Merge remote-tracking branch 'origin/dev' into socket-lwip-raw-udp

[socket] Apply SO_REUSEADDR to the pcb and unmap IPv4-mapped IPv6 destinations
[socket] Zero lwip address struct and narrow dual-stack bind promotion
2026-09-09 06:18:46 +00:00 · 2026-09-08 18:18:48 +02:00 · 2026-08-28 11:23:43 -05:00 · 2026-08-28 10:31:20 -05:00 · 2026-08-28 10:26:05 -05:00 · 2026-08-28 10:08:58 -05:00
50 changed files with 879 additions and 1665 deletions
@@ -1289,9 +1289,10 @@ def _choose_ota_platform(config: ConfigType, requested: str | None) -> str:
    The native API uses challenge-response auth with MD5/SHA256 hashing of a
    server-issued nonce, so the password is never sent over the wire; the
    ``web_server`` path uses HTTP Basic auth which transmits credentials in
-    cleartext over the LAN. (The native path also compresses the upload:
-    gzip on ESP8266 and RP2040, which inflate it at reboot, and a deflate
-    stream on ESP32/LibreTiny, which inflate it as it arrives.) Falls back to
+    cleartext over the LAN. (The native path also supports gzip compression
+    on ESP8266, where flash space is tight; on ESP32/RP2040/LibreTiny the
+    backend reports ``supports_compression() == false`` and the firmware is
+    sent uncompressed regardless of which platform is used.) Falls back to
    ``web_server`` only when that is the only available platform.
    """
    # Use a dict (insertion-ordered) instead of a list so error messages and
@@ -58,9 +58,6 @@ esp_err_t AudioReader::add_sink(const std::weak_ptr<ring_buffer::RingBuffer> &ou
  if (current_audio_file_ != nullptr) {
    // A transfer buffer isn't ncessary for a local file
    this->file_ring_buffer_ = output_ring_buffer.lock();
-    if (this->file_ring_buffer_ == nullptr) {
-      return ESP_ERR_INVALID_STATE;
-    }
    return ESP_OK;
  }

@@ -51,14 +51,14 @@ void AudioTransferBuffer::increase_buffer_length(size_t bytes) { this->buffer_le

 void AudioTransferBuffer::clear_buffered_data() {
  this->buffer_length_ = 0;
-  if (this->ring_buffer_ != nullptr) {
+  if (this->ring_buffer_.use_count() > 0) {
    this->ring_buffer_->reset();
  }
 }

 void AudioSinkTransferBuffer::clear_buffered_data() {
  this->buffer_length_ = 0;
-  if (this->ring_buffer_ != nullptr) {
+  if (this->ring_buffer_.use_count() > 0) {
    this->ring_buffer_->reset();
  }
 #ifdef USE_SPEAKER
@@ -69,7 +69,7 @@ void AudioSinkTransferBuffer::clear_buffered_data() {
 }

 bool AudioTransferBuffer::has_buffered_data() const {
-  if (this->ring_buffer_ != nullptr) {
+  if (this->ring_buffer_.use_count() > 0) {
    return ((this->ring_buffer_->available() > 0) || (this->available() > 0));
  }
  return (this->available() > 0);
@@ -144,7 +144,7 @@ size_t AudioSourceTransferBuffer::transfer_data_from_source(TickType_t ticks_to_
  size_t bytes_to_read = AudioTransferBuffer::free();
  size_t bytes_read = 0;
  if (bytes_to_read > 0) {
-    if (this->ring_buffer_ != nullptr) {
+    if (this->ring_buffer_.use_count() > 0) {
      bytes_read = this->ring_buffer_->read((void *) this->get_buffer_end(), bytes_to_read, ticks_to_wait);
    }

@@ -161,7 +161,7 @@ size_t AudioSinkTransferBuffer::transfer_data_to_sink(TickType_t ticks_to_wait,
      bytes_written = this->speaker_->play(this->data_start_, this->available(), ticks_to_wait);
    } else
 #endif
-        if (this->ring_buffer_ != nullptr) {
+        if (this->ring_buffer_.use_count() > 0) {
      bytes_written =
          this->ring_buffer_->write_without_replacement((void *) this->data_start_, this->available(), ticks_to_wait);
    } else if (this->sink_callback_ != nullptr) {
@@ -186,7 +186,7 @@ bool AudioSinkTransferBuffer::has_buffered_data() const {
    return (this->speaker_->has_buffered_data() || (this->available() > 0));
  }
 #endif
-  if (this->ring_buffer_ != nullptr) {
+  if (this->ring_buffer_.use_count() > 0) {
    return ((this->ring_buffer_->available() > 0) || (this->available() > 0));
  }
  return (this->available() > 0);
@@ -283,18 +283,10 @@ FINAL_VALIDATE_SCHEMA = ota_esphome_final_validate


 FILTER_SOURCE_FILES = filter_source_files_from_defines(
-    {
-        "ota_esphome_noise.cpp": "USE_OTA_ENCRYPTION",
-        "ota_esphome_inflate.c": "USE_OTA_DEFLATE",
-    }
+    {"ota_esphome_noise.cpp": "USE_OTA_ENCRYPTION"}
 )


-def enable_deflate() -> None:
-    """Compile the on-the-fly inflater for compressed uploads."""
-    cg.add_define("USE_OTA_DEFLATE")
-
-
@coroutine_with_priority(CoroPriority.OTA_UPDATES)
 async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
@@ -313,10 +305,6 @@ async def to_code(config: ConfigType) -> None:
    if config.get(CONF_ALLOW_PARTITION_ACCESS):
        cg.add_define("USE_OTA_PARTITIONS")

-    # ESP8266 and RP2040 inflate gzip at reboot; the rest inflate on the fly
-    if not (CORE.is_esp8266 or CORE.is_rp2):
-        enable_deflate()
-
    # One key per device: an api encryption block supplies it (static or
    # runtime) and offers; the ota block only adds the requirement
    api_conf = CORE.config.get(CONF_API) or {}
@@ -22,11 +22,8 @@
 #include "esphome/core/lwip_fast_select.h"
 #endif

-#include <algorithm>
 #include <cerrno>
 #include <cstdio>
-#include <cstring>
-#include <new>
 #include <sys/time.h>

 namespace esphome {
@@ -44,12 +41,7 @@ const noise::NoiseContext &ESPHomeOTAComponent::noise_context_() const {
 #endif
 static constexpr uint16_t OTA_BLOCK_SIZE = 8192;
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_HANDSHAKE = 20000;  // milliseconds for initial handshake
-// Milliseconds for data transfer. Covers the lwIP retransmit run seen in
-// practice for a lost chunk ack (1.5 + 3 + 6 + 12 + 24 + 48 s); the CLI waits
-// longer (espota2.DATA_PHASE_TIMEOUT) so the device is free before it retries
-static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 105000;
-static constexpr uint32_t OTA_PROGRESS_INTERVAL_MS = 1000;
-static constexpr size_t OTA_SIZE_FIELD_BYTES = 4;  // sizes on the wire are 4 bytes MSB first
+static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 90000;       // milliseconds for data transfer

 // Single-instance pointer — multi-port configs are rejected in final_validate.
 // NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables)
@@ -187,23 +179,12 @@ static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_NOISE = 0x08;
-static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_DEFLATE = 0x10;
 // Noise needs the extended protocol: the prologue binds the 2-byte feature ack
 static constexpr uint8_t CLIENT_NOISE_FEATURES =
    CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_NOISE = 0x04;
-// Raw deflate, window <= OTA_INFLATE_WINDOW_SIZE. Binding once offered: the
-// client must then send the image size frame and a deflate stream.
-static constexpr uint8_t SERVER_FEATURE_SUPPORTS_DEFLATE = 0x08;
-
-#ifdef USE_OTA_ENCRYPTION
-inline bool ESPHomeOTAComponent::noise_offered_() const {
-  return (this->handshake_buf_[1] & SERVER_FEATURE_SUPPORTS_NOISE) != 0 &&
-         (this->ota_features_ & CLIENT_NOISE_FEATURES) == CLIENT_NOISE_FEATURES;
-}
-#endif

 inline bool ESPHomeOTAComponent::extended_proto_() const {
 #ifdef USE_OTA_ENCRYPTION_REQUIRED
@@ -309,7 +290,7 @@ void ESPHomeOTAComponent::handle_handshake_() {
      this->transition_ota_state_(OTAState::FEATURE_ACK);

      const bool supports_compression =
-          (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_COMPRESSION) != 0 && ota::OTABackend::supports_compression();
+          (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_COMPRESSION) != 0 && this->backend_->supports_compression();

      // Compose the feature-ack response. When the client negotiates the extended protocol we emit
      // a 2-byte response (marker + server feature flags); otherwise we emit the single-byte
@@ -329,26 +310,6 @@ void ESPHomeOTAComponent::handle_handshake_() {
 #elif defined(USE_OTA_ENCRYPTION)
        // A yaml key always exists: validation rejects the all-zeros key
        this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
-#endif
-#ifdef USE_OTA_ENCRYPTION
-        // Reserve the noise session before the optional inflate buffer, so the
-        // required allocation is not starved by the compression window
-        if (this->noise_offered_()) {
-          this->noise_reserve_session_();
-        }
-#endif
-#ifdef USE_OTA_DEFLATE
-        // Offered only once the session memory is in hand; else uncompressed
-        if ((this->ota_features_ & CLIENT_FEATURE_SUPPORTS_DEFLATE) != 0) {
-          // Value initialized: a corrupt stream that back references the
-          // window before it is filled then copies zeros, never stale memory
-          this->inflate_.reset(new (std::nothrow) InflateSession());
-          if (this->inflate_ != nullptr) {
-            this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_DEFLATE;
-          } else {
-            ESP_LOGW(TAG, "No memory to inflate");
-          }
-        }
 #endif
      } else {
        this->handshake_buf_[0] =
@@ -367,7 +328,8 @@ void ESPHomeOTAComponent::handle_handshake_() {
 #ifdef USE_OTA_ENCRYPTION
      // Latch the offer actually sent: a key activating between the two
      // states must not start a session the client never expects
-      if (this->noise_offered_()) {
+      if ((this->handshake_buf_[1] & SERVER_FEATURE_SUPPORTS_NOISE) != 0 &&
+          (this->ota_features_ & CLIENT_NOISE_FEATURES) == CLIENT_NOISE_FEATURES) {
        // handshake_buf_ still holds the feature ack composed above; a
        // would-block re-entry lands here without rebuilding it
        if (!this->noise_start_session_(this->handshake_buf_[1])) {
@@ -465,11 +427,16 @@ void ESPHomeOTAComponent::handle_data_() {
  // Backend calls overwrite this with OK; reset to UNKNOWN before any
  // goto error that follows a successful begin()/write()
  ota::OTAResponseTypes error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
-  DataTransfer xfer;
+  size_t total = 0;
+  uint32_t last_progress = 0;
+  uint32_t last_data_ms = 0;
  uint8_t buf[OTA_BUFFER_SIZE];
  char *sbuf = reinterpret_cast<char *>(buf);
-  size_t image_size;
+  size_t ota_size;
  ota::OTAType ota_type = ota::OTA_TYPE_UPDATE_APP;
+#if USE_OTA_VERSION == 2
+  size_t size_acknowledged = 0;
+#endif

  // Set socket timeouts and blocking mode (see strategy table above)
  struct timeval tv;
@@ -492,13 +459,14 @@ void ESPHomeOTAComponent::handle_data_() {
  }
  ESP_LOGV(TAG, "OTA type is 0x%02x", ota_type);

-  if (!this->read_size_(buf, xfer.ota_size, LOG_STR("size")))
+  // Read size, 4 bytes MSB first
+  if (!this->data_readall_(buf, 4)) {
+    this->log_read_error_(LOG_STR("size"));
    goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-  image_size = xfer.ota_size;
-#ifdef USE_OTA_DEFLATE
-  if (this->inflate_ != nullptr && !this->read_size_(buf, image_size, LOG_STR("image size")))
-    goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-#endif
+  }
+  ota_size = (static_cast<size_t>(buf[0]) << 24) | (static_cast<size_t>(buf[1]) << 16) |
+             (static_cast<size_t>(buf[2]) << 8) | buf[3];
+  ESP_LOGV(TAG, "Size is %zu bytes", ota_size);

 #ifndef USE_OTA_PARTITIONS
  if (ota_type != ota::OTA_TYPE_UPDATE_APP) {
@@ -518,7 +486,7 @@ void ESPHomeOTAComponent::handle_data_() {
 #endif

  // begin() returns quickly; flash sectors are erased incrementally during write().
-  error_code = this->backend_->begin(image_size, ota_type);
+  error_code = this->backend_->begin(ota_size, ota_type);
  if (error_code != ota::OTA_RESPONSE_OK)
    goto error;  // NOLINT(cppcoreguidelines-avoid-goto)

@@ -538,25 +506,75 @@ void ESPHomeOTAComponent::handle_data_() {
  // Acknowledge MD5 OK - 1 byte
  this->data_write_byte_(ota::OTA_RESPONSE_BIN_MD5_OK);

-  xfer.last_data_ms = millis();
-#ifdef USE_OTA_DEFLATE
-  if (this->inflate_ != nullptr) {
-    error_code = this->inflate_data_(buf, image_size, xfer);
-    if (error_code != ota::OTA_RESPONSE_OK)
+  // Track when we last received data so a silently-vanished peer (no FIN/RST
+  // delivered, e.g. uploader killed mid-transfer or NAT/router dropped state)
+  // can't wedge the device indefinitely. Without this, the loop only exits
+  // on actual data, EOF, or a non-EWOULDBLOCK error from read(), and lwIP
+  // TCP keepalive isn't enabled here.
+  last_data_ms = millis();
+  while (total < ota_size) {
+    if (millis() - last_data_ms > OTA_SOCKET_TIMEOUT_DATA) {
+      ESP_LOGW(TAG, "No data received for %u ms", (unsigned) OTA_SOCKET_TIMEOUT_DATA);
+      error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
      goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-  } else
-#endif
-  {
-    while (xfer.total < xfer.ota_size) {
-      ssize_t read = this->receive_data_(buf, xfer);
-      if (read < 0) {
+    }
+    size_t remaining = ota_size - total;
+    size_t requested = remaining < OTA_BUFFER_SIZE ? remaining : OTA_BUFFER_SIZE;
+    ssize_t read;
+#ifdef USE_OTA_ENCRYPTION
+    if (this->noise_ != nullptr) {
+      // One frame per call; noise_read_data_ waits internally (readall_), so
+      // there is no would-block retry here and failures are already logged.
+      read = this->noise_read_data_(buf, requested);
+      if (read <= 0) {
        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
      }
-      error_code = this->write_flash_(buf, read);
-      if (error_code != ota::OTA_RESPONSE_OK)
+    } else
+#endif
+    {
+      read = this->client_->read(buf, requested);
+      if (read == -1) {
+        const int err = errno;
+        if (this->would_block_(err)) {
+          // read() already waited up to SO_RCVTIMEO for data, just feed WDT
+          App.feed_wdt();
+          continue;
+        }
+        ESP_LOGW(TAG, "Read err %d", err);
+        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-      this->ack_written_(xfer);
+      } else if (read == 0) {
+        ESP_LOGW(TAG, "Remote closed");
+        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
+        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+      }
+    }
+
+    last_data_ms = millis();
+    error_code = this->backend_->write(buf, read);
+    if (error_code != ota::OTA_RESPONSE_OK) {
+      ESP_LOGW(TAG, "Flash write err %d", error_code);
+      goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+    }
+    total += read;
+#if USE_OTA_VERSION == 2
+    while (size_acknowledged + OTA_BLOCK_SIZE <= total || (total == ota_size && size_acknowledged < ota_size)) {
+      this->data_write_byte_(ota::OTA_RESPONSE_CHUNK_OK);
+      size_acknowledged += OTA_BLOCK_SIZE;
+    }
+#endif
+
+    uint32_t now = millis();
+    if (now - last_progress > 1000) {
+      last_progress = now;
+      float percentage = (total * 100.0f) / ota_size;
+      ESP_LOGD(TAG, "Progress: %0.1f%%", percentage);
+#ifdef USE_OTA_STATE_LISTENER
+      this->notify_state_(ota::OTA_IN_PROGRESS, percentage, 0);
+#endif
+      // feed watchdog and give other tasks a chance to run
+      this->yield_and_feed_watchdog_();
    }
  }

@@ -753,171 +771,6 @@ bool ESPHomeOTAComponent::try_write_(size_t to_write, const LogString *desc) {
  return this->handshake_buf_pos_ >= to_write;
 }

-bool ESPHomeOTAComponent::read_size_(uint8_t *buf, size_t &size, const LogString *desc) {
-  if (!this->data_readall_(buf, OTA_SIZE_FIELD_BYTES)) {
-    this->log_read_error_(desc);
-    return false;
-  }
-  size = encode_uint32(buf[0], buf[1], buf[2], buf[3]);
-  ESP_LOGV(TAG, "%s is %zu bytes", LOG_STR_ARG(desc), size);
-  return true;
-}
-
-ota::OTAResponseTypes ESPHomeOTAComponent::write_flash_(uint8_t *data, size_t len) {
-  ota::OTAResponseTypes result = this->backend_->write(data, len);
-  if (result != ota::OTA_RESPONSE_OK) {
-    ESP_LOGW(TAG, "Flash write err %d", result);
-  }
-  return result;
-}
-
-ssize_t ESPHomeOTAComponent::receive_data_(uint8_t *buf, DataTransfer &xfer) {
-  const size_t remaining = xfer.ota_size - xfer.total;
-  const size_t requested = std::min(remaining, OTA_BUFFER_SIZE);
-  ssize_t read;
-  for (;;) {
-    // A silently-vanished peer (no FIN/RST delivered, e.g. uploader killed
-    // mid-transfer or NAT/router dropped state) must not wedge the device:
-    // read() only fails on EOF or a real error, and lwIP TCP keepalive isn't
-    // enabled here.
-    if (millis() - xfer.last_data_ms > OTA_SOCKET_TIMEOUT_DATA) {
-      ESP_LOGW(TAG, "No data received for %u ms", (unsigned) OTA_SOCKET_TIMEOUT_DATA);
-      return -1;
-    }
-#ifdef USE_OTA_ENCRYPTION
-    if (this->noise_ != nullptr) {
-      // One frame per call; noise_read_data_ waits internally (readall_), so
-      // there is no would-block retry here and failures are already logged.
-      read = this->noise_read_data_(buf, requested);
-      if (read <= 0)
-        return -1;
-      break;
-    }
-#endif
-    read = this->client_->read(buf, requested);
-    if (read > 0)
-      break;
-    if (read == 0) {
-      this->log_remote_closed_(LOG_STR("data"));
-      return -1;
-    }
-    if (!this->would_block_(errno)) {
-      this->log_socket_error_(LOG_STR("data"));
-      return -1;
-    }
-    // read() already waited up to SO_RCVTIMEO for data, just feed WDT
-    App.feed_wdt();
-  }
-
-  const uint32_t now = millis();
-  xfer.last_data_ms = now;
-  xfer.total += read;
-  this->ack_received_(xfer);
-  if (now - xfer.last_progress > OTA_PROGRESS_INTERVAL_MS) {
-    xfer.last_progress = now;
-    float percentage = (xfer.total * 100.0f) / xfer.ota_size;
-    ESP_LOGD(TAG, "Progress: %0.1f%%", percentage);
-#ifdef USE_OTA_STATE_LISTENER
-    this->notify_state_(ota::OTA_IN_PROGRESS, percentage, 0);
-#endif
-    // feed watchdog and give other tasks a chance to run
-    this->yield_and_feed_watchdog_();
-  }
-  return read;
-}
-
-void ESPHomeOTAComponent::send_chunk_acks_(DataTransfer &xfer) {
-#if USE_OTA_VERSION == 2
-  while (xfer.acknowledged + OTA_BLOCK_SIZE <= xfer.total ||
-         (xfer.total == xfer.ota_size && xfer.acknowledged < xfer.ota_size)) {
-    this->data_write_byte_(ota::OTA_RESPONSE_CHUNK_OK);
-    xfer.acknowledged += OTA_BLOCK_SIZE;
-  }
-#endif
-}
-
-#ifdef USE_OTA_DEFLATE
-// The window doubles as the output buffer; flushed bytes stay as back
-// reference history for the next windowful.
-ota::OTAResponseTypes ESPHomeOTAComponent::inflate_flush_(InflateSession &session) {
-  const size_t produced = session.dest - session.window;
-  const size_t pending = produced - session.flushed;
-  if (pending != 0) {
-    if (pending > session.image_size - session.written) {
-      ESP_LOGW(TAG, "Inflate overrun");
-      return ota::OTA_RESPONSE_ERROR_UNKNOWN;
-    }
-    ota::OTAResponseTypes result = this->write_flash_(session.window + session.flushed, pending);
-    if (result != ota::OTA_RESPONSE_OK)
-      return result;
-    session.flushed = produced;
-    session.written += pending;
-    // A compressible region yields many windows per socket read
-    App.feed_wdt();
-  }
-  // Even with nothing new written: a block boundary can fall inside a header
-  this->ack_written_(*session.xfer);
-  return ota::OTA_RESPONSE_OK;
-}
-
-ota::OTAResponseTypes ESPHomeOTAComponent::inflate_data_(uint8_t *in, size_t image_size, DataTransfer &xfer) {
-  InflateSession &session = *this->inflate_;
-  session.self = this;
-  session.xfer = &xfer;
-  session.in = in;
-  session.image_size = image_size;
-  session.written = 0;
-  session.error = ota::OTA_RESPONSE_OK;
-  ota_inflate_init(&session, session.window, OTA_INFLATE_WINDOW_SIZE);
-  // Where the ack must follow the write, flush and ack before waiting for
-  // input, or the client waits for an ack while the decoder waits for data
-  session.source_read_cb = [](OtaInflateState *d) -> int {
-    auto *s = static_cast<InflateSession *>(d);
-    if (ACK_AFTER_WRITE) {
-      s->error = s->self->inflate_flush_(*s);
-      if (s->error != ota::OTA_RESPONSE_OK)
-        return -1;
-    }
-    // More input than announced; reported by the size check below
-    if (s->xfer->total >= s->xfer->ota_size)
-      return -1;
-    ssize_t read = s->self->receive_data_(s->in, *s->xfer);
-    if (read <= 0) {
-      // Already logged by receive_data_
-      s->error = ota::OTA_RESPONSE_ERROR_UNKNOWN;
-      return -1;
-    }
-    d->source = s->in + 1;
-    d->source_limit = s->in + read;
-    return s->in[0];
-  };
-
-  int res;
-  do {
-    // The ring index wrapped to 0 exactly when the window filled
-    session.dest = session.window;
-    session.dest_limit = session.window + OTA_INFLATE_WINDOW_SIZE;
-    session.flushed = 0;
-    res = ota_inflate(&session);
-    // A stored block keeps emitting zeros after a failed read, hence eof
-    if (res < 0 || session.eof)
-      break;
-    session.error = this->inflate_flush_(session);
-  } while (res != OTA_INFLATE_DONE && session.error == ota::OTA_RESPONSE_OK);
-
-  // Transport and flash failures are logged where they happen
-  if (session.error != ota::OTA_RESPONSE_OK)
-    return session.error;
-  if (res != OTA_INFLATE_DONE || session.written != image_size || xfer.total != xfer.ota_size) {
-    ESP_LOGW(TAG, "Inflate err %d, %zu of %zu B from %zu of %zu", res, session.written, image_size, xfer.total,
-             xfer.ota_size);
-    return ota::OTA_RESPONSE_ERROR_UNKNOWN;
-  }
-  ESP_LOGD(TAG, "Inflated %zu bytes from %zu", session.written, xfer.total);
-  return ota::OTA_RESPONSE_OK;
-}
-#endif  // USE_OTA_DEFLATE
-
 void ESPHomeOTAComponent::cleanup_connection_() {
  this->client_->close();
  this->client_ = nullptr;
@@ -931,9 +784,6 @@ void ESPHomeOTAComponent::cleanup_connection_() {
 #endif
 #ifdef USE_OTA_ENCRYPTION
  this->noise_ = nullptr;
-#endif
-#ifdef USE_OTA_DEFLATE
-  this->inflate_ = nullptr;
 #endif
  // Intentionally no disable_loop() — letting loop() run one more iteration catches
  // any connection that queued on the listener mid-session (otherwise the wake flag,
@@ -7,9 +7,6 @@
 #ifdef USE_OTA_ENCRYPTION
 #include "esphome/components/noise/noise_handshake.h"
 #endif
-#ifdef USE_OTA_DEFLATE
-#include "ota_esphome_inflate.h"
-#endif
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "esphome/core/preferences.h"
@@ -91,9 +88,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
  };
  // The api server's live context when the api has encryption, else our own
  const noise::NoiseContext &noise_context_() const;
-  // True once the feature ack offers noise and the client asked for it
-  bool noise_offered_() const;
-  void noise_reserve_session_();
  bool noise_start_session_(uint8_t server_feature_flags);
  bool handle_noise_handshake_();
  bool noise_try_read_frame_();
@@ -125,38 +119,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
    return this->readall_(buf, len);
  }

