+ * @param hw_blue   Native value for blue
+ * @param hw_orange Native value for orange
+ * @return          Converted native hardware color value
+ * @internal Constexpr. Does not depend on side effects ("pure").
+ */
+template<typename NATIVE_COLOR>
+constexpr NATIVE_COLOR color_to_bwyrgbo(Color color, NATIVE_COLOR hw_black, NATIVE_COLOR hw_white,
+                                        NATIVE_COLOR hw_yellow, NATIVE_COLOR hw_red, NATIVE_COLOR hw_green,
+                                        NATIVE_COLOR hw_blue, NATIVE_COLOR hw_orange) {
+  const auto [min_rgb, max_rgb] = std::minmax({color.r, color.g, color.b});
+
+  if ((max_rgb - min_rgb) < COLORCONV_GRAY_THRESHOLD) {
+    if ((static_cast<int>(color.r) + color.g + color.b) > 382) {
+      return hw_white;
+    }
+    return hw_black;
+  }
+
+  const bool r_on = (color.r > 128);
+  const bool g_on = (color.g > 128);
+  const bool b_on = (color.b > 128);
+
+  if (r_on && !b_on) {
+    // Between red and yellow: split the gradient in three instead of two, since this panel has a
+    // dedicated orange ink. Named orange (e.g. 0xFFA500) has g close to the midpoint, so the
+    // plain g_on (>128) threshold used by color_to_bwyrgb can't tell it apart from yellow.
+    if (color.g > 170) {
+      return hw_yellow;
+    }
+    if (color.g > 85) {
+      return hw_orange;
+    }
+    return hw_red;
+  }
+  if (!r_on && g_on && !b_on) {
+    return hw_green;
+  }
+  if (!r_on && !g_on && b_on) {
+    return hw_blue;
+  }
+  // Handle "impure" colors (cyan, magenta) by folding into the closest primary.
+  if (!r_on && g_on && b_on) {
+    return hw_green;  // cyan
+  }
+  if (r_on && !g_on) {
+    return hw_red;  // magenta
+  }
+  if (r_on) {
+    // All high (but not gray) -> white
+    return hw_white;
+  }
+  // !r_on && !g_on && !b_on
+  // All low (but not gray) -> black
+  return hw_black;
+}
+
 }  // namespace esphome::epaper_spi
@@ -0,0 +1,82 @@
+#include "epaper_spi_4bpp.h"
+
+#include "esphome/core/log.h"
+
+namespace esphome::epaper_spi {
+
+static constexpr const char *const TAG = "epaper_spi.4bpp";
+
+void EPaper4bpp::fill(Color color) {
+  // If clipping is active, fall back to base implementation
+  if (this->get_clipping().is_set()) {
+    EPaperBase::fill(color);
+    return;
+  }
+
+  auto pixel_color = this->color_to_native(color);
+
+  // We store 2 pixels per byte
+  this->buffer_.fill(pixel_color + (pixel_color << 4));
+
+  // Whole buffer just changed; mark the entire canvas dirty.
+  this->x_low_ = 0;
+  this->y_low_ = 0;
+  this->x_high_ = this->width_;
+  this->y_high_ = this->height_;
+}
+
+void EPaper4bpp::clear() {
+  // clear buffer to white, just like real paper.
+  this->fill(COLOR_ON);
+}
+
+void HOT EPaper4bpp::draw_pixel_at(int x, int y, Color color) {
+  if (!this->rotate_coordinates_(x, y))
+    return;
+  auto pixel_bits = this->color_to_native(color);
+  uint32_t pixel_position = x + y * this->get_width_internal();
+  uint32_t byte_position = pixel_position / 2;
+  auto original = this->buffer_[byte_position];
+  if ((pixel_position & 1) != 0) {
+    this->buffer_[byte_position] = (original & 0xF0) | pixel_bits;
+  } else {
+    this->buffer_[byte_position] = (original & 0x0F) | (pixel_bits << 4);
+  }
+}
+
+bool HOT EPaper4bpp::transfer_data() {
+  const uint32_t start_time = App.get_loop_component_start_time();
+  const size_t buffer_length = this->buffer_length_;
+  if (this->current_data_index_ == 0) {
+    this->command(CMD_TRANSFER_DATA);
+  }
+
+  size_t buf_idx = 0;
+  uint8_t bytes_to_send[MAX_TRANSFER_SIZE];
+  while (this->current_data_index_ != buffer_length) {
+    bytes_to_send[buf_idx++] = this->buffer_[this->current_data_index_++];
+
+    if (buf_idx == sizeof bytes_to_send) {
+      this->start_data_();
+      this->write_array(bytes_to_send, buf_idx);
+      this->disable();
+      ESP_LOGV(TAG, "Wrote %d bytes at %ums", buf_idx, (unsigned) millis());
+      buf_idx = 0;
+
+      if (millis() - start_time > MAX_TRANSFER_TIME) {
+        // Let the main loop run and come back next loop
+        return false;
+      }
+    }
+  }
+  // Finished the entire dataset
+  if (buf_idx != 0) {
+    this->start_data_();
+    this->write_array(bytes_to_send, buf_idx);
+    this->disable();
+  }
+  this->current_data_index_ = 0;
+  return true;
+}
+
+}  // namespace esphome::epaper_spi
@@ -0,0 +1,35 @@
+#pragma once
+
+#include "epaper_spi.h"
+
+namespace esphome::epaper_spi {
+
+/**
+ * Intermediate base for panels with a 4-bit-per-pixel native buffer layout (2 pixels per byte).
+ *
+ * Owns buffer sizing, fill()/clear()/draw_pixel_at() and the chunked SPI transfer loop shared by
+ * this family of controllers. Concrete subclasses supply only their RGB -> 4-bit color mapping via
+ * color_to_native() plus their IC-specific power/refresh/sleep command sequences.
+ */
+class EPaper4bpp : public EPaperBase {
+ public:
+  EPaper4bpp(const char *name, uint16_t width, uint16_t height, const uint8_t *init_sequence,
+             size_t init_sequence_length)
+      : EPaperBase(name, width, height, init_sequence, init_sequence_length, DISPLAY_TYPE_COLOR) {
+    this->buffer_length_ = width * height / 2;  // 2 pixels per byte
+  }
+
+  void fill(Color color) override;
+  void clear() override;
+
+ protected:
+  void draw_pixel_at(int x, int y, Color color) override;
+  bool transfer_data() override;
+
+  /// Map an RGB color to this panel's native 4-bit color key (low nibble).
+  virtual uint8_t color_to_native(Color color) = 0;
+
+  static constexpr uint8_t CMD_TRANSFER_DATA = 0x10;
+};
+
+}  // namespace esphome::epaper_spi
@@ -0,0 +1,47 @@
+// Reference: https://github.com/SolderedElectronics/Inkplate-Arduino-library (src/boards/Inkplate6COLOR)
+
+#include "epaper_spi_inkplate6color.h"
+#include "colorconv.h"
+
+#include "esphome/core/log.h"
+
+namespace esphome::epaper_spi {
+
+static constexpr const char *const TAG = "epaper_spi.inkplate6color";
+
+// Native hardware color codes for this panel's 4-bit color values.
+enum Inkplate6ColorHex : uint8_t {
+  BLACK = 0,
+  WHITE = 1,
+  GREEN = 2,
+  BLUE = 3,
+  RED = 4,
+  YELLOW = 5,
+  ORANGE = 6,
+};
+
+uint8_t EPaperInkplate6Color::color_to_native(Color color) {
+  return color_to_bwyrgbo<uint8_t>(color, BLACK, WHITE, YELLOW, RED, GREEN, BLUE, ORANGE);
+}
+
+void EPaperInkplate6Color::power_on() {
+  ESP_LOGV(TAG, "Power on");
+  this->command(0x04);
+}
+
+void EPaperInkplate6Color::power_off() {
+  ESP_LOGV(TAG, "Power off");
+  this->command(0x02);
+}
+
+void EPaperInkplate6Color::refresh_screen(bool partial) {
+  ESP_LOGV(TAG, "Refresh");  // full refresh only; partial is unused
+  this->cmd_data(0x12, {0x00});
+}
+
+void EPaperInkplate6Color::deep_sleep() {
+  ESP_LOGV(TAG, "Deep sleep");
+  this->cmd_data(0x07, {0xA5});
+}
+
+}  // namespace esphome::epaper_spi
@@ -0,0 +1,22 @@
+#pragma once
+
+#include "epaper_spi_4bpp.h"
+
+namespace esphome::epaper_spi {
+
+// Soldered Inkplate 6COLOR: 600x448 7-color (black/white/green/blue/red/yellow/orange) e-paper,
+// UC8159-family controller.
+class EPaperInkplate6Color final : public EPaper4bpp {
+ public:
+  using EPaper4bpp::EPaper4bpp;
+
+ protected:
+  uint8_t color_to_native(Color color) override;
+
+  void refresh_screen(bool partial) override;
+  void power_on() override;
+  void power_off() override;
+  void deep_sleep() override;
+};
+
+}  // namespace esphome::epaper_spi
@@ -1,76 +1,23 @@
 #include "epaper_spi_spectra_e6.h"
-
-#include <algorithm>
+#include "colorconv.h"

 #include "esphome/core/log.h"

 namespace esphome::epaper_spi {
 static constexpr const char *const TAG = "epaper_spi.6c";
-static constexpr unsigned char GRAY_THRESHOLD = 50;

-enum E6Color {
-  BLACK,
-  WHITE,
-  YELLOW,
-  RED,
-  SKIP_1,
-  BLUE,
-  GREEN,
-  CYAN,
-  SKIP_2,
+// Native hardware color codes for this panel's 4-bit color values.
+enum E6Color : uint8_t {
+  BLACK = 0,
+  WHITE = 1,
+  YELLOW = 2,
+  RED = 3,
+  BLUE = 5,
+  GREEN = 6,
 };

-static uint8_t color_to_hex(Color color) {
-  // --- Step 1: Check for Grayscale (Black or White) ---
-  // We define "grayscale" as a color where the min and max components
-  // are close to each other.
-  unsigned char max_rgb = std::max({color.r, color.g, color.b});
-  unsigned char min_rgb = std::min({color.r, color.g, color.b});
-
-  if ((max_rgb - min_rgb) < GRAY_THRESHOLD) {
-    // It's a shade of gray. Map to BLACK or WHITE.
-    // We split the luminance at the halfway point (382 = (255*3)/2)
-    if ((static_cast<int>(color.r) + color.g + color.b) > 382) {
-      return WHITE;
-    }
-    return BLACK;
-  }
-  // --- Step 2: Check for Primary/Secondary Colors ---
-  // If it's not gray, it's a color. We check which components are
-  // "on" (over 128) vs "off". This divides the RGB cube into 8 corners.
-  bool r_on = (color.r > 128);
-  bool g_on = (color.g > 128);
-  bool b_on = (color.b > 128);
-
-  if (r_on && g_on && !b_on) {
-    return YELLOW;
-  }
-  if (r_on && !g_on && !b_on) {
-    return RED;
-  }
-  if (!r_on && g_on && !b_on) {
-    return GREEN;
-  }
-  if (!r_on && !g_on && b_on) {
-    return BLUE;
-  }
-  // Handle "impure" colors (Cyan, Magenta)
-  if (!r_on && g_on && b_on) {
-    // Cyan (G+B) -> Closest is Green or Blue. Pick Green.
-    return GREEN;
-  }
-  if (r_on && !g_on) {
-    // Magenta (R+B) -> Closest is Red or Blue. Pick Red.
-    return RED;
-  }
-  // Handle the remaining corners (White-ish, Black-ish)
-  if (r_on) {
-    // All high (but not gray) -> White
-    return WHITE;
-  }
-  // !r_on && !g_on && !b_on
-  // All low (but not gray) -> Black
-  return BLACK;
+uint8_t EPaperSpectraE6::color_to_native(Color color) {
+  return color_to_bwyrgb<uint8_t>(color, BLACK, WHITE, YELLOW, RED, GREEN, BLUE);
 }

