Check the unknown name no-op before any select write so no timer can race it

Co-authored-by: Claude Code <noreply@anthropic.com>

.agents/skills/display-test/SKILL.md

@@ -0,0 +1,156 @@
+---
+name: display-test
+description: Test an ESPHome display driver on a real panel with a camera. Use when a task asks to verify a display (LCD, e-paper, OLED, RLCD) on hardware, check orientation/rotation, partial updates, colours, contrast, or that text and shapes render correctly. Covers finding the USB port, flashing a test pattern, capturing the panel with any camera, and reading the photo.
+allowed-tools: Read, Write, Edit, Bash, Glob, Grep
+---
+
+# Display testing with a camera
+
+Point a camera at the panel to get visual evidence that a driver renders correctly. Any camera
+and capture tool works; this skill covers the common ones. `$SKILL` below is this directory
+(`.agents/skills/display-test`).
+
+## Ask before using a camera
+
+A camera can show people and rooms, not only the panel. Before the first capture, ask the user
+for permission and for which camera to use. List the cameras the host has (the commands below
+show how), name the one you intend to use, and wait for the user to confirm it. Do not pick a
+camera yourself, and do not fall back to another camera if the chosen one fails; ask again.
+
+The permission covers this session and the camera the user named. Ask again for a different
+camera or in a new session. If the user declines, stop and report that the display was not
+checked visually.
+
+## Capturing a frame
+
+Grab a still image, skipping the first few frames so auto-exposure and white balance settle.
+Read the JPEG with the Read tool; the image is shown visually.
+
+### macOS
+
+The bundled Swift tool uses AVFoundation and avoids the frame-grabbing problems some USB
+cameras have with other tools:
+
+```bash
+mkdir -p /tmp/camsnap /tmp/display-test
+swiftc -O "$SKILL/scripts/camsnap.swift" -o /tmp/camsnap/camsnap
+/tmp/camsnap/camsnap <camera-name-substring> /tmp/display-test/after.jpg 30
+```
+
+The camera argument is a case-insensitive substring of the name AVFoundation reports. If it does
+not match, the tool lists the cameras it found, so a run with a name that matches nothing lists
+the cameras without capturing. Use a substring that matches only the camera the user approved.
+It creates the output directory if needed and reports encoding or write errors on stderr. Other
+options include `ffmpeg` with `avfoundation` input, `imagesnap`, or Photo Booth's still capture.
+
+### Linux
+
+Use `ffmpeg` with the v4l2 input, `fswebcam`, or `v4l2-ctl`. With `ffmpeg`, `-ss 2` after the
+input discards the first two seconds of frames while exposure settles:
+
+```bash
+mkdir -p /tmp/display-test
+ffmpeg -f v4l2 -i /dev/video0 -ss 2 -frames:v 1 -y /tmp/display-test/after.jpg
+# or
+fswebcam -d /dev/video0 --skip 10 /tmp/display-test/after.jpg
+```
+
+List devices with `v4l2-ctl --list-devices`.
+
+### Windows
+
+Use `ffmpeg` with the DirectShow input (`-ss 2` skips the first frames, as on Linux), or any
+camera application that can save a still image:
+
+```powershell
+mkdir C:\temp -Force | Out-Null
+ffmpeg -f dshow -list_devices true -i dummy   # find the device name
+ffmpeg -f dshow -i video="<device name>" -ss 2 -frames:v 1 -y C:\temp\after.jpg
+```
+
+### Camera caveats
+
+- The board may sit at an angle. Do not trust absolute pixel positions or aspect ratios from the
+  photo; judge orientation, ordering and approximate spacing, using the corner markers as
+  references.
+- Reflections or a glossy cover can brighten one side. Capture again if a region is unclear.
+- A moving pattern is caught at an arbitrary phase. Take several captures, or use a static marker
+  per position.
+
+## Board and port
+
+Find the port; names change on every replug:
+
+```bash
+python3 "$SKILL/../hardware-test/scripts/ports.py"
+```
+
+Native-USB ESP32-S3/C3/C6/H2 boards show up as `USB JTAG/serial debug unit` and need
+`logger: hardware_uart: USB_SERIAL_JTAG`.
+
+## Test pattern
+
+Write a scratch config outside the checkout. Use one `name:` per board and include:
+
+- a white background, a black border and a filled square at the centre, drawn in the first
+  update (full-window check and scale);
+- a 60x20 bar near each corner, one bar per later update with `auto_clear_enabled: false`, so
+  each bar is written by its own partial window. The bars are wider than tall, which shows a
+  90 or 270 degree rotation; the corners exercise the window alignment;
+- a 20x20 square under the left end of the top-left bar, drawn in the same update, which marks
+  the top-left corner and shows a 180 degree rotation or a mirrored image.
+
+Use `Color::BLACK` and `Color::WHITE` in lambdas. Do not use the old `COLOR_OFF`/`COLOR_ON`
+constants; black must mean black.
+
+A ready template is in `$SKILL/templates/display-pattern.yaml`. Substitute the display platform,
+pins and (for a driver with fonts) a font. The marker pattern needs no font.
+
+## Build, flash, capture
+
+Run from the worktree under test so `python -m esphome` imports the checkout, not an installed
+copy:
+
+```bash
+cd <worktree>
+python3 -c "import esphome; print(esphome.__file__)"   # must print the worktree path
+PYTHONUNBUFFERED=1 python3 -m esphome compile /tmp/display-test/display-pattern.yaml
+PYTHONUNBUFFERED=1 python3 -m esphome upload /tmp/display-test/display-pattern.yaml \
+  --device /dev/cu.usbmodemXXXX
+sleep 6   # boot plus a few update intervals
+<capture command> /tmp/display-test/after.jpg
+```
+
+The device path differs by OS and host; use the path printed by `ports.py`. If the USB console
+wedges during flashing (esptool `No serial data received`), replug the board and retry. A board
+powered only by a battery may need the USB cable for flashing; the panel keeps its image when
+power is removed, which is useful for checking that an image is bistable.
+
+## What to check
+
+1. **Orientation**: the extra square sits under the bar in the expected top-left corner. If it is
+   in another corner, the image is rotated or mirrored. Test `rotation:` values with the same
+   pattern. The logical width and height swap at 90 and
+   270 degrees, so the 60x20 corner bars should then appear taller than wide on the physical
+   panel.
+2. **Coverage**: the border touches all four edges, with no dead rows or columns at the edges.
+3. **Partial updates**: with `auto_clear_enabled: false`, draw one marker per update. Each should
+   appear exactly at its requested position with no smearing, offset or mirrored placement.
+   Include all four corners.
+4. **Text and contrast**: sharp glyphs, correct polarity (black text on white, not inverted), no
+   ghosting from the previous frame.
+5. **Speed**: if the driver logs transfer sizes, check that a full refresh and a partial window
+   take the expected times.
+
+Record the build commit, board, config, and the captured image path when reporting results.
+
+## When a partial update looks wrong
+
+Take a marker-only capture before assuming the mapping is wrong: the camera's perspective makes
+absolute positions deceptive. If markers land in mirrored positions, the controller's address
+order (`MADCTL` MX/MY/MV) or the RAM block mapping is inverted for the window; verify the
+full-frame path separately, then fix the window computation.
+
+## Add findings
+
+Add new capture tools, panel quirks, or recovery steps here so the next session starts ahead.

.agents/skills/display-test/scripts/camsnap.swift

@@ -0,0 +1,71 @@
+// camsnap <camera name substring> <output.jpg> [frames to skip]
+// macOS only: grabs one frame from an AVFoundation camera after letting exposure settle.
+// See SKILL.md for capture tools on other systems.
+import AVFoundation
+import AppKit
+import CoreImage
+
+let args = CommandLine.arguments
+guard args.count >= 3 else {
+  FileHandle.standardError.write("usage: camsnap <camera name> <out.jpg> [skip]\n".data(using: .utf8)!)
+  exit(2)
+}
+let wanted = args[1].lowercased()
+let outPath = args[2]
+let skip = args.count > 3 ? Int(args[3]) ?? 30 : 30
+
+let discovery = AVCaptureDevice.DiscoverySession(
+  deviceTypes: [.external, .builtInWideAngleCamera], mediaType: .video, position: .unspecified)
+guard let device = discovery.devices.first(where: { $0.localizedName.lowercased().contains(wanted) }) else {
+  let names = discovery.devices.map { $0.localizedName }.joined(separator: ", ")
+  FileHandle.standardError.write("no camera matching '\(wanted)'; found: \(names)\n".data(using: .utf8)!)
+  exit(1)
+}
+
+final class Grabber: NSObject, AVCaptureVideoDataOutputSampleBufferDelegate {
+  var seen = 0
+  let skip: Int
+  let out: String
+  init(skip: Int, out: String) { self.skip = skip; self.out = out }
+  func captureOutput(_ output: AVCaptureOutput, didOutput sampleBuffer: CMSampleBuffer,
+                     from connection: AVCaptureConnection) {
+    seen += 1
+    guard seen > skip, let pixels = CMSampleBufferGetImageBuffer(sampleBuffer) else { return }
+    let image = CIImage(cvPixelBuffer: pixels)
+    let rep = NSBitmapImageRep(ciImage: image)
+    guard let jpeg = rep.representation(using: .jpeg, properties: [.compressionFactor: 0.9]) else {
+      FileHandle.standardError.write("failed to encode \(out) as JPEG\n".data(using: .utf8)!)
+      exit(1)
+    }
+    let url = URL(fileURLWithPath: out)
+    try? FileManager.default.createDirectory(
+      at: url.deletingLastPathComponent(), withIntermediateDirectories: true)
+    do {
+      try jpeg.write(to: url)
+    } catch {
+      FileHandle.standardError.write("failed to write \(out): \(error)\n".data(using: .utf8)!)
+      exit(1)
+    }
+    print("saved \(out) after \(seen) frames")
+    exit(0)
+  }
+}
+
+let session = AVCaptureSession()
+session.sessionPreset = .high
+guard let input = try? AVCaptureDeviceInput(device: device), session.canAddInput(input) else {
+  FileHandle.standardError.write("cannot open \(device.localizedName)\n".data(using: .utf8)!)
+  exit(1)
+}
+session.addInput(input)
+let output = AVCaptureVideoDataOutput()
+output.videoSettings = [kCVPixelBufferPixelFormatTypeKey as String: kCVPixelFormatType_32BGRA]
+let grabber = Grabber(skip: skip, out: outPath)
+output.setSampleBufferDelegate(grabber, queue: DispatchQueue(label: "camsnap"))
+session.addOutput(output)
+session.startRunning()
+DispatchQueue.main.asyncAfter(deadline: .now() + 15) {
+  FileHandle.standardError.write("timed out waiting for frames\n".data(using: .utf8)!)
+  exit(1)
+}
+RunLoop.main.run()

.agents/skills/display-test/templates/display-pattern.yaml

@@ -0,0 +1,43 @@
+# Display test pattern: corner markers, centre reference and partial-update markers.
+# Replace the display platform and pins with the driver under test.
+esphome:
+  name: display-pattern
+
+esp32:
+  board: esp32-s3-devkitc-1
+  framework:
+    type: esp-idf
+
+logger:
+  hardware_uart: USB_SERIAL_JTAG
+  level: DEBUG
+
+spi:
+  clk_pin: GPIO11
+  mosi_pin: GPIO12
+
+display:
+  - platform: st7305
+    id: test_display
+    cs_pin: GPIO40
+    dc_pin: GPIO5
+    reset_pin: GPIO41
+    update_interval: 1s
+    auto_clear_enabled: false
+    lambda: |-
+      static int frame = 0;
+      if (frame == 0) {
+        it.fill(Color::WHITE);
+        it.rectangle(0, 0, it.get_width(), it.get_height(), Color::BLACK);
+        it.filled_rectangle(it.get_width() / 2 - 10, it.get_height() / 2 - 10, 20, 20, Color::BLACK);
+      } else if (frame == 1) {
+        it.filled_rectangle(20, 20, 60, 20, Color::BLACK);
+        it.filled_rectangle(20, 50, 20, 20, Color::BLACK);
+      } else if (frame == 2) {
+        it.filled_rectangle(20, it.get_height() - 40, 60, 20, Color::BLACK);
+      } else if (frame == 3) {
+        it.filled_rectangle(it.get_width() - 80, 20, 60, 20, Color::BLACK);
+      } else if (frame == 4) {
+        it.filled_rectangle(it.get_width() - 80, it.get_height() - 40, 60, 20, Color::BLACK);
+      }
+      frame++;

.agents/skills/hardware-test/SKILL.md

@@ -115,7 +115,7 @@ Per-topic scripts, each described in the matching `reference/recipes/<component>
 (host driver, Zephyr driver probe), `rtsp_server/` (protocol client, raw rate reader, measurement set,
 API image grab), `cse7766/` (API observer with ping), `zephyr_coredump/` (reader flow, decode with the
 Zephyr tools), `libretiny_prefs/` (rtc preference harness header), `libretiny_crash/` (BK72xx crash probe header and
-capture decoder), `api_outgoing/` (wake cycle and Wi-Fi drop timing readers), `ld2450/` (zone number driver), `dfrobot_sen0395/` (API driver and case runner), `homeassistant_light/` (direct bulb driver, held-report case driver), `usb_audio/` (URL player), `speaker_media_player/` (API player driver, pipeline task case runner), `web_server/` (SSE client, request mix, SSE and HTTPD case runners), `mqtt/` (broker config with WebSocket listeners, test CA, transport case runner).
+capture decoder), `api_outgoing/` (wake cycle and Wi-Fi drop timing readers), `ld2450/` (zone number driver), `dfrobot_sen0395/` (API driver and case runner), `homeassistant_light/` (direct bulb driver, held-report case driver), `usb_audio/` (URL player), `speaker_media_player/` (API player driver, pipeline task case runner), `web_server/` (SSE client, request mix, SSE and HTTPD case runners), `mqtt/` (broker config with TLS, client-certificate and WebSocket listeners, test CA with server and client certificates, transport case runner, flash-and-drive runner, CLI TLS check without a board), `udp/` (datagram recorder, `udp.write` payload checker and case driver), `entity_icons/` (icon and device class readback over the API, MQTT discovery, web_server and dump_config, with a comparer).
 
 ## Templates in `$SKILL/templates`
 
@@ -132,11 +132,14 @@ capture decoder), `api_outgoing/` (wake cycle and Wi-Fi drop timing readers), `l
   `globals-storage-dut.yaml`, `usb-audio-waveshare-s3-eth-dut.yaml`, `usb-audio-sendspin-s3-eth-dut.yaml`,
   `cast-pro-1-sendspin-control.yaml`, `aux-2-preprod-stock-dut.yaml`, `aux-2-preprod-usb-audio-dut.yaml`,
   `dfrobot-sen0395-dut.yaml`, `aux-2-preprod-speaker-player-dut.yaml`, `web-server-sse-dut.yaml`,
-  `mqtt-transport-dut.yaml`.
+  `mqtt-transport-dut.yaml`, `mqtt-tls-dut.yaml`, `udp-write-dut.yaml`, `entity-icon-dut.yaml`.
 
 ## When something looks wrong
 
 - A capture stopped early or a line is missing: check the timestamps before trusting it.
+- A script that pipes into `tee` never ends although its work is done: a background command written as
+  `(cd dir && server & echo $!)` backgrounds the whole `cd && server` list, so a shell stays behind holding the
+  pipe open and `$!` is that shell, not the server. Write `(cd dir && exec server > out 2>&1 < /dev/null) &`.
 - The client never joins the AP: another board may still run an AP with the same SSID, or the device
   booted with saved credentials because the name was reused. One AP device at a time on the bench.
 - Builds come out byte-identical between branches: the wrong tree was imported (rule 3). The reverse

.agents/skills/hardware-test/reference/recipes/README.md

@@ -11,14 +11,14 @@ One file per component, named after it:
 - [`hdmi_cec.md`](hdmi_cec.md): two-board wire
 - [`ld2450.md`](ld2450.md): polygon zones, zone number round trip through the radar's readback
 - [`libretiny.md`](libretiny.md): rtc preference emulation, BK72xx crash report on the next boot
-- [`mqtt.md`](mqtt.md): broker bench, QoS, reconnect, crash log over MQTT, WebSocket transports with a local and a public broker
+- [`mqtt.md`](mqtt.md): broker bench, QoS, reconnect, crash log over MQTT, WebSocket transports with a local and a public broker, TLS trust sources (own CA, client certificate, certificate bundle, no verification) with the CLI check
 - [`nrf52.md`](nrf52.md): dongle board support
 - [`online_image.md`](online_image.md): stalled and malformed downloads
 - [`openthread.md`](openthread.md): border router on the S3 host plus H2 RCP
 - [`ota.md`](ota.md): overlap and lock, timeouts, deflate
 - [`rtsp_server.md`](rtsp_server.md): camera streaming on the Waveshare ESP32-S3-ETH
 - [`scheduler.md`](scheduler.md): loop wake A/B
-- [`udp.md`](udp.md): datagrams, multicast, sockets
+- [`udp.md`](udp.md): datagrams, multicast, sockets, `udp.write` payload shapes
 - [`usb_cdc_acm.md`](usb_cdc_acm.md): nRF52840 dongle host driver
 - [`wifi.md`](wifi.md): reboot_timeout with a fallback AP, DHCP lease cache, Easy Connect (DPP)
 - [`zephyr.md`](zephyr.md): preferences on the nRF52840 dongle
@@ -29,4 +29,4 @@ One file per component, named after it:
 - [`usb_audio.md`](usb_audio.md): USB audio speaker and microphone, the usb_host FIFO split, and Music Assistant playback through sendspin
 - [`dfrobot_sen0395.md`](dfrobot_sen0395.md): SEN0395 mmWave command flow, module quirks and overlong lines through its error reply
 - [`speaker.md`](speaker.md): media player pipeline tasks on the Connect AUX-2 with the `speaker` platform player
-- [`web_server.md`](web_server.md): state SSE stress and the HTTPD task stack on web_server_idf
+- [`web_server.md`](web_server.md): state SSE stress and the HTTPD task stack on web_server_idf, entity icon and device class readback