-  // Upload accounting shared by the data loop and the inflate read callback
-  struct DataTransfer {
-    size_t ota_size{0};  // bytes the client sends
-    size_t total{0};     // bytes received so far
-#if USE_OTA_VERSION == 2
-    size_t acknowledged{0};
-#endif
-    uint32_t last_data_ms{0};
-    uint32_t last_progress{0};
-  };
-  // Up to OTA_BUFFER_SIZE bytes into buf; returns bytes read, -1 on failure (logged)
-  inline ssize_t receive_data_(uint8_t *buf, DataTransfer &xfer);
-  // Raw lwIP cannot service the radio during a sector write, so the ack waits
-  // for the write there; a socket task lets the next block arrive meanwhile
-#ifdef USE_SOCKET_IMPL_LWIP_TCP
-  static constexpr bool ACK_AFTER_WRITE = true;
-#else
-  static constexpr bool ACK_AFTER_WRITE = false;
-#endif
-  void send_chunk_acks_(DataTransfer &xfer);
-  inline void ack_received_(DataTransfer &xfer) {
-    if (!ACK_AFTER_WRITE)
-      this->send_chunk_acks_(xfer);
-  }
-  inline void ack_written_(DataTransfer &xfer) {
-    if (ACK_AFTER_WRITE)
-      this->send_chunk_acks_(xfer);
-  }
-  inline bool read_size_(uint8_t *buf, size_t &size, const LogString *desc);
-  // Writes to the backend and logs a failure
-  inline ota::OTAResponseTypes write_flash_(uint8_t *data, size_t len);
-
  bool try_read_(size_t to_read, const LogString *desc);
  bool try_write_(size_t to_write, const LogString *desc);

@@ -209,31 +171,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
  static_assert(OTA_BUFFER_SIZE >= NOISE_CLIENT_MAX_PLAINTEXT + noise::MAC_SIZE,
                "OTA_BUFFER_SIZE must fit a full encrypted data frame");
 #endif
-#ifdef USE_OTA_DEFLATE
-  // At least 1 << espota2.DEFLATE_WINDOW_BITS; also the inflate output buffer
-  static constexpr size_t OTA_INFLATE_WINDOW_SIZE = 4096;
-  // Heap-allocated only while a deflate upload is negotiated; the decoder
-  // state is the base so the read callback can recover the session
-  struct InflateSession : OtaInflateState {
-    ESPHomeOTAComponent *self;
-    DataTransfer *xfer;
-    uint8_t *in;  // caller's buffer for the compressed input, valid during inflate_data_
-    size_t image_size;
-    size_t written;               // inflated bytes in flash
-    size_t flushed;               // bytes of the current window already in flash
-    ota::OTAResponseTypes error;  // first failure inside the read callback
-    uint8_t window[OTA_INFLATE_WINDOW_SIZE];
-  };
-#ifndef CLANG_TIDY  // static analysis sets every define at once
-  static_assert(!ota::OTABackend::supports_compression(),
-                "USE_OTA_DEFLATE is for backends that cannot store a gzip image");
-#endif
-  // Writes the decoded bytes not yet in flash without moving dest
-  ota::OTAResponseTypes inflate_flush_(InflateSession &session);
-  ota::OTAResponseTypes inflate_data_(uint8_t *in, size_t image_size, DataTransfer &xfer);
-  std::unique_ptr<InflateSession> inflate_;
-#endif
-
  static constexpr uint8_t MAGIC_BYTES[5] = {0x6C, 0x26, 0xF7, 0x5C, 0x45};
  // Derived from the feature byte; storing it would pad the trailing bytes
  bool extended_proto_() const;
@@ -1,498 +0,0 @@
-/*
- * uzlib  -  tiny deflate/inflate library (deflate, gzip, zlib)
- *
- * Copyright (c) 2003 by Joergen Ibsen / Jibz
- * All Rights Reserved
- * http://www.ibsensoftware.com/
- *
- * Copyright (c) 2014-2018 by Paul Sokolovsky
- *
- * This software is provided 'as-is', without any express
- * or implied warranty.  In no event will the authors be
- * held liable for any damages arising from the use of
- * this software.
- *
- * Permission is granted to anyone to use this software
- * for any purpose, including commercial applications,
- * and to alter it and redistribute it freely, subject to
- * the following restrictions:
- *
- * 1. The origin of this software must not be
- *    misrepresented; you must not claim that you
- *    wrote the original software. If you use this
- *    software in a product, an acknowledgment in
- *    the product documentation would be appreciated
- *    but is not required.
- *
- * 2. Altered source versions must be plainly marked
- *    as such, and must not be misrepresented as
- *    being the original software.
- *
- * 3. This notice may not be removed or altered from
- *    any source distribution.
- */
-
-/*
- * Altered for ESPHome: this is the raw deflate decoder from uzlib's
- * tinflate.c (v2.9.5) with the gzip/zlib header parsers, checksums,
- * runtime table builder and in-memory (non ring window) output path
- * removed, and the public names prefixed with ota_inflate.
- */
-
-#include "ota_esphome_inflate.h"
-
-#include <stddef.h>
-
-#define TINF_OK OTA_INFLATE_OK
-#define TINF_DONE OTA_INFLATE_DONE
-#define TINF_DATA_ERROR OTA_INFLATE_DATA_ERROR
-#define TINF_DICT_ERROR OTA_INFLATE_DICT_ERROR
-#define TINF_DATA struct OtaInflateState
-#define TINF_TREE struct OtaInflateTree
-#define TINF_ARRAY_SIZE(arr) (sizeof(arr) / sizeof(*(arr)))
-
-/* every output byte also goes into the ring window */
-#define TINF_PUT(d, c) \
-  { \
-    *d->dest++ = c; \
-    d->dict_ring[d->dict_idx++] = c; \
-    if (d->dict_idx == d->dict_size) \
-      d->dict_idx = 0; \
-  }
-
-/* --------------------------------------------------- *
- * -- constant tables (upstream builds them at runtime) -- *
- * --------------------------------------------------- */
-
-static const unsigned char LENGTH_BITS[30] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2,
-                                              2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5};
-static const unsigned short LENGTH_BASE[30] = {3,  4,  5,  6,  7,  8,  9,  10, 11,  13,  15,  17,  19,  23, 27,
-                                               31, 35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
-
-static const unsigned char DIST_BITS[30] = {0, 0, 0, 0, 1, 1, 2, 2,  3,  3,  4,  4,  5,  5,  6,
-                                            6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13};
-static const unsigned short DIST_BASE[30] = {1,    2,    3,    4,    5,    7,    9,    13,    17,    25,
-                                             33,   49,   65,   97,   129,  193,  257,  385,   513,   769,
-                                             1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577};
-
-/* special ordering of code length codes */
-static const unsigned char CLCIDX[] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
-
-/* ----------------------- *
- * -- utility functions -- *
- * ----------------------- */
-
-/* given an array of code lengths, build a tree */
-static void tinf_build_tree(TINF_TREE *t, const unsigned char *lengths, unsigned int num) {
-  unsigned short offs[16];
-  unsigned int i, sum;
-
-  /* clear code length count table */
-  for (i = 0; i < 16; ++i)
-    t->table[i] = 0;
-
-  /* scan symbol lengths, and sum code length counts */
-  for (i = 0; i < num; ++i)
-    t->table[lengths[i]]++;
-
-  /* In the lengths array, 0 means unused code. So, t->table[0] now contains
-     number of unused codes. But table's purpose is to contain # of codes of
-     particular length, and there're 0 codes of length 0. */
-  t->table[0] = 0;
-
-  /* compute offset table for distribution sort */
-  for (sum = 0, i = 0; i < 16; ++i) {
-    offs[i] = sum;
-    sum += t->table[i];
-  }
-
-  /* create code->symbol translation table (symbols sorted by code) */
-  for (i = 0; i < num; ++i) {
-    if (lengths[i])
-      t->trans[offs[lengths[i]]++] = i;
-  }
-}
-
-/* ---------------------- *
- * -- decode functions -- *
- * ---------------------- */
-
-static unsigned char uzlib_get_byte(TINF_DATA *d) {
-  /* If end of source buffer is not reached, return next byte from source
-     buffer. */
-  if (d->source < d->source_limit) {
-    return *d->source++;
-  }
-
-  /* Otherwise if there's callback and we haven't seen EOF yet, try to
-     read next byte using it. (Note: the callback can also update ->source
-     and ->source_limit). */
-  if (!d->eof) {
-    int val = d->source_read_cb(d);
-    if (val >= 0) {
-      return (unsigned char) val;
-    }
-  }
-
-  /* Otherwise, we hit EOF (either from ->source_read_cb() or from exhaustion
-     of the buffer), and it will be "sticky", i.e. further calls to this
-     function will end up here too. */
-  d->eof = true;
-
-  return 0;
-}
-
-/* get one bit from source stream */
-static int tinf_getbit(TINF_DATA *d) {
-  unsigned int bit;
-
-  /* check if tag is empty */
-  if (!d->bitcount--) {
-    /* load next tag */
-    d->tag = uzlib_get_byte(d);
-    d->bitcount = 7;
-  }
-
-  /* shift bit out of tag */
-  bit = d->tag & 0x01;
-  d->tag >>= 1;
-
-  return bit;
-}
-
-/* read a num bit value from a stream and add base */
-static unsigned int tinf_read_bits(TINF_DATA *d, int num, int base) {
-  unsigned int val = 0;
-
-  /* read num bits */
-  if (num) {
-    unsigned int limit = 1 << (num);
-    unsigned int mask;
-
-    for (mask = 1; mask < limit; mask *= 2)
-      if (tinf_getbit(d))
-        val += mask;
-  }
-
-  return val + base;
-}
-
-/* given a data stream and a tree, decode a symbol */
-static int tinf_decode_symbol(TINF_DATA *d, TINF_TREE *t) {
-  int sum = 0, cur = 0, len = 0;
-
-  /* get more bits while code value is above sum */
-  do {
-    cur = 2 * cur + tinf_getbit(d);
-
-    if (++len == TINF_ARRAY_SIZE(t->table)) {
-      return TINF_DATA_ERROR;
-    }
-
-    sum += t->table[len];
-    cur -= t->table[len];
-
-  } while (cur >= 0);
-
-  sum += cur;
-  if (sum < 0 || sum >= t->size) {
-    return TINF_DATA_ERROR;
-  }
-
-  return t->trans[sum];
-}
-
-/* given a data stream, decode dynamic trees from it */
-static int tinf_decode_trees(TINF_DATA *d, TINF_TREE *lt, TINF_TREE *dt) {
-  /* code lengths for 288 literal/len symbols and 32 dist symbols */
-  unsigned char lengths[288 + 32];
-  unsigned int hlit, hdist, hclen, hlimit;
-  unsigned int i, num, length;
-
-  /* get 5 bits HLIT (257-286) */
-  hlit = tinf_read_bits(d, 5, 257);
-
-  /* get 5 bits HDIST (1-32) */
-  hdist = tinf_read_bits(d, 5, 1);
-
-  /* get 4 bits HCLEN (4-19) */
-  hclen = tinf_read_bits(d, 4, 4);
-
-  for (i = 0; i < 19; ++i)
-    lengths[i] = 0;
-
-  /* read code lengths for code length alphabet */
-  for (i = 0; i < hclen; ++i) {
-    /* get 3 bits code length (0-7) */
-    unsigned int clen = tinf_read_bits(d, 3, 0);
-
-    lengths[CLCIDX[i]] = clen;
-  }
-
-  /* build code length tree, temporarily use length tree */
-  tinf_build_tree(lt, lengths, 19);
-
-  /* decode code lengths for the dynamic trees */
-  hlimit = hlit + hdist;
-  for (num = 0; num < hlimit;) {
-    int sym = tinf_decode_symbol(d, lt);
-    unsigned char fill_value = 0;
-    int lbits, lbase = 3;
-
-    /* error decoding */
-    if (sym < 0)
-      return sym;
-
-    switch (sym) {
-      case 16:
-        /* copy previous code length 3-6 times (read 2 bits) */
-        if (num == 0)
-          return TINF_DATA_ERROR;
-        fill_value = lengths[num - 1];
-        lbits = 2;
-        break;
-      case 17:
-        /* repeat code length 0 for 3-10 times (read 3 bits) */
-        lbits = 3;
-        break;
-      case 18:
-        /* repeat code length 0 for 11-138 times (read 7 bits) */
-        lbits = 7;
-        lbase = 11;
-        break;
-      default:
-        /* values 0-15 represent the actual code lengths */
-        lengths[num++] = sym;
-        /* continue the for loop */
-        continue;
-    }
-
-    /* special code length 16-18 are handled here */
-    length = tinf_read_bits(d, lbits, lbase);
-    if (num + length > hlimit)
-      return TINF_DATA_ERROR;
-    for (; length; --length) {
-      lengths[num++] = fill_value;
-    }
-  }
-
-  /* Check that there's "end of block" symbol */
-  if (lengths[256] == 0) {
-    return TINF_DATA_ERROR;
-  }
-
-  /* build dynamic trees */
-  tinf_build_tree(lt, lengths, hlit);
-  tinf_build_tree(dt, lengths + hlit, hdist);
-
-  return TINF_OK;
-}
-
-/* build the fixed huffman trees (RFC 1951 3.2.6) through the generic tree
-   builder; altered from upstream, which unrolls them by hand */
-static void tinf_build_fixed_trees(TINF_TREE *lt, TINF_TREE *dt) {
-  unsigned char lengths[288];
-  unsigned int i;
-
-  for (i = 0; i < 144; ++i)
-    lengths[i] = 8;
-  for (; i < 256; ++i)
-    lengths[i] = 9;
-  for (; i < 280; ++i)
-    lengths[i] = 7;
-  for (; i < 288; ++i)
-    lengths[i] = 8;
-  tinf_build_tree(lt, lengths, 288);
-
-  for (i = 0; i < 32; ++i)
-    lengths[i] = 5;
-  tinf_build_tree(dt, lengths, 32);
-}
-
-/* ----------------------------- *
- * -- block inflate functions -- *
- * ----------------------------- */
-
-/* given a stream and two trees, inflate next chunk of output (a byte or more) */
-static int tinf_inflate_block_data(TINF_DATA *d, TINF_TREE *lt, TINF_TREE *dt) {
-  if (d->curlen == 0) {
-    unsigned int offs;
-    int dist;
-    int sym = tinf_decode_symbol(d, lt);
-
-    if (d->eof) {
-      return TINF_DATA_ERROR;
-    }
-
-    if (sym < 0) {
-      return sym;
-    }
-
-    /* literal byte */
-    if (sym < 256) {
-      TINF_PUT(d, sym);
-      return TINF_OK;
-    }
-
-    /* end of block */
-    if (sym == 256) {
-      return TINF_DONE;
-    }
-
-    /* substring from sliding dictionary */
-    sym -= 257;
-    if (sym >= 29) {
-      return TINF_DATA_ERROR;
-    }
-
-    /* possibly get more bits from length code */
-    d->curlen = tinf_read_bits(d, LENGTH_BITS[sym], LENGTH_BASE[sym]);
-
-    dist = tinf_decode_symbol(d, dt);
-    if (dist < 0 || dist >= 30) {
-      return TINF_DATA_ERROR;
-    }
-
-    /* possibly get more bits from distance code */
-    offs = tinf_read_bits(d, DIST_BITS[dist], DIST_BASE[dist]);
-
-    /* calculate and validate actual LZ offset to use */
-    if (offs > d->dict_size) {
-      return TINF_DICT_ERROR;
-    }
-    /* Note: we don't try to catch offset which points to not yet filled
-       part of the dictionary here. Doing so would require keeping another
-       variable to track "filled in" size of the dictionary. Appearance of
-       such an offset cannot lead to accessing memory outside of the
-       dictionary buffer, and clients which don't want to leak unrelated
-       information, should explicitly initialize dictionary buffer passed
-       to uzlib. */
-
-    d->lz_off = d->dict_idx - offs;
-    if (d->lz_off < 0) {
-      d->lz_off += d->dict_size;
-    }
-  }
-
-  /* copy next byte from dict substring */
-  TINF_PUT(d, d->dict_ring[d->lz_off]);
-  if ((unsigned) ++d->lz_off == d->dict_size) {
-    d->lz_off = 0;
-  }
-  d->curlen--;
-  return TINF_OK;
-}
-
-/* inflate next byte from uncompressed block of data */
-static int tinf_inflate_uncompressed_block(TINF_DATA *d) {
-  if (d->curlen == 0) {
-    unsigned int length, invlength;
-
-    /* get length */
-    length = uzlib_get_byte(d);
-    length += 256 * uzlib_get_byte(d);
-    /* get one's complement of length */
-    invlength = uzlib_get_byte(d);
-    invlength += 256 * uzlib_get_byte(d);
-    /* check length */
-    if (length != (~invlength & 0x0000ffff))
-      return TINF_DATA_ERROR;
-
-    /* increment length to properly return TINF_DONE below, without
-       producing data at the same time */
-    d->curlen = length + 1;
-
-    /* make sure we start next block on a byte boundary */
-    d->bitcount = 0;
-  }
-
-  if (--d->curlen == 0) {
-    return TINF_DONE;
-  }
-
-  unsigned char c = uzlib_get_byte(d);
-  TINF_PUT(d, c);
-  return TINF_OK;
-}
-
-/* ---------------------- *
- * -- public functions -- *
- * ---------------------- */
-
-/* initialize decompression structure */
-void ota_inflate_init(TINF_DATA *d, unsigned char *dict, unsigned int dict_len) {
-  d->source = NULL;
-  d->source_limit = NULL;
-  d->tag = 0;
-  d->eof = 0;
-  d->bitcount = 0;
-  d->lz_off = 0;
-  d->bfinal = 0;
-  d->btype = -1;
-  d->dict_size = dict_len;
-  d->dict_ring = dict;
-  d->dict_idx = 0;
-  d->curlen = 0;
-  d->ltree.trans = d->ltrans;
-  d->ltree.size = TINF_ARRAY_SIZE(d->ltrans);
-  d->dtree.trans = d->dtrans;
-  d->dtree.size = TINF_ARRAY_SIZE(d->dtrans);
-}
-
-/* inflate next output bytes from compressed stream */
-int ota_inflate(TINF_DATA *d) {
-  do {
-    int res;
-
-    /* start a new block */
-    if (d->btype == -1) {
-      int old_btype;
-    next_blk:
-      old_btype = d->btype;
-      /* read final block flag */
-      d->bfinal = tinf_getbit(d);
-      /* read block type (2 bits) */
-      d->btype = tinf_read_bits(d, 2, 0);
-
-      if (d->btype == 1 && old_btype != 1) {
-        /* build fixed huffman trees */
-        tinf_build_fixed_trees(&d->ltree, &d->dtree);
-      } else if (d->btype == 2) {
-        /* decode trees from stream */
-        res = tinf_decode_trees(d, &d->ltree, &d->dtree);
-        if (res != TINF_OK) {
-          return res;
-        }
-      }
-    }
-
-    /* process current block */
-    switch (d->btype) {
-      case 0:
-        /* decompress uncompressed block */
-        res = tinf_inflate_uncompressed_block(d);
-        break;
-      case 1:
-      case 2:
-        /* decompress block with fixed/dynamic huffman trees */
-        /* trees were decoded previously, so it's the same routine for both */
-        res = tinf_inflate_block_data(d, &d->ltree, &d->dtree);
-        break;
-      default:
-        return TINF_DATA_ERROR;
-    }
-
-    if (res == TINF_DONE && !d->bfinal) {
-      /* the block has ended (without producing more data), but we
-         can't return without data, so start procesing next block */
-      goto next_blk;
-    }
-
-    if (res != TINF_OK) {
-      return res;
-    }
-
-  } while (d->dest < d->dest_limit);
-
-  return TINF_OK;
-}
@@ -1,66 +0,0 @@
-#pragma once
-// Raw deflate decoder cut down from uzlib (https://github.com/pfalcon/uzlib,
-// zlib licence, see the .c file); output goes through a ring window.
-
-#include <stdbool.h>
-#include <stdint.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-enum OtaInflateResult {
-  OTA_INFLATE_OK = 0,   /* more data produced, call again */
-  OTA_INFLATE_DONE = 1, /* end of compressed stream reached */
-  OTA_INFLATE_DATA_ERROR = -3,
-  OTA_INFLATE_DICT_ERROR = -5,
-};
-
-struct OtaInflateTree {
-  uint16_t table[16]; /* table of code length counts */
-  uint16_t *trans;    /* code -> symbol translation table, size entries */
-  uint16_t size;
-};
-
-struct OtaInflateState {
-  /* Next byte in the input buffer and one past its end */
-  const unsigned char *source;
-  const unsigned char *source_limit;
-  /* Called when source is exhausted; returns the next byte or -1 at EOF.
-     It may refill source/source_limit for buffered operation. */
-  int (*source_read_cb)(struct OtaInflateState *d);
-
-  unsigned int tag;
-  unsigned int bitcount;
-
-  /* Output cursor and one past the end of the output buffer */
-  unsigned char *dest;
-  unsigned char *dest_limit;
-
-  bool eof;
-
-  int btype;
-  int bfinal;
-  unsigned int curlen;
-  int lz_off;
-  /* Ring window holding the last dict_size output bytes for back references */
-  unsigned char *dict_ring;
-  unsigned int dict_size;
-  unsigned int dict_idx;
-
-  struct OtaInflateTree ltree; /* dynamic length/symbol tree */
-  struct OtaInflateTree dtree; /* dynamic distance tree */
-  uint16_t ltrans[288];
-  uint16_t dtrans[32]; /* the distance alphabet has 30 symbols, so the tree is kept small */
-};
-
-/* dict must cover the encoder's window (its largest back reference) */
-void ota_inflate_init(struct OtaInflateState *d, unsigned char *dict, unsigned int dict_len);
-/* Fills dest up to dest_limit (OK) or to the end of the stream (DONE). dest may
-   alias dict only if dest_limit - dest == dict_len and dest is reset to dict
-   exactly when a call returns OK, so the ring index and dest stay in lockstep */
-int ota_inflate(struct OtaInflateState *d);
-
-#ifdef __cplusplus
-}
-#endif
@@ -33,13 +33,7 @@ ESPHomeOTAComponent::NoiseSession::~NoiseSession() {
  }
 }

-void ESPHomeOTAComponent::noise_reserve_session_() {
-  // Default-init: the frame buffer is written before it is read
-  // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks)
-  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession);
-}
-
-/** Start the responder handshake, on the session reserved at offer time.
+/** Allocate the session and start the responder handshake.
 *
 * The prologue binds the whole plaintext preamble, so any tampering with the
 * negotiation (a stripped feature flag, a changed version) breaks the first
@@ -48,7 +42,10 @@ void ESPHomeOTAComponent::noise_reserve_session_() {
 */
 bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
  // A provisioned key cleared between the offer and here is not guarded: the
-  // session runs on the zero key load_psk fills in and fails the client's MAC
+  // session runs on the zero key load_psk fills in and fails the client's MAC.
+  // Default-init: the frame buffer is written before it is read
+  // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks)
+  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession);
  static constexpr size_t PROLOGUE_ACK_LEN = 2;  // OTA_RESPONSE_OK + version
  static constexpr size_t PROLOGUE_CLIENT_FEATURES_LEN = 1;
  static constexpr size_t PROLOGUE_FEATURE_ACK_LEN = 2;  // OTA_RESPONSE_FEATURE_FLAGS + server flags
@@ -118,24 +118,21 @@ void I2SAudioSpeakerBase::loop() {
        break;
      }

-      // Still starting up or winding down from a previous run
-      if ((this->tx_handle_ != nullptr) || (this->speaker_task_handle_ != nullptr)) {
-        break;
-      }
-
      if (this->start_i2s_driver(this->audio_stream_info_) != ESP_OK) {
        ESP_LOGE(TAG, "Driver failed to start; retrying in 1 second");
        this->status_momentary_error("driver-failure", 1000);
        break;
      }

-      xTaskCreate(I2SAudioSpeakerBase::speaker_task, "speaker_task", TASK_STACK_SIZE, (void *) this, TASK_PRIORITY,
-                  &this->speaker_task_handle_);
-
      if (this->speaker_task_handle_ == nullptr) {
-        ESP_LOGE(TAG, "Task failed to start, retrying in 1 second");
-        this->status_momentary_error("task-failure", 1000);
-        this->stop_i2s_driver_();  // Stops the driver to return the lock; will be reloaded in next attempt
+        xTaskCreate(I2SAudioSpeakerBase::speaker_task, "speaker_task", TASK_STACK_SIZE, (void *) this, TASK_PRIORITY,
+                    &this->speaker_task_handle_);
+
+        if (this->speaker_task_handle_ == nullptr) {
+          ESP_LOGE(TAG, "Task failed to start, retrying in 1 second");
+          this->status_momentary_error("task-failure", 1000);
+          this->stop_i2s_driver_();  // Stops the driver to return the lock; will be reloaded in next attempt
+        }
      }
      break;
    case speaker::STATE_RUNNING:   // Intentional fallthrough
@@ -221,8 +218,8 @@ size_t I2SAudioSpeakerBase::play(const uint8_t *data, size_t length, TickType_t
 }

 bool I2SAudioSpeakerBase::has_buffered_data() const {
-  std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->audio_ring_buffer_.lock();
-  if (temp_ring_buffer != nullptr) {
+  if (this->audio_ring_buffer_.use_count() > 0) {
+    std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->audio_ring_buffer_.lock();
    return temp_ring_buffer->available() > 0;
  }
  return false;
@@ -129,7 +129,7 @@ void MicroWakeWord::setup() {
      return;
    }
    std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (temp_ring_buffer != nullptr) {
+    if (this->ring_buffer_.use_count() > 1) {
      // Producer-only write: never touches consumer state. If the buffer is full, ask the inference task
      // to drain it - reset() is a consumer operation and must run on the inference task's thread.
      // Disable partial writes so audio chunks are either fully accepted or rejected and handled below.
@@ -446,9 +446,9 @@ void MicroWakeWord::loop() {
    xEventGroupClearBits(this->event_group_, EventGroupBits::TASK_STOPPING);
  }