 void EPaperSpectraE6::power_on() {
@@ -92,71 +39,4 @@ void EPaperSpectraE6::deep_sleep() {
  ESP_LOGV(TAG, "Deep sleep");
  this->cmd_data(0x07, {0xA5});
 }
-
-void EPaperSpectraE6::fill(Color color) {
-  // If clipping is active, fall back to base implementation
-  if (this->get_clipping().is_set()) {
-    EPaperBase::fill(color);
-    return;
-  }
-
-  auto pixel_color = color_to_hex(color);
-
-  // We store 2 pixels per byte
-  this->buffer_.fill(pixel_color + (pixel_color << 4));
-}
-
-void EPaperSpectraE6::clear() {
-  // clear buffer to white, just like real paper.
-  this->fill(COLOR_ON);
-}
-
-void HOT EPaperSpectraE6::draw_pixel_at(int x, int y, Color color) {
-  if (!this->rotate_coordinates_(x, y))
-    return;
-  auto pixel_bits = color_to_hex(color);
-  uint32_t pixel_position = x + y * this->get_width_internal();
-  uint32_t byte_position = pixel_position / 2;
-  auto original = this->buffer_[byte_position];
-  if ((pixel_position & 1) != 0) {
-    this->buffer_[byte_position] = (original & 0xF0) | pixel_bits;
-  } else {
-    this->buffer_[byte_position] = (original & 0x0F) | (pixel_bits << 4);
-  }
-}
-
-bool HOT EPaperSpectraE6::transfer_data() {
-  const uint32_t start_time = App.get_loop_component_start_time();
-  const size_t buffer_length = this->buffer_length_;
-  if (this->current_data_index_ == 0) {
-    this->command(0x10);
-  }
-
-  size_t buf_idx = 0;
-  uint8_t bytes_to_send[MAX_TRANSFER_SIZE];
-  while (this->current_data_index_ != buffer_length) {
-    bytes_to_send[buf_idx++] = this->buffer_[this->current_data_index_++];
-
-    if (buf_idx == sizeof bytes_to_send) {
-      this->start_data_();
-      this->write_array(bytes_to_send, buf_idx);
-      this->disable();
-      ESP_LOGV(TAG, "Wrote %d bytes at %ums", buf_idx, (unsigned) millis());
-      buf_idx = 0;
-
-      if (millis() - start_time > MAX_TRANSFER_TIME) {
-        // Let the main loop run and come back next loop
-        return false;
-      }
-    }
-  }
-  // Finished the entire dataset
-  if (buf_idx != 0) {
-    this->start_data_();
-    this->write_array(bytes_to_send, buf_idx);
-    this->disable();
-  }
-  this->current_data_index_ = 0;
-  return true;
-}
 }  // namespace esphome::epaper_spi
@@ -1,28 +1,20 @@
 #pragma once

-#include "epaper_spi.h"
+#include "epaper_spi_4bpp.h"

 namespace esphome::epaper_spi {

-class EPaperSpectraE6 final : public EPaperBase {
+class EPaperSpectraE6 final : public EPaper4bpp {
 public:
-  EPaperSpectraE6(const char *name, uint16_t width, uint16_t height, const uint8_t *init_sequence,
-                  size_t init_sequence_length)
-      : EPaperBase(name, width, height, init_sequence, init_sequence_length, DISPLAY_TYPE_COLOR) {
-    this->buffer_length_ = width * height / 2;  // 2 pixels per byte
-  }
-
-  void fill(Color color) override;
-  void clear() override;
+  using EPaper4bpp::EPaper4bpp;

 protected:
+  uint8_t color_to_native(Color color) override;
+
  void refresh_screen(bool partial) override;
  void power_on() override;
  void power_off() override;
  void deep_sleep() override;
-  void draw_pixel_at(int x, int y, Color color) override;
-
-  bool transfer_data() override;
 };

 }  // namespace esphome::epaper_spi
@@ -311,9 +311,12 @@ bool HOT EPaperT133A01::transfer_data() {
      this->current_data_index_ = half;

      if (millis() - start_time > MAX_TRANSFER_TIME) {
-        return false;
+        break;
      }
    }
+    if (half < total_rows) {
+      return false;
+    }
    ESP_LOGD(TAG, "CS phase done");
    this->disable();
    this->cs_pin_->digital_write(true);  // deselect CS
@@ -346,9 +349,12 @@ bool HOT EPaperT133A01::transfer_data() {
      this->current_data_index_ = half;

      if (millis() - start_time > MAX_TRANSFER_TIME) {
-        return false;
+        break;
      }
    }
+    if (half < total_rows * 2) {
+      return false;
+    }
    ESP_LOGD(TAG, "CS1 phase done");
    this->disable();
    this->cs1_pin_->digital_write(true);  // deselect CS1
@@ -15,7 +15,7 @@ class EpaperModel:
        self,
        name: str,
        class_name: str,
-        initsequence=None,
+        initsequence=(),
        **defaults,
    ):
        name = name.upper()
@@ -0,0 +1,57 @@
+# Reference: https://github.com/SolderedElectronics/Inkplate-Arduino-library (src/boards/Inkplate6COLOR)
+
+from esphome.components.mipi import delay
+
+from . import EpaperModel
+
+
+class Inkplate6ColorModel(EpaperModel):
+    def __init__(self, name, class_name="EPaperInkplate6Color", **kwargs):
+        super().__init__(name, class_name, **kwargs)
+
+    # fmt: off
+    def get_init_sequence(self, config: dict):
+        width, height = self.get_dimensions(config)
+        return (
+            (0x00, 0xEF, 0x08,),  # panel setting
+            (0x01, 0x37, 0x00, 0x05, 0x05,),  # power setting
+            (0x03, 0x00,),  # power off sequence setting
+            (0x06, 0xC7, 0xC7, 0x1D,),  # booster soft start
+            (0x41, 0x00,),  # temperature sensor enable
+            (0x50, 0x37,),  # VCOM and data interval
+            (0x60, 0x20,),  # TCON setting
+            (0x61, width // 256, width % 256, height // 256, height % 256,),  # resolution set
+            (0xE3, 0xAA,),  # power saving
+            delay(100),
+            (0x50, 0x37,),  # VCOM and data interval, resent once the power-saving setting settles
+        )
+
+
+# Native orientation is landscape (600x448).
+inkplate6color = Inkplate6ColorModel(
+    "inkplate6color",
+    width=600,
+    height=448,
+    # Vendor library drives the panel at 2MHz; the controller doesn't reliably support faster rates.
+    data_rate="2MHz",
+    # Vendor library waits 200ms after releasing reset before talking to the panel.
+    reset_duration="200ms",
+    # A full 7-color refresh takes tens of seconds; disallow faster updates to avoid FSM update loops.
+    minimum_update_interval="30s",
+    # Panel's native buffer orientation is rotated 180 degrees relative to the logical
+    # rotation=0 orientation; confirmed on real hardware.
+    mirror_x=True,
+    mirror_y=True,
+    # Default GPIO pins for the on-board Inkplate 6COLOR wiring.
+    reset_pin=19,
+    dc_pin=33,
+    cs_pin=27,
+    busy_pin={
+        "number": 32,
+        "inverted": True,  # hardware: LOW=busy, HIGH=idle
+        "mode": {
+            "input": True,
+            "pullup": True,
+        },
+    },
+)
@@ -119,6 +119,7 @@ CONF_SIGNING_SCHEME = "signing_scheme"
 CONF_SRAM1_AS_IRAM = "sram1_as_iram"
 CONF_SUBTYPE = "subtype"
 CONF_VERIFICATION_KEY = "verification_key"
+CONF_VERIFICATION_KEYS = "verification_keys"

 ARDUINO_FRAMEWORK_NAME = "framework-arduinoespressif32"
 ARDUINO_FRAMEWORK_PKG = f"pioarduino/{ARDUINO_FRAMEWORK_NAME}"
@@ -141,12 +142,22 @@ ASSERTION_LEVELS = {
    "SILENT": "CONFIG_COMPILER_OPTIMIZATION_ASSERTIONS_SILENT",
 }

+SIGNING_SCHEME_RSA3072 = "rsa3072"
+SIGNING_SCHEME_ECDSA256 = "ecdsa256"
+SIGNING_SCHEME_ECDSA_V1 = "ecdsa_v1"
+
 SIGNING_SCHEMES = {
-    "rsa3072": "CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME",
-    "ecdsa256": "CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME",
-    "ecdsa_v1": "CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME",
+    SIGNING_SCHEME_RSA3072: "CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME",
+    SIGNING_SCHEME_ECDSA256: "CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME",
+    SIGNING_SCHEME_ECDSA_V1: "CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME",
 }

+# A Secure Boot v2 image carries at most three signature blocks, and hardware
+# secure boot exposes three eFuse key slots. The trusted-key list isn't bound by
+# the per-image limit (an incoming image need only match one trusted key), but
+# cap it at three to mirror those hardware limits.
+SIGNED_OTA_MAX_KEYS = 3
+
 # Chip variants that only support one V2 signing scheme.
 # Based on SOC_SECURE_BOOT_V2_RSA / SOC_SECURE_BOOT_V2_ECC in soc_caps.h.
 # Variants not listed in either set support both RSA and ECDSA V2
@@ -628,7 +639,6 @@ class NetworkSdkconfigData:
    wifi_ap: bool = False  # WiFi AP mode configured
    ethernet: bool = False  # Ethernet component active
    bluetooth: bool = False  # any BLE component active
-    ble_42: bool = False  # BLE 4.2 features needed
    software_coexistence: bool = False  # WiFi/BT software coexistence requested
    # esp32 advanced enable_lwip_dhcp_server option (True/False/None=unset)
    enable_lwip_dhcp_server: bool | None = None
@@ -654,12 +664,10 @@ def request_ethernet() -> None:
    _network_sdkconfig().ethernet = True


-def request_bluetooth(ble_42: bool = False) -> None:
-    """Request the Bluetooth controller. Pass ble_42=True for 4.2 features."""
+def request_bluetooth() -> None:
+    """Request the Bluetooth controller."""
    net = _network_sdkconfig()
    net.bluetooth = True
-    if ble_42:
-        net.ble_42 = True


 def request_software_coexistence() -> None:
@@ -814,14 +822,15 @@ def _is_framework_url(source: str) -> bool:
 # The default/recommended arduino framework version
 #  - https://github.com/espressif/arduino-esp32/releases
 ARDUINO_FRAMEWORK_VERSION_LOOKUP = {
-    "recommended": cv.Version(3, 3, 10),
-    "latest": cv.Version(3, 3, 10),
-    "dev": cv.Version(3, 3, 10),
+    "recommended": cv.Version(3, 3, 11),
+    "latest": cv.Version(3, 3, 11),
+    "dev": cv.Version(3, 3, 11),
 }
 ARDUINO_PLATFORM_VERSION_LOOKUP = {
    cv.Version(
        4, 0, 0, "alpha1"
    ): "https://github.com/pioarduino/platform-espressif32.git#prep_IDF6",
+    cv.Version(3, 3, 11): cv.Version(55, 3, 311),
    cv.Version(3, 3, 10): cv.Version(55, 3, 39),
    cv.Version(3, 3, 9): cv.Version(55, 3, 39),
    cv.Version(3, 3, 8): cv.Version(55, 3, 38, "1"),
@@ -845,6 +854,7 @@ ARDUINO_PLATFORM_VERSION_LOOKUP = {
 # See: https://github.com/pioarduino/esp-idf/releases
 ARDUINO_IDF_VERSION_LOOKUP = {
    cv.Version(4, 0, 0, "alpha1"): cv.Version(6, 0, 1),
+    cv.Version(3, 3, 11): cv.Version(5, 5, 5),
    cv.Version(3, 3, 10): cv.Version(5, 5, 5),
    cv.Version(3, 3, 9): cv.Version(5, 5, 4),
    cv.Version(3, 3, 8): cv.Version(5, 5, 4),
@@ -879,7 +889,7 @@ ESP_IDF_PLATFORM_VERSION_LOOKUP = {
    cv.Version(
        6, 0, 0
    ): "https://github.com/pioarduino/platform-espressif32.git#prep_IDF6",
-    cv.Version(5, 5, 5): cv.Version(55, 3, 39),
+    cv.Version(5, 5, 5): cv.Version(55, 3, 311),
    cv.Version(5, 5, 4): cv.Version(55, 3, 39),
    cv.Version(5, 5, 3, "1"): cv.Version(55, 3, 37),
    cv.Version(5, 5, 3): cv.Version(55, 3, 37),
@@ -900,8 +910,8 @@ ESP_IDF_PLATFORM_VERSION_LOOKUP = {
 # The platform-espressif32 version
 #  - https://github.com/pioarduino/platform-espressif32/releases
 PLATFORM_VERSION_LOOKUP = {
-    "recommended": cv.Version(55, 3, 39),
-    "latest": cv.Version(55, 3, 39),
+    "recommended": cv.Version(55, 3, 311),
+    "latest": cv.Version(55, 3, 311),
    "dev": "https://github.com/pioarduino/platform-espressif32.git#develop",
 }

@@ -1029,7 +1039,9 @@ def _check_esp_idf_versions(config: ConfigType) -> ConfigType:


 def _validate_toolchain(value) -> Toolchain:
-    return Toolchain(cv.one_of(*(t.value for t in Toolchain), lower=True)(value))
+    return Toolchain(
+        cv.one_of(Toolchain.PLATFORMIO, Toolchain.ESP_IDF, lower=True)(value)
+    )


 def _resolve_toolchain(value: ConfigType) -> ConfigType:
@@ -1163,11 +1175,99 @@ def _ota_downgrade_protection_errors(
    return errs