.agents/skills/hardware-test/reference/recipes/mqtt.md

@@ -20,7 +20,7 @@ the TLS listener's certificate, both run in the scratch directory so keys, logs
 to `NAME/#`, sends a switch command and an `on_message` topic, presses the 3000 byte publish button over the API,
 restarts the local broker when the last argument is `restart` (the PID in `mosquitto.pid`, written when the broker
 was started with `mosquitto -c mosquitto-ws.conf & echo $! > mosquitto.pid` in the working directory next to the
-certificates), checks its three ports answer again, and prints the broker's message counts with the device log. `mosquitto_sub` cannot speak
+certificates), checks every listener in the broker config answers again, and prints the broker's message counts with the device log. `mosquitto_sub` cannot speak
 WebSocket, so it subscribes on the plain listener of the same broker. Cases: `tcp` on 1883, `ws` on 9001, `wss` on
 9002 with `certificate_authority` (the certificate names an address, so `skip_cert_cn_check: true`), `wss` to
 test.mosquitto.org on 8081 with no CA for the certificate bundle, and two negatives that must never connect: a
@@ -29,3 +29,25 @@ different CA (`mbedtls_ssl_handshake returned -0x2700`) and the self-signed serv
 default in the generated sdkconfig. The TLS session costs about 29 kB of internal heap while connected; the public
 broker carries other devices' `esphome/discover` traffic, which is noise. Results:
 https://github.com/esphome/esphome/pull/16056#issuecomment-6301034019
+
+## TLS trust sources on ESP-IDF (#14318)
+
+One build per trust source from `templates/mqtt-tls-dut.yaml`: broker only (port must resolve to 1883),
+`certificate_authority` with no port (must resolve to 8883), `verify_ssl: false` with no CA, the CA plus
+`client_certificate` and `client_certificate_key` on the 8884 listener that requires one, `transport: wss` with the CA,
+`tls: true` to test.mosquitto.org on 8886 for the certificate bundle, and `tls: true` to the local self-signed broker as
+the negative. `scripts/mqtt/mosquitto-ws.conf` now has the 8883 and 8884 listeners and `scripts/mqtt/make_test_ca.sh`
+also writes `client.crt`/`client.key`. Before flashing, check each build's `src/esphome/core/defines.h` for
+`USE_MQTT_TLS`, `USE_MQTT_CERT_BUNDLE` and `USE_MQTT_TLS_INSECURE` and its `sdkconfig.<name>` for
+`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE` and `CONFIG_ESP_TLS_INSECURE`: only the bundle builds may carry the bundle and only
+the unverified build the insecure flags. `scripts/mqtt/flash_and_drive.sh TREE YAML PORT KEY BROKER_HOST
+local|public|neg` runs one build end to end (flash, bounded capture, `cases.sh` with a restart for the local broker,
+counts and the broker's per-listener connection lines) and prints the config dump's `TLS:` line (`CA certificate`,
+`certificate bundle` or `no verification`). The CLI side (`esphome/mqtt.py`) is covered without a board by
+`scripts/mqtt/cli_tls_check.sh TREE [neg] YAML...`, which runs `esphome clean-mqtt` under a timeout: status 124
+after `Connected to MQTT broker!` is a pass, and with `neg` each config must instead fail with
+`CERTIFICATE_VERIFY_FAILED` and never connect. Python's default SSL
+context rejects a CA that lacks a `keyUsage` extension (`CA cert does not include key usage extension`) while mbedTLS
+on the device accepts it, which is why the test CA carries `basicConstraints` and `keyUsage`. A broker kill shows as one
+`Last esp-tls error: 0x8008` on every build, TLS or not. Results:
+https://github.com/esphome/esphome/pull/14318#issuecomment-6311863827

.agents/skills/hardware-test/reference/recipes/udp.md

@@ -9,3 +9,18 @@ listener. Broadcast to boards is lossy under power save, unicast is not. Flood a
 reconnect on the Pico keeps IGMP membership. Set a long loop interval from `wifi.on_connect`
 (`App.set_loop_interval(20000)`), not `on_boot`, or Wi-Fi connect crawls. The `logger.log` action
 rejects `%.*s`; use a lambda.
+
+## udp.write payload shapes (#21263, ApplyBytes)
+
+`templates/udp-write-dut.yaml` puts every payload shape behind a template button (constant 4 bytes twice, 3, 9, 0,
+128, 129 and 600 bytes, a 300 byte lambda, a simple value, a string) plus an `on_receive` that replies with the
+received bytes reversed. `scripts/udp/write_cases.sh DEVICE_IP KEY` records the device's datagrams with
+`udp_listen.py` on the test host, presses the buttons two seconds apart, sends one unicast datagram for the echo and
+compares everything byte for byte with `check.py`; a missing datagram shifts every later one, so read the first
+mismatch. Before flashing, check the generated `main.cpp`: on ESP8266 a constant payload is copied out of its
+`PROGMEM` table into `uint8_t esphome__bytes[N]` up to the stack limit and into `std::make_unique<uint8_t[]>` beyond,
+identical payloads share one table, a lambda is sent from its vector. An empty constant payload is generated as
+`send_packet(nullptr, 0)`, and the raw lwIP UDP `sendto` used on ESP8266 rejected a null buffer with `EINVAL`
+(`sendto() error 22` in the log, no datagram) until it accepted `nullptr` with a zero length; the old
+`TemplatableBytes::visit` had passed a zero length stack buffer instead. Compare sizes against the stacked PR's own
+head when the PR is stacked, not against dev. Results: https://github.com/esphome/esphome/pull/21263

.agents/skills/hardware-test/reference/recipes/web_server.md

@@ -29,3 +29,32 @@ clients. Entity URLs use the entity name, URL encoded, not an object id. The HTT
 request of the boot; compare after the mix and after the SSE round, with two boots when the numbers are close.
 Results: https://github.com/esphome/esphome/pull/21109#issuecomment-6300582328 and
 https://github.com/esphome/esphome/pull/21038#issuecomment-6301310182
+
+## Entity icon and device class readback (#21111)
+
+Covers every path that reads an entity's icon or device class: the native API listing, MQTT discovery, the web_server
+`/events` listing and REST endpoints, and `dump_config`. `templates/entity-icon-dut.yaml` (ESP8266 board with wifi,
+encrypted api, ota, web_server and mqtt against a local broker) carries a sensor with a 63 character icon, one with no
+icon or device class, an internal sensor, and binary_sensor, switch, button, text_sensor, number, select, event, cover
+and text entities with icons and device classes. The per-run file supplies `name` and `broker_ip` through
+substitutions. Flash the PR and base builds under different names, then from the scratch directory:
+
+```sh
+scripts/entity_icons/readback.sh DEVICE_IP KEY NAME BROKER_HOST cap-NAME.txt   # once per build
+scripts/entity_icons/compare.sh ic-base ic-pr                                   # api, web, mqttn, dump all identical
+```
+
+`readback.sh` takes about 25 s once the device is on the network: 12 s of `mosquitto_sub` on `homeassistant/#` and
+`NAME/#`, the API listing (`api_list.py`, one JSON line per entity with icon, device class, unit, options and event
+types) and `web_dump.py` (6 s on `/events`, keeping only the listing rows that carry `domain`, then a GET of each
+listed id with `?detail=all` and one retry, because the ESP8266 async server occasionally leaves a request unanswered
+within 5 s). The web ids are `domain/Name`, not object ids, and `/event/<name>` has no GET handler (404 on every
+build). `mqtt_norm.py` drops the `dev` block (compile time) and the `NAME/debug` topic (heap probe), so a clean run
+differs in nothing. `dump_config` prints icons and device classes only for some domains; button, event and
+binary_sensor icons never appear there.
+
+Found with this flow on 2026-10-21: since #19577 every ESP8266 `web_server` build that lists a cover, climate, lock,
+valve, update, alarm_control_panel or water_heater entity reboots with `Exception (3) LoadStoreErr` in
+`json::linked(const char *)` (the ROM `strlen` on a flash address), fixed by #21316. The cover in the template keeps
+that path covered; before #21316 is merged, apply its one line change to both trees or the web_server comparison
+cannot run.

.agents/skills/hardware-test/scripts/entity_icons/api_list.py

@@ -0,0 +1,56 @@
+"""List every entity over the native API with its icon, device class and unit: one sorted JSON line each.
+
+usage: api_list.py HOST KEY OUT
+"""
+
+import asyncio
+import json
+import pathlib
+import sys
+
+from aioesphomeapi import APIClient
+
+HOST, KEY, OUT = sys.argv[1], sys.argv[2], sys.argv[3]
+
+
+async def main() -> None:
+    c = APIClient(HOST, 6053, None, noise_psk=KEY)
+    await c.connect(login=True)
+    ents, _ = await c.list_entities_services()
+    rows = []
+    for e in ents:
+        row = {
+            "type": type(e).__name__,
+            "name": e.name,
+            "object_id": e.object_id,
+            "icon": e.icon,
+        }
+        for k in (
+            "device_class",
+            "unit_of_measurement",
+            "event_types",
+            "options",
+            "mode",
+        ):
+            if hasattr(e, k):
+                v = getattr(e, k)
+                row[k] = (
+                    list(v)
+                    if isinstance(v, (list, tuple))
+                    else (v.name if hasattr(v, "name") else v)
+                )
+        row["entity_category"] = (
+            e.entity_category.name
+            if hasattr(e.entity_category, "name")
+            else e.entity_category
+        )
+        row["disabled_by_default"] = e.disabled_by_default
+        rows.append(row)
+    rows.sort(key=lambda r: (r["type"], r["name"]))
+    with pathlib.Path(OUT).open("w", encoding="utf-8") as f:
+        f.writelines(json.dumps(r, sort_keys=True) + "\n" for r in rows)
+    print(f"{len(rows)} entities listed")
+    await c.disconnect()
+
+
+asyncio.run(main())

.agents/skills/hardware-test/scripts/entity_icons/compare.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+# compare.sh NAME_A NAME_B : diff the readback.sh outputs of two device names (api, web, mqttn and, when present, dump)
+# after replacing each name with DEV. Exit 1 when any pair differs; the diffs stay in cmp-KIND.diff.
+A=$1; B=$2; rc=0
+[ -n "$A" ] && [ -n "$B" ] || { echo "usage: compare.sh NAME_A NAME_B"; exit 2; }
+for k in api web mqttn dump; do
+  ext=jsonl; [ $k = dump ] && ext=txt
+  [ -f "$PWD/$k-$A.$ext" ] && [ -f "$PWD/$k-$B.$ext" ] || { echo "$k: missing"; [ $k = dump ] || rc=1; continue; }
+  sed "s/$A/DEV/g; s/$(echo "$A" | tr - _)/DEV/g" "$PWD/$k-$A.$ext" > "$PWD/cmp-$k-a.txt"
+  sed "s/$B/DEV/g; s/$(echo "$B" | tr - _)/DEV/g" "$PWD/$k-$B.$ext" > "$PWD/cmp-$k-b.txt"
+  if diff -u "$PWD/cmp-$k-a.txt" "$PWD/cmp-$k-b.txt" > "$PWD/cmp-$k.diff"; then echo "$k: identical ($(wc -l < "$PWD/cmp-$k-b.txt" | tr -d ' ') lines)"; else echo "$k: DIFFERS"; head -20 "$PWD/cmp-$k.diff"; rc=1; fi
+done
+exit $rc

.agents/skills/hardware-test/scripts/entity_icons/mqtt_norm.py

@@ -0,0 +1,37 @@
+"""Normalise mosquitto_sub output (topic TAB payload) for one device: drop other devices, replace the name, drop dev block.
+
+usage: mqtt_norm.py IN NAME OUT
+"""
+
+import json
+import pathlib
+import sys
+
+IN, NAME, OUT = sys.argv[1], sys.argv[2], sys.argv[3]
+rows = {}
+with pathlib.Path(IN).open(encoding="utf-8") as f:
+    for line in f:
+        topic, _, payload = line.rstrip("\n").partition("\t")
+        if (
+            f"/{NAME}/" not in topic and not topic.startswith(f"{NAME}/")
+        ) or topic == f"{NAME}/debug":
+            continue
+        topic = topic.replace(NAME, "DEV")
+        try:
+            obj = json.loads(payload)
+        except ValueError:
+            rows[topic] = payload.replace(NAME, "DEV")
+            continue
+        if isinstance(obj, dict):
+            obj.pop("dev", None)
+            obj = {
+                k: (v.replace(NAME, "DEV") if isinstance(v, str) else v)
+                for k, v in obj.items()
+            }
+        rows[topic] = obj
+with pathlib.Path(OUT).open("w", encoding="utf-8") as f:
+    f.writelines(
+        json.dumps({"topic": t, "payload": rows[t]}, sort_keys=True) + "\n"
+        for t in sorted(rows)
+    )
+print(f"{len(rows)} topics for {NAME}")

.agents/skills/hardware-test/scripts/entity_icons/readback.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# readback.sh DEVICE_IP KEY NAME BROKER_HOST [CAPTURE] : record how a device built from templates/entity-icon-dut.yaml
+# reports its entity icons and device classes: the native API listing (api-NAME.jsonl), the retained MQTT discovery
+# payloads and states (mqtt-NAME.txt, normalised to mqttn-NAME.jsonl with the device name replaced and the debug topic
+# dropped), the web_server /events listing plus every REST endpoint with ?detail=all (web-NAME.jsonl) and, when a
+# serial CAPTURE is given, the dump_config Icon and Device Class lines (dump-NAME.txt, timestamps and line numbers
+# removed). KEY as for api_button.py. Outputs go to the working directory; compare two names with compare.sh.
+HERE=$(cd "$(dirname "$0")" && pwd); PY=${PYTHON:-python3}; DEV=$1; KEY=$2; N=$3; B=$4; CAP=$5; rc=0; TAB=$(printf '\t')
+[ -n "$DEV" ] && [ -n "$KEY" ] && [ -n "$N" ] && [ -n "$B" ] || { echo "usage: readback.sh DEVICE_IP KEY NAME BROKER_HOST [CAPTURE]"; exit 2; }
+timeout 12 mosquitto_sub -h "$B" -v -t 'homeassistant/#' -t "$N/#" -F "%t$TAB%p" > "$PWD/mqtt-$N.txt" 2> "$PWD/mqtt-$N.err"
+$PY "$HERE/mqtt_norm.py" "$PWD/mqtt-$N.txt" "$N" "$PWD/mqttn-$N.jsonl" || rc=1
+$PY "$HERE/api_list.py" "$DEV" "$KEY" "$PWD/api-$N.jsonl" || { echo "API listing failed"; rc=1; }
+$PY "$HERE/web_dump.py" "$DEV" "$PWD/web-$N.jsonl" || { echo "web_server dump failed"; rc=1; }
+if [ -n "$CAP" ]; then
+  LC_ALL=C grep -a '\]:   Icon: \|\]:   Device Class: ' "$CAP" | LC_ALL=C sed 's/\x1b\[[0-9;]*m//g; s/^\[[^]]*\]//; s/:[0-9]*\]:/]:/' | sort > "$PWD/dump-$N.txt"
+  echo "dump_config icon lines $(grep -c 'Icon:' "$PWD/dump-$N.txt"), device class lines $(grep -c 'Device Class:' "$PWD/dump-$N.txt")"
+fi
+exit $rc

.agents/skills/hardware-test/scripts/entity_icons/web_dump.py

@@ -0,0 +1,99 @@
+"""Dump the web_server view of every entity: the /events listing (detail all) and each REST endpoint with ?detail=all.
+
+usage: web_dump.py HOST OUT
+"""
+
+import json
+import pathlib
+import socket
+import sys
+import time
+import urllib.parse
+import urllib.request
+
+HOST, OUT = sys.argv[1], sys.argv[2]
+
+
+def sse_listing(seconds: float) -> list[dict]:
+    s = socket.create_connection((HOST, 80), timeout=5)
+    s.sendall(
+        b"GET /events HTTP/1.1\r\nHost: %s\r\nAccept: text/event-stream\r\n\r\n"
+        % HOST.encode()
+    )
+    buf = b""
+    deadline = time.monotonic() + seconds
+    s.settimeout(1.0)
+    while time.monotonic() < deadline:
+        try:
+            data = s.recv(65536)
+        except TimeoutError:
+            continue
+        if not data:
+            break
+        buf += data
+    s.close()
+    head, _, body = buf.partition(b"\r\n\r\n")
+    if b"chunked" in head.lower():
+        out = b""
+        while True:
+            i = body.find(b"\r\n")
+            if i < 0:
+                break
+            size = int(body[:i].split(b";")[0], 16)
+            out += body[i + 2 : i + 2 + size]
+            body = body[i + 2 + size + 2 :]
+            if size == 0:
+                break
+        body = out
+    rows = []
+    for block in body.decode(errors="replace").split("\n\n"):
+        ev, data = None, None
+        for line in block.split("\n"):
+            line = line.rstrip("\r")
+            if line.startswith("event:"):
+                ev = line[6:].strip()
+            elif line.startswith("data:"):
+                data = line[5:].strip()
+        if ev in ("state", "state_detail_all") and data:
+            try:
+                obj = json.loads(data)
+            except ValueError:
+                rows.append({"event": ev, "invalid": data})
+                continue
+            # bare state updates that land inside the window carry no domain; only the listing rows are kept
+            if "domain" in obj:
+                rows.append({"event": ev, **obj})
+    return rows
+
+
+def get_json(url: str) -> dict:
+    """One retry: the ESP8266 async server occasionally leaves a request unanswered."""
+    for attempt in (1, 2):
+        try:
+            with urllib.request.urlopen(url, timeout=5) as resp:
+                return json.loads(resp.read())
+        except TimeoutError:
+            if attempt == 2:
+                raise
+            print(f"retrying {url}", flush=True)
+    return {}
+
+
+rows = sse_listing(6)
+ids = sorted({r["id"] for r in rows if "id" in r})
+rest = []
+for ident in ids:
+    domain, _, obj = ident.partition("/")
+    url = f"http://{HOST}/{domain}/{urllib.parse.quote(obj)}?detail=all"
+    try:
+        rest.append({"url": url.replace(HOST, "HOST"), **get_json(url)})
+    except Exception as e:  # noqa: BLE001
+        rest.append({"url": url.replace(HOST, "HOST"), "error": str(e)})
+    time.sleep(0.3)
+with pathlib.Path(OUT).open("w", encoding="utf-8") as f:
+    f.writelines(
+        json.dumps(r, sort_keys=True) + "\n"
+        for r in sorted(rows, key=lambda r: (r.get("id", ""), r["event"]))
+    )
+    f.writelines(json.dumps(r, sort_keys=True) + "\n" for r in rest)
+print(f"{len(rows)} sse rows, {len(ids)} ids, {len(rest)} rest rows")

.agents/skills/hardware-test/scripts/mqtt/cases.sh

@@ -24,8 +24,10 @@ if [ "$RESTART" = restart ]; then
   pid=$(cat "$WORK/mosquitto.pid" 2>/dev/null); [ -n "$pid" ] || { echo "no mosquitto.pid in $WORK, cannot restart the broker"; exit 1; }
   kill "$pid" || { echo "broker PID $pid is not running, nothing to restart"; exit 1; }; sleep 8
   nc -z -w 3 "$B" 1883 && { echo "the old broker still answers on 1883 after the kill"; exit 1; }
-  (cd "$WORK" && mosquitto -c mosquitto-ws.conf > mosquitto.out 2>&1 & echo $! > "$WORK/mosquitto.pid"); sleep 25
-  for port in 1883 9001 9002; do nc -z -w 3 "$B" "$port" || { echo "broker port $port not listening after the restart"; exit 1; }; done
+  # exec so the PID is the broker's own and no shell stays behind holding the caller's output pipe open
+  (cd "$WORK" && exec mosquitto -c mosquitto-ws.conf > mosquitto.out 2>&1 < /dev/null) &
+  echo $! > "$WORK/mosquitto.pid"; sleep 25
+  for port in $(awk '/^listener/ {print $2}' "$WORK/mosquitto-ws.conf"); do nc -z -w 3 "$B" "$port" || { echo "broker port $port not listening after the restart"; exit 1; }; done
   tail -n +$((n1+1)) "$LOG" | grep -a -q "MQTT_EVENT_CONNECTED\|\[mqtt:[0-9]*\]: Connected" || { echo "the device did not reconnect after the broker restart"; exit 1; }
 else
   echo "=== $N: no broker restart (pass 'restart' as the 7th argument for a local broker)"

