Merge remote-tracking branch 'upstream/dev' into neutral-ble-client

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.claude/settings.json

@@ -0,0 +1,16 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "d=\"${CLAUDE_PROJECT_DIR:-.}\"; [ -x \"$d/venv/bin/python\" ] || { mkdir -p \"$d/.temp\"; env -u VIRTUAL_ENV \"$d/script/setup\" >\"$d/.temp/setup.log\" 2>&1 || echo '{\"systemMessage\":\"script/setup failed; see .temp/setup.log\"}'; }",
+            "statusMessage": "Setting up dev environment (script/setup)...",
+            "timeout": 900
+          }
+        ]
+      }
+    ]
+  }
+}

.github/actions/cache-arduino8266/action.yml

@@ -1,39 +0,0 @@
-name: Cache Arduino ESP8266
-description: >
-  Resolve the pinned Arduino core and xtensa toolchain versions and cache the
-  native ESP8266 install (~110 MB framework + toolchain; no ccache store, the
-  seed job saves before any compile runs). Exports
-  ESPHOME_ARDUINO8266_PREFIX to the job so every later step installs into
-  the cached path; the Python venv must already be restored. Mirrors
-  cache-esp-idf: only dev-branch pushes write the shared cache, everything
-  else restores.
-runs:
-  using: composite
-  steps:
-    - name: Resolve the native toolchain cache key
-      # Versions are pinned in code, not a hashable file; resolve them so a
-      # bump changes the cache key. Assignment form so errexit catches a
-      # resolver failure.
-      id: version
-      shell: bash
-      run: |
-        # One owner for the install prefix: exported here and referenced by
-        # the cache steps below via env, so the caller's install and the
-        # cached path cannot diverge.
-        echo "ESPHOME_ARDUINO8266_PREFIX=$HOME/.esphome-arduino8266" >> "$GITHUB_ENV"
-        . venv/bin/activate
-        key=$(python -c 'from esphome.components.esp8266 import RECOMMENDED_ARDUINO_FRAMEWORK_VERSION as f; from esphome.arduino8266.framework import TOOLCHAIN_VERSION as t; print(f"{f}-{t}")')
-        [ -n "$key" ] || exit 1
-        echo "key=$key" >> "$GITHUB_OUTPUT"
-    - name: Cache the native toolchain (write on dev)
-      if: github.ref == 'refs/heads/dev'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ env.ESPHOME_ARDUINO8266_PREFIX }}
-        key: ${{ runner.os }}-esp8266-native-${{ steps.version.outputs.key }}
-    - name: Restore the native toolchain (off dev)
-      if: github.ref != 'refs/heads/dev'
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ env.ESPHOME_ARDUINO8266_PREFIX }}
-        key: ${{ runner.os }}-esp8266-native-${{ steps.version.outputs.key }}

.github/actions/cache-clang-tidy-idedata/action.yml

@@ -0,0 +1,50 @@
+name: Cache clang-tidy idedata
+description: >
+  Cache the clang-tidy idedata and the headers it references under .temp
+  (headers only, about 30MB per env). Run after restore-python and cache-esp-idf.
+inputs:
+  environment:
+    description: 'clang-tidy environment (e.g. esp32-idf-tidy).'
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Compute cache key
+      id: key
+      shell: bash
+      run: |
+        . venv/bin/activate
+        [ -n "${{ inputs.environment }}" ] || { echo "::error::cache-clang-tidy-idedata: 'environment' input is empty"; exit 1; }
+        hash=$(python -c 'import sys; sys.path.insert(0, "script"); from clang_tidy_hash import idedata_cache_hash; print(idedata_cache_hash("${{ inputs.environment }}"))')
+        pyver=$(python -c 'import platform; print(platform.python_version())')
+        # Generating idedata is what installs ESP-IDF; never skip it over a missing
+        # install. This also skips the save, so a dev run that installs ESP-IDF
+        # warms the idedata cache on the next run.
+        if [ -d ~/.esphome-idf/frameworks ]; then
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+        else
+          echo "ESP-IDF install missing, not using the clang-tidy idedata cache"
+          echo "skip=true" >> "$GITHUB_OUTPUT"
+        fi
+        echo "key=${{ runner.os }}-tidy-idedata-${{ inputs.environment }}-$hash-py$pyver" >> "$GITHUB_OUTPUT"
+        {
+          echo "path<<EOF"
+          printf '%s\n' '.temp/idedata-*.json' '.temp/idedata-*.hash'
+          printf '.temp/**/*.%s\n' h hpp hh hxx inc inl ipp tpp
+          echo "EOF"
+        } >> "$GITHUB_OUTPUT"
+    # Mirror cache-esp-idf: write on dev, restore-only on PRs. The post-step
+    # save only runs when the job succeeded, so a failed generation is never saved.
+    # Extend the extension list if a component ships extensionless headers.
+    - name: Cache clang-tidy idedata (write on dev)
+      if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write')) && steps.key.outputs.skip != 'true'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.key.outputs.path }}
+        key: ${{ steps.key.outputs.key }}
+    - name: Cache clang-tidy idedata (restore-only off dev)
+      if: github.ref != 'refs/heads/dev' && !contains(github.event.pull_request.labels.*.name, 'ci-cache-write') && steps.key.outputs.skip != 'true'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.key.outputs.path }}
+        key: ${{ steps.key.outputs.key }}

.github/actions/cache-esp-idf/action.yml

@@ -26,6 +26,9 @@ runs:
       # The native-IDF version is pinned in code, not in any file that feeds the
       # other cache keys, so resolve it explicitly. Keying on it means the cache
       # invalidates on a version bump (actions/cache never overwrites a key).
+      # Also key on the Python version: the cached IDF venv links to the
+      # runner's toolcache interpreter and is reinstalled every run after a
+      # runner image bump.
       id: version
       shell: bash
       run: |
@@ -36,19 +39,32 @@ runs:
           version=$(python -c 'from esphome.components.esp32 import ESP_IDF_FRAMEWORK_VERSION_LOOKUP as L; print(L["recommended"])')
         fi
         echo "version=$version" >> "$GITHUB_OUTPUT"
+        echo "python-version=$(python -c 'import platform; print(platform.python_version())')" >> "$GITHUB_OUTPUT"
     # Mirror the adjacent PlatformIO cache: only dev-branch runs write the
     # shared cache (so it lives in the default-branch scope readable by all
     # PRs), and PRs are restore-only -- they never push multi-GB artifacts into
-    # their own scope / the repo quota (e.g. on a version-bump PR).
+    # their own scope / the repo quota (e.g. on a version-bump PR). The
+    # ci-cache-write label lets a PR write into its own scope to test the hit path;
+    # that costs about 1GB of the repo cache quota per run, so remove it when done.
+    # -slim: bump when prune-esp-idf changes what it removes; a key is never overwritten.
     - name: Cache ESP-IDF install (write on dev)
-      if: github.ref == 'refs/heads/dev' && inputs.restore-only != 'true'
+      if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write')) && inputs.restore-only != 'true'
       uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/.esphome-idf
-        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}
+        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}-py${{ steps.version.outputs.python-version }}-slim
     - name: Cache ESP-IDF install (restore-only off dev)
-      if: github.ref != 'refs/heads/dev' || inputs.restore-only == 'true'
+      if: github.ref != 'refs/heads/dev' && !contains(github.event.pull_request.labels.*.name, 'ci-cache-write') || inputs.restore-only == 'true'
       uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/.esphome-idf
-        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}
+        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}-py${{ steps.version.outputs.python-version }}-slim
+    # Install explicitly so the prune below sees the toolchains on a cache miss
+    # too, instead of the install happening inside the first build step.
+    - name: Install ESP-IDF
+      shell: bash
+      run: |
+        . venv/bin/activate
+        python -c 'from esphome.espidf.framework import check_esp_idf_install; check_esp_idf_install("${{ steps.version.outputs.version }}")'
+    - name: Prune ESP-IDF install
+      uses: ./.github/actions/prune-esp-idf

.github/actions/prune-esp-idf/action.yml

@@ -0,0 +1,34 @@
+name: Prune ESP-IDF install
+description: >
+  Remove the picolibc sysroots (1.1GB of the 3.9GB install) from the native
+  ESP-IDF toolchains; IDF 5.x links newlib. Skipped when an IDF 6 install is
+  present, which links picolibc (see esp32/__init__.py).
+runs:
+  using: composite
+  steps:
+    - name: Prune picolibc
+      shell: bash
+      run: |
+        shopt -s nullglob
+        prefix="${ESPHOME_ESP_IDF_PREFIX:-$HOME/.esphome-idf}"
+        prefix="${prefix/#\~/$HOME}"
+        for fw in "$prefix"/frameworks/*/; do
+          case "$(basename "$fw")" in
+            [6-9].*) echo "IDF $(basename "$fw") installed, keeping picolibc"; exit 0 ;;
+          esac
+        done
+        n=0
+        for dir in "$prefix"/tools/*-esp-elf/*/*-esp-elf/picolibc; do
+          echo "Removing $dir ($(du -sh "$dir" | cut -f1))"
+          rm -rf "$dir"
+          n=$((n + 1))
+        done
+        # The marker rides along in the cache entry so a restored slim tree stays quiet.
+        if [ "$n" -gt 0 ]; then
+          touch "$prefix/.picolibc-pruned"
+        elif [ -d "$prefix/tools" ] && [ ! -f "$prefix/.picolibc-pruned" ]; then
+          echo "::warning::no picolibc sysroots matched under $prefix/tools"
+        fi
+        if [ -d "$prefix" ]; then
+          du -sh "$prefix"
+        fi

.github/workflows/ci-docker.yml

@@ -21,7 +21,6 @@ on:
       - "esphome/core/**"
       - "esphome/writer.py"
       - "esphome/build_gen/**"
-      - "esphome/build_helpers/**"
       - "esphome/espidf/**"
       - "esphome/platformio/**"
       - "esphome/components/bk72xx/**"
@@ -198,7 +197,6 @@ jobs:
         # the default.
         id:
           - esp8266-arduino
-          - esp8266-arduino-native
           - esp32-arduino-platformio
           - esp32-arduino-esp-idf
           - esp32-idf-platformio
@@ -209,16 +207,6 @@ jobs:
           - ln882x-arduino
           - nrf52
           - host
-        # Strict by default so a new matrix id cannot silently join in the
-        # degrade-quietly mode the knob exists to catch.
-        # Opt-outs: libretiny GCC rejects its own pch until a toolchain bump.
-        include:
-          - id: bk72xx-arduino
-            pch_strict: "0"
-          - id: rtl87xx-arduino
-            pch_strict: "0"
-          - id: ln882x-arduino
-            pch_strict: "0"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download image artifact
@@ -230,7 +218,6 @@ jobs:
       - name: Compile ${{ matrix.id }}
         run: |
           docker run --rm \
-            -e ESPHOME_PCH_STRICT="${{ matrix.pch_strict || '1' }}" \
             -v "${{ github.workspace }}/docker/test_configs:/config" \
             "ghcr.io/esphome/esphome-amd64:${{ needs.check-docker.outputs.tag }}" \
             compile "${{ matrix.id }}.yaml"

.github/workflows/ci.yml

@@ -92,6 +92,7 @@ jobs:
     outputs:
       core-ci: ${{ steps.determine.outputs.core-ci }}
       integration-tests: ${{ steps.determine.outputs.integration-tests }}
+      integration-run-all: ${{ steps.determine.outputs.integration-run-all }}
       integration-test-buckets: ${{ steps.determine.outputs.integration-test-buckets }}
       clang-tidy: ${{ steps.determine.outputs.clang-tidy }}
       clang-tidy-mode: ${{ steps.determine.outputs.clang-tidy-mode }}
@@ -101,8 +102,6 @@ jobs:
       device-builder: ${{ steps.determine.outputs.device-builder }}
       esp32-platformio: ${{ steps.determine.outputs.esp32-platformio }}
       esp32-platformio-components: ${{ steps.determine.outputs.esp32-platformio-components }}
-      esp8266-native: ${{ steps.determine.outputs.esp8266-native }}
-      esp8266-native-components: ${{ steps.determine.outputs.esp8266-native-components }}
       changed-components: ${{ steps.determine.outputs.changed-components }}
       changed-components-with-tests: ${{ steps.determine.outputs.changed-components-with-tests }}
       directly-changed-components-with-tests: ${{ steps.determine.outputs.directly-changed-components-with-tests }}
@@ -154,6 +153,9 @@ jobs:
           # Extract individual fields
           echo "core-ci=$(echo "$output" | jq -r '.core_ci')" >> $GITHUB_OUTPUT
           echo "integration-tests=$(echo "$output" | jq -r '.integration_tests')" >> $GITHUB_OUTPUT
+          # A missing key must fail here, not silently disable the junit upload
+          run_all=$(echo "$output" | jq -r 'if has("integration_run_all") then .integration_run_all else error("integration_run_all missing") end')
+          echo "integration-run-all=${run_all}" >> $GITHUB_OUTPUT
           echo "integration-test-buckets=$(echo "$output" | jq -c '.integration_test_buckets')" >> $GITHUB_OUTPUT
           echo "clang-tidy=$(echo "$output" | jq -r '.clang_tidy')" >> $GITHUB_OUTPUT
           echo "clang-tidy-mode=$(echo "$output" | jq -r '.clang_tidy_mode')" >> $GITHUB_OUTPUT
@@ -163,8 +165,6 @@ jobs:
           echo "device-builder=$(echo "$output" | jq -r '.device_builder')" >> $GITHUB_OUTPUT
           echo "esp32-platformio=$(echo "$output" | jq -r '.esp32_platformio')" >> $GITHUB_OUTPUT
           echo "esp32-platformio-components=$(echo "$output" | jq -r '.esp32_platformio_components')" >> $GITHUB_OUTPUT
-          echo "esp8266-native=$(echo "$output" | jq -r '.esp8266_native')" >> $GITHUB_OUTPUT
-          echo "esp8266-native-components=$(echo "$output" | jq -r '.esp8266_native_components')" >> $GITHUB_OUTPUT
           echo "changed-components=$(echo "$output" | jq -c '.changed_components')" >> $GITHUB_OUTPUT
           echo "changed-components-with-tests=$(echo "$output" | jq -c '.changed_components_with_tests')" >> $GITHUB_OUTPUT
           echo "directly-changed-components-with-tests=$(echo "$output" | jq -c '.directly_changed_components_with_tests')" >> $GITHUB_OUTPUT
@@ -183,32 +183,6 @@ jobs:
           path: .temp/components_graph.json
           key: components-graph-${{ hashFiles('esphome/components/**/*.py') }}
 
-  seed-esp8266-native-cache:
-    name: Seed the esp8266 native toolchain cache
-    runs-on: ubuntu-24.04
-    needs:
-      - common
-    # PR-branch cache saves are invisible to other PRs, so dev pushes seed
-    # the shared entry test-esp8266-native restores. Only dev: the composite
-    # action saves nowhere else, so a beta/release push would download the
-    # toolchain and discard it.
-    if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
-    timeout-minutes: 15
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Restore Python
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-          cache-key: ${{ needs.common.outputs.cache-key }}
-      - name: Cache the native toolchain
-        uses: ./.github/actions/cache-arduino8266
-      - name: Install the native toolchain
-        run: |
-          . venv/bin/activate
-          python -c "from esphome.arduino8266.framework import check_and_install; from esphome.components.esp8266 import RECOMMENDED_ARDUINO_FRAMEWORK_VERSION; check_and_install(RECOMMENDED_ARDUINO_FRAMEWORK_VERSION)"
-
   ci-custom:
     name: Run script/ci-custom
     runs-on: ubuntu-24.04
@@ -385,6 +359,15 @@ jobs:
       fail-fast: false
       matrix:
         bucket: ${{ fromJson(needs.determine-jobs.outputs.integration-test-buckets) }}
+    env:
+      # What the cache steps persist; libdeps is excluded (keyed per xdist
+      # worker and env, it never crosses runs).
+      INTEGRATION_PIO_CACHE_PATH: |
+        ~/.esphome-integration-tests/platformio/platforms
+        ~/.esphome-integration-tests/platformio/packages
+        ~/.esphome-integration-tests/platformio/appstate.json
+        ~/.esphome-integration-tests/platformio/.cache
+        ~/.esphome-integration-tests/platformio/.esphome.pio.stamp.json
     steps:
       - name: Check out code from GitHub
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -403,6 +386,14 @@ jobs:
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
+      - name: Restore integration PlatformIO cache
+        # Native platform + toolchain installed by shared_platformio_cache in
+        # tests/integration/conftest.py; a miss self-heals, so no restore-keys.
+        id: pio-cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ env.INTEGRATION_PIO_CACHE_PATH }}
+          key: integration-pio-v1-${{ runner.os }}-py${{ steps.python.outputs.python-version }}-${{ hashFiles('requirements.txt', 'tests/integration/fixtures/cache_init.yaml', 'esphome/components/host/__init__.py') }}
       - name: Restore Python virtual environment
         id: cache-venv
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -440,12 +431,36 @@ jobs:
         run: |
           . venv/bin/activate
           mapfile -t test_files < <(echo "$BUCKET_TESTS" | jq -r '.[]')
+          if [ "${#test_files[@]}" -eq 0 ]; then
+            echo "::error::Empty integration test bucket; pytest would collect the whole tree"
+            exit 1
+          fi
           echo "Bucket ${{ matrix.bucket.name }}: running ${#test_files[@]} integration tests"
-          pytest -vv --no-cov --tb=native --durations=30 -n auto "${test_files[@]}"
+          pytest -vv --no-cov --tb=native --durations=30 -n auto --dist worksteal \
+            --junitxml=junit-integration.xml "${test_files[@]}"
+      - name: Upload junit timings
+        # Consumed by sync-integration-durations.yml through
+        # script/update_integration_test_durations.py; only full matrix dev
+        # runs produce usable data.
+        if: github.ref == 'refs/heads/dev' && needs.determine-jobs.outputs.integration-run-all == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: junit-integration-${{ strategy.job-index }}
+          path: junit-integration.xml
+          if-no-files-found: error
+          # A full cron period of margin for the weekly refresh
+          retention-days: 14
       - name: Print ccache statistics
         # esphome stores the PlatformIO ccache under the machine-global cache
         # dir (see _ccache_env() in esphome/platformio/toolchain.py).
         run: CCACHE_DIR="$HOME/.cache/esphome/platformio-ccache" ccache -s
+      - name: Save integration PlatformIO cache
+        # Bucket 0 only; the others would race the same immutable key.
+        if: success() && (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write')) && strategy.job-index == 0 && steps.pio-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ env.INTEGRATION_PIO_CACHE_PATH }}
+          key: ${{ steps.pio-cache.outputs.cache-primary-key }}
 
   import-time:
     name: Check import esphome.__main__ time
@@ -679,6 +694,12 @@ jobs:
         with:
           framework: arduino
 
+      - name: Cache clang-tidy idedata
+        if: matrix.cache_idf
+        uses: ./.github/actions/cache-clang-tidy-idedata
+        with:
+          environment: esp32-arduino-tidy
+
       - name: Cache nRF Connect SDK install
         if: matrix.cache_sdk_nrf
         uses: ./.github/actions/cache-sdk-nrf
@@ -728,6 +749,10 @@ jobs:
           # Also cache libdeps, store them in a ~/.platformio subfolder
           PLATFORMIO_LIBDEPS_DIR: ~/.platformio/libdeps
 
+      - name: Prune ESP-IDF install before cache save
+        if: matrix.cache_idf && (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write'))
+        uses: ./.github/actions/prune-esp-idf
+
       - name: Suggested changes
         run: script/ci-suggest-changes ${{ matrix.ignore_errors && '|| true' || '' }}
         # yamllint disable-line rule:line-length
@@ -760,6 +785,11 @@ jobs:
       - name: Cache ESP-IDF install
         uses: ./.github/actions/cache-esp-idf
 
+      - name: Cache clang-tidy idedata
+        uses: ./.github/actions/cache-clang-tidy-idedata
+        with:
+          environment: esp32-idf-tidy
+
       - name: Register problem matchers
         run: |
           echo "::add-matcher::.github/workflows/matchers/gcc.json"
@@ -794,6 +824,10 @@ jobs:
           # Also cache libdeps, store them in a ~/.platformio subfolder
           PLATFORMIO_LIBDEPS_DIR: ~/.platformio/libdeps
 
+      - name: Prune ESP-IDF install before cache save
+        if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write'))
+        uses: ./.github/actions/prune-esp-idf
+
       - name: Suggested changes
         run: script/ci-suggest-changes
         if: always()
@@ -839,6 +873,11 @@ jobs:
       - name: Cache ESP-IDF install
         uses: ./.github/actions/cache-esp-idf
 
+      - name: Cache clang-tidy idedata
+        uses: ./.github/actions/cache-clang-tidy-idedata
+        with:
+          environment: esp32-idf-tidy
+
       - name: Register problem matchers
         run: |
           echo "::add-matcher::.github/workflows/matchers/gcc.json"
@@ -873,6 +912,10 @@ jobs:
           # Also cache libdeps, store them in a ~/.platformio subfolder
           PLATFORMIO_LIBDEPS_DIR: ~/.platformio/libdeps
 
+      - name: Prune ESP-IDF install before cache save
+        if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write'))
+        uses: ./.github/actions/prune-esp-idf
+
       - name: Suggested changes
         run: script/ci-suggest-changes
         if: always()
@@ -896,16 +939,19 @@ jobs:
             name: Run script/clang-tidy for ESP32 S3
             # yamllint disable-line rule:line-length
             options: --environment esp32s3-idf-tidy --grep SOC_TEMP_SENSOR_SUPPORTED --grep USE_ESP32_VARIANT_ESP32S3 --grep USE_LOGGER_USB_CDC
+            tidy_environment: esp32s3-idf-tidy
           - id: clang-tidy
             name: Run script/clang-tidy for ESP32 P4
             # P4 has no native Wi-Fi/BLE; those run over the hosted co-processor,
             # so their code paths differ -- lint them under the P4 build too.
             # yamllint disable-line rule:line-length
             options: --environment esp32p4-idf-tidy --grep USE_ESP32_VARIANT_ESP32P4 --grep USE_ESP32_HOSTED --grep USE_WIFI --grep USE_BLE
+            tidy_environment: esp32p4-idf-tidy
           - id: clang-tidy
             name: Run script/clang-tidy for ESP32 C6
             # yamllint disable-line rule:line-length
             options: --environment esp32c6-idf-tidy --grep SOC_LP_I2C_SUPPORTED --grep USE_ESP32_VARIANT_ESP32C6 --grep USE_OPENTHREAD --grep USE_ZIGBEE
+            tidy_environment: esp32c6-idf-tidy
 
     steps:
       - name: Check out code from GitHub
@@ -923,6 +969,11 @@ jobs:
       - name: Cache ESP-IDF install
         uses: ./.github/actions/cache-esp-idf
 
+      - name: Cache clang-tidy idedata
+        uses: ./.github/actions/cache-clang-tidy-idedata
+        with:
+          environment: ${{ matrix.tidy_environment }}
+
       - name: Register problem matchers
         run: |
           echo "::add-matcher::.github/workflows/matchers/gcc.json"
@@ -956,6 +1007,10 @@ jobs:
             script/clang-tidy --fix --changed ${{ matrix.options }}
           fi
 
+      - name: Prune ESP-IDF install before cache save
+        if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write'))
+        uses: ./.github/actions/prune-esp-idf
+
       - name: Suggested changes
         run: script/ci-suggest-changes
         if: always()
@@ -1162,7 +1217,7 @@ jobs:
 
           # compile validates config first, so a separate config pass is
           # redundant for this smoke test. ESP-IDF framework via PlatformIO:
-          python3 script/test_build_components.py -e compile -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain platformio --fail-on-no-tests
+          python3 script/test_build_components.py -e compile -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain platformio
 
           echo ""
           echo "ESP-IDF-via-PlatformIO build passed! Starting Arduino smoke test..."
@@ -1171,42 +1226,6 @@ jobs:
           # Arduino framework via PlatformIO (only components with an esp32-ard test are built):
           python3 script/test_build_components.py -e compile -t esp32-ard -c "$TEST_COMPONENTS" -f --toolchain platformio
 
-  test-esp8266-native:
-    name: Test esp8266 components with the native toolchain
-    runs-on: ubuntu-24.04
-    needs:
-      - common
-      - determine-jobs
-    if: github.event_name == 'pull_request' && needs.determine-jobs.outputs.esp8266-native == 'true'
-    env:
-      # Computed by script/determine-jobs.py (ESP8266_NATIVE_TEST_COMPONENTS)
-      TEST_COMPONENTS: ${{ needs.determine-jobs.outputs.esp8266-native-components }}
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Restore Python
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-          cache-key: ${{ needs.common.outputs.cache-key }}
-
-      - name: Cache the native toolchain
-        uses: ./.github/actions/cache-arduino8266
-
-      - name: Run native toolchain compile test
-        run: |
-          . venv/bin/activate
-
-          echo "Testing components: $TEST_COMPONENTS"
-          echo ""
-
-          # ESP8266 Arduino built directly (no PlatformIO); compile validates
-          # config first, so a separate config pass is redundant. Strict pch:
-          # exercises the native ninja pch (and its probe edge) against real
-          # component configs; the docker matrix smoke-tests both toolchains.
-          ESPHOME_PCH_STRICT=1 python3 script/test_build_components.py -e compile -t esp8266-ard -c "$TEST_COMPONENTS" -f --toolchain arduino --fail-on-no-tests
-
   device-builder:
     name: Test downstream esphome/device-builder
     runs-on: ubuntu-24.04
@@ -1569,7 +1588,6 @@ jobs:
     needs:
       - common
       - seed-apt-cache
-      - seed-esp8266-native-cache
       - determine-jobs
       - ci-custom
       - pylint
@@ -1585,7 +1603,6 @@ jobs:
       - clang-tidy-esp32-variants
       - test-build-components-split
       - test-esp32-platformio
-      - test-esp8266-native
       - device-builder
       - memory-impact-target-branch
       - memory-impact-pr-branch

.github/workflows/codeql.yml

@@ -56,7 +56,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -84,6 +84,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/sync-integration-durations.yml

@@ -0,0 +1,98 @@
+---
+name: Refresh integration test durations
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "45 5 * * 1"
+
+# Repo writes (branch push, PR open) happen via the App token minted below,
+# so the workflow's GITHUB_TOKEN does not need any write scopes.
+permissions:
+  contents: read
+  actions: read  # gh api / gh run download for the CI junit artifacts
+
+jobs:
+  sync:
+    name: Refresh integration test durations
+    runs-on: ubuntu-latest
+    if: github.repository == 'esphome/esphome'
+    steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          permission-contents: write       # push the sync branch
+          permission-pull-requests: write  # open or refresh the sync PR
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+
+      - name: Refresh from the newest usable dev run
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Only full matrix dev runs upload junit-integration-* artifacts
+          # (see the integration-tests job); the merge script re-checks
+          # coverage regardless.
+          # Newest-first candidates via their bucket-0 artifact. Fork PRs run
+          # their own ci.yml, so name and branch are spoofable; require
+          # same-repo. Assignment failures trip set -e and fail loudly.
+          candidates=$(
+            gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=junit-integration-0&per_page=100" \
+              --jq '.artifacts[] | select(.expired | not) | .workflow_run
+                    | select(.head_branch == "dev" and .head_repository_id != null
+                             and .head_repository_id == .repository_id)
+                    | .id'
+          )
+          # Green runs first, then the rest newest first; a run missing a
+          # bucket fails the coverage check and the next one is tried
+          green=""
+          rest=""
+          for id in ${candidates}; do
+            conclusion=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${id}" --jq '.conclusion // ""')
+            if [ "${conclusion}" = "success" ]; then
+              green="${green} ${id}"
+            elif [ -n "${conclusion}" ]; then
+              rest="${rest} ${id}"
+            fi
+          done
+          # helpers.py imports colorama; the script needs nothing else
+          pip install colorama
+          for id in ${green} ${rest}; do
+            rm -rf /tmp/junit
+            if ! gh run download "${id}" --repo "${GITHUB_REPOSITORY}" -p "junit-integration-*" -D /tmp/junit; then
+              echo "::warning::Could not download artifacts for run ${id}; trying the next"
+              continue
+            fi
+            status=0
+            python script/update_integration_test_durations.py /tmp/junit || status=$?
+            if [ "${status}" -eq 0 ]; then
+              echo "Refreshed from run ${id}"
+              exit 0
+            fi
+            # Only EXIT_LOW_COVERAGE (3) from the script advances to the next run
+            [ "${status}" -eq 3 ] || exit 1
+            echo "::warning::Run ${id} covers too few test files; trying the next"
+          done
+          echo "::error::No dev CI run with usable junit artifacts in range; the feed is starved"
+          exit 1
+
+      - name: Commit changes
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          commit-message: "[ci] Refresh integration test durations"
+          committer: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
+          author: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
+          branch: sync/integration-durations
+          delete-branch: true
+          title: "[ci] Refresh integration test durations"
+          body-path: .github/PULL_REQUEST_TEMPLATE.md
+          token: ${{ steps.generate-token.outputs.token }}

AGENTS.md

@@ -44,6 +44,16 @@ This document provides essential context for AI models interacting with this pro
 
 ## 4. Coding Conventions & Style Guide
 
+**Read the developer documentation before writing a component.** https://developers.esphome.io covers the
+component lifecycle, the main loop, and the reasoning behind the rules below in far more depth than this
+file does, and it is the authority when they disagree. The most useful starting points:
+
+*   https://developers.esphome.io/architecture/components/ - component lifecycle, `setup()`, `loop()`,
+    setup priorities, and how a component is registered.
+*   https://developers.esphome.io/architecture/components/advanced/ - choosing between `loop()`,
+    `set_interval`, `set_timeout` and `defer`; waking the loop from another thread; the RAM cost of each.
+*   https://developers.esphome.io/contributing/code/ - contribution rules, public API and breaking changes.
+
 *   **Formatting:**
     *   **Python:** Uses `ruff` and `flake8` for linting and formatting. Configuration is in `pyproject.toml`.
     *   **C++:** Uses `clang-format` for formatting. Configuration is in `.clang-format`.
@@ -142,6 +152,47 @@ This document provides essential context for AI models interacting with this pro
     *   **Indentation:** Use spaces (two per indentation level), not tabs
     *   **Type aliases:** Prefer `using type_t = int;` over `typedef int type_t;`
     *   **Line length:** Wrap lines at no more than 120 characters
+    *   **Timing in `loop()`:** Never call `millis()` in a `loop()` body. The current tick's timestamp is
+        already cached - use `App.get_loop_component_start_time()` (from `esphome/core/application.h`).
+        Only reach for `millis()` when you genuinely need sub-tick resolution inside a long operation.
+    *   **The main loop runs every 16 ms.** A rate-limit gate shorter than that does nothing: the check
+        passes on essentially every pass of the loop, so it costs a comparison and buys nothing. Pick an
+        interval comfortably coarser than 16 ms, or drop the gate entirely and accept running every loop.
+        ```cpp
+        // Bad - a 10ms gate against a 16ms loop never holds anything back
+        static constexpr uint32_t POLL_INTERVAL_MS = 10;
+        const uint32_t now = millis();
+        if (now - this->last_poll_ < POLL_INTERVAL_MS)
+          return;
+        this->last_poll_ = now;
+        ```
+        ```cpp
+        // Good - an interval that actually rate limits, off the cached timestamp
+        static constexpr uint32_t POLL_INTERVAL_MS = 100;
+        const uint32_t now = App.get_loop_component_start_time();
+        if (now - this->last_poll_ < POLL_INTERVAL_MS)
+          return;
+        this->last_poll_ = now;
+        ```
+        Pick the primitive by cadence: under 250 ms use a gated `loop()`; 500 ms and above use
+        `set_interval`. Full reasoning, including why `set_interval` costs more below 500 ms:
+        https://developers.esphome.io/architecture/components/advanced/#quick-rule-of-thumb
+    *   **Don't override a default with the same value:** if a base class method already returns what you
+        want, do not override it. `Component::get_setup_priority()` returns `setup_priority::DATA`, so a
+        component that wants `DATA` should simply leave it alone.
+        ```cpp
+        // Bad - this is exactly what the base class already does
+        float get_setup_priority() const override { return setup_priority::DATA; }
+        ```
+    *   **Logging string literals:** wrap literals passed as `%s` arguments in `LOG_STR_LITERAL()` so they
+        can be stored in flash rather than RAM.
+        ```cpp
+        // Bad
+        ESP_LOGV(TAG, "Key %u %s", key, pressed ? "pressed" : "released");
+
+        // Good
+        ESP_LOGV(TAG, "Key %u %s", key, pressed ? LOG_STR_LITERAL("pressed") : LOG_STR_LITERAL("released"));
+        ```
     *   **Constructor parameters vs setters:** Component properties that are both **required** and **invariant**
         (never change after construction) should be constructor parameters rather than set via setter methods.
         This makes the dependency explicit and prevents use of the object in an incompletely-initialized state.
@@ -562,6 +613,33 @@ This document provides essential context for AI models interacting with this pro
            Use `cg.add_define("MAX_SERVICES", count)` to set the size from Python configuration.
            Like `std::array` but with vector-like API (`push_back()`, `size()`) and no STL reallocation code.
 