-  // Retries on a subsequent loop if the task is still running on the other core
-  if ((event_group_bits & EventGroupBits::TASK_STOPPED) && this->inference_task_.deallocate()) {
+  if ((event_group_bits & EventGroupBits::TASK_STOPPED)) {
    ESP_LOGD(TAG, "Inference task is finished, freeing task resources");
+    this->inference_task_.deallocate();
    xEventGroupClearBits(this->event_group_, ALL_BITS);
    xQueueReset(this->detection_queue_);
    this->set_state_(State::STOPPED);
@@ -48,7 +48,7 @@ class MicrophoneSource final {
  template<typename F> void add_data_callback(F &&data_callback) {
    this->mic_->add_data_callback([this, data_callback](const std::vector<uint8_t> &data) {
      if (this->enabled_ || this->passive_) {
-        if (this->processed_samples_ == nullptr) {
+        if (this->processed_samples_.use_count() == 0) {
          // Create vector if its unused
          this->processed_samples_ = std::make_shared<std::vector<uint8_t>>();
        }
@@ -218,7 +218,7 @@ size_t SourceSpeaker::play(const uint8_t *data, size_t length, TickType_t ticks_
  }
  size_t bytes_written = 0;
  std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-  if (temp_ring_buffer != nullptr) {
+  if (temp_ring_buffer.use_count() > 0) {
    // Only write to the ring buffer if the reference is valid
    bytes_written = temp_ring_buffer->write_without_replacement(data, length, ticks_to_wait);
    if (bytes_written > 0) {
@@ -250,14 +250,14 @@ esp_err_t SourceSpeaker::start_() {
  // avoids unnecessary single-frame splices.
  const size_t ring_buffer_size =
      (this->audio_stream_info_.ms_to_bytes(this->buffer_duration_ms_) / bytes_per_frame) * bytes_per_frame;
-  if (this->audio_source_ == nullptr) {
+  if (this->audio_source_.use_count() == 0) {
    std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (temp_ring_buffer == nullptr) {
+    if (!temp_ring_buffer) {
      temp_ring_buffer = ring_buffer::RingBuffer::create(ring_buffer_size);
      this->ring_buffer_ = temp_ring_buffer;
    }

-    if (temp_ring_buffer == nullptr) {
+    if (!temp_ring_buffer) {
      return ESP_ERR_NO_MEM;
    }

@@ -278,7 +278,7 @@ void SourceSpeaker::stop() { this->send_command_(SOURCE_SPEAKER_COMMAND_STOP); }
 void SourceSpeaker::finish() { this->send_command_(SOURCE_SPEAKER_COMMAND_FINISH); }

 bool SourceSpeaker::has_buffered_data() const {
-  return ((this->audio_source_ != nullptr) && this->audio_source_->has_buffered_data());
+  return ((this->audio_source_.use_count() > 0) && this->audio_source_->has_buffered_data());
 }

 void SourceSpeaker::set_mute_state(bool mute_state) {
@@ -382,8 +382,8 @@ void MixerSpeaker::loop() {
    ESP_LOGV(TAG, "Stopping");
    xEventGroupClearBits(this->event_group_, MIXER_TASK_STATE_STOPPING);
  }
-  // Retries on a subsequent loop if the task is still running on the other core
-  if ((event_group_bits & MIXER_TASK_STATE_STOPPED) && this->task_.deallocate()) {
+  if (event_group_bits & MIXER_TASK_STATE_STOPPED) {
+    this->task_.deallocate();
    ESP_LOGD(TAG, "Stopped");
    xEventGroupClearBits(this->event_group_, MIXER_TASK_ALL_BITS);
    this->all_stopped_since_ms_ = 0;
@@ -496,7 +496,7 @@ void MixerSpeaker::audio_mixer_task(void *params) {
        if (speaker->is_running() && !speaker->get_pause_state()) {
          // Speaker is running and not paused, so it possibly can provide audio data
          std::shared_ptr<audio::RingBufferAudioSource> audio_source = speaker->get_audio_source().lock();
-          if (audio_source == nullptr) {
+          if (audio_source.use_count() == 0) {
            // No audio source allocated, so skip processing this speaker
            continue;
          }
@@ -88,12 +88,12 @@ def encryption_schema(config: ConfigType | None) -> ConfigType:

 async def to_code(config: ConfigType) -> None:
    cg.add_define("USE_NOISE")
-    cg.add_library("esphome/noise-c", "0.1.26")
+    cg.add_library("esphome/noise-c", "0.1.24")
    # noise-c depends on libsodium, but declaring it here too lets the
    # library manager see the full set up front instead of discovering
    # libsodium only after noise-c has downloaded, so the two can download
    # in parallel. The version must match noise-c's library.json.
-    cg.add_library("esphome/libsodium", "1.10021.8")
+    cg.add_library("esphome/libsodium", "1.10021.6")
    # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
    cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
    cg.add_build_flag("-DHAVE_INLINE_ASM=1")
@@ -7,7 +7,6 @@
 #include <concepts>
 #include <cstddef>
 #include <cstdint>
-#include <type_traits>

 #ifdef USE_OTA_STATE_LISTENER
 #include <vector>
@@ -103,8 +102,6 @@ enum OTAType : uint8_t {
 // - set_update_md5: expected digest of the incoming image, hex string.
 // - write: consume the next chunk; end: finalize and mark bootable.
 // - abort: safe to call in any state, including after end().
-// - supports_compression: constexpr, whether a gzip image is stored as is and
-//   inflated at reboot.
 template<typename T>
 concept OTABackendContract = requires(T backend, size_t image_size, uint8_t *data, size_t len, const char *md5) {
  { backend.begin(image_size, OTA_TYPE_UPDATE_APP) } -> std::same_as<OTAResponseTypes>;
@@ -113,9 +110,7 @@ concept OTABackendContract = requires(T backend, size_t image_size, uint8_t *dat
  { backend.write(data, len) } -> std::same_as<OTAResponseTypes>;
  { backend.end() } -> std::same_as<OTAResponseTypes>;
  backend.abort();
-  { T::supports_compression() } -> std::same_as<bool>;
-  // The value must be a constant expression
-  typename std::bool_constant<T::supports_compression()>;
+  { backend.supports_compression() } -> std::same_as<bool>;
 };

 /** Listener interface for OTA state changes.
@@ -13,7 +13,7 @@ class ArduinoLibreTinyOTABackend final {
  OTAResponseTypes write(uint8_t *data, size_t len);
  OTAResponseTypes end();
  void abort();
-  static constexpr bool supports_compression() { return false; }
+  bool supports_compression() { return false; }

 private:
  bool md5_set_{false};
@@ -15,10 +15,7 @@ class ArduinoRP2OTABackend final {
  OTAResponseTypes write(uint8_t *data, size_t len);
  OTAResponseTypes end();
  void abort();
-  // The core's OTA stub inflates a staged gzip image at reboot, on every chip
-  // from 4.0.3 (ESPHome pins 6.0.0). begin() only sees the gzip size; the
-  // inflated size is known when the stub reads the trailer.
-  static constexpr bool supports_compression() { return USE_ARDUINO_VERSION_CODE >= VERSION_CODE(4, 0, 3); }
+  bool supports_compression() { return false; }

 private:
  bool md5_set_{false};
@@ -20,7 +20,7 @@ class ESP8266OTABackend final {
  OTAResponseTypes end();
  void abort();
  // Compression supported in all ESP8266 Arduino versions ESPHome supports (>= 2.7.0)
-  static constexpr bool supports_compression() { return true; }
+  bool supports_compression() { return true; }

 protected:
  /// Erase flash sector if current address is at sector boundary
@@ -33,7 +33,7 @@ class IDFOTABackend final {
  OTAResponseTypes write(uint8_t *data, size_t len);
  OTAResponseTypes end();
  void abort();
-  static constexpr bool supports_compression() { return false; }
+  bool supports_compression() { return false; }

 protected:
 #ifdef USE_OTA_PARTITIONS
@@ -25,7 +25,7 @@ struct StubOTABackend {
  OTAResponseTypes write(uint8_t *data, size_t len) { return OTA_RESPONSE_ERROR_UNKNOWN; }
  OTAResponseTypes end() { return OTA_RESPONSE_ERROR_UNKNOWN; }
  void abort() {}
-  static constexpr bool supports_compression() { return false; }
+  bool supports_compression() { return false; }
 };
 std::unique_ptr<StubOTABackend> make_ota_backend();
 }  // namespace esphome::ota
@@ -33,7 +33,6 @@ std::unique_ptr<StubOTABackend> make_ota_backend();

 namespace esphome::ota {
 using OTABackendPtr = decltype(make_ota_backend());
-using OTABackend = OTABackendPtr::element_type;
-static_assert(OTABackendContract<OTABackend>,
+static_assert(OTABackendContract<OTABackendPtr::element_type>,
              "The platform's OTA backend is missing part of the backend surface (ota_backend.h)");
 }  // namespace esphome::ota
@@ -19,7 +19,7 @@ class HostOTABackend final {
  OTAResponseTypes write(uint8_t *data, size_t len);
  OTAResponseTypes end();
  void abort();
-  static constexpr bool supports_compression() { return false; }
+  bool supports_compression() { return false; }

 protected:
  md5::MD5Digest md5_{};
@@ -153,8 +153,8 @@ void ResamplerSpeaker::loop() {
    ESP_LOGV(TAG, "Stopping");
    xEventGroupClearBits(this->event_group_, ResamplingEventGroupBits::STATE_STOPPING);
  }
-  // Retries on a subsequent loop if the task is still running on the other core
-  if ((event_group_bits & ResamplingEventGroupBits::STATE_STOPPED) && this->task_.deallocate()) {
+  if (event_group_bits & ResamplingEventGroupBits::STATE_STOPPED) {
+    this->task_.deallocate();
    ESP_LOGD(TAG, "Stopped");
    xEventGroupClearBits(this->event_group_, ResamplingEventGroupBits::ALL_BITS);
  }
@@ -235,7 +235,7 @@ size_t ResamplerSpeaker::play(const uint8_t *data, size_t length, TickType_t tic
    bytes_written = this->output_speaker_->play(data, length, ticks_to_wait);
  } else {
    std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (temp_ring_buffer != nullptr) {
+    if (temp_ring_buffer) {
      // Only write to the ring buffer if the reference is valid
      bytes_written = temp_ring_buffer->write_without_replacement(data, length, ticks_to_wait);
    } else {
@@ -299,7 +299,7 @@ bool ResamplerSpeaker::has_buffered_data() const {
  bool has_ring_buffer_data = false;
  if (this->requires_resampling_()) {
    std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (temp_ring_buffer != nullptr) {
+    if (temp_ring_buffer) {
      has_ring_buffer_data = (temp_ring_buffer->available() > 0);
    }
  }
@@ -342,7 +342,7 @@ void ResamplerSpeaker::resample_task(void *params) {
      std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = ring_buffer::RingBuffer::create(
          this_resampler->audio_stream_info_.ms_to_bytes(this_resampler->buffer_duration_ms_));

-      if (temp_ring_buffer == nullptr) {
+      if (!temp_ring_buffer) {
        err = ESP_ERR_NO_MEM;
      } else {
        this_resampler->ring_buffer_ = temp_ring_buffer;
@@ -187,7 +187,9 @@ async def to_code(config: ConfigType) -> None:
 # for the selected implementation.
 FILTER_SOURCE_FILES = filter_source_files_from_defines(
    {
+        "lwip_raw_common_impl.cpp": "USE_SOCKET_IMPL_LWIP_TCP",
        "lwip_raw_tcp_impl.cpp": "USE_SOCKET_IMPL_LWIP_TCP",
+        "lwip_raw_udp_impl.cpp": "USE_SOCKET_IMPL_LWIP_TCP",
        "bsd_sockets_impl.cpp": "USE_SOCKET_IMPL_BSD_SOCKETS",
        "lwip_sockets_impl.cpp": "USE_SOCKET_IMPL_LWIP_SOCKETS",
    }
@@ -144,6 +144,9 @@ class BSDSocketImpl {

  int get_fd() const { return this->fd_; }

+  /// UDP rx drop counter parity with LWIPRawUDPImpl; drops are not counted here.
+  uint16_t get_rx_dropped() const { return 0; }
+
 protected:
  // fd_ < 0 means "not open" — used both pre-open (initial state) and post-close. This
  // replaces a separate closed_ flag: close() sets fd_ = -1 after ::close(), and the
@@ -20,6 +20,16 @@

 #define IPPROTO_IP 0
 #define IPPROTO_TCP 6
+#define IPPROTO_UDP 17
+
+#define IP_ADD_MEMBERSHIP 3
+#define IP_DROP_MEMBERSHIP 4
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+struct ip_mreq {
+  struct in_addr imr_multiaddr;
+  struct in_addr imr_interface;
+};

 #if LWIP_IPV6
 #define AF_INET6 10
@@ -0,0 +1,109 @@
+#include "lwip_raw_common_impl.h"
+#include "esphome/core/defines.h"
+
+#ifdef USE_SOCKET_IMPL_LWIP_TCP
+
+#include <cerrno>
+#include <cstring>
+
+namespace esphome::socket {
+
+int lwip_ip_to_sockaddr(sa_family_t family, const ip_addr_t *ip, uint16_t port_host, struct sockaddr *name,
+                        socklen_t *addrlen) {
+  if (family == AF_INET) {
+    if (*addrlen < sizeof(struct sockaddr_in)) {
+      errno = EINVAL;
+      return -1;
+    }
+    auto *addr = reinterpret_cast<struct sockaddr_in *>(name);
+    addr->sin_family = AF_INET;
+    *addrlen = addr->sin_len = sizeof(struct sockaddr_in);
+    addr->sin_port = htons(port_host);
+    inet_addr_from_ip4addr(&addr->sin_addr, ip_2_ip4(ip));
+    return 0;
+  }
+#if LWIP_IPV6
+  if (family == AF_INET6) {
+    if (*addrlen < sizeof(struct sockaddr_in6)) {
+      errno = EINVAL;
+      return -1;
+    }
+    auto *addr = reinterpret_cast<struct sockaddr_in6 *>(name);
+    addr->sin6_family = AF_INET6;
+    *addrlen = addr->sin6_len = sizeof(struct sockaddr_in6);
+    addr->sin6_port = htons(port_host);
+    // AF_INET6 sockets may receive IPv4 packets; convert to IPv4-mapped IPv6.
+    if (IP_IS_V4(ip)) {
+      ip_addr_t mapped;
+      ip4_2_ipv4_mapped_ipv6(ip_2_ip6(&mapped), ip_2_ip4(ip));
+      inet6_addr_from_ip6addr(&addr->sin6_addr, ip_2_ip6(&mapped));
+    } else {
+      inet6_addr_from_ip6addr(&addr->sin6_addr, ip_2_ip6(ip));
+    }
+    return 0;
+  }
+#endif
+  errno = EAFNOSUPPORT;
+  return -1;
+}
+
+bool sockaddr_to_lwip(const struct sockaddr *addr, socklen_t addrlen, ip_addr_t *ip, uint16_t *port) {
+  // headers.h defines sockaddr and sockaddr_in with the same size, so this covers AF_INET
+  if (addrlen < sizeof(struct sockaddr))
+    return false;
+  // Zero the whole struct — the IPv6 zone byte would otherwise be stack garbage
+  memset(ip, 0, sizeof(*ip));
+  if (addr->sa_family == AF_INET) {
+    auto *addr4 = reinterpret_cast<const sockaddr_in *>(addr);
+    *port = ntohs(addr4->sin_port);
+    IP_SET_TYPE_VAL(*ip, IPADDR_TYPE_V4);
+    ip_2_ip4(ip)->addr = addr4->sin_addr.s_addr;
+    return true;
+  }
+#if LWIP_IPV6
+  if (addr->sa_family == AF_INET6) {
+    if (addrlen < sizeof(sockaddr_in6))
+      return false;
+    auto *addr6 = reinterpret_cast<const sockaddr_in6 *>(addr);
+    *port = ntohs(addr6->sin6_port);
+    IP_SET_TYPE_VAL(*ip, IPADDR_TYPE_V6);
+    memcpy(&ip_2_ip6(ip)->addr, &addr6->sin6_addr.un.u8_addr, 16);
+    // Unmap ::ffff:a.b.c.d so replies to recvfrom addresses route as IPv4
+    if (ip6_addr_isipv4mappedipv6(ip_2_ip6(ip))) {
+      unmap_ipv4_mapped_ipv6(ip_2_ip4(ip), ip_2_ip6(ip));
+      IP_SET_TYPE_VAL(*ip, IPADDR_TYPE_V4);
+    }
+    return true;
+  }
+#endif
+  return false;
+}
+
+bool sockaddr_to_lwip_bind(sa_family_t family, const struct sockaddr *addr, socklen_t addrlen, ip_addr_t *ip,
+                           uint16_t *port) {
+  if (!sockaddr_to_lwip(addr, addrlen, ip, port))
+    return false;
+#if LWIP_IPV6
+  // Only promote wildcard binds — a specific address must keep filtering
+  if (family == AF_INET6 && ip_addr_isany_val(*ip))
+    IP_SET_TYPE_VAL(*ip, IPADDR_TYPE_ANY);
+#endif
+  return true;
+}
+
+int lwip_bind_err(err_t err) {
+  if (err == ERR_OK)
+    return 0;
+  if (err == ERR_USE) {
+    errno = EADDRINUSE;
+  } else if (err == ERR_VAL) {
+    errno = EINVAL;
+  } else {
+    errno = EIO;
+  }
+  return -1;
+}
+
+}  // namespace esphome::socket
+
+#endif  // USE_SOCKET_IMPL_LWIP_TCP
@@ -0,0 +1,53 @@
+#pragma once
+#include "esphome/core/defines.h"
+
+#ifdef USE_SOCKET_IMPL_LWIP_TCP
+
+#include "headers.h"
+#include "lwip/ip.h"
+
+namespace esphome::socket {
+
+// ---- LWIP thread safety ----
+//
+// On RP2040 (Pico W), arduino-pico sets PICO_CYW43_ARCH_THREADSAFE_BACKGROUND=1.
+// This means lwip callbacks (recv_fn, accept_fn, err_fn) run from a low-priority
+// user IRQ context, not the main loop (see low_priority_irq_handler() in pico-sdk
+// async_context_threadsafe_background.c). They can preempt main-loop code at any point.
+//
+// Without locking, this causes race conditions between recv_fn and read() on the
+// shared rx_buf_ pbuf chain — recv_fn calls pbuf_cat() while read() is freeing
+// nodes, leading to use-after-free and infinite-loop crashes. See esphome#10681.
+//
+// On ESP8266, lwip callbacks run from the SYS context which cooperates with user
+// code (CONT context) — they never preempt each other, so no locking is needed.
+//
+// esphome::LwIPLock is the platform-provided RAII guard (see helpers.h/helpers.cpp).
+// On RP2040, it acquires cyw43_arch_lwip_begin/end (WiFi) or ethernet_arch_lwip_begin/end
+// (Ethernet). On ESP8266, it's a no-op.
+//
+// Each .cpp file that needs locking defines its own LWIP_LOCK() macro:
+//   #define LWIP_LOCK() esphome::LwIPLock lwip_lock_guard
+// This is a per-TU convenience macro, not defined here to avoid macro leaking.
+
+/// Convert lwip ip_addr_t + host-order port to sockaddr, based on the socket's address family.
+/// TCP callers pass ntohs(pcb port) to preserve historical getpeername/getsockname output.
+int lwip_ip_to_sockaddr(sa_family_t family, const ip_addr_t *ip, uint16_t port_host, struct sockaddr *name,
+                        socklen_t *addrlen);
+
+/// Convert sockaddr to lwip ip_addr_t and host-order port.
+/// For IPv6, sets type to IPADDR_TYPE_V6 — correct for sendto destinations.
+/// Bind paths must use sockaddr_to_lwip_bind() instead.
+bool sockaddr_to_lwip(const struct sockaddr *addr, socklen_t addrlen, ip_addr_t *ip, uint16_t *port);
+
+/// sockaddr_to_lwip variant for bind: promotes AF_INET6 sockets to
+/// IPADDR_TYPE_ANY so they accept both IPv4 and IPv6 (dual-stack).
+bool sockaddr_to_lwip_bind(sa_family_t family, const struct sockaddr *addr, socklen_t addrlen, ip_addr_t *ip,
+                           uint16_t *port);
+
+/// Map lwip bind error to errno. Returns 0 on success, -1 on error with errno set.
+int lwip_bind_err(err_t err);
+
+}  // namespace esphome::socket
+
+#endif  // USE_SOCKET_IMPL_LWIP_TCP
@@ -10,6 +10,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/wake.h"
 #include "esphome/core/log.h"
+#include "lwip_raw_common_impl.h"

 #ifdef USE_OTA_PLATFORM_ESPHOME
 extern "C" void esphome_wake_ota_component_any_context();
@@ -24,23 +25,9 @@ extern "C" void esphome_wake_ota_component_any_context();

 namespace esphome::socket {

-// ---- LWIP thread safety ----
-//
-// On RP2040 (Pico W), arduino-pico sets PICO_CYW43_ARCH_THREADSAFE_BACKGROUND=1.
-// This means lwip callbacks (recv_fn, accept_fn, err_fn) run from a low-priority
-// user IRQ context, not the main loop (see low_priority_irq_handler() in pico-sdk
-// async_context_threadsafe_background.c). They can preempt main-loop code at any point.
-//
-// Without locking, this causes race conditions between recv_fn and read() on the
-// shared rx_buf_ pbuf chain — recv_fn calls pbuf_cat() while read() is freeing
-// nodes, leading to use-after-free and infinite-loop crashes. See esphome#10681.
-//
-// On ESP8266, lwip callbacks run from the SYS context which cooperates with user
-// code (CONT context) — they never preempt each other, so no locking is needed.
-//
-// esphome::LwIPLock is the platform-provided RAII guard (see helpers.h/helpers.cpp).
-// On RP2040, it acquires cyw43_arch_lwip_begin/end (WiFi) or ethernet_arch_lwip_begin/end
-// (Ethernet). On ESP8266, it's a no-op.
+// LWIP thread safety — see lwip_raw_common_impl.h for full explanation.
+// esphome::LwIPLock is the platform-provided RAII guard.
+// On RP2040, it acquires cyw43_arch_lwip_begin/end. On ESP8266, it's a no-op.
 #define LWIP_LOCK() esphome::LwIPLock lwip_lock_guard  // NOLINT

 static const char *const TAG = "socket";
@@ -112,59 +99,14 @@ int LWIPRawCommon::bind(const struct sockaddr *name, socklen_t addrlen) {
    return -1;
  }
  ip_addr_t ip;
-  in_port_t port;
-#if LWIP_IPV6
-  if (this->family_ == AF_INET) {
-    if (addrlen < sizeof(sockaddr_in)) {
-      errno = EINVAL;
-      return -1;
-    }
-    auto *addr4 = reinterpret_cast<const sockaddr_in *>(name);
-    port = ntohs(addr4->sin_port);
-    ip.type = IPADDR_TYPE_V4;
-    ip.u_addr.ip4.addr = addr4->sin_addr.s_addr;
-    LWIP_LOG("tcp_bind(%p ip=%s port=%u)", this->pcb_, ip4addr_ntoa(&ip.u_addr.ip4), port);
-  } else if (this->family_ == AF_INET6) {
-    if (addrlen < sizeof(sockaddr_in6)) {
-      errno = EINVAL;
-      return -1;
-    }
-    auto *addr6 = reinterpret_cast<const sockaddr_in6 *>(name);
-    port = ntohs(addr6->sin6_port);
-    ip.type = IPADDR_TYPE_ANY;
-    memcpy(&ip.u_addr.ip6.addr, &addr6->sin6_addr.un.u8_addr, 16);
-    LWIP_LOG("tcp_bind(%p ip=%s port=%u)", this->pcb_, ip6addr_ntoa(&ip.u_addr.ip6), port);
-  } else {
+  uint16_t port;
+  if (!sockaddr_to_lwip_bind(this->family_, name, addrlen, &ip, &port)) {
    errno = EINVAL;
    return -1;
  }
-#else
-  if (this->family_ != AF_INET) {
-    errno = EINVAL;
-    return -1;
-  }
-  auto *addr4 = reinterpret_cast<const sockaddr_in *>(name);
-  port = ntohs(addr4->sin_port);
-  ip.addr = addr4->sin_addr.s_addr;
-  LWIP_LOG("tcp_bind(%p ip=%u port=%u)", this->pcb_, ip.addr, port);
-#endif
  err_t err = tcp_bind(this->pcb_, &ip, port);
-  if (err == ERR_USE) {
-    LWIP_LOG("  -> err ERR_USE");
-    errno = EADDRINUSE;
-    return -1;
-  }
-  if (err == ERR_VAL) {
-    LWIP_LOG("  -> err ERR_VAL");
-    errno = EINVAL;
-    return -1;
-  }
-  if (err != ERR_OK) {
-    LWIP_LOG("  -> err %d", err);
-    errno = EIO;
-    return -1;
-  }
-  return 0;
+  LWIP_LOG("  -> err %d", err);
+  return lwip_bind_err(err);
 }

 int LWIPRawCommon::close() {
@@ -349,43 +291,8 @@ int LWIPRawCommon::setsockopt(int level, int optname, const void *optval, sockle
 }

 int LWIPRawCommon::ip2sockaddr_(ip_addr_t *ip, uint16_t port, struct sockaddr *name, socklen_t *addrlen) {
-  if (this->family_ == AF_INET) {
-    if (*addrlen < sizeof(struct sockaddr_in)) {
-      errno = EINVAL;
-      return -1;
-    }
-
-    struct sockaddr_in *addr = reinterpret_cast<struct sockaddr_in *>(name);
-    addr->sin_family = AF_INET;
-    *addrlen = addr->sin_len = sizeof(struct sockaddr_in);
-    addr->sin_port = port;
-    inet_addr_from_ip4addr(&addr->sin_addr, ip_2_ip4(ip));
-    return 0;
-  }
-#if LWIP_IPV6
-  else if (this->family_ == AF_INET6) {
-    if (*addrlen < sizeof(struct sockaddr_in6)) {
-      errno = EINVAL;
-      return -1;
-    }
-
-    struct sockaddr_in6 *addr = reinterpret_cast<struct sockaddr_in6 *>(name);
-    addr->sin6_family = AF_INET6;
-    *addrlen = addr->sin6_len = sizeof(struct sockaddr_in6);
-    addr->sin6_port = port;
-
-    // AF_INET6 sockets are bound to IPv4 as well, so we may encounter IPv4 addresses that must be converted to IPv6.
-    if (IP_IS_V4(ip)) {
-      ip_addr_t mapped;
-      ip4_2_ipv4_mapped_ipv6(ip_2_ip6(&mapped), ip_2_ip4(ip));
-      inet6_addr_from_ip6addr(&addr->sin6_addr, ip_2_ip6(&mapped));
-    } else {
-      inet6_addr_from_ip6addr(&addr->sin6_addr, ip_2_ip6(ip));
-    }
-    return 0;
-  }
-#endif
-  return -1;
+  // lwip pcb ports are host order; ntohs preserves historical byte-swapped sin_port output
+  return lwip_ip_to_sockaddr(this->family_, ip, ntohs(port), name, addrlen);
 }