.agents/skills/hardware-test/scripts/mqtt/cli_tls_check.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+# cli_tls_check.sh TREE [neg] YAML... : run `esphome clean-mqtt` from the checkout TREE for each config, which goes
+# through the same TLS setup in esphome/mqtt.py as `esphome logs` over MQTT, without needing a board. clean-mqtt never
+# exits on its own, so it runs under a 25 s timeout: status 124 after "Connected to MQTT broker!" means the CLI
+# connected. With neg every config must instead fail with CERTIFICATE_VERIFY_FAILED and never connect, so a negative
+# that fails for another reason (bad YAML, broker down) is reported as a failure too. A relative YAML path is taken
+# from the working directory, where the cleanmqtt-NAME.log outputs also go. Exit 1 when any config missed its result.
+TREE=$1; shift; PY=${PYTHON:-python3}; NEG=0
+[ "$1" = neg ] && { NEG=1; shift; }
+[ -d "$TREE/esphome" ] && [ -n "$1" ] || { echo "usage: cli_tls_check.sh TREE [neg] YAML..."; exit 2; }
+bad=0
+for y in "$@"; do
+  case $y in /*) ;; *) y=$PWD/$y;; esac
+  n=$(basename "$y" .yaml); log=$PWD/cleanmqtt-$n.log
+  (cd "$TREE" && PYTHONUNBUFFERED=1 timeout 25 $PY -m esphome clean-mqtt "$y" > "$log" 2>&1); rc=$?
+  if [ "$NEG" = 0 ] && [ "$rc" = 124 ] && grep -q "Connected to MQTT broker" "$log"; then
+    echo "$n: connected"
+  elif [ "$NEG" = 1 ] && grep -q "CERTIFICATE_VERIFY_FAILED" "$log" && ! grep -q "Connected to MQTT broker" "$log"; then
+    echo "$n: rejected (CERTIFICATE_VERIFY_FAILED)"
+  else
+    echo "$n: FAILED (status $rc): $(grep -a -m1 -i 'cannot connect\|error' "$log" | cut -c1-160)"; bad=$((bad+1))
+  fi
+done
+[ "$bad" = 0 ]

.agents/skills/hardware-test/scripts/mqtt/flash_and_drive.sh

@@ -0,0 +1,53 @@
+#!/bin/sh
+# flash_and_drive.sh TREE YAML PORT KEY BROKER_HOST MODE [SUB_PORT] : flash YAML from the checkout TREE over the serial
+# PORT, capture the serial log (cap-NAME.txt in the working directory), wait for the first MQTT connect or TLS error,
+# then drive the device with cases.sh (KEY as for cases.sh, - for a plaintext API). MODE local runs cases.sh with a
+# broker restart (the working directory must hold mosquitto-ws.conf and mosquitto.pid), public runs it without a
+# restart, neg only watches for 100 s (a build that must never connect). SUB_PORT is the plain listener cases.sh
+# subscribes on (default 1883). Ends with connect, disconnect, handshake error and crash counts, the config dump's
+# TLS line, the probe heap lines and the broker listener each connection used. Exit 1 when the capture did not start,
+# the device reached no MQTT event within 90 s (local and public), it crashed, or the mode's own check failed.
+TREE=$1; YAML=$2; PORT=$3; KEY=$4; B=$5; MODE=$6; SP=${7:-1883}
+case $YAML in /*) ;; *) YAML=$PWD/$YAML;; esac
+HERE=$(cd "$(dirname "$0")" && pwd); PY=${PYTHON:-python3}; N=$(basename "$YAML" .yaml); CAP=$PWD/cap-$N.txt; ULOG=$PWD/upload-$N.log
+[ -d "$TREE/esphome" ] && [ -e "$PORT" ] && [ -n "$KEY" ] && [ -n "$B" ] || { echo "usage: flash_and_drive.sh TREE YAML PORT KEY BROKER_HOST local|public|neg [SUB_PORT]"; exit 2; }
+case $MODE in local|public|neg) ;; *) echo "MODE must be local, public or neg"; exit 2;; esac
+pkill -f "[s]erial_capture.py $PORT "; sleep 1
+echo "=== $N: flash ($(date +%T))"
+(cd "$TREE" && PYTHONUNBUFFERED=1 timeout 300 $PY -m esphome upload "$YAML" --device "$PORT" > "$ULOG" 2>&1) || { echo "upload failed"; tail -5 "$ULOG"; exit 1; }
+SECS=200; [ "$MODE" = neg ] && SECS=100
+# a stale capture from an earlier run must not satisfy the wait below
+rm -f "$CAP"
+$PY "$HERE/../serial_capture.py" "$PORT" $SECS "$CAP" > "$PWD/cap-$N.stderr" 2>&1 &
+cap_pid=$!
+i=0; until grep -a -q "MQTT_EVENT_CONNECTED\|\[mqtt:[0-9]*\]: Connected\|mbedtls_ssl_handshake returned\|Failed to verify" "$CAP" 2>/dev/null || [ $i -ge 45 ]; do sleep 2; i=$((i+1)); done
+kill -0 $cap_pid 2>/dev/null && [ -f "$CAP" ] || { echo "serial capture is not running on $PORT"; tail -3 "$PWD/cap-$N.stderr"; exit 1; }
+DEV=$(grep -a -o 'IP Address: [0-9.]*' "$CAP" | head -1 | awk '{print $3}')
+if [ $i -ge 45 ] || [ -z "$DEV" ]; then
+  echo "=== $N: no MQTT event or no IP within 90 s ($(date +%T))"
+  [ "$MODE" = neg ] || { pkill -f "[s]erial_capture.py $PORT "; exit 1; }
+else
+  echo "=== $N: first MQTT event after $((i*2)) s, device $DEV ($(date +%T))"
+fi
+grep -a 'ESPHome version\|\]:   Transport\|\]:   TLS:' "$CAP" | sed 's/\x1b\[[0-9;]*m//g' | cut -c1-120
+rc=0
+case $MODE in
+  local)  PYTHON=$PY sh "$HERE/cases.sh" "$N" "$KEY" "$B" "$SP" "$CAP" "$DEV" restart; rc=$?;;
+  public) PYTHON=$PY sh "$HERE/cases.sh" "$N" "$KEY" "$B" "$SP" "$CAP" "$DEV"; rc=$?;;
+  neg)    sleep 70;;
+esac
+wait $cap_pid
+strip() { sed 's/\x1b\[[0-9;]*m//g'; }
+# count the backend's own events so the result does not depend on on_connect/on_disconnect log lines in the config
+connects=$(grep -a -c 'MQTT_EVENT_CONNECTED' "$CAP"); errors=$(grep -a -c 'mbedtls_ssl_handshake returned\|Failed to verify certificate' "$CAP")
+crashes=$(grep -a -c 'Guru\|abort()\|Backtrace' "$CAP")
+echo "=== $N: connects $connects, disconnects $(grep -a -c 'MQTT_EVENT_DISCONNECTED' "$CAP"), handshake errors $errors, crashes $crashes"
+grep -a 'mbedtls_ssl_handshake returned\|Failed to verify\|esp-tls' "$CAP" | strip | sed 's/^\[[^]]*\]//' | sort | uniq -c | sort -rn | head -4 | cut -c1-150
+grep -a '\[probe:' "$CAP" | strip | sed 's/.*\[probe:[0-9]*\]: //' | sed -n '1p;$p'
+[ -f "$PWD/mosquitto.log" ] && [ -n "$DEV" ] && echo "broker listeners used by $DEV: $(grep "New connection from $DEV" "$PWD/mosquitto.log" | sed 's/.*on port //' | sort | uniq -c | tr '\n' ';')"
+[ "$crashes" = 0 ] || { echo "device crashed $crashes time(s)"; exit 1; }
+if [ "$MODE" = neg ]; then
+  [ "$connects" = 0 ] && [ "$errors" -gt 0 ] || { echo "negative case: expected no connect and a handshake error"; exit 1; }
+else
+  [ "$rc" = 0 ] || { echo "cases.sh failed with status $rc"; exit 1; }
+fi

.agents/skills/hardware-test/scripts/mqtt/make_test_ca.sh

@@ -1,13 +1,21 @@
 #!/bin/sh
-# make_test_ca.sh BROKER_IP : a throwaway CA and a server certificate for the broker address (30 days), written into
-# the working directory; run it in the scratch directory where a copy of mosquitto-ws.conf lives. The device
-# config takes ca.crt as certificate_authority (skip_cert_cn_check: true, the name check does not match an address);
-# other-ca.crt is a second CA for the negative case.
+# make_test_ca.sh BROKER_IP : a throwaway CA, a server certificate for the broker address and a client certificate
+# (30 days), written into the working directory; run it in the scratch directory where a copy of mosquitto-ws.conf
+# lives. The device config takes ca.crt as certificate_authority (skip_cert_cn_check: true, the name check does not
+# match an address) and client.crt/client.key as client_certificate/client_certificate_key for the listener that
+# requires one; other-ca.crt is a second CA for the negative case. The CA carries basicConstraints and keyUsage
+# because Python's default SSL context (esphome logs, esphome clean-mqtt) rejects a CA without them.
 set -e
 IP=$1
-openssl req -x509 -newkey rsa:2048 -nodes -keyout ca.key -out ca.crt -days 30 -subj "/CN=hwtest-ca"
+[ -n "$IP" ] || { echo "usage: make_test_ca.sh BROKER_IP"; exit 2; }
+openssl req -x509 -newkey rsa:2048 -nodes -keyout ca.key -out ca.crt -days 30 -subj "/CN=hwtest-ca" \
+  -addext "basicConstraints=critical,CA:TRUE" -addext "keyUsage=critical,keyCertSign,cRLSign"
 openssl req -newkey rsa:2048 -nodes -keyout server.key -out server.csr -subj "/CN=hwtest-broker"
 printf "subjectAltName=IP:%s\nextendedKeyUsage=serverAuth\n" "$IP" > san.ext
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 30 -extfile san.ext
-openssl req -x509 -newkey rsa:2048 -nodes -keyout other-ca.key -out other-ca.crt -days 30 -subj "/CN=other-ca"
-openssl verify -CAfile ca.crt server.crt
+openssl req -newkey rsa:2048 -nodes -keyout client.key -out client.csr -subj "/CN=hwtest-client"
+printf "extendedKeyUsage=clientAuth\n" > client.ext
+openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 30 -extfile client.ext
+openssl req -x509 -newkey rsa:2048 -nodes -keyout other-ca.key -out other-ca.crt -days 30 -subj "/CN=other-ca" \
+  -addext "basicConstraints=critical,CA:TRUE" -addext "keyUsage=critical,keyCertSign,cRLSign"
+openssl verify -CAfile ca.crt server.crt client.crt

.agents/skills/hardware-test/scripts/mqtt/mosquitto-ws.conf

@@ -1,8 +1,20 @@
 # Copy next to the certificates in the scratch directory and start it there with
-# `mosquitto -c mosquitto-ws.conf & echo $! > mosquitto.pid` (cases.sh restarts that PID): plain MQTT, MQTT over WebSocket, and MQTT over WebSocket with TLS (server.crt and
-# server.key from make_test_ca.sh in the same directory). log_type all gives the listener port per connection.
+# `mosquitto -c mosquitto-ws.conf & echo $! > mosquitto.pid` (cases.sh restarts that PID): plain MQTT, MQTT over TLS,
+# MQTT over TLS that requires a client certificate, MQTT over WebSocket, and MQTT over WebSocket with TLS
+# (server.crt, server.key, ca.crt from make_test_ca.sh in the same directory). log_type all gives the listener port
+# per connection.
 listener 1883
 protocol mqtt
+listener 8883
+protocol mqtt
+certfile server.crt
+keyfile server.key
+listener 8884
+protocol mqtt
+certfile server.crt
+keyfile server.key
+cafile ca.crt
+require_certificate true
 listener 9001
 protocol websockets
 listener 9002

.agents/skills/hardware-test/scripts/udp/check.py

@@ -0,0 +1,40 @@
+"""Compare the listener log (JSON lines from udp_listen.py) against the udp-write-dut.yaml payload sequence.
+
+usage: check.py LISTEN_JSONL ECHO_HEX  (ECHO_HEX is the datagram sent to the device for the echo case)
+"""
+
+import json
+import pathlib
+import sys
+
+with pathlib.Path(sys.argv[1]).open(encoding="utf-8") as f:
+    log = [json.loads(line) for line in f if line.strip()]
+echo_in = bytes.fromhex(sys.argv[2])
+small = bytes([0xAA, 0x55, 0x01, 0x02])
+expected = [
+    ("small 1/2", small),
+    ("small 2/2", small),
+    ("simple", bytes([1, 2, 3])),
+    ("text", b"hello udp"),
+    ("empty", b""),
+    ("stack128", bytes((0x10 + i) & 0xFF for i in range(128))),
+    ("heap129", bytes((0x20 + i) & 0xFF for i in range(129))),
+    ("heap600", bytes((0x30 + i) & 0xFF for i in range(600))),
+    ("lambda300", bytes((i * 7) & 0xFF for i in range(300))),
+    ("echo", echo_in[::-1]),
+]
+got = [bytes.fromhex(e["hex"]) for e in log]
+ok = 0
+for i, (name, want) in enumerate(expected):
+    have = got[i] if i < len(got) else None
+    res = (
+        "OK"
+        if have == want
+        else f"MISMATCH got {None if have is None else have[:16].hex() + '... len ' + str(len(have))}"
+    )
+    ok += res == "OK"
+    print(f"{name:10s} {len(want):4d} B  {res}")
+print(
+    f"{ok}/{len(expected)} payloads byte-exact, {len(got)} datagrams received, sources {sorted({e['src'] for e in log})}"
+)
+sys.exit(0 if ok == len(expected) and len(got) == len(expected) else 1)

.agents/skills/hardware-test/scripts/udp/udp_listen.py

@@ -0,0 +1,32 @@
+"""Log every datagram on PORT for SECONDS as one JSON line: time, source, length, hex payload."""
+
+import json
+import pathlib
+import socket
+import sys
+import time
+
+port, secs, out = int(sys.argv[1]), float(sys.argv[2]), sys.argv[3]
+s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+s.bind(("", port))
+s.settimeout(1.0)
+end = time.monotonic() + secs
+with pathlib.Path(out).open("w", encoding="utf-8") as f:
+    while time.monotonic() < end:
+        try:
+            data, (ip, sport) = s.recvfrom(65535)
+        except TimeoutError:
+            continue
+        f.write(
+            json.dumps(
+                {
+                    "t": time.strftime("%H:%M:%S"),
+                    "src": ip,
+                    "len": len(data),
+                    "hex": data.hex(),
+                }
+            )
+            + "\n"
+        )
+        f.flush()

.agents/skills/hardware-test/scripts/udp/write_cases.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+# write_cases.sh DEVICE_IP KEY [PORT] : drive a device built from templates/udp-write-dut.yaml. Records every datagram
+# the device sends to PORT (the udp component's port, default 18511) with udp_listen.py in the working directory,
+# presses the eight payload buttons over the API two seconds apart (KEY as for api_button.py, - for a plaintext API),
+# sends one 16 byte unicast datagram to the device for the echo case, then compares the recorded datagrams with
+# check.py. The recorder runs until the driver stops it. Exit 1 when the recorder did not start or a payload is
+# missing or differs; listen.jsonl stays in the working directory.
+HERE=$(cd "$(dirname "$0")" && pwd); PY=${PYTHON:-python3}; DEV=$1; KEY=$2; PORT=${3:-18511}
+[ -n "$DEV" ] && [ -n "$KEY" ] || { echo "usage: write_cases.sh DEVICE_IP KEY [PORT]"; exit 2; }
+ECHO=0102030405060708090a0b0c0d0e0f10
+rm -f "$PWD/listen.jsonl"
+$PY "$HERE/udp_listen.py" "$PORT" 600 "$PWD/listen.jsonl" &
+lst=$!
+sleep 2
+kill -0 $lst 2>/dev/null || { echo "udp_listen.py is not running on port $PORT"; exit 1; }
+for b in Small Simple Text Empty Stack128 Heap129 Heap600 Lambda300; do
+  $PY "$HERE/../api_button.py" "$DEV" "$KEY" press "$b" > /dev/null || echo "press $b failed"; sleep 2
+done
+$PY -c "import socket; socket.socket(socket.AF_INET, socket.SOCK_DGRAM).sendto(bytes.fromhex('$ECHO'), ('$DEV', $PORT))"
+sleep 5
+kill $lst 2>/dev/null; wait $lst 2>/dev/null
+$PY "$HERE/check.py" "$PWD/listen.jsonl" "$ECHO"

.agents/skills/hardware-test/templates/entity-icon-dut.yaml

@@ -0,0 +1,148 @@
+# Entity icon and device class readback (esphome#21111): the per-run file supplies name and broker_ip through substitutions and includes this file as a package. Every readback path is covered: API listing, MQTT discovery, web_server JSON and dump_config. See reference/recipes/web_server.md.
+esp8266:
+  board: d1_mini
+
+logger:
+  level: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  power_save_mode: none
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+web_server:
+  port: 80
+
+mqtt:
+  broker: ${broker_ip}
+  reboot_timeout: 0s
+
+interval:
+  - interval: 10s
+    then:
+      - lambda: |-
+          ESP_LOGI("probe", "free heap %u, max block %u", (unsigned) ESP.getFreeHeap(), (unsigned) ESP.getMaxFreeBlockSize());
+
+esphome:
+  name: ${name}
+
+sensor:
+  - platform: template
+    name: Temp
+    id: temp
+    device_class: temperature
+    unit_of_measurement: "°C"
+    icon: mdi:thermometer
+    accuracy_decimals: 1
+    lambda: return 21.5;
+    update_interval: 30s
+  - platform: template
+    name: Long Icon
+    id: long_icon
+    icon: mdi:this-icon-name-is-exactly-sixty-three-characters-long-abcde
+    device_class: humidity
+    unit_of_measurement: "%"
+    lambda: return 40.0;
+    update_interval: 30s
+  - platform: template
+    name: Plain
+    id: plain
+    lambda: return 1.0;
+    update_interval: 30s
+  - platform: template
+    name: Hidden
+    id: hidden
+    internal: true
+    icon: mdi:eye-off
+    device_class: power
+    lambda: return 2.0;
+    update_interval: 30s
+
+binary_sensor:
+  - platform: template
+    name: Motion
+    id: motion
+    device_class: motion
+    icon: mdi:motion-sensor
+    lambda: return false;
+
+switch:
+  - platform: template
+    name: Relay
+    id: relay
+    device_class: outlet
+    icon: mdi:power-plug
+    optimistic: true
+
+button:
+  - platform: template
+    name: Reboot
+    id: reboot_btn
+    device_class: restart
+    icon: mdi:restart
+    on_press:
+      - logger.log: "Reboot pressed"
+
+text_sensor:
+  - platform: template
+    name: Version
+    id: version
+    device_class: timestamp
+    icon: mdi:tag
+    lambda: return {"2026-10-21T00:00:00+00:00"};
+    update_interval: 30s
+
+number:
+  - platform: template
+    name: Level
+    id: level
+    device_class: battery
+    icon: mdi:knob
+    unit_of_measurement: "%"
+    min_value: 0
+    max_value: 100
+    step: 1
+    optimistic: true
+    initial_value: 50
+
+select:
+  - platform: template
+    name: Mode
+    id: mode
+    icon: mdi:format-list-bulleted
+    options: [a, b, c]
+    optimistic: true
+    initial_option: a
+
+event:
+  - platform: template
+    name: Doorbell
+    id: doorbell
+    device_class: doorbell
+    icon: mdi:doorbell
+    event_types: [ring, knock]
+
+cover:
+  - platform: template
+    name: Garage
+    id: garage
+    device_class: garage
+    icon: mdi:garage
+    optimistic: true
+
+text:
+  - platform: template
+    name: Secret Note
+    id: note
+    mode: password
+    icon: mdi:form-textbox-password
+    optimistic: true
+    initial_value: "x"