+           **Listener and child-entity registration lists are the most common case, and the most commonly
+           missed.** A `register_*()` method called once per child at code generation time has a count that
+           is known at compile time, so it should never be a `std::vector`. Use `cg.slot_counter()`: it
+           returns a function that each consumer calls once per slot it will occupy, and after every
+           `to_code` has run it emits the define with the final count. When nothing registers, no define is
+           emitted and the storage plus its registration method compile out entirely.
+           ```python
+           # hub component's __init__.py
+           _request_listener_slot = cg.slot_counter("MY_COMPONENT_LISTENER_COUNT")
+
+
+           async def register_listener(hub: MockObj, var: MockObj) -> None:
+               _request_listener_slot()
+               cg.add(hub.register_listener(var))
+           ```
+           ```cpp
+           #ifdef MY_COMPONENT_LISTENER_COUNT
+             void register_listener(MyComponentListener *listener);
+           #endif
+            protected:
+           #ifdef MY_COMPONENT_LISTENER_COUNT
+             StaticVector<MyComponentListener *, MY_COMPONENT_LISTENER_COUNT> listeners_;
+           #endif
+           ```
+           Request slots from `to_code`, not from a job that runs after `CoroPriority.FINAL` - a late
+           request raises rather than silently undercounting.
+
         3. **Runtime-known sizes:** Use `FixedVector` from `esphome/core/helpers.h` when the size is only known at runtime initialization.
            ```cpp
            // Bad - generates STL realloc code (_M_realloc_insert)
@@ -599,9 +677,25 @@ This document provides essential context for AI models interacting with this pro
            ```
            Linear search on small datasets (1-16 elements) is often faster than hashing/tree overhead, but this depends on lookup frequency and access patterns. For frequent lookups in hot code paths, the O(1) vs O(n) complexity difference may still matter even for small datasets. `std::vector` with simple structs is usually fine—it's the heavy containers (`map`, `set`, `unordered_map`) that should be avoided for small datasets unless profiling shows otherwise.
 
-        5. **Avoid `std::deque`:** It allocates in 512-byte blocks regardless of element size, guaranteeing at least 512 bytes of RAM usage immediately. This is a major source of crashes on memory-constrained devices.
+        5. **Strings set once from configuration:** Use `StringRef` (`esphome/core/string_ref.h`) rather than
+           `std::string`. Code generation passes a string literal that lives in flash for the life of the
+           program, so storing a `std::string` copies it onto the heap for nothing. `StringRef` is a
+           non-owning pointer plus length; it does not copy, and it must only ever refer to storage that
+           outlives it (a string literal, or a buffer owned elsewhere).
+           ```cpp
+           // Bad - heap copy of a literal that is already in flash
+           void set_keys(std::string keys) { this->keys_ = std::move(keys); }
+           std::string keys_;
+           ```
+           ```cpp
+           // Good - no allocation
+           void set_keys(const char *keys) { this->keys_ = StringRef(keys); }
+           StringRef keys_;
+           ```
 
-        6. **Detection:** Look for these patterns in compiler output:
+        6. **Avoid `std::deque`:** It allocates in 512-byte blocks regardless of element size, guaranteeing at least 512 bytes of RAM usage immediately. This is a major source of crashes on memory-constrained devices.
+
+        7. **Detection:** Look for these patterns in compiler output:
            - Large code sections with STL symbols (vector, map, set)
            - `alloc`, `realloc`, `dealloc` in symbol names
            - `_M_realloc_insert`, `_M_default_append` (vector reallocation)

CODEOWNERS

@@ -131,6 +131,7 @@ esphome/components/cst816/* @clydebarrow
 esphome/components/cst9220/* @clydebarrow
 esphome/components/ct_clamp/* @jesserockz
 esphome/components/current_based/* @djwmarcx
+esphome/components/d01/* @ch604
 esphome/components/dac7678/* @NickB1
 esphome/components/daikin_arc/* @MagicBear
 esphome/components/daikin_brc/* @hagak
@@ -148,6 +149,7 @@ esphome/components/display_menu_base/* @numo68
 esphome/components/dlms_meter/* @latonita @PolarGoose @SimonFischer04 @Tomer27cz
 esphome/components/dps310/* @kbx81
 esphome/components/ds1307/* @badbadc0ffee
+esphome/components/ds1603l/* @JakeLC15
 esphome/components/ds2484/* @mrk-its
 esphome/components/ds248x/* @tomwellnitz
 esphome/components/dsmr/* @glmnet @PolarGoose
@@ -350,6 +352,7 @@ esphome/components/mipi_spi/* @clydebarrow
 esphome/components/mitsubishi/* @RubyBailey
 esphome/components/mitsubishi_cn105/* @crnjan
 esphome/components/mixer/speaker/* @kahrendt
+esphome/components/mk2pvrouter/* @FredM67
 esphome/components/mlx90393/* @functionpointer
 esphome/components/mlx90614/* @jesserockz
 esphome/components/mmc5603/* @benhoff

THREAT_MODEL.md

@@ -23,7 +23,8 @@ For this repository there are two trusted inputs by design:
 1. **The configuration.** Anyone who can supply or edit a YAML config is trusted
    (see below).
 2. **Authenticated peers of a running device** — clients holding the device's
-   API encryption key / password, OTA password, or web server credentials.
+   API/OTA encryption key, API password, OTA password, or web server
+   credentials.
 
 The security boundary is therefore **unauthenticated network traffic vs. those
 trusted inputs.** A bug that lets an unauthenticated attacker cross it is a
@@ -76,8 +77,8 @@ These *are* security bugs in this repo, and we want to hear about them privately
   captive portal, etc.) **without** valid credentials.
 - Authentication or encryption bypass on the device — reaching API calls, OTA
   updates, or the web server without the configured key/password.
-- Flaws that weaken the device's API encryption (Noise), OTA, or web server auth
-  below their documented guarantees.
+- Flaws that weaken the device's API or OTA encryption (Noise), OTA auth, or
+  web server auth below their documented guarantees.
 
 ## The web server is an open HTTP API by design
 
@@ -121,6 +122,37 @@ and any memory-safety or protocol bug in the server reachable without credential
 This section documents the current design and scope; it is not a judgment that the
 design is optimal or that it will not change.
 
+## OTA update encryption
+
+The `esphome` OTA platform optionally encrypts updates with the same Noise
+`NNpsk0` pattern the native API uses; one key protects the device. With an
+`encryption:` block configured the guarantees are: the firmware image is
+confidential in transit, the uploader is authenticated by the pre-shared key,
+and the plaintext negotiation preceding the handshake is bound into the
+handshake prologue, so stripping or tampering with it fails the first MAC.
+Both ends fail closed with no override: a device built with a key refuses
+plaintext uploads, and the CLI refuses to send plaintext when a key is
+configured.
+
+Defeating any of that without the key is in scope: a keyed device accepting a
+plaintext or downgraded upload, getting past the MAC, or recovering image
+contents from captured traffic.
+
+The following are **not** vulnerabilities, by design:
+
+- Plaintext OTA on a device with no `encryption:` block. That is the
+  documented default, authenticated (if at all) by the OTA password.
+- The enablement window: turning encryption on takes one last upload of the
+  encryption-enabled firmware over the existing plaintext channel, with the
+  pre-existing plaintext exposure.
+- The web OTA `/update` endpoint alongside encryption. The `web_server`
+  component keeps it always reachable, and `captive_portal:` auto-loads it
+  for the fallback AP window; validation warns about both combinations, and
+  the operator keeps the recovery path.
+- CLI retry behavior on transport or MAC failures; every attempt renegotiates
+  a fresh handshake with fresh ephemerals, so retrying does not weaken
+  authentication.
+
 ## Explicitly out of scope
 
 - Local attackers who already have shell access on the host that runs `esphome`.

docker/generate_tags.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python3
 import argparse
+import os
 import re
 
 CHANNEL_DEV = "dev"
@@ -64,7 +65,10 @@ def main():
 
     suffix = f"-{args.suffix}" if args.suffix else ""
 
-    image_name = f"esphome/esphome{suffix}"
+    repository = (
+        (os.environ.get("GITHUB_REPOSITORY") or "esphome/esphome").strip().lower()
+    )
+    image_name = f"{repository}{suffix}"
 
     print(f"channel={channel}")
 

docker/test_configs/esp8266-arduino-native.yaml

@@ -1,8 +0,0 @@
-esphome:
-  name: docker-test-esp8266-native
-
-esp8266:
-  board: d1_mini
-  toolchain: arduino
-
-logger:

esphome/__main__.py

@@ -26,7 +26,9 @@ from esphome.const import (
     CONF_DEASSERT_RTS_DTR,
     CONF_DISABLED,
     CONF_DISCOVER_IP,
+    CONF_ENCRYPTION,
     CONF_ESPHOME,
+    CONF_KEY,
     CONF_LEVEL,
     CONF_LOG,
     CONF_LOG_TOPIC,
@@ -815,9 +817,7 @@ def write_cpp_file() -> int:
         from esphome.build_gen import espidf
 
         espidf.write_project()
-    elif not CORE.using_native_toolchain:
-        # Other native builds generate their project at compile time;
-        # never write a platformio.ini for them
+    else:
         from esphome.build_gen import platformio
 
         platformio.write_project()
@@ -859,14 +859,20 @@ def compile_program(args: ArgsProtocol, config: ConfigType) -> int:
         toolchain.create_factory_bin()
         toolchain.create_ota_bin()
         toolchain.create_elf_copy()
-        from esphome.build_helpers.idedata import warn_if_idedata_missing
+        from esphome.build_helpers.idedata import IDEDATA_BEST_EFFORT_ERRORS
 
-        warn_if_idedata_missing(toolchain.get_idedata)
-    elif CORE.using_native_toolchain:
-        raise EsphomeError(
-            f"Toolchain '{CORE.toolchain.value}' resolved but no platform "
-            "backend claimed the build"
-        )
+        try:
+            if toolchain.get_idedata() is None:
+                _LOGGER.warning("No idedata was generated for this build")
+        except IDEDATA_BEST_EFFORT_ERRORS as err:
+            # The firmware already built; an idedata failure must not fail
+            # a successful build.
+            _LOGGER.warning(
+                "Could not generate idedata: %s (IDE, clang-tidy, and "
+                "memory-analysis data will be unavailable for this build)",
+                err,
+            )
+            _LOGGER.debug("Idedata failure detail", exc_info=True)
     else:
         from esphome.platformio import toolchain
 
@@ -969,15 +975,12 @@ def upload_using_esptool(
 
     if file is not None:
         flash_images = [FlashImage(path=file, offset="0x0")]
-    elif (native := _native_toolchain_module()) is not None:
-        # Every native backend supplies its own 0x0 flash image (bootloader
-        # and partitions included where the target needs them)
-        image = native.get_factory_firmware_path()
-        if not image.is_file():
-            raise EsphomeError(
-                f"{image} does not exist; compile the configuration first"
-            )
-        flash_images = [FlashImage(path=image, offset="0x0")]
+    elif CORE.using_toolchain_esp_idf:
+        from esphome.espidf import toolchain
+
+        flash_images = [
+            FlashImage(path=toolchain.get_factory_firmware_path(), offset="0x0")
+        ]
     else:
         from esphome.platformio import toolchain
 
@@ -1335,6 +1338,19 @@ def _upload_via_native_api(
 
     remote_port = int(ota_conf[CONF_PORT])
     password = ota_conf.get(CONF_PASSWORD)
+    # Fail closed: an encryption block whose key did not resolve must never
+    # fall back to a plaintext upload
+    noise_psk = None
+    if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
+        noise_psk = encryption_conf.get(CONF_KEY)
+        if not noise_psk:
+            raise EsphomeError(
+                "OTA encryption is configured but no key was resolved; "
+                "set the key under 'ota: encryption:' or 'api: encryption:'"
+            )
+        # Ensure the key is a string, as required by the underlying OTA implementation.
+        # It arrives here as a SensitiveStr which aioesphomeapi rejects.
+        noise_psk = str(noise_psk)
 
     def check_partition_access(option_string: str) -> None:
         if not ota_conf.get("allow_partition_access"):
@@ -1365,7 +1381,9 @@ def _upload_via_native_api(
     if ota_type == espota2.OTA_TYPE_UPDATE_BOOTLOADER:
         _validate_bootloader_binary(binary)
 
-    return espota2.run_ota(network_devices, remote_port, password, binary, ota_type)
+    return espota2.run_ota(
+        network_devices, remote_port, password, binary, ota_type, noise_psk
+    )
 
 
 def _upload_via_web_server(
@@ -1374,6 +1392,16 @@ def _upload_via_web_server(
     from esphome import web_server_ota
     from esphome.web_server_helpers import get_web_server_connection
 
+    if any(
+        ota_item.get(CONF_PLATFORM) == CONF_ESPHOME
+        and ota_item.get(CONF_ENCRYPTION) is not None
+        for ota_item in config.get(CONF_OTA, [])
+    ):
+        _LOGGER.warning(
+            "This config has OTA encryption, but the web_server OTA path sends "
+            "the image over plaintext HTTP; use the esphome OTA platform to "
+            "keep it confidential"
+        )
     remote_port, username, password = get_web_server_connection(config)
     return web_server_ota.run_ota(
         network_devices, remote_port, username, password, binary
@@ -1669,20 +1697,26 @@ def command_compile(args: ArgsProtocol, config: ConfigType) -> int | None:
     if exit_code != 0:
         return exit_code
     if CORE.is_host:
-        if CORE.using_toolchain_esp_idf:
-            from esphome.espidf import toolchain
-
-            program_path = str(toolchain.get_elf_path())
-        else:
-            from esphome.platformio.toolchain import get_idedata
-
-            program_path = str(get_idedata(config).firmware_elf_path)
-        _LOGGER.info("Successfully compiled program to path '%s'", program_path)
+        _LOGGER.info(
+            "Successfully compiled program to path '%s'", _host_program_path(config)
+        )
     else:
         _LOGGER.info("Successfully compiled program.")
     return 0
 
 
+def _host_program_path(config: ConfigType) -> str:
+    """Return the compiled host ELF path."""
+    if CORE.using_toolchain_esp_idf:
+        from esphome.espidf import toolchain
+
+        return str(toolchain.get_elf_path())
+    from esphome.platformio.toolchain import get_idedata
+
+    # Memoized by compile_program's own call; this is a dict lookup
+    return str(get_idedata(config).firmware_elf_path)
+
+
 def command_upload(args: ArgsProtocol, config: ConfigType) -> int | None:
     # Get devices, resolving special identifiers like OTA
     devices = choose_upload_log_host(
@@ -1727,14 +1761,7 @@ def command_run(args: ArgsProtocol, config: ConfigType) -> int | None:
         return exit_code
     _LOGGER.info("Successfully compiled program.")
     if CORE.is_host:
-        if CORE.using_toolchain_esp_idf:
-            from esphome.espidf import toolchain
-
-            program_path = str(toolchain.get_elf_path())
-        else:
-            from esphome.platformio.toolchain import get_idedata
-
-            program_path = str(get_idedata(config).firmware_elf_path)
+        program_path = _host_program_path(config)
         _LOGGER.info("Running program from path '%s'", program_path)
         return run_external_process(program_path)
 
@@ -1923,39 +1950,15 @@ def command_update_all(args: ArgsProtocol) -> int | None:
     return run_multiple_configs(files, build_command)
 
 
-# Native build backend per (target platform, toolchain). Keyed here rather
-# than through a platform hook so the serial upload/logs fast path never
-# imports the platform component package (see the esp32 variant comment in
-# upload_using_esptool); the platform half comes from CORE.data the same way.
-_NATIVE_TOOLCHAIN_MODULES = {
-    ("esp32", Toolchain.ESP_IDF): "esphome.espidf.toolchain",
-    ("esp8266", Toolchain.ARDUINO): "esphome.arduino8266.toolchain",
-}
-
-
-def _native_toolchain_module():
-    """The native build backend module for the resolved toolchain."""
-    if not CORE.using_native_toolchain:
-        return None
-    key = (CORE.target_platform, CORE.toolchain)
-    if (module_path := _NATIVE_TOOLCHAIN_MODULES.get(key)) is None:
-        # Degrading to the PlatformIO path would build with the wrong backend
-        raise EsphomeError(
-            f"Toolchain '{CORE.toolchain.value}' has no native build backend "
-            f"module for platform {CORE.target_platform}"
-        )
-    return importlib.import_module(module_path)
-
-
 def command_idedata(args: ArgsProtocol, config: ConfigType) -> int:
     import json
 
-    native_toolchain = _native_toolchain_module()
+    if CORE.using_toolchain_esp_idf:
+        # Native ESP-IDF derives idedata from the build's compile_commands.json,
+        # so the configuration must already be compiled.
+        from esphome.espidf import toolchain as espidf_toolchain
 
-    if native_toolchain is not None:
-        # Native toolchains derive idedata from the build's
-        # compile_commands.json, so the configuration must already be compiled.
-        idedata = native_toolchain.get_idedata()
+        idedata = espidf_toolchain.get_idedata()
         if idedata is None:
             _LOGGER.error(
                 "No idedata available; compile the configuration first",
@@ -1994,17 +1997,6 @@ def command_analyze_memory(args: ArgsProtocol, config: ConfigType) -> int:
     from esphome.analyze_memory.cli import MemoryAnalyzerCLI
     from esphome.analyze_memory.ram_strings import RamStringsAnalyzer
 
-    # Refuse an unsupported toolchain before paying for a full compile
-    native_toolchain = _native_toolchain_module()
-    if native_toolchain is None and not CORE.using_toolchain_platformio:
-        _LOGGER.error(
-            "analyze-memory is not supported with the '%s' toolchain on %s; "
-            "re-run with --toolchain platformio",
-            CORE.toolchain.value if CORE.toolchain else "unresolved",
-            CORE.target_platform,
-        )
-        return 1
-
     # Always compile to ensure fresh data (fast if no changes - just relinks)
     exit_code = write_cpp(config)
     if exit_code != 0:
@@ -2016,31 +2008,13 @@ def command_analyze_memory(args: ArgsProtocol, config: ConfigType) -> int:
 
     # Get idedata for analysis
     idedata = None
-    if native_toolchain is not None:
-        objdump = native_toolchain.get_objdump_path()
-        readelf = native_toolchain.get_readelf_path()
-        for tool in (objdump, readelf):
-            if not tool.is_file():
-                # The analyzer would silently fall back to host binutils,
-                # which cannot read the target ELF. clean-all is heavy for
-                # ESP-IDF, so suggest a recompile first.
-                _LOGGER.error(
-                    "%s is missing; the toolchain install may be incomplete "
-                    "(recompile, or run 'esphome clean-all' if it persists)",
-                    tool,
-                )
-                return 1
-        objdump_path = str(objdump)
-        readelf_path = str(readelf)
+    if CORE.using_toolchain_esp_idf:
+        from esphome.espidf import toolchain
 
-        firmware_elf = native_toolchain.get_elf_path()
-        if not firmware_elf.is_file():
-            # The analyzer swallows tool failures, so a missing ELF would
-            # produce an exit-0 zeroed report
-            _LOGGER.error(
-                "%s is missing; compile the configuration first", firmware_elf
-            )
-            return 1
+        objdump_path = str(toolchain.get_objdump_path())
+        readelf_path = str(toolchain.get_readelf_path())
+
+        firmware_elf = toolchain.get_elf_path()
     else:
         from esphome.platformio import toolchain
 

esphome/arduino8266/framework.py

@@ -19,11 +19,10 @@ from typing import NamedTuple
 
 from esphome.build_helpers.ccache import ccache_defaults_env
 from esphome.build_helpers.ninja import find_ninja
-from esphome.build_helpers.pch import ccache_pch_env
 from esphome.build_helpers.tools_cache import ARDUINO8266_TOOLS_CACHE, tools_cache_path
 from esphome.core import EsphomeError, Version
 from esphome.framework_helpers import str_to_lst_of_str
-from esphome.platformio.registry import install_packages, prefetch_packages
+from esphome.platformio.registry import install_package, prefetch_packages
 
 FRAMEWORK_PACKAGE = "framework-arduinoespressif8266"
 TOOLCHAIN_PACKAGE = "toolchain-xtensa"
@@ -121,9 +120,10 @@ def check_and_install(framework_version: Version) -> InstalledPaths:
             ("bin", "xtensa-lx106-elf"),
         ),
     )
-    # Fetch both archives at once; the install verifies and extracts them
+    # Fetch both archives at once; the installs below verify and extract
     prefetch_packages([spec[:4] for spec in specs], downloads_dir)
-    install_packages(specs, downloads_dir)
+    for name, version, dest, mirrors, expect in specs:
+        install_package(name, version, dest, mirrors, downloads_dir, expect=expect)
     return InstalledPaths(
         framework=framework_path, toolchain=toolchain_path, ninja=ninja_path
     )
@@ -161,6 +161,4 @@ def ccache_env(ccache: str | None) -> dict[str, str]:
     """
     if ccache is None:
         return {}
-    env = ccache_defaults_env(get_arduino8266_tools_path() / "ccache")
-    env.update(ccache_pch_env())
-    return env
+    return ccache_defaults_env(get_arduino8266_tools_path() / "ccache")

esphome/arduino8266/toolchain.py

@@ -1,329 +0,0 @@
-"""Native Arduino ESP8266 build driver (the PlatformIO ``run`` equivalent)."""
-
-from __future__ import annotations
-
-import json
-import logging
-from pathlib import Path
-import subprocess
-from typing import Any
-
-from esphome.arduino8266 import framework
-from esphome.build_helpers.ccache import resolve_ccache_path
-from esphome.const import (
-    CONF_COMPILE_PROCESS_LIMIT,
-    CONF_ESPHOME,
-    KEY_CORE,
-    KEY_FRAMEWORK_VERSION,
-)
-from esphome.core import CORE, EsphomeError
-from esphome.helpers import write_file_if_changed
-from esphome.types import ConfigType
-
-_LOGGER = logging.getLogger(__name__)
-
-# ESP8266 user RAM (matches upload.maximum_ram_size in every board manifest)
-_MAX_RAM_SIZE = 81920
-
-
-def _warn_ignored_platformio_options() -> None:
-    """Warn for component-added platformio options the native build drops.
-
-    The consumed set is exported by core/config.py next to the routing that
-    stores these options, so the two cannot drift; YAML upload_speed never
-    reaches CORE.platformio_options here.
-    """
-    from esphome.core.config import NATIVE_ARDUINO_CONSUMED_PIO_OPTIONS
-
-    consumed = NATIVE_ARDUINO_CONSUMED_PIO_OPTIONS
-    for key in sorted(CORE.platformio_options or {}):
-        if key not in consumed:
-            _LOGGER.warning(
-                "platformio_options->%s is ignored when building with the "
-                "native 'arduino' toolchain",
-                key,
-            )
-
-
-_RAM_SECTIONS = (".data", ".rodata", ".bss")
-_FLASH_SECTIONS = (".irom0.text", ".text", ".text1", ".data", ".rodata")
-
-
-def get_build_dir() -> Path:
-    return CORE.relative_pioenvs_path(CORE.name)
-
-
-def get_elf_path() -> Path:
-    return get_build_dir() / "firmware.elf"
-
-
-def _toolchain_tool(name: str) -> Path:
-    return framework.toolchain_tool(framework.get_toolchain_path(), name)
-
-
-def get_factory_firmware_path() -> Path:
-    """The image to serial-flash at 0x0 (same bytes as firmware.bin: the
-    8266 factory copy exists for artifact-contract parity, not content)."""
-    return get_build_dir() / "firmware.factory.bin"
-
-
-def get_addr2line_path() -> Path:
-    return _toolchain_tool("addr2line")
-
-
-def get_objdump_path() -> Path:
-    return _toolchain_tool("objdump")
-
-
-def get_readelf_path() -> Path:
-    return _toolchain_tool("readelf")
-
-
-def run_compile(config: ConfigType, verbose: bool) -> int:
-    from esphome.build_gen import arduino8266 as build_gen
-
-    _warn_ignored_platformio_options()
-    paths = framework.check_and_install(CORE.data[KEY_CORE][KEY_FRAMEWORK_VERSION])
-    # Resolved once per build: the resolution probes PATH and spawns the
-    # runnability check, and three consumers need the same answer
-    ccache = resolve_ccache_path()
-    ninja_changed = build_gen.write_project(paths, ccache)
-
-    build_dir = get_build_dir()
-    env = framework.get_build_env(paths.toolchain, ccache)
-
-    # Regenerate the compile DB before the build (a pure function of
-    # build.ninja); skip only when it is at least as fresh as build.ninja
-    # (an interrupted previous run may have rewritten the manifest without
-    # regenerating the DB).
-    compdb = build_dir / "compile_commands.json"
-    compdb_stamp = build_dir / ".compile_commands.stamp"
-    ninja_file = build_dir / "build.ninja"
-    # Freshness rides a stamp: the DB itself is written through
-    # write_file_if_changed (its mtime feeds get_idedata's cache), so a
-    # regeneration with identical content would stay "stale" forever
-    if (
-        ninja_changed
-        or not compdb.is_file()
-        or not compdb_stamp.is_file()
-        or compdb_stamp.stat().st_mtime < ninja_file.stat().st_mtime
-    ):
-        _write_compile_commands(paths.ninja, build_dir, env)
-        compdb_stamp.touch()
-
-    cmd = [str(paths.ninja)]
-    if verbose:
-        cmd.append("-v")
-    if jobs := config[CONF_ESPHOME].get(CONF_COMPILE_PROCESS_LIMIT):
-        cmd += ["-j", str(jobs)]
-    # Explicit targets, not the default statement: a generator defect that
-    # drops them fails loudly with "unknown target" instead of a green
-    # no-op run that leaves stale artifacts in place
-    targets = ["firmware.factory.bin", "firmware.ota.bin"]
-    cmd += targets
-
-    # A dry-run probe keeps a no-op rebuild quiet: ninja would only print
-    # "no work to do". A freshly rewritten manifest all but guarantees work,
-    # so skip the probe (and its full stat pass) on that path. cwd instead
-    # of -C also drops the "Entering directory" banner on real builds.
-    skip_build = False
-    if not ninja_changed:
-        probe = subprocess.run(
-            [str(paths.ninja), "-n", *targets],
-            cwd=build_dir,
-            env=env,
-            capture_output=True,
-            text=True,
-            check=False,
-            close_fds=False,
-        )
-        if probe.stderr.strip():
-            # A load-time diagnostic (e.g. "multiple rules generate X")
-            # flags a generator bug; the skip branch would otherwise
-            # swallow it forever
-            _LOGGER.warning("ninja: %s", probe.stderr.strip())
-        if probe.returncode != 0:
-            # An unknown target here is the defective-manifest case; fall
-            # through to the real build so the error prints attributably
-            _LOGGER.debug("ninja probe failed; running the full build")
-        skip_build = probe.returncode == 0 and "no work to do" in probe.stdout
-    if skip_build:
-        _LOGGER.debug("ninja: nothing to rebuild")
-    else:
-        _LOGGER.debug("Running: %s", " ".join(cmd))
-        rc = subprocess.run(
-            cmd, cwd=build_dir, env=env, check=False, close_fds=False
-        ).returncode
-        if rc != 0:
-            return rc
-
-    # ninja already refused a manifest missing the explicit targets above;
-    # existence covers the remaining hole (a rule that ran but wrote
-    # elsewhere). The factory/ota copies are what upload and OTA consume.
-    build_dir_artifacts = (
-        get_elf_path(),
-        build_dir / "firmware.bin",
-        get_factory_firmware_path(),
-        build_dir / "firmware.ota.bin",
-    )
-    for artifact in build_dir_artifacts:
-        if not artifact.is_file():
-            _LOGGER.error("Build produced no %s", artifact)
-            return 1
-
-    if not _print_size_summary(build_dir, paths):
-        # The cause was already warned; name the consequence so a build
-        # contributing no RAM/Flash metric is visible to CI harnesses
-        _LOGGER.warning("Firmware size summary unavailable for this build")
-    from esphome.build_helpers.idedata import warn_if_idedata_missing
-
-    warn_if_idedata_missing(lambda: get_idedata(ccache))
-    return 0
-
-
-def _write_compile_commands(
-    ninja_path: Path, build_dir: Path, env: dict[str, str]
-) -> None:
-    compdb = build_dir / "compile_commands.json"
-    result = subprocess.run(
-        [str(ninja_path), "-C", str(build_dir), "-t", "compdb", "c", "cxx", "asm"],
-        env=env,
-        capture_output=True,
-        text=True,
-        check=False,
-        close_fds=False,
-    )
-    if result.returncode != 0:
-        # Drop any stale database so consumers (IDE integration, clang-tidy,
-        # the memory analyzer) can't silently read outdated data.
-        compdb.unlink(missing_ok=True)
-        raise EsphomeError(f"Could not generate compile_commands.json: {result.stderr}")
-    try:
-        entries = json.loads(result.stdout)
-    except ValueError as err:
-        compdb.unlink(missing_ok=True)
-        raise EsphomeError(
-            f"ninja produced an unparsable compile database: {err} "
-            f"(output starts {result.stdout[:120]!r})"
-        ) from err
-    if not entries:
-        # compdb exits 0 with [] for unknown rule names; a renamed compile
-        # rule must fail the build, not silently strand every consumer
-        compdb.unlink(missing_ok=True)
-        raise EsphomeError(
-            "ninja produced an empty compile database; the generator's rule "
-            "names no longer match"
-        )
-    # write_file_if_changed keeps the mtime stable on no-op builds so the
-    # idedata cache in get_idedata() stays valid.
-    write_file_if_changed(compdb, result.stdout)
-
-
-def _parse_app_size(build_dir: Path, paths: framework.InstalledPaths) -> int | None:
-    """Read the app flash budget (irom0_0_seg length) from the linker script."""
-    from esphome.build_gen.arduino8266 import get_flash_ld_path
-    from esphome.components.esp8266.build_surgery import segment_length
-
-    # Warnings, not debug: without the app size the Flash summary line is
-    # dropped and CI's memory-impact extraction loses its flash metric.
-    ld_path = get_flash_ld_path(build_dir, paths)
-    try:
-        ld_text = ld_path.read_text(encoding="utf-8")
-    except (OSError, UnicodeDecodeError) as err:
-        # UnicodeDecodeError: a truncated/corrupt script must degrade to
-        # the same warning, never abort an already-linked build
-        _LOGGER.warning("Cannot read linker script for the Flash summary: %s", err)
-        return None
-    app_size = segment_length(ld_text, "irom0_0_seg")
-    if app_size is None:
-        _LOGGER.warning("irom0_0_seg not found in %s; skipping Flash summary", ld_path)
-        return None
-    if app_size == 0:
-        _LOGGER.warning(
-            "irom0_0_seg has zero length in %s; skipping Flash summary", ld_path
-        )
-        return None
-    return app_size
-
-
-def _print_size_summary(build_dir: Path, paths: framework.InstalledPaths) -> bool:
-    """Print the PlatformIO-shaped RAM/Flash lines; False when skipped.
-
-    The exact shape (including the bar) is parsed by
-    ``script/ci_memory_impact_extract.py``; ``print_size_line`` matches it.
-    """
-    from esphome.build_helpers.size_summary import print_size_line
-
-    size_tool = _toolchain_tool("size")
-    try:
-        result = subprocess.run(
-            [str(size_tool), "-A", "-d", str(get_elf_path())],
-            capture_output=True,
-            text=True,
-            check=False,
-            close_fds=False,
-        )
-    except OSError as err:
-        # The summary is a bonus artifact like idedata; a truncated
-        # toolchain extraction must not discard an already-linked build
-        _LOGGER.warning("Could not summarize firmware size: %s", err)
-        return False
-    if result.returncode != 0:
-        _LOGGER.warning("Could not summarize firmware size: %s", result.stderr)
-        return False
-    sections: dict[str, int] = {}
-    for line in result.stdout.splitlines():
-        parts = line.split()
-        if len(parts) >= 2 and parts[0].startswith("."):
-            try:
-                sections[parts[0]] = int(parts[1])
-            except ValueError:
-                # An unparsed RAM/Flash section trips the missing-sections
-                # guard below, so no total is built on a dropped value
-                _LOGGER.warning("Unparsable size output for section %s", parts[0])
-    if missing := set(_RAM_SECTIONS + _FLASH_SECTIONS) - set(sections):
-        # A defaulted 0 would print a confidently wrong total for CI's metric
-        _LOGGER.warning(
-            "Size output is missing section(s) %s; skipping the size summary",
-            ", ".join(sorted(missing)),
-        )
-        return False
-    # Resolve the flash budget before printing anything: a RAM line without
-    # its Flash line would let CI's memory-impact extraction sum the two
-    # metrics over different build counts (_parse_app_size already warned).
-    app_size = _parse_app_size(build_dir, paths)
-    if not app_size:
-        return False
-    ram = sum(sections[s] for s in _RAM_SECTIONS)
-    flash = sum(sections[s] for s in _FLASH_SECTIONS)
-    print_size_line("RAM", ram, _MAX_RAM_SIZE)
-    print_size_line("Flash", flash, app_size)
-    return True
-
-
-# Sentinel: "resolve for me"; None is a real value meaning disabled.
-_CCACHE_UNRESOLVED: Any = object()
-
-
-def get_idedata(ccache: str | None = _CCACHE_UNRESOLVED) -> dict | None:
-    """Derive idedata from the build's compile_commands.json.
-
-    Same contract as ``espidf.toolchain.get_idedata``: the fields IDE
-    integrations, clang-tidy, and the memory analyzer expect.
-    """
-    from esphome.build_helpers.idedata import load_or_build_idedata
-
-    if ccache is _CCACHE_UNRESOLVED:
-        # Deliberately uncached: env/PATH can change between builds in a
-        # long-lived host process
-        ccache = resolve_ccache_path()
-    return load_or_build_idedata(
-        get_build_dir() / "compile_commands.json",
-        get_elf_path(),
-        # Suffixed so a platformio->arduino->platformio round trip on one
-        # config never serves the other toolchain's cache shape
-        CORE.relative_internal_path("idedata", f"{CORE.name}.arduino.json"),
-        # The compile DB's commands carry the same ccache prefix the ninja
-        # rules were generated with
-        launcher=str(ccache) if ccache else None,
-    )