+def _sbv2_rsa_key_digest(path: Path) -> bytes:
+    """SHA-256 of a public key's Secure Boot v2 signature-block key region.
+
+    This hashes the 776-byte {n, e, rinv, m'} region exactly as the ROM lays it
+    out -- i.e. the value the device computes per signature block and the one
+    ``espsecure digest-sbv2-public-key`` prints, not a hash of the DER key.
+    """
+    import hashlib
+    import struct
+
+    from cryptography.exceptions import UnsupportedAlgorithm
+    from cryptography.hazmat.primitives.asymmetric import rsa
+    from cryptography.hazmat.primitives.serialization import (
+        load_pem_private_key,
+        load_pem_public_key,
+    )
+
+    data = path.read_bytes()
+    try:
+        if b"PUBLIC KEY" in data:
+            public_key = load_pem_public_key(data)
+        else:
+            # verification_keys only needs the public half; warn so the private
+            # key doesn't end up committed alongside the config.
+            _LOGGER.warning(
+                "'%s' is a private key, but '%s' needs only the public key. Use a "
+                "public-key PEM or the 64-hex digest (espsecure "
+                "digest-sbv2-public-key) so the private key stays out of your config.",
+                path,
+                CONF_VERIFICATION_KEYS,
+            )
+            public_key = load_pem_private_key(data, password=None).public_key()
+    except (ValueError, TypeError, UnsupportedAlgorithm) as err:
+        raise cv.Invalid(f"Could not load key '{path}': {err}") from err
+    if not isinstance(public_key, rsa.RSAPublicKey) or public_key.key_size != 3072:
+        raise cv.Invalid(
+            f"'{CONF_VERIFICATION_KEYS}' entries must be RSA-3072 keys; "
+            f"'{path}' is not."
+        )
+    numbers = public_key.public_numbers()
+    n, e = numbers.n, numbers.e
+    m = (-pow(n, -1, 1 << 32)) & 0xFFFFFFFF
+    rinv = (1 << (public_key.key_size * 2)) % n
+    blob = struct.pack(
+        "<384sI384sI",
+        n.to_bytes(384, "big")[::-1],
+        e,
+        rinv.to_bytes(384, "big")[::-1],
+        m,
+    )
+    return hashlib.sha256(blob).digest()
+
+
+def _validate_trusted_key(value: Any) -> str:
+    """Normalize a trusted key to its 64-hex-char signature-block digest.
+
+    Accepts either the digest directly (so CI can inject it without shipping a
+    key file) or a PEM key file whose digest is computed here. Typed ``Any``
+    because YAML hands validators the parsed value -- e.g. an unquoted ``0x...``
+    digest arrives as an int, which the guard below rejects with advice to quote.
+    """
+    # An unquoted 0x... or all-digit digest is parsed by YAML as an int before it
+    # reaches here, so it never looks like a string digest -- reject it clearly
+    # rather than letting it fall through to cv.file_ as a bogus path.
+    if not isinstance(value, str):
+        raise cv.Invalid(
+            f"Expected a key file path or a 64-character hex digest, got {value!r}. "
+            f"Quote the digest so YAML keeps it as text (an unquoted '0x...' or "
+            f"all-digit value is parsed as a number)."
+        )
+    stripped = value.strip()
+    if re.fullmatch(r"[0-9A-Fa-f]{64}", stripped):
+        return stripped.lower()
+    # An all-hex value that isn't exactly 64 chars is a mangled digest, not a
+    # path: a truncated or 0x-prefixed CI variable would otherwise fall through
+    # and fail as "file not found", pointing at the wrong problem.
+    if re.fullmatch(r"(?:0x)?[0-9A-Fa-f]+", stripped):
+        raise cv.Invalid(
+            f"'{stripped}' looks like a key digest but must be exactly 64 hex "
+            f"characters (a SHA-256, no '0x' prefix); check for truncation."
+        )
+    return _sbv2_rsa_key_digest(cv.file_(value)).hex()
+
+
 _SIGNED_OTA_VERIFICATION_SCHEMA = cv.Schema(
    {
        cv.Optional(CONF_SIGNING_KEY): cv.file_,
        cv.Optional(CONF_VERIFICATION_KEY): cv.file_,
-        cv.Optional(CONF_SIGNING_SCHEME, default="rsa3072"): cv.one_of(
+        cv.Optional(CONF_VERIFICATION_KEYS): cv.All(
+            cv.ensure_list(_validate_trusted_key),
+            cv.Length(min=1, max=SIGNED_OTA_MAX_KEYS),
+        ),
+        cv.Optional(CONF_SIGNING_SCHEME, default=SIGNING_SCHEME_RSA3072): cv.one_of(
            *SIGNING_SCHEMES, lower=True
        ),
    }
@@ -1200,9 +1300,15 @@ def _validate_signed_ota_keys(config: ConfigType) -> ConfigType:
    block appended to each image, so verifying externally-signed binaries
    needs no key in the config at all -- omitting both keys selects that
    external-signing mode.
+
+    For external RSA (rsa3072, no signing key), an optional 'verification_keys'
+    list names the keys the running app trusts. ESPHome then verifies OTA
+    signatures against that compiled-in set instead of IDF's single-block
+    check, which enables key rotation and multi-provider backup keys.
    """
    has_signing_key = CONF_SIGNING_KEY in config
    has_verification_key = CONF_VERIFICATION_KEY in config
+    has_verification_keys = CONF_VERIFICATION_KEYS in config
    scheme = config[CONF_SIGNING_SCHEME]
    if has_signing_key and has_verification_key:
        raise cv.Invalid(
@@ -1210,7 +1316,35 @@ def _validate_signed_ota_keys(config: ConfigType) -> ConfigType:
            f"'{CONF_VERIFICATION_KEY}', not both.",
            path=[CONF_VERIFICATION_KEY],
        )
-    if scheme == "ecdsa_v1":
+    if has_verification_keys:
+        if scheme != SIGNING_SCHEME_RSA3072:
+            raise cv.Invalid(
+                f"'{CONF_VERIFICATION_KEYS}' is only used with signing scheme "
+                f"'rsa3072' (externally-signed RSA images). With '{scheme}' the "
+                f"public key travels in each image's signature block.",
+                path=[CONF_VERIFICATION_KEYS],
+            )
+        if has_signing_key:
+            raise cv.Invalid(
+                f"'{CONF_VERIFICATION_KEYS}' verifies externally-signed images "
+                f"and cannot be combined with '{CONF_SIGNING_KEY}' (which signs "
+                f"during the build). Provide one or the other.",
+                path=[CONF_VERIFICATION_KEYS],
+            )
+        if has_verification_key:
+            raise cv.Invalid(
+                f"Provide at most one of '{CONF_VERIFICATION_KEY}' and "
+                f"'{CONF_VERIFICATION_KEYS}', not both.",
+                path=[CONF_VERIFICATION_KEYS],
+            )
+        keys = config[CONF_VERIFICATION_KEYS]
+        if len(set(keys)) != len(keys):
+            raise cv.Invalid(
+                f"'{CONF_VERIFICATION_KEYS}' entries must be unique (duplicate "
+                f"keys add nothing and waste a trusted-set slot).",
+                path=[CONF_VERIFICATION_KEYS],
+            )
+    if scheme == SIGNING_SCHEME_ECDSA_V1:
        if not has_signing_key and not has_verification_key:
            raise cv.Invalid(
                f"Signing scheme 'ecdsa_v1' requires either '{CONF_SIGNING_KEY}' "
@@ -1237,6 +1371,13 @@ def final_validate(config):

    from .gpio import final_validate_pins

+    # Remove before 2027.2.0
+    if CORE.using_toolchain_platformio:
+        _LOGGER.warning(
+            "The 'platformio' toolchain for ESP32 is deprecated and will be removed "
+            "in ESPHome 2027.2.0. Please use 'toolchain: esp-idf' instead."
+        )
+
    errs = []
    conf_fw = config[CONF_FRAMEWORK]
    advanced = conf_fw[CONF_ADVANCED]
@@ -1359,7 +1500,10 @@ def final_validate(config):
        ]

        # V1 ECDSA is only available on the original ESP32
-        if scheme == "ecdsa_v1" and variant not in SIGNED_OTA_V1_ECDSA_VARIANTS:
+        if (
+            scheme == SIGNING_SCHEME_ECDSA_V1
+            and variant not in SIGNED_OTA_V1_ECDSA_VARIANTS
+        ):
            errs.append(
                cv.Invalid(
                    f"Signing scheme 'ecdsa_v1' is only supported on "
@@ -1372,7 +1516,9 @@ def final_validate(config):
            # On ESP32, V2 RSA requires minimum_chip_revision >= 3.0
            # Note: string comparison works here because cv.one_of constrains
            # min_rev to known ESP32_CHIP_REVISIONS values ("0.0".."3.1").
-            if scheme == "rsa3072" and (min_rev is None or min_rev < "3.0"):
+            if scheme == SIGNING_SCHEME_RSA3072 and (
+                min_rev is None or min_rev < "3.0"
+            ):
                errs.append(
                    cv.Invalid(
                        f"Signing scheme 'rsa3072' on {VARIANT_FRIENDLY[variant]} "
@@ -1383,7 +1529,7 @@ def final_validate(config):
                    )
                )
            # ESP32 does not support V2 ECDSA (no SOC_SECURE_BOOT_V2_ECC)
-            elif scheme == "ecdsa256":
+            elif scheme == SIGNING_SCHEME_ECDSA256:
                errs.append(
                    cv.Invalid(
                        f"Signing scheme 'ecdsa256' is not supported on "
@@ -1393,7 +1539,11 @@ def final_validate(config):
                    )
                )
            # V1 on rev 3.0+ -- suggest V2 RSA for stronger security
-            elif scheme == "ecdsa_v1" and min_rev is not None and min_rev >= "3.0":
+            elif (
+                scheme == SIGNING_SCHEME_ECDSA_V1
+                and min_rev is not None
+                and min_rev >= "3.0"
+            ):
                _LOGGER.info(
                    "Using Secure Boot V1 ECDSA on %s rev %s. "
                    "Consider using 'rsa3072' (Secure Boot V2 RSA) for "
@@ -1404,8 +1554,14 @@ def final_validate(config):
        else:
            # Non-ESP32 variants: check V2 scheme-variant compatibility
            scheme_variant_conflicts = {
-                "ecdsa256": (SIGNED_OTA_V2_RSA_ONLY_VARIANTS, "rsa3072"),
-                "rsa3072": (SIGNED_OTA_V2_ECC_ONLY_VARIANTS, "ecdsa256"),
+                SIGNING_SCHEME_ECDSA256: (
+                    SIGNED_OTA_V2_RSA_ONLY_VARIANTS,
+                    SIGNING_SCHEME_RSA3072,
+                ),
+                SIGNING_SCHEME_RSA3072: (
+                    SIGNED_OTA_V2_ECC_ONLY_VARIANTS,
+                    SIGNING_SCHEME_ECDSA256,
+                ),
            }
            if (
                conflict := scheme_variant_conflicts.get(scheme)
@@ -2044,12 +2200,12 @@ async def _reconcile_network_sdkconfig() -> None:
        if name not in opts:
            add_idf_sdkconfig_option(name, value)

-    # Bluetooth: only ever enable when requested. The IDF default is off and
-    # nothing sets these False today, so never write False here.
+    # Bluetooth: only ever enable when requested. The IDF default is off.
+    # According to the IDF docs, only one of 4.2 or 5.0 should be enabled.
    if net.bluetooth:
        set_opt("CONFIG_BT_ENABLED", True)
-        if net.ble_42:
-            set_opt("CONFIG_BT_BLE_42_FEATURES_SUPPORTED", True)
+        set_opt("CONFIG_BT_BLE_42_FEATURES_SUPPORTED", True)
+        set_opt("CONFIG_BT_BLE_50_FEATURES_SUPPORTED", False)