.agents/skills/hardware-test/templates/mqtt-tls-dut.yaml

@@ -0,0 +1,99 @@
+# MQTT TLS trust-source test (#14318, needs that PR's tree for tls and verify_ssl): one build per trust source, with
+# the name and the mqtt block edited per file (see reference/recipes/mqtt.md). Secrets: broker_ip (the local broker
+# from make_test_ca.sh), mqtt_ca, mqtt_client_cert and mqtt_client_key as block scalars from the same run.
+esp32:
+  board: esp32dev
+  framework:
+    type: esp-idf
+
+logger:
+  level: VERBOSE
+  logs:
+    wifi: DEBUG
+    api: DEBUG
+    api.connection: DEBUG
+    scheduler: DEBUG
+    component: DEBUG
+    sensor: DEBUG
+    esp32: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  power_save_mode: none
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+interval:
+  - interval: 10s
+    then:
+      - lambda: |-
+          ESP_LOGI("probe", "mqtt connected %d, internal free %u, largest block %u", id(mq).is_connected(),
+                   (unsigned) heap_caps_get_free_size(MALLOC_CAP_INTERNAL),
+                   (unsigned) heap_caps_get_largest_free_block(MALLOC_CAP_INTERNAL));
+
+sensor:
+  - platform: template
+    name: Counter
+    update_interval: 2s
+    accuracy_decimals: 0
+    lambda: |-
+      static uint32_t n = 0;
+      return n++;
+
+switch:
+  - platform: template
+    name: Relay
+    id: relay
+    optimistic: true
+    on_turn_on:
+      - logger.log: "Relay ON"
+    on_turn_off:
+      - logger.log: "Relay OFF"
+
+button:
+  - platform: template
+    name: Publish big
+    on_press:
+      - mqtt.publish:
+          topic: ${name}/big
+          payload: !lambda |-
+            return std::string(3000, 'q');
+
+substitutions:
+  name: mqtt-dut
+
+esphome:
+  name: ${name}
+
+mqtt:
+  id: mq
+  broker: !secret broker_ip        # test.mosquitto.org for the bundle run
+  # No port: it must resolve to 1883 without TLS options and to 8883 with them. Spell it out only for the
+  # client-certificate listener (8884), wss (9002) and the public bundle broker (8886).
+  # The next two lines are the own-CA build. Remove both for the broker-only build (skip_cert_cn_check alone turns
+  # TLS on), replace both with verify_ssl: false for the unverified build (the flag is rejected next to it), or with
+  # tls: true for the bundle builds (public broker, and the local one as the negative).
+  skip_cert_cn_check: true         # with the local CA: the certificate names an address
+  certificate_authority: !secret mqtt_ca
+  # client_certificate: !secret mqtt_client_cert       # with the CA, port 8884
+  # client_certificate_key: !secret mqtt_client_key
+  # transport: wss                                     # with the CA, port 9002
+  reboot_timeout: 0s
+  discovery: false
+  on_message:
+    - topic: ${name}/cmd
+      then:
+        - logger.log:
+            format: "cmd payload: %s"
+            args: ["x.c_str()"]
+  on_connect:
+    - logger.log: "MQTT on_connect"
+  on_disconnect:
+    - logger.log: "MQTT on_disconnect"

.agents/skills/hardware-test/templates/udp-write-dut.yaml

@@ -0,0 +1,93 @@
+# udp.write payload shapes (#21263): every shape the action takes behind a template button, plus an on_receive that
+# replies with the received bytes reversed through a lambda. Per run file: substitutions name and listener_ip (the test
+# host that runs scripts/udp/udp_listen.py), then packages: common: !include this file. Drive it with
+# scripts/udp/write_cases.sh DEVICE_IP KEY, which presses the buttons, sends the echo datagram and checks every payload.
+esp8266:
+  board: d1_mini
+
+logger:
+  level: VERBOSE
+  logs:
+    wifi: DEBUG
+    api: DEBUG
+    api.connection: DEBUG
+    scheduler: DEBUG
+    component: DEBUG
+
+wifi:
+  ssid: !secret wifi_ssid
+  password: !secret wifi_password
+  power_save_mode: none
+
+api:
+  encryption:
+    key: !secret api_key
+  reboot_timeout: 0s
+
+ota:
+  - platform: esphome
+
+interval:
+  - interval: 10s
+    then:
+      - lambda: |-
+          ESP_LOGI("probe", "free heap %u, max block %u", (unsigned) ESP.getFreeHeap(), (unsigned) ESP.getMaxFreeBlockSize());
+
+esphome:
+  name: ${name}
+
+udp:
+  id: u
+  addresses:
+    - ${listener_ip}
+  on_receive:
+    - lambda: ESP_LOGI("echo", "received %u bytes", (unsigned) data.size());
+    - udp.write: !lambda |-
+        std::vector<uint8_t> v(data.rbegin(), data.rend());
+        return v;
+
+button:
+  - platform: template
+    name: Small
+    on_press:
+      - logger.log: "case small"
+      - udp.write: [0xAA, 0x55, 0x01, 0x02]
+      - udp.write: [0xAA, 0x55, 0x01, 0x02]
+  - platform: template
+    name: Simple
+    on_press:
+      - logger.log: "case simple"
+      - udp.write: [1, 2, 3]
+  - platform: template
+    name: Text
+    on_press:
+      - logger.log: "case text"
+      - udp.write: "hello udp"
+  - platform: template
+    name: Empty
+    on_press:
+      - logger.log: "case empty"
+      - udp.write: []
+  - platform: template
+    name: Stack128
+    on_press:
+      - logger.log: "case stack128"
+      - udp.write: [0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8E, 0x8F]
+  - platform: template
+    name: Heap129
+    on_press:
+      - logger.log: "case heap129"
+      - udp.write: [0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8E, 0x8F, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9A, 0x9B, 0x9C, 0x9D, 0x9E, 0x9F, 0xA0]
+  - platform: template
+    name: Heap600
+    on_press:
+      - logger.log: "case heap600"
+      - udp.write: [0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8E, 0x8F, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9A, 0x9B, 0x9C, 0x9D, 0x9E, 0x9F, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5, 0xA6, 0xA7, 0xA8, 0xA9, 0xAA, 0xAB, 0xAC, 0xAD, 0xAE, 0xAF, 0xB0, 0xB1, 0xB2, 0xB3, 0xB4, 0xB5, 0xB6, 0xB7, 0xB8, 0xB9, 0xBA, 0xBB, 0xBC, 0xBD, 0xBE, 0xBF, 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF, 0xD0, 0xD1, 0xD2, 0xD3, 0xD4, 0xD5, 0xD6, 0xD7, 0xD8, 0xD9, 0xDA, 0xDB, 0xDC, 0xDD, 0xDE, 0xDF, 0xE0, 0xE1, 0xE2, 0xE3, 0xE4, 0xE5, 0xE6, 0xE7, 0xE8, 0xE9, 0xEA, 0xEB, 0xEC, 0xED, 0xEE, 0xEF, 0xF0, 0xF1, 0xF2, 0xF3, 0xF4, 0xF5, 0xF6, 0xF7, 0xF8, 0xF9, 0xFA, 0xFB, 0xFC, 0xFD, 0xFE, 0xFF, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8E, 0x8F, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9A, 0x9B, 0x9C, 0x9D, 0x9E, 0x9F, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5, 0xA6, 0xA7, 0xA8, 0xA9, 0xAA, 0xAB, 0xAC, 0xAD, 0xAE, 0xAF, 0xB0, 0xB1, 0xB2, 0xB3, 0xB4, 0xB5, 0xB6, 0xB7, 0xB8, 0xB9, 0xBA, 0xBB, 0xBC, 0xBD, 0xBE, 0xBF, 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF, 0xD0, 0xD1, 0xD2, 0xD3, 0xD4, 0xD5, 0xD6, 0xD7, 0xD8, 0xD9, 0xDA, 0xDB, 0xDC, 0xDD, 0xDE, 0xDF, 0xE0, 0xE1, 0xE2, 0xE3, 0xE4, 0xE5, 0xE6, 0xE7, 0xE8, 0xE9, 0xEA, 0xEB, 0xEC, 0xED, 0xEE, 0xEF, 0xF0, 0xF1, 0xF2, 0xF3, 0xF4, 0xF5, 0xF6, 0xF7, 0xF8, 0xF9, 0xFA, 0xFB, 0xFC, 0xFD, 0xFE, 0xFF, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87]
+  - platform: template
+    name: Lambda300
+    on_press:
+      - logger.log: "case lambda300"
+      - udp.write: !lambda |-
+          std::vector<uint8_t> v(300);
+          for (size_t i = 0; i < v.size(); i++) v[i] = (uint8_t) (i * 7);
+          return v;

.github/scripts/auto-label-pr/constants.js

@@ -21,6 +21,7 @@ module.exports = {
     'github-actions',
     'by-code-owner',
     'has-tests',
+    'api.proto',
     'needs-tests',
     'needs-docs',
     'needs-developer-docs',

.github/scripts/auto-label-pr/detectors.js

@@ -272,6 +272,18 @@ async function detectTests(changedFiles) {
   return labels;
 }
 
+// Strategy: API protocol change detection
+// aioesphomeapi carries copies of both files, so every change here needs a sync there
+const API_PROTO_FILES = ['esphome/components/api/api.proto', 'esphome/components/api/api_options.proto'];
+
+async function detectApiProto(changedFiles) {
+  const labels = new Set();
+  if (changedFiles.some(file => API_PROTO_FILES.includes(file))) {
+    labels.add('api.proto');
+  }
+  return labels;
+}
+
 // Strategy: PR Template Checkbox detection
 async function detectPRTemplateCheckboxes(context) {
   const labels = new Set();
@@ -460,6 +472,7 @@ module.exports = {
   detectGitHubActionsChanges,
   detectCodeOwner,
   detectTests,
+  detectApiProto,
   detectPRTemplateCheckboxes,
   detectDeprecatedComponents,
   detectMaintainerAccess,

.github/scripts/auto-label-pr/index.js

@@ -10,6 +10,7 @@ const {
   detectGitHubActionsChanges,
   detectCodeOwner,
   detectTests,
+  detectApiProto,
   detectPRTemplateCheckboxes,
   detectDeprecatedComponents,
   detectMaintainerAccess,
@@ -114,6 +115,7 @@ module.exports = async ({ github, context }) => {
     actionsLabels,
     codeOwnerLabels,
     testLabels,
+    apiProtoLabels,
     checkboxLabels,
     deprecatedResult,
     maintainerAccess
@@ -128,6 +130,7 @@ module.exports = async ({ github, context }) => {
     detectGitHubActionsChanges(changedFiles),
     detectCodeOwner(github, context, changedFiles),
     detectTests(changedFiles),
+    detectApiProto(changedFiles),
     detectPRTemplateCheckboxes(context),
     detectDeprecatedComponents(github, context, changedFiles),
     detectMaintainerAccess(context)
@@ -156,6 +159,7 @@ module.exports = async ({ github, context }) => {
     ...actionsLabels,
     ...codeOwnerLabels,
     ...testLabels,
+    ...apiProtoLabels,
     ...checkboxLabels,
     ...deprecatedLabels
   ]);

.github/scripts/auto-label-pr/tests/detectors.test.js

@@ -1,6 +1,7 @@
 const { describe, it } = require('node:test');
 const assert = require('node:assert/strict');
 const {
+  detectApiProto,
   detectMergeBranch,
   detectNewPlatforms,
   detectNewComponents,
@@ -375,6 +376,27 @@ describe('detectRequirements', () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// detectApiProto
+// ---------------------------------------------------------------------------
+
+describe('detectApiProto', () => {
+  it('labels a PR that changes api.proto', async () => {
+    const labels = await detectApiProto(['esphome/components/api/api.proto', 'esphome/components/api/api_pb2.cpp']);
+    assert.deepEqual(Array.from(labels), ['api.proto']);
+  });
+
+  it('labels a PR that changes only api_options.proto', async () => {
+    const labels = await detectApiProto(['esphome/components/api/api_options.proto']);
+    assert.deepEqual(Array.from(labels), ['api.proto']);
+  });
+
+  it('ignores the generated protocol files and other components', async () => {
+    const labels = await detectApiProto(['esphome/components/api/api_pb2.cpp', 'esphome/components/uart/api.proto']);
+    assert.equal(labels.size, 0);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // MANAGED_LABELS
 // ---------------------------------------------------------------------------
@@ -387,6 +409,10 @@ describe('MANAGED_LABELS', () => {
   it('includes needs-developer-docs so the workflow syncs it', () => {
     assert.ok(MANAGED_LABELS.includes('needs-developer-docs'));
   });
+
+  it('includes api.proto so the workflow removes it when the file drops out of the diff', () => {
+    assert.ok(MANAGED_LABELS.includes('api.proto'));
+  });
 });
 
 // ---------------------------------------------------------------------------

esphome/components/adc/adc_sensor_zephyr.cpp

@@ -111,6 +111,8 @@ static const LogString *input_to_str(uint8_t input) {
       return LOG_STR("VDD");
     case NRF_SAADC_INPUT_VDDHDIV5:
       return LOG_STR("VDDHDIV5");
+    default:
+      break;
   }
   return LOG_STR("undefined input");
 }

esphome/components/airton/airton.cpp

@@ -261,6 +261,8 @@ void AirtonClimate::parse_state_frame_(const uint8_t *frame) {
     case AIRTON_FAN_AUTO:
       this->fan_mode = climate::CLIMATE_FAN_AUTO;
       break;
+    default:
+      break;
   }
 
   this->target_temperature = (frame[3] & 0b00001111) + AIRTON_TEMP_MIN;

esphome/components/api/api.proto

@@ -607,6 +607,7 @@ message ListEntitiesCoverResponse {
   EntityCategory entity_category = 11;
   bool supports_stop = 12;
   uint32 device_id = 13 [(field_ifdef) = "USE_DEVICES"];
+  bool supports_stop_tilt = 14;
 }
 
 // Deprecated in API version 1.1
@@ -668,6 +669,7 @@ message CoverCommandRequest {
   float tilt = 7;
   bool stop = 8;
   uint32 device_id = 9 [(field_ifdef) = "USE_DEVICES"];
+  bool stop_tilt = 10;
 }
 
 // ==================== FAN ====================

esphome/components/api/api_connection.cpp

@@ -554,6 +554,7 @@ uint16_t APIConnection::try_send_cover_info(EntityBase *entity, APIConnection *c
   msg.supports_position = traits.get_supports_position();
   msg.supports_tilt = traits.get_supports_tilt();
   msg.supports_stop = traits.get_supports_stop();
+  msg.supports_stop_tilt = traits.get_supports_stop_tilt();
   return fill_and_encode_entity_info_with_device_class(cover, msg, msg.device_class, conn, remaining_size);
 }
 void APIConnection::on_cover_command_request(const CoverCommandRequest &msg) {
@@ -564,6 +565,8 @@ void APIConnection::on_cover_command_request(const CoverCommandRequest &msg) {
     call.set_tilt(msg.tilt);
   if (msg.stop)
     call.set_command_stop();
+  if (msg.stop_tilt)
+    call.set_command_stop_tilt();
   call.perform();
 }
 #endif