 // ---- LWIPRawImpl methods ----
@@ -887,11 +794,11 @@ err_t LWIPRawListenImpl::accept_fn_(struct tcp_pcb *newpcb, err_t err) {
  return ERR_OK;
 }

-// ---- Factory functions ----
+// ---- TCP Factory functions ----

 std::unique_ptr<Socket> socket(int domain, int type, int protocol) {
  if (type != SOCK_STREAM) {
-    ESP_LOGE(TAG, "UDP sockets not supported on this platform, use WiFiUDP");
+    ESP_LOGE(TAG, "Use socket_udp() for UDP sockets on this platform");
    errno = EPROTOTYPE;
    return nullptr;
  }
@@ -911,7 +818,7 @@ std::unique_ptr<Socket> socket_loop_monitored(int domain, int type, int protocol

 std::unique_ptr<ListenSocket> socket_listen(int domain, int type, int protocol) {
  if (type != SOCK_STREAM) {
-    ESP_LOGE(TAG, "UDP sockets not supported on this platform, use WiFiUDP");
+    ESP_LOGE(TAG, "Use socket_udp() for UDP sockets on this platform");
    errno = EPROTOTYPE;
    return nullptr;
  }
@@ -0,0 +1,328 @@
+#include "socket.h"
+#include "esphome/core/defines.h"
+
+#ifdef USE_SOCKET_IMPL_LWIP_TCP
+
+#include <cerrno>
+#include <cstring>
+
+#include "esphome/core/helpers.h"
+#include "esphome/core/log.h"
+#include "esphome/core/wake.h"
+#include "lwip_raw_common_impl.h"
+
+#include "lwip/igmp.h"
+#include "lwip/pbuf.h"
+#include "lwip/udp.h"
+
+namespace esphome::socket {
+
+// LWIP thread safety — see lwip_raw_common_impl.h for full explanation.
+// esphome::LwIPLock is the platform-provided RAII guard.
+// On RP2040, it acquires cyw43_arch_lwip_begin/end. On ESP8266, it's a no-op.
+#define LWIP_LOCK() esphome::LwIPLock lwip_lock_guard  // NOLINT
+
+// ---- LWIPRawUDPSendImpl (send-only) methods ----
+
+LWIPRawUDPSendImpl::~LWIPRawUDPSendImpl() {
+  // Guard avoids acquiring the lwip lock when already closed
+  if (this->pcb_ != nullptr)
+    this->close();
+}
+
+int LWIPRawUDPSendImpl::bind(const struct sockaddr *name, socklen_t addrlen) {
+  LWIP_LOCK();
+  if (this->pcb_ == nullptr) {
+    errno = EBADF;
+    return -1;
+  }
+  if (name == nullptr) {
+    errno = EINVAL;
+    return -1;
+  }
+  ip_addr_t ip;
+  uint16_t port;
+  if (!sockaddr_to_lwip_bind(this->family_, name, addrlen, &ip, &port)) {
+    errno = EINVAL;
+    return -1;
+  }
+  return lwip_bind_err(udp_bind(this->pcb_, &ip, port));
+}
+
+int LWIPRawUDPSendImpl::close() {
+  LWIP_LOCK();
+  return this->close_internal_locked_();
+}
+
+int LWIPRawUDPSendImpl::close_internal_locked_() {
+  // Caller must hold LWIP_LOCK
+  if (this->pcb_ == nullptr) {
+    errno = EBADF;
+    return -1;
+  }
+  udp_remove(this->pcb_);
+  this->pcb_ = nullptr;
+  return 0;
+}
+
+int LWIPRawUDPSendImpl::ip2sockaddr_(const ip_addr_t *ip, uint16_t port, struct sockaddr *name, socklen_t *addrlen) {
+  // UDP recv callback provides port in host byte order
+  return lwip_ip_to_sockaddr(this->family_, ip, port, name, addrlen);
+}
+
+ssize_t LWIPRawUDPSendImpl::sendto(const void *buf, size_t len, int flags, const struct sockaddr *dest_addr,
+                                   socklen_t addrlen) {
+  (void) flags;  // Flags (MSG_DONTWAIT, etc.) are ignored; raw lwip is always non-blocking
+  if (buf == nullptr || dest_addr == nullptr) {
+    errno = EINVAL;
+    return -1;
+  }
+
+  // pbuf_alloc takes u16_t length; reject oversized packets
+  if (len > UINT16_MAX) {
+    errno = EMSGSIZE;
+    return -1;
+  }
+
+  ip_addr_t dst_ip;
+  uint16_t dst_port;
+  if (!sockaddr_to_lwip(dest_addr, addrlen, &dst_ip, &dst_port)) {
+    errno = EINVAL;
+    return -1;
+  }
+
+  LWIP_LOCK();
+  if (this->pcb_ == nullptr) {
+    errno = EBADF;
+    return -1;
+  }
+
+  // Allocate pbuf and copy data
+  struct pbuf *pb = pbuf_alloc(PBUF_TRANSPORT, (uint16_t) len, PBUF_RAM);
+  if (pb == nullptr) {
+    errno = ENOMEM;
+    return -1;
+  }
+  memcpy(pb->payload, buf, len);
+
+  err_t err = udp_sendto(this->pcb_, pb, &dst_ip, dst_port);
+  pbuf_free(pb);
+
+  if (err != ERR_OK) {
+    errno = err == ERR_MEM ? ENOMEM : EIO;
+    return -1;
+  }
+  return (ssize_t) len;
+}
+
+int LWIPRawUDPSendImpl::setsockopt(int level, int optname, const void *optval, socklen_t optlen) {
+  LWIP_LOCK();
+  if (this->pcb_ == nullptr) {
+    errno = EBADF;
+    return -1;
+  }
+  if (level == SOL_SOCKET && optname == SO_REUSEADDR) {
+    if (optval == nullptr || optlen < sizeof(int)) {
+      errno = EINVAL;
+      return -1;
+    }
+    // Effective only where lwip is built with SO_REUSE=1 (ESP8266 yes, RP2040 currently no)
+    if (*reinterpret_cast<const int *>(optval)) {
+      ip_set_option(this->pcb_, SOF_REUSEADDR);
+    } else {
+      ip_reset_option(this->pcb_, SOF_REUSEADDR);
+    }
+    return 0;
+  }
+  if (level == SOL_SOCKET && optname == SO_BROADCAST) {
+    if (optval == nullptr || optlen < sizeof(int)) {
+      errno = EINVAL;
+      return -1;
+    }
+    int val = *reinterpret_cast<const int *>(optval);
+    if (val) {
+      ip_set_option(this->pcb_, SOF_BROADCAST);
+    } else {
+      ip_reset_option(this->pcb_, SOF_BROADCAST);
+    }
+    return 0;
+  }
+  if (level == IPPROTO_IP && (optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP)) {
+    if (optval == nullptr || optlen < sizeof(struct ip_mreq)) {
+      errno = EINVAL;
+      return -1;
+    }
+    auto *mreq = reinterpret_cast<const struct ip_mreq *>(optval);
+    ip4_addr_t multiaddr{mreq->imr_multiaddr.s_addr};
+    ip4_addr_t ifaddr{mreq->imr_interface.s_addr};
+    err_t err =
+        optname == IP_ADD_MEMBERSHIP ? igmp_joingroup(&ifaddr, &multiaddr) : igmp_leavegroup(&ifaddr, &multiaddr);
+    if (err != ERR_OK) {
+      errno = EIO;
+      return -1;
+    }
+    return 0;
+  }
+  errno = ENOPROTOOPT;
+  return -1;
+}
+
+int LWIPRawUDPSendImpl::getsockopt(int level, int optname, void *optval, socklen_t *optlen) {
+  LWIP_LOCK();
+  if (this->pcb_ == nullptr) {
+    errno = EBADF;
+    return -1;
+  }
+  if (level == SOL_SOCKET && optname == SO_REUSEADDR) {
+    if (optval == nullptr || optlen == nullptr || *optlen < sizeof(int)) {
+      errno = EINVAL;
+      return -1;
+    }
+    *reinterpret_cast<int *>(optval) = ip_get_option(this->pcb_, SOF_REUSEADDR) ? 1 : 0;
+    *optlen = sizeof(int);
+    return 0;
+  }
+  errno = ENOPROTOOPT;
+  return -1;
+}
+
+int LWIPRawUDPSendImpl::setblocking(bool blocking) {
+  if (blocking) {
+    // blocking operation not supported on raw lwip
+    errno = EINVAL;
+    return -1;
+  }
+  return 0;
+}
+
+// ---- LWIPRawUDPImpl methods ----
+
+LWIPRawUDPImpl::LWIPRawUDPImpl(sa_family_t family, struct udp_pcb *pcb) : LWIPRawUDPSendImpl(family, pcb) {
+  // Registered here (not in bind) so unbound client sockets can receive replies
+  udp_recv(this->pcb_, LWIPRawUDPImpl::s_recv_fn, this);
+}
+
+LWIPRawUDPImpl::~LWIPRawUDPImpl() {
+  // Flush rx queue and unregister callback before base destructor removes pcb
+  if (this->pcb_ != nullptr)
+    this->close();
+}
+
+int LWIPRawUDPImpl::close() {
+  LWIP_LOCK();
+  // Unregister recv callback before removing pcb
+  if (this->pcb_ != nullptr) {
+    udp_recv(this->pcb_, nullptr, nullptr);
+  }
+  // Flush queued rx packets; slots within rx_count_ always hold a live pbuf
+  for (; this->rx_count_ > 0; this->rx_count_--) {
+    pbuf_free(this->rx_queue_[this->rx_read_idx_].pb);
+    this->rx_read_idx_ = (this->rx_read_idx_ + 1) & UDP_RX_MASK;
+  }
+  // close_internal_locked_() returns EBADF if already closed, which is fine from destructor
+  return this->close_internal_locked_();
+}
+
+ssize_t LWIPRawUDPImpl::read(void *buf, size_t len) { return this->recvfrom(buf, len, nullptr, nullptr); }
+
+ssize_t LWIPRawUDPImpl::recvfrom(void *buf, size_t len, struct sockaddr *src_addr, socklen_t *addrlen) {
+  if (buf == nullptr && len > 0) {
+    errno = EINVAL;
+    return -1;
+  }
+  LWIP_LOCK();
+  if (this->pcb_ == nullptr) {
+    errno = EBADF;
+    return -1;
+  }
+  if (this->rx_count_ == 0) {
+    errno = EWOULDBLOCK;
+    return -1;
+  }
+
+  auto &pkt = this->rx_queue_[this->rx_read_idx_];
+  // On address conversion failure, still consume the packet — the failure is
+  // deterministic (family_ and *addrlen), so keeping it would wedge the queue
+  ssize_t ret = -1;
+  if (src_addr == nullptr || addrlen == nullptr ||
+      this->ip2sockaddr_(&pkt.src_addr, pkt.src_port, src_addr, addrlen) == 0) {
+    ret = (ssize_t) std::min(len, (size_t) pkt.pb->tot_len);
+    pbuf_copy_partial(pkt.pb, buf, ret, 0);
+  }
+  pbuf_free(pkt.pb);
+  this->rx_read_idx_ = (this->rx_read_idx_ + 1) & UDP_RX_MASK;
+  this->rx_count_--;
+  return ret;
+}
+
+void LWIPRawUDPImpl::s_recv_fn(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port) {
+  auto *self = reinterpret_cast<LWIPRawUDPImpl *>(arg);
+  self->recv_fn_(p, addr, port);
+}
+
+// LWIP CALLBACK — runs from IRQ context on RP2040 (low-priority user IRQ).
+// No heap allocation allowed — malloc is not IRQ-safe (see #14687).
+// No LWIP_LOCK() needed — lwip core already holds the async_context lock.
+void LWIPRawUDPImpl::recv_fn_(struct pbuf *p, const ip_addr_t *addr, u16_t port) {
+  if (p == nullptr)
+    return;
+
+  // Check if queue is full
+  if (this->rx_count_ >= UDP_RX_QUEUE_SIZE) {
+    // Drop packet — queue full. Can't log from IRQ context, so count it
+    // (saturating) for consumers to surface via get_rx_dropped().
+    if (this->rx_dropped_ != UINT16_MAX)
+      this->rx_dropped_++;
+    pbuf_free(p);
+    return;
+  }
+
+  // Enqueue the packet
+  uint8_t write_idx = (this->rx_read_idx_ + this->rx_count_) & UDP_RX_MASK;
+  auto &slot = this->rx_queue_[write_idx];
+  slot.pb = p;
+  slot.src_addr = *addr;
+  slot.src_port = port;
+  this->rx_count_++;
+
+  esphome::wake_loop_any_context();
+}
+
+// ---- UDP Factory functions ----
+
+static struct udp_pcb *new_udp_pcb(int domain) {
+#if LWIP_IPV6
+  return udp_new_ip_type(domain == AF_INET6 ? IPADDR_TYPE_ANY : IPADDR_TYPE_V4);
+#else
+  return udp_new();
+#endif
+}
+
+std::unique_ptr<UDPSendSocket> socket_udp_send(int domain, int protocol) {
+  (void) protocol;  // Raw lwip UDP ignores protocol; kept for API compatibility
+  LWIP_LOCK();
+  auto *pcb = new_udp_pcb(domain);
+  if (pcb == nullptr) {
+    errno = ENOMEM;
+    return nullptr;
+  }
+  return make_unique<LWIPRawUDPSendImpl>((sa_family_t) domain, pcb);
+}
+
+std::unique_ptr<UDPSocket> socket_udp(int domain, int protocol) {
+  (void) protocol;  // Raw lwip UDP ignores protocol; kept for API compatibility
+  LWIP_LOCK();
+  auto *pcb = new_udp_pcb(domain);
+  if (pcb == nullptr) {
+    errno = ENOMEM;
+    return nullptr;
+  }
+  // Ctor registers the recv callback under the lock held here
+  return make_unique<LWIPRawUDPImpl>((sa_family_t) domain, pcb);
+}
+
+#undef LWIP_LOCK
+
+}  // namespace esphome::socket
+
+#endif  // USE_SOCKET_IMPL_LWIP_TCP
@@ -0,0 +1,113 @@
+#pragma once
+#include "esphome/core/defines.h"
+
+#ifdef USE_SOCKET_IMPL_LWIP_TCP
+
+#include <array>
+#include <cstdint>
+
+#include "headers.h"
+#include "lwip/ip.h"
+#include "lwip/udp.h"
+
+namespace esphome::socket {
+
+/// Send-only UDP socket implementation for LWIP raw API.
+/// Non-virtual, concrete type. Uses lwip/udp.h raw API.
+/// No receive capability — use LWIPRawUDPImpl for sockets that need to receive.
+class LWIPRawUDPSendImpl {
+ public:
+  /// The pcb is allocated by the factory (like the TCP impl); never null here.
+  LWIPRawUDPSendImpl(sa_family_t family, struct udp_pcb *pcb) : pcb_(pcb), family_(family) {}
+  ~LWIPRawUDPSendImpl();
+  LWIPRawUDPSendImpl(const LWIPRawUDPSendImpl &) = delete;
+  LWIPRawUDPSendImpl &operator=(const LWIPRawUDPSendImpl &) = delete;
+
+  int bind(const struct sockaddr *name, socklen_t addrlen);
+  int close();
+
+  /// Send a UDP packet to the specified destination.
+  ssize_t sendto(const void *buf, size_t len, int flags, const struct sockaddr *dest_addr, socklen_t addrlen);
+
+  int setsockopt(int level, int optname, const void *optval, socklen_t optlen);
+  int getsockopt(int level, int optname, void *optval, socklen_t *optlen);
+
+  int setblocking(bool blocking);
+
+  bool ready() const { return false; }
+  int get_fd() const { return -1; }
+
+ protected:
+  /// Convert lwip ip_addr_t and port to sockaddr.
+  int ip2sockaddr_(const ip_addr_t *ip, uint16_t port, struct sockaddr *name, socklen_t *addrlen);
+
+  /// Shared close logic — removes the udp pcb. Caller must hold LWIP_LOCK.
+  int close_internal_locked_();
+
+  struct udp_pcb *pcb_;
+  sa_family_t family_;
+};
+
+/// UDP socket with receive support for LWIP raw API.
+/// Extends LWIPRawUDPSendImpl with a fixed-size ring buffer for incoming packets.
+/// Inheritance is private (base dtor is non-virtual; converting to a base
+/// pointer would leak queued pbufs on destruction).
+class LWIPRawUDPImpl : private LWIPRawUDPSendImpl {
+ public:
+  /// Caller (the factory) must hold the lwip lock; registers the recv callback.
+  LWIPRawUDPImpl(sa_family_t family, struct udp_pcb *pcb);
+  ~LWIPRawUDPImpl();
+
+  using LWIPRawUDPSendImpl::bind;
+  using LWIPRawUDPSendImpl::get_fd;
+  using LWIPRawUDPSendImpl::getsockopt;
+  using LWIPRawUDPSendImpl::sendto;
+  using LWIPRawUDPSendImpl::setblocking;
+  using LWIPRawUDPSendImpl::setsockopt;
+
+  /// Close the socket, flushing any queued rx packets first.
+  int close();
+
+  /// Read the next queued packet, discarding source address info.
+  /// If buf is smaller than the packet, data is silently truncated (returns bytes copied).
+  /// Note: unlike POSIX MSG_TRUNC, this does not return the original packet length on truncation.
+  ssize_t read(void *buf, size_t len);
+  /// Read the next queued packet and return the source address.
+  /// If buf is smaller than the packet, data is silently truncated (returns bytes copied).
+  /// Note: unlike POSIX MSG_TRUNC, this does not return the original packet length on truncation.
+  ssize_t recvfrom(void *buf, size_t len, struct sockaddr *src_addr, socklen_t *addrlen);
+
+  /// Returns true if there are packets available to read.
+  /// Intentionally unlocked — same rationale as LWIPRawImpl::ready().
+  bool ready() const { return this->rx_count_ > 0; }
+
+  /// Number of packets dropped because the rx queue was full (saturating).
+  uint16_t get_rx_dropped() const { return this->rx_dropped_; }
+
+ protected:
+  static void s_recv_fn(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port);
+  void recv_fn_(struct pbuf *p, const ip_addr_t *addr, u16_t port);
+
+  /// Ring buffer for received UDP packets.
+  /// Both producer (recv callback) and consumer (main loop) are serialized by the
+  /// lwip lock — the callback runs under lwip core lock, and consumer methods hold
+  /// LWIP_LOCK(). All 4 slots are usable (no wasted slot for full/empty distinction).
+  /// No heap allocation in the recv callback — packets are dropped if the queue is full.
+  static constexpr uint8_t UDP_RX_QUEUE_SIZE = 4;
+  static constexpr uint8_t UDP_RX_MASK = UDP_RX_QUEUE_SIZE - 1;
+  static_assert((UDP_RX_QUEUE_SIZE & UDP_RX_MASK) == 0, "UDP_RX_QUEUE_SIZE must be power of 2");
+  // Fields are written by recv_fn_ before rx_count_ makes a slot visible
+  struct UDPRxPacket {
+    ip_addr_t src_addr;
+    struct pbuf *pb;
+    uint16_t src_port;
+  };
+  std::array<UDPRxPacket, UDP_RX_QUEUE_SIZE> rx_queue_{};
+  uint16_t rx_dropped_{0};
+  uint8_t rx_read_idx_{0};
+  uint8_t rx_count_{0};
+};
+
+}  // namespace esphome::socket
+
+#endif  // USE_SOCKET_IMPL_LWIP_TCP
@@ -84,6 +84,9 @@ class LwIPSocketImpl {

  int get_fd() const { return this->fd_; }

+  /// UDP rx drop counter parity with LWIPRawUDPImpl; drops are not counted here.
+  uint16_t get_rx_dropped() const { return 0; }
+
 protected:
  // fd_ < 0 means "not open" — used both pre-open (initial state) and post-close. This
  // replaces a separate closed_ flag: close() sets fd_ = -1 after lwip_close(), and the
@@ -116,25 +116,7 @@ size_t format_sockaddr_to(const struct sockaddr *addr_ptr, socklen_t len, std::s
  return 0;
 }

-std::unique_ptr<Socket> socket_ip(int type, int protocol) {
-#if USE_NETWORK_IPV6
-  return socket(AF_INET6, type, protocol);
-#else
-  return socket(AF_INET, type, protocol);
-#endif /* USE_NETWORK_IPV6 */
-}
-
-#ifdef USE_SOCKET_IMPL_LWIP_TCP
-// LWIP_TCP has separate Socket/ListenSocket types — needs out-of-line factory.
-// BSD and LWIP_SOCKETS define this inline in socket.h.
-std::unique_ptr<ListenSocket> socket_ip_loop_monitored(int type, int protocol) {
-#if USE_NETWORK_IPV6
-  return socket_listen_loop_monitored(AF_INET6, type, protocol);
-#else
-  return socket_listen_loop_monitored(AF_INET, type, protocol);
-#endif /* USE_NETWORK_IPV6 */
-}
-#endif
+std::unique_ptr<Socket> socket_ip(int type, int protocol) { return socket(IP_DOMAIN, type, protocol); }

 socklen_t set_sockaddr(struct sockaddr *addr, socklen_t addrlen, const char *ip_address, uint16_t port) {
 #if USE_NETWORK_IPV6
@@ -20,6 +20,7 @@
 #include "lwip_sockets_impl.h"
 #elif defined(USE_SOCKET_IMPL_LWIP_TCP)
 #include "lwip_raw_tcp_impl.h"
+#include "lwip_raw_udp_impl.h"
 #endif

 namespace esphome::socket {
@@ -27,17 +28,32 @@ namespace esphome::socket {
 // Type aliases — only one implementation is active per build.
 // Socket is the concrete type for connected sockets.
 // ListenSocket is the concrete type for listening/server sockets.
-// On BSD and LWIP_SOCKETS, both aliases resolve to the same type.
+// UDPSocket is the concrete type for UDP sockets (send + receive).
+// UDPSendSocket is the concrete type for send-only UDP sockets.
+// On BSD and LWIP_SOCKETS, all aliases resolve to the same type.
 // On LWIP_TCP, they are different types (no virtual dispatch between them).
 #ifdef USE_SOCKET_IMPL_BSD_SOCKETS
 using Socket = BSDSocketImpl;
 using ListenSocket = BSDSocketImpl;
+using UDPSendSocket = BSDSocketImpl;
+using UDPSocket = BSDSocketImpl;
 #elif defined(USE_SOCKET_IMPL_LWIP_SOCKETS)
 using Socket = LwIPSocketImpl;
 using ListenSocket = LwIPSocketImpl;
+using UDPSendSocket = LwIPSocketImpl;
+using UDPSocket = LwIPSocketImpl;
 #elif defined(USE_SOCKET_IMPL_LWIP_TCP)
 using Socket = LWIPRawImpl;
 using ListenSocket = LWIPRawListenImpl;
+using UDPSendSocket = LWIPRawUDPSendImpl;
+using UDPSocket = LWIPRawUDPImpl;
+#endif
+
+// Domain used by the socket_ip_* helpers: newest available IP domain.
+#if USE_NETWORK_IPV6
+inline constexpr int IP_DOMAIN = AF_INET6;
+#else
+inline constexpr int IP_DOMAIN = AF_INET;
 #endif