    # WiFi stack: disable only when Ethernet is present and WiFi is not. WiFi
    # relies on the IDF default (enabled), so it is never written True here.
@@ -2182,6 +2338,8 @@ async def to_code(config):
    cg.set_cpp_standard("gnu++20")
    cg.add_build_flag("-DUSE_ESP32")
    cg.add_define("USE_NATIVE_64BIT_TIME")
+    # NVS finds stored preferences by key, so preference key migration is possible
+    cg.add_define("USE_PREFERENCE_KEY_LOOKUP")
    cg.add_build_flag("-Wl,-z,noexecstack")
    # Deferred so KEY_COMPONENTS is fully populated -- see the coroutine.
    CORE.add_job(_finalize_arduino_aware_flags)
@@ -2546,9 +2704,70 @@ async def to_code(config):
    # Enable signed app verification without hardware secure boot
    if signed_ota := advanced.get(CONF_SIGNED_OTA_VERIFICATION):
        add_idf_sdkconfig_option("CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT", True)
-        add_idf_sdkconfig_option("CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT", True)

        scheme = signed_ota[CONF_SIGNING_SCHEME]
+        # For externally-signed RSA images with a declared 'verification_keys'
+        # list, ESPHome verifies the OTA signature itself instead of using IDF's
+        # on-update check. IDF only matches the incoming image's first signature
+        # block against the running app's first, which blocks key rotation and
+        # multi-provider backup keys; ESPHome accepts an image signed by any key
+        # in the compiled-in trusted set. Without 'verification_keys' there is no
+        # trust anchor, so fall back to IDF's built-in check.
+        # The build still produces the padded unsigned image (via SECURE_
+        # SIGNED_APPS_NO_SECURE_BOOT above); only the on-update check moves.
+        # SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT defaults to y under
+        # SECURE_SIGNED_APPS_NO_SECURE_BOOT, so it must be set explicitly:
+        # False to hand verification to ESPHome, True to keep IDF's check.
+        # Setting it False also drives the hidden CONFIG_SECURE_SIGNED_APPS to
+        # n; the 4 KiB padding and reserved signature sector the verifier
+        # depends on survive only because --secure-pad-v2 keys off
+        # CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME (set below), not that symbol.
+        external_rsa = (
+            scheme == SIGNING_SCHEME_RSA3072 and CONF_SIGNING_KEY not in signed_ota
+        )
+        verification_keys = signed_ota.get(CONF_VERIFICATION_KEYS)
+        # verification_keys is accepted only for external RSA (rsa3072 with no
+        # signing_key), enforced in _validate_signed_ota_keys. Assert the
+        # post-condition so validator/codegen drift fails the build loudly
+        # instead of silently dropping the declared trust anchor and downgrading
+        # to IDF's single-block check.
+        assert not verification_keys or external_rsa
+        multi_key = external_rsa and verification_keys
+        # Turning IDF's on-update check off is global -- it also drops the
+        # signature check from esp_ota_set_boot_partition() on the partition-table
+        # path and safe_mode's recovery rollback. Both deliberately select an
+        # already-installed image (or an MD5-checked partition table), not a
+        # freshly-downloaded one, so ESPHome's verifier only needs to cover the
+        # app and bootloader OTA paths, where a new image is actually written.
+        add_idf_sdkconfig_option(
+            "CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT", not multi_key
+        )
+        if multi_key:
+            cg.add_define("USE_OTA_SIGNED_VERIFICATION_MULTI_KEY")
+            # Compile the trusted key digests in as the immutable trust anchor.
+            # Each is the SHA-256 of a key's signature-block region; the verifier
+            # accepts an OTA whose signature block matches one of these.
+            digests = [bytes.fromhex(k) for k in verification_keys]
+            # Echo the resolved digests so a stale or mistyped key (which builds
+            # cleanly but leaves the device updatable only by serial reflash) is
+            # visible in the build log.
+            _LOGGER.info(
+                "Signed OTA verification trusts %d key digest(s): %s",
+                len(digests),
+                ", ".join(d.hex() for d in digests),
+            )
+            cg.add_define("OTA_TRUSTED_KEY_COUNT", len(digests))
+            cg.add_define(
+                "OTA_TRUSTED_KEY_DIGESTS",
+                cg.RawExpression(
+                    "{"
+                    + ",".join(
+                        "{" + ",".join(f"0x{b:02x}" for b in d) + "}" for d in digests
+                    )
+                    + "}"
+                ),
+            )
+
        for key, flag in SIGNING_SCHEMES.items():
            add_idf_sdkconfig_option(flag, scheme == key)

@@ -1,9 +1,22 @@
 import esphome.codegen as cg

-KEY_ESP32 = "esp32"
+# Re-exported for the many esp32-side users; defined in esphome.const
+# and esphome.espidf so the upload/logs fast path can use them without
+# importing this package.
+from esphome.const import (  # noqa: F401  # pylint: disable=unused-import
+    KEY_ESP32,
+    KEY_FLASH_SIZE,
+    KEY_IDF_VERSION,
+    KEY_VARIANT,
+)
+
+# Back compat for external components only; in-tree callers import it
+# from esphome.espidf directly.
+from esphome.espidf import (  # noqa: F401  # pylint: disable=unused-import
+    variant_to_idf_target,
+)
+
 KEY_BOARD = "board"
-KEY_FLASH_SIZE = "flash_size"
-KEY_VARIANT = "variant"
 KEY_SDKCONFIG_OPTIONS = "sdkconfig_options"
 KEY_COMPONENTS = "components"
 KEY_EXCLUDE_COMPONENTS = "exclude_components"
@@ -15,7 +28,6 @@ KEY_PATH = "path"
 KEY_SUBMODULES = "submodules"
 KEY_EXTRA_BUILD_FILES = "extra_build_files"
 KEY_FULL_CERT_BUNDLE = "full_cert_bundle"
-KEY_IDF_VERSION = "idf_version"
 KEY_NETWORK_SDKCONFIG = "network_sdkconfig"

 VARIANT_ESP32 = "ESP32"
@@ -64,9 +76,4 @@ VARIANT_FRIENDLY = {
 }


-def variant_to_idf_target(variant: str) -> str:
-    """Map an esp32 variant name (e.g. "ESP32S3") to its ESP-IDF target name."""
-    return variant.lower().replace("-", "")
-
-
 esp32_ns = cg.esphome_ns.namespace("esp32")
@@ -4,6 +4,7 @@
 #ifdef USE_ESP32_CRASH_HANDLER

 #include "crash_handler.h"
+#include "esphome/core/build_info_data.h"
 #include "esphome/core/log.h"

 #include <cinttypes>
@@ -122,7 +123,7 @@ static uint8_t IRAM_ATTR capture_riscv_backtrace(RvExcFrame *frame, uint32_t *ou
 // Magic is second to validate the data. Remaining fields can change between versions.
 // Version is uint32_t because it would be padded to 4 bytes anyway before the next
 // uint32_t field, so we use the full width rather than wasting 3 bytes of padding.
-static constexpr uint32_t CRASH_DATA_VERSION = 3;
+static constexpr uint32_t CRASH_DATA_VERSION = 4;
 struct RawCrashData {
  uint32_t version;
  uint32_t magic;
@@ -134,6 +135,7 @@ struct RawCrashData {
  uint32_t backtrace[MAX_BACKTRACE];
  uint32_t cause;       // Architecture-specific: exccause (Xtensa) or mcause (RISC-V)
  uint32_t fault_addr;  // Faulting memory address: excvaddr (Xtensa) or mtval (RISC-V)
+  uint32_t build_time;  // ESPHOME_BUILD_TIME of the firmware that captured this record
  uint8_t crashed_core;
 #if SOC_CPU_CORES_NUM > 1
  static_assert(SOC_CPU_CORES_NUM == 2, "Dual-core logic assumes exactly 2 cores");
@@ -152,6 +154,16 @@ namespace esphome::esp32 {

 static const char *const TAG = "esp32.crash";

+// RAM copy of the build timestamp. The generated constant lives in flash,
+// which the panic handler must not read (cache may be disabled during
+// cache-error panics), so the wrapper stamps the record from this mirror
+// instead. Filled during C++ dynamic initialization, well before arch_init();
+// ESPHOME_BUILD_TIME itself is constant-initialized, so the read is ordered.
+// Unqualified name on purpose: the runtime header declares it in namespace
+// esphome, while the static-analysis stub defines it as a macro.
+// NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables)
+static uint32_t s_current_build_time = static_cast<uint32_t>(ESPHOME_BUILD_TIME);
+
 void crash_handler_read_and_clear() {
  if (s_raw_crash_data.magic == CRASH_MAGIC && s_raw_crash_data.version == CRASH_DATA_VERSION) {
    s_crash_data_valid = true;
@@ -331,6 +343,66 @@ static int append_addrs_to_hint(char *buf, int size, int pos, const uint32_t *ad
  return pos;
 }

+// Register holding the faulting memory address, named as in ESP-IDF's live
+// register dump. The lowercase form is for old-build reports, where the
+// stacktrace decoders must not match the line.
+#if CONFIG_IDF_TARGET_ARCH_XTENSA
+static const char *const FAULT_ADDR_REG = "EXCVADDR";
+static const char *const FAULT_ADDR_REG_LOWER = "excvaddr";
+#elif CONFIG_IDF_TARGET_ARCH_RISCV
+static const char *const FAULT_ADDR_REG = "MTVAL";
+static const char *const FAULT_ADDR_REG_LOWER = "mtval";
+#endif
+
+// Whether the fault address is meaningful — real CPU faults only, not
+// aborts/watchdogs or SoC-level pseudo exceptions.
+static bool has_fault_addr() {
+  return s_raw_crash_data.exception == PANIC_EXCEPTION_FAULT && !s_raw_crash_data.pseudo_excause;
+}
+
+// Append both cores' backtrace addresses to buf; returns the new position.
+static int append_all_backtraces(char *buf, int size, int pos) {
+  pos = append_addrs_to_hint(buf, size, pos, s_raw_crash_data.backtrace, s_raw_crash_data.backtrace_count,
+                             s_raw_crash_data.reg_frame_count);
+#if SOC_CPU_CORES_NUM > 1
+  pos = append_addrs_to_hint(buf, size, pos, s_raw_crash_data.other_backtrace, s_raw_crash_data.other_backtrace_count,
+                             s_raw_crash_data.other_reg_frame_count);
+#endif
+  return pos;
+}
+
+// The record was captured by a different firmware build (it survives soft
+// resets, including the OTA reboot), so symbolizing its addresses against the
+// current ELF would produce misleading symbols. Print them with lowercase
+// labels the stacktrace decoders deliberately do not match, and skip the
+// addr2line hint. One line per address so nothing is lost to a shared buffer.
+// No is_return_addr() filtering here: it would inspect the current build's
+// code bytes, which say nothing about addresses captured by the old build.
+static uint8_t log_foreign_backtrace(const uint32_t *addrs, uint8_t count, uint8_t bt_num) {
+  for (uint8_t i = 0; i < count; i++) {
+    ESP_LOGE(TAG, "  bt%d: 0x%08" PRIX32, bt_num++, addrs[i]);
+  }
+  return bt_num;
+}
+
+static void log_foreign_addresses() {
+  ESP_LOGE(TAG, "  Captured by a different firmware build; addresses belong to that build's ELF");
+  ESP_LOGE(TAG, "  pc: 0x%08" PRIX32, s_raw_crash_data.pc);
+  if (has_fault_addr()) {
+    ESP_LOGE(TAG, "  %s: 0x%08" PRIX32, FAULT_ADDR_REG_LOWER, s_raw_crash_data.fault_addr);
+  }
+  uint8_t bt_num = log_foreign_backtrace(s_raw_crash_data.backtrace, s_raw_crash_data.backtrace_count, 0);
+#if SOC_CPU_CORES_NUM > 1
+  if (s_raw_crash_data.other_backtrace_count > 0) {
+    // Lowercase like the address labels: carries no address, matches no decoder.
+    ESP_LOGE(TAG, "  other core (%d):", 1 - s_raw_crash_data.crashed_core);
+    log_foreign_backtrace(s_raw_crash_data.other_backtrace, s_raw_crash_data.other_backtrace_count, bt_num);
+  }
+#else
+  (void) bt_num;  // Single-core targets have no second list to continue numbering into.
+#endif
+}
+
 // Intentionally uses separate ESP_LOGE calls per line instead of combining into
 // one multi-line log message. This ensures each address appears as its own line
 // on the serial console, making it possible to see partial output if the device
@@ -348,18 +420,17 @@ void crash_handler_log() {
    ESP_LOGE(TAG, "  Reason: %s", get_exception_type());
  }
  ESP_LOGE(TAG, "  Crashed core: %d", s_raw_crash_data.crashed_core);
+  if (s_raw_crash_data.build_time != s_current_build_time) {
+    // Captured by a different firmware build: the record survives soft resets
+    // including the OTA reboot, so its addresses belong to a previous ELF.
+    log_foreign_addresses();
+    return;
+  }
  ESP_LOGE(TAG, "  PC:  0x%08" PRIX32 "  (fault location)", s_raw_crash_data.pc);
-  // Faulting memory address — only meaningful for real CPU faults, not
-  // aborts/watchdogs or SoC-level pseudo exceptions. Uses the same register
-  // name as ESP-IDF's live register dump for the architecture (EXCVADDR on
-  // Xtensa, MTVAL on RISC-V) so the CLI decodes it when it happens to be a
-  // code address.
-  if (s_raw_crash_data.exception == PANIC_EXCEPTION_FAULT && !s_raw_crash_data.pseudo_excause) {
-#if CONFIG_IDF_TARGET_ARCH_XTENSA
-    ESP_LOGE(TAG, "  EXCVADDR: 0x%08" PRIX32 "  (faulting address)", s_raw_crash_data.fault_addr);
-#elif CONFIG_IDF_TARGET_ARCH_RISCV
-    ESP_LOGE(TAG, "  MTVAL: 0x%08" PRIX32 "  (faulting address)", s_raw_crash_data.fault_addr);
-#endif
+  // Uses the same register name as ESP-IDF's live register dump so the CLI
+  // decodes the address when it happens to be a code address.
+  if (has_fault_addr()) {
+    ESP_LOGE(TAG, "  %s: 0x%08" PRIX32 "  (faulting address)", FAULT_ADDR_REG, s_raw_crash_data.fault_addr);
  }
  log_backtrace(s_raw_crash_data.backtrace, s_raw_crash_data.backtrace_count, s_raw_crash_data.reg_frame_count);