esphome/build_gen/build_tool.py

@@ -6,7 +6,6 @@ started esphome and must not depend on the package being importable.
 Subcommands:
     ar <ar-binary> <archive> <rspfile>   remove stale archive, then ``ar rcs``
     copy <src> <dst>                     copy a file
-    touch <path>                         create/update a stamp file
 
 The ar rspfile carries one object path per line (the generating rule must
 use ``$in_newline``, never ``$in``).
@@ -84,18 +83,9 @@ def _run_copy(src: str, dst: str) -> int:
     return 0
 
 
-def _run_touch(path: str) -> int:
-    try:
-        Path(path).touch()
-    except OSError as err:
-        print(f"touch: {path} failed: {err}", file=sys.stderr)
-        return 1
-    return 0
-
-
 # mode -> (handler, expected operand count); surplus argv means a
 # mis-specified ninja rule and must error, not silently drop operands
-_MODES = {"ar": (_run_ar, 3), "copy": (_run_copy, 2), "touch": (_run_touch, 1)}
+_MODES = {"ar": (_run_ar, 3), "copy": (_run_copy, 2)}
 
 
 def main() -> int:

esphome/build_gen/espidf.py

@@ -4,14 +4,6 @@ import json
 import logging
 from pathlib import Path
 
-from esphome.build_helpers import pch
-from esphome.build_helpers.pch import (
-    PCH_DEFAULT_HEADERS,
-    PCH_HEADER_NAME,
-    mark_pch_emitted,
-    pch_enabled,
-    pch_header_text,
-)
 from esphome.components.esp32 import (
     get_esp32_variant,
     get_excluded_builtin_components,
@@ -287,47 +279,7 @@ idf_component_register(
 target_link_options(${{COMPONENT_LIB}} PUBLIC
     {link_opts_str}
 )
-{_pch_cmake()}"""
-
-
-def _pch_cmake() -> str:
-    """Consumer block for the component CMakeLists. Baked at generation:
-    a strict-knob flip takes effect on the next esphome compile; a
-    hand-run idf.py keeps the old one."""
-    return pch.pch_cmake_consumer("${COMPONENT_LIB}", "${app_sources}")
-
-
-def prepare_pch() -> None:
-    """Build the .gch right before ninja, after every reconfigure, so the
-    compile_commands.json flags and the sdkconfig are the settled ones."""
-    if not pch_enabled():
-        # Self-cleaning escape hatch: drop any previously built .gch
-        pch.discard_pch(CORE.relative_build_path("build"))
-        pch.pch_disabled_degraded()
-        return
-    sdkconfig_path = CORE.relative_build_path(f"sdkconfig.{CORE.name}")
-    try:
-        sdkconfig = sdkconfig_path.read_text(encoding="utf-8")
-    except OSError as err:
-        # Fail closed: the sdkconfig is the .sum's only config identity for
-        # sdkconfig.h-only options; a stand-in marker would collide
-        _LOGGER.warning(
-            "Could not read %s; compiling without the pch: %s", sdkconfig_path, err
-        )
-        pch.discard_pch(CORE.relative_build_path("build"))
-        pch.pch_degraded(f"sdkconfig unreadable: {err}")
-        return
-    pch.prepare_pch(
-        CORE.relative_build_path("build"),
-        PCH_DEFAULT_HEADERS,
-        (
-            str(idf_version()),
-            CORE.cpp_standard or "",
-            sdkconfig,
-            *get_project_compile_flags(),
-            *get_project_cxx_compile_flags(),
-        ),
-    )
+"""
 
 
 def write_project(
@@ -349,14 +301,6 @@ def write_project(
         get_component_cmakelists(),
     )
 
-    if pch_enabled():
-        write_file_if_changed(
-            CORE.relative_build_path("build", PCH_HEADER_NAME),
-            pch_header_text(PCH_DEFAULT_HEADERS),
-        )
-        # Consumers carry the -include; gate the ccache relaxation on it
-        mark_pch_emitted()
-
     # Snapshot the exclusion set so has_outdated_files() can trigger a
     # discovery reconfigure when it changes. Excluded components never
     # register in project_description.json, so re-including one (e.g. a

esphome/build_helpers/ccache.py

@@ -21,13 +21,12 @@ def _ccache_runs(ccache: str) -> bool:
     )
 
 
-def parse_enable_env(name: str, strict: bool = False) -> bool | None:
+def parse_enable_env(name: str) -> bool | None:
     """Strictly parse an on/off environment knob; None when unset or invalid.
 
     ``bool(str)`` truthiness would flip ``no``/``off`` to enabled, so only
     1/true/yes/on and 0/false/no/off count; anything else warns and reads
-    as unset so the caller's default policy applies — or raises when
-    ``strict`` (a typo must not silently disable a CI gate).
+    as unset so the caller's default policy applies.
     """
     raw = os.environ.get(name)
     if raw is None:
@@ -40,10 +39,6 @@ def parse_enable_env(name: str, strict: bool = False) -> bool | None:
         return True
     if lowered in FALSY_ENV_STRINGS:
         return False
-    if strict:
-        from esphome.core import EsphomeError
-
-        raise EsphomeError(f"Unrecognized {name}={raw!r}; use 1 or 0")
     _LOGGER.warning("Ignoring unrecognized %s=%r; use 1 or 0", name, raw)
     return None
 
@@ -92,19 +87,6 @@ def ccache_defaults_env(cache_dir: Path) -> dict[str, str]:
         "CCACHE_DIR": str(cache_dir),
         "CCACHE_NOHASHDIR": "true",
         "CCACHE_DEPEND": "1",
-        # A user value wins via the filter below
-        "CCACHE_BASEDIR": effective_ccache_basedir(),
+        "CCACHE_BASEDIR": str(Path(CORE.build_path).resolve()),
     }
     return {k: v for k, v in defaults.items() if k not in os.environ}
-
-
-def effective_ccache_basedir() -> str:
-    """The prefix ccache rewrites out of hashed paths: a user CCACHE_BASEDIR
-    wins, else the resolved build path (matching ccache_defaults_env)."""
-    from esphome.core import CORE
-
-    raw = os.environ.get("CCACHE_BASEDIR")
-    if raw is not None and Path(raw).is_absolute() and len(Path(raw).parts) > 1:
-        return raw
-    # Unset or degenerate ("", "/", relative): fall back to the build path
-    return str(Path(CORE.build_path).resolve())

esphome/build_helpers/idedata.py

@@ -11,7 +11,6 @@ consumers (IDE integration, clang-tidy) expect:
 
 from __future__ import annotations
 
-from collections.abc import Callable
 import json
 import logging
 import os
@@ -22,8 +21,6 @@ import subprocess
 from esphome.core import EsphomeError
 from esphome.helpers import write_file
 
-_LOGGER = logging.getLogger(__name__)
-
 # Everything idedata generation may raise after a successful link; idedata
 # is a bonus artifact, so consumers warn instead of failing the build
 IDEDATA_BEST_EFFORT_ERRORS = (
@@ -34,36 +31,13 @@ IDEDATA_BEST_EFFORT_ERRORS = (
     ValueError,
 )
 
+_LOGGER = logging.getLogger(__name__)
 
-def warn_if_idedata_missing(get_idedata: Callable[[], dict | None]) -> None:
-    """Run an idedata generator, downgrading any failure to a warning.
-
-    Shared by the native backends: the firmware already built, so a missing
-    or broken idedata must not fail a successful build.
-    """
-    try:
-        if get_idedata() is None:
-            _LOGGER.warning("No idedata was generated for this build")
-    except IDEDATA_BEST_EFFORT_ERRORS as err:
-        _LOGGER.warning(
-            "Could not generate idedata: %s (IDE, clang-tidy, and "
-            "memory-analysis data will be unavailable for this build)",
-            err,
-        )
-        if isinstance(err, (EsphomeError, OSError)):
-            # Routine environmental failures keep the detail at debug
-            _LOGGER.debug("Idedata failure detail", exc_info=True)
-        else:
-            # LookupError/ValueError/RuntimeError smell like a parsing bug;
-            # a permanently masked traceback would hide it on every build
-            _LOGGER.warning("Idedata failure detail", exc_info=True)
-
-
-# C++ translation-unit suffixes.
-CXX_SOURCE_SUFFIXES = (".cpp", ".cc", ".cxx")
+# C++ translation-unit suffixes used to identify ESPHome source files.
+_CXX_SUFFIXES = (".cpp", ".cc")
 # Suffixes of input/output files that appear bare on the command line (and so
 # must not be mistaken for compiler flags).
-_INPUT_FILE_SUFFIXES = (*CXX_SOURCE_SUFFIXES, ".c", ".o", ".S", ".s")
+_INPUT_FILE_SUFFIXES = (*_CXX_SUFFIXES, ".c", ".o", ".S", ".s")
 # Path marker identifying an ESPHome source translation unit.
 _ESPHOME_SRC_MARKER = "/src/esphome/"
 
@@ -72,11 +46,11 @@ def _is_esphome_src(file: str) -> bool:
     """Whether ``file`` is an ESPHome C++ translation unit; normalized to
     ``/`` first since Windows compile DBs use backslashes."""
     return _ESPHOME_SRC_MARKER in file.replace("\\", "/") and file.endswith(
-        CXX_SOURCE_SUFFIXES
+        _CXX_SUFFIXES
     )
 
 
-def split_command(command: str) -> list[str]:
+def _split_command(command: str) -> list[str]:
     r"""Tokenize a compile_commands.json / response-file command string.
 
     On Windows, tokenize per Windows ``argv`` rules via ``CommandLineToArgvW``.
@@ -112,7 +86,7 @@ def split_command(command: str) -> list[str]:
         ctypes.windll.kernel32.LocalFree(argv)
 
 
-def expand_response_files(tokens: list[str], directory: Path) -> list[str]:
+def _expand_response_files(tokens: list[str], directory: Path) -> list[str]:
     """Inline any ``@response-file`` arguments (paths relative to ``directory``).
 
     GCC response files embed flags that must be expanded so GCC-only flags
@@ -127,8 +101,8 @@ def expand_response_files(tokens: list[str], directory: Path) -> list[str]:
                 rf = directory / rf
             try:
                 out.extend(
-                    expand_response_files(
-                        split_command(rf.read_text(encoding="utf-8")), directory
+                    _expand_response_files(
+                        _split_command(rf.read_text(encoding="utf-8")), directory
                     )
                 )
                 continue
@@ -147,7 +121,7 @@ def _pick_entry(entries: list[dict]) -> dict:
         if _is_esphome_src(entry["file"]):
             return entry
     for entry in entries:
-        if entry["file"].endswith(CXX_SOURCE_SUFFIXES):
+        if entry["file"].endswith(_CXX_SUFFIXES):
             return entry
     raise ValueError("no C++ translation unit found in compile_commands.json")
 
@@ -157,25 +131,16 @@ def _pick_entry(entries: list[dict]) -> dict:
 _LAUNCHER_STEMS = frozenset({"ccache", "sccache", "distcc", "icecc", "buildcache"})
 
 
-def is_launcher(token: str) -> bool:
+def _is_launcher(token: str) -> bool:
     return Path(token).stem.lower() in _LAUNCHER_STEMS
 
 
-def is_joined_include(tok: str) -> bool:
-    """The joined ``-includefoo.h`` spelling; excludes clang's -include-pch."""
-    return (
-        tok.startswith("-include")
-        and tok != "-include"
-        and not tok.startswith("-include-")
-    )
-
-
 def parse_entry(
     entry: dict, launcher: str | None = None
 ) -> tuple[str, list[str], list[str], list[str]]:
     """Parse one compile_commands entry -> (cxx_path, defines, includes, cxx_flags)."""
     directory = Path(entry["directory"])
-    tokens = expand_response_files(split_command(entry["command"]), directory)
+    tokens = _expand_response_files(_split_command(entry["command"]), directory)
 
     def _include(raw: str) -> str:
         # Resolve against the entry's ``directory`` so cached idedata works
@@ -191,7 +156,7 @@ def parse_entry(
     if not tokens:
         # An empty command, or one that was only the launcher; fail by name
         raise ValueError(f"empty compile command for {entry.get('file')}")
-    if is_launcher(tokens[0]) and len(tokens) > 1 and not tokens[1].startswith("-"):
+    if _is_launcher(tokens[0]) and len(tokens) > 1 and not tokens[1].startswith("-"):
         # Stale DB built with a launcher this run no longer configures; the
         # real compiler is the next token
         _LOGGER.warning("Stripping unconfigured launcher %s", tokens[0])
@@ -204,23 +169,11 @@ def parse_entry(
     defines: list[str] = []
     includes: list[str] = []
     cxx_flags: list[str] = []
-    unresolved_force_includes: list[str] = []
 
     it = iter(tokens[1:])
     for tok in it:
         if tok in ("-c", "-o"):
             next(it, None)  # drop the flag and its argument (input/output)
-        elif tok == "-include" or is_joined_include(tok):
-            # Re-anchor only names next to the compile (the pch); a name
-            # meant for the -I chain must stay untouched
-            raw = next(it, "") if tok == "-include" else tok[len("-include") :]
-            if not raw:
-                _LOGGER.warning("Dropping -include with no argument")
-            elif Path(resolved := _include(raw)).is_file():
-                cxx_flags.extend(("-include", resolved))
-            else:
-                unresolved_force_includes.append(raw)
-                cxx_flags.extend(("-include", raw))
         elif tok.startswith("-D"):
             # ``.strip()`` handles tokens like ``-D CONFIGURED=1`` (a single
             # quoted arg with a space after -D) that some flags arrive as.
@@ -239,14 +192,6 @@ def parse_entry(
             pass  # input/output files
         else:
             cxx_flags.append(tok)
-    for raw in unresolved_force_includes:
-        # A deleted build artifact would otherwise surface only downstream
-        if not any((Path(inc) / raw).is_file() for inc in includes):
-            _LOGGER.warning(
-                "-include %s found neither next to the compile nor on the "
-                "include path; cached idedata may not resolve it",
-                raw,
-            )
     return cxx_path, defines, includes, cxx_flags
 
 
@@ -311,7 +256,7 @@ def _cache_usable(cached: object) -> bool:
     if not isinstance(cached, dict) or "cc_path" not in cached:
         return False
     cxx_path = cached.get("cxx_path")
-    if not isinstance(cxx_path, str) or is_launcher(cxx_path):
+    if not isinstance(cxx_path, str) or _is_launcher(cxx_path):
         return False
     includes = cached.get("includes")
     return isinstance(includes, dict) and isinstance(includes.get("build"), list)
@@ -359,7 +304,7 @@ def load_or_build_idedata(
 def reject_launcher_compiler(cxx_path: str) -> None:
     """Reject a compile DB naming a launcher (ccache) as the compiler; it
     must never be probed, cached, or consumed."""
-    if is_launcher(cxx_path):
+    if _is_launcher(cxx_path):
         raise EsphomeError(
             f"compile_commands.json names the launcher {cxx_path} as the "
             "compiler; the compile database is unusable"