 #ifdef USE_LWIP_FAST_SELECT
@@ -104,6 +120,36 @@ std::unique_ptr<Socket> socket_ip(int type, int protocol);
 /// File descriptors >= FD_SETSIZE will not be monitored and will log an error.
 std::unique_ptr<Socket> socket_loop_monitored(int domain, int type, int protocol);

+/// Create a send-only UDP socket (socket_udp_send), a UDP socket with receive
+/// support (socket_udp), or a UDP socket monitored for data in the main loop
+/// (socket_udp_loop_monitored).
+#ifdef USE_SOCKET_IMPL_LWIP_TCP
+std::unique_ptr<UDPSendSocket> socket_udp_send(int domain, int protocol);
+std::unique_ptr<UDPSocket> socket_udp(int domain, int protocol);
+// Wake is built into the recv callback, so monitoring needs nothing extra.
+inline std::unique_ptr<UDPSocket> socket_udp_loop_monitored(int domain, int protocol) {
+  return socket_udp(domain, protocol);
+}
+#else
+inline std::unique_ptr<UDPSendSocket> socket_udp_send(int domain, int protocol) {
+  return esphome::socket::socket(domain, SOCK_DGRAM, protocol);
+}
+inline std::unique_ptr<UDPSocket> socket_udp(int domain, int protocol) {
+  return esphome::socket::socket(domain, SOCK_DGRAM, protocol);
+}
+// Registers the socket with the Application's select() loop.
+inline std::unique_ptr<UDPSocket> socket_udp_loop_monitored(int domain, int protocol) {
+  return socket_loop_monitored(domain, SOCK_DGRAM, protocol);
+}
+#endif
+
+/// socket_udp* variants using the newest available IP domain.
+inline std::unique_ptr<UDPSendSocket> socket_ip_udp_send(int protocol) { return socket_udp_send(IP_DOMAIN, protocol); }
+inline std::unique_ptr<UDPSocket> socket_ip_udp(int protocol) { return socket_udp(IP_DOMAIN, protocol); }
+inline std::unique_ptr<UDPSocket> socket_ip_udp_loop_monitored(int protocol) {
+  return socket_udp_loop_monitored(IP_DOMAIN, protocol);
+}
+
 /// Create a listening socket of the given domain, type and protocol.
 /// Create a listening socket and monitor it for data in the main loop.
 /// Create a listening socket in the newest available IP domain and monitor it.
@@ -111,7 +157,6 @@ std::unique_ptr<Socket> socket_loop_monitored(int domain, int type, int protocol
 // LWIP_TCP has separate Socket/ListenSocket types — needs distinct factory functions.
 std::unique_ptr<ListenSocket> socket_listen(int domain, int type, int protocol);
 std::unique_ptr<ListenSocket> socket_listen_loop_monitored(int domain, int type, int protocol);
-std::unique_ptr<ListenSocket> socket_ip_loop_monitored(int type, int protocol);
 #else
 // BSD and LWIP_SOCKETS: Socket == ListenSocket, so listen variants just delegate.
 inline std::unique_ptr<ListenSocket> socket_listen(int domain, int type, int protocol) {
@@ -120,14 +165,10 @@ inline std::unique_ptr<ListenSocket> socket_listen(int domain, int type, int pro
 inline std::unique_ptr<ListenSocket> socket_listen_loop_monitored(int domain, int type, int protocol) {
  return socket_loop_monitored(domain, type, protocol);
 }
+#endif
 inline std::unique_ptr<ListenSocket> socket_ip_loop_monitored(int type, int protocol) {
-#if USE_NETWORK_IPV6
-  return socket_loop_monitored(AF_INET6, type, protocol);
-#else
-  return socket_loop_monitored(AF_INET, type, protocol);
-#endif
+  return socket_listen_loop_monitored(IP_DOMAIN, type, protocol);
 }
-#endif

 /// Set a sockaddr to the specified address and port for the IP version used by socket_ip().
 /// @param addr Destination sockaddr structure
@@ -202,15 +202,8 @@ AudioPipelineState AudioPipeline::process_state() {
    if (!this->is_playing_) {
      // The tasks have been stopped for two ``process_state`` calls in a row, so delete the tasks
      if (this->read_task_.is_created() || this->decode_task_.is_created()) {
-        // Both are attempted every time; a task that is still running on the other core is freed by a
-        // subsequent call, and freeing an already freed task succeeds without doing anything
-        bool read_task_freed = this->read_task_.deallocate();
-        bool decode_task_freed = this->decode_task_.deallocate();
-        if (!read_task_freed || !decode_task_freed) {
-          // A task is still running on the other core, so keep the pipeline in its current state and try
-          // again on the next call
-          return AudioPipelineState::PLAYING;
-        }
+        this->read_task_.deallocate();
+        this->decode_task_.deallocate();
        if (this->hard_stop_) {
          // Stop command was sent, so immediately end the playback
          this->speaker_->stop();
@@ -322,17 +315,17 @@ void AudioPipeline::read_task(void *params) {
      if (err == ESP_OK) {
        size_t file_ring_buffer_size = this_pipeline->buffer_size_;

-        std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this_pipeline->raw_file_ring_buffer_.lock();
+        std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer;

-        if (temp_ring_buffer == nullptr) {
+        if (!this_pipeline->raw_file_ring_buffer_.use_count()) {
          temp_ring_buffer = ring_buffer::RingBuffer::create(file_ring_buffer_size);
          this_pipeline->raw_file_ring_buffer_ = temp_ring_buffer;
        }

-        if (temp_ring_buffer == nullptr) {
+        if (!this_pipeline->raw_file_ring_buffer_.use_count()) {
          err = ESP_ERR_NO_MEM;
        } else {
-          err = reader->add_sink(temp_ring_buffer);
+          reader->add_sink(this_pipeline->raw_file_ring_buffer_);
        }
      }

@@ -403,9 +396,7 @@ void AudioPipeline::decode_task(void *params) {
          make_unique<audio::AudioDecoder>(this_pipeline->transfer_buffer_size_, this_pipeline->transfer_buffer_size_);

      esp_err_t err = decoder->start(this_pipeline->current_audio_file_type_);
-      if (err == ESP_OK) {
-        err = decoder->add_source(this_pipeline->raw_file_ring_buffer_);
-      }
+      decoder->add_source(this_pipeline->raw_file_ring_buffer_);

      if (err != ESP_OK) {
        // Send specific error message
@@ -244,7 +244,6 @@
 #define USE_RUNTIME_IMAGE_QOI
 #define USE_RUNTIME_STATS
 #define USE_OTA
-#define USE_OTA_DEFLATE
 #define USE_OTA_ENCRYPTION
 #define USE_OTA_ENCRYPTION_FROM_API
 #define USE_OTA_ENCRYPTION_PROVISIONED
@@ -40,31 +40,16 @@ bool StaticTask::create(TaskFunction_t fn, const char *name, uint32_t stack_size
  return true;
 }

-bool StaticTask::destroy() {
-  if (this->handle_ == nullptr) {
-    return true;
+void StaticTask::destroy() {
+  if (this->handle_ != nullptr) {
+    TaskHandle_t handle = this->handle_;
+    this->handle_ = nullptr;
+    vTaskDelete(handle);
  }
-
-  // Suspending takes the task off the ready and event lists, so nothing can schedule it again. It only asks
-  // the other core to yield though, so the task may still be running on it for a moment.
-  vTaskSuspend(this->handle_);
-  if (eTaskGetState(this->handle_) != eSuspended) {
-    // The task is still running on the other core and using its stack. Deleting it now would only put it on
-    // the termination list and return, so the caller has to try again once it has been swapped out.
-    return false;
-  }
-
-  // The task cannot run again, so the delete completes right away instead of being left to the idle task.
-  TaskHandle_t handle = this->handle_;
-  this->handle_ = nullptr;
-  vTaskDelete(handle);
-  return true;
 }

-bool StaticTask::deallocate() {
-  if (!this->destroy()) {
-    return false;
-  }
+void StaticTask::deallocate() {
+  this->destroy();
  if (this->stack_buffer_ != nullptr) {
    RAMAllocator<StackType_t> allocator(this->use_psram_ ? RAMAllocator<StackType_t>::ALLOC_EXTERNAL
                                                         : RAMAllocator<StackType_t>::ALLOC_INTERNAL);
@@ -72,7 +57,6 @@ bool StaticTask::deallocate() {
    this->stack_buffer_ = nullptr;
    this->stack_size_ = 0;
  }
-  return true;
 }

 }  // namespace esphome
@@ -11,7 +11,6 @@ namespace esphome {

 /** Helper for FreeRTOS static task management.
 * Bundles TaskHandle_t, StaticTask_t, and the stack buffer into one object with create/destroy methods.
- * Call destroy() and deallocate() from another task: a task cannot free the stack it is still running on.
 */
 class StaticTask {
 public:
@@ -24,7 +23,7 @@ class StaticTask {
  /// @brief Allocate stack and create task.
  /// @param fn         Task function
  /// @param name       Task name (for debug)
-  /// @param stack_size Stack size in bytes (StackType_t is a byte on ESP-IDF)
+  /// @param stack_size Stack size in StackType_t words
  /// @param param      Parameter passed to task function
  /// @param priority   FreeRTOS task priority
  /// @param use_psram  If true, allocate stack in PSRAM; otherwise internal RAM
@@ -32,17 +31,11 @@ class StaticTask {
  bool create(TaskFunction_t fn, const char *name, uint32_t stack_size, void *param, UBaseType_t priority,
              bool use_psram);

-  /// @brief Delete the task, keeping the stack buffer allocated for reuse by a subsequent create() call.
-  /// The task must have finished its work and parked itself, either suspended or blocked indefinitely: it is
-  /// suspended here so that it cannot be scheduled again, and it is given no chance to clean up.
-  /// @return true if the task was deleted; false if it is still running on another core, in which case the
-  /// caller should try again later.
-  bool destroy();
+  /// @brief Delete the task but keep the stack buffer allocated for reuse by a subsequent create() call.
+  void destroy();

-  /// @brief Delete the task (if created) and free the stack buffer.
-  /// @return true if the stack buffer was freed; false if the task is still running on another core, in
-  /// which case the caller should try again later.
-  bool deallocate();
+  /// @brief Delete the task (if running) and free the stack buffer.
+  void deallocate();

 protected:
  TaskHandle_t handle_{nullptr};
@@ -11,7 +11,6 @@ import secrets
 import socket
 import time
 from typing import Any
-import zlib

 from esphome.core import EsphomeError
 from esphome.helpers import ProgressBar, resolve_ip_address
@@ -66,15 +65,9 @@ CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01
 CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02
 CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04
 CLIENT_FEATURE_SUPPORTS_NOISE = 0x08
-CLIENT_FEATURE_SUPPORTS_DEFLATE = 0x10
 SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01
 SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02
 SERVER_FEATURE_SUPPORTS_NOISE = 0x04
-# Binding once offered: the device then expects the image size and a deflate stream
-SERVER_FEATURE_SUPPORTS_DEFLATE = 0x08
-
-# Wire constant: the deflate bit promises a 4 KB window (OTA_INFLATE_WINDOW_SIZE)
-DEFLATE_WINDOW_BITS = 12

 NOISE_FRAME_INDICATOR = 0x01
 NOISE_HANDSHAKE_OK = 0x00
@@ -94,9 +87,6 @@ _SUPPORTED_OTA_TYPES: frozenset[int] = frozenset(
 )

 UPLOAD_BLOCK_SIZE = 8192
-# Sizes on the wire are 4 bytes MSB first
-SIZE_FIELD_BYTES = 4
-COMPRESS_LEVEL = 9
 UPLOAD_BUFFER_SIZE = UPLOAD_BLOCK_SIZE * 8

 # Flaky Wi-Fi links often drop the first OTA attempt, and the device may need time
@@ -106,10 +96,6 @@ UPLOAD_BUFFER_SIZE = UPLOAD_BLOCK_SIZE * 8
 # across the addresses on top of that.
 EXTRA_UPLOAD_ATTEMPTS = 2
 UPLOAD_RETRY_DELAY = 5.0
-# Data phase timeout; must stay longer than the device's OTA_SOCKET_TIMEOUT_DATA
-# (105 s) so a stalled session is gone before a retry, and long enough for lwIP
-# to get a lost chunk ack through after the retransmit run seen in practice
-DATA_PHASE_TIMEOUT = 160.0

 _LOGGER = logging.getLogger(__name__)

@@ -561,7 +547,6 @@ def perform_ota(
        CLIENT_FEATURE_SUPPORTS_COMPRESSION
        | CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
        | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
-        | CLIENT_FEATURE_SUPPORTS_DEFLATE
    )
    if noise_psk:
        features_to_send |= CLIENT_FEATURE_SUPPORTS_NOISE
@@ -655,16 +640,8 @@ def perform_ota(
                f"retry {flag_name}."
            )

-    deflate = bool(extended_proto and features & SERVER_FEATURE_SUPPORTS_DEFLATE)
-    if deflate:
-        # The device inflates while receiving through a small ring window
-        upload_contents = zlib.compress(
-            file_contents, COMPRESS_LEVEL, wbits=-DEFLATE_WINDOW_BITS
-        )
-        _LOGGER.info("Compressed to %s bytes (deflate)", len(upload_contents))
-    elif features & SERVER_FEATURE_SUPPORTS_COMPRESSION:
-        # The device stores the gzip file and inflates it when it reboots
-        upload_contents = gzip.compress(file_contents, compresslevel=COMPRESS_LEVEL)
+    if features & SERVER_FEATURE_SUPPORTS_COMPRESSION:
+        upload_contents = gzip.compress(file_contents, compresslevel=9)
        _LOGGER.info("Compressed to %s bytes", len(upload_contents))
    else:
        upload_contents = file_contents
@@ -717,26 +694,29 @@ def perform_ota(

    _LOGGER.info("Handshake complete")

-    sock.settimeout(DATA_PHASE_TIMEOUT)
+    # Timeout must match device-side OTA_SOCKET_TIMEOUT_DATA to prevent premature failures
+    sock.settimeout(90.0)

    if extended_proto:
        send_check(sock, ota_type, "ota type")

    upload_size = len(upload_contents)
+    upload_size_encoded = [
+        (upload_size >> 24) & 0xFF,
+        (upload_size >> 16) & 0xFF,
+        (upload_size >> 8) & 0xFF,
+        (upload_size >> 0) & 0xFF,
+    ]
    # The device erases flash between receiving the size and acking the
    # prepare, so this window shows the erase cost (near zero when the
    # device erases lazily during the upload)
    prepare_start = time.perf_counter()
-    send_check(sock, upload_size.to_bytes(SIZE_FIELD_BYTES, "big"), "binary size")
-    if deflate:
-        # Own frame: an encrypted session carries one field per frame
-        send_check(sock, file_size.to_bytes(SIZE_FIELD_BYTES, "big"), "image size")
+    send_check(sock, upload_size_encoded, "binary size")
    receive_exactly(sock, 1, "update prepare result", RESPONSE_UPDATE_PREPARE_OK)
    prepare_duration = time.perf_counter() - prepare_start
    _LOGGER.info("Preparing for upload took %.2f seconds", prepare_duration)

-    # The device hashes what it writes: the inflated image, else the received bytes
-    upload_md5 = hashlib.md5(file_contents if deflate else upload_contents).hexdigest()
+    upload_md5 = hashlib.md5(upload_contents).hexdigest()
    _LOGGER.debug("MD5 of upload is %s", upload_md5)