@@ -375,14 +446,7 @@ void crash_handler_log() {
  // Build addr2line hint with all captured addresses for easy copy-paste
  char hint[256];
  int pos = snprintf(hint, sizeof(hint), "Use: addr2line -pfiaC -e firmware.elf 0x%08" PRIX32, s_raw_crash_data.pc);
-  pos = append_addrs_to_hint(hint, sizeof(hint), pos, s_raw_crash_data.backtrace, s_raw_crash_data.backtrace_count,
-                             s_raw_crash_data.reg_frame_count);
-#if SOC_CPU_CORES_NUM > 1
-  append_addrs_to_hint(hint, sizeof(hint), pos, s_raw_crash_data.other_backtrace,
-                       s_raw_crash_data.other_backtrace_count, s_raw_crash_data.other_reg_frame_count);
-#else
-  (void) pos;  // There is no second-core append on single-core targets, so pos would otherwise be unread.
-#endif
+  append_all_backtraces(hint, sizeof(hint), pos);
  ESP_LOGE(TAG, "%s", hint);
 }

@@ -408,6 +472,11 @@ void IRAM_ATTR __wrap_esp_panic_handler(panic_info_t *info) {
  // Zero unconditionally so a null frame doesn't leave stale .noinit data from a previous boot
  s_raw_crash_data.cause = 0;
  s_raw_crash_data.fault_addr = 0;
+  // Record which build's ELF the captured addresses belong to (RAM read, panic-safe).
+  // Still 0 if the panic precedes C++ dynamic initialization, so such a crash
+  // reports as a foreign build — conservative: addresses are shown raw instead
+  // of decoded.
+  s_raw_crash_data.build_time = esphome::esp32::s_current_build_time;
 #if SOC_CPU_CORES_NUM > 1
  s_raw_crash_data.other_backtrace_count = 0;
  s_raw_crash_data.other_reg_frame_count = 0;
@@ -176,12 +176,21 @@ ESPPreferenceObject ESP32Preferences::make_preference(size_t length, uint32_t ty
    }
    s_open_err = ESP_OK;
  }
-  auto *pref = new ESP32PreferenceBackend();  // NOLINT(cppcoreguidelines-owning-memory)
-  pref->nvs_handle = this->nvs_handle;
-  pref->key = type;
-  pref->in_flash = true;
+  // NOLINTNEXTLINE(cppcoreguidelines-owning-memory)
+  return ESPPreferenceObject(new ESP32PreferenceBackend(this->make_backend_(type)));
+}

-  return ESPPreferenceObject(pref);
+ESP32PreferenceBackend ESP32Preferences::make_backend_(uint32_t type) const {
+  // in_flash keeps its default of true, selecting the NVS path
+  ESP32PreferenceBackend backend;
+  backend.nvs_handle = this->nvs_handle;
+  backend.key = type;
+  return backend;
+}
+
+bool ESP32Preferences::load_from_key(uint32_t type, uint8_t *data, size_t len) {
+  ESP32PreferenceBackend backend = this->make_backend_(type);
+  return backend.load(data, len);
 }

 #ifdef USE_ESP32_RTC_PREFERENCES_STORAGE
@@ -23,12 +23,15 @@ class ESP32Preferences final : public PreferencesMixin<ESP32Preferences> {
  ESPPreferenceObject make_preference(size_t length, uint32_t type, bool in_flash);
  // Two-argument form defaults to NVS (flash) storage, preserving historic ESP32 behavior.
  ESPPreferenceObject make_preference(size_t length, uint32_t type);
+  /// One-shot read of a stored preference by key, without allocating a backend
+  bool load_from_key(uint32_t type, uint8_t *data, size_t len);
  bool sync();
  bool reset();

  uint32_t nvs_handle;

 protected:
+  ESP32PreferenceBackend make_backend_(uint32_t type) const;
  bool is_changed_(uint32_t nvs_handle, const NVSData &to_save, const char *key_str);

 #ifdef USE_ESP32_RTC_PREFERENCES_STORAGE
@@ -1,5 +1,4 @@
 from collections.abc import Callable, MutableMapping
-from dataclasses import dataclass
 from enum import Enum
 import logging
 from typing import Any
@@ -32,7 +31,7 @@ from esphome.const import (
    CONF_NAME,
    CONF_NAME_ADD_MAC_SUFFIX,
 )
-from esphome.core import CORE, CoroPriority, TimePeriod, coroutine_with_priority
+from esphome.core import CORE, TimePeriod
 import esphome.final_validate as fv
 from esphome.types import ConfigType

@@ -134,18 +133,21 @@ def _get_required_loggers() -> set[BTLoggers]:
    return CORE.data.setdefault(ESP32_BLE_REQUIRED_LOGGERS_KEY, set())


-# Dataclass for handler registration counts
-@dataclass
-class HandlerCounts:
-    gap_event: int = 0
-    gap_scan_event: int = 0
-    gattc_event: int = 0
-    gatts_event: int = 0
-    ble_status_event: int = 0
-
-
-# Track handler registration counts for StaticVector sizing
-_handler_counts = HandlerCounts()
+# Handler slot counters sizing the StaticCallbackManager storage in ble.h;
+# one request per register_* call below.
+_request_gap_event_slot = cg.slot_counter("ESPHOME_ESP32_BLE_GAP_EVENT_HANDLER_COUNT")
+_request_gap_scan_event_slot = cg.slot_counter(
+    "ESPHOME_ESP32_BLE_GAP_SCAN_EVENT_HANDLER_COUNT"
+)
+_request_gattc_event_slot = cg.slot_counter(
+    "ESPHOME_ESP32_BLE_GATTC_EVENT_HANDLER_COUNT"
+)
+_request_gatts_event_slot = cg.slot_counter(
+    "ESPHOME_ESP32_BLE_GATTS_EVENT_HANDLER_COUNT"
+)
+_request_ble_status_event_slot = cg.slot_counter(
+    "ESPHOME_ESP32_BLE_BLE_STATUS_EVENT_HANDLER_COUNT"
+)


 def _add_callback(
@@ -171,8 +173,8 @@ def _add_callback(


 def register_gap_event_handler(parent_var: cg.MockObj, handler_var: cg.MockObj) -> None:
-    """Register a GAP event handler and track the count."""
-    _handler_counts.gap_event += 1
+    """Register a GAP event handler and request a handler slot."""
+    _request_gap_event_slot()
    _add_callback(
        parent_var,
        "add_gap_event_callback",
@@ -185,8 +187,8 @@ def register_gap_event_handler(parent_var: cg.MockObj, handler_var: cg.MockObj)
 def register_gap_scan_event_handler(
    parent_var: cg.MockObj, handler_var: cg.MockObj
 ) -> None:
-    """Register a GAP scan event handler and track the count."""
-    _handler_counts.gap_scan_event += 1
+    """Register a GAP scan event handler and request a handler slot."""
+    _request_gap_scan_event_slot()
    _add_callback(
        parent_var,
        "add_gap_scan_event_callback",
@@ -199,8 +201,8 @@ def register_gap_scan_event_handler(
 def register_gattc_event_handler(
    parent_var: cg.MockObj, handler_var: cg.MockObj
 ) -> None:
-    """Register a GATTc event handler and track the count."""
-    _handler_counts.gattc_event += 1
+    """Register a GATTc event handler and request a handler slot."""
+    _request_gattc_event_slot()
    _add_callback(
        parent_var,
        "add_gattc_event_callback",
@@ -213,8 +215,8 @@ def register_gattc_event_handler(
 def register_gatts_event_handler(
    parent_var: cg.MockObj, handler_var: cg.MockObj
 ) -> None:
-    """Register a GATTs event handler and track the count."""
-    _handler_counts.gatts_event += 1
+    """Register a GATTs event handler and request a handler slot."""
+    _request_gatts_event_slot()
    _add_callback(
        parent_var,
        "add_gatts_event_callback",
@@ -227,8 +229,8 @@ def register_gatts_event_handler(
 def register_ble_status_event_handler(
    parent_var: cg.MockObj, handler_var: cg.MockObj
 ) -> None:
-    """Register a BLE status event handler and track the count."""
-    _handler_counts.ble_status_event += 1
+    """Register a BLE status event handler and request a handler slot."""
+    _request_ble_status_event_slot()
    _add_callback(
        parent_var,
        "add_ble_status_event_callback",
@@ -518,36 +520,6 @@ def final_validation(config):
 FINAL_VALIDATE_SCHEMA = final_validation


-# This needs to be run as a job with CoroPriority.FINAL priority so that all components have
-# a chance to register their handlers before the counts are added to defines.
-@coroutine_with_priority(CoroPriority.FINAL)
-async def _add_ble_handler_defines():
-    # Add defines for StaticVector sizing based on handler registration counts
-    # Only define if count > 0 to avoid allocating unnecessary memory
-    if _handler_counts.gap_event > 0:
-        cg.add_define(
-            "ESPHOME_ESP32_BLE_GAP_EVENT_HANDLER_COUNT", _handler_counts.gap_event
-        )
-    if _handler_counts.gap_scan_event > 0:
-        cg.add_define(
-            "ESPHOME_ESP32_BLE_GAP_SCAN_EVENT_HANDLER_COUNT",
-            _handler_counts.gap_scan_event,
-        )
-    if _handler_counts.gattc_event > 0:
-        cg.add_define(
-            "ESPHOME_ESP32_BLE_GATTC_EVENT_HANDLER_COUNT", _handler_counts.gattc_event
-        )
-    if _handler_counts.gatts_event > 0:
-        cg.add_define(
-            "ESPHOME_ESP32_BLE_GATTS_EVENT_HANDLER_COUNT", _handler_counts.gatts_event
-        )
-    if _handler_counts.ble_status_event > 0:
-        cg.add_define(
-            "ESPHOME_ESP32_BLE_BLE_STATUS_EVENT_HANDLER_COUNT",
-            _handler_counts.ble_status_event,
-        )
-
-
 async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    cg.add(var.set_enable_on_boot(config[CONF_ENABLE_ON_BOOT]))
@@ -576,7 +548,7 @@ async def to_code(config):
    max_connections = config.get(CONF_MAX_CONNECTIONS, DEFAULT_MAX_CONNECTIONS)
    cg.add_define("USE_ESP32_BLE_MAX_CONNECTIONS", max_connections)

-    request_bluetooth(ble_42=True)
+    request_bluetooth()

    # When PSRAM and BT are used together, Bluedroid should prefer SPIRAM for
    # heap allocations and use dynamic (heap-based) environment memory tables
@@ -633,9 +605,6 @@ async def to_code(config):
        cg.add_define("USE_ESP32_BLE_ADVERTISING")
        cg.add_define("USE_ESP32_BLE_UUID")

-    # Schedule the handler defines to be added after all components register
-    CORE.add_job(_add_ble_handler_defines)
-

@automation.register_condition("ble.enabled", BLEEnabledCondition, cv.Schema({}))
 async def ble_enabled_to_code(config, condition_id, template_arg, args):
@@ -86,4 +86,4 @@ async def to_code(config):

    cg.add_define("USE_ESP32_BLE_ADVERTISING")