esphome/components/api/api_pb2.cpp

@@ -25,6 +25,8 @@ void HelloRequest::decode_field(void *self, uint32_t tag, const uint8_t *data, p
       msg.outgoing_connection_target = value.as_bool();
       break;
 #endif
+    default:
+      break;
   }
 }
 uint8_t *HelloResponse::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -51,6 +53,8 @@ void DisconnectRequest::decode_field(void *self, uint32_t tag, const uint8_t *da
     case proto_tag(1, WIRE_TYPE_VARINT):
       msg.reason = static_cast<enums::DisconnectReason>(value.as_varint());
       break;
+    default:
+      break;
   }
 }
 uint8_t *DisconnectRequest::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -396,6 +400,8 @@ void WizardInputSetRequest::decode_field(void *self, uint32_t tag, const uint8_t
     case proto_tag(2, WIRE_TYPE_LENGTH_DELIMITED):
       msg.entity_id = StringRef(value.data(), value.size());
       break;
+    default:
+      break;
   }
 }
 #endif
@@ -477,6 +483,7 @@ uint8_t *ListEntitiesCoverResponse::encode_msg(const void *self, uint8_t *__rest
 #ifdef USE_DEVICES
   pos = ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 13, msg.device_id);
 #endif
+  pos = ProtoEncode::encode_bool(pos PROTO_ENCODE_DEBUG_ARG, 14, msg.supports_stop_tilt);
   return pos;
 }
 uint32_t ListEntitiesCoverResponse::calc_size_msg(const void *self) {
@@ -498,6 +505,7 @@ uint32_t ListEntitiesCoverResponse::calc_size_msg(const void *self) {
 #ifdef USE_DEVICES
   size += ProtoSize::calc_uint32(1, msg.device_id);
 #endif
+  size += ProtoSize::calc_bool(1, msg.supports_stop_tilt);
   return size;
 }
 uint8_t *CoverStateResponse::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -554,6 +562,11 @@ void CoverCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *
       msg.device_id = value.as_varint();
       break;
 #endif
+    case proto_tag(10, WIRE_TYPE_VARINT):
+      msg.stop_tilt = value.as_bool();
+      break;
+    default:
+      break;
   }
 }
 #endif
@@ -674,6 +687,8 @@ void FanCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *da
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -880,6 +895,8 @@ void LightCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -1023,6 +1040,8 @@ void SwitchCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -1093,6 +1112,8 @@ void SubscribeLogsRequest::decode_field(void *self, uint32_t tag, const uint8_t
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.dump_config = value.as_bool();
       break;
+    default:
+      break;
   }
 }
 __attribute__((optimize("O2")))  // NOLINT(clang-diagnostic-unknown-attributes)
@@ -1122,6 +1143,8 @@ void NoiseEncryptionSetKeyRequest::decode_field(void *self, uint32_t tag, const
       msg.key = value.data();
       msg.key_len = value.size();
       break;
+    default:
+      break;
   }
 }
 uint8_t *NoiseEncryptionSetKeyResponse::encode_msg(const void *self,
@@ -1228,6 +1251,8 @@ void HomeassistantActionResponse::decode_field(void *self, uint32_t tag, const u
       msg.response_data_len = value.size();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -1262,6 +1287,8 @@ void HomeAssistantStateResponse::decode_field(void *self, uint32_t tag, const ui
     case proto_tag(3, WIRE_TYPE_LENGTH_DELIMITED):
       msg.attribute = StringRef(value.data(), value.size());
       break;
+    default:
+      break;
   }
 }
 #endif
@@ -1287,6 +1314,8 @@ void DSTRule::decode_field(void *self, uint32_t tag, const uint8_t *data, proto_
     case proto_tag(6, WIRE_TYPE_VARINT):
       msg.day_of_week = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 void ParsedTimezone::decode_field(void *self, uint32_t tag, const uint8_t *data, proto_varint_value_t scalar) {
@@ -1305,6 +1334,8 @@ void ParsedTimezone::decode_field(void *self, uint32_t tag, const uint8_t *data,
     case proto_tag(4, WIRE_TYPE_LENGTH_DELIMITED):
       value.decode_to_message(msg.dst_end);
       break;
+    default:
+      break;
   }
 }
 void GetTimeResponse::decode_field(void *self, uint32_t tag, const uint8_t *data, proto_varint_value_t scalar) {
@@ -1318,6 +1349,8 @@ void GetTimeResponse::decode_field(void *self, uint32_t tag, const uint8_t *data
       value.decode_to_message(msg.parsed_timezone);
       msg.has_parsed_timezone = true;
       break;
+    default:
+      break;
   }
 }
 #ifdef USE_API_USER_DEFINED_ACTIONS
@@ -1408,6 +1441,8 @@ void ExecuteServiceArgument::decode_field(void *self, uint32_t tag, const uint8_
     case proto_tag(9, WIRE_TYPE_LENGTH_DELIMITED):
       msg.string_array.push_back(value.as_string());
       break;
+    default:
+      break;
   }
 }
 void ExecuteServiceArgument::decode(const uint8_t *buffer, size_t length) {
@@ -1442,6 +1477,8 @@ void ExecuteServiceRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.return_response = value.as_bool();
       break;
 #endif
+    default:
+      break;
   }
 }
 void ExecuteServiceRequest::decode(const uint8_t *buffer, size_t length) {
@@ -1536,6 +1573,8 @@ void CameraImageRequest::decode_field(void *self, uint32_t tag, const uint8_t *d
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.stream = value.as_bool();
       break;
+    default:
+      break;
   }
 }
 #endif
@@ -1772,6 +1811,8 @@ void ClimateCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -1900,6 +1941,8 @@ void WaterHeaterCommandRequest::decode_field(void *self, uint32_t tag, const uin
     case proto_tag(8, WIRE_TYPE_FIXED32):
       msg.target_temperature_high = value.as_float();
       break;
+    default:
+      break;
   }
 }
 #endif
@@ -1991,6 +2034,8 @@ void NumberCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -2070,6 +2115,8 @@ void SelectCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -2172,6 +2219,8 @@ void SirenCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -2255,6 +2304,8 @@ void LockCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *d
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -2304,6 +2355,8 @@ void ButtonCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -2431,6 +2484,8 @@ void MediaPlayerCommandRequest::decode_field(void *self, uint32_t tag, const uin
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -2443,6 +2498,8 @@ void SubscribeBluetoothLEAdvertisementsRequest::decode_field(void *self, uint32_
     case proto_tag(1, WIRE_TYPE_VARINT):
       msg.flags = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 __attribute__((optimize("O2")))  // NOLINT(clang-diagnostic-unknown-attributes)
@@ -2501,6 +2558,8 @@ void BluetoothDeviceRequest::decode_field(void *self, uint32_t tag, const uint8_
     case proto_tag(4, WIRE_TYPE_VARINT):
       msg.address_type = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 uint8_t *BluetoothDeviceConnectionResponse::encode_msg(const void *self,
@@ -2529,6 +2588,8 @@ void BluetoothGATTGetServicesRequest::decode_field(void *self, uint32_t tag, con
     case proto_tag(1, WIRE_TYPE_VARINT):
       msg.address = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 uint8_t *BluetoothGATTDescriptor::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -2655,6 +2716,8 @@ void BluetoothGATTReadRequest::decode_field(void *self, uint32_t tag, const uint
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.handle = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 uint8_t *BluetoothGATTReadResponse::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -2690,6 +2753,8 @@ void BluetoothGATTWriteRequest::decode_field(void *self, uint32_t tag, const uin
       msg.data = value.data();
       msg.data_len = value.size();
       break;
+    default:
+      break;
   }
 }
 void BluetoothGATTReadDescriptorRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -2703,6 +2768,8 @@ void BluetoothGATTReadDescriptorRequest::decode_field(void *self, uint32_t tag,
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.handle = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 void BluetoothGATTWriteDescriptorRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -2720,6 +2787,8 @@ void BluetoothGATTWriteDescriptorRequest::decode_field(void *self, uint32_t tag,
       msg.data = value.data();
       msg.data_len = value.size();
       break;
+    default:
+      break;
   }
 }
 void BluetoothGATTNotifyRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -2736,6 +2805,8 @@ void BluetoothGATTNotifyRequest::decode_field(void *self, uint32_t tag, const ui
     case proto_tag(3, WIRE_TYPE_VARINT):
       msg.enable = value.as_bool();
       break;
+    default:
+      break;
   }
 }
 uint8_t *BluetoothGATTNotifyDataResponse::encode_msg(const void *self,
@@ -2893,6 +2964,8 @@ void BluetoothScannerSetModeRequest::decode_field(void *self, uint32_t tag, cons
     case proto_tag(1, WIRE_TYPE_VARINT):
       msg.mode = static_cast<enums::BluetoothScannerMode>(value.as_varint());
       break;
+    default:
+      break;
   }
 }
 #endif
@@ -2908,6 +2981,8 @@ void SubscribeVoiceAssistantRequest::decode_field(void *self, uint32_t tag, cons
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.flags = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 uint8_t *VoiceAssistantAudioSettings::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -2956,6 +3031,8 @@ void VoiceAssistantResponse::decode_field(void *self, uint32_t tag, const uint8_
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.error = value.as_bool();
       break;
+    default:
+      break;
   }
 }
 void VoiceAssistantEventData::decode_field(void *self, uint32_t tag, const uint8_t *data, proto_varint_value_t scalar) {
@@ -2968,6 +3045,8 @@ void VoiceAssistantEventData::decode_field(void *self, uint32_t tag, const uint8
     case proto_tag(2, WIRE_TYPE_LENGTH_DELIMITED):
       msg.value = StringRef(value.data(), value.size());
       break;
+    default:
+      break;
   }
 }
 void VoiceAssistantEventResponse::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -2982,6 +3061,8 @@ void VoiceAssistantEventResponse::decode_field(void *self, uint32_t tag, const u
       msg.data.emplace_back();
       value.decode_to_message(msg.data.back());
       break;
+    default:
+      break;
   }
 }
 void VoiceAssistantAudio::decode_field(void *self, uint32_t tag, const uint8_t *data, proto_varint_value_t scalar) {
@@ -2999,6 +3080,8 @@ void VoiceAssistantAudio::decode_field(void *self, uint32_t tag, const uint8_t *
       msg.data2 = value.data();
       msg.data2_len = value.size();
       break;
+    default:
+      break;
   }
 }
 uint8_t *VoiceAssistantAudio::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -3039,6 +3122,8 @@ void VoiceAssistantTimerEventResponse::decode_field(void *self, uint32_t tag, co
     case proto_tag(6, WIRE_TYPE_VARINT):
       msg.is_active = value.as_bool();
       break;
+    default:
+      break;
   }
 }
 void VoiceAssistantAnnounceRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -3058,6 +3143,8 @@ void VoiceAssistantAnnounceRequest::decode_field(void *self, uint32_t tag, const
     case proto_tag(4, WIRE_TYPE_VARINT):
       msg.start_conversation = value.as_bool();
       break;
+    default:
+      break;
   }
 }
 uint8_t *VoiceAssistantAnnounceFinished::encode_msg(const void *self,
@@ -3119,6 +3206,8 @@ void VoiceAssistantExternalWakeWord::decode_field(void *self, uint32_t tag, cons
     case proto_tag(7, WIRE_TYPE_LENGTH_DELIMITED):
       msg.url = StringRef(value.data(), value.size());
       break;
+    default:
+      break;
   }
 }
 void VoiceAssistantConfigurationRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -3130,6 +3219,8 @@ void VoiceAssistantConfigurationRequest::decode_field(void *self, uint32_t tag,
       msg.external_wake_words.emplace_back();
       value.decode_to_message(msg.external_wake_words.back());
       break;
+    default:
+      break;
   }
 }
 uint8_t *VoiceAssistantConfigurationResponse::encode_msg(const void *self,
@@ -3168,6 +3259,8 @@ void VoiceAssistantSetConfiguration::decode_field(void *self, uint32_t tag, cons
     case proto_tag(1, WIRE_TYPE_LENGTH_DELIMITED):
       msg.active_wake_words.push_back(value.as_string());
       break;
+    default:
+      break;
   }
 }
 #endif
@@ -3249,6 +3342,8 @@ void AlarmControlPanelCommandRequest::decode_field(void *self, uint32_t tag, con
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3328,6 +3423,8 @@ void TextCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *d
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3409,6 +3506,8 @@ void DateCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *d
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3490,6 +3589,8 @@ void TimeCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *d
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3639,6 +3740,8 @@ void ValveCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t *
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3713,6 +3816,8 @@ void DateTimeCommandRequest::decode_field(void *self, uint32_t tag, const uint8_
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3802,6 +3907,8 @@ void UpdateCommandRequest::decode_field(void *self, uint32_t tag, const uint8_t
       msg.device_id = value.as_varint();
       break;
 #endif
+    default:
+      break;
   }
 }
 #endif
@@ -3814,6 +3921,8 @@ void ZWaveProxyFrame::decode_field(void *self, uint32_t tag, const uint8_t *data
       msg.data = value.data();
       msg.data_len = value.size();
       break;
+    default:
+      break;
   }
 }
 __attribute__((optimize("O2")))  // NOLINT(clang-diagnostic-unknown-attributes)
@@ -3840,6 +3949,8 @@ void ZWaveProxyRequest::decode_field(void *self, uint32_t tag, const uint8_t *da
       msg.data = value.data();
       msg.data_len = value.size();
       break;
+    default:
+      break;
   }
 }
 uint8_t *ZWaveProxyRequest::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -3935,6 +4046,8 @@ void InfraredRFTransmitRawTimingsRequest::decode_field(void *self, uint32_t tag,
     case proto_tag(6, WIRE_TYPE_VARINT):
       msg.modulation = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 __attribute__((optimize("O2")))  // NOLINT(clang-diagnostic-unknown-attributes)
@@ -4051,6 +4164,8 @@ void SerialProxyConfigureRequest::decode_field(void *self, uint32_t tag, const u
     case proto_tag(6, WIRE_TYPE_VARINT):
       msg.data_size = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 __attribute__((optimize("O2")))  // NOLINT(clang-diagnostic-unknown-attributes)
@@ -4079,6 +4194,8 @@ void SerialProxyWriteRequest::decode_field(void *self, uint32_t tag, const uint8
       msg.data = value.data();
       msg.data_len = value.size();
       break;
+    default:
+      break;
   }
 }
 void SerialProxySetModemPinsRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -4092,6 +4209,8 @@ void SerialProxySetModemPinsRequest::decode_field(void *self, uint32_t tag, cons
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.line_states = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 void SerialProxyGetModemPinsRequest::decode_field(void *self, uint32_t tag, const uint8_t *data,
@@ -4102,6 +4221,8 @@ void SerialProxyGetModemPinsRequest::decode_field(void *self, uint32_t tag, cons
     case proto_tag(1, WIRE_TYPE_VARINT):
       msg.instance = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 uint8_t *SerialProxyGetModemPinsResponse::encode_msg(const void *self,
@@ -4130,6 +4251,8 @@ void SerialProxyRequest::decode_field(void *self, uint32_t tag, const uint8_t *d
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.type = static_cast<enums::SerialProxyRequestType>(value.as_varint());
       break;
+    default:
+      break;
   }
 }
 uint8_t *SerialProxyRequestResponse::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -4160,6 +4283,8 @@ void SerialProxySetModeRequest::decode_field(void *self, uint32_t tag, const uin
     case proto_tag(2, WIRE_TYPE_VARINT):
       msg.mode = static_cast<enums::SerialProxyMode>(value.as_varint());
       break;
+    default:
+      break;
   }
 }
 uint8_t *UsbDeviceDescriptor::encode_msg(const void *self, uint8_t *__restrict__ pos PROTO_ENCODE_DEBUG_PARAM) {
@@ -4228,6 +4353,8 @@ void BluetoothSetConnectionParamsRequest::decode_field(void *self, uint32_t tag,
     case proto_tag(5, WIRE_TYPE_VARINT):
       msg.timeout = value.as_varint();
       break;
+    default:
+      break;
   }
 }
 uint8_t *BluetoothSetConnectionParamsResponse::encode_msg(const void *self,

esphome/components/api/api_pb2.h

@@ -911,7 +911,7 @@ class BinarySensorStateResponse final : public StateResponseProtoMessage {
 class ListEntitiesCoverResponse final : public InfoResponseProtoMessage {
  public:
   static constexpr uint16_t MESSAGE_TYPE = 13;
-  static constexpr uint8_t ESTIMATED_SIZE = 57;
+  static constexpr uint8_t ESTIMATED_SIZE = 59;
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const LogString *message_name() const override { return LOG_STR("list_entities_cover_response"); }
 #endif
@@ -920,6 +920,7 @@ class ListEntitiesCoverResponse final : public InfoResponseProtoMessage {
   bool supports_tilt{false};
   ProgmemStringRef device_class{};
   bool supports_stop{false};
+  bool supports_stop_tilt{false};
   static uint8_t *encode_msg(const void *self, uint8_t *pos PROTO_ENCODE_DEBUG_PARAM);
   uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
     return encode_msg(this, buffer.get_pos() PROTO_ENCODE_DEBUG_ARG);
@@ -957,7 +958,7 @@ class CoverStateResponse final : public StateResponseProtoMessage {
 class CoverCommandRequest final : public CommandProtoMessage {
  public:
   static constexpr uint16_t MESSAGE_TYPE = 30;
-  static constexpr uint8_t ESTIMATED_SIZE = 25;
+  static constexpr uint8_t ESTIMATED_SIZE = 27;
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const LogString *message_name() const override { return LOG_STR("cover_command_request"); }
 #endif
@@ -966,6 +967,7 @@ class CoverCommandRequest final : public CommandProtoMessage {
   bool has_tilt{false};
   float tilt{0.0f};
   bool stop{false};
+  bool stop_tilt{false};
   void decode(const uint8_t *buffer, size_t length) {
     ProtoDecodableMessage::decode_fields(this, buffer, length, &decode_field);
   }

esphome/components/api/api_pb2_dump.cpp

@@ -1245,6 +1245,7 @@ const char *ListEntitiesCoverResponse::dump_to(DumpBuffer &out) const {
 #ifdef USE_DEVICES
   dump_field(out, ESPHOME_PSTR("device_id"), this->device_id);
 #endif
+  dump_field(out, ESPHOME_PSTR("supports_stop_tilt"), this->supports_stop_tilt);
   return out.c_str();
 }
 const char *CoverStateResponse::dump_to(DumpBuffer &out) const {
@@ -1269,6 +1270,7 @@ const char *CoverCommandRequest::dump_to(DumpBuffer &out) const {
 #ifdef USE_DEVICES
   dump_field(out, ESPHOME_PSTR("device_id"), this->device_id);
 #endif
+  dump_field(out, ESPHOME_PSTR("stop_tilt"), this->stop_tilt);
   return out.c_str();
 }
 #endif

esphome/components/ballu/ballu.cpp

@@ -168,6 +168,8 @@ bool BalluClimate::on_receive(remote_base::RemoteReceiveData data) {
       case BALLU_AUTO:
         this->mode = climate::CLIMATE_MODE_AUTO;
         break;
+      default:
+        break;
     }
   }
 

esphome/components/bluetooth_connection/bluetooth_connection_bluedroid.cpp

@@ -268,6 +268,7 @@ int BluedroidGattClient::discover_services() {
     case SearchState::REPORT_PENDING:
       return 0;  // One completion is already owed to this claimant.
     case SearchState::NONE:
+    default:
       break;
   }
   int err = this->check_and_log_error_("esp_ble_gattc_search_service",

esphome/components/bluetooth_connection/bluetooth_connection_hub.h

@@ -22,8 +22,8 @@ class BluetoothProxy;
 
 namespace esphome::bluetooth_connection {
 
-using ClientState = ble_device_base::ClientState;
-using ConnectionType = ble_device_base::ConnectionType;
+using ble_device_base::ClientState;
+using ble_device_base::ConnectionType;
 
 /// A refused GATT reply owed to the current subscriber. Payload-free only:
 /// these rebuild from address + handle + error, so a retry costs no buffered

esphome/components/bluetooth_proxy/bluetooth_proxy.h

@@ -30,8 +30,8 @@ using bluetooth_connection::INIT_SENDING_SERVICES;
 using bluetooth_connection::SERVICES_DONE_PENDING;
 
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
-using BluetoothConnection = bluetooth_connection::BluetoothConnection;
-using ClientState = ble_device_base::ClientState;
+using bluetooth_connection::BluetoothConnection;
+using ble_device_base::ClientState;
 #endif
 
 // Legacy versions:

esphome/components/bmi160/bmi160.cpp

@@ -123,7 +123,7 @@ void BMI160Component::internal_setup_(int stage) {
 
 bool BMI160Component::setup_stage_(int stage) {
   switch (stage) {
-    case 0:
+    case 0: {
       uint8_t chipid;
       if (!this->read_byte(BMI160_REGISTER_CHIPID, &chipid) || (chipid != 0b11010001)) {
         return false;
@@ -138,7 +138,7 @@ bool BMI160Component::setup_stage_(int stage) {
       // min 5ms, 10ms
       this->set_timeout(10, [this]() { this->internal_setup_(1); });
       break;
-
+    }
     case 1:
       ESP_LOGV(TAG, "  Bringing gyroscope out of sleep");
       if (!this->write_byte(BMI160_REGISTER_CMD, (uint8_t) Cmd::GYRO_SET_PMU_MODE | (uint8_t) GyroPmuMode::NORMAL)) {
@@ -149,7 +149,7 @@ bool BMI160Component::setup_stage_(int stage) {
       this->set_timeout(GYRO_WAKEUP_TIMEOUT_MS, [this]() { this->internal_setup_(2); });
       break;
 