    send_check(sock, upload_md5, "file checksum")
@@ -874,7 +854,7 @@ def run_ota_impl_(
    # clean up a half-open connection (its handshake watchdog runs at 20s);
    # moving on to the next address family stays immediate. Known limitation:
    # a silent mid-transfer drop with no reset can wedge the device until its
-    # 105s data timeout, which outlasts this budget; the retries target the
+    # 90s data timeout, which outlasts this budget; the retries target the
    # common failures where the device resets or closes the link promptly.
    total_attempts = len(res) + EXTRA_UPLOAD_ATTEMPTS
    last_error = ""
@@ -45,7 +45,7 @@ lib_deps_base =
 lib_deps =
    ${common.lib_deps_base}
    https://github.com/dudanov/MideaUART.git#eeea6c3e9b4474f067054592b435be1c4e466815 ; midea
-    esphome/noise-c@0.1.26                 ; noise (api, ota)
+    esphome/noise-c@0.1.24                 ; noise (api, ota)
    improv/Improv@1.2.7                    ; improv_serial / esp32_improv
    kikuchan98/pngle@1.1.0                 ; online_image
    ; Using the repository directly, otherwise ESP-IDF can't use the library
@@ -244,7 +244,7 @@ lib_deps =
    ${common:idf-component-libs.lib_deps}
    ESP32Async/ESPAsyncWebServer@3.9.6    ; web_server_base
    droscy/esp_wireguard@0.4.5            ; wireguard
-    esphome/noise-c@0.1.26                ; noise (api, ota)
+    esphome/noise-c@0.1.24                ; noise (api, ota)
    ESP32Async/AsyncTCP@3.4.5             ; async_tcp
    DNSServer                             ; captive_portal
    heman/AsyncMqttClient-esphome@2.0.0   ; mqtt
@@ -641,7 +641,7 @@ build_unflags =
 extends = common
 platform = platformio/native
 lib_deps =
-    esphome/noise-c@0.1.26  ; used by noise (api, ota)
+    esphome/noise-c@0.1.24  ; used by noise (api, ota)
    lvgl/lvgl@9.5.0         ; lvgl
 build_flags =
    ${common.build_flags}
@@ -10,7 +10,7 @@ tzlocal==5.4.4    # from time
 tzdata>=2026.3  # from time
 pyserial==3.5
 platformio==6.1.19
-esptool==5.4.0
+esptool==5.3.1
 click==8.3.3
 aioesphomeapi==46.3.0
 aiohappyeyeballs==2.7.1  # Happy Eyeballs for requests downloads; already pulled in by aioesphomeapi
@@ -823,8 +823,6 @@ def lint_relative_py_import(fname: Path, line, col, content):
        # neither can live in a C++ namespace.
        "esphome/components/esp32_hosted/esp_now_hosted.cpp",
        "esphome/components/esp32_hosted/esp_now_hosted_rpc.h",
-        # C header shared with the vendored decoder
-        "esphome/components/esphome/ota/ota_esphome_inflate.h",
    ],
 )
 def lint_namespace(fname: Path, content: str) -> str | None:
@@ -1,12 +0,0 @@
-from esphome.loader import FileResource
-from tests.testing_helpers import ComponentManifestOverride
-
-
-def override_manifest(manifest: ComponentManifestOverride) -> None:
-    # to_code emits the component count the application needs
-    manifest.enable_codegen()
-    # Only the decoder is under test; its ota platform is not in this build
-    manifest.resources = manifest.resources + [
-        FileResource("esphome.components.esphome", "ota/ota_esphome_inflate.c"),
-        FileResource("esphome.components.esphome", "ota/ota_esphome_inflate.h"),
-    ]
@@ -1,324 +0,0 @@
-#include <gtest/gtest.h>
-
-#include <cstdint>
-#include <cstring>
-#include <vector>
-
-#include "esphome/components/esphome/ota/ota_esphome_inflate.h"
-
-namespace esphome::testing {
-
-// build_plain() compressed with the CLI's window (espota2.DEFLATE_WINDOW_BITS):
-//   DEFLATED = zlib.compress(plain, 9, wbits=-12)
-//   STORED = zlib.compress(plain[:300], 0, wbits=-12)
-static const uint8_t DEFLATED[] = {
-    0xed, 0xc8, 0xf7, 0x3f, 0xd4, 0x0f, 0x03, 0x00, 0x70, 0x67, 0xaf, 0x4b, 0x67, 0x66, 0x9f, 0x90, 0x91, 0x11, 0xc2,
-    0x11, 0x91, 0xb8, 0xb3, 0xf7, 0x3a, 0xd9, 0x5f, 0x4e, 0x99, 0x67, 0x1e, 0xce, 0x8a, 0xac, 0xec, 0x59, 0xb8, 0xc2,
-    0x95, 0x5d, 0x56, 0x42, 0x67, 0x73, 0x46, 0xf6, 0xca, 0xce, 0xc8, 0xc8, 0xc8, 0x91, 0x8a, 0x7c, 0x2f, 0x7a, 0xfe,
-    0x86, 0xe7, 0x87, 0xe7, 0x87, 0xe7, 0xf5, 0xfa, 0xbc, 0x7f, 0x7c, 0xbb, 0x07, 0xa2, 0x1f, 0xfa, 0xf9, 0xb8, 0x43,
-    0xfd, 0x82, 0x5c, 0xa0, 0x6e, 0xee, 0x28, 0x6f, 0x97, 0x20, 0x77, 0xa8, 0x3b, 0x70, 0xc0, 0x01, 0x07, 0x1c, 0x70,
-    0xc0, 0x01, 0x07, 0x1c, 0x70, 0xc0, 0x01, 0x07, 0x1c, 0x70, 0xc0, 0x01, 0x07, 0x1c, 0x70, 0xc0, 0x01, 0x07, 0x1c,
-    0x70, 0xc0, 0x01, 0xf7, 0x5f, 0xdd, 0x40, 0xd4, 0x63, 0x2f, 0x03, 0xf2, 0x17, 0xb2, 0xe5, 0x69, 0xc7, 0x5a, 0x04,
-    0xdf, 0x46, 0x22, 0xa8, 0x4b, 0x6e, 0xd5, 0x3a, 0x80, 0x05, 0xe1, 0x81, 0x4a, 0x44, 0x56, 0x27, 0xa9, 0x21, 0xf7,
-    0xad, 0xd9, 0xb0, 0xd3, 0xf1, 0xa5, 0x0b, 0x6a, 0x96, 0x56, 0xb2, 0xca, 0xb5, 0xee, 0x0f, 0x96, 0x28, 0xc3, 0x9e,
-    0x8f, 0x6e, 0xf2, 0x84, 0xa4, 0x3b, 0x2d, 0x16, 0x64, 0x08, 0x6a, 0x28, 0x91, 0xee, 0x87, 0x1a, 0x81, 0xff, 0xed,
-    0x2c, 0x5f, 0xda, 0x4a, 0x48, 0x5f, 0x91, 0xf0, 0x31, 0xfe, 0x6b, 0xbd, 0x81, 0x86, 0x92, 0x33, 0x1a, 0x6c, 0x69,
-    0x32, 0xfb, 0x19, 0x56, 0x2c, 0xc6, 0xaa, 0xef, 0xe8, 0x16, 0x98, 0xcf, 0x98, 0xbf, 0xa0, 0x2d, 0xde, 0x7f, 0xdf,
-    0x4b, 0xcb, 0xf6, 0x5c, 0xaf, 0x11, 0x24, 0xf0, 0x46, 0x3e, 0x49, 0x0e, 0x67, 0x0e, 0xcf, 0xf3, 0x57, 0xca, 0xb0,
-    0x39, 0x55, 0xe1, 0xe7, 0xfc, 0x37, 0x29, 0xe8, 0xd7, 0xf3, 0x08, 0x2e, 0xfb, 0x7b, 0x6d, 0x3e, 0xfe, 0xe9, 0x2c,
-    0x68, 0xe4, 0x20, 0x88, 0x57, 0x56, 0x41, 0x3d, 0xab, 0x9b, 0xbf, 0x0c, 0x0c, 0xae, 0x51, 0x48, 0x8b, 0x72, 0xcc,
-    0xb8, 0xbb, 0xf3, 0x30, 0xa8, 0x5c, 0xb5, 0xa1, 0x2f, 0x07, 0x52, 0xe9, 0x36, 0xb8, 0x3c, 0xbc, 0xee, 0xbc, 0xf1,
-    0xa3, 0x8b, 0x81, 0xc2, 0x03, 0xbf, 0x29, 0x5a, 0x22, 0x24, 0x97, 0xf8, 0xc9, 0xb5, 0xbf, 0xd2, 0x24, 0x4a, 0x86,
-    0xc1, 0x2b, 0xb7, 0xb8, 0xde, 0xa7, 0xea, 0xa5, 0x1d, 0x13, 0x1c, 0x1d, 0xd3, 0x3c, 0x81, 0x60, 0x2e, 0x2f, 0x93,
-    0x5c, 0x78, 0x43, 0x2e, 0x39, 0x68, 0x09, 0x13, 0x09, 0x10, 0xce, 0xd6, 0x8d, 0xe9, 0x2f, 0xaf, 0x88, 0x6f, 0x99,
-    0x4f, 0xcd, 0xdc, 0xaa, 0xf9, 0x47, 0xdb, 0x1c, 0xb5, 0x89, 0x53, 0x10, 0x3d, 0x77, 0xac, 0x26, 0x04, 0x3a, 0x3b,
-    0x18, 0xf8, 0x47, 0x75, 0x56, 0xa5, 0xda, 0x70, 0xfb, 0xf7, 0x0d, 0x3b, 0x6e, 0x4b, 0x2a, 0xbc, 0x49, 0x32, 0x43,
-    0x95, 0x62, 0x83, 0x3d, 0xdc, 0x0a, 0x1f, 0x1d, 0xf9, 0x59, 0x6b, 0x95, 0xf0, 0x9b, 0xf5, 0x53, 0x9e, 0xb5, 0x65,
-    0xeb, 0x74, 0xfa, 0x81, 0x9b, 0x61, 0xa3, 0x57, 0x2f, 0xda, 0x2c, 0xcd, 0xf8, 0xb0, 0x74, 0xb9, 0x62, 0x39, 0x91,
-    0xd9, 0x7d, 0xb3, 0x03, 0x65, 0x2e, 0x66, 0x20, 0x18, 0xac, 0xa2, 0xeb, 0x3b, 0x35, 0x98, 0xa3, 0x28, 0x46, 0x30,
-    0xee, 0xd3, 0xeb, 0x47, 0x49, 0x11, 0xc5, 0xcd, 0xa0, 0xa5, 0x1c, 0x2e, 0x9d, 0x14, 0xd6, 0x46, 0x4a, 0x05, 0x7b,
-    0xd3, 0xb9, 0x0d, 0xeb, 0xd7, 0x6f, 0xb5, 0xf4, 0xed, 0x3f, 0x27, 0xb8, 0xec, 0x51, 0xb1, 0x6e, 0xb0, 0x14, 0xed,
-    0xdf, 0x90, 0x72, 0x59, 0x71, 0xd5, 0xf5, 0xf2, 0x61, 0x5f, 0xa7, 0x8a, 0xd7, 0x0f, 0x80, 0x2f, 0xe5, 0x0f, 0x45,
-    0xf2, 0x4d, 0xd1, 0xdc, 0xdd, 0xce, 0x46, 0xdf, 0x77, 0xf2, 0xa6, 0xa2, 0x79, 0x77, 0xf0, 0x0e, 0xaa, 0x68, 0x14,
-    0x85, 0x32, 0x05, 0x29, 0x75, 0x2b, 0x6c, 0xb0, 0x7c, 0x84, 0xc9, 0xec, 0x49, 0x70, 0x9b, 0x38, 0x36, 0x4c, 0xe9,
-    0xa5, 0xdc, 0xb1, 0xb8, 0x28, 0xd6, 0x20, 0x89, 0x8a, 0x2a, 0x62, 0xc1, 0x90, 0x3a, 0x43, 0x48, 0xaa, 0xfc, 0xec,
-    0x52, 0xf4, 0x02, 0xa7, 0xcd, 0x46, 0xf9, 0x78, 0x64, 0x4f, 0xad, 0x6b, 0x17, 0xdb, 0x56, 0xa2, 0xa1, 0x6a, 0xcf,
-    0x3b, 0x66, 0x64, 0x01, 0xc2, 0xd6, 0xae, 0x23, 0x34, 0x82, 0x60, 0x0a, 0x3a, 0xe4, 0xdd, 0x7f, 0xaa, 0x97, 0x44,
-    0x9a, 0x63, 0x8f, 0xaf, 0xa9, 0x97, 0x5a, 0x55, 0xcc, 0x81, 0x48, 0x83, 0xf8, 0xe6, 0xc5, 0xef, 0xdf, 0xfa, 0x5a,
-    0x4f, 0x7f, 0x18, 0x56, 0xc0, 0x66, 0x36, 0xad, 0x8a, 0x79, 0xab, 0xde, 0xf4, 0x7b, 0x70, 0x98, 0xea, 0xfa, 0xf4,
-    0xc7, 0x01, 0x31, 0x16, 0xea, 0xf1, 0x70, 0x8d, 0xee, 0x87, 0x52, 0x13, 0x01, 0x9e, 0x0c, 0xbd, 0x5a, 0x14, 0x01,
-    0x8e, 0xf7, 0x6e, 0xff, 0xce, 0x7f, 0xa4, 0xd1, 0xa1, 0x6a, 0x9b, 0x95, 0xb2, 0x31, 0x8a, 0x6f, 0xc8, 0xfe, 0x8c,
-    0x29, 0x55, 0xbc, 0xfc, 0x61, 0xd0, 0xde, 0xb0, 0xa9, 0x0c, 0x01, 0x0f, 0xba, 0x77, 0x7e, 0x77, 0xd9, 0x76, 0xa4,
-    0xfd, 0xab, 0x38, 0x18, 0x92, 0xec, 0xf0, 0xd3, 0x57, 0x7f, 0xf4, 0xbd, 0x65, 0xd4, 0x77, 0x8e, 0xa1, 0x92, 0x82,
-    0x0c, 0x7b, 0x34, 0xd3, 0x11, 0xfb, 0xc0, 0x36, 0x23, 0x8e, 0xbb, 0x89, 0xdf, 0x70, 0xdc, 0x9a, 0x76, 0x45, 0x0b,
-    0x22, 0xfa, 0x35, 0xdf, 0x8f, 0x45, 0x48, 0x7d, 0xed, 0xdc, 0x06, 0x01, 0x5e, 0xbb, 0xe9, 0xf9, 0x07, 0x93, 0xf6,
-    0x69, 0x6f, 0xf1, 0xfc, 0xfd, 0xfa, 0x41, 0xc0, 0x13, 0x9e, 0x74, 0x2d, 0x76, 0xfe, 0xa7, 0xbe, 0x4e, 0xd9, 0xaa,
-    0x64, 0xa6, 0xed, 0xd3, 0xad, 0xee, 0x62, 0x9d, 0x39, 0xc9, 0xb8, 0xae, 0x86, 0x31, 0x4f, 0x62, 0x57, 0xea, 0xea,
-    0x5a, 0xe3, 0x59, 0xd8, 0x99, 0xb3, 0xcd, 0x9f, 0x3b, 0xea, 0x58, 0x99, 0x11, 0xdc, 0x3d, 0xac, 0x58, 0xd9, 0xa6,
-    0xae, 0x2d, 0x07, 0x1d, 0xd7, 0xfa, 0x87, 0x78, 0xa7, 0x7f, 0x2a, 0x4f, 0x25, 0x58, 0xef, 0x53, 0x78, 0x2e, 0x93,
-    0xdc, 0x44, 0xcc, 0x53, 0x88, 0x77, 0x1c, 0xda, 0x14, 0xaf, 0xe1, 0x67, 0x92, 0xff, 0x36, 0x96, 0x20, 0x6f, 0x9d,
-    0x2c, 0x7f, 0xea, 0x31, 0xf2, 0x34, 0x50, 0xc2, 0x39, 0x84, 0xee, 0x4c, 0xbe, 0xca, 0x06, 0x6f, 0x67, 0x42, 0xea,
-    0x13, 0x58, 0xee, 0xdd, 0x8e, 0x29, 0x4f, 0xee, 0xd8, 0x93, 0x0d, 0x45, 0x80, 0x4d, 0xf3, 0x12, 0x79, 0xbb, 0x36,
-    0xa3, 0x73, 0x95, 0x95, 0xb6, 0xfc, 0x54, 0x60, 0xb2, 0xcc, 0x71, 0xaa, 0xf1, 0x6b, 0x66, 0xed, 0xba, 0x8b, 0xd6,
-    0x6d, 0x61, 0x79, 0x61, 0x1d, 0xb3, 0xba, 0xa6, 0x2f, 0xaa, 0xdc, 0x1d, 0xb8, 0x22, 0xd8, 0x98, 0x58, 0xed, 0x4d,
-    0x3c, 0xea, 0xa9, 0x37, 0x5e, 0x5e, 0x7b, 0x47, 0xa1, 0x7a, 0x39, 0x42, 0xe4, 0x3b, 0xbb, 0x69, 0x0a, 0x8b, 0x32,
-    0x6e, 0x63, 0xeb, 0x87, 0xf6, 0x5d, 0xaa, 0xbf, 0xbe, 0xc5, 0xb2, 0x85, 0x60, 0xdc, 0x32, 0x07, 0x85, 0x73, 0x3d,
-    0x96, 0x8b, 0x89, 0x71, 0x52, 0xb4, 0x93, 0xe6, 0x18, 0xad, 0xbf, 0xce, 0x21, 0x1d, 0x33, 0xb5, 0xb3, 0x35, 0x6a,
-    0x5b, 0xe7, 0x47, 0x13, 0x19, 0x8f, 0x53, 0xf4, 0x0c, 0x2a, 0x39, 0x16, 0x37, 0x39, 0x3b, 0x5f, 0x81, 0x51, 0xbc,
-    0x23, 0x92, 0x2c, 0x8d, 0xbf, 0x2f, 0xee, 0xbf, 0xed, 0x9d, 0x3f, 0xe0, 0x16, 0x21, 0x5a, 0x57, 0xa6, 0x8c, 0x58,
-    0x7a, 0xd5, 0xa1, 0x6d, 0xed, 0xe8, 0x90, 0x97, 0x14, 0xb4, 0x6b, 0xa5, 0x3b, 0xd7, 0x90, 0x84, 0x9e, 0x07, 0xc2,
-    0x7f, 0x1e, 0x08, 0xa0, 0x6f, 0x69, 0xf1, 0xcc, 0x4e, 0xca, 0x07, 0x64, 0xa2, 0xb4, 0xbc, 0x5f, 0xe0, 0xa7, 0x0e,
-    0x31, 0x77, 0x6f, 0x35, 0xd7, 0x66, 0x83, 0x5d, 0x64, 0x4e, 0xf1, 0x3c, 0x7a, 0xcb, 0xa5, 0xfc, 0xc9, 0x95, 0xab,
-    0x27, 0x30, 0x6b, 0x82, 0x57, 0xcd, 0xb0, 0x85, 0x9d, 0xc5, 0xa9, 0x0f, 0xdb, 0xe3, 0x5a, 0xc1, 0xb2, 0x3f, 0xfa,
-    0xea, 0xf3, 0x3a, 0xa0, 0xe4, 0xad, 0xd7, 0x14, 0xcf, 0x4f, 0xc9, 0x46, 0x09, 0x6e, 0x70, 0x27, 0xe4, 0x9b, 0x5f,
-    0x61, 0x4a, 0xb2, 0xfb, 0xc3, 0xf0, 0x3a, 0x53, 0x38, 0x2a, 0x59, 0x48, 0x2b, 0xab, 0x21, 0x64, 0x1a, 0x1c, 0x90,
-    0xb6, 0x69, 0xbb, 0x89, 0xe3, 0x9a, 0x12, 0xb7, 0xfd, 0x47, 0xcc, 0x57, 0xdb, 0x2b, 0xf6, 0x35, 0xe1, 0x79, 0xe0,
-    0xbf, 0x6d, 0x7f, 0x71, 0x3c, 0x21, 0x27, 0x82, 0x12, 0x05, 0xae, 0x43, 0x11, 0x0f, 0xc8, 0xe7, 0x3c, 0xf0, 0x0b,
-    0xe4, 0x69, 0xff, 0xb2, 0xda, 0x9e, 0x7f, 0xfe, 0xa4, 0x3f, 0xdf, 0x02, 0x58, 0xaa, 0x60, 0xd2, 0x8e, 0xd5, 0x6c,
-    0x92, 0x22, 0x38, 0xb1, 0xd2, 0x84, 0x80, 0xea, 0xce, 0xfe, 0x34, 0x79, 0xd6, 0x94, 0xb0, 0xad, 0x51, 0x67, 0x65,
-    0xf5, 0xab, 0xd5, 0x18, 0x05, 0x92, 0x8a, 0x24, 0x36, 0xc2, 0xc4, 0x99, 0xad, 0x0d, 0x26, 0xb8, 0x70, 0xea, 0x5b,
-    0x74, 0x35, 0x6a, 0xfa, 0xac, 0x97, 0xd8, 0x4c, 0x08, 0x6d, 0xc1, 0xfe, 0x60, 0xe4, 0xd4, 0x8f, 0x93, 0xd4, 0xaf,
-    0xa2, 0xec, 0xb8, 0x71, 0xf6, 0xcb, 0x3f, 0xdc, 0x3e, 0x42, 0xca, 0xe2, 0x8d, 0xb9, 0x0a, 0x2c, 0xef, 0xb6, 0x18,
-    0x75, 0x46, 0x8a, 0x2b, 0x21, 0xeb, 0xc5, 0x12, 0x4d, 0xd7, 0xb8, 0x8e, 0x6c, 0xec, 0x9d, 0x12, 0xde, 0xa5, 0x45,
-    0xab, 0xc4, 0x26, 0x47, 0xfa, 0x57, 0xad, 0x78, 0x4c, 0x5e, 0x87, 0x0b, 0x42, 0x6a, 0xbe, 0xef, 0xbd, 0xbc, 0xe5,
-    0xd7, 0x4c, 0x3a, 0x0f, 0x96, 0x29, 0xcb, 0x45, 0x46, 0x3f, 0x8a, 0x31, 0xda, 0x8d, 0x7f, 0x89, 0xa4, 0xd6, 0xb4,
-    0xe5, 0x99, 0x27, 0xa7, 0xab, 0x15, 0x82, 0x75, 0x3e, 0xc0, 0x9d, 0xae, 0x8c, 0x7f, 0x19, 0x80, 0xf5, 0xa6, 0x89,
-    0xbc, 0xb7, 0x36, 0x50, 0x1f, 0x63, 0xca, 0x40, 0x3e, 0xe1, 0x4c, 0x2d, 0x1e, 0x15, 0x51, 0x93, 0xf2, 0x1a, 0x97,
-    0x3e, 0xad, 0x5e, 0xba, 0xe2, 0xd6, 0xa7, 0x7c, 0x51, 0x45, 0xdf, 0x92, 0xbe, 0x35, 0xf3, 0xb4, 0xe8, 0x5c, 0x2e,
-    0x6a, 0x5c, 0xda, 0xe8, 0xf7, 0x51, 0xdc, 0xcb, 0x06, 0xd2, 0xd2, 0xa4, 0x7c, 0x7d, 0x5f, 0x20, 0xb8, 0x50, 0x04,
-    0xb5, 0xb1, 0x9a, 0x4e, 0xc9, 0x94, 0xe4, 0x40, 0x2b, 0x85, 0xc8, 0xd3, 0x71, 0xfa, 0x83, 0x81, 0x28, 0x53, 0xef,
-    0xa0, 0xb0, 0xf0, 0xc8, 0xb9, 0x52, 0xb2, 0x0f, 0x8c, 0x49, 0x93, 0xeb, 0x2a, 0x95, 0x83, 0x4f, 0x47, 0xe8, 0x0c,
-    0x83, 0x7b, 0x88, 0x18, 0x63, 0xa9, 0x87, 0x7f, 0xe3, 0x57, 0xa6, 0x57, 0xdd, 0x6d, 0x2a, 0x85, 0xe9, 0x79, 0x16,
-    0x3b, 0x07, 0x59, 0x4f, 0xed, 0x9a, 0x17, 0xe7, 0xcd, 0x35, 0xa6, 0x9b, 0x06, 0x1d, 0x18, 0x5e, 0xb2, 0x9b, 0xac,
-    0x18, 0xc6, 0x5b, 0xec, 0xbe, 0x29, 0xa3, 0x57, 0xc2, 0x6b, 0x3f, 0x11, 0x89, 0xd1, 0x57, 0xe4, 0xb8, 0xaf, 0x11,
-    0xba, 0x90, 0x93, 0x4f, 0x5e, 0x0c, 0x6b, 0x9f, 0x61, 0x5c, 0xdd, 0xb6, 0xcf, 0x18, 0xcc, 0x9a, 0x95, 0x32, 0x5f,
-    0x6f, 0xf1, 0x43, 0x17, 0x2d, 0xbc, 0x70, 0xbe, 0xd4, 0x76, 0x38, 0x42, 0xcc, 0xdd, 0xf0, 0xff, 0x5b, 0xe8, 0x19,
-    0xc9, 0xf4, 0x25, 0xda, 0xdb, 0x5f, 0xd2, 0x3c, 0xf3, 0xe0, 0xed, 0xb0, 0xa2, 0x4c, 0xdf, 0x05, 0xf2, 0x0c, 0xc4,
-    0x21, 0xb9, 0xc4, 0x02, 0xd2, 0x1e, 0x46, 0x2c, 0x57, 0x78, 0xb0, 0xf1, 0x85, 0x33, 0x51, 0xc5, 0x3e, 0xce, 0x69,
-    0x68, 0x77, 0x3e, 0xb4, 0x5a, 0x4e, 0x43, 0x89, 0x85, 0x71, 0x36, 0x84, 0x56, 0x5c, 0x6b, 0xce, 0x78, 0x4e, 0x86,
-    0x6a, 0x5f, 0xf1, 0x2d, 0x73, 0x4c, 0xba, 0xc1, 0x5e, 0x2b, 0x6e, 0x0d, 0xdd, 0x45, 0x1d, 0x92, 0xb4, 0x31, 0xd9,
-    0xce, 0x0b, 0x58, 0x67, 0xc1, 0xa6, 0x47, 0x2e, 0x5e, 0x6d, 0x6d, 0xa3, 0x78, 0xed, 0xc5, 0xcb, 0xac, 0x20, 0xb8,
-    0x6a, 0x14, 0x32, 0x55, 0xe8, 0xfb, 0xe0, 0xee, 0x31, 0xfc, 0x47, 0x33, 0xf6, 0xe7, 0x54, 0xd1, 0x61, 0x91, 0x74,
-    0x90, 0xfa, 0x44, 0x0a, 0xc8, 0xaf, 0xa2, 0xdb, 0x2c, 0x83, 0xda, 0xe8, 0xd0, 0xb7, 0x34, 0x8a, 0xc8, 0xbb, 0x86,
-    0x58, 0x82, 0x1a, 0x2f, 0xd6, 0xc5, 0x92, 0xe9, 0xd0, 0x21, 0x11, 0xf6, 0xeb, 0x9b, 0xed, 0xbf, 0xa9, 0x71, 0x89,
-    0xb2, 0x59, 0x76, 0xb3, 0xeb, 0x9c, 0xe1, 0x73, 0x79, 0x7b, 0x11, 0x3d, 0x4e, 0x33, 0xca, 0xf6, 0x7e, 0xd8, 0xcf,
-    0x06, 0x41, 0x39, 0xef, 0x78, 0x5a, 0x89, 0x69, 0x0c, 0xff, 0xda, 0x31, 0x16, 0x32, 0xd4, 0xe5, 0x2d, 0x8b, 0x22,
-    0xb9, 0x82, 0x38, 0xd8, 0x22, 0xfc, 0xe8, 0xbd, 0xbf, 0x0d, 0x4b, 0xc9, 0x0d, 0x74, 0x5e, 0x2d, 0xb2, 0x1f, 0x23,
-    0xa8, 0xf8, 0xa7, 0x27, 0xe1, 0x02, 0x61, 0x83, 0xc4, 0xd0, 0x63, 0x0e, 0x23, 0xf2, 0x34, 0x06, 0x69, 0xd1, 0xa3,
-    0xa2, 0x76, 0x76, 0x94, 0xbc, 0x1f, 0x78, 0x73, 0x5a, 0x48, 0x82, 0xb4, 0x68, 0x3d, 0x24, 0x52, 0xe8, 0x92, 0x4e,
-    0x58, 0xdf, 0x55, 0x3f, 0xa8, 0x48, 0x59, 0x35, 0x90, 0x9b, 0x55, 0xc9, 0xdc, 0xff, 0xcc, 0x22, 0x7c, 0xd1, 0x29,
-    0xe0, 0xd5, 0xd8, 0x31, 0x3d, 0x9b, 0xae, 0x38, 0x52, 0x2a, 0xa1, 0xc5, 0x86, 0x19, 0x93, 0xe7, 0x2d, 0x9b, 0xa9,
-    0x09, 0xbf, 0xdd, 0x89, 0x43, 0x35, 0xb2, 0x6f, 0x91, 0xba, 0x28, 0xfa, 0x2f, 0x2c, 0xab, 0xe8, 0x58, 0xe6, 0x4c,
-    0xbf, 0xd5, 0xaf, 0x49, 0xcd, 0x7f, 0x18, 0xa4, 0x69, 0xd3, 0xff, 0x99, 0xad, 0x9d, 0xb0, 0x93, 0x3b, 0x04, 0x01,
-    0xd5, 0x7d, 0x33, 0xe0, 0x66, 0xe2, 0xd4, 0xeb, 0xae, 0xcd, 0x7f, 0x66, 0xf2, 0x2c, 0xa7, 0xfe, 0x7d, 0x51, 0x8b,
-    0x2a, 0x25, 0xa8, 0x90, 0xb2, 0x71, 0xe5, 0x98, 0x40, 0xb8, 0xe9, 0x1f, 0x64, 0xd9, 0x90, 0xf2, 0x39, 0x25, 0x6f,
-    0x58, 0x35, 0x9e, 0x40, 0x25, 0x92, 0xbb, 0xa2, 0x4d, 0x45, 0xf6, 0xc3, 0x1a, 0xc6, 0xc0, 0xf6, 0xc2, 0x9b, 0x2b,
-    0xb5, 0xc7, 0xe9, 0xc8, 0x75, 0x03, 0x71, 0x1c, 0x76, 0x0e, 0xde, 0x5c, 0xe7, 0xf4, 0x91, 0xc4, 0x1d, 0x9f, 0xcb,
-    0x67, 0x1c, 0x1b, 0xc9, 0x25, 0x6d, 0x95, 0x05, 0xd7, 0x3b, 0xbf, 0x2d, 0x90, 0x96, 0xc3, 0x44, 0xa3, 0x0a, 0xee,
-    0x7a, 0x4c, 0x7e, 0x7f, 0xc2, 0x4e, 0x4f, 0x38, 0x88, 0xe9, 0x9f, 0x93, 0xd8, 0xd1, 0x10, 0x8c, 0x85, 0x89, 0xb2,
-    0xd0, 0x95, 0xc3, 0xe4, 0xd2, 0x8f, 0x2b, 0x0c, 0x82, 0xbd, 0x25, 0x74, 0x39, 0xe7, 0x3e, 0xef, 0xd2, 0x2f, 0x6f,
-    0xdc, 0xe0, 0x75, 0x6b, 0xf2, 0x66, 0x7d, 0x65, 0x18, 0x26, 0xb0, 0x7a, 0x7a, 0x45, 0xf0, 0xf2, 0xc4, 0xbe, 0x70,
-    0x6e, 0x58, 0x3a, 0x54, 0x31, 0x64, 0xf6, 0x49, 0xb5, 0xdc, 0x1c, 0x9e, 0x87, 0xdb, 0x6a, 0x92, 0x2a, 0x59, 0x73,
-    0x35, 0x4d, 0x59, 0xed, 0xd0, 0x8a, 0xd9, 0xac, 0xea, 0x7c, 0xc0, 0x0a, 0xfe, 0x8f, 0x29, 0xb7, 0xda, 0xdc, 0x8a,
-    0x55, 0x0f, 0x61, 0xc0, 0x82, 0x49, 0x4c, 0xc2, 0x51, 0x4b, 0x41, 0x7d, 0x1f, 0xf1, 0x07, 0x13, 0x23, 0x16, 0xe4,
-    0x88, 0x76, 0x38, 0x92, 0xbd, 0x3d, 0xe2, 0x7b, 0xab, 0x1c, 0x53, 0x35, 0xfb, 0x85, 0x76, 0x35, 0xf7, 0xfc, 0xdc,
-    0x3e, 0xc9, 0xae, 0x6a, 0x7c, 0x10, 0x44, 0xa5, 0xfb, 0xc4, 0x81, 0x9a, 0x6d, 0x9b, 0xf2, 0x87, 0x0a, 0x9e, 0xcd,
-    0x75, 0xc2, 0xd5, 0xe7, 0x0b, 0xcd, 0x5c, 0x6e, 0xf2, 0x51, 0x96, 0xa3, 0xe8, 0xd5, 0x5a, 0x17, 0xf5, 0x1a, 0x28,
-    0xff, 0xc8, 0xf0, 0xfc, 0x7e, 0x3b, 0xd3, 0xf3, 0x12, 0x61, 0xe9, 0x02, 0xfa, 0x7b, 0x8e, 0x6b, 0x34, 0x4a, 0x5a,
-    0xb6, 0xb1, 0x71, 0x7d, 0xad, 0xbc, 0x88, 0x22, 0xf6, 0x14, 0xc5, 0x57, 0x1a, 0x0b, 0xb6, 0x8b, 0xbb, 0x9a, 0x09,
-    0xf2, 0xe8, 0x8d, 0x32, 0xd1, 0x54, 0xa9, 0xd2, 0x9f, 0xc5, 0xf4, 0x12, 0xad, 0xb3, 0xfd, 0x52, 0xb7, 0xff, 0x0e,
-    0x72, 0x59, 0xcb, 0x1d, 0x8d, 0xa4, 0xf2, 0x0f, 0x39, 0x8f, 0xc9, 0x84, 0xe0, 0x5c, 0xdd, 0x9c, 0xe4, 0x42, 0x4f,
-    0xf2, 0x09, 0x1e, 0x05, 0xcc, 0x41, 0xdd, 0xbd, 0xc1, 0xed, 0xdc, 0x8e, 0x64, 0xc3, 0x67, 0x51, 0xe5, 0x8a, 0x9a,
-    0x0d, 0x09, 0xb8, 0x4b, 0xa1, 0xb2, 0xdb, 0x01, 0xde, 0xf5, 0xd1, 0x51, 0xf7, 0x9d, 0x88, 0x59, 0xfd, 0xd5, 0x13,
-    0x0d, 0x05, 0xd5, 0x5e, 0xfa, 0x63, 0x26, 0x25, 0xad, 0x01, 0x83, 0x6f, 0xf3, 0x7f, 0x56, 0x11, 0x89, 0xaa, 0xdb,
-    0x49, 0xaa, 0x8f, 0x7d, 0x10, 0x99, 0xbf, 0x8b, 0xcf, 0xf4, 0xf8, 0xc2, 0x4e, 0x36, 0xa7, 0xb1, 0xfe, 0xc5, 0xf0,
-    0x07, 0xc3, 0x57, 0xe3, 0xbd, 0x1e, 0xa1, 0x56, 0x46, 0x32, 0x43, 0x8f, 0x8d, 0xc7, 0x73, 0x0a, 0xa5, 0x35, 0xa9,
-    0x93, 0x7c, 0x53, 0x3c, 0xf2, 0x58, 0xf3, 0x6a, 0x37, 0x41, 0xb4, 0xc7, 0x9d, 0xcd, 0xb1, 0x67, 0xb7, 0xaa, 0x5f,
-    0x25, 0xb9, 0xc5, 0xb6, 0xa2, 0xdb, 0xce, 0x34, 0x2c, 0xea, 0x93, 0x45, 0x6e, 0x7b, 0x6f, 0xb6, 0xf6, 0x89, 0x83,
-    0xd1, 0x9e, 0x08, 0x4b, 0x57, 0x4e, 0xd9, 0xf3, 0xe8, 0x81, 0x03, 0x5c, 0xd6, 0x6c, 0x2c, 0xea, 0x27, 0x2d, 0xfb,
-    0x39, 0xbb, 0x25, 0x81, 0xbb, 0x1a, 0xc3, 0xcb, 0xf5, 0x5e, 0x69, 0x1c, 0xa4, 0x8a, 0x0e, 0x4a, 0x69, 0xdf, 0xcd,
-    0x6c, 0xc7, 0xce, 0x48, 0xdb, 0x7a, 0x0b, 0xcb, 0x40, 0xc8, 0x59, 0x81, 0xde, 0x71, 0x3e, 0x0d, 0x41, 0xc9, 0xa2,
-    0x57, 0xae, 0xb7, 0x3f, 0x8b, 0x4e, 0x7c, 0xcb, 0xf9, 0xa5, 0xcb, 0xf8, 0xee, 0x52, 0xbe, 0x54, 0xa8, 0xef, 0x99,
-    0xb7, 0xa1, 0x0b, 0x77, 0xa2, 0xa7, 0x89, 0x47, 0x7f, 0x48, 0xaa, 0x02, 0x36, 0xbf, 0x9d, 0x97, 0xba, 0x43, 0x5e,
-    0x39, 0xa6, 0x99, 0x81, 0xde, 0xe4, 0x98, 0x06, 0x6a, 0xc8, 0x2c, 0x96, 0xf5, 0x51, 0x8c, 0x95, 0xd3, 0xe4, 0x2b,
-    0x94, 0x9a, 0x15, 0x71, 0x9f, 0xa4, 0x24, 0xfc, 0x92, 0x97, 0x18, 0xb7, 0x56, 0xe5, 0x59, 0xe1, 0x1a, 0x79, 0x3a,
-    0x47, 0x77, 0x92, 0xf5, 0x75, 0x42, 0xbd, 0x2d, 0x55, 0x05, 0xcf, 0xe8, 0xea, 0x64, 0x8b, 0xff, 0x30, 0xa1, 0x1e,
-    0x28, 0x2c, 0xa9, 0xaa, 0xd4, 0x19, 0x1d, 0x24, 0x7a, 0xcf, 0x5d, 0x39, 0xf2, 0xe3, 0xd2, 0xab, 0x26, 0x97, 0x35,
-    0xf6, 0x70, 0x8b, 0x09, 0x8b, 0x00, 0xb9, 0xb8, 0xa8, 0xb7, 0x78, 0xf1, 0x96, 0x03, 0xd2, 0x72, 0x46, 0x26, 0x82,
-    0x41, 0xce, 0xe3, 0x73, 0xb2, 0x31, 0x4f, 0x49, 0xc8, 0xa8, 0xcf, 0xcc, 0xb8, 0xcc, 0x5d, 0xab, 0xd1, 0x1e, 0xf5,
-    0x5a, 0x9a, 0x54, 0xaf, 0x15, 0xed, 0x5f, 0x96, 0x2b, 0x62, 0x0a, 0x4c, 0x67, 0x21, 0x98, 0xfd, 0x29, 0xf8, 0x12,
-    0x9d, 0xc2, 0x34, 0x4d, 0x70, 0x0e, 0x3b, 0x5e, 0xe3, 0x91, 0x58, 0x82, 0xa8, 0x9c, 0x7d, 0x11, 0xfb, 0x5d, 0x81,
-    0x0c, 0x0f, 0x9d, 0x84, 0xbb, 0xeb, 0x65, 0x1d, 0xeb, 0x6e, 0x18, 0x8e, 0x93, 0x70, 0xbb, 0x9d, 0xed, 0x58, 0xb2,
-    0x64, 0xf2, 0x7b, 0x8f, 0x05, 0xd8, 0xfa, 0x55, 0x50, 0xef, 0x7a, 0x49, 0x0d, 0xdf, 0xca, 0x63, 0xff, 0x41, 0x1d,
-    0x89, 0x79, 0xca, 0x8c, 0x1b, 0xbe, 0x75, 0x6f, 0x0e, 0x6b, 0x68, 0x8c, 0x5c, 0x93, 0xc8, 0xf3, 0x62, 0x0b, 0x68,
-    0xb1, 0x32, 0x2f, 0x1e, 0xda, 0xe5, 0x6d, 0x45, 0xaf, 0x3d, 0xa7, 0xaf, 0x81, 0x0f, 0xda, 0x82, 0x85, 0x94, 0x06,
-    0xc5, 0x3f, 0xf5, 0x73, 0x5f, 0xa4, 0x43, 0x5f, 0xb3, 0xac, 0x3d, 0x16, 0xe8, 0x6f, 0x84, 0xb3, 0xb6, 0x75, 0xf7,
-    0x13, 0x03, 0x46, 0x67, 0x87, 0x9a, 0xf1, 0x6c, 0x2e, 0x33, 0x33, 0x14, 0x85, 0x18, 0xe9, 0xd6, 0x1b, 0xee, 0x17,
-    0xe9, 0xe7, 0x6b, 0xd4, 0x46, 0xaf, 0x26, 0x55, 0x8d, 0xfc, 0x3a, 0xb4, 0x61, 0x1a, 0x9e, 0x2d, 0x85, 0xa2, 0x86,
-    0x8c, 0x92, 0xbd, 0x8d, 0x0e, 0x4b, 0x4e, 0x0d, 0xdf, 0x4a, 0xc6, 0x66, 0xcd, 0x28, 0xff, 0xc4, 0x44, 0xba, 0x39,
-    0x4a, 0x04, 0x43, 0xce, 0x95, 0x47, 0x99, 0x8c, 0x9b, 0xb7, 0x72, 0x48, 0xdd, 0x9b, 0x98, 0x4f, 0xd5, 0x18, 0x81,
-    0xb4, 0xef, 0xfa, 0x96, 0x54, 0x9b, 0xda, 0x73, 0xe2, 0xe0, 0x27, 0x2f, 0x10, 0x0f, 0xf9, 0x0e, 0x24, 0xb4, 0xd2,
-    0x39, 0xf7, 0x49, 0x8c, 0x5c, 0x05, 0x37, 0xdd, 0xa7, 0x73, 0xac, 0x16, 0x85, 0x71, 0x46, 0xd1, 0x6f, 0x7a, 0x25,
-    0xd2, 0x5c, 0x4e, 0x70, 0x26, 0x93, 0x36, 0x22, 0x5f, 0xe5, 0x42, 0x4e, 0x89, 0xf2, 0x4c, 0x55, 0x9b, 0xd1, 0xa5,
-    0xaf, 0x87, 0xd8, 0x7e, 0xe8, 0xdd, 0xb9, 0x47, 0xb3, 0xda, 0xf7, 0x98, 0x52, 0x73, 0x8b, 0x3c, 0x0b, 0xe7, 0xfa,
-    0x14, 0x7f, 0x9a, 0xa6, 0x8e, 0xf4, 0x7c, 0xad, 0x58, 0x11, 0x73, 0xe3, 0x3a, 0x56, 0x47, 0x9b, 0x95, 0x24, 0x68,
-    0x35, 0xa9, 0xd9, 0x6e, 0x5c, 0x4d, 0xe8, 0xa4, 0xb8, 0x80, 0x0b, 0x73, 0xc4, 0x0f, 0x87, 0x0c, 0xa1, 0xf4, 0x5a,
-    0x3c, 0xce, 0x3f, 0x30, 0x3d, 0xb5, 0xc1, 0x0b, 0x43, 0x2a, 0xb1, 0xbe, 0x6b, 0x12, 0xc4, 0x4b, 0xdb, 0xcb, 0x2f,
-    0x77, 0x8a, 0x3a, 0xba, 0xf4, 0xa3, 0x9b, 0x05, 0xee, 0x98, 0x50, 0x77, 0xfe, 0x82, 0x5b, 0x29, 0x6d, 0x7c, 0x0c,
-    0x4b, 0x41, 0xa2, 0x6a, 0xb2, 0x27, 0x32, 0xf1, 0x0c, 0x1d, 0xd7, 0x6c, 0x02, 0x4d, 0xbd, 0xf2, 0x5a, 0x66, 0xd3,
-    0xb5, 0x30, 0xab, 0x4b, 0x7e, 0x72, 0x77, 0x30, 0x42, 0xd7, 0x70, 0x05, 0x9f, 0xeb, 0x2f, 0x22, 0x7f, 0x49, 0x2d,
-    0x5d, 0xcf, 0x4b, 0x84, 0x0c, 0xa5, 0xb9, 0xe5, 0x49, 0xae, 0x54, 0x2c, 0x86, 0x53, 0x4c, 0x9c, 0x42, 0x29, 0x78,
-    0xf0, 0x0a, 0x8a, 0x36, 0x53, 0x4d, 0x2b, 0xc9, 0xe2, 0x69, 0x0e, 0x9a, 0x37, 0x0c, 0x91, 0x2d, 0xac, 0x2f, 0x43,
-    0x6a, 0xf1, 0xe9, 0xfb, 0xb4, 0x68, 0xec, 0x90, 0x00, 0xff, 0x32, 0xf8, 0x58, 0xab, 0xd1, 0x73, 0x9f, 0x77, 0x72,
-    0x22, 0xed, 0x64, 0xac, 0x7d, 0xd0, 0xa8, 0x1f, 0x01, 0x99, 0x9f, 0xfd, 0xa6, 0xcb, 0x62, 0xca, 0x65, 0xd8, 0xf8,
-    0x31, 0xf0, 0xc1, 0x5e, 0xef, 0xf1, 0x4d, 0x79, 0xa9, 0xfc, 0x8f, 0x57, 0xcb, 0xc1, 0xb7, 0x03, 0x30, 0xbb, 0xad,
-    0xdb, 0x88, 0xf7, 0xcc, 0xa1, 0x25, 0xfd, 0x37, 0x03, 0xc5, 0xdb, 0x7f, 0xb4, 0xe0, 0xe6, 0xa3, 0x7e, 0xa4, 0x52,
-    0x68, 0xa7, 0x2e, 0xe6, 0x1c, 0xea, 0x91, 0x48, 0x67, 0xbd, 0x3d, 0x6d, 0xcc, 0x09, 0x49, 0x17, 0x50, 0x16, 0xb5,
-    0x65, 0x63, 0xd4, 0x84, 0x2c, 0x3a, 0x5f, 0x6a, 0x3c, 0x66, 0xfa, 0x24, 0xaf, 0xd1, 0xfd, 0x18, 0x66, 0xe4, 0xe8,
-    0x3c, 0x6c, 0x74, 0xb6, 0xc5, 0x4c, 0xf8, 0xa8, 0x15, 0x3c, 0xd0, 0xb8, 0x4a, 0x53, 0x15, 0x4b, 0x1e, 0x56, 0x7f,
-    0xd8, 0x40, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0xfe, 0xe7, 0xdc, 0x03, 0xd1, 0x0f, 0xfd, 0x7c, 0xdc, 0xa1, 0x7e, 0x41, 0x2e, 0x50, 0x37, 0x77, 0x94, 0xb7, 0x4b,
-    0x90, 0x3b, 0x14, 0x38, 0xe0, 0x80, 0x03, 0x0e, 0x38, 0xe0, 0x80, 0xfb, 0xff, 0xba, 0xff, 0x00,
-};
-
-static const uint8_t STORED[] = {
-    0x01, 0x2c, 0x01, 0xd3, 0xfe, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64,
-    0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61,
-    0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f,
-    0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65,
-    0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f,
-    0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70,
-    0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65,
-    0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65,
-    0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61,
-    0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66,
-    0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64,
-    0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61,
-    0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f,
-    0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65,
-    0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f,
-    0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70,
-    0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20,
-};
-
-static constexpr size_t WINDOW = 4096;
-static constexpr size_t PLAIN_SIZE = 16000;
-
-static uint8_t lcg_next(uint32_t &x) {
-  x = (x * 1103515245u + 12345u) & 0x7fffffffu;
-  return (x >> 16) & 0xff;
-}
-
-static std::vector<uint8_t> build_plain() {
-  std::vector<uint8_t> plain;
-  const char *text = "esphome ota deflate ";
-  for (int i = 0; i < 300; i++)
-    plain.insert(plain.end(), text, text + strlen(text));
-  uint32_t x = 1;
-  for (int i = 0; i < 3000; i++)
-    plain.push_back(lcg_next(x));
-  plain.insert(plain.end(), 5000, 0);
-  for (int i = 0; i < 100; i++)
-    plain.insert(plain.end(), text, text + strlen(text));
-  return plain;
-}
-
-// Mirrors the OTA session: chunked input through the read callback, window as output
-struct Session : OtaInflateState {
-  const uint8_t *in;
-  size_t in_len;
-  size_t in_pos;
-  size_t chunk;
-  std::vector<uint8_t> out;
-  uint8_t window[WINDOW];
-};
-
-static int read_cb(OtaInflateState *d) {
-  auto *s = static_cast<Session *>(d);
-  if (s->in_pos >= s->in_len)
-    return -1;
-  size_t n = std::min(s->chunk, s->in_len - s->in_pos);
-  d->source = s->in + s->in_pos + 1;
-  d->source_limit = s->in + s->in_pos + n;
-  s->in_pos += n;
-  return s->in[s->in_pos - n];
-}
-
-// Inflates the whole input; returns the decoder result and fills s.out
-static int inflate_all(Session &s, const uint8_t *in, size_t in_len, size_t chunk) {
-  s.in = in;
-  s.in_len = in_len;
-  s.in_pos = 0;
-  s.chunk = chunk;
-  s.out.clear();
-  memset(s.window, 0, sizeof(s.window));
-  ota_inflate_init(&s, s.window, WINDOW);
-  s.source_read_cb = read_cb;
-  int res;
-  do {
-    s.dest = s.window;
-    s.dest_limit = s.window + WINDOW;
-    res = ota_inflate(&s);
-    if (res < 0 || s.eof)
-      return res < 0 ? res : OTA_INFLATE_DATA_ERROR;
-    s.out.insert(s.out.end(), s.window, s.dest);
-    if (s.out.size() > PLAIN_SIZE)
-      return OTA_INFLATE_DATA_ERROR;
-  } while (res != OTA_INFLATE_DONE);
-  return res;
-}
-
-TEST(OtaInflate, RoundTripThroughWindow) {
-  auto s = std::make_unique<Session>();
-  ASSERT_EQ(inflate_all(*s, DEFLATED, sizeof(DEFLATED), 1040), OTA_INFLATE_DONE);
-  EXPECT_EQ(s->out, build_plain());
-  EXPECT_EQ(s->in_pos, sizeof(DEFLATED));
-}
-
-TEST(OtaInflate, SmallReadChunks) {
-  auto s = std::make_unique<Session>();
-  ASSERT_EQ(inflate_all(*s, DEFLATED, sizeof(DEFLATED), 7), OTA_INFLATE_DONE);
-  EXPECT_EQ(s->out, build_plain());
-}
-
-TEST(OtaInflate, StoredBlock) {
-  auto s = std::make_unique<Session>();
-  ASSERT_EQ(inflate_all(*s, STORED, sizeof(STORED), 64), OTA_INFLATE_DONE);
-  auto plain = build_plain();
-  plain.resize(300);
-  EXPECT_EQ(s->out, plain);
-}
-
-TEST(OtaInflate, TruncatedStreamFails) {
-  auto s = std::make_unique<Session>();
-  for (size_t cut : {size_t{1}, size_t{100}, size_t{1000}, sizeof(DEFLATED) - 1}) {
-    EXPECT_LT(inflate_all(*s, DEFLATED, cut, 1040), 0) << "cut at " << cut;
-    EXPECT_LE(s->out.size(), PLAIN_SIZE);
-  }
-}
-
-TEST(OtaInflate, TruncatedStoredBlockFails) {
-  auto s = std::make_unique<Session>();
-  EXPECT_LT(inflate_all(*s, STORED, sizeof(STORED) - 50, 64), 0);
-}
-
-TEST(OtaInflate, CorruptStreamsNeverEscapeTheWindow) {
-  // Flipped bytes and garbage; the sanitizers check the decoder stays in bounds
-  auto s = std::make_unique<Session>();
-  std::vector<uint8_t> bad(DEFLATED, DEFLATED + sizeof(DEFLATED));
-  // A coarse, non-aligned stride: neighbouring offsets hit the same paths
-  for (size_t i = 0; i < bad.size(); i += 29) {
-    bad[i] ^= 0x5a;
-    inflate_all(*s, bad.data(), bad.size(), 1040);
-    bad[i] ^= 0x5a;
-  }
-  uint32_t x = 99;
-  std::vector<uint8_t> garbage(2000);
-  for (int round = 0; round < 50; round++) {
-    for (auto &b : garbage)
-      b = lcg_next(x);
-    inflate_all(*s, garbage.data(), garbage.size(), 1040);
-  }
-}
-
-}  // namespace esphome::testing
@@ -1 +0,0 @@
-<<: !include common.yaml
@@ -14,7 +14,7 @@ struct MinimalBackend {
  OTAResponseTypes write(uint8_t *data, size_t len) { return OTA_RESPONSE_OK; }
  OTAResponseTypes end() { return OTA_RESPONSE_OK; }
  void abort() {}
-  static constexpr bool supports_compression() { return false; }
+  bool supports_compression() { return false; }
 };
 static_assert(OTABackendContract<MinimalBackend>);