-    request_bluetooth(ble_42=True)
+    request_bluetooth()
@@ -125,6 +125,9 @@ void BLEClientBase::connect() {
  }
  ESP_LOGI(TAG, "[%d] [%s] 0x%02x Connecting", this->connection_index_, this->address_str_, this->remote_addr_type_);
  this->paired_ = false;
+  // A registration whose event never arrived must not block this connection's release.
+  this->services_released_ = false;
+  this->pending_notify_regs_ = 0;
  // Enable loop for state processing
  this->enable_loop();
  // Immediately transition to CONNECTING to prevent duplicate connection attempts
@@ -200,10 +203,26 @@ void BLEClientBase::release_services() {
  this->services_.clear();
 #endif
 #ifndef CONFIG_BT_GATTC_CACHE_NVS_FLASH
+  // Only the cache clean makes the stack's database unsafe to walk.
+  this->services_released_ = true;
  esp_ble_gattc_cache_clean(this->remote_bda_);
 #endif
 }

+esp_err_t BLEClientBase::register_for_notify(uint16_t char_handle) {
+  esp_err_t err = esp_ble_gattc_register_for_notify(this->gattc_if_, this->remote_bda_, char_handle);
+  if (err != ESP_OK)
+    return err;
+  if (this->pending_notify_regs_ == UINT8_MAX) {
+    // Saturating undercounts, so the release can run before the last registration completes.
+    // Wrapping to zero would undercount by the full range instead, which is worse.
+    this->log_warning_("Too many outstanding notify registrations to track");
+    return err;
+  }
+  this->pending_notify_regs_++;
+  return err;
+}
+
 void BLEClientBase::log_event_(const char *name) {
  ESP_LOGD(TAG, "[%d] [%s] %s", this->connection_index_, this->address_str_, name);
 }
@@ -498,12 +517,20 @@ bool BLEClientBase::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_
    }
    case ESP_GATTC_REG_FOR_NOTIFY_EVT: {
      this->log_gattc_data_event_("REG_FOR_NOTIFY");
+      // The event carries no conn_id, so this is the only place the request can be retired.
+      if (this->pending_notify_regs_ > 0)
+        this->pending_notify_regs_--;
      if (this->connection_type_ == espbt::ConnectionType::V3_WITH_CACHE ||
          this->connection_type_ == espbt::ConnectionType::V3_WITHOUT_CACHE) {
        // Client is responsible for flipping the descriptor value
        // when using the cache
        break;
      }
+      if (this->services_released_) {
+        // The lookup below walks the freed GATT cache, and Bluedroid asserts on it rather than erroring.
+        this->log_warning_("REG_FOR_NOTIFY after services released, notifications not enabled");
+        break;
+      }
      esp_gattc_descr_elem_t desc_result;
      uint16_t count = 1;
      esp_gatt_status_t descr_status = esp_ble_gattc_get_descr_by_char_handle(
@@ -44,6 +44,12 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
  void unconditional_disconnect();
  void release_services();

+  /// Register for notifications, holding the service release until the registration completes.
+  esp_err_t register_for_notify(uint16_t char_handle);
+
+  /// True while a register_for_notify() request has not completed.
+  bool notify_registration_pending() const { return this->pending_notify_regs_ > 0; }
+
  bool connected() { return this->state() == espbt::ClientState::ESTABLISHED; }

  void set_auto_connect(bool auto_connect) { this->auto_connect_ = auto_connect; }
@@ -125,9 +131,15 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
  espbt::ConnectionType connection_type_{espbt::ConnectionType::V1};
  uint8_t connection_index_;
  uint8_t service_count_{0};  // ESP32 has max handles < 255, typical devices have < 50 services
+  // Outstanding register_for_notify() requests
+  // A count, not per-request state, so a raw esp_ble_gattc_register_for_notify() on the same client can retire one
+  // services_released_ is the backstop if that ever lets the release run early
+  uint8_t pending_notify_regs_{0};
  bool auto_connect_{false};
  bool paired_{false};
-  // 6 bytes used, 2 bytes padding
+  // Set only when release_services() cleans the stack's GATT cache, which no API may then walk
+  bool services_released_{false};
+  // 8 bytes used, no padding

  void log_event_(const char *name);
  void log_gattc_lifecycle_event_(const char *name);
@@ -1,11 +1,11 @@
 from __future__ import annotations

-from dataclasses import dataclass
 import logging

 from esphome import automation
 import esphome.codegen as cg
 from esphome.components import ble_device_base, esp32_ble, ota
+from esphome.components.const import CONF_ON_SCAN_END, CONF_SCAN_PARAMETERS, CONF_WINDOW
 from esphome.components.esp32 import (
    add_idf_sdkconfig_option,
    request_bluetooth,
@@ -43,10 +43,9 @@ AUTO_LOAD = ["ble_device_base", "esp32_ble"]
 DEPENDENCIES = ["esp32"]
 CODEOWNERS = ["@bdraco"]

+ble_device_base.register_hub_provider("esp32_ble_tracker")
+
 CONF_ESP32_BLE_ID = "esp32_ble_id"
-CONF_SCAN_PARAMETERS = "scan_parameters"
-CONF_WINDOW = "window"
-CONF_ON_SCAN_END = "on_scan_end"
 CONF_SOFTWARE_COEXISTENCE = "software_coexistence"

 _LOGGER = logging.getLogger(__name__)
@@ -57,16 +56,8 @@ class BLEFeatures(StrEnum):
    ESP_BT_DEVICE = "ESP_BT_DEVICE"


-# Dataclass for registration counts
-@dataclass
-class RegistrationCounts:
-    listeners: int = 0
-    clients: int = 0
-
-
-# CORE.data keys for state management
+# CORE.data key for state management
 ESP32_BLE_TRACKER_REQUIRED_FEATURES_KEY = "esp32_ble_tracker_required_features"
-ESP32_BLE_TRACKER_REGISTRATION_COUNTS_KEY = "esp32_ble_tracker_registration_counts"


 def _get_required_features() -> set[BLEFeatures]:
@@ -74,11 +65,13 @@ def _get_required_features() -> set[BLEFeatures]:
    return CORE.data.setdefault(ESP32_BLE_TRACKER_REQUIRED_FEATURES_KEY, set())


-def _get_registration_counts() -> RegistrationCounts:
-    """Get the registration counts from CORE.data."""
-    return CORE.data.setdefault(
-        ESP32_BLE_TRACKER_REGISTRATION_COUNTS_KEY, RegistrationCounts()
-    )
+# Slot counters sizing the tracker's StaticVector storage; one request per
+# registered listener, client, or scanner state listener.
+_request_listener_slot = cg.slot_counter("ESPHOME_ESP32_BLE_TRACKER_LISTENER_COUNT")
+_request_client_slot = cg.slot_counter("ESPHOME_ESP32_BLE_TRACKER_CLIENT_COUNT")
+_request_scanner_state_listener_slot = cg.slot_counter(
+    "ESPHOME_ESP32_BLE_TRACKER_SCANNER_STATE_LISTENER_COUNT"
+)


 def register_ble_features(features: set[BLEFeatures]) -> None:
@@ -126,25 +119,6 @@ ESP32BLEStopScanAction = esp32_ble_tracker_ns.class_(
 )


-def validate_scan_parameters(config):
-    duration = config[CONF_DURATION]
-    interval = config[CONF_INTERVAL]
-    window = config[CONF_WINDOW]
-
-    if window > interval:
-        raise cv.Invalid(
-            f"Scan window ({window}) needs to be smaller than scan interval ({interval})"
-        )
-
-    if interval.total_milliseconds * 3 > duration.total_milliseconds:
-        raise cv.Invalid(
-            "Scan duration needs to be at least three times the scan interval to"
-            "cover all BLE channels."
-        )
-
-    return config
-
-
 def validate_max_connections_deprecated(config: ConfigType) -> ConfigType:
    if CONF_MAX_CONNECTIONS in config:
        _LOGGER.warning(
@@ -154,6 +128,13 @@ def validate_max_connections_deprecated(config: ConfigType) -> ConfigType:
    return config


+# 320 ms is the ESP-IDF reference scan interval; the shared schema also
+# tightens validation to the controller's 2.5 ms .. 10240 ms range and rejects
+# window/interval pairs that collapse to the same 0.625 ms unit count.
+SCAN_PARAMETERS_SCHEMA = ble_device_base.scan_parameters_schema(
+    "320ms", supports_active=True
+)
+
 # Codegen helpers are owned by ble_device_base; kept under the historical names
 # here for the components that import them from this module.
 as_hex = ble_device_base.as_hex
@@ -169,24 +150,7 @@ CONFIG_SCHEMA = cv.All(
            cv.Optional(CONF_MAX_CONNECTIONS): cv.All(
                cv.positive_int, cv.Range(min=0, max=IDF_MAX_CONNECTIONS)
            ),
-            cv.Optional(CONF_SCAN_PARAMETERS, default={}): cv.All(
-                cv.Schema(
-                    {
-                        cv.Optional(
-                            CONF_DURATION, default="5min"
-                        ): cv.positive_time_period_seconds,
-                        cv.Optional(
-                            CONF_INTERVAL, default="320ms"
-                        ): cv.positive_time_period_milliseconds,
-                        cv.Optional(
-                            CONF_WINDOW, default="30ms"
-                        ): cv.positive_time_period_milliseconds,
-                        cv.Optional(CONF_ACTIVE, default=True): cv.boolean,
-                        cv.Optional(CONF_CONTINUOUS, default=True): cv.boolean,
-                    }
-                ),
-                validate_scan_parameters,
-            ),
+            cv.Optional(CONF_SCAN_PARAMETERS, default={}): SCAN_PARAMETERS_SCHEMA,
            cv.Optional(CONF_ON_BLE_ADVERTISE): automation.validate_automation(
                {
                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
@@ -256,8 +220,8 @@ async def to_code(config):

    params = config[CONF_SCAN_PARAMETERS]
    cg.add(var.set_scan_duration(params[CONF_DURATION]))
-    cg.add(var.set_scan_interval(int(params[CONF_INTERVAL].total_milliseconds / 0.625)))
-    cg.add(var.set_scan_window(int(params[CONF_WINDOW].total_milliseconds / 0.625)))
+    cg.add(var.set_scan_interval(ble_device_base.to_ble_units(params[CONF_INTERVAL])))
+    cg.add(var.set_scan_window(ble_device_base.to_ble_units(params[CONF_WINDOW])))
    cg.add(var.set_scan_active(params[CONF_ACTIVE]))
    cg.add(var.set_scan_continuous(params[CONF_CONTINUOUS]))

@@ -269,17 +233,15 @@ async def to_code(config):
    ):
        register_ble_features({BLEFeatures.ESP_BT_DEVICE})

-    registration_counts = _get_registration_counts()
-
    for conf in config.get(CONF_ON_BLE_ADVERTISE, []):
-        registration_counts.listeners += 1
+        _request_listener_slot()
        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
        if CONF_MAC_ADDRESS in conf:
            addr_list = [it.as_hex for it in conf[CONF_MAC_ADDRESS]]
            cg.add(trigger.set_addresses(addr_list))
        await automation.build_automation(trigger, [(ESPBTDeviceConstRef, "x")], conf)
    for conf in config.get(CONF_ON_BLE_SERVICE_DATA_ADVERTISE, []):
-        registration_counts.listeners += 1
+        _request_listener_slot()
        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
        if len(conf[CONF_SERVICE_UUID]) == len(bt_uuid16_format):
            cg.add(trigger.set_service_uuid16(as_hex(conf[CONF_SERVICE_UUID])))
@@ -292,7 +254,7 @@ async def to_code(config):
            cg.add(trigger.set_address(conf[CONF_MAC_ADDRESS].as_hex))
        await automation.build_automation(trigger, [(adv_data_t_const_ref, "x")], conf)
    for conf in config.get(CONF_ON_BLE_MANUFACTURER_DATA_ADVERTISE, []):
-        registration_counts.listeners += 1
+        _request_listener_slot()
        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
        if len(conf[CONF_MANUFACTURER_ID]) == len(bt_uuid16_format):
            cg.add(trigger.set_manufacturer_uuid16(as_hex(conf[CONF_MANUFACTURER_ID])))
@@ -305,7 +267,7 @@ async def to_code(config):
            cg.add(trigger.set_address(conf[CONF_MAC_ADDRESS].as_hex))
        await automation.build_automation(trigger, [(adv_data_t_const_ref, "x")], conf)
    for conf in config.get(CONF_ON_SCAN_END, []):
-        registration_counts.listeners += 1
+        _request_listener_slot()
        trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
        await automation.build_automation(trigger, [], conf)