esphome/build_helpers/pch.py

@@ -1,624 +0,0 @@
-"""Shared precompiled-header policy for the build backends.
-
-The prefix either mirrors the TUs' own force-includes (ESP8266) or is a
-curated core-header set (ESP-IDF). ``esphome: includes:`` sources receive
-it too; Arduino.h visibility there is intended (esphome#8693).
-"""
-
-from __future__ import annotations
-
-from collections.abc import Callable, Iterable
-from contextlib import suppress
-from dataclasses import dataclass
-import hashlib
-import json
-import logging
-import os
-from pathlib import Path
-import posixpath
-import re
-import stat
-import subprocess
-
-from esphome.build_helpers.ccache import effective_ccache_basedir, parse_enable_env
-from esphome.build_helpers.idedata import (
-    CXX_SOURCE_SUFFIXES,
-    expand_response_files,
-    is_launcher,
-    split_command,
-)
-
-_DOMAIN = "pch"
-
-
-@dataclass
-class _PCHData:
-    emitted: bool = False
-
-
-def _pch_data() -> _PCHData:
-    from esphome.core import CORE
-
-    if _DOMAIN not in CORE.data:
-        CORE.data[_DOMAIN] = _PCHData()
-    return CORE.data[_DOMAIN]
-
-
-def mark_pch_emitted() -> None:
-    """Record that this build's consumers reference the pch."""
-    _pch_data().emitted = True
-
-
-_LOGGER = logging.getLogger(__name__)
-
-# The header and its .gch/.sum sidecars live in the build directory.
-PCH_HEADER_NAME = "esphome_pch.h"
-
-# Every artifact the pch machinery can leave behind, for cleanup.
-PCH_ARTIFACT_NAMES = (
-    PCH_HEADER_NAME,
-    f"{PCH_HEADER_NAME}.gch",
-    f"{PCH_HEADER_NAME}.gch.sum",
-    f"{PCH_HEADER_NAME}.gch.failed",
-)
-
-# The core defines header every backend anchors its prefix on.
-PCH_CORE_HEADER = "esphome/core/defines.h"
-
-# Guarded curated-prefix wrapper for PlatformIO backends without framework
-# force-includes (host, esp32); folded by the pch script via build_src_flags.
-PCH_PREFIX_HEADER = "esphome/core/pch_prefix.h"
-
-# Prefix-header contents for backends that inject a curated set (rather
-# than mirroring the TUs' own force-includes), defines.h first so USE_*
-# macros exist for the rest. Deliberately hard-coded: frequency-derived
-# sets measured no better and kept selecting headers that cannot compile
-# standalone (X-macro, platform-variant). Every entry must be safe to
-# include first in an empty TU. Caveat: application.h/automation.h become
-# ambiently visible, so a TU missing those #includes still builds on such
-# backends; ESPHOME_PCH_ENABLE=0 restores the strict view.
-PCH_DEFAULT_HEADERS = (
-    PCH_CORE_HEADER,
-    "esphome/core/component.h",
-    "esphome/core/helpers.h",
-    "esphome/core/log.h",
-    "esphome/core/application.h",
-    "esphome/core/automation.h",
-)
-
-# ccache cannot hash through a .gch; CCACHE_PCH_EXTSUM makes it hash the
-# .sum sidecar instead of the .gch bytes, which are not reproducible.
-# Keep in sync with the literals in platformio/pch.py.script.
-_CCACHE_PCH_ENV = {
-    "CCACHE_SLOPPINESS": "pch_defines,time_macros",
-    "CCACHE_PCH_EXTSUM": "true",
-}
-
-# Both include forms: an angle include resolving under src/ must enter the
-# digest too; ones that do not resolve simply end the walk
-# Compiler failures that clear on their own must not latch the .failed marker
-_TRANSIENT_ERRORS = ("No space left", "Cannot allocate", "Resource temporarily")
-
-_INCLUDE_RE = re.compile(rb'^\s*#\s*include\s+["<]([^">]+)[">]', re.MULTILINE)
-
-
-def pch_enabled() -> bool:
-    """Precompiled-header knob: default on, ``ESPHOME_PCH_ENABLE=0`` opts out."""
-    return parse_enable_env("ESPHOME_PCH_ENABLE") is not False
-
-
-def pch_strict() -> bool:
-    """CI knob: ``ESPHOME_PCH_STRICT=1`` turns pch degrade paths fatal.
-
-    A set-but-unrecognized value raises: a typo must not silently turn
-    the gate into a no-op that proves nothing.
-    """
-    return parse_enable_env("ESPHOME_PCH_STRICT", strict=True) is True
-
-
-def pch_degraded(reason: str) -> None:
-    """Every degrade path funnels through here; strict mode raises."""
-    if pch_strict():
-        from esphome.core import EsphomeError
-
-        raise EsphomeError(f"ESPHOME_PCH_STRICT: {reason}")
-
-
-def pch_disabled_degraded() -> None:
-    """Strict CI must not read "no pch at all" as success."""
-    pch_degraded("pch disabled by ESPHOME_PCH_ENABLE")
-
-
-def pch_probe_tail(source: str = "-") -> list[str]:
-    """The syntax-only compile shared by the probe and its baseline."""
-    return ["-fsyntax-only", "-x", "c++", source]
-
-
-def pch_probe_args(header: str, source: str = "-") -> list[str]:
-    """Flags that load-check a built .gch via a syntax-only compile.
-
-    Rejection must be a nonzero exit (never just a wording match), so the
-    invalid-pch class is always escalated. ``source`` defaults to stdin
-    (host independent); the ninja probe edge passes a real file.
-    """
-    return [
-        "-Winvalid-pch",
-        "-Werror=invalid-pch",
-        "-include",
-        header,
-        *pch_probe_tail(source),
-    ]
-
-
-def pch_consumer_escalation() -> str:
-    """Consumer-side invalid-pch flag: strict reds the build on rejection
-    (per-process, so the probe alone cannot prove the consumers)."""
-    return "-Werror=invalid-pch" if pch_strict() else "-Wno-error=invalid-pch"
-
-
-def pch_cmake_consumer(target: str, sources_var: str) -> str:
-    """Emit the CMake block making ``target``'s C++ sources consume the
-    pch; empty when disabled. OBJECT_DEPENDS is on the header, not the
-    .gch (pch-baked headers drop out of TU depfiles); the -include stays
-    relative — an absolute path would poison ccache keys."""
-    if not pch_enabled():
-        return ""
-    escalation = pch_consumer_escalation()
-    return f"""
-# ESPHome precompiled header (see esphome/build_helpers/pch.py).
-# The touch keeps OBJECT_DEPENDS satisfiable when the build system itself
-# wiped the build dir after the header was written (west --pristine)
-if(NOT EXISTS "${{CMAKE_BINARY_DIR}}/{PCH_HEADER_NAME}")
-  file(TOUCH "${{CMAKE_BINARY_DIR}}/{PCH_HEADER_NAME}")
-endif()
-target_compile_options({target} PRIVATE
-    "$<$<COMPILE_LANGUAGE:CXX>:-Winvalid-pch>"
-    "$<$<COMPILE_LANGUAGE:CXX>:{escalation}>"
-    "$<$<COMPILE_LANGUAGE:CXX>:-include>"
-    "$<$<COMPILE_LANGUAGE:CXX>:{PCH_HEADER_NAME}>"
-)
-set_source_files_properties({sources_var} PROPERTIES
-    OBJECT_DEPENDS "${{CMAKE_BINARY_DIR}}/{PCH_HEADER_NAME}")
-"""
-
-
-def ccache_pch_env() -> dict[str, str]:
-    """Settings ccache needs to cache compiles that consume the .gch;
-    empty unless this build actually emitted one. User-set values win.
-    Native backends export these process-wide; only time_macros affects
-    non-pch TUs."""
-    if not (pch_enabled() and _pch_data().emitted):
-        return {}
-    extsum = os.environ.get("CCACHE_PCH_EXTSUM")
-    if extsum is not None and extsum.strip().lower() not in ("1", "true", "yes", "on"):
-        # ccache then hashes the non-reproducible .gch bytes: permanent misses
-        _LOGGER.warning("CCACHE_PCH_EXTSUM=%s disables pch caching", extsum)
-    env = {k: v for k, v in _CCACHE_PCH_ENV.items() if k not in os.environ}
-    user_sloppiness = os.environ.get("CCACHE_SLOPPINESS")
-    if user_sloppiness is not None and (
-        missing := [
-            t
-            for t in ("pch_defines", "time_macros")
-            if t not in {tok.strip() for tok in user_sloppiness.split(",")}
-        ]
-    ):
-        # Without these ccache declines every pch-consuming compile
-        env["CCACHE_SLOPPINESS"] = ",".join((user_sloppiness, *missing))
-        _LOGGER.warning(
-            "Adding %s to CCACHE_SLOPPINESS so ccache can cache compiles "
-            "that use the precompiled header",
-            ",".join(missing),
-        )
-    return env
-
-
-def guarded_prepare(build_dir: Path, prepare: Callable[[], None]) -> None:
-    """Run a backend's pch preparation; an optional speedup must never
-    abort the build. Strict is read first so its own knob error cannot
-    mask the real failure; discard_pch raises if a stale .gch survives;
-    the header is ensured so OBJECT_DEPENDS stays satisfiable."""
-    try:
-        prepare()
-    except Exception:  # noqa: BLE001  # pylint: disable=broad-exception-caught
-        strict = pch_strict()
-        discard_pch(build_dir)
-        if strict:
-            raise
-        header = build_dir / PCH_HEADER_NAME
-        if not header.exists():
-            try:
-                header.touch()
-            except OSError as err:
-                # The coming OBJECT_DEPENDS error would hide the real cause
-                _LOGGER.warning("Could not create the pch placeholder: %s", err)
-        _LOGGER.warning(
-            "Precompiled header setup failed; compiling without it", exc_info=True
-        )
-
-
-def pch_extra_scripts() -> list[str]:
-    """The extra_scripts entries a PlatformIO platform registers for the
-    pch; empty when disabled (the script itself has no enable check)."""
-    if not pch_enabled():
-        pch_disabled_degraded()
-        return []
-    return ["post:pch.py"]
-
-
-def pch_header_text(include_headers: Iterable[str]) -> str:
-    """The prefix-header source: exactly these includes, in order."""
-    return "".join(f'#include "{name}"\n' for name in include_headers)
-
-
-def _resolves(path: Path) -> bool:
-    """False when missing; other stat failures propagate (identity unknown,
-    unlike is_file(), which would silently drop the header)."""
-    try:
-        return stat.S_ISREG(path.stat().st_mode)
-    except (FileNotFoundError, NotADirectoryError):
-        return False
-
-
-def _include_closure(src_dir: Path, roots: Iterable[str]) -> dict[str, bytes]:
-    """Include closure of ``roots``: src-relative name -> contents.
-
-    Resolution mirrors the compiler (includer's dir, then src root); names
-    outside ``src_dir`` end the walk and are versioned by the caller. No
-    #ifdef evaluation: over-approximating is the safe direction.
-    """
-    seen: dict[str, bytes] = {}
-    stack: list[tuple[str, str]] = [(name, "") for name in roots]
-    while stack:
-        name, from_dir = stack.pop()
-        for candidate in (f"{from_dir}/{name}" if from_dir else name, name):
-            rel = posixpath.normpath(candidate)
-            if not rel.startswith("..") and _resolves(src_dir / rel):
-                break
-        else:
-            continue
-        if rel in seen:
-            continue
-        try:
-            data = (src_dir / rel).read_bytes()
-        except OSError as err:
-            # A marker would truncate the transitive walk; fail closed
-            _LOGGER.warning("Could not read %s for the pch checksum: %s", rel, err)
-            raise
-        seen[rel] = data
-        parent = posixpath.dirname(rel)
-        stack.extend(
-            # surrogateescape: a non-UTF-8 name just fails to resolve
-            (inc.decode(errors="surrogateescape"), parent)
-            for inc in _INCLUDE_RE.findall(data)
-        )
-    return seen
-
-
-def pch_checksum(
-    src_dir: Path, include_headers: Iterable[str], extra: Iterable[str]
-) -> str:
-    """Digest standing in for the .gch in ccache's hash: the include closure
-    of the prefix header plus caller-supplied identity strings (versioned
-    install paths, flags). Raises OSError when a header's identity cannot
-    be established at all; callers must then compile without a pch."""
-    digest = hashlib.sha256()
-    closure = _include_closure(src_dir, include_headers)
-    for name in sorted(closure):
-        digest.update(name.encode(errors="surrogateescape"))
-        digest.update(closure[name])
-        digest.update(b"\0")
-    for item in extra:
-        digest.update(item.encode(errors="surrogateescape"))
-        digest.update(b"\0")
-    return digest.hexdigest()
-
-
-# Tokens dropped when retargeting a TU's flags at the prefix header
-# (the pch compile must not touch depfiles)
-_PCH_STRIP_FLAGS_WITH_ARG = frozenset({"-o", "-c", "-MT", "-MF", "-MQ"})
-_PCH_STRIP_FLAGS = frozenset({"-MD", "-MMD", "-MP", "-MM", "-M"})
-
-
-def pch_compile_command(
-    build_dir: Path, header: Path, gch: Path
-) -> tuple[list[str], Path] | None:
-    """The exact src C++ flags from compile_commands.json retargeted at the
-    header, with the directory they resolve against (relative -I paths must
-    be expanded and executed from the same root); None (logged) when no
-    configured C++ TU is available yet."""
-    from esphome.core import CORE
-
-    try:
-        entries = json.loads(
-            (build_dir / "compile_commands.json").read_text(encoding="utf-8")
-        )
-    except (OSError, json.JSONDecodeError) as err:
-        # Configure already succeeded, so an unusable DB is a real anomaly
-        _LOGGER.warning("No usable compile database, skipping pch: %s", err)
-        return None
-    if not isinstance(entries, list):
-        _LOGGER.warning("Malformed compile database, skipping pch")
-        return None
-    # CMake may spell paths through a symlink differently than CORE does
-    # (macOS /tmp vs /private/tmp), so compare resolved paths
-    src_root = Path(CORE.relative_src_path()).resolve()
-    entry = next(
-        (
-            e
-            for e in entries
-            if isinstance(e, dict)
-            and isinstance(e.get("file"), str)
-            and e["file"].endswith(CXX_SOURCE_SUFFIXES)
-            and Path(e["file"]).resolve().is_relative_to(src_root)
-        ),
-        None,
-    )
-    if entry is None:
-        _LOGGER.warning("No src C++ entry in the compile database, skipping pch")
-        return None
-    directory = entry.get("directory")
-    cmd_dir = Path(directory) if isinstance(directory, str) and directory else build_dir
-    command = entry.get("command")
-    tokens = expand_response_files(
-        split_command(command if isinstance(command, str) else ""), cmd_dir
-    )
-    # A DB recorded with ccache enabled prefixes the compiler with the
-    # launcher; the .gch must be compiled directly
-    if tokens and is_launcher(tokens[0]):
-        tokens = tokens[1:]
-    if not tokens:
-        # "arguments"-style or empty entries must skip, not spawn "-x ..."
-        _LOGGER.warning("Compile database entry has no usable command, skipping pch")
-        return None
-    args: list[str] = []
-    arg_it = iter(tokens)
-    for tok in arg_it:
-        if tok in _PCH_STRIP_FLAGS_WITH_ARG:
-            next(arg_it, None)
-            continue
-        if tok in _PCH_STRIP_FLAGS:
-            continue
-        if tok == "-include":
-            # Drop only the injected prefix; user force-includes must reach
-            # the .gch compile or GCC rejects it over the macro mismatch
-            inc = next(arg_it, "")
-            if not inc.endswith(PCH_HEADER_NAME):
-                args.extend(("-include", inc))
-            continue
-        args.append(tok)
-    return [*args, "-x", "c++-header", "-c", str(header), "-o", str(gch)], cmd_dir
-
-
-def _flags_identity(tokens: Iterable[str]) -> str:
-    """Flag string normalized for digest use: strip like ccache's rewriting
-    (user CCACHE_BASEDIR wins); the raw build path covers unresolved
-    (symlinked) spellings."""
-    from esphome.core import CORE
-
-    return (
-        " ".join(tokens)
-        .replace(effective_ccache_basedir(), "")
-        .replace(str(CORE.build_path), "")
-    )
-
-
-def pch_identity(
-    tokens: Iterable[str],
-    src_dir: Path,
-    include_headers: tuple[str, ...],
-    extra: Iterable[str],
-) -> str | None:
-    """The .sum digest naming this exact pch build: include closure, header
-    text, backend identity strings, and the normalized compile command or
-    flags (``tokens``). None (warned and degraded) when the identity
-    cannot be established."""
-    try:
-        return pch_checksum(
-            src_dir,
-            include_headers,
-            (
-                # The closure is sorted, so root order only enters via the text
-                pch_header_text(include_headers),
-                *extra,
-                _flags_identity(tokens),
-            ),
-        )
-    except (OSError, UnicodeError) as err:
-        # Identity unknown: a stale cache entry must never be served
-        _LOGGER.warning(
-            "Could not establish the pch identity; compiling without it: %s", err
-        )
-        pch_degraded(f"identity unknown: {err}")
-        return None
-
-
-def log_pch_in_use() -> None:
-    # The only place a user can discover the knob; emitted only once a
-    # .gch is actually fresh or being built
-    _LOGGER.info(
-        "Compiling with a precompiled header (set ESPHOME_PCH_ENABLE=0 to disable)"
-    )
-
-
-def _read_stamp(path: Path) -> str:
-    """A corrupt sidecar must read as stale, not kill the pch forever."""
-    try:
-        return path.read_text(encoding="utf-8").strip()
-    except (OSError, UnicodeDecodeError):
-        return ""
-
-
-def discard_pch(build_dir: Path) -> None:
-    """Remove the pch sidecars so a stale .gch is never consumed.
-
-    Bumps the header only when a .gch was actually removed: TUs compiled
-    against it have incomplete depfiles, while a repeat failure with no
-    .gch must not force a full rebuild every build. A .gch that survives
-    an unlink failure would be consumed silently (wrong output, not a
-    slow build), so that raises.
-    """
-    header = build_dir / PCH_HEADER_NAME
-    gch = Path(f"{header}.gch")
-    had_gch = gch.is_file()
-    errors = []
-    for sidecar in (gch, Path(f"{gch}.sum")):
-        try:
-            sidecar.unlink(missing_ok=True)
-        except OSError as err:
-            if sidecar.is_file():
-                from esphome.core import EsphomeError
-
-                raise EsphomeError(
-                    f"Could not discard the stale precompiled header: {err}"
-                ) from err
-            errors.append(err)
-    for err in errors:
-        _LOGGER.warning("Could not discard the pch sidecars: %s", err)
-    if had_gch and header.is_file():
-        with suppress(OSError):
-            os.utime(header)
-
-
-def prepare_pch(
-    build_dir: Path, include_headers: tuple[str, ...], extra: Iterable[str]
-) -> None:
-    """Compile ``build_dir``'s .gch from compile_commands.json flags and
-    write its ccache .sum.
-
-    The .sum doubles as the freshness stamp and folds in the compile
-    command, so a flag-only change rebuilds the .gch; ``extra`` carries
-    backend identity (framework version, sdkconfig, ...). A failed
-    compile falls back to the plain header include.
-    """
-    from esphome.core import CORE
-
-    header = build_dir / PCH_HEADER_NAME
-    gch = Path(f"{header}.gch")
-    sum_path = Path(f"{gch}.sum")
-    cmd_and_dir = pch_compile_command(build_dir, header, gch)
-    if cmd_and_dir is None:
-        # Freshness cannot be validated; a leftover .gch must not be consumed
-        discard_pch(build_dir)
-        pch_degraded("no usable compile command")
-        return
-    cmd, cmd_dir = cmd_and_dir
-    checksum = pch_identity(cmd, CORE.relative_src_path(), include_headers, extra)
-    if checksum is None:
-        discard_pch(build_dir)
-        return
-    failed_marker = Path(f"{gch}.failed")
-
-    def _run(
-        run_cmd: list[str], what: str, stdin: str | None = None
-    ) -> subprocess.CompletedProcess | None:
-        """Spawn one pch tool step; environmental failures discard and
-        degrade (None): spawn/IO/timeout errors and signal kills never
-        latch the marker."""
-        try:
-            proc = subprocess.run(
-                run_cmd,
-                cwd=cmd_dir,
-                # C locale keeps diagnostics matchable by _TRANSIENT_ERRORS
-                env={**os.environ, "LC_ALL": "C"},
-                input=stdin,
-                capture_output=True,
-                text=True,
-                check=False,
-                timeout=300,
-            )
-        except (OSError, subprocess.SubprocessError) as err:
-            _LOGGER.warning("Precompiled header %s did not run: %s", what, err)
-            discard_pch(build_dir)
-            pch_degraded(f"{what} did not run: {err}")
-            return None
-        if proc.returncode < 0:
-            # Killed by a signal (OOM, ^C): environmental, do not latch
-            _LOGGER.warning(
-                "Precompiled header %s was killed (signal %d); retrying next build",
-                what,
-                -proc.returncode,
-            )
-            discard_pch(build_dir)
-            pch_degraded(f"{what} killed by signal {-proc.returncode}")
-            return None
-        return proc
-
-    def _fail(error: str, reason: str, latch: bool) -> None:
-        """Discard and degrade; deterministic failures latch when asked."""
-        _LOGGER.warning(
-            "Precompiled header failed; compiling without it: %s", error[:400]
-        )
-        # Latching paths keep the full compiler output recoverable
-        _LOGGER.debug("Full pch output: %s", error)
-        discard_pch(build_dir)
-        if latch and not any(m in error for m in _TRANSIENT_ERRORS):
-            # Skip retries until a header/flag/backend-identity/command change
-            failed_marker.write_text(checksum + "\n", encoding="utf-8")
-            os.utime(header)
-        pch_degraded(f"{reason}: {error[:200]}")
-
-    def _probe(latch: bool = True) -> None:
-        """Load-check the built .gch: some toolchains build one they then
-        refuse to load (per-process ASLR). Dep flags are already stripped
-        from cmd, so no -MF is needed; cmd ends with the fixed
-        "-x c++-header -c -o" tail. A cached-header rejection may not
-        reproduce (per-process), so that caller passes latch=False."""
-        if cmd[-6:-4] != ["-x", "c++-header"]:
-            # The slice below depends on pch_compile_command's fixed tail
-            _LOGGER.warning("Unexpected pch command shape: %s", cmd[-6:])
-            discard_pch(build_dir)
-            pch_degraded("unexpected pch command shape")
-            return
-        base = cmd[:-6]
-        probe = _run([*base, *pch_probe_args(str(header))], "probe", stdin="")
-        if probe is None:
-            return
-        if probe.returncode != 0:
-            # Disambiguate: only blame the pch when the same compile passes
-            # without it; a failing baseline is its own (latchable) problem
-            baseline = _run([*base, *pch_probe_tail()], "probe baseline", stdin="")
-            if baseline is None:
-                return
-            if baseline.returncode == 0:
-                error = probe.stderr.strip() or f"exit code {probe.returncode}"
-                _fail(error, "toolchain cannot load the pch", latch=latch)
-            else:
-                error = baseline.stderr.strip() or f"exit code {baseline.returncode}"
-                _fail(error, "probe cannot run at all", latch=latch)
-
-    if gch.is_file() and _read_stamp(sum_path) == checksum:
-        log_pch_in_use()
-        if pch_strict():
-            # Rejection is per-process, so a cached .gch must re-prove
-            # loadability for the strict gate (CI-only cost); no latch,
-            # since the rejection may not reproduce either
-            _probe(latch=False)
-        return
-    if _read_stamp(failed_marker) == checksum:
-        _LOGGER.info(
-            "Precompiled header disabled after an earlier failure; delete %s to retry",
-            failed_marker,
-        )
-        pch_degraded("earlier failure latched")
-        return
-    log_pch_in_use()
-    result = _run(cmd, "compile")
-    if result is None:
-        return
-    error = None
-    if result.returncode != 0:
-        error = result.stderr.strip() or f"exit code {result.returncode}"
-    elif not gch.is_file():
-        error = "compiler produced no .gch"
-    if error is not None:
-        _fail(error, "compile failed", latch=True)
-        return
-    _probe()
-    if not gch.is_file():
-        # The probe discarded a rejected or unrunnable .gch
-        return
-    failed_marker.unlink(missing_ok=True)
-    sum_path.write_text(checksum + "\n", encoding="utf-8")
-    # Consumers depend on the header (depfiles cannot see through a .gch);
-    # bump it so users of the previous .gch recompile
-    os.utime(header)

esphome/codegen.py

@@ -78,6 +78,7 @@ from esphome.cpp_types import (  # noqa: F401
     StringRef,
     arduino_json_ns,
     bool_,
+    char,
     const_char_ptr,
     double,
     esphome_ns,

esphome/components/adc/__init__.py

@@ -13,6 +13,7 @@ from esphome.components.esp32 import (
     VARIANT_ESP32P4,
     VARIANT_ESP32S2,
     VARIANT_ESP32S3,
+    VARIANT_ESP32S31,
     get_esp32_variant,
 )
 import esphome.config_validation as cv
@@ -156,6 +157,17 @@ ESP32_VARIANT_ADC1_PIN_TO_CHANNEL = {
         9: adc_channel_t.ADC_CHANNEL_8,
         10: adc_channel_t.ADC_CHANNEL_9,
     },
+    # https://github.com/espressif/esp-idf/blob/master/components/soc/esp32s31/include/soc/adc_channel.h
+    VARIANT_ESP32S31: {
+        42: adc_channel_t.ADC_CHANNEL_0,
+        43: adc_channel_t.ADC_CHANNEL_1,
+        44: adc_channel_t.ADC_CHANNEL_2,
+        45: adc_channel_t.ADC_CHANNEL_3,
+        46: adc_channel_t.ADC_CHANNEL_4,
+        47: adc_channel_t.ADC_CHANNEL_5,
+        48: adc_channel_t.ADC_CHANNEL_6,
+        49: adc_channel_t.ADC_CHANNEL_7,
+    },
 }
 
 # pin to adc2 channel mapping
@@ -225,6 +237,17 @@ ESP32_VARIANT_ADC2_PIN_TO_CHANNEL = {
         19: adc_channel_t.ADC_CHANNEL_8,
         20: adc_channel_t.ADC_CHANNEL_9,
     },
+    # https://github.com/espressif/esp-idf/blob/master/components/soc/esp32s31/include/soc/adc_channel.h
+    VARIANT_ESP32S31: {
+        50: adc_channel_t.ADC_CHANNEL_0,
+        51: adc_channel_t.ADC_CHANNEL_1,
+        52: adc_channel_t.ADC_CHANNEL_2,
+        53: adc_channel_t.ADC_CHANNEL_3,
+        54: adc_channel_t.ADC_CHANNEL_4,
+        55: adc_channel_t.ADC_CHANNEL_5,
+        56: adc_channel_t.ADC_CHANNEL_6,
+        57: adc_channel_t.ADC_CHANNEL_7,
+    },
 }
 
 

esphome/components/adc/adc_sensor_esp32.cpp

@@ -74,9 +74,7 @@ void ADCSensor::setup() {
   if (this->calibration_handle_ == nullptr) {
     adc_cali_handle_t handle = nullptr;
 
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
-    // RISC-V variants (except C2) and S3 use curve fitting calibration
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED)
     adc_cali_curve_fitting_config_t cali_config = {};  // Zero initialize first
 #if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 3, 0)
     cali_config.chan = this->channel_;
@@ -94,7 +92,7 @@ void ADCSensor::setup() {
       ESP_LOGW(TAG, "Curve fitting calibration failed with error %d, will use uncalibrated readings", err);
       this->setup_flags_.calibration_complete = false;
     }
-#else  // ESP32, ESP32-S2, and ESP32-C2 use line fitting calibration
+#elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
     adc_cali_line_fitting_config_t cali_config = {
       .unit_id = this->adc_unit_,
       .atten = this->attenuation_,
@@ -112,7 +110,11 @@ void ADCSensor::setup() {
       ESP_LOGW(TAG, "Line fitting calibration failed with error %d, will use uncalibrated readings", err);
       this->setup_flags_.calibration_complete = false;
     }
-#endif  // ESP32C3 || ESP32C5 || ESP32C6 || ESP32C61 || ESP32H2 || ESP32P4 || ESP32S3
+#else   // No calibration scheme available
+    (void) handle;
+    ESP_LOGD(TAG, "No calibration scheme for this variant, readings are uncalibrated");
+    this->setup_flags_.calibration_complete = false;
+#endif
   }
 
   this->setup_flags_.init_complete = true;
@@ -121,23 +123,28 @@ void ADCSensor::setup() {
 void ADCSensor::dump_config() {
   LOG_SENSOR("", "ADC Sensor", this);
   LOG_PIN("  Pin: ", this->pin_);
-  ESP_LOGCONFIG(
-      TAG,
-      "  Channel:       %d\n"
-      "  Unit:          %s\n"
-      "  Attenuation:   %s\n"
-      "  Samples:       %i\n"
-      "  Sampling mode: %s\n"
-      "  Setup Status:\n"
-      "    Handle Init:  %s\n"
-      "    Config:       %s\n"
-      "    Calibration:  %s\n"
-      "    Overall Init: %s",
-      this->channel_, LOG_STR_ARG(adc_unit_to_str(this->adc_unit_)),
-      this->autorange_ ? "Auto" : LOG_STR_ARG(attenuation_to_str(this->attenuation_)), this->sample_count_,
-      LOG_STR_ARG(sampling_mode_to_str(this->sampling_mode_)),
-      this->setup_flags_.handle_init_complete ? "OK" : "FAILED", this->setup_flags_.config_complete ? "OK" : "FAILED",
-      this->setup_flags_.calibration_complete ? "OK" : "FAILED", this->setup_flags_.init_complete ? "OK" : "FAILED");
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED) || defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
+  const char *calibration_status = this->setup_flags_.calibration_complete ? "OK" : "FAILED";
+#else
+  const char *calibration_status = "N/A";  // This variant has no calibration scheme
+#endif
+  ESP_LOGCONFIG(TAG,
+                "  Channel:       %d\n"
+                "  Unit:          %s\n"
+                "  Attenuation:   %s\n"
+                "  Samples:       %i\n"
+                "  Sampling mode: %s\n"
+                "  Setup Status:\n"
+                "    Handle Init:  %s\n"
+                "    Config:       %s\n"
+                "    Calibration:  %s\n"
+                "    Overall Init: %s",
+                this->channel_, LOG_STR_ARG(adc_unit_to_str(this->adc_unit_)),
+                this->autorange_ ? "Auto" : LOG_STR_ARG(attenuation_to_str(this->attenuation_)), this->sample_count_,
+                LOG_STR_ARG(sampling_mode_to_str(this->sampling_mode_)),
+                this->setup_flags_.handle_init_complete ? "OK" : "FAILED",
+                this->setup_flags_.config_complete ? "OK" : "FAILED", calibration_status,
+                this->setup_flags_.init_complete ? "OK" : "FAILED");
 
   LOG_UPDATE_INTERVAL(this);
 }
@@ -184,12 +191,11 @@ float ADCSensor::sample_fixed_attenuation_() {
     } else {
       ESP_LOGW(TAG, "ADC calibration conversion failed with error %d, disabling calibration", err);
       if (this->calibration_handle_ != nullptr) {
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED)
         adc_cali_delete_scheme_curve_fitting(this->calibration_handle_);
-#else   // Other ESP32 variants use line fitting calibration
+#elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
         adc_cali_delete_scheme_line_fitting(this->calibration_handle_);
-#endif  // ESP32C3 || ESP32C5 || ESP32C6 || ESP32C61 || ESP32H2 || ESP32P4 || ESP32S3
+#endif
         this->calibration_handle_ = nullptr;
       }
     }
@@ -217,10 +223,9 @@ float ADCSensor::sample_autorange_() {
     // Need to recalibrate for the new attenuation
     if (this->calibration_handle_ != nullptr) {
       // Delete old calibration handle
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED)
       adc_cali_delete_scheme_curve_fitting(this->calibration_handle_);
-#else
+#elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
       adc_cali_delete_scheme_line_fitting(this->calibration_handle_);
 #endif
       this->calibration_handle_ = nullptr;
@@ -229,8 +234,7 @@ float ADCSensor::sample_autorange_() {
     // Create new calibration handle for this attenuation
     adc_cali_handle_t handle = nullptr;
 
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED)
     adc_cali_curve_fitting_config_t cali_config = {};
 #if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 3, 0)
     cali_config.chan = this->channel_;
@@ -242,7 +246,7 @@ float ADCSensor::sample_autorange_() {
     err = adc_cali_create_scheme_curve_fitting(&cali_config, &handle);
     ESP_LOGVV(TAG, "Autorange atten=%d: Calibration handle creation %s (err=%d)", atten,
               (err == ESP_OK) ? "SUCCESS" : "FAILED", err);
-#else
+#elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
     adc_cali_line_fitting_config_t cali_config = {
       .unit_id = this->adc_unit_,
       .atten = atten,
@@ -264,10 +268,9 @@ float ADCSensor::sample_autorange_() {
     if (err != ESP_OK) {
       ESP_LOGW(TAG, "ADC read failed in autorange with error %d", err);
       if (handle != nullptr) {
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED)
         adc_cali_delete_scheme_curve_fitting(handle);
-#else
+#elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
         adc_cali_delete_scheme_line_fitting(handle);
 #endif
       }
@@ -286,10 +289,9 @@ float ADCSensor::sample_autorange_() {
         ESP_LOGVV(TAG, "Autorange atten=%d: UNCALIBRATED FALLBACK - raw=%d -> %.6fV (3.3V ref)", atten, raw, voltage);
       }
       // Clean up calibration handle
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED)
       adc_cali_delete_scheme_curve_fitting(handle);
-#else
+#elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
       adc_cali_delete_scheme_line_fitting(handle);
 #endif
     } else {

esphome/components/adc/sensor.py

@@ -3,6 +3,7 @@ import logging
 import esphome.codegen as cg
 from esphome.components import sensor, voltage_sampler
 from esphome.components.esp32 import (
+    VARIANT_ESP32S31,
     get_esp32_variant,
     include_builtin_idf_component,
     require_adc_oneshot_iram,
@@ -56,6 +57,14 @@ def validate_config(config: ConfigType) -> ConfigType:
     if config[CONF_RAW] and config.get(CONF_ATTENUATION, None) == "auto":
         raise cv.Invalid("Automatic attenuation cannot be used when raw output is set")
 
+    # The S31 ADC supports a single attenuation level (SOC_ADC_ATTEN_NUM is 1)
+    if (
+        CORE.is_esp32
+        and get_esp32_variant() == VARIANT_ESP32S31
+        and config.get(CONF_ATTENUATION, "0db") != "0db"
+    ):
+        raise cv.Invalid("ESP32-S31 only supports 'attenuation: 0db'")
+
     if config.get(CONF_ATTENUATION, None) == "auto" and config.get(CONF_SAMPLES, 1) > 1:
         raise cv.Invalid(
             "Automatic attenuation cannot be used when multisampling is set"

esphome/components/alpha3/alpha3.cpp

@@ -162,8 +162,9 @@ void Alpha3::send_request_(uint8_t *request, size_t len) {
   auto status =
       esp_ble_gattc_write_char(this->parent_->get_gattc_if(), this->parent_->get_conn_id(), this->geni_handle_, len,
                                request, ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
-  if (status)
+  if (status) {
     ESP_LOGW(TAG, "[%s] esp_ble_gattc_write_char failed, status=%d", this->parent_->address_str(), status);
+  }
 }
 
 void Alpha3::update() {

esphome/components/api/__init__.py

@@ -5,6 +5,7 @@ from typing import Any
 from esphome import automation
 from esphome.automation import Condition
 import esphome.codegen as cg
+from esphome.components.const import CONF_DESCRIPTION
 from esphome.components.logger import request_log_listener
 
 # ENCRYPTION_SCHEMA and validate_encryption_key are re-exported for external
@@ -41,10 +42,12 @@ from esphome.const import (
     CONF_TAG,
     CONF_THEN,
     CONF_TRIGGER_ID,
+    CONF_TYPE,
     CONF_VARIABLES,
 )
 from esphome.core import CORE, ID, CoroPriority, EsphomeError, coroutine_with_priority
 from esphome.cpp_generator import MockObj, TemplateArgsType
+from esphome.helpers import fnv1_hash
 from esphome.types import ConfigFragmentType, ConfigType
 
 # Compat alias: downstream consumers (e.g. device-builder) referenced the
@@ -125,6 +128,7 @@ SERVICE_ARG_FALLBACK_TYPES: dict[str, MockObj] = {
 }
 CONF_BATCH_DELAY = "batch_delay"
 CONF_CUSTOM_SERVICES = "custom_services"
+CONF_EXAMPLE = "example"
 CONF_HOMEASSISTANT_SERVICES = "homeassistant_services"
 CONF_HOMEASSISTANT_STATES = "homeassistant_states"
 CONF_LISTEN_BACKLOG = "listen_backlog"
@@ -228,14 +232,30 @@ def _validate_supports_response(value: Any) -> str:
     return cv.enum(SUPPORTS_RESPONSE_OPTIONS, lower=True)(value)
 
 
+# ESP8266 copies every string of an action into a stack buffer sized by codegen; keep it small
+ESP8266_ACTION_STRINGS_MAX_TOTAL = 384
+
+VARIABLE_SCHEMA = cv.Schema(
+    {
+        cv.Required(CONF_TYPE): cv.one_of(*SERVICE_ARG_NATIVE_TYPES, lower=True),
+        cv.Optional(CONF_DESCRIPTION): cv.string_strict,
+        cv.Optional(CONF_EXAMPLE): cv.string_strict,
+    }
+)
+
+# Accepts the plain `name: type` shorthand or the full mapping form
+validate_variable = cv.maybe_simple_value(VARIABLE_SCHEMA, key=CONF_TYPE)
+
+
 ACTIONS_SCHEMA = automation.validate_automation(
     {
         cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(UserServiceTrigger),
         cv.Exclusive(CONF_SERVICE, group_of_exclusion=CONF_ACTION): cv.valid_name,
         cv.Exclusive(CONF_ACTION, group_of_exclusion=CONF_ACTION): cv.valid_name,
+        cv.Optional(CONF_DESCRIPTION): cv.string_strict,
         cv.Optional(CONF_VARIABLES, default={}): cv.Schema(
             {
-                cv.validate_id_name: cv.one_of(*SERVICE_ARG_NATIVE_TYPES, lower=True),
+                cv.validate_id_name: validate_variable,
             }
         ),
         # No default - auto-detected by _auto_detect_supports_response
@@ -352,6 +372,85 @@ CONFIG_SCHEMA = cv.All(
 )
 
 
+def _has_action_metadata(actions: list[ConfigType]) -> bool:
+    # Empty strings count as unset, matching _action_strings
+    return any(
+        conf.get(CONF_DESCRIPTION)
+        or any(
+            var_.get(CONF_DESCRIPTION) or var_.get(CONF_EXAMPLE)
+            for var_ in conf[CONF_VARIABLES].values()
+        )
+        for conf in actions
+    )
+
+
+def _action_strings(conf: ConfigType, has_metadata: bool) -> list[str | None]:
+    """Strings of one action in the table order UserServiceStatic (user_services.h) expects."""
+    # An empty description or example is treated as unset
+    strings: list[str | None] = [conf[CONF_ACTION]]
+    if has_metadata:
+        strings.append(conf.get(CONF_DESCRIPTION) or None)
+    for name, var_ in conf[CONF_VARIABLES].items():
+        strings.append(name)
+        if has_metadata:
+            strings += [
+                var_.get(CONF_DESCRIPTION) or None,
+                var_.get(CONF_EXAMPLE) or None,
+            ]
+    return strings
+
+
+def _action_strings_size(strings: list[str | None]) -> int:
+    """Bytes needed to copy every string out of flash, each with its terminator."""
+    return sum(
+        len(string.encode("utf-8")) + 1 for string in strings if string is not None
+    )
+
+
+def _validate_esp8266_action_strings(config: ConfigType) -> ConfigType:
+    if not CORE.is_esp8266:
+        return config
+    actions = config.get(CONF_ACTIONS, [])
+    has_metadata = _has_action_metadata(actions)
+    for conf in actions:
+        size = _action_strings_size(_action_strings(conf, has_metadata))
+        if size > ESP8266_ACTION_STRINGS_MAX_TOTAL:
+            raise cv.Invalid(
+                f"Action '{conf[CONF_ACTION]}' has {size} bytes of name, variable name, "
+                f"description and example text; ESP8266 allows at most "
+                f"{ESP8266_ACTION_STRINGS_MAX_TOTAL} bytes per action"
+            )
+    return config
+
+
+FINAL_VALIDATE_SCHEMA = _validate_esp8266_action_strings
+
+
+def _add_action_strings(
+    index: int, strings: list[str | None], interned: dict[str, MockObj]
+) -> MockObj:
+    """Emit the PROGMEM string table for one action.
+
+    Each string is its own PROGMEM array because on ESP8266 .rodata is RAM, and identical
+    strings are shared between actions through `interned`.
+    """
+    entries: list[MockObj] = []
+    for string in strings:
+        if string is None:
+            entries.append(cg.nullptr)
+            continue
+        if (var := interned.get(string)) is None:
+            var = interned[string] = cg.progmem_array(
+                ID(f"api_action_str{len(interned)}", is_declaration=True, type=cg.char),
+                string,
+            )
+        entries.append(var)
+    return cg.progmem_array(
+        ID(f"api_action{index}_strings", is_declaration=True, type=cg.const_char_ptr),
+        entries,
+    )
+
+
 @coroutine_with_priority(CoroPriority.WEB)
 async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
@@ -371,8 +470,10 @@ async def to_code(config: ConfigType) -> None:
     cg.add_define("MAX_API_CONNECTIONS", config[CONF_MAX_CONNECTIONS])
     cg.add_define("API_MAX_SEND_QUEUE", config[CONF_MAX_SEND_QUEUE])
 
+    actions = config.get(CONF_ACTIONS, [])
+    has_user_actions = bool(actions) or config[CONF_CUSTOM_SERVICES]
     # Set USE_API_USER_DEFINED_ACTIONS if any services are enabled
-    if config.get(CONF_ACTIONS) or config[CONF_CUSTOM_SERVICES]:
+    if has_user_actions:
         cg.add_define("USE_API_USER_DEFINED_ACTIONS")
 
     # Set USE_API_CUSTOM_SERVICES if external components need dynamic service registration
@@ -385,10 +486,17 @@ async def to_code(config: ConfigType) -> None:
     if config[CONF_HOMEASSISTANT_STATES]:
         cg.add_define("USE_API_HOMEASSISTANT_STATES")
 
-    if actions := config.get(CONF_ACTIONS, []):
+    scratch_size = 0
+    if actions:
+        # Metadata is compiled in for every action once any action declares it, because the
+        # string table layout is fixed by the define rather than per action
+        has_metadata = _has_action_metadata(actions)
+        if has_metadata:
+            cg.add_define("USE_API_USER_DEFINED_ACTION_METADATA")
+        interned_strings: dict[str, MockObj] = {}
         # Collect all triggers first, then register all at once with initializer_list
         triggers: list[cg.MockObj] = []
-        for conf in actions:
+        for index, conf in enumerate(actions):
             func_args: list[tuple[MockObj, str]] = []
             service_template_args: list[MockObj] = []  # User service argument types
 