@@ -1,9 +0,0 @@
-esphome:
-  name: host-ota-test
-host:
-api:
-ota:
-  - platform: esphome
-    port: __OTA_PORT__
-logger:
-  level: DEBUG
@@ -9,14 +9,12 @@ from __future__ import annotations

 import asyncio
 import base64
-from collections.abc import Callable, Generator
+from collections.abc import Generator
 from contextlib import contextmanager
 from dataclasses import dataclass
 import functools
 from pathlib import Path
 import socket
-from types import SimpleNamespace
-import zlib

 import pytest

@@ -124,7 +122,6 @@ class _Device:
    binary_path: Path
    proc: asyncio.subprocess.Process | None = None
    reboots: int = 0
-    inflates: int = 0

    def __post_init__(self) -> None:
        self._rebooted = asyncio.Event()
@@ -133,8 +130,6 @@ class _Device:
        if "Rebooting safely" in line:
            self.reboots += 1
            self._rebooted.set()
-        if "Inflated " in line and " bytes from " in line:
-            self.inflates += 1

    async def wait_reboot(self, count: int, timeout: float = 10.0) -> None:
        async with asyncio.timeout(timeout):
@@ -209,81 +204,6 @@ async def test_host_ota_self_update(
        await dev.ota(None, None, "second OTA failed -- listener leaked across execv")


-@pytest.mark.asyncio
-async def test_host_ota_deflate(
-    yaml_config: str,
-    write_yaml_config: ConfigWriter,
-    compile_esphome: CompileFunction,
-    reserved_tcp_port: tuple[int, socket.socket],
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """Deflate is negotiated by default, an old client gets an uncompressed
-    upload, and a corrupt stream is rejected without taking the device down."""
-    dev = _Device(
-        *await _build(
-            yaml_config, write_yaml_config, compile_esphome, reserved_tcp_port
-        )
-    )
-    errors: list[str] = []
-
-    def on_log(line: str) -> None:
-        # A corrupt stream is caught by the decoder, by the size check or by
-        # the MD5 at the end, depending on where the damage lands
-        if any(
-            text in line
-            for text in ("Inflate err", "Inflate overrun", "End update err")
-        ):
-            errors.append(line)
-        dev.on_log(line)
-
-    real_compress = zlib.compress
-
-    def corrupt_compress(data: bytes, *args: object, **kwargs: object) -> bytes:
-        out = bytearray(real_compress(data, *args, **kwargs))
-        out[len(out) // 2] ^= 0x55
-        return bytes(out)
-
-    def overlong_compress(data: bytes, *args: object, **kwargs: object) -> bytes:
-        """A stream that inflates past the size the client announced."""
-        return real_compress(data + bytes(8192), *args, **kwargs)
-
-    def patch_compress(func: Callable[..., bytes]) -> None:
-        monkeypatch.setattr(espota2, "zlib", SimpleNamespace(compress=func))
-
-    async with run_binary(dev.binary_path, line_callback=on_log) as (proc, _lines):
-        dev.proc = proc
-        await _wait_for_port(LOCALHOST, dev.api_port, PORT_WAIT_TIMEOUT)
-
-        # Default: the host backend cannot store gzip, so the CLI sends deflate
-        await dev.ota(None, None, "deflate upload failed")
-        assert dev.inflates == 1, "device did not inflate the upload"
-
-        # A client that does not offer deflate is served uncompressed
-        monkeypatch.setattr(espota2, "CLIENT_FEATURE_SUPPORTS_DEFLATE", 0)
-        await dev.ota(None, None, "uncompressed upload failed")
-        assert dev.inflates == 1, "device inflated without a client offer"
-        monkeypatch.undo()
-
-        # A corrupt stream fails the upload and leaves the device running
-        patch_compress(corrupt_compress)
-        await dev.refused_ota(None, None, "corrupt deflate stream was accepted")
-        monkeypatch.undo()
-        assert errors, "device did not report the corrupt stream"
-
-        # So does a stream that inflates past the announced image size
-        errors.clear()
-        patch_compress(overlong_compress)
-        await dev.refused_ota(None, None, "overlong deflate stream was accepted")
-        monkeypatch.undo()
-        assert any("Inflate overrun" in line for line in errors), (
-            "device wrote past the announced size"
-        )
-
-        # and it still takes a good upload afterwards
-        await dev.ota(None, None, "upload after a rejected stream failed")
-        assert dev.inflates == 2
-
-
@pytest.mark.asyncio
 async def test_host_ota_encrypted(
    yaml_config: str,
@@ -35,8 +35,8 @@ def _load_script():
 def test_spec_key_collapses_destinations() -> None:
    """Two specs delivering one package share a directory and one key."""
    mod = _load_script()
-    assert mod.spec_key("esphome/noise-c @ 0.1.26") == "noise-c"
-    assert mod.spec_key("esphome/noise-c@0.1.26") == "noise-c"
+    assert mod.spec_key("esphome/noise-c @ 0.1.24") == "noise-c"
+    assert mod.spec_key("esphome/noise-c@0.1.24") == "noise-c"
    assert mod.spec_key("ESP32Async/AsyncTCP @ ^3.4.10") == mod.spec_key(
        "esp32async/asynctcp @ 3.5.0"
    )
@@ -54,23 +54,23 @@ def test_parse_specs_and_cli_args(tmp_path: Path) -> None:
        "[env:a]\n"
        "platform = fake/platform@1\n"
        "lib_deps =\n"
-        "    esphome/noise-c @ 0.1.26\n"
+        "    esphome/noise-c @ 0.1.24\n"
        "    ${common.lib_deps}\n"
        "    internal_lib\n"
        "[env:b]\n"
        "lib_deps =\n"
-        "    esphome/noise-c @ 0.1.26\n"
+        "    esphome/noise-c @ 0.1.24\n"
    )
    mod = _load_script()
    args = Namespace(libraries=True, platforms=True, tools=False)
    libs, platforms, tools = mod.parse_specs(str(ini), args)
    # exact-string duplicates collapse; distinct version pins survive
-    assert libs == ["esphome/noise-c @ 0.1.26"]
+    assert libs == ["esphome/noise-c @ 0.1.24"]
    assert platforms == ["fake/platform@1"]
    assert tools == []
    assert mod.build_cli_args(libs, platforms, tools) == [
        "-l",
-        "esphome/noise-c @ 0.1.26",
+        "esphome/noise-c @ 0.1.24",
        "-p",
        "fake/platform@1",
    ]
@@ -162,13 +162,13 @@ def test_parallel_install_behavior(tmp_path: Path) -> None:
    mod.parallel_install(
        cls,
        [
-            "esphome/noise-c @ 0.1.26",
-            "esphome/noise-c @ 0.1.26",
+            "esphome/noise-c @ 0.1.24",
+            "esphome/noise-c @ 0.1.24",
            "esphome/already @ 1.0",
            "https://x/framework.tar.xz",
        ],
    )
-    assert cls.calls == ["esphome/noise-c @ 0.1.26"]
+    assert cls.calls == ["esphome/noise-c @ 0.1.24"]
    assert cls.lock_events == ["lock", "unlock"]