@@ -338,28 +300,14 @@ async def _add_ble_features():
    required_features = _get_required_features()
    # Sensors registered through the neutral ble_device_base path (BLEHub) need
    # the parsed-device pipeline compiled in, exactly like esp32-path listeners.
-    neutral_listener_count = ble_device_base.get_listener_count()
-    if neutral_listener_count > 0:
+    if cg.get_slot_count(ble_device_base.LISTENER_COUNT_DEFINE):
+        # The neutral (BLEHub) listener count define itself is emitted by
+        # ble_device_base's own job; only the feature coupling lives here.
        required_features.add(BLEFeatures.ESP_BT_DEVICE)
-        # StaticVector sizing for the neutral (BLEHub) listener list — same
-        # pattern as the esp32-path registration counts below.
-        cg.add_define("ESPHOME_BLE_DEVICE_BASE_LISTENER_COUNT", neutral_listener_count)
    if BLEFeatures.ESP_BT_DEVICE in required_features:
        cg.add_define("USE_ESP32_BLE_DEVICE")
        cg.add_define("USE_ESP32_BLE_UUID")

-    # Add defines for StaticVector sizing based on registration counts
-    # Only define if count > 0 to avoid allocating unnecessary memory
-    registration_counts = _get_registration_counts()
-    if registration_counts.listeners > 0:
-        cg.add_define(
-            "ESPHOME_ESP32_BLE_TRACKER_LISTENER_COUNT", registration_counts.listeners
-        )
-    if registration_counts.clients > 0:
-        cg.add_define(
-            "ESPHOME_ESP32_BLE_TRACKER_CLIENT_COUNT", registration_counts.clients
-        )
-

 ESP32_BLE_START_SCAN_ACTION_SCHEMA = cv.Schema(
    {
@@ -412,7 +360,7 @@ async def register_ble_device(
    var: cg.SafeExpType, config: ConfigType
 ) -> cg.SafeExpType:
    register_ble_features({BLEFeatures.ESP_BT_DEVICE})
-    _get_registration_counts().listeners += 1
+    _request_listener_slot()
    paren = await cg.get_variable(config[CONF_ESP32_BLE_ID])
    cg.add(paren.register_listener(var))
    return var
@@ -420,7 +368,7 @@ async def register_ble_device(

 async def register_client(var: cg.SafeExpType, config: ConfigType) -> cg.SafeExpType:
    register_ble_features({BLEFeatures.ESP_BT_DEVICE})
-    _get_registration_counts().clients += 1
+    _request_client_slot()
    paren = await cg.get_variable(config[CONF_ESP32_BLE_ID])
    cg.add(paren.register_client(var))
    return var
@@ -434,7 +382,7 @@ async def register_raw_ble_device(
    This does NOT register the ESP_BT_DEVICE feature, meaning ESPBTDevice
    will not be compiled in if this is the only registration method used.
    """
-    _get_registration_counts().listeners += 1
+    _request_listener_slot()
    paren = await cg.get_variable(config[CONF_ESP32_BLE_ID])
    cg.add(paren.register_listener(var))
    return var
@@ -448,7 +396,21 @@ async def register_raw_client(
    This does NOT register the ESP_BT_DEVICE feature, meaning ESPBTDevice
    will not be compiled in if this is the only registration method used.
    """
-    _get_registration_counts().clients += 1
+    _request_client_slot()
    paren = await cg.get_variable(config[CONF_ESP32_BLE_ID])
    cg.add(paren.register_client(var))
    return var
+
+
+async def register_scanner_state_listener(
+    var: cg.SafeExpType, config: ConfigType
+) -> cg.SafeExpType:
+    """Register a listener for scanner state changes.
+
+    The slot request here is what sizes the tracker's listener storage; a
+    build with no registrations compiles the storage out entirely.
+    """
+    _request_scanner_state_listener_slot()
+    paren = await cg.get_variable(config[CONF_ESP32_BLE_ID])
+    cg.add(paren.add_scanner_state_listener(var))
+    return var
@@ -3,6 +3,8 @@
 #include "esphome/core/automation.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"

+#include <vector>
+
 #ifdef USE_ESP32

 namespace esphome::esp32_ble_tracker {
@@ -36,27 +36,6 @@ static const char *const TAG = "esp32_ble_tracker";

 ESP32BLETracker *global_esp32_ble_tracker = nullptr;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)

-const char *client_state_to_string(ClientState state) {
-  switch (state) {
-    case ClientState::INIT:
-      return "INIT";
-    case ClientState::DISCONNECTING:
-      return "DISCONNECTING";
-    case ClientState::IDLE:
-      return "IDLE";
-    case ClientState::DISCOVERED:
-      return "DISCOVERED";
-    case ClientState::CONNECTING:
-      return "CONNECTING";
-    case ClientState::CONNECTED:
-      return "CONNECTED";
-    case ClientState::ESTABLISHED:
-      return "ESTABLISHED";
-    default:
-      return "UNKNOWN";
-  }
-}
-
 float ESP32BLETracker::get_setup_priority() const { return setup_priority::AFTER_BLUETOOTH; }

 void ESP32BLETracker::setup() {
@@ -443,9 +422,11 @@ void ESP32BLETracker::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_i
 void ESP32BLETracker::set_scanner_state_(ScannerState state) {
  this->scanner_state_ = state;
  this->state_version_++;
+#ifdef ESPHOME_ESP32_BLE_TRACKER_SCANNER_STATE_LISTENER_COUNT
  for (auto *listener : this->scanner_state_listeners_) {
    listener->on_scanner_state(state);
  }
+#endif
 }

 void ESP32BLETracker::dump_config() {
@@ -499,6 +480,8 @@ void ESP32BLETracker::process_scan_result_(const BLEScanResult &scan_result) {
  if (this->parse_advertisements_) {
 #ifdef USE_ESP32_BLE_DEVICE
    ESPBTDevice device;
+    // The historical ingest keeps the raw scan-result fields populated for
+    // external components.
    device.parse_scan_rst(scan_result);

    bool found = false;
@@ -8,7 +8,6 @@
 #include <array>
 #include <span>
 #include <string>
-#include <vector>

 #ifdef USE_ESP32

@@ -19,6 +18,7 @@
 #include <freertos/FreeRTOS.h>
 #include <freertos/semphr.h>

+#include "esphome/components/ble_device_base/ble_client_state.h"
 #include "esphome/components/ble_device_base/ble_device.h"
 #include "esphome/components/ble_device_base/ble_hub.h"
 #include "esphome/components/esp32_ble/ble.h"
@@ -89,22 +89,11 @@ struct ClientStateCounts {
  bool operator!=(const ClientStateCounts &other) const { return !(*this == other); }
 };

-enum class ClientState : uint8_t {
-  // Connection is allocated
-  INIT,
-  // Client is disconnecting
-  DISCONNECTING,
-  // Connection is idle, no device detected.
-  IDLE,
-  // Device advertisement found.
-  DISCOVERED,
-  // Connection in progress.
-  CONNECTING,
-  // Initial connection established.
-  CONNECTED,
-  // The client and sub-clients have completed setup.
-  ESTABLISHED,
-};
+// The client connection state types are owned by the platform-neutral
+// ble_device_base layer; re-exported here for backward compatibility.
+using ClientState = ble_device_base::ClientState;
+using ConnectionType = ble_device_base::ConnectionType;
+using ble_device_base::client_state_to_string;

 enum class ScannerState {
  // Scanner is idle, init state
@@ -129,21 +118,6 @@ class BLEScannerStateListener {
  virtual void on_scanner_state(ScannerState state) = 0;
 };

-// Helper function to convert ClientState to string
-const char *client_state_to_string(ClientState state);
-
-enum class ConnectionType : uint8_t {
-  // The default connection type, we hold all the services in ram
-  // for the duration of the connection.
-  V1,
-  // The client has a cache of the services and mtu so we should not
-  // fetch them again
-  V3_WITH_CACHE,
-  // The client does not need the services and mtu once we send them
-  // so we should wipe them from memory as soon as we send them
-  V3_WITHOUT_CACHE
-};
-
 /// Base class for BLE GATT clients that connect to remote devices.
 ///
 /// State Change Tracking Design:
@@ -239,11 +213,14 @@ class ESP32BLETracker final : public Component,

  // ---- ble_device_base::BLEHub (the platform-neutral tracker contract) ----
  void register_listener(ble_device_base::ESPBTDeviceListener *listener) override;
-  void set_raw_advertisement_callback(ble_device_base::RawAdvertisementCallback cb) override {
-    this->raw_advertisement_callback_ = std::move(cb);
+  void set_raw_advertisement_callback(ble_device_base::RawAdvertisementCallback callback) override {
+    this->raw_advertisement_callback_ = callback;
  }
  ble_device_base::HubCapabilities get_capabilities() const override {
-    return {/* active_scan = */ true, /* merges_scan_response = */ true, /* gatt = */ true};
+    // scan_mode_switch is false: the mode is driven through this tracker's own
+    // API (set_scan_active + restart), not the neutral request_scan_mode().
+    return {/* active_scan = */ true, /* merges_scan_response = */ true, /* gatt = */ true,
+            /* scan_mode_switch = */ false};
  }
  void get_adapter_mac(uint8_t out[6]) override;
  bool scan_running() override { return this->scanner_state_ == ScannerState::RUNNING; }
@@ -265,10 +242,15 @@ class ESP32BLETracker final : public Component,
  void on_ota_global_state(ota::OTAState state, float progress, uint8_t error, ota::OTAComponent *comp) override;
 #endif

-  /// Add a listener for scanner state changes
+#ifdef ESPHOME_ESP32_BLE_TRACKER_SCANNER_STATE_LISTENER_COUNT
+  /// Add a listener for scanner state changes. Only compiled when a consumer
+  /// requested a slot in codegen: register through
+  /// esp32_ble_tracker.register_scanner_state_listener() in your component's
+  /// to_code, which requests the slot and emits this call.
  void add_scanner_state_listener(BLEScannerStateListener *listener) {
    this->scanner_state_listeners_.push_back(listener);
  }
+#endif
  ScannerState get_scanner_state() const { return this->scanner_state_; }

 protected:
@@ -335,13 +317,16 @@ class ESP32BLETracker final : public Component,
 #ifdef ESPHOME_ESP32_BLE_TRACKER_CLIENT_COUNT
  StaticVector<ESPBTClient *, ESPHOME_ESP32_BLE_TRACKER_CLIENT_COUNT> clients_;
 #endif
-  std::vector<BLEScannerStateListener *> scanner_state_listeners_;
+#ifdef ESPHOME_ESP32_BLE_TRACKER_SCANNER_STATE_LISTENER_COUNT
+  StaticVector<BLEScannerStateListener *, ESPHOME_ESP32_BLE_TRACKER_SCANNER_STATE_LISTENER_COUNT>
+      scanner_state_listeners_;
+#endif
  // Parsed listeners registered through the neutral BLEHub contract (migrated
  // sensors); dispatched alongside listeners_.
 #ifdef ESPHOME_BLE_DEVICE_BASE_LISTENER_COUNT
  StaticVector<ble_device_base::ESPBTDeviceListener *, ESPHOME_BLE_DEVICE_BASE_LISTENER_COUNT> neutral_listeners_;
 #endif
-  ble_device_base::RawAdvertisementCallback raw_advertisement_callback_{nullptr};
+  ble_device_base::RawAdvertisementCallback raw_advertisement_callback_{};
 #ifdef USE_ESP32_BLE_DEVICE
  /// Per-period "Found device" DEBUG log with MAC dedup (shared ble_device_base impl)
  ble_device_base::DiscoveredDeviceLog discovered_log_;
@@ -13,7 +13,9 @@

 namespace esphome::esp32_camera_web_server {

-static const int IMAGE_REQUEST_TIMEOUT = 5000;
+static const uint32_t IMAGE_REQUEST_TIMEOUT = 5000;
+// How often streaming_handler_ reports its throughput.
+static const uint32_t STREAM_STATS_INTERVAL = 5000;
 static const char *const TAG = "esp32_camera_web_server";

 #define PART_BOUNDARY "123456789000000000000987654321"
@@ -113,10 +115,31 @@ std::shared_ptr<esphome::camera::CameraImage> CameraWebServer::wait_for_image_()
  std::shared_ptr<esphome::camera::CameraImage> image;
  image.swap(this->image_);

-  if (!image) {
-    // retry as we might still be fetching image
-    xSemaphoreTake(this->semaphore_, IMAGE_REQUEST_TIMEOUT / portTICK_PERIOD_MS);
+  if (image)
+    return image;
+
+  // Keep waiting until a frame really shows up, rather than trusting a single
+  // take() to mean one is there.
+  //
+  // on_camera_image() gives the semaphore for every frame it accepts, but the
+  // swap above hands frames out without taking it, so as soon as the camera is
+  // faster than this task for one frame the (binary) semaphore is left
+  // signalled by a frame that has already been consumed. The next take() then
+  // returns immediately with nothing to swap in, and the caller reports a lost
+  // frame and closes the stream -- after an arbitrary number of good frames,
+  // which is exactly when the camera happens to fall behind for one iteration.
+  //
+  // running_ is re-checked on every pass so a shutdown or a client that went
+  // away is noticed straight away instead of after the full timeout.
+  const uint32_t start = millis();
+  while (this->running_) {
+    uint32_t elapsed = millis() - start;
+    if (elapsed >= IMAGE_REQUEST_TIMEOUT)
+      break;
+    xSemaphoreTake(this->semaphore_, pdMS_TO_TICKS(IMAGE_REQUEST_TIMEOUT - elapsed));
    image.swap(this->image_);
+    if (image)
+      break;
  }

  return image;
@@ -170,8 +193,14 @@ esp_err_t CameraWebServer::streaming_handler_(struct httpd_req *req) {
    return res;
  }