@@ -421,22 +529,23 @@ async def to_code(config: ConfigType) -> None:
                 conf.get(CONF_THEN, [])
             )
 
-            service_arg_names: list[str] = []
             for name, var_ in conf[CONF_VARIABLES].items():
-                if has_non_synchronous and var_ in SERVICE_ARG_FALLBACK_TYPES:
-                    native = SERVICE_ARG_FALLBACK_TYPES[var_]
+                var_type = var_[CONF_TYPE]
+                if has_non_synchronous and var_type in SERVICE_ARG_FALLBACK_TYPES:
+                    native = SERVICE_ARG_FALLBACK_TYPES[var_type]
                 else:
-                    native = SERVICE_ARG_NATIVE_TYPES[var_]
+                    native = SERVICE_ARG_NATIVE_TYPES[var_type]
                 service_template_args.append(native)
                 func_args.append((native, name))
-                service_arg_names.append(name)
+            strings = _action_strings(conf, has_metadata)
+            table = _add_action_strings(index, strings, interned_strings)
+            if CORE.is_esp8266:
+                scratch_size = max(scratch_size, _action_strings_size(strings))
             # Template args: supports_response mode, then user service arg types
             templ = cg.TemplateArguments(supports_response, *service_template_args)
+            # Key is hashed here because the name is not readable at runtime on ESP8266
             trigger = cg.new_Pvariable(
-                conf[CONF_TRIGGER_ID],
-                templ,
-                conf[CONF_ACTION],
-                service_arg_names,
+                conf[CONF_TRIGGER_ID], templ, table, fnv1_hash(conf[CONF_ACTION])
             )
             triggers.append(trigger)
             auto = await automation.build_automation(trigger, func_args, conf)
@@ -458,6 +567,9 @@ async def to_code(config: ConfigType) -> None:
                 cg.add(auto.add_actions([unregister_action]))
         # Register all services at once - single allocation, no reallocations
         cg.add(var.initialize_user_services(triggers))
+    if CORE.is_esp8266 and has_user_actions:
+        # Stack buffer that list-entities copies PROGMEM strings into, sized for the largest action
+        cg.add_define("API_USER_ACTION_STRINGS_SCRATCH_SIZE", max(scratch_size, 1))
 
     if CONF_ON_CLIENT_CONNECTED in config:
         cg.add_define("USE_API_CLIENT_CONNECTED_TRIGGER")

esphome/components/api/api.proto

@@ -1034,6 +1034,8 @@ message ListEntitiesServicesArgument {
   option (ifdef) = "USE_API_USER_DEFINED_ACTIONS";
   string name = 1;
   ServiceArgType type = 2;
+  string description = 3 [(field_ifdef) = "USE_API_USER_DEFINED_ACTION_METADATA"];
+  string example = 4 [(field_ifdef) = "USE_API_USER_DEFINED_ACTION_METADATA"];
 }
 message ListEntitiesServicesResponse {
   option (id) = 41;
@@ -1044,6 +1046,7 @@ message ListEntitiesServicesResponse {
   fixed32 key = 2 [(force) = true];
   repeated ListEntitiesServicesArgument args = 3 [(fixed_vector) = true];
   SupportsResponseType supports_response = 4;
+  string description = 5 [(field_ifdef) = "USE_API_USER_DEFINED_ACTION_METADATA"];
 }
 message ExecuteServiceArgument {
   option (ifdef) = "USE_API_USER_DEFINED_ACTIONS";

esphome/components/api/api_connection.cpp

@@ -2391,8 +2391,9 @@ void APIConnection::process_batch_() {
     } else if (payload_size == 0) {
       // payload_size == 0 with remove set means encoding hit OOM and the
       // connection is being dropped; warn only for a genuinely oversized message
-      if (!this->flags_.remove)
+      if (!this->flags_.remove) {
         ESP_LOGW(TAG, "Message too large to send: type=%u", item.message_type);
+      }
       this->clear_batch_();
     }
     return;

esphome/components/api/api_pb2.cpp

@@ -1275,12 +1275,24 @@ uint8_t *ListEntitiesServicesArgument::encode(ProtoWriteBuffer &buffer PROTO_ENC
   uint8_t *__restrict__ pos = buffer.get_pos();
   ProtoEncode::encode_string(pos PROTO_ENCODE_DEBUG_ARG, 1, this->name);
   ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 2, static_cast<uint32_t>(this->type));
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  ProtoEncode::encode_string(pos PROTO_ENCODE_DEBUG_ARG, 3, this->description);
+#endif
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  ProtoEncode::encode_string(pos PROTO_ENCODE_DEBUG_ARG, 4, this->example);
+#endif
   return pos;
 }
 uint32_t ListEntitiesServicesArgument::calculate_size() const {
   uint32_t size = 0;
   size += ProtoSize::calc_length(1, this->name.size());
   size += this->type ? 2 : 0;
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  size += ProtoSize::calc_length(1, this->description.size());
+#endif
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  size += ProtoSize::calc_length(1, this->example.size());
+#endif
   return size;
 }
 uint8_t *ListEntitiesServicesResponse::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
@@ -1291,6 +1303,9 @@ uint8_t *ListEntitiesServicesResponse::encode(ProtoWriteBuffer &buffer PROTO_ENC
     ProtoEncode::encode_sub_message(pos PROTO_ENCODE_DEBUG_ARG, buffer, 3, it);
   }
   ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 4, static_cast<uint32_t>(this->supports_response));
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  ProtoEncode::encode_string(pos PROTO_ENCODE_DEBUG_ARG, 5, this->description);
+#endif
   return pos;
 }
 uint32_t ListEntitiesServicesResponse::calculate_size() const {
@@ -1303,6 +1318,9 @@ uint32_t ListEntitiesServicesResponse::calculate_size() const {
     }
   }
   size += this->supports_response ? 2 : 0;
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  size += ProtoSize::calc_length(1, this->description.size());
+#endif
   return size;
 }
 bool ExecuteServiceArgument::decode_varint(uint32_t field_id, proto_varint_value_t value) {

esphome/components/api/api_pb2.h

@@ -1317,6 +1317,12 @@ class ListEntitiesServicesArgument final : public ProtoMessage {
  public:
   StringRef name{};
   enums::ServiceArgType type{};
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  StringRef description{};
+#endif
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  StringRef example{};
+#endif
   uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
   uint32_t calculate_size() const;
 #ifdef HAS_PROTO_MESSAGE_DUMP
@@ -1328,7 +1334,7 @@ class ListEntitiesServicesArgument final : public ProtoMessage {
 class ListEntitiesServicesResponse final : public ProtoMessage {
  public:
   static constexpr uint16_t MESSAGE_TYPE = 41;
-  static constexpr uint8_t ESTIMATED_SIZE = 50;
+  static constexpr uint8_t ESTIMATED_SIZE = 59;
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const LogString *message_name() const override { return LOG_STR("list_entities_services_response"); }
 #endif
@@ -1336,6 +1342,9 @@ class ListEntitiesServicesResponse final : public ProtoMessage {
   uint32_t key{0};
   FixedVector<ListEntitiesServicesArgument> args{};
   enums::SupportsResponseType supports_response{};
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  StringRef description{};
+#endif
   uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
   uint32_t calculate_size() const;
 #ifdef HAS_PROTO_MESSAGE_DUMP

esphome/components/api/api_pb2_dump.cpp

@@ -1500,6 +1500,12 @@ const char *ListEntitiesServicesArgument::dump_to(DumpBuffer &out) const {
   MessageDumpHelper helper(out, ESPHOME_PSTR("ListEntitiesServicesArgument"));
   dump_field(out, ESPHOME_PSTR("name"), this->name);
   dump_field(out, ESPHOME_PSTR("type"), static_cast<enums::ServiceArgType>(this->type));
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  dump_field(out, ESPHOME_PSTR("description"), this->description);
+#endif
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  dump_field(out, ESPHOME_PSTR("example"), this->example);
+#endif
   return out.c_str();
 }
 const char *ListEntitiesServicesResponse::dump_to(DumpBuffer &out) const {
@@ -1512,6 +1518,9 @@ const char *ListEntitiesServicesResponse::dump_to(DumpBuffer &out) const {
     out.append("\n");
   }
   dump_field(out, ESPHOME_PSTR("supports_response"), static_cast<enums::SupportsResponseType>(this->supports_response));
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  dump_field(out, ESPHOME_PSTR("description"), this->description);
+#endif
   return out.c_str();
 }
 const char *ExecuteServiceArgument::dump_to(DumpBuffer &out) const {

esphome/components/api/api_server.cpp

@@ -433,8 +433,10 @@ void APIServer::send_homeassistant_action(const HomeassistantActionRequest &call
     // Home Assistant subscribes to actions shortly *after* authenticating, so actions
     // fired right at connection time (on_client_connected, on_time_sync, ...) can
     // arrive before the subscription and are lost - warn instead of failing silently.
-    ESP_LOGW(TAG, "Home Assistant %s '%s' dropped; %s", call.is_event ? "event" : "action", call.service.c_str(),
-             this->is_connected() ? "client has not subscribed to actions (yet)" : "no client connected");
+    ESP_LOGW(TAG, "Home Assistant %s '%s' dropped; %s",
+             call.is_event ? LOG_STR_LITERAL("event") : LOG_STR_LITERAL("action"), call.service.c_str(),
+             this->is_connected() ? LOG_STR_LITERAL("client has not subscribed to actions (yet)")
+                                  : LOG_STR_LITERAL("no client connected"));
   }
 }
 #ifdef USE_API_HOMEASSISTANT_ACTION_RESPONSES

esphome/components/api/list_entities.cpp

@@ -99,7 +99,8 @@ ListEntitiesIterator::ListEntitiesIterator(APIConnection *client) : client_(clie
 static constexpr uint8_t SERVICE_YIELD_INTERVAL = 3;
 
 bool ListEntitiesIterator::on_service(UserServiceDescriptor *service) {
-  auto resp = service->encode_list_service_response();
+  UserActionScratch scratch;
+  auto resp = service->encode_list_service_response(scratch);
   if (!this->client_->send_message(resp))
     return false;
   // at_ is this service's index

esphome/components/api/user_services.cpp

@@ -1,9 +1,52 @@
 #include "user_services.h"
+#include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 #include "esphome/core/string_ref.h"
 
 namespace esphome::api {
 
+StringRef UserServiceStatic::str_(size_t idx, std::span<char> &scratch) const {
+  const char *s = progmem_read_ptr(&this->strings_[idx]);
+  if (s == nullptr)
+    return {};
+#ifdef USE_ESP8266
+  // Codegen sizes the scratch buffer for the largest service; the bound only guards other callers
+  if (scratch.empty())
+    return {};
+  size_t len = strnlen_P(s, scratch.size() - 1);
+  progmem_memcpy(scratch.data(), s, len);
+  scratch[len] = '\0';
+  StringRef ref(scratch.data(), len);
+  scratch = scratch.subspan(len + 1);
+  return ref;
+#else
+  return StringRef(s);
+#endif
+}
+
+ListEntitiesServicesResponse UserServiceStatic::encode_list_service_response_(
+    std::span<const enums::ServiceArgType> arg_types, std::span<char> scratch) const {
+  ListEntitiesServicesResponse msg;
+  msg.name = this->str_(0, scratch);
+  msg.key = this->key_;
+  msg.supports_response = this->supports_response_;
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+  msg.description = this->str_(1, scratch);
+#endif
+  msg.args.init(arg_types.size());
+  for (size_t i = 0; i < arg_types.size(); i++) {
+    size_t base = USER_ACTION_HEADER_STRINGS + i * USER_ACTION_ARG_STRINGS;
+    auto &arg = msg.args.emplace_back();
+    arg.type = arg_types[i];
+    arg.name = this->str_(base, scratch);
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+    arg.description = this->str_(base + 1, scratch);
+    arg.example = this->str_(base + 2, scratch);
+#endif
+  }
+  return msg;
+}
+
 template<> bool get_execute_arg_value<bool>(const ExecuteServiceArgument &arg) { return arg.bool_; }
 template<> int32_t get_execute_arg_value<int32_t>(const ExecuteServiceArgument &arg) {
   if (arg.legacy_int != 0)

esphome/components/api/user_services.h

@@ -1,5 +1,6 @@
 #pragma once
 
+#include <span>
 #include <tuple>
 #include <utility>
 #include <vector>
@@ -19,7 +20,9 @@ class APIServer;
 
 class UserServiceDescriptor {
  public:
-  virtual ListEntitiesServicesResponse encode_list_service_response() = 0;
+  /// Build the list-entities message. On ESP8266 the strings live in PROGMEM and are copied into
+  /// `scratch`, so the returned message is only valid while `scratch` is; other platforms ignore it.
+  virtual ListEntitiesServicesResponse encode_list_service_response(std::span<char> scratch) = 0;
 
   virtual bool execute_service(const ExecuteServiceRequest &req) = 0;
 #ifdef USE_API_USER_DEFINED_ACTION_RESPONSES
@@ -34,29 +37,51 @@ template<typename T> T get_execute_arg_value(const ExecuteServiceArgument &arg);
 
 template<typename T> enums::ServiceArgType to_service_arg_type();
 
-// Base class for YAML-defined services (most common case)
-// Stores only pointers to string literals in flash - no heap allocation
-template<typename... Ts> class UserServiceBase : public UserServiceDescriptor {
- public:
-  UserServiceBase(const char *name, const std::array<const char *, sizeof...(Ts)> &arg_names,
-                  enums::SupportsResponseType supports_response = enums::SUPPORTS_RESPONSE_NONE)
-      : name_(name), arg_names_(arg_names), supports_response_(supports_response) {
-    this->key_ = fnv1_hash(name);
-  }
+// Scratch buffer list-entities hands to encode_list_service_response(); only ESP8266 copies into it
+#ifdef USE_ESP8266
+using UserActionScratch = std::array<char, API_USER_ACTION_STRINGS_SCRATCH_SIZE>;
+#else
+using UserActionScratch = std::array<char, 0>;
+#endif
 
-  ListEntitiesServicesResponse encode_list_service_response() override {
-    ListEntitiesServicesResponse msg;
-    msg.name = StringRef(this->name_);
-    msg.key = this->key_;
-    msg.supports_response = this->supports_response_;
+// Non-template base for YAML-defined services so the list-entities encoder is compiled once.
+// All strings live in one PROGMEM pointer table emitted by codegen (see _action_strings in
+// __init__.py), so each service costs a single pointer of RAM. Layout: the action name, then
+// each argument name; with USE_API_USER_DEFINED_ACTION_METADATA the action description follows
+// the name and every argument is (name, description, example). Unset metadata is nullptr.
+#ifdef USE_API_USER_DEFINED_ACTION_METADATA
+static constexpr size_t USER_ACTION_HEADER_STRINGS = 2;
+static constexpr size_t USER_ACTION_ARG_STRINGS = 3;
+#else
+static constexpr size_t USER_ACTION_HEADER_STRINGS = 1;
+static constexpr size_t USER_ACTION_ARG_STRINGS = 1;
+#endif
+class UserServiceStatic : public UserServiceDescriptor {
+ public:
+  UserServiceStatic(const char *const *strings, uint32_t key,
+                    enums::SupportsResponseType supports_response = enums::SUPPORTS_RESPONSE_NONE)
+      : strings_(strings), key_(key), supports_response_(supports_response) {}
+
+ protected:
+  ListEntitiesServicesResponse encode_list_service_response_(std::span<const enums::ServiceArgType> arg_types,
+                                                             std::span<char> scratch) const;
+  /// Reference table entry `idx`; nullptr gives an empty StringRef.
+  /// On ESP8266 the bytes are copied out of PROGMEM into `scratch` with a terminator, and the span
+  /// is advanced past the copy.
+  StringRef str_(size_t idx, std::span<char> &scratch) const;
+
+  const char *const *strings_;  // PROGMEM pointer table, read with progmem_read_ptr()
+  uint32_t key_;
+  enums::SupportsResponseType supports_response_;
+};
+
+template<typename... Ts> class UserServiceBase : public UserServiceStatic {
+ public:
+  using UserServiceStatic::UserServiceStatic;
+
+  ListEntitiesServicesResponse encode_list_service_response(std::span<char> scratch) override {
     std::array<enums::ServiceArgType, sizeof...(Ts)> arg_types = {to_service_arg_type<Ts>()...};
-    msg.args.init(sizeof...(Ts));
-    for (size_t i = 0; i < sizeof...(Ts); i++) {
-      auto &arg = msg.args.emplace_back();
-      arg.type = arg_types[i];
-      arg.name = StringRef(this->arg_names_[i]);
-    }
-    return msg;
+    return this->encode_list_service_response_(arg_types, scratch);
   }
 
   bool execute_service(const ExecuteServiceRequest &req) override {
@@ -89,12 +114,6 @@ template<typename... Ts> class UserServiceBase : public UserServiceDescriptor {
   void execute_(const ArgsContainer &args, uint32_t call_id, bool return_response, std::index_sequence<S...> /*type*/) {
     this->execute(call_id, return_response, (get_execute_arg_value<Ts>(args[S]))...);
   }
-
-  // Pointers to string literals in flash - no heap allocation
-  const char *name_;
-  std::array<const char *, sizeof...(Ts)> arg_names_;
-  uint32_t key_{0};
-  enums::SupportsResponseType supports_response_{enums::SUPPORTS_RESPONSE_NONE};
 };
 
 // Separate class for custom_api_device services (rare case)
@@ -106,7 +125,7 @@ template<typename... Ts> class UserServiceDynamic : public UserServiceDescriptor
     this->key_ = fnv1_hash(this->name_.c_str());
   }
 
-  ListEntitiesServicesResponse encode_list_service_response() override {
+  ListEntitiesServicesResponse encode_list_service_response(std::span<char> /*scratch*/) override {
     ListEntitiesServicesResponse msg;
     msg.name = StringRef(this->name_);
     msg.key = this->key_;
@@ -167,8 +186,8 @@ template<typename... Ts>
 class UserServiceTrigger<enums::SUPPORTS_RESPONSE_NONE, Ts...> final : public UserServiceBase<Ts...>,
                                                                        public Trigger<Ts...> {
  public:
-  UserServiceTrigger(const char *name, const std::array<const char *, sizeof...(Ts)> &arg_names)
-      : UserServiceBase<Ts...>(name, arg_names, enums::SUPPORTS_RESPONSE_NONE) {}
+  UserServiceTrigger(const char *const *strings, uint32_t key)
+      : UserServiceBase<Ts...>(strings, key, enums::SUPPORTS_RESPONSE_NONE) {}
 
  protected:
   void execute(uint32_t /*call_id*/, bool /*return_response*/, Ts... x) override { this->trigger(x...); }
@@ -179,8 +198,8 @@ template<typename... Ts>
 class UserServiceTrigger<enums::SUPPORTS_RESPONSE_OPTIONAL, Ts...> final : public UserServiceBase<Ts...>,
                                                                            public Trigger<uint32_t, bool, Ts...> {
  public:
-  UserServiceTrigger(const char *name, const std::array<const char *, sizeof...(Ts)> &arg_names)
-      : UserServiceBase<Ts...>(name, arg_names, enums::SUPPORTS_RESPONSE_OPTIONAL) {}
+  UserServiceTrigger(const char *const *strings, uint32_t key)
+      : UserServiceBase<Ts...>(strings, key, enums::SUPPORTS_RESPONSE_OPTIONAL) {}
 
  protected:
   void execute(uint32_t call_id, bool return_response, Ts... x) override {
@@ -193,8 +212,8 @@ template<typename... Ts>
 class UserServiceTrigger<enums::SUPPORTS_RESPONSE_ONLY, Ts...> final : public UserServiceBase<Ts...>,
                                                                        public Trigger<uint32_t, Ts...> {
  public:
-  UserServiceTrigger(const char *name, const std::array<const char *, sizeof...(Ts)> &arg_names)
-      : UserServiceBase<Ts...>(name, arg_names, enums::SUPPORTS_RESPONSE_ONLY) {}
+  UserServiceTrigger(const char *const *strings, uint32_t key)
+      : UserServiceBase<Ts...>(strings, key, enums::SUPPORTS_RESPONSE_ONLY) {}
 
  protected:
   void execute(uint32_t call_id, bool /*return_response*/, Ts... x) override { this->trigger(call_id, x...); }
@@ -205,8 +224,8 @@ template<typename... Ts>
 class UserServiceTrigger<enums::SUPPORTS_RESPONSE_STATUS, Ts...> final : public UserServiceBase<Ts...>,
                                                                          public Trigger<uint32_t, Ts...> {
  public:
-  UserServiceTrigger(const char *name, const std::array<const char *, sizeof...(Ts)> &arg_names)
-      : UserServiceBase<Ts...>(name, arg_names, enums::SUPPORTS_RESPONSE_STATUS) {}
+  UserServiceTrigger(const char *const *strings, uint32_t key)
+      : UserServiceBase<Ts...>(strings, key, enums::SUPPORTS_RESPONSE_STATUS) {}
 
  protected:
   void execute(uint32_t call_id, bool /*return_response*/, Ts... x) override { this->trigger(call_id, x...); }

esphome/components/aqi/aqi_sensor.cpp

@@ -23,8 +23,10 @@ void AQISensor::setup() {
 
 void AQISensor::dump_config() {
   ESP_LOGCONFIG(TAG, "AQI Sensor:");
-  ESP_LOGCONFIG(TAG, "  Calculation Type: %s", this->aqi_calc_type_ == AQI_TYPE ? "AQI" : "CAQI");
-  ESP_LOGCONFIG(TAG, "  Extended Range: %s", this->extended_range_ ? "enabled" : "disabled");
+  ESP_LOGCONFIG(TAG, "  Calculation Type: %s",
+                this->aqi_calc_type_ == AQI_TYPE ? LOG_STR_LITERAL("AQI") : LOG_STR_LITERAL("CAQI"));
+  ESP_LOGCONFIG(TAG, "  Extended Range: %s",
+                this->extended_range_ ? LOG_STR_LITERAL("enabled") : LOG_STR_LITERAL("disabled"));
   if (this->pm_2_5_sensor_ != nullptr) {
     ESP_LOGCONFIG(TAG, "  PM2.5 Sensor: '%s'", this->pm_2_5_sensor_->get_name().c_str());
   }

esphome/components/binary_sensor/automation.cpp

@@ -100,13 +100,15 @@ void MultiClickTriggerBase::schedule_is_valid_(uint32_t min_length) {
   }
   this->is_valid_ = false;
   this->set_timeout(MULTICLICK_IS_VALID_ID, min_length, [this]() {
-    ESP_LOGV(TAG, "Multi Click: You can now %s the button.", this->parent_->state ? "RELEASE" : "PRESS");
+    ESP_LOGV(TAG, "Multi Click: You can now %s the button.",
+             this->parent_->state ? LOG_STR_LITERAL("RELEASE") : LOG_STR_LITERAL("PRESS"));
     this->is_valid_ = true;
   });
 }
 void MultiClickTriggerBase::schedule_is_not_valid_(uint32_t max_length) {
   this->set_timeout(MULTICLICK_IS_NOT_VALID_ID, max_length, [this]() {
-    ESP_LOGV(TAG, "Multi Click: You waited too long to %s.", this->parent_->state ? "RELEASE" : "PRESS");
+    ESP_LOGV(TAG, "Multi Click: You waited too long to %s.",
+             this->parent_->state ? LOG_STR_LITERAL("RELEASE") : LOG_STR_LITERAL("PRESS"));
     this->is_valid_ = false;
     this->schedule_cooldown_();
   });

esphome/components/bk72xx_ble/bdk_scan.cpp

@@ -62,8 +62,9 @@ BdkActivityState bdk_scan_state(uint8_t activity_idx) {
 
 uint8_t bdk_scan_acquire_activity() {
   uint8_t idx = app_ble_get_idle_actv_idx_handle(SCAN_ACTV);
-  if (idx == INVALID_ACTIVITY_IDX)
+  if (idx == INVALID_ACTIVITY_IDX) {
     ESP_LOGE(TAG, "Scan start failed: no idle activity handle");
+  }
   return idx;
 }
 

esphome/components/bk72xx_ble/bk72xx_ble.cpp

@@ -181,8 +181,9 @@ void BK72xxBLE::enable() {
       break;
     }
   }
-  if (!bdaddr_live)
+  if (!bdaddr_live) {
     ESP_LOGW(TAG, "Controller address still unset after init; BLE stack may not have started");
+  }
 #endif
 
   this->state_ = BLEComponentState::ACTIVE;
@@ -210,8 +211,9 @@ void BK72xxBLE::loop() {
     // Re-check a settled scan; scan_start() refills the bring-up budget.
     // WARN: the only report of a drop that recovers inside its budget.
     if (this->scan_start(this->requested_.interval, this->requested_.window, this->requested_.active) !=
-        ScanOpResult::SETTLED)
+        ScanOpResult::SETTLED) {
       ESP_LOGW(TAG, "Controller dropped the scan; restarting");
+    }
   }
 
   // Drain the lock-free ring filled by the BLE task; all per-report work runs
@@ -230,8 +232,9 @@ void BK72xxBLE::loop() {
   // Log dropped reports — only reachable when reports were processed; drops can
   // only occur while the queue is full, and only this loop drains it.
   uint16_t dropped = this->report_queue_.get_and_reset_dropped_count();
-  if (dropped > 0)
+  if (dropped > 0) {
     ESP_LOGW(TAG, "Dropped %u scan reports due to queue overflow", dropped);
+  }
 }
 
 void BK72xxBLE::get_mac_lsb_first(uint8_t out[MAC_ADDRESS_SIZE]) const {
@@ -449,8 +452,9 @@ ScanOpResult BK72xxBLE::advance_stop_(BdkActivityState state, bool ready) {
   if (!ready) {
     // Acting mid-operation could delete an activity whose start lands
     // afterwards, leaking the slot with the radio on; wait.
-    if (this->last_result_ == ScanOpResult::SETTLED)
+    if (this->last_result_ == ScanOpResult::SETTLED) {
       ESP_LOGD(TAG, "Scan stop deferred (controller busy)");
+    }
     return ScanOpResult::PENDING;
   }
   // Settled, so CREATED unambiguously means "never started".
@@ -474,8 +478,9 @@ ScanOpResult BK72xxBLE::advance_start_(BdkActivityState state, bool ready) {
     return ScanOpResult::PENDING;
   }
   if (!ready) {
-    if (this->last_result_ == ScanOpResult::SETTLED)
+    if (this->last_result_ == ScanOpResult::SETTLED) {
       ESP_LOGD(TAG, "Scan start deferred (controller busy)");
+    }
     return ScanOpResult::PENDING;
   }
   if (state == BdkActivityState::CREATED) {

esphome/components/bk72xx_ble_tracker/bk72xx_ble_tracker.cpp

@@ -69,8 +69,9 @@ void BK72xxBLETracker::on_ota_global_state(ota::OTAState state, float progress,
     this->stop_scan();
     // The transfer starves the loop; a deferred stop would leave the radio
     // scanning for the whole update, so drain it here, bounded.
-    if (!this->parent_->flush_pending_stop(OTA_STOP_FLUSH_MS))
+    if (!this->parent_->flush_pending_stop(OTA_STOP_FLUSH_MS)) {
       ESP_LOGE(TAG, "Scan still stopping at OTA start; the radio may contend with the update");
+    }
   } else if (state == ota::OTA_ERROR || state == ota::OTA_ABORT) {
     // On success the device reboots, so restore only on a failed/aborted update;
     // loop() restarts the scan on its next iteration (continuous idle branch).

esphome/components/ble_client/__init__.py

@@ -1,8 +1,23 @@
+from collections.abc import Callable
+import functools
+from typing import Any
+
 from esphome import automation
 from esphome.automation import maybe_simple_id
 import esphome.codegen as cg
-from esphome.components import esp32_ble, esp32_ble_client, esp32_ble_tracker
-from esphome.components.esp32_ble import BTLoggers
+from esphome.components import ble_device_base, bluetooth_connection
+from esphome.components.ble_device_base import (
+    BT_UUID16_FORMAT as bt_uuid16_format,
+    BT_UUID32_FORMAT as bt_uuid32_format,
+    BT_UUID128_FORMAT as bt_uuid128_format,
+    as_hex,
+    as_reversed_hex_array,
+    bt_uuid,
+)
+from esphome.config_helpers import (
+    filter_source_files_from_platform,
+    frameworks_for_platforms,
+)
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_CHARACTERISTIC_UUID,
@@ -15,13 +30,53 @@ from esphome.const import (
     CONF_SERVICE_UUID,
     CONF_TRIGGER_ID,
     CONF_VALUE,
+    PLATFORM_ESP32,
+    PlatformFramework,
 )
-from esphome.core import ID
+from esphome.core import CORE, ID
+from esphome.enum import StrEnum
+from esphome.schema_extractors import SCHEMA_EXTRACT, schema_extractor
 from esphome.types import ConfigType
 
-AUTO_LOAD = ["esp32_ble_client"]
+# The esp32 BLE stack (esp32_ble, esp32_ble_tracker) is imported lazily inside
+# the esp32 schema/codegen arms: importing those modules registers esp32-only
+# automations as a side effect, which must not leak into the neutral
+# platforms' registries (the bluetooth_proxy pattern).
+
+
+def _legacy_engine() -> bool:
+    """True when the build uses the legacy raw-gattc engine - one line to
+    flip when esp32 moves to the neutral engine (with
+    USE_BLE_CLIENT_LEGACY_ENGINE in _to_code_esp32)."""
+    return CORE.is_esp32
+
+
+def AUTO_LOAD() -> list[str]:
+    """The engine's closure per platform: the legacy esp32 engine builds on
+    esp32_ble_client plus bluetooth_connection (the shared service-table
+    materializer; its sources compile empty in builds without a neutral
+    node), the neutral engine on the bluetooth_connection backend. The
+    platform-less arm is the union for manifest-resolving tooling."""
+    if _legacy_engine() or CORE.target_platform is None:
+        return ["bluetooth_connection", "esp32_ble_client"]
+    return ["bluetooth_connection"]
+
+
 CODEOWNERS = ["@buxtronix", "@clydebarrow"]
-DEPENDENCIES = ["esp32_ble_tracker"]
+
+FILTER_SOURCE_FILES = filter_source_files_from_platform(
+    {
+        "ble_client.cpp": {
+            PlatformFramework.ESP32_ARDUINO,
+            PlatformFramework.ESP32_IDF,
+        },
+        # Every framework of every non-esp32 registry platform: a platform
+        # that validates the neutral arm must also compile the neutral engine.
+        "ble_client_gatt.cpp": frameworks_for_platforms(
+            set(bluetooth_connection.GATT_CLIENT_PLATFORMS) - {PLATFORM_ESP32}
+        ),
+    }
+)
 
 CONF_DESCRIPTOR_UUID = "descriptor_uuid"
 CONF_ON_NOTIFY = "on_notify"
@@ -58,7 +113,9 @@ def notify_from_on_notify(config: ConfigType) -> ConfigType:
 
 
 ble_client_ns = cg.esphome_ns.namespace("ble_client")
-BLEClient = ble_client_ns.class_("BLEClient", esp32_ble_client.BLEClientBase)
+# One codegen class for both engines: the exclusively-gated headers resolve
+# the name to exactly one C++ definition per build.
+BLEClient = ble_client_ns.class_("BLEClient", cg.Component)
 BLEClientNode = ble_client_ns.class_("BLEClientNode")
 BLEClientNodeConstRef = BLEClientNode.operator("ref").operator("const")
 # Triggers
@@ -105,62 +162,179 @@ CONF_AUTO_CONNECT = "auto_connect"
 