-    case 2:
+    case 2: {
       ESP_LOGV(TAG, "  Setting up Gyro Config");
       uint8_t gyro_config = (uint8_t) GyroBandwidth::OSR4 | (uint8_t) GyroOuputDataRate::HZ_25;
       ESP_LOGV(TAG, "  Output gyro_config: 0b" BYTE_TO_BINARY_PATTERN, BYTE_TO_BINARY(gyro_config));
@@ -178,6 +178,10 @@ bool BMI160Component::setup_stage_(int stage) {
       }
 
       this->setup_complete_ = true;
+      break;
+    }
+    default:
+      break;
   }
   return true;
 }

esphome/components/cc1101/cc1101.h

@@ -108,7 +108,7 @@ class CC1101Component final : public Component,
 
   // GDO pin for packet reception
   InternalGPIOPin *gdo0_pin_{nullptr};
-  static void IRAM_ATTR gpio_intr(CC1101Component *arg);
+  static void gpio_intr(CC1101Component *arg);
 
   // Packet handling
   void call_listeners_(const std::vector<uint8_t> &packet, float freq_offset, float rssi, uint8_t lqi);

esphome/components/const/__init__.py

@@ -60,6 +60,7 @@ CONF_ON_RECEIVE = "on_receive"
 CONF_ON_SCAN_END = "on_scan_end"
 CONF_ON_STATE_CHANGE = "on_state_change"
 CONF_ON_STOP = "on_stop"
+CONF_OUT_PIN = "out_pin"
 CONF_OUT_PIN_LEVEL = "out_pin_level"
 CONF_PARITY = "parity"
 CONF_PROVIDER = "provider"

esphome/components/copy/cover/copy_cover.cpp

@@ -31,12 +31,14 @@ cover::CoverTraits CopyCover::get_traits() {
   traits.set_supports_position(base.get_supports_position());
   traits.set_supports_tilt(base.get_supports_tilt());
   traits.set_supports_toggle(base.get_supports_toggle());
+  traits.set_supports_stop_tilt(base.get_supports_stop_tilt());
   return traits;
 }
 
 void CopyCover::control(const cover::CoverCall &call) {
   auto call2 = source_->make_call();
   call2.set_stop(call.get_stop());
+  call2.set_stop_tilt(call.get_stop_tilt());
   auto tilt = call.get_tilt();
   if (tilt.has_value())
     call2.set_tilt(*tilt);

esphome/components/cover/__init__.py

@@ -99,6 +99,7 @@ CONF_ON_CLOSED = "on_closed"
 CONF_ON_OPENED = "on_opened"
 CONF_ON_OPENING = "on_opening"
 CONF_ON_CLOSING = "on_closing"
+CONF_STOP_TILT = "stop_tilt"
 
 TRIGGERS = {
     CONF_ON_OPEN: CoverOpenedTrigger,  # Deprecated, use on_opened
@@ -248,6 +249,7 @@ for _name, _command in (
     ("cover.open", "set_command_open()"),
     ("cover.close", "set_command_close()"),
     ("cover.stop", "set_command_stop()"),
+    ("cover.stop_tilt", "set_command_stop_tilt()"),
     ("cover.toggle", "set_command_toggle()"),
 ):
     automation.register_apply_action(
@@ -259,6 +261,7 @@ COVER_CONTROL_ACTION_SCHEMA = cv.Schema(
     {
         cv.Required(CONF_ID): cv.use_id(Cover),
         cv.Optional(CONF_STOP): cv.templatable(cv.boolean),
+        cv.Optional(CONF_STOP_TILT): cv.templatable(cv.boolean),
         cv.Exclusive(CONF_STATE, "pos"): cv.templatable(validate_cover_state),
         cv.Exclusive(CONF_POSITION, "pos"): cv.templatable(cv.percentage),
         cv.Optional(CONF_TILT): cv.templatable(cv.percentage),
@@ -272,6 +275,7 @@ automation.register_apply_action(
     "cover.control",
     COVER_CONTROL_ACTION_SCHEMA,
     automation.ApplyField(CONF_STOP, "set_stop", cg.bool_),
+    automation.ApplyField(CONF_STOP_TILT, "set_stop_tilt", cg.bool_),
     automation.ApplyField(CONF_STATE, "set_position", cg.float_),
     automation.ApplyField(CONF_POSITION, "set_position", cg.float_),
     automation.ApplyField(CONF_TILT, "set_tilt", cg.float_),

esphome/components/cover/cover.cpp

@@ -55,6 +55,10 @@ CoverCall &CoverCall::set_command_stop() {
   this->stop_ = true;
   return *this;
 }
+CoverCall &CoverCall::set_command_stop_tilt() {
+  this->stop_tilt_ = true;
+  return *this;
+}
 CoverCall &CoverCall::set_command_toggle() {
   this->toggle_ = true;
   return *this;
@@ -74,6 +78,9 @@ void CoverCall::perform() {
   if (this->stop_) {
     ESP_LOGV(TAG, "  Command: STOP");
   }
+  if (this->stop_tilt_) {
+    ESP_LOGV(TAG, "  Command: STOP_TILT");
+  }
   if (this->position_.has_value()) {
     if (traits.get_supports_position()) {
       ESP_LOGV(TAG, "  Position: %.0f%%", *this->position_ * 100.0f);
@@ -122,6 +129,15 @@ void CoverCall::validate_() {
       this->toggle_.reset();
     }
   }
+  if (this->stop_tilt_) {
+    if (!traits.get_supports_stop_tilt()) {
+      ESP_LOGW(TAG, "'%s': stop tilt unsupported", name);
+      this->stop_tilt_ = false;
+    } else if (this->tilt_.has_value()) {
+      ESP_LOGW(TAG, "'%s': cannot tilt when stopping tilt", name);
+      this->tilt_.reset();
+    }
+  }
   if (this->stop_) {
     if (this->position_.has_value() || this->tilt_.has_value() || this->toggle_.has_value()) {
       ESP_LOGW(TAG, "'%s': cannot position/tilt/toggle when stopping", name);
@@ -135,6 +151,10 @@ CoverCall &CoverCall::set_stop(bool stop) {
   this->stop_ = stop;
   return *this;
 }
+CoverCall &CoverCall::set_stop_tilt(bool stop_tilt) {
+  this->stop_tilt_ = stop_tilt;
+  return *this;
+}
 void Cover::publish_state(bool save) {
   this->position = clamp(this->position, 0.0f, 1.0f);
   this->tilt = clamp(this->tilt, 0.0f, 1.0f);

esphome/components/cover/cover.h

@@ -36,6 +36,8 @@ class CoverCall {
   CoverCall &set_command_close();
   /// Set the command to stop the cover.
   CoverCall &set_command_stop();
+  /// Set the command to stop the cover tilt.
+  CoverCall &set_command_stop_tilt();
   /// Set the command to toggle the cover.
   CoverCall &set_command_toggle();
   /// Set the call to a certain target position.
@@ -44,12 +46,15 @@ class CoverCall {
   CoverCall &set_tilt(float tilt);
   /// Set whether this cover call should stop the cover.
   CoverCall &set_stop(bool stop);
+  /// Set whether this cover call should stop the cover tilt.
+  CoverCall &set_stop_tilt(bool stop_tilt);
 
   /// Perform the cover call.
   void perform();
 
   const optional<float> &get_position() const;
   bool get_stop() const { return this->stop_; }
+  bool get_stop_tilt() const { return this->stop_tilt_; }
   const optional<float> &get_tilt() const;
   const optional<bool> &get_toggle() const;
 
@@ -58,6 +63,7 @@ class CoverCall {
 
   Cover *parent_;
   bool stop_{false};
+  bool stop_tilt_{false};
   optional<float> position_{};
   optional<float> tilt_{};
   optional<bool> toggle_{};

esphome/components/cover/cover_traits.h

@@ -16,6 +16,8 @@ class CoverTraits {
   void set_supports_toggle(bool supports_toggle) { this->supports_toggle_ = supports_toggle; }
   bool get_supports_stop() const { return this->supports_stop_; }
   void set_supports_stop(bool supports_stop) { this->supports_stop_ = supports_stop; }
+  bool get_supports_stop_tilt() const { return this->supports_stop_tilt_; }
+  void set_supports_stop_tilt(bool supports_stop_tilt) { this->supports_stop_tilt_ = supports_stop_tilt; }
 
  protected:
   bool is_assumed_state_{false};
@@ -23,6 +25,7 @@ class CoverTraits {
   bool supports_tilt_{false};
   bool supports_toggle_{false};
   bool supports_stop_{false};
+  bool supports_stop_tilt_{false};
 };
 
 }  // namespace esphome::cover

esphome/components/cse7761/cse7761.cpp

@@ -175,6 +175,8 @@ uint32_t CSE7761Component::coefficient_by_unit_(uint32_t unit) {
     case POWER_PAC:
       coeff = this->data_.coefficient[POWER_PAC] * scale;
       return coeff ? 0x80000000 / coeff : 0;
+    default:
+      break;
   }
   return 0;
 }

esphome/components/debug/debug_zephyr.cpp

@@ -156,6 +156,8 @@ static const char *regout0_to_str(uint32_t value) {
       return "3.0V";
     case (UICR_REGOUT0_VOUT_3V3):
       return "3.3V";
+    default:
+      break;
   }
   return "???V";
 }
@@ -337,6 +339,8 @@ size_t DebugComponent::get_device_info_(std::span<char, DEVICE_INFO_BUFFER_SIZE>
         return "QFxx - 6x6 48-pin QFN";
       case 0x2005:
         return "CKxx - 3.544 x 3.607 WLCSP";
+      default:
+        break;
     }
     return "Unspecified";
   };

esphome/components/delonghi/delonghi.cpp

@@ -143,6 +143,8 @@ bool DelonghiClimate::parse_state_frame_(const uint8_t frame[]) {
     case DELONGHI_FAN_AUTO:
       this->fan_mode = climate::CLIMATE_FAN_AUTO;
       break;
+    default:
+      break;
   }
   this->publish_state();
   return true;

esphome/components/dfplayer/dfplayer.cpp

@@ -250,6 +250,8 @@ void DFPlayer::loop() {
                   ESP_LOGE(TAG, "Entered into sleep mode");
                   this->is_playing_ = false;
                   break;
+                default:
+                  break;
               }
               break;
             case 0x41:

esphome/components/duty_time/duty_time_sensor.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <cinttypes>
+#include <utility>
 
 #include "esphome/core/component.h"
 #include "esphome/core/preferences.h"
@@ -26,7 +27,7 @@ class DutyTimeSensor final : public sensor::Sensor, public PollingComponent {
 #ifdef USE_BINARY_SENSOR
   void set_sensor(binary_sensor::BinarySensor *sensor);
 #endif
-  void set_lambda(std::function<bool()> &&func) { this->func_ = func; }
+  void set_lambda(std::function<bool()> &&func) { this->func_ = std::move(func); }
   void set_last_duty_time_sensor(sensor::Sensor *sensor) { this->last_duty_time_sensor_ = sensor; }
   void set_restore(bool restore) { this->restore_ = restore; }
 

esphome/components/esp32_ble/ble_uuid.h

@@ -15,7 +15,7 @@
 namespace esphome::esp32_ble {
 
 using ble_device_base::UUID_STR_LEN;
-using ESPBTUUID = ble_device_base::ESPBTUUID;
+using ble_device_base::ESPBTUUID;
 
 }  // namespace esphome::esp32_ble
 

esphome/components/esp32_ble_tracker/esp32_ble_tracker.h

@@ -33,18 +33,18 @@ namespace esphome::esp32_ble_tracker {
 
 using namespace esp32_ble;
 
-using adv_data_t = ble_device_base::adv_data_t;
+using ble_device_base::adv_data_t;
 
 #ifdef USE_ESP32_BLE_UUID
-using ServiceData = ble_device_base::ServiceData;
+using ble_device_base::ServiceData;
 #endif
 
 #ifdef USE_ESP32_BLE_DEVICE
 // The advertisement device types are owned by the platform-neutral
 // ble_device_base layer; re-exported here (esp32 only) for backward
 // compatibility. ESPBTDevice::parse_scan_rst() (esp32-only) adapts BLEScanResult.
-using ESPBLEiBeacon = ble_device_base::ESPBLEiBeacon;
-using ESPBTDevice = ble_device_base::ESPBTDevice;
+using ble_device_base::ESPBLEiBeacon;
+using ble_device_base::ESPBTDevice;
 #endif  // USE_ESP32_BLE_DEVICE
 
 class ESP32BLETracker;
@@ -82,12 +82,12 @@ struct ClientStateCounts {
 
 // The client connection state types are owned by the platform-neutral
 // ble_device_base layer; re-exported here for backward compatibility.
-using ClientState = ble_device_base::ClientState;
-using ConnectionType = ble_device_base::ConnectionType;
+using ble_device_base::ClientState;
+using ble_device_base::ConnectionType;
 using ble_device_base::client_state_to_string;
 
 // Neutral scanner lifecycle re-exported for backward compatibility.
-using ScannerState = ble_device_base::ScannerState;
+using ble_device_base::ScannerState;
 
 /// Base class for BLE GATT clients that connect to remote devices.
 ///

esphome/components/esp32_hosted/esp_now_hosted.cpp

@@ -425,7 +425,7 @@ esp_err_t esp_now_send(const uint8_t *peer_addr, const uint8_t *data, size_t len
   // task, and a shared build buffer here would let two callers corrupt each
   // other's frame. Passing the body through also drops a full-frame copy per
   // transmit, on the path this shim exists to keep quick.
-  uint8_t hdr[sizeof(esp_now_hosted_send_req_t)];
+  uint8_t hdr[sizeof(esp_now_hosted_send_req_t)] = {};
   auto *s = reinterpret_cast<esp_now_hosted_send_req_t *>(hdr);
   s->has_addr = peer_addr != nullptr ? 1 : 0;
   if (peer_addr != nullptr) {

esphome/components/esp8266/preferences.cpp

@@ -48,7 +48,8 @@ static inline bool esp_rtc_user_mem_read(uint32_t index, uint32_t *dest) {
   if (index >= ESP_RTC_USER_MEM_SIZE_WORDS) {
     return false;
   }
-  *dest = ESP_RTC_USER_MEM[index];  // NOLINT(performance-no-int-to-ptr,clang-analyzer-core.FixedAddressDereference)
+  // NOLINTNEXTLINE(performance-no-int-to-ptr,clang-analyzer-core.FixedAddressDereference,clang-analyzer-optin.core.FixedAddressDereference)
+  *dest = ESP_RTC_USER_MEM[index];
   return true;
 }
 
@@ -61,7 +62,8 @@ static inline bool esp_rtc_user_mem_write(uint32_t index, uint32_t value) {
   }
 
   auto *ptr = &ESP_RTC_USER_MEM[index];  // NOLINT(performance-no-int-to-ptr)
-  *ptr = value;                          // NOLINT(clang-analyzer-core.FixedAddressDereference)
+  // NOLINTNEXTLINE(clang-analyzer-core.FixedAddressDereference,clang-analyzer-optin.core.FixedAddressDereference)
+  *ptr = value;
   return true;
 }
 

esphome/components/ezo_pmp/ezo_pmp.cpp

@@ -175,6 +175,8 @@ void EzoPMP::read_command_result_() {
           third_parameter_buffer[position_in_parameter_buffer] = current_char;
           third_parameter_buffer[position_in_parameter_buffer + 1] = '\0';
           break;
+        default:
+          break;
       }
       position_in_parameter_buffer++;
     }

esphome/components/fingerprint_grow/fingerprint_grow.cpp

@@ -194,6 +194,8 @@ uint8_t FingerprintGrowComponent::scan_image_(uint8_t buffer) {
       ESP_LOGE(TAG, "Could not find fingerprint features");
       this->finger_scan_invalid_callback_.call();
       break;
+    default:
+      break;
   }
   return send_result;
 }

esphome/components/haier/haier_base.cpp

@@ -318,20 +318,21 @@ void HaierClimateBase::process_protocol_reset() {
 
 bool HaierClimateBase::prepare_pending_action() {
   if (this->action_request_.has_value()) {
-    switch (this->action_request_.value().action) {
+    PendingAction &request = this->action_request_.value();
+    switch (request.action) {
       case ActionRequest::SEND_CUSTOM_COMMAND:
         return true;
       case ActionRequest::TURN_POWER_ON:
-        this->action_request_.value().message = this->get_power_message(true);
+        request.message = this->get_power_message(true);
         return true;
       case ActionRequest::TURN_POWER_OFF:
-        this->action_request_.value().message = this->get_power_message(false);
+        request.message = this->get_power_message(false);
         return true;
       case ActionRequest::TOGGLE_POWER:
-        this->action_request_.value().message = this->get_power_message(this->mode == ClimateMode::CLIMATE_MODE_OFF);
+        request.message = this->get_power_message(this->mode == ClimateMode::CLIMATE_MODE_OFF);
         return true;
       default:
-        ESP_LOGW(TAG, "Unsupported action: %d", (uint8_t) this->action_request_.value().action);
+        ESP_LOGW(TAG, "Unsupported action: %d", (uint8_t) request.action);
         this->action_request_.reset();
         return false;
     }

esphome/components/haier/hon_climate.cpp

@@ -1071,6 +1071,8 @@ haier_protocol::HandlerError HonClimate::process_status_message_(const uint8_t *
       case (uint8_t) hon_protocol::FanMode::FAN_HIGH:
         this->fan_mode = CLIMATE_FAN_HIGH;
         break;
+      default:
+        break;
     }
     should_publish = should_publish || (!old_fan_mode.has_value()) ||
                      (old_fan_mode.value_or(CLIMATE_FAN_ON) != this->fan_mode.value_or(CLIMATE_FAN_ON));
@@ -1144,6 +1146,8 @@ haier_protocol::HandlerError HonClimate::process_status_message_(const uint8_t *
         case (uint8_t) hon_protocol::ConditioningMode::AUTO:
           this->mode = CLIMATE_MODE_HEAT_COOL;
           break;
+        default:
+          break;
       }
     }
     should_publish = should_publish || (old_mode != this->mode);

esphome/components/heatpumpir/receiver_mitsubishi_heavy_zmp.cpp

@@ -40,6 +40,8 @@ void decode_mitsubishi_heavy_zmp(const uint8_t frame[MITSUBISHI_HEAVY_FRAME_LENG
     case MITSUBISHI_HEAVY_ZMP_ECONO:
       climate.preset = climate::CLIMATE_PRESET_ECO;
       break;
+    default:
+      break;
   }
 
   uint8_t swing_h = frame[BYTE_SWING_H] & HORIZONTAL_SWING_MASK;

esphome/components/hitachi_ac344/hitachi_ac344.cpp

@@ -260,6 +260,8 @@ bool HitachiClimate::parse_mode_(const uint8_t remote_state[]) {
       case HITACHI_AC344_MODE_FAN:
         this->mode = climate::CLIMATE_MODE_FAN_ONLY;
         break;
+      default:
+        break;
     }
   } else {
     this->mode = climate::CLIMATE_MODE_OFF;
@@ -294,6 +296,8 @@ bool HitachiClimate::parse_fan_(const uint8_t remote_state[]) {
     case HITACHI_AC344_FAN_AUTO:
       this->fan_mode = climate::CLIMATE_FAN_AUTO;
       break;
+    default:
+      break;
   }
   return true;
 }

esphome/components/hitachi_ac424/hitachi_ac424.cpp

@@ -255,6 +255,8 @@ bool HitachiClimate::parse_mode_(const uint8_t remote_state[]) {
       case HITACHI_AC424_MODE_FAN:
         this->mode = climate::CLIMATE_MODE_FAN_ONLY;
         break;
+      default:
+        break;
     }
   } else {
     this->mode = climate::CLIMATE_MODE_OFF;
@@ -289,6 +291,8 @@ bool HitachiClimate::parse_fan_(const uint8_t remote_state[]) {
     case HITACHI_AC424_FAN_AUTO:
       this->fan_mode = climate::CLIMATE_FAN_AUTO;
       break;
+    default:
+      break;
   }
   return true;
 }

esphome/components/improv_base/improv_base.cpp

@@ -69,7 +69,7 @@ size_t ImprovBase::get_formatted_next_url_(char *buffer, size_t buffer_size) {
 void ImprovBase::add_next_url_(improv::RpcResponseBuilder &builder, size_t max_len) {
   // The builder rejects strings above 254 bytes, so anything longer than this
   // buffer could never be sent anyway
-  char url_buffer[256];
+  char url_buffer[256] = {};
   size_t len = this->get_formatted_next_url_(url_buffer, sizeof(url_buffer));
   if (len == 0) {
     return;

esphome/components/json/json_util.h

@@ -4,6 +4,7 @@
 #include <cstddef>
 #include <cstring>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "esphome/core/defines.h"
@@ -50,15 +51,15 @@ template<size_t STACK_SIZE = 640> class SerializationBuffer {
   ~SerializationBuffer() { delete[] heap_buffer_; }
 