@@ -205,7 +205,7 @@ def test_parallel_install_runs_dependency_waves(tmp_path: Path) -> None:
    mod = _load_script()
    cls = _reset_fake(str(tmp_path))
    cls.deps = {
-        "esphome/noise-c @ 0.1.26": [
+        "esphome/noise-c @ 0.1.24": [
            {"owner": "esphome", "name": "libsodium", "version": "^1.0"},
            {"name": "SPI"},
        ],
@@ -213,12 +213,12 @@ def test_parallel_install_runs_dependency_waves(tmp_path: Path) -> None:
            {"owner": "esphome", "name": "libsodium", "version": "^1.0"},
        ],
    }
-    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.26", "esphome/wg @ 1.0"])
+    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.24", "esphome/wg @ 1.0"])
    assert len(cls.calls) == 3  # the shared dep installs exactly once
    assert {mod.spec_key(c) for c in cls.calls} == {"noise-c", "wg", "libsodium"}
    # Wave-1 strings carry no compatibility; the dependency wave does
    compats = dict(cls.compat_calls)
-    assert compats["esphome/noise-c @ 0.1.26"] is None
+    assert compats["esphome/noise-c @ 0.1.24"] is None
    dep_compat = next(v for k, v in cls.compat_calls if "libsodium" in k)
    assert dep_compat is not None  # mirrors pio's install_dependency

@@ -229,11 +229,11 @@ def test_dependency_wave_excludes_url_specs(tmp_path: Path) -> None:
    mod = _load_script()
    cls = _reset_fake(str(tmp_path))
    cls.deps = {
-        "esphome/noise-c @ 0.1.26": [
+        "esphome/noise-c @ 0.1.24": [
            {"name": "vendored", "version": "https://github.com/x/y.git"},
        ],
    }
-    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.26"])
+    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.24"])
    assert {mod.spec_key(c) for c in cls.calls} == {"noise-c"}


@@ -348,13 +348,13 @@ def test_warm_store_still_walks_dependencies(tmp_path: Path) -> None:
    """Already-installed top-level packages still feed the dependency
    wave; a warm store can be missing a transitive dep."""
    mod = _load_script()
-    cls = _reset_fake(str(tmp_path), installed={"esphome/noise-c @ 0.1.26"})
+    cls = _reset_fake(str(tmp_path), installed={"esphome/noise-c @ 0.1.24"})
    cls.deps = {
-        "esphome/noise-c @ 0.1.26": [
+        "esphome/noise-c @ 0.1.24": [
            {"owner": "esphome", "name": "libsodium", "version": "^1.0"},
        ],
    }
-    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.26"])
+    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.24"])
    assert [mod.spec_key(c) for c in cls.calls] == ["libsodium"]


@@ -12,7 +12,6 @@ from pathlib import Path
 import socket
 import struct
 from unittest.mock import Mock, call, patch
-import zlib

 import pytest
 from pytest import CaptureFixture
@@ -355,7 +354,6 @@ def test_perform_ota_successful_md5_auth(
                espota2.CLIENT_FEATURE_SUPPORTS_COMPRESSION
                | espota2.CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
                | espota2.CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
-                | espota2.CLIENT_FEATURE_SUPPORTS_DEFLATE
            ]
        )
    )
@@ -418,9 +416,6 @@ def test_perform_ota_no_auth(
        "Update took 14.00 seconds (prepare 2.00, upload 5.00, commit 7.00)"
        in caplog.text
    )
-    # The data phase timeout must outlast the device's 105 s data timeout
-    mock_socket.settimeout.assert_any_call(espota2.DATA_PHASE_TIMEOUT)
-    assert espota2.DATA_PHASE_TIMEOUT > 105.0


@pytest.mark.usefixtures("mock_time")
@@ -603,16 +598,12 @@ def test_perform_ota_upload_error(mock_socket: Mock, mock_file: io.BytesIO) -> N
        espota2.perform_ota(mock_socket, None, mock_file, "test.bin")


-def _no_auth_handshake(version: int, server_features: int | None = None) -> list[bytes]:
+def _no_auth_handshake(version: int) -> list[bytes]:
    """Recv responses for a handshake without auth, up to the MD5 check."""
-    if server_features is None:
-        features = [bytes([espota2.RESPONSE_HEADER_OK])]
-    else:
-        features = [bytes([espota2.RESPONSE_FEATURE_FLAGS]), bytes([server_features])]
    return [
        bytes([espota2.RESPONSE_OK]),  # First byte of version response
        bytes([version]),  # Version number
-        *features,
+        bytes([espota2.RESPONSE_HEADER_OK]),  # Features response
        bytes([espota2.RESPONSE_AUTH_OK]),  # No auth required
        bytes([espota2.RESPONSE_UPDATE_PREPARE_OK]),  # Binary size OK
        bytes([espota2.RESPONSE_BIN_MD5_OK]),  # MD5 checksum OK
@@ -1060,7 +1051,6 @@ def test_perform_ota_successful_sha256_auth(
                espota2.CLIENT_FEATURE_SUPPORTS_COMPRESSION
                | espota2.CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
                | espota2.CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
-                | espota2.CLIENT_FEATURE_SUPPORTS_DEFLATE
            ]
        )
    )
@@ -1117,7 +1107,6 @@ def test_perform_ota_sha256_fallback_to_md5(
                espota2.CLIENT_FEATURE_SUPPORTS_COMPRESSION
                | espota2.CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
                | espota2.CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
-                | espota2.CLIENT_FEATURE_SUPPORTS_DEFLATE
            ]
        )
    )
@@ -1227,7 +1216,6 @@ def test_perform_ota_extended_protocol_app(
                espota2.CLIENT_FEATURE_SUPPORTS_COMPRESSION
                | espota2.CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
                | espota2.CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
-                | espota2.CLIENT_FEATURE_SUPPORTS_DEFLATE
            ]
        )
    )
@@ -1288,7 +1276,6 @@ def test_perform_ota_successful_partition_table(
                espota2.CLIENT_FEATURE_SUPPORTS_COMPRESSION
                | espota2.CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
                | espota2.CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
-                | espota2.CLIENT_FEATURE_SUPPORTS_DEFLATE
            ]
        )
    )
@@ -1517,40 +1504,3 @@ def test_check_error_passes_non_error_when_expect_is_none() -> None:
    espota2.check_error([espota2.RESPONSE_OK], None)
    espota2.check_error([espota2.RESPONSE_HEADER_OK], None)
    espota2.check_error([espota2.RESPONSE_FEATURE_FLAGS], None)
-
-
-# Device replies after the MD5 check for a one-chunk upload
-_UPLOAD_TAIL = [
-    bytes([espota2.RESPONSE_CHUNK_OK]),
-    bytes([espota2.RESPONSE_RECEIVE_OK]),
-    bytes([espota2.RESPONSE_UPDATE_END_OK]),
-]
-
-
-@pytest.mark.usefixtures("mock_time")
-@pytest.mark.parametrize(
-    "server_features",
-    [
-        espota2.SERVER_FEATURE_SUPPORTS_DEFLATE,
-        # Binding offer: deflate wins over gzip
-        espota2.SERVER_FEATURE_SUPPORTS_DEFLATE
-        | espota2.SERVER_FEATURE_SUPPORTS_COMPRESSION,
-    ],
-)
-def test_perform_ota_with_deflate(mock_socket: Mock, server_features: int) -> None:
-    """The device gets a raw deflate stream, both sizes and the image MD5."""
-    original_content = b"firmware" * 100
-    mock_socket.recv.side_effect = (
-        _no_auth_handshake(espota2.OTA_VERSION_2_0, server_features) + _UPLOAD_TAIL
-    )
-
-    espota2.perform_ota(mock_socket, None, io.BytesIO(original_content), "test.bin")
-
-    sent = [c[0][0] for c in mock_socket.sendall.call_args_list]
-    # magic, features, ota type, size, image size, md5, data, end ack
-    sent_size = struct.unpack(">I", sent[3])[0]
-    assert sent[4] == len(original_content).to_bytes(espota2.SIZE_FIELD_BYTES, "big")
-    payload = sent[6]
-    assert len(payload) == sent_size < len(original_content)
-    assert zlib.decompress(payload, -espota2.DEFLATE_WINDOW_BITS) == original_content
-    assert sent[5] == hashlib.md5(original_content).hexdigest().encode()
@@ -1663,7 +1663,7 @@ def test_preinstall_runs_dependency_waves(tmp_path: Path) -> None:
        {"name": "SPI"},
    ]
    m.dependency_to_spec.side_effect = lambda dep: _FakeSpec(name=dep["name"])
-    pf._preinstall(m, [("noise-c@0.1.26", _FakeSpec(name="noise-c"))])
+    pf._preinstall(m, [("noise-c@0.1.24", _FakeSpec(name="noise-c"))])
    assert installed == ["noise-c", "libsodium"]  # dep deduped, SPI left out
    # The dep wave carries its compatibility so _install searches qualified
    dep_call = m._install.call_args_list[-1]
@@ -1683,7 +1683,7 @@ def test_preinstall_dependency_wave_skips_seen_names(tmp_path: Path) -> None:
    m._install.side_effect = lambda spec, skip_dependencies, compatibility=None: (
        installed.append(getattr(spec, "name", str(spec)))
    )
-    pf._preinstall(m, [("noise-c@0.1.26", _FakeSpec(name="noise-c"))])
+    pf._preinstall(m, [("noise-c@0.1.24", _FakeSpec(name="noise-c"))])
    assert installed == ["noise-c"]
Author	SHA1	Message	Date
J. Nick Koston	534ec5df15	Merge remote-tracking branch 'origin/dev' into socket-lwip-raw-udp	2026-09-08 18:18:48 +02:00
J. Nick Koston	fd9760d8e3	[socket] Apply SO_REUSEADDR to the pcb and unmap IPv4-mapped IPv6 destinations	2026-08-28 11:23:43 -05:00
J. Nick Koston	a4d2a4ad4b	[socket] Zero lwip address struct and narrow dual-stack bind promotion	2026-08-28 10:31:20 -05:00
J. Nick Koston	7cbc81ad66	[socket] Simplify UDP implementation and deduplicate lwip helpers	2026-08-28 10:26:05 -05:00
J. Nick Koston	c71a599f5a	[socket] Address review feedback on UDP implementation	2026-08-28 10:08:58 -05:00
J. Nick Koston	e6f9d9c369	Merge remote-tracking branch 'origin/dev' into socket-lwip-raw-udp # Conflicts: # esphome/components/socket/__init__.py	2026-08-28 09:33:29 -05:00
J. Nick Koston	6d2e1f8658	Merge branch 'dev' into socket-lwip-raw-udp	2026-05-13 01:36:28 -05:00
J. Nick Koston	e855ddb1f1	Merge branch 'dev' into socket-lwip-raw-udp	2026-04-22 08:22:37 +02:00
J. Nick Koston	e191f5fb4b	Merge branch 'dev' into socket-lwip-raw-udp	2026-04-21 15:08:29 +02:00
J. Nick Koston	e7c126d3dc	[socket] Rename UDP socket types so UDPSocket is the full send+recv type Swap the UDP type naming so the unsuffixed UDPSocket is the full send+recv socket and the send-only variant becomes UDPSendSocket. The previous naming inverted reader expectations (UDPSocket sounded complete but was send-only, UDPRecvSocket sounded limited but was the full one). Public: UDPSocket (was UDPRecvSocket) UDPSendSocket (was UDPSocket) socket_udp (was socket_udp_recv) socket_ip_udp (was socket_ip_udp_recv) socket_udp_loop_monitored (was socket_udp_recv_loop_monitored) socket_ip_udp_loop_monitored (was socket_ip_udp_recv_loop_monitored) socket_udp_send (was socket_udp) socket_ip_udp_send (was socket_ip_udp) Internal: LWIPRawUDPImpl (was LWIPRawUDPRecvImpl) LWIPRawUDPSendImpl (was LWIPRawUDPImpl) No consumers exist yet, so this is a clean rename with no migration.	2026-04-10 18:40:14 -10:00
J. Nick Koston	af7b3821b8	Merge branch 'dev' into socket-lwip-raw-udp	2026-04-10 18:31:45 -10:00
J. Nick Koston	d6c48e2d64	[socket] Validate source address before copying data in recvfrom Move pbuf_copy_partial after ip2sockaddr_ validation so the caller buffer is not modified when the address conversion fails.	2026-04-09 09:21:48 -10:00
J. Nick Koston	c01699f2a4	[socket] Move socket_loop_monitored declaration before UDP factories Fix forward declaration ordering: socket_udp_recv_loop_monitored calls socket_loop_monitored, so the latter must be declared first.	2026-04-09 09:20:36 -10:00
J. Nick Koston	abc4069657	[socket] Restore LWIP thread safety documentation to common header	2026-04-09 09:09:38 -10:00
J. Nick Koston	c3827423ba	[socket] Move thin UDP and listen factory wrappers inline into socket.h All the _ip_ variants and non-LWIP_TCP delegators are one-liners that just forward to other factory functions. Move them inline to reduce socket.cpp and keep the dispatch logic visible in one place.	2026-04-09 09:09:17 -10:00
J. Nick Koston	41a8e7f61b	[socket] Split lwip raw impl into tcp, udp, and common files Extract UDP classes and shared helpers from lwip_raw_tcp_impl into separate files for better organization: - lwip_raw_common_impl.{h,cpp}: shared helpers (lwip_ip_to_sockaddr, sockaddr_to_lwip, lwip_bind_err) - lwip_raw_udp_impl.{h,cpp}: LWIPRawUDPImpl, LWIPRawUDPRecvImpl, and UDP factory functions - lwip_raw_tcp_impl.{h,cpp}: TCP-only code (LWIPRawCommon, LWIPRawImpl, LWIPRawListenImpl, TCP factories) Update __init__.py FILTER_SOURCE_FILES to exclude all three lwip raw files when not using the lwip_tcp implementation.	2026-04-09 09:06:04 -10:00
J. Nick Koston	0a3f8c6d67	[socket] Add unified UDP recv loop-monitored factory functions Add socket_udp_recv_loop_monitored() and socket_ip_udp_recv_loop_monitored() so consumers can create UDP recv sockets with loop wake support using a single API across all platforms, without #ifdef guards.	2026-04-09 08:56:11 -10:00
J. Nick Koston	2375faee88	fixes, update	2026-04-09 08:54:08 -10:00
J. Nick Koston	3da3a66d09	Merge branch 'dev' into socket-lwip-raw-udp	2026-04-09 07:55:07 -10:00
J. Nick Koston	cf22559af0	Merge branch 'dev' into socket-lwip-raw-udp	2026-04-02 09:56:54 -10:00
J. Nick Koston	17c2557cca	Merge branch 'dev' into socket-lwip-raw-udp	2026-04-01 18:47:13 -10:00
J. Nick Koston	012dadbf77	Merge branch 'dev' into socket-lwip-raw-udp	2026-03-22 21:27:55 -10:00
J. Nick Koston	97e4bb71c3	Merge branch 'dev' into socket-lwip-raw-udp	2026-03-18 19:31:21 -10:00
J. Nick Koston	b333bb76e4	Merge branch 'dev' into socket-lwip-raw-udp	2026-03-16 16:36:46 -10:00
J. Nick Koston	273637b6d7	tweak	2026-03-16 16:35:32 -10:00
J. Nick Koston	75efdd8662	tweaks	2026-03-16 11:01:21 -10:00
J. Nick Koston	86e4341a52	tweaks	2026-03-16 11:00:57 -10:00
J. Nick Koston	402398b389	tweaks	2026-03-16 10:55:33 -10:00
J. Nick Koston	dde81d3f63	tweaks	2026-03-16 10:51:54 -10:00
J. Nick Koston	eef806c806	Merge branch 'dev' into socket-lwip-raw-udp	2026-03-16 10:44:13 -10:00
J. Nick Koston	cdbbcfb87d	[socket] Extract lwip_bind_err() to deduplicate bind error handling TCP bind and UDP bind_internal_ had identical ERR_USE/ERR_VAL/ERR_OK to errno mapping. Extract into a shared helper.	2026-03-14 16:12:39 -10:00
J. Nick Koston	71da3dc2de	[socket] Fix RP2040 socket_delay race: don't clear wake flag before sleep Restore the comment explaining why s_socket_woke must not be cleared between the early-return check and the __wfe() loop, and restore the s_socket_woke = false after the loop to consume the wake for the next call. Both were lost during conflict resolution.	2026-03-14 16:09:24 -10:00
J. Nick Koston	0176305d24	[socket] Restore read_locked_, SO_RCVTIMEO, and wait_for_data_ lost in merge These features from upstream/dev were dropped when resolving conflicts with the PR's remote branch: read_locked_/wait_for_data_ (blocking read with SO_RCVTIMEO timeout support), recv_timeout_cs_ field, SO_RCVTIMEO and SO_SNDTIMEO setsockopt/getsockopt handling, and the setblocking() implementation that accepts blocking mode for SO_RCVTIMEO.	2026-03-14 16:07:15 -10:00
J. Nick Koston	c81e9fd154	[socket] Deduplicate sockaddr parsing between TCP and UDP bind Extract sockaddr_to_lwip() from LWIPRawUDPImpl static method to a shared file-level function. Refactor LWIPRawCommon::bind() to use it instead of inline address parsing, removing ~35 lines of duplicated sockaddr-to-ip_addr_t conversion code.	2026-03-14 16:03:24 -10:00
J. Nick Koston	556ef1894f	Merge branch 'socket-lwip-raw-udp' of https://github.com/esphome/esphome into socket-lwip-raw-udp # Conflicts: # esphome/components/socket/lwip_raw_tcp_impl.cpp # esphome/components/socket/lwip_raw_tcp_impl.h	2026-03-14 16:00:31 -10:00
J. Nick KostonandClaude Opus 4.6	519be06e73	[socket] Add LWIP_LOCK to UDP socket methods for RP2040 safety On RP2040, lwip callbacks run from a low-priority IRQ context and can preempt main-loop code. All lwip API calls from the main loop must hold the async_context lock (LWIP_LOCK) to prevent races on shared lwip state (PCB lists, pbuf pools, IGMP groups). The TCP implementation was already correct; the UDP methods were missing the lock. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-14 15:57:57 -10:00
J. Nick Koston	1e935c128a	Merge remote-tracking branch 'upstream/dev' into socket-lwip-raw-udp # Conflicts: # esphome/components/socket/lwip_raw_tcp_impl.cpp	2026-03-14 15:53:39 -10:00
J. Nick Koston	a0e162912c	safety	2026-03-11 00:00:52 -10:00
J. Nick Koston	1131af1690	safety	2026-03-10 23:59:25 -10:00
J. Nick Koston	6fb00baa29	Merge remote-tracking branch 'upstream/dev' into socket-lwip-raw-udp	2026-03-10 23:57:51 -10:00
J. Nick Koston	fccfab8083	[socket] Switch UDP rx queue from lock-free SPSC to count-based with LWIP_LOCK With the lwip lock infrastructure in place from the TCP race fix, the lock-free SPSC ring buffer's wasted slot is no longer needed. Switch to a simple rx_count_ approach that uses all 4 queue slots. Also add LWIP_LOCK() to all UDP methods that call lwip APIs (bind, close, sendto, setsockopt, getsockopt, recvfrom, factories).	2026-03-10 01:15:57 -10:00
J. Nick KostonandJ. Nick Koston	f54756ae2d	[socket] Address review comments: doc comments and (void) flags - Document port_host byte order convention in lwip_ip_to_sockaddr - Note intentional method hiding in LWIPRawUDPRecvImpl - Note recvfrom truncation differs from POSIX MSG_TRUNC - Add (void) flags in sendto to clarify flags are ignored Co-Authored-By: J. Nick Koston <nick@koston.org>	2026-03-10 01:12:15 -10:00
J. Nick Koston	49ba08cec9	[socket] Add lwip raw UDP socket implementation Add native UDP support to the lwip raw TCP socket layer used by ESP8266 and RP2040, eliminating the need for Arduino WiFiUDP fallback. Two new classes: - LWIPRawUDPImpl: send-only UDP (8 bytes overhead) - LWIPRawUDPRecvImpl: send+recv with fixed-size ring buffer (no heap allocation in recv callback) Factory functions: socket_udp(), socket_udp_recv(), socket_ip_udp(), socket_ip_udp_recv() with UDPSocket/UDPRecvSocket type aliases. Additive only — no consumer migration in this PR.	2026-03-10 01:12:15 -10:00
J. Nick Koston	81d12fd14a	[socket] Hold lwip lock for entire write() operation Same pattern as writev — write() calls internal_write_() then internal_output_(), each acquiring the lock separately. Hold the lock at the outer scope so inner calls just bump the recursion counter.	2026-03-10 00:57:36 -10:00
J. Nick Koston	cc05bf3ed2	[socket] Add LWIP_LOCK to socket factory functions tcp_new() is an lwip core API call that must be bracketed with the lwip lock on RP2040 per pico-sdk docs. Add LWIP_LOCK() to socket() and socket_listen() factory functions.	2026-03-10 00:55:34 -10:00
J. Nick Koston	c182c0c74f	[socket] Hold lwip lock for entire readv/writev scatter-gather operation Avoid repeated lock acquire/release cycles per iovec element. The recursive mutex re-entry in inner calls is nearly free (counter bump), while the outer lock prevents the expensive IRQ disable/enable on each iteration.	2026-03-10 00:53:01 -10:00
J. Nick Koston	a88e9b8146	[socket] Fix RP2040 TCP race condition between lwip callbacks and main loop On RP2040 (Pico W), arduino-pico sets PICO_CYW43_ARCH_THREADSAFE_BACKGROUND=1, which means lwip callbacks (recv_fn, accept_fn, err_fn) run from a PendSV interrupt — not the main loop. This allows them to preempt read(), write(), close(), and accept() at any point, causing race conditions on shared state like the rx_buf_ pbuf chain. The most critical race: recv_fn calls pbuf_cat(rx_buf_, pb) while read() is freeing nodes in the same chain, leading to use-after-free and lwip's "Creating an infinite loop" assertion panic. This is the root cause of #10681. Fix: implement RP2040's LwIPLock (previously a no-op) to call cyw43_arch_lwip_begin/end, which acquires the pico-sdk async_context recursive mutex. Add LWIP_LOCK() guards to all main-loop lwip API call sites in the socket layer. On ESP8266, lwip callbacks run cooperatively from the main loop, so LwIPLock remains a no-op. Closes #10681	2026-03-10 00:34:20 -10:00
J. Nick KostonandJ. Nick Koston	7dea3756e9	[socket] Address review comments: doc comments and (void) flags - Document port_host byte order convention in lwip_ip_to_sockaddr - Note intentional method hiding in LWIPRawUDPRecvImpl - Note recvfrom truncation differs from POSIX MSG_TRUNC - Add (void) flags in sendto to clarify flags are ignored Co-Authored-By: J. Nick Koston <nick@koston.org>	2026-03-09 23:56:37 -10:00
J. Nick Koston	fa0bff3374	[socket] Add lwip raw UDP socket implementation Add native UDP support to the lwip raw TCP socket layer used by ESP8266 and RP2040, eliminating the need for Arduino WiFiUDP fallback. Two new classes: - LWIPRawUDPImpl: send-only UDP (8 bytes overhead) - LWIPRawUDPRecvImpl: send+recv with fixed-size ring buffer (no heap allocation in recv callback) Factory functions: socket_udp(), socket_udp_recv(), socket_ip_udp(), socket_ip_udp_recv() with UDPSocket/UDPRecvSocket type aliases. Additive only — no consumer migration in this PR.	2026-03-09 23:48:07 -10:00