 MULTI_CONF = True
 
-CONFIG_SCHEMA = cv.All(
-    cv.Schema(
-        {
-            cv.GenerateID(): cv.declare_id(BLEClient),
-            cv.Required(CONF_MAC_ADDRESS): cv.mac_address,
-            cv.Optional(CONF_NAME): cv.string,
-            cv.Optional(CONF_AUTO_CONNECT, default=True): cv.boolean,
-            cv.Optional(CONF_ON_CONNECT): automation.validate_automation(
-                {
-                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                        BLEClientConnectTrigger
-                    ),
-                }
-            ),
-            cv.Optional(CONF_ON_DISCONNECT): automation.validate_automation(
-                {
-                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                        BLEClientDisconnectTrigger
-                    ),
-                }
-            ),
-            cv.Optional(CONF_ON_PASSKEY_REQUEST): automation.validate_automation(
-                {
-                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                        BLEClientPasskeyRequestTrigger
-                    ),
-                }
-            ),
-            cv.Optional(CONF_ON_PASSKEY_NOTIFICATION): automation.validate_automation(
-                {
-                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                        BLEClientPasskeyNotificationTrigger
-                    ),
-                }
-            ),
-            cv.Optional(
-                CONF_ON_NUMERIC_COMPARISON_REQUEST
-            ): automation.validate_automation(
-                {
-                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                        BLEClientNumericComparisonRequestTrigger
-                    ),
-                }
-            ),
-        }
+# Keys shared by both engines' schemas.
+_COMMON_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(): cv.declare_id(BLEClient),
+        cv.Required(CONF_MAC_ADDRESS): cv.mac_address,
+        cv.Optional(CONF_AUTO_CONNECT, default=True): cv.boolean,
+        cv.Optional(CONF_ON_CONNECT): automation.validate_automation(
+            {
+                cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(BLEClientConnectTrigger),
+            }
+        ),
+        cv.Optional(CONF_ON_DISCONNECT): automation.validate_automation(
+            {
+                cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                    BLEClientDisconnectTrigger
+                ),
+            }
+        ),
+    }
+).extend(cv.COMPONENT_SCHEMA)
+
+
+@functools.cache
+def _esp32_config_schema() -> cv.All:
+    """The legacy engine's schema, byte-compatible with what esp32 always had
+    (including the Bluedroid security triggers)."""
+    from esphome.components import esp32_ble_tracker
+
+    return cv.All(
+        _COMMON_SCHEMA.extend(
+            {
+                # Accepted-but-unused legacy key; not propagated to the
+                # neutral schema.
+                cv.Optional(CONF_NAME): cv.string,
+                cv.Optional(CONF_ON_PASSKEY_REQUEST): automation.validate_automation(
+                    {
+                        cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                            BLEClientPasskeyRequestTrigger
+                        ),
+                    }
+                ),
+                cv.Optional(
+                    CONF_ON_PASSKEY_NOTIFICATION
+                ): automation.validate_automation(
+                    {
+                        cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                            BLEClientPasskeyNotificationTrigger
+                        ),
+                    }
+                ),
+                cv.Optional(
+                    CONF_ON_NUMERIC_COMPARISON_REQUEST
+                ): automation.validate_automation(
+                    {
+                        cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                            BLEClientNumericComparisonRequestTrigger
+                        ),
+                    }
+                ),
+            }
+        ).extend(esp32_ble_tracker.ESP_BLE_DEVICE_SCHEMA),
+        bluetooth_connection.consume_gatt_slot("ble_client"),
     )
-    .extend(cv.COMPONENT_SCHEMA)
-    .extend(esp32_ble_tracker.ESP_BLE_DEVICE_SCHEMA),
-    esp32_ble.consume_connection_slots(1, "ble_client"),
-)
+
+
+@functools.cache
+def _gatt_config_schema(platform: str) -> cv.All:
+    """The neutral engine's schema: the shared keys plus the hub reference
+    (parsed-advertisement sightings) and the GATT backend declaration.
+    Keyed by platform - the backend fragment differs per platform."""
+    return cv.All(
+        _COMMON_SCHEMA.extend(ble_device_base.BLE_DEVICE_SCHEMA).extend(
+            bluetooth_connection.gatt_client_schema(platform)
+        ),
+        bluetooth_connection.consume_gatt_slot("ble_client"),
+    )
+
+
+@schema_extractor("schema")
+def _validate_platform(config: ConfigType) -> ConfigType:
+    if config is SCHEMA_EXTRACT:
+        # Deliberate gap (the bluetooth_proxy pattern): the dumper gets only
+        # this shape, so the neutral arm's ble_hub_id is absent from editor
+        # schemas and the esp32-only keys are advertised on every platform.
+        # The language-schema dumper runs without a platform; expose the
+        # esp32 (legacy-engine) shape.
+        return _esp32_config_schema()
+    if _legacy_engine():
+        return _esp32_config_schema()(config)
+    if CORE.target_platform in bluetooth_connection.GATT_CLIENT_PLATFORMS:
+        return _gatt_config_schema(CORE.target_platform)(config)
+    raise cv.Invalid(f"ble_client is not supported on {CORE.target_platform}")
+
+
+CONFIG_SCHEMA = _validate_platform
 
 CONF_BLE_CLIENT_ID = "ble_client_id"
 
+
+class BLEClientFeatures(StrEnum):
+    """Per-platform engine capabilities consumers declare against."""
+
+    # The platform-neutral node interface (on_connected/table + completion
+    # callbacks) - every platform with a ble_client engine.
+    GATT_NODE = "gatt_node"
+    # The raw esp32 GATT client event stream (gattc/gap handlers,
+    # node_state) - the legacy engine only.
+    RAW_GATTC = "raw_gattc"
+    # Pairing dialog replies and bond management (Bluedroid GAP/SMP).
+    SECURITY = "security"
+
+
+def _engine_features() -> set[BLEClientFeatures]:
+    """Features the validated platform's engine provides."""
+    if _legacy_engine():
+        return {
+            BLEClientFeatures.GATT_NODE,
+            BLEClientFeatures.RAW_GATTC,
+            BLEClientFeatures.SECURITY,
+        }
+    if CORE.target_platform in bluetooth_connection.GATT_CLIENT_PLATFORMS:
+        return {BLEClientFeatures.GATT_NODE}
+    return set()
+
+
+def requires_feature(
+    feature: BLEClientFeatures, description: str
+) -> Callable[[Any], Any]:
+    """Validator gating a consumer to platforms whose engine provides
+    `feature`, naming the missing capability in the error."""
+
+    def validator(value: Any) -> Any:
+        features = _engine_features()
+        if feature not in features:
+            available = (
+                f"; this platform's engine provides: {', '.join(sorted(features))}"
+                if features
+                else ""
+            )
+            raise cv.Invalid(
+                f"{description} requires the ble_client '{feature}' feature, "
+                f"which {CORE.target_platform} does not provide{available}"
+            )
+        return value
+
+    return validator
+
+
+# The one choke point for every node component still on the raw esp32 event
+# stream; migrating to the neutral interface (NODE_BLE_CLIENT_SCHEMA +
+# register_gatt_node) lifts it.
+_legacy_engine_only = requires_feature(
+    BLEClientFeatures.RAW_GATTC,
+    "This component drives the raw ESP32 GATT client events and has not "
+    "been migrated to the platform-neutral node interface yet; it",
+)
+
 BLE_CLIENT_SCHEMA = cv.Schema(
     {
-        cv.GenerateID(CONF_BLE_CLIENT_ID): cv.use_id(BLEClient),
+        cv.GenerateID(CONF_BLE_CLIENT_ID): cv.All(
+            cv.use_id(BLEClient), _legacy_engine_only
+        ),
+    }
+)
+
+# For node components on the neutral interface: valid wherever ble_client
+# itself is.
+NODE_BLE_CLIENT_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(CONF_BLE_CLIENT_ID): cv.All(
+            cv.use_id(BLEClient),
+            requires_feature(BLEClientFeatures.GATT_NODE, "This component"),
+        ),
     }
 )
 
@@ -170,11 +344,31 @@ async def register_ble_node(var, config):
     cg.add(parent.register_ble_node(var))
 
 
+def _request_gatt_node_build() -> None:
+    """Node storage and the one define meaning "the neutral node surface is
+    compiled in", plus the esp32 bridge/materializer defines."""
+    _request_node_slot()
+    cg.add_define("USE_BLE_CLIENT_GATT_NODES")
+    if _legacy_engine():
+        # Deliberately not ble_device_base.request_gatt_client(): that would
+        # claim a phantom backend slot on combined proxy builds.
+        cg.add_define("USE_BLE_GATT_CLIENT")
+        cg.add_define("USE_BLE_GATT_BACKEND_BLUEDROID")
+        cg.add_define("USE_BLUEDROID_GATT_SERVICE_TABLE")
+
+
+async def register_gatt_node(var, config):
+    """Register a node on the platform-neutral interface (both engines)."""
+    parent = await cg.get_variable(config[CONF_BLE_CLIENT_ID])
+    _request_gatt_node_build()
+    cg.add(parent.register_gatt_node(var))
+
+
 BLE_WRITE_ACTION_SCHEMA = cv.Schema(
     {
         cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
-        cv.Required(CONF_SERVICE_UUID): esp32_ble_tracker.bt_uuid,
-        cv.Required(CONF_CHARACTERISTIC_UUID): esp32_ble_tracker.bt_uuid,
+        cv.Required(CONF_SERVICE_UUID): bt_uuid,
+        cv.Required(CONF_CHARACTERISTIC_UUID): bt_uuid,
         cv.Required(CONF_VALUE): cv.templatable(cv.ensure_list(cv.hex_uint8_t)),
     }
 )
@@ -185,25 +379,34 @@ BLE_CONNECT_ACTION_SCHEMA = maybe_simple_id(
     }
 )
 
-BLE_NUMERIC_COMPARISON_REPLY_ACTION_SCHEMA = cv.Schema(
-    {
-        cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
-        cv.Required(CONF_ACCEPT): cv.templatable(cv.boolean),
-    }
+BLE_NUMERIC_COMPARISON_REPLY_ACTION_SCHEMA = cv.All(
+    requires_feature(BLEClientFeatures.SECURITY, "This action"),
+    cv.Schema(
+        {
+            cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
+            cv.Required(CONF_ACCEPT): cv.templatable(cv.boolean),
+        }
+    ),
 )
 
-BLE_PASSKEY_REPLY_ACTION_SCHEMA = cv.Schema(
-    {
-        cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
-        cv.Required(CONF_PASSKEY): cv.templatable(cv.int_range(min=0, max=999999)),
-    }
+BLE_PASSKEY_REPLY_ACTION_SCHEMA = cv.All(
+    requires_feature(BLEClientFeatures.SECURITY, "This action"),
+    cv.Schema(
+        {
+            cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
+            cv.Required(CONF_PASSKEY): cv.templatable(cv.int_range(min=0, max=999999)),
+        }
+    ),
 )
 
 
-BLE_REMOVE_BOND_ACTION_SCHEMA = cv.Schema(
-    {
-        cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
-    }
+BLE_REMOVE_BOND_ACTION_SCHEMA = cv.All(
+    requires_feature(BLEClientFeatures.SECURITY, "This action"),
+    cv.Schema(
+        {
+            cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
+        }
+    ),
 )
 
 
@@ -237,6 +440,8 @@ async def ble_connect_to_code(config, action_id, template_arg, args):
 )
 async def ble_write_to_code(config, action_id, template_arg, args):
     parent = await cg.get_variable(config[CONF_ID])
+    # The action registers itself as a neutral node in its constructor.
+    _request_gatt_node_build()
     var = cg.new_Pvariable(action_id, template_arg, parent)
 
     value = config[CONF_VALUE]
@@ -251,38 +456,20 @@ async def ble_write_to_code(config, action_id, template_arg, args):
         arr = cg.static_const_array(arr_id, cg.ArrayInitializer(*value))
         cg.add(var.set_value_simple(arr, len(value)))
 
-    if len(config[CONF_SERVICE_UUID]) == len(esp32_ble_tracker.bt_uuid16_format):
-        cg.add(
-            var.set_service_uuid16(esp32_ble_tracker.as_hex(config[CONF_SERVICE_UUID]))
-        )
-    elif len(config[CONF_SERVICE_UUID]) == len(esp32_ble_tracker.bt_uuid32_format):
-        cg.add(
-            var.set_service_uuid32(esp32_ble_tracker.as_hex(config[CONF_SERVICE_UUID]))
-        )
-    elif len(config[CONF_SERVICE_UUID]) == len(esp32_ble_tracker.bt_uuid128_format):
-        uuid128 = esp32_ble_tracker.as_reversed_hex_array(config[CONF_SERVICE_UUID])
+    if len(config[CONF_SERVICE_UUID]) == len(bt_uuid16_format):
+        cg.add(var.set_service_uuid16(as_hex(config[CONF_SERVICE_UUID])))
+    elif len(config[CONF_SERVICE_UUID]) == len(bt_uuid32_format):
+        cg.add(var.set_service_uuid32(as_hex(config[CONF_SERVICE_UUID])))
+    elif len(config[CONF_SERVICE_UUID]) == len(bt_uuid128_format):
+        uuid128 = as_reversed_hex_array(config[CONF_SERVICE_UUID])
         cg.add(var.set_service_uuid128(uuid128))
 
-    if len(config[CONF_CHARACTERISTIC_UUID]) == len(esp32_ble_tracker.bt_uuid16_format):
-        cg.add(
-            var.set_char_uuid16(
-                esp32_ble_tracker.as_hex(config[CONF_CHARACTERISTIC_UUID])
-            )
-        )
-    elif len(config[CONF_CHARACTERISTIC_UUID]) == len(
-        esp32_ble_tracker.bt_uuid32_format
-    ):
-        cg.add(
-            var.set_char_uuid32(
-                esp32_ble_tracker.as_hex(config[CONF_CHARACTERISTIC_UUID])
-            )
-        )
-    elif len(config[CONF_CHARACTERISTIC_UUID]) == len(
-        esp32_ble_tracker.bt_uuid128_format
-    ):
-        uuid128 = esp32_ble_tracker.as_reversed_hex_array(
-            config[CONF_CHARACTERISTIC_UUID]
-        )
+    if len(config[CONF_CHARACTERISTIC_UUID]) == len(bt_uuid16_format):
+        cg.add(var.set_char_uuid16(as_hex(config[CONF_CHARACTERISTIC_UUID])))
+    elif len(config[CONF_CHARACTERISTIC_UUID]) == len(bt_uuid32_format):
+        cg.add(var.set_char_uuid32(as_hex(config[CONF_CHARACTERISTIC_UUID])))
+    elif len(config[CONF_CHARACTERISTIC_UUID]) == len(bt_uuid128_format):
+        uuid128 = as_reversed_hex_array(config[CONF_CHARACTERISTIC_UUID])
         cg.add(var.set_char_uuid128(uuid128))
 
     return var
@@ -339,14 +526,45 @@ async def remove_bond_to_code(config, action_id, template_arg, args):
     return cg.new_Pvariable(action_id, template_arg, parent)
 
 
-async def to_code(config):
+async def _to_code_esp32(config: ConfigType) -> cg.MockObj:
+    from esphome.components import esp32_ble, esp32_ble_tracker
+    from esphome.components.esp32_ble import BTLoggers
+
     # Register the loggers this component needs
     esp32_ble.register_bt_logger(BTLoggers.GATT, BTLoggers.SMP)
     cg.add_define("USE_ESP32_BLE_UUID")
+    cg.add_define("USE_BLE_CLIENT_LEGACY_ENGINE")
 
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
     await esp32_ble_tracker.register_client(var, config)
+    return var
+
+
+# Sizes the neutral client's node storage; the client itself requests a
+# baseline slot so the define exists on every build that compiles the engine.
+_request_node_slot = cg.slot_counter("ESPHOME_BLE_CLIENT_MAX_NODES")
+
+
+async def _to_code_gatt(config: ConfigType) -> cg.MockObj:
+    # The engine always carries the node surface (the client itself owns the
+    # baseline slot).
+    _request_gatt_node_build()
+    backend = await bluetooth_connection.new_gatt_backend(config)
+    var = cg.new_Pvariable(config[CONF_ID])
+    await cg.register_component(var, config)
+    cg.add(var.set_backend(backend))
+    # Sighting-gated connects: the client listens for the peer's parsed
+    # advertisements through the hub.
+    await ble_device_base.register_ble_device(var, config)
+    return var
+
+
+async def to_code(config: ConfigType) -> None:
+    if _legacy_engine():
+        var = await _to_code_esp32(config)
+    else:
+        var = await _to_code_gatt(config)
     cg.add(var.set_address(config[CONF_MAC_ADDRESS].as_hex))
     cg.add(var.set_auto_connect(config[CONF_AUTO_CONNECT]))
     for conf in config.get(CONF_ON_CONNECT, []):

esphome/components/ble_client/automation.cpp

@@ -1,11 +0,0 @@
-#ifdef USE_ESP32
-
-#include "automation.h"
-
-namespace esphome::ble_client {
-
-const char *const Automation::TAG = "ble_client.automation";
-
-}  // namespace esphome::ble_client
-
-#endif

esphome/components/ble_client/automation.h

@@ -1,27 +1,14 @@
 #pragma once
 
-#ifdef USE_ESP32
+#include "esphome/core/defines.h"
 
-#include <utility>
-#include <vector>
+#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
 
 #include "esphome/core/automation.h"
 #include "esphome/components/ble_client/ble_client.h"
-#include "esphome/core/helpers.h"
-#include "esphome/core/log.h"
-
-// Maximum bytes to log in hex format for BLE writes (many logging buffers are 256 chars)
-static constexpr size_t BLE_WRITE_MAX_LOG_BYTES = 64;
 
 namespace esphome::ble_client {
 
-// placeholder class for static TAG .
-class Automation {
- public:
-  // could be made inline with C++17
-  static const char *const TAG;
-};
-
 // implement on_connect automation.
 class BLEClientConnectTrigger final : public Trigger<>, public BLEClientNode {
  public:
@@ -93,144 +80,6 @@ class BLEClientNumericComparisonRequestTrigger final : public Trigger<uint32_t>,
   }
 };
 
-// implement the ble_client.ble_write action.
-template<typename... Ts> class BLEClientWriteAction final : public Action<Ts...>, public BLEClientNode {
- public:
-  BLEClientWriteAction(BLEClient *ble_client) {
-    ble_client->register_ble_node(this);
-    ble_client_ = ble_client;
-  }
-
-  void set_service_uuid16(uint16_t uuid) { this->service_uuid_ = espbt::ESPBTUUID::from_uint16(uuid); }
-  void set_service_uuid32(uint32_t uuid) { this->service_uuid_ = espbt::ESPBTUUID::from_uint32(uuid); }
-  void set_service_uuid128(uint8_t *uuid) { this->service_uuid_ = espbt::ESPBTUUID::from_raw(uuid); }
-
-  void set_char_uuid16(uint16_t uuid) { this->char_uuid_ = espbt::ESPBTUUID::from_uint16(uuid); }
-  void set_char_uuid32(uint32_t uuid) { this->char_uuid_ = espbt::ESPBTUUID::from_uint32(uuid); }
-  void set_char_uuid128(uint8_t *uuid) { this->char_uuid_ = espbt::ESPBTUUID::from_raw(uuid); }
-
-  void set_value_template(std::vector<uint8_t> (*func)(Ts...)) {
-    this->value_.func = func;
-    this->len_ = -1;  // Sentinel value indicates template mode
-  }
-
-  // Store pointer to static data in flash (no RAM copy)
-  void set_value_simple(const uint8_t *data, size_t len) {
-    this->value_.data = data;
-    this->len_ = len;  // Length >= 0 indicates static mode
-  }
-
-  void play(const Ts &...x) override {}
-
-  void play_complex(const Ts &...x) override {
-    this->num_running_++;
-    this->var_ = std::make_tuple(x...);
-
-    bool result;
-    if (this->len_ >= 0) {
-      // Static mode: write directly from flash pointer
-      result = this->write(this->value_.data, this->len_);
-    } else {
-      // Template mode: call function and write the vector
-      std::vector<uint8_t> value = this->value_.func(x...);
-      result = this->write(value);
-    }
-
-    // on write failure, continue the automation chain rather than stopping so that e.g. disconnect can work.
-    if (!result)
-      this->play_next_(x...);
-  }
-
-  /**
-   * Note about logging: the esph_log_X macros are used here because the CI checks complain about use of the ESP LOG
-   * macros in header files (Can't even write it in a comment!)
-   * Not sure why, because they seem to work just fine.
-   * The problem is that the implementation of a templated class can't be placed in a .cpp file when using C++ less than
-   * 17, so the methods have to be here.  The esph_log_X macros are equivalent in function, but don't trigger the CI
-   * errors.
-   */
-  // initiate the write. Return true if all went well, will be followed by a WRITE_CHAR event.
-  bool write(const uint8_t *data, size_t len) {
-    if (this->node_state != espbt::ClientState::ESTABLISHED) {
-      esph_log_w(Automation::TAG, "Cannot write to BLE characteristic - not connected");
-      return false;
-    }
-#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERY_VERBOSE
-    char hex_buf[format_hex_pretty_size(BLE_WRITE_MAX_LOG_BYTES)];
-    esph_log_vv(Automation::TAG, "Will write %d bytes: %s", len, format_hex_pretty_to(hex_buf, data, len));
-#endif
-    esp_err_t err =
-        esp_ble_gattc_write_char(this->parent()->get_gattc_if(), this->parent()->get_conn_id(), this->char_handle_, len,
-                                 const_cast<uint8_t *>(data), this->write_type_, ESP_GATT_AUTH_REQ_NONE);
-    if (err != ESP_OK) {
-      esph_log_e(Automation::TAG, "Error writing to characteristic: %s!", esp_err_to_name(err));
-      return false;
-    }
-    return true;
-  }
-
-  bool write(const std::vector<uint8_t> &value) { return this->write(value.data(), value.size()); }
-
-  void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
-                           esp_ble_gattc_cb_param_t *param) override {
-    switch (event) {
-      case ESP_GATTC_WRITE_CHAR_EVT:
-        // upstream code checked the MAC address, verify the characteristic.
-        if (param->write.handle == this->char_handle_)
-          this->parent()->run_later([this]() { this->play_next_tuple_(this->var_); });
-        break;
-      case ESP_GATTC_DISCONNECT_EVT:
-        if (this->num_running_ != 0)
-          this->stop_complex();
-        break;
-      case ESP_GATTC_SEARCH_CMPL_EVT: {
-        auto *chr = this->parent()->get_characteristic(this->service_uuid_, this->char_uuid_);
-        if (chr == nullptr) {
-          char char_buf[esp32_ble::UUID_STR_LEN];
-          char service_buf[esp32_ble::UUID_STR_LEN];
-          esph_log_w("ble_write_action", "Characteristic %s was not found in service %s",
-                     this->char_uuid_.to_str(char_buf), this->service_uuid_.to_str(service_buf));
-          break;
-        }
-        this->char_handle_ = chr->handle;
-        this->char_props_ = chr->properties;
-        if (this->char_props_ & ESP_GATT_CHAR_PROP_BIT_WRITE) {
-          this->write_type_ = ESP_GATT_WRITE_TYPE_RSP;
-          esph_log_d(Automation::TAG, "Write type: ESP_GATT_WRITE_TYPE_RSP");
-        } else if (this->char_props_ & ESP_GATT_CHAR_PROP_BIT_WRITE_NR) {
-          this->write_type_ = ESP_GATT_WRITE_TYPE_NO_RSP;
-          esph_log_d(Automation::TAG, "Write type: ESP_GATT_WRITE_TYPE_NO_RSP");
-        } else {
-          char char_buf[esp32_ble::UUID_STR_LEN];
-          esph_log_e(Automation::TAG, "Characteristic %s does not allow writing", this->char_uuid_.to_str(char_buf));
-          break;
-        }
-        this->node_state = espbt::ClientState::ESTABLISHED;
-        char char_buf[esp32_ble::UUID_STR_LEN];
-        esph_log_d(Automation::TAG, "Found characteristic %s on device %s", this->char_uuid_.to_str(char_buf),
-                   ble_client_->address_str());
-        break;
-      }
-      default:
-        break;
-    }
-  }
-
- private:
-  BLEClient *ble_client_;
-  ssize_t len_{-1};  // -1 = template mode, >=0 = static mode with length
-  union Value {
-    std::vector<uint8_t> (*func)(Ts...);  // Function pointer (stateless lambdas)
-    const uint8_t *data;                  // Pointer to static data in flash
-  } value_;
-  espbt::ESPBTUUID service_uuid_;
-  espbt::ESPBTUUID char_uuid_;
-  std::tuple<Ts...> var_{};
-  uint16_t char_handle_{};
-  esp_gatt_char_prop_t char_props_{};
-  esp_gatt_write_type_t write_type_{};
-};
-
 template<typename... Ts> class BLEClientPasskeyReplyAction final : public Action<Ts...> {
  public:
   BLEClientPasskeyReplyAction(BLEClient *ble_client) { parent_ = ble_client; }

esphome/components/ble_client/automation_gatt.h

@@ -0,0 +1,118 @@
+// Neutral twins of the shared ble_client automations. Class names, namespace,
+// and codegen-visible signatures are IDENTICAL to automation.h so generated
+// main.cpp compiles against whichever engine the build gates in; only the
+// internals differ (client callbacks and the neutral node interface instead
+// of raw gattc events). The Bluedroid-security automations (passkey, numeric
+// comparison, remove bond) have no neutral equivalent and stay esp32-only.
+
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#if defined(USE_BLE_GATT_CLIENT) && !defined(USE_BLE_CLIENT_LEGACY_ENGINE)
+
+#include <tuple>
+
+#include "ble_client_gatt.h"
+#include "esphome/core/automation.h"
+
+namespace esphome::ble_client {
+
+class BLEClientConnectTrigger final : public Trigger<> {
+ public:
+  explicit BLEClientConnectTrigger(BLEClient *parent) {
+    parent->add_on_connect_callback([this]() { this->trigger(); });
+  }
+};
+
+class BLEClientDisconnectTrigger final : public Trigger<> {
+ public:
+  explicit BLEClientDisconnectTrigger(BLEClient *parent) {
+    // Fires only after a completed connection (never for failed attempts),
+    // matching the legacy CLOSE_EVT semantics.
+    parent->add_on_disconnect_callback([this]() { this->trigger(); });
+  }
+};
+
+template<typename... Ts> class BLEClientConnectAction final : public Action<Ts...> {
+ public:
+  BLEClientConnectAction(BLEClient *ble_client) {
+    ble_client_ = ble_client;
+    ble_client->add_on_connect_callback([this]() {
+      if (this->num_running_ != 0)
+        this->play_next_tuple_(this->var_);
+    });
+    // A connect attempt that dies (or a later disconnect) terminates the
+    // chain, mirroring the legacy DISCONNECT_EVT handling.
+    ble_client->add_on_connect_failed_callback([this]() {
+      if (this->num_running_ != 0)
+        this->stop_complex();
+    });
+    ble_client->add_on_disconnect_callback([this]() {
+      if (this->num_running_ != 0)
+        this->stop_complex();
+    });
+  }
+
+  // not used since we override play_complex_
+  void play(const Ts &...x) override {}
+
+  void play_complex(const Ts &...x) override {
+    // it makes no sense to have multiple instances of this running at the
+    // same time; cancel a re-trigger while still running.
+    if (this->num_running_ != 0) {
+      this->stop_complex();
+      return;
+    }
+    this->num_running_++;
+    if (this->ble_client_->connected()) {
+      this->play_next_(x...);
+    } else {
+      this->var_ = std::make_tuple(x...);
+      // No-op while already connecting; the callback resolves the wait.
+      this->ble_client_->connect();
+    }
+  }
+
+ private:
+  BLEClient *ble_client_;
+  std::tuple<Ts...> var_{};
+};
+
+template<typename... Ts> class BLEClientDisconnectAction final : public Action<Ts...> {
+ public:
+  BLEClientDisconnectAction(BLEClient *ble_client) {
+    ble_client_ = ble_client;
+    // Both terminal outcomes resolve the wait: a completed teardown and a
+    // connect attempt that died on the way down.
+    ble_client->add_on_disconnect_callback([this]() {
+      if (this->num_running_ != 0)
+        this->play_next_tuple_(this->var_);
+    });
+    ble_client->add_on_connect_failed_callback([this]() {
+      if (this->num_running_ != 0)
+        this->play_next_tuple_(this->var_);
+    });
+  }
+
+  // not used since we override play_complex_
+  void play(const Ts &...x) override {}
+
+  void play_complex(const Ts &...x) override {
+    this->num_running_++;
+    if (this->ble_client_->idle()) {
+      this->play_next_(x...);
+    } else {
+      this->var_ = std::make_tuple(x...);
+      this->ble_client_->disconnect();
+    }
+  }
+
+ private:
+  BLEClient *ble_client_;
+  std::tuple<Ts...> var_{};
+};
+
+}  // namespace esphome::ble_client
+
+#endif  // USE_BLE_GATT_CLIENT && !USE_BLE_CLIENT_LEGACY_ENGINE

esphome/components/ble_client/ble_client.cpp

@@ -2,10 +2,16 @@
 #include "esphome/components/esp32_ble_client/ble_client_base.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 #include "esphome/core/application.h"
+#include "esphome/core/hal.h"
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-#ifdef USE_ESP32
+#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
+
+#ifdef USE_BLE_CLIENT_GATT_NODES
+#include "esphome/components/bluetooth_connection/bluetooth_connection.h"
+#include "esphome/components/bluetooth_connection/gatt_service_table_bluedroid.h"
+#endif
 
 namespace esphome::ble_client {
 
@@ -30,6 +36,10 @@ void BLEClient::dump_config() {
 bool BLEClient::parse_device(const espbt::ESPBTDevice &device) {
   if (!this->enabled)
     return false;
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  if (device.address_uint64() == this->address_ && this->gatt_backoff_.holding_off())
+    return false;
+#endif
   return BLEClientBase::parse_device(device);
 }
 
@@ -40,24 +50,60 @@ void BLEClient::set_enabled(bool enabled) {
   if (!enabled) {
     ESP_LOGI(TAG, "[%s] Disabling BLE client.", this->address_str());
     this->disconnect();
+    return;
   }
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  // A re-enable clears the backoff (neutral-engine parity).
+  this->gatt_backoff_.reset();
+#endif
 }
 
 bool BLEClient::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t esp_gattc_if,
                                     esp_ble_gattc_cb_param_t *param) {
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  // Bridge-initiated registrations bypass the base's REG_FOR_NOTIFY handling:
+  // its automatic CCCD write would double the node's own.
+  // Handle-keyed: mixed legacy/neutral subscriptions to one characteristic
+  // are unsupported during the migration window.
+  if (event == ESP_GATTC_REG_FOR_NOTIFY_EVT && esp_gattc_if == this->gattc_if_ &&
+      this->take_pending_gatt_reg_(param->reg_for_notify.handle)) {
+    if (this->pending_notify_regs_ > 0)
+      this->pending_notify_regs_--;
+    int err = param->reg_for_notify.status == ESP_GATT_OK ? 0 : param->reg_for_notify.status;
+    this->notify_state_to_gatt_nodes_(param->reg_for_notify.handle, true, err);
+    // A retiring last registration must still release the cache.
+    this->maybe_release_services_();
+    return true;
+  }
+#endif
   if (!BLEClientBase::gattc_event_handler(event, esp_gattc_if, param))
     return false;
 