   // Move constructor - works with same template instantiation
-  SerializationBuffer(SerializationBuffer &&other) noexcept : heap_buffer_(other.heap_buffer_), size_(other.size_) {
+  SerializationBuffer(SerializationBuffer &&other) noexcept
+      : heap_buffer_(std::exchange(other.heap_buffer_, nullptr)), size_(other.size_) {
     if (other.buffer_ == other.stack_buffer_) {
       // Stack buffer - must copy content
       std::memcpy(stack_buffer_, other.stack_buffer_, size_ + 1);
       buffer_ = stack_buffer_;
     } else {
-      // Heap buffer - steal ownership
+      // Heap buffer - ownership was taken above
       buffer_ = heap_buffer_;
-      other.heap_buffer_ = nullptr;
     }
     // Leave moved-from object in valid empty state
     other.stack_buffer_[0] = '\0';
@@ -70,14 +71,13 @@ template<size_t STACK_SIZE = 640> class SerializationBuffer {
   SerializationBuffer &operator=(SerializationBuffer &&other) noexcept {
     if (this != &other) {
       delete[] heap_buffer_;
-      heap_buffer_ = other.heap_buffer_;
+      heap_buffer_ = std::exchange(other.heap_buffer_, nullptr);
       size_ = other.size_;
       if (other.buffer_ == other.stack_buffer_) {
         std::memcpy(stack_buffer_, other.stack_buffer_, size_ + 1);
         buffer_ = stack_buffer_;
       } else {
         buffer_ = heap_buffer_;
-        other.heap_buffer_ = nullptr;
       }
       // Leave moved-from object in valid empty state
       other.stack_buffer_[0] = '\0';

esphome/components/kuntze/kuntze.cpp

@@ -61,6 +61,8 @@ void Kuntze::on_read_holding_registers(uint16_t start_address, std::span<const u
       if (this->oci_sensor_ != nullptr)
         this->oci_sensor_->publish_state(value);
       break;
+    default:
+      break;
   }
 }
 

esphome/components/ld2410/ld2410.cpp

@@ -9,27 +9,12 @@
 
 #include "esphome/core/application.h"
 #include "esphome/core/helpers.h"
+#include "esphome/core/progmem.h"
 
 namespace esphome::ld2410 {
 
 ESPHOME_LOG_TAG(TAG, "ld2410");
 
-enum BaudRate : uint8_t {
-  BAUD_RATE_9600 = 1,
-  BAUD_RATE_19200 = 2,
-  BAUD_RATE_38400 = 3,
-  BAUD_RATE_57600 = 4,
-  BAUD_RATE_115200 = 5,
-  BAUD_RATE_230400 = 6,
-  BAUD_RATE_256000 = 7,
-  BAUD_RATE_460800 = 8,
-};
-
-enum DistanceResolution : uint8_t {
-  DISTANCE_RESOLUTION_0_2 = 0x01,
-  DISTANCE_RESOLUTION_0_75 = 0x00,
-};
-
 enum LightFunction : uint8_t {
   LIGHT_FUNCTION_OFF = 0x00,
   LIGHT_FUNCTION_BELOW = 0x01,
@@ -69,73 +54,17 @@ enum AckData : uint8_t {
   COMMAND_STATUS = 7,
 };
 
-// Memory-efficient lookup tables
-struct StringToUint8 {
-  const char *str;
-  const uint8_t value;
-};
+// Index + 1 is the BaudRate value; the select options use the same order
+PROGMEM_STRING_TABLE(BaudRateStrings, "9600", "19200", "38400", "57600", "115200", "230400", "256000", "460800");
+static_assert(BAUD_RATE_9600 == 1 && BAUD_RATE_460800 == BaudRateStrings::COUNT, "BaudRate is index + 1");
+// Same order as DISTANCE_RESOLUTIONS
+PROGMEM_STRING_TABLE(DistanceResolutionStrings, "0.2m", "0.75m");
+// The light function and out pin level select options are in enum order
+static_assert(LIGHT_FUNCTION_OFF == 0 && LIGHT_FUNCTION_BELOW == 1 && LIGHT_FUNCTION_ABOVE == 2,
+              "LightFunction is the select option index");
+static_assert(OUT_PIN_LEVEL_LOW == 0 && OUT_PIN_LEVEL_HIGH == 1, "OutPinLevel is the select option index");
 
-struct Uint8ToString {
-  const uint8_t value;
-  const char *str;
-};
-
-constexpr StringToUint8 BAUD_RATES_BY_STR[] = {
-    {"9600", BAUD_RATE_9600},     {"19200", BAUD_RATE_19200},   {"38400", BAUD_RATE_38400},
-    {"57600", BAUD_RATE_57600},   {"115200", BAUD_RATE_115200}, {"230400", BAUD_RATE_230400},
-    {"256000", BAUD_RATE_256000}, {"460800", BAUD_RATE_460800},
-};
-
-constexpr StringToUint8 DISTANCE_RESOLUTIONS_BY_STR[] = {
-    {"0.2m", DISTANCE_RESOLUTION_0_2},
-    {"0.75m", DISTANCE_RESOLUTION_0_75},
-};
-
-constexpr Uint8ToString DISTANCE_RESOLUTIONS_BY_UINT[] = {
-    {DISTANCE_RESOLUTION_0_2, "0.2m"},
-    {DISTANCE_RESOLUTION_0_75, "0.75m"},
-};
-
-constexpr StringToUint8 LIGHT_FUNCTIONS_BY_STR[] = {
-    {"off", LIGHT_FUNCTION_OFF},
-    {"below", LIGHT_FUNCTION_BELOW},
-    {"above", LIGHT_FUNCTION_ABOVE},
-};
-
-constexpr Uint8ToString LIGHT_FUNCTIONS_BY_UINT[] = {
-    {LIGHT_FUNCTION_OFF, "off"},
-    {LIGHT_FUNCTION_BELOW, "below"},
-    {LIGHT_FUNCTION_ABOVE, "above"},
-};
-
-constexpr StringToUint8 OUT_PIN_LEVELS_BY_STR[] = {
-    {"low", OUT_PIN_LEVEL_LOW},
-    {"high", OUT_PIN_LEVEL_HIGH},
-};
-
-constexpr Uint8ToString OUT_PIN_LEVELS_BY_UINT[] = {
-    {OUT_PIN_LEVEL_LOW, "low"},
-    {OUT_PIN_LEVEL_HIGH, "high"},
-};
-
-constexpr uint32_t BAUD_RATES[] = {9600, 19200, 38400, 57600, 115200, 230400, 256000, 460800};
-
-// Helper functions for lookups
-template<size_t N> uint8_t find_uint8(const StringToUint8 (&arr)[N], const char *str) {
-  for (const auto &entry : arr) {
-    if (strcmp(str, entry.str) == 0)
-      return entry.value;
-  }
-  return 0xFF;  // Not found
-}
-
-template<size_t N> const char *find_str(const Uint8ToString (&arr)[N], uint8_t value) {
-  for (const auto &entry : arr) {
-    if (value == entry.value)
-      return entry.str;
-  }
-  return "";  // Not found
-}
+static constexpr uint32_t BAUD_RATES[] PROGMEM = {9600, 19200, 38400, 57600, 115200, 230400, 256000, 460800};
 
 // Commands
 static constexpr uint8_t CMD_ENABLE_CONF = 0xFF;
@@ -407,7 +336,7 @@ void LD2410Component::handle_periodic_data_() {
 }
 
 #ifdef USE_NUMBER
-std::function<void(void)> set_number_value(number::Number *n, float value) {
+std::function<void()> set_number_value(number::Number *n, float value) {
   if (n != nullptr && (!n->has_state() || n->state != value)) {
     n->state = value;
     return [n, value]() { n->publish_state(value); };
@@ -469,11 +398,16 @@ bool LD2410Component::handle_ack_data_() {
     }
 
     case CMD_QUERY_DISTANCE_RESOLUTION: {
-      const auto *distance_resolution = find_str(DISTANCE_RESOLUTIONS_BY_UINT, this->buffer_data_[10]);
-      ESP_LOGV(TAG, "Distance resolution: %s", distance_resolution);
+      const auto index = ld24xx::find_index(DISTANCE_RESOLUTIONS, this->buffer_data_[10]);
+      if (!index) {
+        ESP_LOGW(TAG, "Unknown distance resolution %u", this->buffer_data_[10]);
+        break;
+      }
+      ESP_LOGV(TAG, "Distance resolution: %s",
+               LOG_STR_ARG(DistanceResolutionStrings::get_log_str(*index, DistanceResolutionStrings::LAST_INDEX)));
 #ifdef USE_SELECT
       if (this->distance_resolution_select_ != nullptr) {
-        this->distance_resolution_select_->publish_state(distance_resolution);
+        this->distance_resolution_select_->publish_state(*index);
       }
 #endif
       break;
@@ -483,16 +417,14 @@ bool LD2410Component::handle_ack_data_() {
       this->light_function_ = this->buffer_data_[10];
       this->light_threshold_ = this->buffer_data_[11];
       this->out_pin_level_ = this->buffer_data_[12];
-      const auto *light_function_str = find_str(LIGHT_FUNCTIONS_BY_UINT, this->light_function_);
-      const auto *out_pin_level_str = find_str(OUT_PIN_LEVELS_BY_UINT, this->out_pin_level_);
-      ESP_LOGV(TAG, "Light function: %s, threshold: %u, out pin level: %s", light_function_str, this->light_threshold_,
-               out_pin_level_str);
+      ESP_LOGV(TAG, "Light function: %u, threshold: %u, out pin level: %u", this->light_function_,
+               this->light_threshold_, this->out_pin_level_);
 #ifdef USE_SELECT
       if (this->light_function_select_ != nullptr) {
-        this->light_function_select_->publish_state(light_function_str);
+        this->light_function_select_->publish_state(static_cast<size_t>(this->light_function_));
       }
       if (this->out_pin_level_select_ != nullptr) {
-        this->out_pin_level_select_->publish_state(out_pin_level_str);
+        this->out_pin_level_select_->publish_state(static_cast<size_t>(this->out_pin_level_));
       }
 #endif
 #ifdef USE_NUMBER
@@ -560,7 +492,7 @@ bool LD2410Component::handle_ack_data_() {
         Moving distance range: 13th byte
         Still distance range: 14th byte
       */
-      std::vector<std::function<void(void)>> updates;
+      std::vector<std::function<void()>> updates;
       updates.push_back(set_number_value(this->max_move_distance_gate_number_, this->buffer_data_[12]));
       updates.push_back(set_number_value(this->max_still_distance_gate_number_, this->buffer_data_[13]));
       /*
@@ -638,15 +570,29 @@ void LD2410Component::set_bluetooth(bool enable) {
 }
 
 void LD2410Component::set_distance_resolution(const char *state) {
+  const int16_t index = progmem_string_table_find<DistanceResolutionStrings>(state, strlen(state));
+  if (index >= 0) {
+    this->set_distance_resolution(static_cast<DistanceResolution>(progmem_read_byte(&DISTANCE_RESOLUTIONS[index])));
+  }
+}
+
+void LD2410Component::set_distance_resolution(DistanceResolution resolution) {
   this->set_config_mode_(true);
-  const uint8_t cmd_value[2] = {find_uint8(DISTANCE_RESOLUTIONS_BY_STR, state), 0x00};
+  const uint8_t cmd_value[2] = {resolution, 0x00};
   this->send_command_(CMD_SET_DISTANCE_RESOLUTION, cmd_value, sizeof(cmd_value));
   this->set_timeout(200, [this]() { this->restart_and_read_all_info(); });
 }
 
 void LD2410Component::set_baud_rate(const char *state) {
+  const int16_t index = progmem_string_table_find<BaudRateStrings>(state, strlen(state));
+  if (index >= 0) {
+    this->set_baud_rate(static_cast<BaudRate>(index + 1));
+  }
+}
+
+void LD2410Component::set_baud_rate(BaudRate rate) {
   this->set_config_mode_(true);
-  const uint8_t cmd_value[2] = {find_uint8(BAUD_RATES_BY_STR, state), 0x00};
+  const uint8_t cmd_value[2] = {rate, 0x00};
   this->send_command_(CMD_SET_BAUD_RATE, cmd_value, sizeof(cmd_value));
   this->set_timeout(200, [this]() { this->restart_(); });
 }
@@ -769,11 +715,15 @@ void LD2410Component::set_light_out_control() {
   }
 #endif
 #ifdef USE_SELECT
-  if (this->light_function_select_ != nullptr && this->light_function_select_->has_state()) {
-    this->light_function_ = find_uint8(LIGHT_FUNCTIONS_BY_STR, this->light_function_select_->current_option().c_str());
+  if (this->light_function_select_ != nullptr) {
+    if (const auto index = this->light_function_select_->active_index()) {
+      this->light_function_ = *index;
+    }
   }
-  if (this->out_pin_level_select_ != nullptr && this->out_pin_level_select_->has_state()) {
-    this->out_pin_level_ = find_uint8(OUT_PIN_LEVELS_BY_STR, this->out_pin_level_select_->current_option().c_str());
+  if (this->out_pin_level_select_ != nullptr) {
+    if (const auto index = this->out_pin_level_select_->active_index()) {
+      this->out_pin_level_ = *index;
+    }
   }
 #endif
   this->set_config_mode_(true);

esphome/components/ld2410/ld2410.h

@@ -37,6 +37,25 @@ using namespace ld24xx;
 static constexpr uint8_t MAX_LINE_LENGTH = 50;
 static constexpr uint8_t TOTAL_GATES = 9;  // Total number of gates supported by the LD2410
 
+enum BaudRate : uint8_t {
+  BAUD_RATE_9600 = 1,
+  BAUD_RATE_19200 = 2,
+  BAUD_RATE_38400 = 3,
+  BAUD_RATE_57600 = 4,
+  BAUD_RATE_115200 = 5,
+  BAUD_RATE_230400 = 6,
+  BAUD_RATE_256000 = 7,
+  BAUD_RATE_460800 = 8,
+};
+
+enum DistanceResolution : uint8_t {
+  DISTANCE_RESOLUTION_0_2 = 0x01,
+  DISTANCE_RESOLUTION_0_75 = 0x00,
+};
+
+// Device values of the distance resolution select options, in option order; in flash on ESP8266
+static constexpr uint8_t DISTANCE_RESOLUTIONS[] PROGMEM = {DISTANCE_RESOLUTION_0_2, DISTANCE_RESOLUTION_0_75};
+
 class LD2410Component final : public Component, public uart::UARTDevice {
 #ifdef USE_BINARY_SENSOR
   SUB_BINARY_SENSOR(out_pin_presence_status)
@@ -99,7 +118,9 @@ class LD2410Component final : public Component, public uart::UARTDevice {
   void restart_and_read_all_info();
   void set_bluetooth(bool enable);
   void set_distance_resolution(const char *state);
+  void set_distance_resolution(DistanceResolution resolution);
   void set_baud_rate(const char *state);
+  void set_baud_rate(BaudRate rate);
   void factory_reset();
 
  protected:

esphome/components/ld2410/select/__init__.py

@@ -52,6 +52,7 @@ CONFIG_SCHEMA = {
 async def to_code(config: ConfigType) -> None:
     hub = await cg.get_variable(config[CONF_LD2410_ID])
     selects = select.sub_selects(config, parent=hub)
+    # Option lists follow the order of the C++ enums and tables; the hub maps by index
     await selects(
         CONF_DISTANCE_RESOLUTION,
         hub.set_distance_resolution_select,

esphome/components/ld2410/select/baud_rate_select.cpp

@@ -4,7 +4,7 @@ namespace esphome::ld2410 {
 
 void BaudRateSelect::control(size_t index) {
   this->publish_state(index);
-  this->parent_->set_baud_rate(this->option_at(index));
+  this->parent_->set_baud_rate(static_cast<BaudRate>(index + 1));
 }
 
 }  // namespace esphome::ld2410

esphome/components/ld2410/select/distance_resolution_select.cpp

@@ -4,7 +4,8 @@ namespace esphome::ld2410 {
 
 void DistanceResolutionSelect::control(size_t index) {
   this->publish_state(index);
-  this->parent_->set_distance_resolution(this->option_at(index));
+  this->parent_->set_distance_resolution(
+      static_cast<DistanceResolution>(progmem_read_byte(&DISTANCE_RESOLUTIONS[index])));
 }
 
 }  // namespace esphome::ld2410

esphome/components/ld24xx/ld24xx.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include "esphome/core/defines.h"
+#include "esphome/core/hal.h"
 #include "esphome/core/helpers.h"
 
 #include <memory>
@@ -24,10 +25,17 @@
 
 namespace esphome::ld24xx {
 
-// Helper to find index of value in constexpr array
-template<size_t N> optional<size_t> find_index(const uint32_t (&arr)[N], uint32_t value) {
+// Index of value in a constant table that may live in flash, or none
+template<typename T, size_t N> optional<size_t> find_index(const T (&arr)[N], T value) {
+  static_assert(sizeof(T) == 1 || sizeof(T) == 4, "flash tables are read as bytes or aligned 32 bit words");
   for (size_t i = 0; i < N; i++) {
-    if (arr[i] == value)
+    T entry;
+    if constexpr (sizeof(T) == 1) {
+      entry = progmem_read_byte(reinterpret_cast<const uint8_t *>(&arr[i]));
+    } else {
+      entry = arr[i];  // an aligned 32 bit read from flash is safe on ESP8266
+    }
+    if (entry == value)
       return i;
   }
   return {};

esphome/components/libretiny/preferences.cpp

@@ -230,7 +230,8 @@ bool LibreTinyPreferences::is_changed_(fdb_kvdb_t db, const NVSData &to_save, co
     return true;
   }
 