-  uint32_t last_frame = millis();
  uint32_t frames = 0;
+  // Frame statistics are aggregated over STREAM_STATS_INTERVAL rather than
+  // logged per frame. A line per frame comes out of this (non-main) task tens
+  // of times a second, and formatting and buffering it costs more than the
+  // stream it is reporting on.
+  uint32_t stats_since = millis();
+  uint32_t stats_frames = 0;
+  uint32_t stats_bytes = 0;

  camera::Camera::instance()->start_stream(esphome::camera::WEB_REQUESTER);

@@ -179,7 +208,10 @@ esp_err_t CameraWebServer::streaming_handler_(struct httpd_req *req) {
    auto image = this->wait_for_image_();

    if (!image) {
-      ESP_LOGW(TAG, "STREAM: failed to acquire frame");
+      // A shutdown is not a lost frame: wait_for_image_() returns empty as soon
+      // as running_ clears, and the loop condition below ends the stream anyway.
+      if (this->running_)
+        ESP_LOGW(TAG, "STREAM: failed to acquire frame");
      res = ESP_FAIL;
    }
    if (res == ESP_OK) {
@@ -194,14 +226,29 @@ esp_err_t CameraWebServer::streaming_handler_(struct httpd_req *req) {
    }
    if (res == ESP_OK) {
      frames++;
-      int64_t frame_time = millis() - last_frame;
-      last_frame = millis();
-
-      ESP_LOGD(TAG, "MJPG: %" PRIu32 "B %" PRIu32 "ms (%.1ffps)", (uint32_t) image->get_data_length(),
-               (uint32_t) frame_time, 1000.0 / (uint32_t) frame_time);
+      stats_frames++;
+      stats_bytes += image->get_data_length();
+      uint32_t elapsed = millis() - stats_since;
+      if (elapsed >= STREAM_STATS_INTERVAL) {
+        ESP_LOGD(TAG, "MJPG: %.1ffps, %" PRIu32 "B/frame (%" PRIu32 " frames)", stats_frames * 1000.0f / elapsed,
+                 stats_bytes / stats_frames, stats_frames);
+        stats_since = millis();
+        stats_frames = 0;
+        stats_bytes = 0;
+      }
    }
  }

+  // Report whatever did not fill a whole interval, so a stream that only ran for
+  // a second or two still says what it managed rather than nothing at all.
+  if (stats_frames > 0) {
+    uint32_t elapsed = millis() - stats_since;
+    if (elapsed == 0)
+      elapsed = 1;
+    ESP_LOGD(TAG, "MJPG: %.1ffps, %" PRIu32 "B/frame (%" PRIu32 " frames)", stats_frames * 1000.0f / elapsed,
+             stats_bytes / stats_frames, stats_frames);
+  }
+
  if (!frames) {
    res = httpd_send_all(req, STREAM_ERROR, strlen(STREAM_ERROR));
  }
@@ -256,10 +256,10 @@ async def to_code(config):
    idf_ver = esp32.idf_version()
    os.environ["ESP_IDF_VERSION"] = f"{idf_ver.major}.{idf_ver.minor}"
    if idf_ver >= cv.Version(5, 5, 0):
-        esp32.add_idf_component(name="espressif/esp_wifi_remote", ref="1.5.1")
-        esp32.add_idf_component(name="espressif/wifi_remote_over_eppp", ref="0.3.2")
+        esp32.add_idf_component(name="espressif/esp_wifi_remote", ref="1.6.3")
+        esp32.add_idf_component(name="espressif/wifi_remote_over_eppp", ref="0.3.3")
        esp32.add_idf_component(name="espressif/eppp_link", ref="1.1.5")
-        esp32.add_idf_component(name="espressif/esp_hosted", ref="2.12.9")
+        esp32.add_idf_component(name="espressif/esp_hosted", ref="2.12.12")
    else:
        esp32.add_idf_component(name="espressif/esp_wifi_remote", ref="0.13.0")
        esp32.add_idf_component(name="espressif/eppp_link", ref="0.2.0")
@@ -255,11 +255,11 @@ light::ESPColorView ESP32RMTLEDStripLightOutput::get_view_internal(int32_t index
      break;
  }
  uint8_t multiplier = this->is_rgbw_ || this->is_wrgb_ ? 4 : 3;
-  uint8_t white = this->is_wrgb_ ? 0 : 3;
+  uint8_t white = this->is_wrgb_ ? 0 : this->white_index_;

-  return {this->buf_ + (index * multiplier) + r + this->is_wrgb_,
-          this->buf_ + (index * multiplier) + g + this->is_wrgb_,
-          this->buf_ + (index * multiplier) + b + this->is_wrgb_,
+  return {this->buf_ + (index * multiplier) + r + (white <= r),
+          this->buf_ + (index * multiplier) + g + (white <= g),
+          this->buf_ + (index * multiplier) + b + (white <= b),
          this->is_rgbw_ || this->is_wrgb_ ? this->buf_ + (index * multiplier) + white : nullptr,
          &this->effect_data_[index],
          &this->correction_};
@@ -295,11 +295,22 @@ void ESP32RMTLEDStripLightOutput::dump_config() {
      rgb_order = "UNKNOWN";
      break;
  }
+  if (this->is_rgbw_ || this->is_wrgb_) {
+    char rgbw_order[5];
+    uint8_t white = this->is_wrgb_ ? 0 : this->white_index_;
+    uint8_t rgb_index = 0;
+    for (uint8_t i = 0; i < 4; i++) {
+      rgbw_order[i] = i == white ? 'W' : rgb_order[rgb_index++];
+    }
+    rgbw_order[4] = '\0';
+    ESP_LOGCONFIG(TAG, "  RGBW Order: %s", rgbw_order);
+  } else {
+    ESP_LOGCONFIG(TAG, "  RGB Order: %s", rgb_order);
+  }
  ESP_LOGCONFIG(TAG,
-                "  RGB Order: %s\n"
                "  Max refresh rate: %" PRIu32 "\n"
                "  Number of LEDs: %u",
-                rgb_order, this->max_refresh_rate_.value_or(0), this->num_leds_);
+                this->max_refresh_rate_.value_or(0), this->num_leds_);
 }

 float ESP32RMTLEDStripLightOutput::get_setup_priority() const { return setup_priority::HARDWARE; }
@@ -52,6 +52,11 @@ class ESP32RMTLEDStripLightOutput final : public light::AddressableLight {
  void set_num_leds(uint16_t num_leds) { this->num_leds_ = num_leds; }
  void set_is_rgbw(bool is_rgbw) { this->is_rgbw_ = is_rgbw; }
  void set_is_wrgb(bool is_wrgb) { this->is_wrgb_ = is_wrgb; }
+  void set_rgbw_order(uint8_t white_index) {
+    this->is_rgbw_ = true;
+    this->is_wrgb_ = false;
+    this->white_index_ = white_index;
+  }
  void set_use_dma(bool use_dma) { this->use_dma_ = use_dma; }
  void set_use_psram(bool use_psram) { this->use_psram_ = use_psram; }

@@ -91,6 +96,8 @@ class ESP32RMTLEDStripLightOutput final : public light::AddressableLight {
  uint16_t num_leds_;
  bool is_rgbw_{false};
  bool is_wrgb_{false};
+  // An index after the RGB channels makes offset adjustment a no-op for three-channel strips.
+  uint8_t white_index_{3};
  bool use_dma_{false};
  bool use_psram_{false};
  bool invert_out_{false};
@@ -20,6 +20,7 @@ from esphome.const import (
    CONF_RMT_SYMBOLS,
    CONF_USE_DMA,
 )
+from esphome.types import ConfigType

 _LOGGER = logging.getLogger(__name__)

@@ -62,6 +63,7 @@ CHIPSETS = {
 }

 CONF_IS_WRGB = "is_wrgb"
+CONF_RGBW_ORDER = "rgbw_order"
 CONF_BIT0_HIGH = "bit0_high"
 CONF_BIT0_LOW = "bit0_low"
 CONF_BIT1_HIGH = "bit1_high"
@@ -70,6 +72,26 @@ CONF_RESET_HIGH = "reset_high"
 CONF_RESET_LOW = "reset_low"


+def _validate_rgbw_order(value: str) -> str:
+    value = cv.string(value).upper()
+    if len(value) != 4 or set(value) != set("RGBW"):
+        raise cv.Invalid("RGBW order must be a permutation of RGBW")
+    return value
+
+
+def _split_rgbw_order(rgbw_order: str) -> tuple[str, int]:
+    return rgbw_order.replace("W", ""), rgbw_order.index("W")
+
+
+def _validate_rgbw_order_exclusivity(config: ConfigType) -> ConfigType:
+    if CONF_RGBW_ORDER in config and (config[CONF_IS_RGBW] or config[CONF_IS_WRGB]):
+        raise cv.Invalid(
+            f"'{CONF_RGBW_ORDER}' cannot be used with '{CONF_IS_RGBW}' or "
+            f"'{CONF_IS_WRGB}'"
+        )
+    return config
+
+
 CONFIG_SCHEMA = cv.All(
    esp32.only_on_variant(
        unsupported=list(esp32_rmt.VARIANTS_NO_RMT),
@@ -80,7 +102,8 @@ CONFIG_SCHEMA = cv.All(
            cv.GenerateID(CONF_OUTPUT_ID): cv.declare_id(ESP32RMTLEDStripLightOutput),
            cv.Required(CONF_PIN): pins.internal_gpio_output_pin_schema,
            cv.Required(CONF_NUM_LEDS): cv.positive_not_null_int,
-            cv.Required(CONF_RGB_ORDER): cv.enum(RGB_ORDERS, upper=True),
+            cv.Optional(CONF_RGB_ORDER): cv.enum(RGB_ORDERS, upper=True),
+            cv.Optional(CONF_RGBW_ORDER): _validate_rgbw_order,
            cv.SplitDefault(
                CONF_RMT_SYMBOLS,
                esp32=192,
@@ -130,6 +153,8 @@ CONFIG_SCHEMA = cv.All(
        }
    ).extend(cv.COMPONENT_SCHEMA),
    cv.has_exactly_one_key(CONF_CHIPSET, CONF_BIT0_HIGH),
+    cv.has_exactly_one_key(CONF_RGB_ORDER, CONF_RGBW_ORDER),
+    _validate_rgbw_order_exclusivity,
 )


@@ -173,9 +198,14 @@ async def to_code(config):
            )
        )

-    cg.add(var.set_rgb_order(config[CONF_RGB_ORDER]))
-    cg.add(var.set_is_rgbw(config[CONF_IS_RGBW]))
-    cg.add(var.set_is_wrgb(config[CONF_IS_WRGB]))
+    if (rgbw_order := config.get(CONF_RGBW_ORDER)) is not None:
+        rgb_order, white_index = _split_rgbw_order(rgbw_order)
+        cg.add(var.set_rgb_order(RGB_ORDERS[rgb_order]))
+        cg.add(var.set_rgbw_order(white_index))
+    else:
+        cg.add(var.set_rgb_order(config[CONF_RGB_ORDER]))
+        cg.add(var.set_is_rgbw(config[CONF_IS_RGBW]))
+        cg.add(var.set_is_wrgb(config[CONF_IS_WRGB]))
    cg.add(var.set_use_psram(config[CONF_USE_PSRAM]))
    cg.add(var.set_rmt_symbols(config[CONF_RMT_SYMBOLS]))
    if CONF_USE_DMA in config:
@@ -299,6 +299,7 @@ async def to_code(config):
        "pre:testing_mode.py",
        "pre:exclude_updater.py",
        "pre:exclude_waveform.py",
+        "pre:relocate_ratetable.py",
    ]
    if not enable_scanf_float:
        extra_scripts.append("pre:remove_float_scanf.py")
@@ -451,6 +452,7 @@ def copy_files() -> None:
        "exclude_updater",
        "exclude_waveform",
        "remove_float_scanf",
+        "relocate_ratetable",
    ):
        copy_file_if_changed(
            dir / f"{script}.py.script",
--- a/Show More
+++ b/Show More