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  // Before the legacy fan-out so gatt nodes resolve before any trigger fires.
+  if (!this->gatt_nodes_.empty()) {
+    if (event == ESP_GATTC_SEARCH_CMPL_EVT) {
+      // A failed discovery tears the link down; the on_connect trigger must
+      // not fire into the teardown.
+      if (!this->handle_gatt_search_cmpl_(param->search_cmpl.status))
+        return true;
+    } else {
+      this->dispatch_gatt_event_(event, param);
+    }
+  }
+#endif
   for (auto *node : this->nodes_)
     node->gattc_event_handler(event, esp_gattc_if, param);
+  this->maybe_release_services_();
+  return true;
+}
 
+void BLEClient::maybe_release_services_() {
   // The release frees the GATT cache that BLEClientBase's CCCD lookup still needs.
-  // The last REG_FOR_NOTIFY event clears the counter before node dispatch, so the release still runs here.
   if (!this->services_.empty() && !this->notify_registration_pending() && this->all_nodes_established_()) {
     this->release_services();
     ESP_LOGD(TAG, "All clients established, services released");
   }
-  return true;
 }
 
 void BLEClient::gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) {
@@ -65,10 +111,19 @@ void BLEClient::gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_p
 
   for (auto *node : this->nodes_)
     node->gap_event_handler(event, param);
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  if (event == ESP_GAP_BLE_AUTH_CMPL_EVT && this->check_addr(param->ble_security.auth_cmpl.bd_addr)) {
+    int status = param->ble_security.auth_cmpl.success ? 0 : param->ble_security.auth_cmpl.fail_reason;
+    for (auto *node : this->gatt_nodes_)
+      node->on_pairing_result(status);
+  }
+#endif
 }
 
 void BLEClient::set_state(espbt::ClientState state) {
   BLEClientBase::set_state(state);
+  // ESTABLISHED never flows through here; gatt nodes are promoted after the
+  // on_connected fan-out.
   for (auto &node : nodes_)
     node->node_state = state;
 }
@@ -83,6 +138,218 @@ bool BLEClient::all_nodes_established_() {
   return true;
 }
 
+#ifdef USE_BLE_CLIENT_GATT_NODES
+
+void BLEClient::register_gatt_node(BLEClientNode *node) {
+  // Parent before the capacity check so a dropped node still has a usable
+  // parent() (neutral-engine parity).
+  node->set_ble_client_parent(this);
+  if (this->gatt_nodes_.size() == ESPHOME_BLE_CLIENT_MAX_NODES) {
+    // push_back past capacity is a silent no-op; an undersized slot count
+    // must be loud at boot, not an unresolvable node at runtime.
+    ESP_LOGE(TAG, "[%s] Node capacity exceeded; node dropped", this->address_str());
+    this->status_set_error(LOG_STR("node capacity exceeded"));
+    return;
+  }
+  this->gatt_nodes_.push_back(node);
+  // nodes_ covers the shared state bookkeeping; gatt_nodes_ is the neutral
+  // fan-out subset.
+  this->register_ble_node(node);
+}
+
+int BLEClient::find_pending_gatt_reg_(uint16_t handle) const {
+  for (uint8_t i = 0; i < this->pending_gatt_reg_count_; i++) {
+    if (this->pending_gatt_regs_[i] == handle)
+      return i;
+  }
+  return -1;
+}
+
+bool BLEClient::take_pending_gatt_reg_(uint16_t handle) {
+  int i = this->find_pending_gatt_reg_(handle);
+  if (i < 0)
+    return false;
+  // No duplicates (notify_characteristic refuses a re-push); swap-with-last.
+  this->pending_gatt_regs_[i] = this->pending_gatt_regs_[--this->pending_gatt_reg_count_];
+  return true;
+}
+
+void BLEClient::notify_state_to_gatt_nodes_(uint16_t handle, bool enabled, int error) {
+  if (error != 0) {
+    ESP_LOGW(TAG, "[%s] Notify %s on handle 0x%04x failed, status=%d", this->address_str(),
+             enabled ? "enable" : "disable", handle, error);
+  }
+  for (auto *node : this->gatt_nodes_)
+    node->on_notify_state(handle, enabled, error);
+}
+
+void BLEClient::dispatch_gatt_event_(esp_gattc_cb_event_t event, esp_ble_gattc_cb_param_t *param) {
+  switch (event) {
+    case ESP_GATTC_READ_CHAR_EVT:
+    case ESP_GATTC_READ_DESCR_EVT: {
+      bool ok = param->read.status == ESP_GATT_OK;
+      if (!ok) {
+        // Breadcrumb even when no node claims the handle.
+        ESP_LOGD(TAG, "[%s] Read on handle 0x%04x completed with status %d", this->address_str(), param->read.handle,
+                 param->read.status);
+      }
+      for (auto *node : this->gatt_nodes_) {
+        node->on_read_result(param->read.handle, ok ? param->read.value : nullptr, ok ? param->read.value_len : 0,
+                             ok ? 0 : param->read.status);
+      }
+      break;
+    }
+    case ESP_GATTC_WRITE_CHAR_EVT:
+    case ESP_GATTC_WRITE_DESCR_EVT:
+      if (param->write.status != ESP_GATT_OK) {
+        // Breadcrumb even when no node claims the handle.
+        ESP_LOGD(TAG, "[%s] Write on handle 0x%04x completed with status %d", this->address_str(), param->write.handle,
+                 param->write.status);
+      }
+      for (auto *node : this->gatt_nodes_) {
+        node->on_write_result(param->write.handle, param->write.status == ESP_GATT_OK ? 0 : param->write.status);
+      }
+      break;
+    case ESP_GATTC_NOTIFY_EVT:
+      for (auto *node : this->gatt_nodes_) {
+        node->on_notify(param->notify.handle, param->notify.value, param->notify.value_len);
+      }
+      break;
+    case ESP_GATTC_UNREG_FOR_NOTIFY_EVT:
+      // The base does no CCCD work for unregister; no interception needed.
+      this->notify_state_to_gatt_nodes_(
+          param->unreg_for_notify.handle, false,
+          param->unreg_for_notify.status == ESP_GATT_OK ? 0 : param->unreg_for_notify.status);
+      break;
+    default:
+      break;
+  }
+}
+
+bool BLEClient::handle_gatt_search_cmpl_(esp_gatt_status_t status) {
+  // The base ignores the search status; the neutral contract must not.
+  uint16_t service_total = 0;
+  bool counted = status == ESP_GATT_OK && bluetooth_connection::BluedroidServiceTable::count_services(
+                                              this->gattc_if_, this->conn_id_, &service_total);
+  if (!counted || service_total == 0) {
+    // A failed search poisons the whole discovery, legacy nodes included.
+    ESP_LOGW(TAG, "[%s] Discovery failed (status=%d, services=%u)", this->address_str(), status, service_total);
+    this->gatt_backoff_.register_failure(this->address_str());
+    this->disconnect();
+    return false;
+  }
+  // Stack-owned; nodes copy their handles during on_connected().
+  bluetooth_connection::BluedroidServiceTable table;
+  if (!table.build(this->gattc_if_, this->conn_id_, service_total, this->connection_index_)) {
+    if (!this->has_legacy_nodes_()) {
+      ESP_LOGW(TAG, "[%s] Service table build failed; treating as failed discovery", this->address_str());
+      this->gatt_backoff_.register_failure(this->address_str());
+      this->disconnect();
+      return false;
+    }
+    // Only the table build failed; legacy nodes read the base's services_
+    // and keep the link. Gatt nodes catch the next connection.
+    ESP_LOGW(TAG, "[%s] Service table build failed; gatt nodes skip this connection", this->address_str());
+    this->status_set_warning(LOG_STR("gatt nodes inactive: service table build failed"));
+  } else {
+    this->gatt_connected_ = true;
+    auto view = table.view();
+    for (auto *node : this->gatt_nodes_) {
+      node->on_connected(view);
+      if (this->state() != espbt::ClientState::ESTABLISHED) {
+        // The node tore the link down; remaining nodes get on_disconnected
+        // with no preceding on_connected, so leave a trace of why.
+        ESP_LOGW(TAG, "[%s] A node aborted the connection during setup", this->address_str());
+        return false;
+      }
+    }
+    this->gatt_backoff_.reset();
+    this->status_clear_warning();
+  }
+  // Promote so the legacy release condition can fire.
+  for (auto *node : this->gatt_nodes_)
+    node->node_state = espbt::ClientState::ESTABLISHED;
+  return true;
+}
+
+void BLEClient::on_disconnect_complete(esp_err_t reason) {
+  this->pending_gatt_reg_count_ = 0;
+  if (!this->gatt_connected_)
+    return;  // Never-established links report nothing (neutral parity).
+  this->gatt_connected_ = false;
+  for (auto *node : this->gatt_nodes_)
+    node->on_disconnected();
+}
+
+int BLEClient::check_and_log_error_(const char *operation, esp_err_t err) {
+  if (err != ESP_OK)
+    this->log_gattc_warning_(operation, err);
+  return err;
+}
+
+int BLEClient::write_characteristic(uint16_t handle, const uint8_t *data, uint16_t len, bool response) {
+  if (this->conn_id_ == UNSET_CONN_ID)
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  return this->check_and_log_error_(
+      "esp_ble_gattc_write_char",
+      esp_ble_gattc_write_char(this->gattc_if_, this->conn_id_, handle, len, const_cast<uint8_t *>(data),
+                               response ? ESP_GATT_WRITE_TYPE_RSP : ESP_GATT_WRITE_TYPE_NO_RSP,
+                               ESP_GATT_AUTH_REQ_NONE));
+}
+
+int BLEClient::read_characteristic(uint16_t handle) {
+  if (this->conn_id_ == UNSET_CONN_ID)
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  return this->check_and_log_error_("esp_ble_gattc_read_char", esp_ble_gattc_read_char(this->gattc_if_, this->conn_id_,
+                                                                                       handle, ESP_GATT_AUTH_REQ_NONE));
+}
+
+int BLEClient::read_descriptor(uint16_t handle) {
+  if (this->conn_id_ == UNSET_CONN_ID)
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  return this->check_and_log_error_(
+      "esp_ble_gattc_read_char_descr",
+      esp_ble_gattc_read_char_descr(this->gattc_if_, this->conn_id_, handle, ESP_GATT_AUTH_REQ_NONE));
+}
+
+int BLEClient::write_descriptor(uint16_t handle, const uint8_t *data, uint16_t len) {
+  if (this->conn_id_ == UNSET_CONN_ID)
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  return this->check_and_log_error_(
+      "esp_ble_gattc_write_char_descr",
+      esp_ble_gattc_write_char_descr(this->gattc_if_, this->conn_id_, handle, len, const_cast<uint8_t *>(data),
+                                     ESP_GATT_WRITE_TYPE_RSP, ESP_GATT_AUTH_REQ_NONE));
+}
+
+int BLEClient::notify_characteristic(uint16_t handle, bool enable) {
+  if (this->conn_id_ == UNSET_CONN_ID)
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  if (enable) {
+    if (this->find_pending_gatt_reg_(handle) >= 0) {
+      // ESP_OK: the in-flight registration's completion fans out to all nodes.
+      ESP_LOGW(TAG, "[%s] Notify registration already pending for handle 0x%04x", this->address_str(), handle);
+      return ESP_OK;
+    }
+    if (this->pending_gatt_reg_count_ == MAX_PENDING_NOTIFY_REGS) {
+      // An untracked registration would let the base's auto-CCCD through.
+      ESP_LOGE(TAG, "[%s] Too many pending notify registrations", this->address_str());
+      return ble_device_base::GATT_ERR_NO_MEMORY;
+    }
+    // The base helper's pending count holds the service-release until the
+    // (intercepted) completion.
+    esp_err_t err = this->register_for_notify(handle);
+    if (err == ESP_OK)
+      this->pending_gatt_regs_[this->pending_gatt_reg_count_++] = handle;
+    return this->check_and_log_error_("esp_ble_gattc_register_for_notify", err);
+  }
+  return this->check_and_log_error_("esp_ble_gattc_unregister_for_notify",
+                                    esp_ble_gattc_unregister_for_notify(this->gattc_if_, this->remote_bda_, handle));
+}
+
+int BLEClient::unpair() { return bluetooth_connection::unpair_device(this->get_address()); }
+
+#endif  // USE_BLE_CLIENT_GATT_NODES
+
 }  // namespace esphome::ble_client
 
 #endif

esphome/components/ble_client/ble_client.h

@@ -1,18 +1,20 @@
 #pragma once
 
+#include "esphome/core/defines.h"
+
+#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
+
+#include "ble_client_node.h"
+#include "connect_backoff.h"
 #include "esphome/components/esp32_ble_client/ble_client_base.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 #include "esphome/core/component.h"
 #include "esphome/core/helpers.h"
 
-#ifdef USE_ESP32
-
 #include <esp_bt_defs.h>
 #include <esp_gap_ble_api.h>
 #include <esp_gatt_common_api.h>
 #include <esp_gattc_api.h>
-#include <array>
-#include <string>
 #include <vector>
 
 namespace esphome::ble_client {
@@ -21,34 +23,6 @@ namespace espbt = esphome::esp32_ble_tracker;
 
 using namespace esp32_ble_client;
 
-class BLEClient;
-
-class BLEClientNode {
- public:
-  virtual void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
-                                   esp_ble_gattc_cb_param_t *param){};
-  virtual void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) {}
-  virtual void loop() {}
-  void set_address(uint64_t address) { address_ = address; }
-  espbt::ESPBTClient *client;
-  // This should be transitioned to Established once the node no longer needs
-  // the services/descriptors/characteristics of the parent client. This will
-  // allow some memory to be freed.
-  // The parent frees the peer's GATT cache once every node reports Established.
-  // Never report Established while an operation that reads that cache is outstanding.
-  // - esp_ble_gattc_register_for_notify() completes asynchronously.
-  // - Register from ESP_GATTC_SEARCH_CMPL_EVT, then set this from ESP_GATTC_REG_FOR_NOTIFY_EVT.
-  // - BLEClientBase::register_for_notify() holds the release until the registration completes.
-  espbt::ClientState node_state;
-
-  BLEClient *parent() { return this->parent_; }
-  void set_ble_client_parent(BLEClient *parent) { this->parent_ = parent; }
-
- protected:
-  BLEClient *parent_;
-  uint64_t address_;
-};
-
 class BLEClient final : public BLEClientBase {
  public:
   void setup() override;
@@ -64,7 +38,6 @@ class BLEClient final : public BLEClientBase {
   void set_enabled(bool enabled);
 
   void register_ble_node(BLEClientNode *node) {
-    node->client = this;
     node->set_ble_client_parent(this);
     this->nodes_.push_back(node);
   }
@@ -73,10 +46,57 @@ class BLEClient final : public BLEClientBase {
 
   void set_state(espbt::ClientState state) override;
 
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  // ---- the neutral node surface (signatures shared with the non-esp32
+  // engine, so nodes on the neutral interface compile against either) ----
+  void register_gatt_node(BLEClientNode *node);
+
+  bool idle() const { return this->state() == espbt::ClientState::IDLE; }
+
+  int write_characteristic(uint16_t handle, const uint8_t *data, uint16_t len, bool response);
+  int read_characteristic(uint16_t handle);
+  int read_descriptor(uint16_t handle);
+  int write_descriptor(uint16_t handle, const uint8_t *data, uint16_t len);
+  /// Local registration only; per the neutral contract the CCCD write is the
+  /// node's job (the legacy auto-CCCD is suppressed for these handles).
+  int notify_characteristic(uint16_t handle, bool enable);
+  // pair() comes from BLEClientBase, matching the neutral engine's.
+  int unpair();
+#endif
+
  protected:
   bool all_nodes_established_();
+  void maybe_release_services_();
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  int check_and_log_error_(const char *operation, esp_err_t err);
+  int find_pending_gatt_reg_(uint16_t handle) const;
+  void notify_state_to_gatt_nodes_(uint16_t handle, bool enabled, int error);
+  void dispatch_gatt_event_(esp_gattc_cb_event_t event, esp_ble_gattc_cb_param_t *param);
+  // False = failed discovery: the link comes down and the caller suppresses
+  // the legacy fan-out.
+  bool handle_gatt_search_cmpl_(esp_gatt_status_t status);
+  bool take_pending_gatt_reg_(uint16_t handle);
+  void on_disconnect_complete(esp_err_t reason) override;
+#endif
 
   std::vector<BLEClientNode *> nodes_;
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  // Raise if a migrated node needs more concurrent registrations.
+  static constexpr uint8_t MAX_PENDING_NOTIFY_REGS = 4;
+
+  // Nodes on the neutral surface; fed the translated callbacks and
+  // auto-established after the on_connected fan-out. Every gatt node is
+  // also in nodes_ (registration pushes into both).
+  StaticVector<BLEClientNode *, ESPHOME_BLE_CLIENT_MAX_NODES> gatt_nodes_;
+  bool has_legacy_nodes_() const { return this->nodes_.size() > this->gatt_nodes_.size(); }
+  // Reconnect backoff after materializer failures.
+  ConnectBackoff gatt_backoff_;
+  // Bridge-initiated notify registrations awaiting REG_FOR_NOTIFY_EVT.
+  uint16_t pending_gatt_regs_[MAX_PENDING_NOTIFY_REGS];
+  uint8_t pending_gatt_reg_count_{0};
+  // on_connected fan-out started; on_disconnected is owed at teardown.
+  bool gatt_connected_{false};
+#endif
 };
 
 }  // namespace esphome::ble_client

esphome/components/ble_client/ble_client_gatt.cpp

@@ -0,0 +1,249 @@
+#include "ble_client_gatt.h"
+
+#if defined(USE_BLE_GATT_CLIENT) && !defined(USE_BLE_CLIENT_LEGACY_ENGINE)
+
+#include "esphome/core/hal.h"
+#include "esphome/core/log.h"
+
+namespace esphome::ble_client {
+
+static const char *const TAG = "ble_client";
+
+void BLEClient::register_ble_node(BLEClientNode *node) {
+  node->set_ble_client_parent(this);
+  if (this->nodes_.size() == ESPHOME_BLE_CLIENT_MAX_NODES) {
+    // push_back past capacity is a silent no-op; an undersized slot count
+    // must be loud at boot, not an unresolvable node at runtime.
+    ESP_LOGE(TAG, "[%s] Node capacity exceeded; node dropped", this->address_str_);
+    this->status_set_error(LOG_STR("node capacity exceeded"));
+    return;
+  }
+  this->nodes_.push_back(node);
+}
+
+void BLEClient::set_address(uint64_t address) {
+  this->address_ = address;
+  uint8_t mac[6];
+  ble_device_base::uint64_to_mac_msb_first(address, mac);
+  format_mac_addr_upper(mac, this->address_str_);
+}
+
+void BLEClient::set_enabled(bool enabled) {
+  if (enabled == this->enabled)
+    return;
+  ESP_LOGI(TAG, "[%s] %s", this->address_str_, enabled ? "Enabled" : "Disabled");
+  this->enabled = enabled;
+  if (!enabled) {
+    this->disconnect();
+    return;
+  }
+  // A re-enable clears the backoff; the next sighting connects (legacy
+  // parity: enabling does not itself connect).
+  this->backoff_.reset();
+}
+
+bool BLEClient::parse_device(const ble_device_base::ESPBTDevice &device) {
+  if (device.address_uint64() != this->address_)
+    return false;
+  // The sighting is the source of truth for the address type.
+  this->address_type_ = device.get_address_type();
+  this->address_type_known_ = true;
+  if (!this->enabled || !this->auto_connect_ || this->state_ != State::IDLE)
+    return true;
+  if (this->backoff_.holding_off())
+    return true;
+  this->attempt_connect_();
+  return true;
+}
+
+void BLEClient::connect() {
+  if (this->state_ != State::IDLE) {
+    ESP_LOGD(TAG, "[%s] Connect requested while busy, ignoring", this->address_str_);
+    return;
+  }
+  // An absent peer can inhibit scanning for the backend's full connect
+  // timeout, so this is worth a breadcrumb - but it is a supported action.
+  ESP_LOGI(TAG, "[%s] Connecting on request", this->address_str_);
+  if (!this->address_type_known_) {
+    // Legacy parity: without a sighting the address type defaults to
+    // public, which never matches a random-static peer.
+    ESP_LOGW(TAG, "[%s] No sighting yet; assuming a public address type", this->address_str_);
+  }
+  this->attempt_connect_();
+}
+
+void BLEClient::attempt_connect_() {
+  int err = this->backend_->connect(this->address_, this->address_type_);
+  if (err != 0) {
+    // A refused connect never produces a callback: stay idle, charge the
+    // backoff, and resolve any waiting connect action through the failure
+    // path so its chain terminates.
+    ESP_LOGW(TAG, "[%s] Connect refused, err=%d", this->address_str_, err);
+    this->backoff_.register_failure(this->address_str_);
+    this->defer([this]() { this->connect_failed_callbacks_.call(); });
+    return;
+  }
+  ESP_LOGD(TAG, "[%s] Connecting", this->address_str_);
+  this->state_ = State::CONNECTING;
+}
+
+void BLEClient::disconnect() {
+  if (this->state_ == State::IDLE) {
+    ESP_LOGD(TAG, "[%s] Disconnect requested while idle, ignoring", this->address_str_);
+    return;
+  }
+  // A deliberate teardown's failure report must not feed the backoff.
+  this->cancel_requested_ = true;
+  int err = this->backend_->gatt_disconnect();
+  if (err != 0) {
+    // Refused synchronously: backend and client disagree about the link
+    // state. Warn, then settle through the deliberate-cancel path.
+    ESP_LOGW(TAG, "[%s] Disconnect refused, err=%d; settling locally", this->address_str_, err);
+    this->on_connection_state(false, 0, err);
+  }
+}
+
+void BLEClient::on_connection_state(bool connected, uint16_t mtu, int error) {
+  if (connected) {
+    this->state_ = State::DISCOVERING;
+    int discover_err = this->backend_->discover_services();
+    if (discover_err != 0) {
+      // Synchronous refusal: no discovery completion will follow.
+      ESP_LOGW(TAG, "[%s] Service discovery refused, err=%d", this->address_str_, discover_err);
+      this->backoff_.register_failure(this->address_str_);
+      // Deliberate teardown: its report must not charge the backoff again.
+      this->disconnect();
+    }
+    return;
+  }
+  bool was_connected = this->state_ == State::CONNECTED;
+  bool cancelled = this->cancel_requested_;
+  this->cancel_requested_ = false;
+  this->state_ = State::IDLE;
+  if (was_connected) {
+    ESP_LOGI(TAG, "[%s] Disconnected, status=%d", this->address_str_, error);
+    for (auto *node : this->nodes_) {
+      node->on_disconnected();
+    }
+    // Continuations leave the backend's event-drain stack first.
+    this->defer([this]() { this->disconnect_callbacks_.call(); });
+  } else {
+    if (cancelled) {
+      // status carries the refusal code when the teardown settled
+      // synchronously; 0 on a backend-completed cancel.
+      ESP_LOGD(TAG, "[%s] Connect attempt cancelled, status=%d", this->address_str_, error);
+    } else {
+      ESP_LOGW(TAG, "[%s] Connect failed, status=%d", this->address_str_, error);
+      this->backoff_.register_failure(this->address_str_);
+    }
+    this->defer([this]() { this->connect_failed_callbacks_.call(); });
+  }
+}
+
+void BLEClient::on_service_discovery_done(int error) {
+  if (error != 0) {
+    ESP_LOGW(TAG, "[%s] Service discovery failed, status=%d", this->address_str_, error);
+    this->backoff_.register_failure(this->address_str_);
+    // The teardown is deliberate: do not charge the backoff again for its
+    // connection report.
+    this->disconnect();
+    return;
+  }
+  ble_device_base::GattServiceTable table{};
+  if (!this->nodes_.empty()) {
+    // Materialize only when a node will read it: a client with no nodes
+    // would pay the build/free cycle on every (re)connect for nothing.
+    table = this->backend_->get_service_table();
+    if (table.service_count == 0) {
+      // A failed materialization is indistinguishable from a service-less
+      // peer, and a real GATT peer always exposes at least GAP/GATT: fail
+      // the discovery before CONNECTED so the teardown resolves through
+      // connect_failed, never a spurious on_disconnect.
+      ESP_LOGW(TAG, "[%s] Service table is empty; treating as failed discovery", this->address_str_);
+      this->backend_->release_services();
+      this->backoff_.register_failure(this->address_str_);
+      this->disconnect();
+      return;
+    }
+  }
+  // CONNECTED before the fan-out so nodes may consult connected() from
+  // their own on_connected().
+  this->state_ = State::CONNECTED;
+  for (auto *node : this->nodes_) {
+    node->on_connected(table);
+    if (this->state_ != State::CONNECTED || this->cancel_requested_) {
+      // A node tore the link down mid-fan-out: on_disconnect fires with no
+      // preceding on_connect, so leave a trace of why.
+      ESP_LOGW(TAG, "[%s] A node aborted the connection during setup", this->address_str_);
+      this->backend_->release_services();
+      return;
+    }
+  }
+  this->backend_->release_services();
+  this->backoff_.reset();
+  ESP_LOGI(TAG, "[%s] Connected", this->address_str_);
+  this->defer([this]() { this->connect_callbacks_.call(); });
+}
+
+void BLEClient::on_write_result(uint16_t handle, int error) {
+  if (error != 0) {
+    // Breadcrumb even when no node claims the handle.
+    ESP_LOGD(TAG, "[%s] Write on handle 0x%04x completed with status %d", this->address_str_, handle, error);
+  }
+  for (auto *node : this->nodes_) {
+    node->on_write_result(handle, error);
+  }
+}
+
+void BLEClient::on_read_result(uint16_t handle, const uint8_t *data, uint16_t len, int error) {
+  if (error != 0) {
+    // Breadcrumb even when no node claims the handle.
+    ESP_LOGD(TAG, "[%s] Read on handle 0x%04x completed with status %d", this->address_str_, handle, error);
+  }
+  for (auto *node : this->nodes_) {
+    node->on_read_result(handle, data, len, error);
+  }
+}
+
+void BLEClient::on_notify_data(uint16_t handle, const uint8_t *data, uint16_t len) {
+  // Every node sees every notification and filters by handle (legacy parity).
+  for (auto *node : this->nodes_) {
+    node->on_notify(handle, data, len);
+  }
+}
+
+void BLEClient::on_notify_state(uint16_t handle, bool enabled, int error) {
+  if (error != 0) {
+    ESP_LOGW(TAG, "[%s] Notify %s on handle 0x%04x failed, status=%d", this->address_str_,
+             enabled ? "enable" : "disable", handle, error);
+  }
+  for (auto *node : this->nodes_) {
+    node->on_notify_state(handle, enabled, error);
+  }
+}
+
+void BLEClient::on_pairing_result(int status) {
+  if (status != 0) {
+    ESP_LOGW(TAG, "[%s] Pairing failed, status=%d", this->address_str_, status);
+  } else {
+    ESP_LOGI(TAG, "[%s] Paired", this->address_str_);
+  }
+  for (auto *node : this->nodes_) {
+    node->on_pairing_result(status);
+  }
+}
+
+void BLEClient::dump_config() {
+  ESP_LOGCONFIG(TAG,
+                "BLE Client:\n"
+                "  Address: %s\n"
+                "  Auto connect: %s",
+                this->address_str_, YESNO(this->auto_connect_));
+  if (this->enabled && this->state_ == State::IDLE) {
+    ESP_LOGCONFIG(TAG, "  Waiting for an advertisement from the device");
+  }
+}
+
+}  // namespace esphome::ble_client
+
+#endif  // USE_BLE_GATT_CLIENT && !USE_BLE_CLIENT_LEGACY_ENGINE

esphome/components/ble_client/ble_client_gatt.h

@@ -0,0 +1,149 @@
+// Platform-neutral ble_client engine on the ble_device_base GATT contract.
+//
+// Compiled on every platform with a GATT backend except esp32, which keeps
+// the legacy BLEClientBase engine (ble_client.h) until its raw-gattc node
+// family migrates - the exclusive gates make the same class names resolve to
+// exactly one definition per build, so codegen is shared.
+//
+// Connects are sighting-gated like the legacy engine: the client is a parsed
+// advertisement listener, captures the peer's address type from the sighting,
+// and asks the backend to connect only when enabled and idle.
+
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#if defined(USE_BLE_GATT_CLIENT) && !defined(USE_BLE_CLIENT_LEGACY_ENGINE)
+
+#include "ble_client_node.h"
+#include "connect_backoff.h"
+#include "esphome/components/ble_device_base/ble_device.h"
+#include "esphome/components/ble_device_base/ble_gatt_client.h"
+#include "esphome/components/bluetooth_connection/bluetooth_connection.h"
+#include "esphome/components/bluetooth_connection/bluetooth_connection_gatt_backend.h"
+#include "esphome/core/component.h"
+#include "esphome/core/helpers.h"
+
+#include <cstdint>
+#include <functional>
+
+namespace esphome::ble_client {
+
+class BLEClient : public Component,
+                  public ble_device_base::ESPBTDeviceListener,
+                  public ble_device_base::GattClientListener {
+ public:
+  void dump_config() override;
+
+  // Public field for legacy parity (the switch platform republishes it).
+  bool enabled{true};
+
+  void set_backend(ble_device_base::BLEGattConnection *backend) {
+    this->backend_ = backend;
+    backend->set_listener(this);
+  }
+  void set_address(uint64_t address);
+  void set_auto_connect(bool auto_connect) { this->auto_connect_ = auto_connect; }
+  void set_enabled(bool enabled);
+  const char *address_str() const { return this->address_str_; }
+
+  void register_ble_node(BLEClientNode *node);
+  // One registration spelling shared with the esp32 engine's bridge.
+  void register_gatt_node(BLEClientNode *node) { this->register_ble_node(node); }
+
+  bool connected() const { return this->state_ == State::CONNECTED; }
+  bool idle() const { return this->state_ == State::IDLE; }
+
+  /// Action-initiated connect (no sighting needed; uses the last captured
+  /// address type, public until a sighting arrives). No-op unless idle.
+  void connect();
+  void disconnect();
+
+  /// Legacy-named deferral used by the automation twins: neutral listener
+  /// callbacks run inside the backend's event drain, so automation chain
+  /// continuations must leave that stack first.
+  void run_later(std::function<void()> &&f) { this->defer(std::move(f)); }  // NOLINT
+
+  // Backend ops for nodes and actions - the frozen node-facing surface.
+  // Only write_characteristic has an in-tree caller; subscribing means
+  // notify_characteristic plus a CCCD write_descriptor (the caller's job
+  // per the contract).
+  int write_characteristic(uint16_t handle, const uint8_t *data, uint16_t len, bool response) {
+    return this->backend_->write_characteristic(handle, data, len, response);
+  }
+  int read_characteristic(uint16_t handle) { return this->backend_->read_characteristic(handle); }
+  int read_descriptor(uint16_t handle) { return this->backend_->read_descriptor(handle); }
+  int write_descriptor(uint16_t handle, const uint8_t *data, uint16_t len) {
+    return this->backend_->write_descriptor(handle, data, len);
+  }
+  int notify_characteristic(uint16_t handle, bool enable) {
+    return this->backend_->notify_characteristic(handle, enable);
+  }
+  int pair() { return this->backend_->pair(); }
+  int unpair() { return bluetooth_connection::unpair_device(this->address_); }
+
+  // Automation callback registration.
+  template<typename F> void add_on_connect_callback(F &&callback) {
+    this->connect_callbacks_.add(std::forward<F>(callback));
+  }
+  template<typename F> void add_on_disconnect_callback(F &&callback) {
+    this->disconnect_callbacks_.add(std::forward<F>(callback));
+  }
+  // Fired when a connect attempt dies before being established; the user
+  // on_disconnect trigger deliberately does NOT fire here (legacy parity).
+  template<typename F> void add_on_connect_failed_callback(F &&callback) {
+    this->connect_failed_callbacks_.add(std::forward<F>(callback));
+  }
+
+  // ---- ble_device_base::ESPBTDeviceListener ----
+  bool parse_device(const ble_device_base::ESPBTDevice &device) override;
+
+  // ---- ble_device_base::GattClientListener ----
+  void on_connection_state(bool connected, uint16_t mtu, int error) override;
+  void on_service_discovery_done(int error) override;
+  void on_read_result(uint16_t handle, const uint8_t *data, uint16_t len, int error) override;
+  void on_write_result(uint16_t handle, int error) override;
+  void on_notify_data(uint16_t handle, const uint8_t *data, uint16_t len) override;
+  void on_notify_state(uint16_t handle, bool enabled, int error) override;
+  void on_pairing_result(int status) override;
+
+ protected:
+  enum class State : uint8_t { IDLE, CONNECTING, DISCOVERING, CONNECTED };
+
+  void attempt_connect_();
+
+  // Group 1: pointers / containers
+  ble_device_base::BLEGattConnection *backend_{nullptr};
+  // Codegen-sized (ESPHOME_BLE_CLIENT_MAX_NODES); filled during setup.
+  StaticVector<BLEClientNode *, ESPHOME_BLE_CLIENT_MAX_NODES> nodes_;
+
+  // Group 2: 8-byte types
+  uint64_t address_{0};
+
+  // Group 3: callback managers (pointer-sized when empty)
+  LazyCallbackManager<void()> connect_callbacks_;
+  LazyCallbackManager<void()> disconnect_callbacks_;
+  LazyCallbackManager<void()> connect_failed_callbacks_;
+
+  // Group 4: 4-byte types
+  // Backoff so an undiscoverable database or a dead peer cannot produce a
+  // battery-draining connect loop.
+  ConnectBackoff backoff_;
+
+  // Group 5: arrays
+  char address_str_[MAC_ADDRESS_PRETTY_BUFFER_SIZE]{};
+
+  // Group 6: 1-byte types
+  State state_{State::IDLE};
+  uint8_t address_type_{0};  // BLE_ADDR_TYPE_*, captured from the sighting
+  // Distinguishes a captured public type from the never-sighted default.
+  bool address_type_known_{false};
+  bool auto_connect_{true};
+  // A user-initiated teardown in flight; its failure report is not a
+  // connect failure and must not feed the backoff.
+  bool cancel_requested_{false};
+};
+
+}  // namespace esphome::ble_client
+
+#endif  // USE_BLE_GATT_CLIENT && !USE_BLE_CLIENT_LEGACY_ENGINE