-  // Compare the actual data
+  // Compare the actual data. fdb_kv_get_blob filled stored_data through this->blob, which the analyzer cannot see.
+  // NOLINTNEXTLINE(clang-analyzer-unix.cstring.UninitializedRead)
   return memcmp(to_save.data.data(), stored_data.get(), kv.value_len) != 0;
 }
 

esphome/components/lightwaverf/LwRx.cpp

@@ -218,6 +218,8 @@ bool LwRx::lwrx_getmessage(uint8_t *buf, uint8_t len) {
         case 10:
           buf[i] = j;
           break;
+        default:
+          break;
       }
     }
   } else {

esphome/components/mcp23016/mcp23016.h

@@ -38,7 +38,7 @@ class MCP23016 final : public Component, public i2c::I2CDevice, public gpio_expa
   void set_interrupt_pin(InternalGPIOPin *pin) { this->interrupt_pin_ = pin; }
 
  protected:
-  static void IRAM_ATTR gpio_intr(MCP23016 *arg);
+  static void gpio_intr(MCP23016 *arg);
   // Virtual methods from CachedGpioExpander
   bool digital_read_hw(uint8_t pin) override;
   bool digital_read_cache(uint8_t pin) override;

esphome/components/mcp23xxx_base/mcp23xxx_base.h

@@ -10,7 +10,7 @@ enum MCP23XXXInterruptMode : uint8_t { MCP23XXX_NO_INTERRUPT = 0, MCP23XXX_CHANG
 
 // Not a template member: GCC 10 (ESP8266) ignores section attributes on template instantiations, leaving the
 // ISR in flash.
-void IRAM_ATTR mcp23xxx_gpio_intr(Component *arg);
+void mcp23xxx_gpio_intr(Component *arg);
 
 template<uint8_t N> class MCP23XXXBase : public Component, public gpio_expander::CachedGpioExpander<uint8_t, N> {
  public:

esphome/components/mcp4461/mcp4461.cpp

@@ -81,6 +81,8 @@ void Mcp4461Component::initialize_terminal_disabled(Mcp4461WiperIdx wiper, char
     case 'w':
       this->reg_[wiper_idx].terminal_w = false;
       break;
+    default:
+      break;
   }
 }
 

esphome/components/modbus_controller/modbus_controller.cpp

@@ -652,7 +652,7 @@ ModbusCommandItem ModbusCommandItem::create_custom_command(
       ESP_LOGI(TAG, "Custom Command sent");
     };
   } else {
-    cmd.on_data_func = handler;
+    cmd.on_data_func = std::move(handler);
   }
   cmd.payload.set(values.data(), values.size());
 
@@ -669,7 +669,7 @@ ModbusCommandItem ModbusCommandItem::create_custom_command(
       ESP_LOGI(TAG, "Custom Command sent");
     };
   } else {
-    cmd.on_data_func = handler;
+    cmd.on_data_func = std::move(handler);
   }
   uint8_t *p = cmd.payload.init(values.size() * 2);
   for (auto v : values) {

esphome/components/mt6701_i2c/__init__.py

@@ -3,7 +3,7 @@ from typing import Any
 from esphome import automation
 import esphome.codegen as cg
 from esphome.components import i2c
-from esphome.components.const import CONF_PWM_FREQUENCY
+from esphome.components.const import CONF_OUT_PIN, CONF_PWM_FREQUENCY
 import esphome.config_validation as cv
 from esphome.const import CONF_DIRECTION, CONF_HYSTERESIS, CONF_ID, CONF_MODE
 from esphome.types import ConfigType
@@ -28,7 +28,6 @@ CONF_PULSES_PER_REVOLUTION = "pulses_per_revolution"
 CONF_Z_PULSE_WIDTH = "z_pulse_width"
 CONF_UVW = "uvw"
 CONF_POLE_PAIRS = "pole_pairs"
-CONF_OUT_PIN = "out_pin"
 CONF_PWM_POLARITY = "pwm_polarity"
 CONF_ANALOG_START = "analog_start"
 CONF_ANALOG_STOP = "analog_stop"

esphome/components/nfc/nfc_helpers.cpp

@@ -28,12 +28,12 @@ std::string get_random_ha_tag_ndef() {
   for (int i = 0; i < 8; i++) {
     uri += ALPHANUM[random_uint32() % (sizeof(ALPHANUM) - 1)];
   }
-  uri += "-";
+  uri += '-';
   for (int j = 0; j < 3; j++) {
     for (int i = 0; i < 4; i++) {
       uri += ALPHANUM[random_uint32() % (sizeof(ALPHANUM) - 1)];
     }
-    uri += "-";
+    uri += '-';
   }
   for (int i = 0; i < 12; i++) {
     uri += ALPHANUM[random_uint32() % (sizeof(ALPHANUM) - 1)];

esphome/components/noblex/noblex.cpp

@@ -254,6 +254,8 @@ bool NoblexClimate::on_receive(remote_base::RemoteReceiveData data) {
       case IRNoblexMode::IR_NOBLEX_MODE_HEAT:
         this->mode = climate::CLIMATE_MODE_HEAT;
         break;
+      default:
+        break;
     }
   }
 

esphome/components/opentherm/__init__.py

@@ -3,6 +3,7 @@ from typing import Any
 from esphome import automation, pins
 import esphome.codegen as cg
 from esphome.components import sensor
+from esphome.components.const import CONF_OUT_PIN
 from esphome.components.esp32 import include_builtin_idf_component
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, PLATFORM_ESP32, PLATFORM_ESP8266
@@ -15,7 +16,6 @@ DOMAIN = "opentherm"
 MULTI_CONF = True
 
 CONF_IN_PIN = "in_pin"
-CONF_OUT_PIN = "out_pin"
 CONF_CH_ENABLE = "ch_enable"
 CONF_DHW_ENABLE = "dhw_enable"
 CONF_COOLING_ENABLE = "cooling_enable"

esphome/components/pca6416a/pca6416a.h

@@ -27,7 +27,7 @@ class PCA6416AComponent final : public Component,
   void set_interrupt_pin(InternalGPIOPin *pin) { this->interrupt_pin_ = pin; }
 
  protected:
-  static void IRAM_ATTR gpio_intr(PCA6416AComponent *arg);
+  static void gpio_intr(PCA6416AComponent *arg);
   // Virtual methods from CachedGpioExpander
   bool digital_read_hw(uint8_t pin) override;
   bool digital_read_cache(uint8_t pin) override;

esphome/components/pca9505/pca9505.h

@@ -29,7 +29,7 @@ class PCA9505Component final : public Component,
   void dump_config() override;
 
  protected:
-  static void IRAM_ATTR gpio_intr(PCA9505Component *arg);
+  static void gpio_intr(PCA9505Component *arg);
 
   bool digital_read_hw(uint8_t pin) override;
   bool digital_read_cache(uint8_t pin) override;

esphome/components/pca9554/pca9554.h

@@ -38,7 +38,7 @@ class PCA9554Component final : public Component,
 #endif
 
  protected:
-  static void IRAM_ATTR gpio_intr(PCA9554Component *arg);
+  static void gpio_intr(PCA9554Component *arg);
 
   bool read_inputs_();
   bool write_register_(uint8_t reg, uint16_t value) { return this->write_address_(reg * this->reg_width_, value); }

esphome/components/pcf8574/pcf8574.h

@@ -33,7 +33,7 @@ class PCF8574Component final : public Component,
   void dump_config() override;
 
  protected:
-  static void IRAM_ATTR gpio_intr(PCF8574Component *arg);
+  static void gpio_intr(PCF8574Component *arg);
 
   bool digital_read_hw(uint8_t pin) override;
   bool digital_read_cache(uint8_t pin) override;

esphome/components/pi4ioe5v6408/pi4ioe5v6408.h

@@ -25,7 +25,7 @@ class PI4IOE5V6408Component final : public Component,
   void set_interrupt_pin(InternalGPIOPin *pin) { this->interrupt_pin_ = pin; }
 
  protected:
-  static void IRAM_ATTR gpio_intr(PI4IOE5V6408Component *arg);
+  static void gpio_intr(PI4IOE5V6408Component *arg);
 
   bool digital_read_hw(uint8_t pin) override;
   bool digital_read_cache(uint8_t pin) override;

esphome/components/pipsolar/pipsolar.cpp

@@ -656,6 +656,8 @@ void Pipsolar::handle_qpiws_(const char *message) {
         this->publish_binary_sensor_(enabled, this->warning_battery_equalization_);
         value_warnings_present |= enabled.value_or(false);
         break;
+      default:
+        break;
     }
   }
 

esphome/components/pulse_counter/pulse_counter_sensor.cpp

@@ -29,18 +29,16 @@ void IRAM_ATTR BasicPulseCounterStorage::gpio_intr(BasicPulseCounterStorage *arg
   if (discard)
     return;
 
-  PulseCounterCountMode mode = arg->isr_pin.digital_read() ? arg->rising_edge_mode : arg->falling_edge_mode;
-  switch (mode) {
-    case PULSE_COUNTER_DISABLE:
-      break;
-    case PULSE_COUNTER_INCREMENT: {
-      auto x = arg->counter + 1;
-      arg->counter = x;
-    } break;
-    case PULSE_COUNTER_DECREMENT: {
-      auto x = arg->counter - 1;
-      arg->counter = x;
-    } break;
+  PulseCounterCountMode mode = arg->fixed_mode;
+  if (mode == PULSE_COUNTER_DISABLE) {
+    mode = arg->isr_pin.digital_read() ? arg->rising_edge_mode : arg->falling_edge_mode;
+  }
+  if (mode == PULSE_COUNTER_INCREMENT) {
+    auto x = arg->counter + 1;
+    arg->counter = x;
+  } else if (mode == PULSE_COUNTER_DECREMENT) {
+    auto x = arg->counter - 1;
+    arg->counter = x;
   }
 }
 
@@ -48,7 +46,24 @@ bool BasicPulseCounterStorage::pulse_counter_setup(InternalGPIOPin *pin) {
   this->pin = pin;
   this->pin->setup();
   this->isr_pin = this->pin->to_isr();
-  this->pin->attach_interrupt(BasicPulseCounterStorage::gpio_intr, this, gpio::INTERRUPT_ANY_EDGE);
+  const bool rising = this->rising_edge_mode != PULSE_COUNTER_DISABLE;
+  const bool falling = this->falling_edge_mode != PULSE_COUNTER_DISABLE;
+  if (!rising && !falling) {
+    return true;
+  }
+  gpio::InterruptType type = gpio::INTERRUPT_ANY_EDGE;
+  if (this->filter_us == 0) {
+    if (!falling) {
+      type = gpio::INTERRUPT_RISING_EDGE;
+      this->fixed_mode = this->rising_edge_mode;
+    } else if (!rising) {
+      type = gpio::INTERRUPT_FALLING_EDGE;
+      this->fixed_mode = this->falling_edge_mode;
+    } else if (this->rising_edge_mode == this->falling_edge_mode) {
+      this->fixed_mode = this->rising_edge_mode;
+    }
+  }
+  this->pin->attach_interrupt(BasicPulseCounterStorage::gpio_intr, this, type);
   return true;
 }
 
@@ -166,6 +181,32 @@ pulse_counter_t HwPulseCounterStorage::read_raw_value() {
 }
 #endif  // HAS_PCNT
 
+bool PulseCounterSensor::before_setup_() {
+  if (this->storage_.pin == nullptr) {
+    return true;
+  }
+  ESP_LOGE(TAG, "Edge modes and filter cannot change after setup");
+  return false;
+}
+
+void PulseCounterSensor::set_rising_edge_mode(PulseCounterCountMode mode) {
+  if (this->before_setup_()) {
+    this->storage_.rising_edge_mode = mode;
+  }
+}
+
+void PulseCounterSensor::set_falling_edge_mode(PulseCounterCountMode mode) {
+  if (this->before_setup_()) {
+    this->storage_.falling_edge_mode = mode;
+  }
+}
+
+void PulseCounterSensor::set_filter_us(uint32_t filter) {
+  if (this->before_setup_()) {
+    this->storage_.filter_us = filter;
+  }
+}
+
 void PulseCounterSensor::setup() {
   if (!this->storage_.pulse_counter_setup(this->pin_)) {
     this->mark_failed();

esphome/components/pulse_counter/pulse_counter_sensor.h

@@ -28,7 +28,7 @@ struct PulseCounterStorageBase {
   virtual bool pulse_counter_setup(InternalGPIOPin *pin) = 0;
   virtual pulse_counter_t read_raw_value() = 0;
 
-  InternalGPIOPin *pin;
+  InternalGPIOPin *pin{nullptr};
   PulseCounterCountMode rising_edge_mode{PULSE_COUNTER_INCREMENT};
   PulseCounterCountMode falling_edge_mode{PULSE_COUNTER_DISABLE};
   uint32_t filter_us{0};
@@ -45,6 +45,7 @@ struct BasicPulseCounterStorage : public PulseCounterStorageBase {
   volatile uint32_t last_pulse{0};
 
   ISRInternalGPIOPin isr_pin;
+  PulseCounterCountMode fixed_mode{PULSE_COUNTER_DISABLE};
 };
 
 #ifdef HAS_PCNT
@@ -64,9 +65,9 @@ class PulseCounterSensor final : public sensor::Sensor, public PollingComponent
   explicit PulseCounterSensor(bool hw_pcnt = false) : storage_(*get_storage(hw_pcnt)) {}
 
   void set_pin(InternalGPIOPin *pin) { pin_ = pin; }
-  void set_rising_edge_mode(PulseCounterCountMode mode) { storage_.rising_edge_mode = mode; }
-  void set_falling_edge_mode(PulseCounterCountMode mode) { storage_.falling_edge_mode = mode; }
-  void set_filter_us(uint32_t filter) { storage_.filter_us = filter; }
+  void set_rising_edge_mode(PulseCounterCountMode mode);
+  void set_falling_edge_mode(PulseCounterCountMode mode);
+  void set_filter_us(uint32_t filter);
   void set_total_sensor(sensor::Sensor *total_sensor) { total_sensor_ = total_sensor; }
 
   void set_total_pulses(uint32_t pulses);
@@ -77,6 +78,8 @@ class PulseCounterSensor final : public sensor::Sensor, public PollingComponent
   void dump_config() override;
 
  protected:
+  bool before_setup_();
+
   InternalGPIOPin *pin_;
   PulseCounterStorageBase &storage_;
   uint32_t last_time_{0};

esphome/components/qmc5883l/qmc5883l.h

@@ -44,7 +44,7 @@ class QMC5883LComponent final : public PollingComponent, public i2c::I2CDevice {
   void set_temperature_sensor(sensor::Sensor *temperature_sensor) { temperature_sensor_ = temperature_sensor; }
 
  protected:
-  static void IRAM_ATTR gpio_intr(QMC5883LComponent *arg);
+  static void gpio_intr(QMC5883LComponent *arg);
   void read_sensor_();
 
   QMC5883LDatarate datarate_{QMC5883L_DATARATE_10_HZ};

esphome/components/rf_bridge/rf_bridge.cpp

@@ -147,7 +147,7 @@ void RFBridgeComponent::finish_bucket_frame_() {
       buckets--;
     }
     if ((i < 3) || (buckets % 2) || (i == at - 1)) {
-      str += " ";
+      str += ' ';
     }
   }
   ESP_LOGI(TAG, "Received RFBridge Bucket: %s", str.c_str());

esphome/components/sim800l/sim800l.cpp

@@ -331,7 +331,7 @@ void Sim800LComponent::parse_cmd_(std::string message) {
         this->state_ = STATE_RECEIVED_SMS;
       } else {
         if (!this->message_.empty())
-          this->message_ += "\n";
+          this->message_ += '\n';
         this->message_ += message;
       }
       break;

esphome/components/sml/sml.cpp

@@ -108,7 +108,7 @@ bool check_sml_data(const bytes &buffer) {
 
   uint16_t crc_received = (buffer.at(buffer.size() - 2) << 8) | buffer.at(buffer.size() - 1);
   uint16_t crc_calculated = crc16(buffer.data() + 8, buffer.size() - 10, 0x6e23, 0x8408, true, true);
-  crc_calculated = (crc_calculated >> 8) | (crc_calculated << 8);
+  crc_calculated = byteswap(crc_calculated);
   if (crc_received == crc_calculated) {
     ESP_LOGV(TAG, "Checksum verification successful with CRC16/X25.");
     return true;

esphome/components/sml/text_sensor/sml_text_sensor.cpp

@@ -48,6 +48,8 @@ void SmlTextSensor::publish_val(const ObisInfo &obis_info) {
       publish_state(reinterpret_cast<const char *>(obis_info.value.begin()), obis_info.value.size());
       break;
     }
+    default:
+      break;
   }
 }
 

esphome/components/spi/spi.h

@@ -2,6 +2,7 @@
 #include "esphome/core/application.h"
 #include "esphome/core/component.h"
 #include "esphome/core/hal.h"
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include <map>
 #include <utility>
@@ -224,8 +225,7 @@ class SPIDelegate {
   // write 16 bits
   virtual void write16(uint16_t data) {
     if (this->bit_order_ == BIT_ORDER_MSB_FIRST) {
-      uint16_t buffer;
-      buffer = (data >> 8) | (data << 8);
+      uint16_t buffer = byteswap(data);
       this->write_array(reinterpret_cast<const uint8_t *>(&buffer), 2);
     } else {
       this->write_array(reinterpret_cast<const uint8_t *>(&data), 2);

esphome/components/st25r/st25r.h

@@ -106,7 +106,7 @@ class ST25R : public PollingComponent, public nfc::Nfcc {
   void finish_scan_();
   void finalize_scan_();
   void remove_tag_();
-  static void IRAM_ATTR isr(ST25R *arg);
+  static void isr(ST25R *arg);
 
   GPIOPin *reset_pin_{nullptr};
   InternalGPIOPin *irq_pin_{nullptr};

esphome/components/sx126x/sx126x.h

@@ -107,7 +107,7 @@ class SX126x final : public Component,
   Trigger<std::vector<uint8_t>, float, float> *get_packet_trigger() { return &this->packet_trigger_; }
 
  protected:
-  static void IRAM_ATTR gpio_intr(SX126x *arg);
+  static void gpio_intr(SX126x *arg);
   void configure_fsk_ook_();
   void configure_lora_();
   void set_packet_params_(uint8_t payload_length);

esphome/components/sx127x/sx127x.h

@@ -91,7 +91,7 @@ class SX127x final : public Component,
   Trigger<std::vector<uint8_t>, float, float> *get_packet_trigger() { return &this->packet_trigger_; }
 
  protected:
-  static void IRAM_ATTR gpio_intr(SX127x *arg);
+  static void gpio_intr(SX127x *arg);
   void configure_fsk_ook_();
   void configure_lora_();
   void set_mode_(uint8_t modulation, uint8_t mode);

esphome/components/tca8418/tca8418.h

@@ -58,7 +58,7 @@ class TCA8418Component : public key_provider::KeyProvider, public Component, pub
 #endif
 
   /// Wakes the loop so queued events are read. Runs in interrupt context.
-  static void IRAM_ATTR interrupt_handler(TCA8418Component *arg);
+  static void interrupt_handler(TCA8418Component *arg);
 
  protected:
   /// Write the matrix / individual-input pin configuration. Returns false on I2C failure.