esphome/components/ble_client/ble_client_node.h

@@ -0,0 +1,68 @@
+// The single BLEClientNode both ble_client engines share. The neutral
+// callback surface is the one interface node components build on; the raw
+// esp32 surface below it remains for components that have not migrated yet.
+
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#ifdef USE_BLE_GATT_CLIENT
+#include "esphome/components/ble_device_base/ble_gatt_client.h"
+#endif
+#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
+#include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
+
+#include <esp_gap_ble_api.h>
+#include <esp_gattc_api.h>
+#endif
+
+#include <cstdint>
+
+namespace esphome::ble_client {
+
+class BLEClient;
+
+class BLEClientNode {
+ public:
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  // Neutral surface, delivered by both engines. The table is borrowed: copy
+  // handles during on_connected(). All nodes see all completions; filter by
+  // handle.
+  // A node that disconnects from inside on_connected() aborts the fan-out;
+  // the user's on_disconnect may then fire without a preceding on_connect.
+  virtual void on_connected(const ble_device_base::GattServiceTable &table) {}
+  virtual void on_disconnected() {}
+  virtual void on_notify(uint16_t handle, const uint8_t *data, uint16_t len) {}
+  // One in-flight registration per handle; its completion fans out to every
+  // node, so a refused duplicate request still sees on_notify_state.
+  virtual void on_notify_state(uint16_t handle, bool enabled, int error) {}
+  virtual void on_read_result(uint16_t handle, const uint8_t *data, uint16_t len, int error) {}
+  virtual void on_write_result(uint16_t handle, int error) {}
+  virtual void on_pairing_result(int status) {}
+#endif
+#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
+  // Legacy raw surface; components overriding these need the legacy engine
+  // until migrated to the neutral surface above.
+  virtual void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
+                                   esp_ble_gattc_cb_param_t *param) {}
+  virtual void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) {}
+  virtual void loop() {}
+  // This should be transitioned to Established once the node no longer needs
+  // the services/descriptors/characteristics of the parent client. This will
+  // allow some memory to be freed.
+  // The parent frees the peer's GATT cache once every node reports Established.
+  // Never report Established while an operation that reads that cache is outstanding.
+  // - esp_ble_gattc_register_for_notify() completes asynchronously.
+  // - Register from ESP_GATTC_SEARCH_CMPL_EVT, then set this from ESP_GATTC_REG_FOR_NOTIFY_EVT.
+  // - BLEClientBase::register_for_notify() holds the release until the registration completes.
+  esp32_ble_tracker::ClientState node_state;
+#endif
+
+  BLEClient *parent() const { return this->parent_; }
+  void set_ble_client_parent(BLEClient *parent) { this->parent_ = parent; }
+
+ protected:
+  BLEClient *parent_{nullptr};
+};
+
+}  // namespace esphome::ble_client

esphome/components/ble_client/ble_write_action.h

@@ -0,0 +1,168 @@
+// The ble_client.ble_write action: a node on the platform-neutral interface,
+// so one implementation serves both engines (the esp32 bridge and the
+// neutral engine).
+
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#ifdef USE_BLE_CLIENT_GATT_NODES
+
+#include <tuple>
+#include <vector>
+
+// One of the two engine headers resolves per build.
+#include "ble_client.h"
+#include "ble_client_gatt.h"
+#include "ble_client_node.h"
+#include "esphome/core/automation.h"
+#include "esphome/core/helpers.h"
+#include "esphome/core/log.h"
+
+namespace esphome::ble_client {
+
+static const char *const BLE_WRITE_TAG = "ble_client.automation";
+
+// Maximum bytes to log in hex format for BLE writes (many logging buffers are 256 chars)
+static constexpr size_t BLE_WRITE_MAX_LOG_BYTES = 64;
+
+template<typename... Ts> class BLEClientWriteAction final : public Action<Ts...>, public BLEClientNode {
+ public:
+  BLEClientWriteAction(BLEClient *ble_client) {
+    ble_client->register_gatt_node(this);
+    ble_client_ = ble_client;
+  }
+
+  void set_service_uuid16(uint16_t uuid) { this->service_uuid_ = ble_device_base::ESPBTUUID::from_uint16(uuid); }
+  void set_service_uuid32(uint32_t uuid) { this->service_uuid_ = ble_device_base::ESPBTUUID::from_uint32(uuid); }
+  void set_service_uuid128(uint8_t *uuid) { this->service_uuid_ = ble_device_base::ESPBTUUID::from_raw(uuid); }
+
+  void set_char_uuid16(uint16_t uuid) { this->char_uuid_ = ble_device_base::ESPBTUUID::from_uint16(uuid); }
+  void set_char_uuid32(uint32_t uuid) { this->char_uuid_ = ble_device_base::ESPBTUUID::from_uint32(uuid); }
+  void set_char_uuid128(uint8_t *uuid) { this->char_uuid_ = ble_device_base::ESPBTUUID::from_raw(uuid); }
+
+  void set_value_template(std::vector<uint8_t> (*func)(Ts...)) {
+    this->value_.func = func;
+    this->len_ = -1;  // Sentinel value indicates template mode
+  }
+
+  // Store pointer to static data in flash (no RAM copy)
+  void set_value_simple(const uint8_t *data, size_t len) {
+    this->value_.data = data;
+    this->len_ = len;  // Length >= 0 indicates static mode
+  }
+
+  void play(const Ts &...x) override {}
+
+  void play_complex(const Ts &...x) override {
+    this->num_running_++;
+    this->var_ = std::make_tuple(x...);
+
+    bool result;
+    if (this->len_ >= 0) {
+      result = this->write(this->value_.data, this->len_);
+    } else {
+      std::vector<uint8_t> value = this->value_.func(x...);
+      result = this->write(value.data(), value.size());
+    }
+
+    // on write failure, continue the automation chain rather than stopping so
+    // that e.g. disconnect can work.
+    if (!result)
+      this->play_next_(x...);
+  }
+
+  // Initiate the write; the completion arrives in on_write_result. The
+  // response-less path can complete synchronously inside the call, so the
+  // handle is armed before the backend is touched.
+  bool write(const uint8_t *data, size_t len) {
+    if (!this->ble_client_->connected()) {
+      esph_log_w(BLE_WRITE_TAG, "Cannot write to BLE characteristic - not connected");
+      return false;
+    }
+    if (!this->resolved_) {
+      esph_log_w(BLE_WRITE_TAG, "Cannot write to BLE characteristic - characteristic was not resolved");
+      return false;
+    }
+#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERY_VERBOSE
+    char hex_buf[format_hex_pretty_size(BLE_WRITE_MAX_LOG_BYTES)];
+    esph_log_vv(BLE_WRITE_TAG, "Will write %d bytes: %s", len, format_hex_pretty_to(hex_buf, data, len));
+#endif
+    int err = this->ble_client_->write_characteristic(this->char_handle_, data, len, this->write_response_);
+    if (err != 0) {
+      esph_log_e(BLE_WRITE_TAG, "Error writing to characteristic: %d!", err);
+      return false;
+    }
+    return true;
+  }
+
+  void on_connected(const ble_device_base::GattServiceTable &table) override {
+    const auto *service = ble_device_base::find_service(table, this->service_uuid_);
+    const auto *chr =
+        service == nullptr ? nullptr : ble_device_base::find_characteristic(table, *service, this->char_uuid_);
+    if (chr == nullptr) {
+      char char_buf[ble_device_base::UUID_STR_LEN];
+      char service_buf[ble_device_base::UUID_STR_LEN];
+      esph_log_w(BLE_WRITE_TAG, "Characteristic %s was not found in service %s", this->char_uuid_.to_str(char_buf),
+                 this->service_uuid_.to_str(service_buf));
+      return;
+    }
+    if (chr->properties & ble_device_base::GATT_CHAR_PROP_WRITE) {
+      this->write_response_ = true;
+    } else if (chr->properties & ble_device_base::GATT_CHAR_PROP_WRITE_NO_RSP) {
+      this->write_response_ = false;
+    } else {
+      char char_buf[ble_device_base::UUID_STR_LEN];
+      esph_log_e(BLE_WRITE_TAG, "Characteristic %s does not allow writing", this->char_uuid_.to_str(char_buf));
+      return;
+    }
+    this->char_handle_ = chr->value_handle;
+    this->resolved_ = true;
+    char char_buf[ble_device_base::UUID_STR_LEN];
+    esph_log_d(BLE_WRITE_TAG, "Found characteristic %s on device %s", this->char_uuid_.to_str(char_buf),
+               this->ble_client_->address_str());
+  }
+
+  void on_disconnected() override {
+    this->resolved_ = false;
+    this->char_handle_ = 0;
+    if (this->num_running_ != 0)
+      this->stop_complex();
+  }
+
+  void on_write_result(uint16_t handle, int error) override {
+    if (this->num_running_ == 0) {
+      return;
+    }
+    if (!this->resolved_ || handle != this->char_handle_) {
+      // A parked chain waiting on a completion that never matches would
+      // otherwise stall silently until disconnect.
+      esph_log_d(BLE_WRITE_TAG, "Write result for handle 0x%04x ignored, waiting on 0x%04x", handle,
+                 this->char_handle_);
+      return;
+    }
+    if (error != 0) {
+      // Continue the chain (legacy parity) but leave a breadcrumb.
+      esph_log_w(BLE_WRITE_TAG, "Write completed with status %d", error);
+    }
+    this->ble_client_->run_later([this]() { this->play_next_tuple_(this->var_); });
+  }
+
+ private:
+  BLEClient *ble_client_;
+  ssize_t len_{-1};  // -1 = template mode, >=0 = static mode with length
+  union Value {
+    std::vector<uint8_t> (*func)(Ts...);  // Function pointer (stateless lambdas)
+    const uint8_t *data;                  // Pointer to static data in flash
+  } value_;
+  ble_device_base::ESPBTUUID service_uuid_;
+  ble_device_base::ESPBTUUID char_uuid_;
+  std::tuple<Ts...> var_{};
+  uint16_t char_handle_{};
+  bool write_response_{false};
+  bool resolved_{false};
+};
+
+}  // namespace esphome::ble_client
+
+#endif  // USE_BLE_CLIENT_GATT_NODES

esphome/components/ble_client/connect_backoff.h

@@ -0,0 +1,43 @@
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#ifdef USE_BLE_GATT_CLIENT
+
+#include "esphome/core/hal.h"
+#include "esphome/core/log.h"
+
+#include <cstdint>
+
+namespace esphome::ble_client {
+
+/// Reconnect backoff after repeated connect/discovery failures, shared by
+/// both engines. 256 ms ticks in a uint16_t keep it 4 bytes; the ~4.7 h tick
+/// wrap can at worst reinstate one stale hold-off of a minute.
+class ConnectBackoff {
+ public:
+  bool holding_off() const {
+    return this->failures_ != 0 && static_cast<uint16_t>(now() - this->start_) < this->failures_ * STEP_TICKS;
+  }
+  void register_failure(const char *address_str) {
+    if (this->failures_ < MAX_STEPS)
+      this->failures_++;
+    this->start_ = now();
+    esph_log_w("ble_client", "[%s] Holding off reconnect for %u s", address_str, this->failures_ * 10u);
+  }
+  void reset() { this->failures_ = 0; }
+
+ private:
+  // ~10 s per consecutive failure, capped so a flapping peer retries within
+  // a minute at worst.
+  static constexpr uint16_t STEP_TICKS = 40;  // x 256 ms
+  static constexpr uint8_t MAX_STEPS = 6;
+  static uint16_t now() { return static_cast<uint16_t>(millis() >> 8); }
+
+  uint16_t start_{0};
+  uint8_t failures_{0};
+};
+
+}  // namespace esphome::ble_client
+
+#endif  // USE_BLE_GATT_CLIENT

esphome/components/ble_client/output/ble_binary_output.cpp

@@ -80,8 +80,9 @@ void BLEBinaryOutput::write_state(bool state) {
   esp_err_t err =
       esp_ble_gattc_write_char(this->parent()->get_gattc_if(), this->parent()->get_conn_id(), this->char_handle_,
                                sizeof(state_as_uint), &state_as_uint, this->write_type_, ESP_GATT_AUTH_REQ_NONE);
-  if (err != ESP_GATT_OK)
+  if (err != ESP_GATT_OK) {
     ESP_LOGW(TAG, "[%s] Write error, err=%d", this->char_uuid_.to_str(char_buf), err);
+  }
 }
 
 }  // namespace esphome::ble_client

esphome/components/ble_device_base/ble_gatt_client.cpp

@@ -0,0 +1,48 @@
+#include "ble_gatt_client.h"
+
+#ifdef USE_BLE_GATT_CLIENT
+
+#include "esphome/core/log.h"
+
+namespace esphome::ble_device_base {
+
+static const char *const TAG = "ble_gatt_client";
+
+const GattCharacteristic *find_characteristic(const GattServiceTable &table, const GattService &service,
+                                              const ESPBTUUID &uuid) {
+  // 32-bit range math: a corrupt first/count pair cannot wrap past the check.
+  uint32_t end = uint32_t(service.first_characteristic) + service.characteristic_count;
+  if (end > table.characteristic_count) {
+    ESP_LOGW(TAG, "characteristic range out of bounds");
+    return nullptr;
+  }
+  for (uint32_t i = service.first_characteristic; i < end; i++) {
+    if (table.characteristics[i].uuid == uuid)
+      return &table.characteristics[i];
+  }
+  return nullptr;
+}
+
+const GattDescriptor *find_descriptor(const GattServiceTable &table, const GattCharacteristic &characteristic,
+                                      const ESPBTUUID &uuid) {
+  uint32_t end = uint32_t(characteristic.first_descriptor) + characteristic.descriptor_count;
+  if (end > table.descriptor_count) {
+    // Corrupt range, not a missing descriptor.
+    ESP_LOGW(TAG, "descriptor range out of bounds");
+    return nullptr;
+  }
+  for (uint32_t i = characteristic.first_descriptor; i < end; i++) {
+    if (table.descriptors[i].uuid == uuid)
+      return &table.descriptors[i];
+  }
+  return nullptr;
+}
+
+uint16_t find_cccd(const GattServiceTable &table, const GattCharacteristic &characteristic) {
+  const GattDescriptor *desc = find_descriptor(table, characteristic, ESPBTUUID::from_uint16(CCCD_UUID));
+  return desc != nullptr ? desc->handle : 0;
+}
+
+}  // namespace esphome::ble_device_base
+
+#endif  // USE_BLE_GATT_CLIENT

esphome/components/ble_device_base/ble_gatt_client.h

@@ -11,13 +11,16 @@
 // interface. All listener calls are delivered on the ESPHome main loop;
 // borrowed data pointers are valid only for the duration of the call.
 //
-// Error domain (plain int, forwarded to the API without translation):
+// Error domain (plain int, forwarded to the API without translation, so the
+// values are wire-frozen - API clients interpret them):
 //   0            success
-//   1..0x11      ATT error codes (Bluetooth spec; BTstack and Bluedroid agree)
+//   1..0x11      ATT error codes (Bluetooth spec) - reserved; a backend whose
+//                native error codes land in this window must remap them out
 //   GATT_ERR_NOT_CONNECTED (-1)  no connection to the peer (on esp32 a raw
 //                ESP_FAIL from the stack shares this value; both read as a
 //                failed, unusable connection on the client side)
 //   GATT_ERR_NO_MEMORY (-2)      backend storage exhausted
+//   -1..-15      reserved for future contract sentinels
 //   anything else: platform stack error/status code, surfaced opaquely.
 // Connection events carry HCI status/disconnect reason codes (same code
 // space on every controller).
@@ -99,9 +102,18 @@ class GattClientListener {
 // The BLEGattConnection op surface, asserted where the alias binds
 // (bluetooth_connection_gatt_backend.h). Operations return 0 when accepted (completion arrives
 // through the listener) or a synchronous error (busy, not connected, stack
-// rejection); one operation may be outstanding at a time. Semantics beyond
-// the signatures:
+// rejection); one operation may be outstanding at a time. An accepted
+// operation's completion is delivered from the event loop, NEVER
+// synchronously from inside the op call - a synchronous terminal
+// on_connection_state from within gatt_disconnect() would re-enter the
+// consumer mid-teardown. Semantics beyond the signatures:
 // - connect: addr_type is a BLE_ADDR_TYPE_* constant (ble_device.h).
+//   Returning 0 means the request is accepted, not that the radio acted: the
+//   backend owns integration with its platform's scan/connect arbitration
+//   (Bluedroid parks the request for the tracker's promote loop, which owns
+//   scan-stop/coex/one-connect-at-a-time; the rp2 backend opens immediately
+//   and relies on sighting-gated consumers). Consumers must not assume
+//   connect timing.
 // - gatt_disconnect: also cancels a connect in progress (named to coexist
 //   with a platform stack's own void disconnect() on one backend class).
 //   Nonzero means nothing to tear down and no completion will follow; an
@@ -143,6 +155,41 @@ concept BLEGattConnectionContract = requires(T conn, GattClientListener *listene
   { conn.set_connection_type(ConnectionType{}) } -> std::same_as<void>;
 };
 
+// ---- service table lookup helpers ----
+//
+// Neutral, bounds-checked walks over a materialized GattServiceTable for
+// direct consumers that resolve a known device's handles by UUID (streaming
+// consumers forward the raw database and never need these). Linear search:
+// the table exists only between discovery and release_services(), for one
+// small known device.
+
+/// Client Characteristic Configuration descriptor UUID (Bluetooth spec).
+static constexpr uint16_t CCCD_UUID = 0x2902;
+
+// Characteristic property bits (the Bluetooth-spec declaration byte carried
+// in GattCharacteristic::properties; the ESP-IDF macros for these do not
+// exist on the other platforms).
+static constexpr uint8_t GATT_CHAR_PROP_WRITE_NO_RSP = 0x04;
+static constexpr uint8_t GATT_CHAR_PROP_WRITE = 0x08;
+
+inline const GattService *find_service(const GattServiceTable &table, const ESPBTUUID &uuid) {
+  for (uint16_t i = 0; i < table.service_count; i++) {
+    if (table.services[i].uuid == uuid)
+      return &table.services[i];
+  }
+  return nullptr;
+}
+
+const GattCharacteristic *find_characteristic(const GattServiceTable &table, const GattService &service,
+                                              const ESPBTUUID &uuid);
+
+const GattDescriptor *find_descriptor(const GattServiceTable &table, const GattCharacteristic &characteristic,
+                                      const ESPBTUUID &uuid);
+
+/// Handle of the characteristic's Client Characteristic Configuration
+/// descriptor (0x2902), or 0 when it has none.
+uint16_t find_cccd(const GattServiceTable &table, const GattCharacteristic &characteristic);
+
 }  // namespace esphome::ble_device_base
 
 #endif  // USE_BLE_GATT_CLIENT

esphome/components/bluetooth_connection/__init__.py

@@ -1,12 +1,14 @@
 """Per-platform GATT connection backends and the helpers to embed one.
 
-Backends: esp32 Bluedroid, rp2 BTstack. No user-facing configuration; the
-Bluetooth proxy's codegen declares and registers the backend instances
-through gatt_client_schema()/hub_connection_schema() + new_gatt_backend().
+Backends: esp32 Bluedroid, rp2 BTstack. No user-facing configuration; a
+consumer's codegen declares and registers the backend instances — the
+Bluetooth proxy through its per-slot connection wrappers (a streaming
+consumer), and the neutral ble_client through gatt_client_schema() +
+new_gatt_backend().
 """
 
 from collections.abc import Awaitable, Callable
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 
 import esphome.codegen as cg
 from esphome.components import rp2040_ble
@@ -23,7 +25,8 @@ from esphome.types import ConfigType
 def AUTO_LOAD() -> list[str]:
     """ble_device_base plus the platform BLE stack the build's backend
     registers with (the Bluedroid header includes the tracker's), so
-    consumers need not know. The platform-less arm serves manifest tooling."""
+    consumers stay platform-blind. The platform-less arm serves tooling that
+    resolves the manifest without a target."""
     if CORE.is_esp32:
         return ["ble_device_base", "esp32_ble_tracker"]
     if CORE.is_rp2:
@@ -63,6 +66,8 @@ DOMAIN = "bluetooth_connection"
 @dataclass
 class _ConnectionData:
     rp2_backend_count: int = 0
+    # GATT connection slots claimed this run, for the platform cap check.
+    slot_consumers: list[str] = field(default_factory=list)
 
 
 def _get_data() -> _ConnectionData:
@@ -119,6 +124,10 @@ class _PlatformBackend:
     backend_class: cg.MockObjClass
     schema_fragment: Callable[[], cv.Schema]
     register: Callable[[cg.MockObj, ConfigType], Awaitable[None]]
+    # Selects the backend's alias-ladder arm (order-independent arms).
+    define: str
+    # The backend's on-demand materializer gate, when it has one.
+    materializer_define: str | None = None
 
 
 # The single registry of platforms with a GATT client backend; a platform
@@ -126,11 +135,20 @@ class _PlatformBackend:
 # platform's arm.
 _PLATFORM_BACKENDS: dict[str, _PlatformBackend] = {
     PLATFORM_ESP32: _PlatformBackend(
-        BluedroidGattClient, _esp32_schema_fragment, _esp32_register
+        BluedroidGattClient,
+        _esp32_schema_fragment,
+        _esp32_register,
+        "USE_BLE_GATT_BACKEND_BLUEDROID",
+        materializer_define="USE_BLUEDROID_GATT_SERVICE_TABLE",
+    ),
+    PLATFORM_RP2: _PlatformBackend(
+        RP2GattClient, _rp2_schema_fragment, _rp2_register, "USE_BLE_GATT_BACKEND_RP2"
     ),
-    PLATFORM_RP2: _PlatformBackend(RP2GattClient, _rp2_schema_fragment, _rp2_register),
 }
 
+# Gates dedicated-backend consumers (cv.only_on).
+GATT_CLIENT_PLATFORMS = list(_PLATFORM_BACKENDS)
+
 
 def _backend_entry(platform: str | None = None) -> _PlatformBackend:
     key = platform if platform is not None else CORE.target_platform
@@ -165,21 +183,89 @@ def hub_connection_schema(platform: str | None = None) -> cv.Schema:
     )
 
 
-async def new_gatt_backend(config: ConfigType) -> cg.MockObj:
+def consume_gatt_slot(
+    consumer: str, count: int = 1
+) -> Callable[[ConfigType], ConfigType]:
+    """Validator claiming GATT connection slots - the one spelling for every
+    claimant. Platforms whose BLE stack owns a connection budget (esp32, rp2)
+    are charged there and their stack's final validation reports an
+    overcommit; the neutral ledger covers any future backend platform without
+    one (the cap check in FINAL_VALIDATE_SCHEMA)."""
+
+    def validator(config: ConfigType) -> ConfigType:
+        _get_data().slot_consumers.extend([consumer] * count)
+        if CORE.is_esp32:
+            from esphome.components import esp32_ble
+
+            esp32_ble.consume_connection_slots(count, consumer)(config)
+        elif CORE.target_platform == PLATFORM_RP2:
+            rp2040_ble.consume_connection_slots(count, consumer)(config)
+        return config
+
+    return validator
+
+
+# Platforms whose BLE stack owns its own connection budget: consume_gatt_slot
+# charges it there, and the stack's final validation is the one place an
+# overcommit is reported (never two messages for one misconfiguration).
+_STACK_BUDGET_PLATFORMS = {PLATFORM_ESP32, PLATFORM_RP2}
+
+
+def _validate_slot_totals(config: ConfigType) -> ConfigType:
+    # Skipped in testing mode so grouped component builds can co-exist
+    # (mirrors esp32_ble.validate_connection_slots).
+    if CORE.testing_mode:
+        return config
+    if CORE.target_platform in _STACK_BUDGET_PLATFORMS:
+        return config
+    if (cap := HUB_MAX_CONNECTIONS.get(CORE.target_platform)) is None:
+        # Any backend platform without a stack budget must carry a cap here
+        # or fail loudly, never fail open.
+        if CORE.target_platform in _PLATFORM_BACKENDS:
+            raise cv.Invalid(
+                f"{CORE.target_platform} has a GATT backend but no slot cap "
+                "in HUB_MAX_CONNECTIONS"
+            )
+        return config
+    claimed = _get_data().slot_consumers
+    if len(claimed) > cap:
+        raise cv.Invalid(
+            f"{CORE.target_platform} supports at most {cap} GATT client "
+            f"connection(s); {len(claimed)} requested by: {', '.join(claimed)}"
+        )
+    return config
+
+
+FINAL_VALIDATE_SCHEMA = _validate_slot_totals
+
+
+async def new_gatt_backend(
+    config: ConfigType, *, service_table: bool = True
+) -> cg.MockObj:
     """Instantiate the backend declared by gatt_client_schema() and register
     it with its platform stack. The connection slot is claimed at validation
-    (the proxy's slot validators), not here.
+    (the consume_gatt_slot validators), not here.
+
+    service_table is honored by the Bluedroid backend only: forward
+    scaffolding for the first esp32 direct consumer, load-bearing on no
+    current build (rp2 ignores the define and always materializes - its
+    proxy hub streams through get_service_table(), so it must keep the
+    materializer regardless of the flag).
     """
     from esphome.components import ble_device_base
 
+    entry = _backend_entry()
     ble_device_base.request_gatt_client()
+    cg.add_define(entry.define)
+    if service_table and entry.materializer_define is not None:
+        cg.add_define(entry.materializer_define)
     backend = cg.new_Pvariable(config[CONF_BACKEND_ID])
     # The backend is the slot's real Component: component keys from the
     # connection entry (setup_priority, ...) apply to it. Consumers whose own
     # schema carries keys that register_component would misapply to the
     # backend (e.g. a polling interval) must not put them in this config.
     await cg.register_component(backend, config)
-    await _backend_entry().register(backend, config)
+    await entry.register(backend, config)
     return backend
 
 
@@ -187,6 +273,7 @@ async def new_gatt_backend(config: ConfigType) -> cg.MockObj:
 # list (this module cannot import bluetooth_proxy to derive it).
 SOURCE_FILE_FRAMEWORKS: dict[str, set[PlatformFramework]] = {
     "bluetooth_connection_bluedroid.cpp": frameworks_for_platforms([PLATFORM_ESP32]),
+    "gatt_service_table_bluedroid.cpp": frameworks_for_platforms([PLATFORM_ESP32]),
     # Every hub platform the proxy admits (the file compiles empty where
     # USE_BLE_GATT_CLIENT is not defined), so a platform gaining a backend
     # cannot hit a missing-symbol trap here.

esphome/components/bluetooth_connection/bluetooth_connection.cpp

@@ -46,7 +46,7 @@ BatchClose close_service_batch(api::BluetoothGATTGetServicesResponse &resp, size
 
 #endif  // USE_BLUETOOTH_PROXY_CONNECTIONS
 
-#if defined(USE_ESP32) && defined(USE_BLE_GATT_CLIENT)
+#if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT)
 namespace esphome::bluetooth_connection {
 
 // Address-scoped Bluedroid maintenance. Gated with the connection surface:
@@ -65,4 +65,4 @@ conn_err_t clear_gatt_cache(uint64_t address) {
 }
 
 }  // namespace esphome::bluetooth_connection
-#endif  // USE_ESP32 && USE_BLE_GATT_CLIENT
+#endif  // USE_ESP32_BLE && USE_BLE_GATT_CLIENT

esphome/components/bluetooth_connection/bluetooth_connection.h

@@ -48,15 +48,16 @@ static constexpr conn_err_t CONN_OK = 0;
 // GATT contract so backend and wrapper cannot drift.
 static constexpr conn_err_t GATT_NOT_CONNECTED = ble_device_base::GATT_ERR_NOT_CONNECTED;
 
-// What the platform's connection backend supports beyond GATT operations;
-// the proxy derives its feature flags and legacy version from these.
-#if defined(USE_ESP32)
+// What the build's connection backend supports beyond GATT operations; the
+// proxy derives its feature flags and legacy version from these. Keyed on
+// the backend define, never the platform, so a second backend on one
+// platform carries its own facts.
+#if defined(USE_BLE_GATT_BACKEND_BLUEDROID)
 static constexpr bool SUPPORTS_PAIRING = true;
 static constexpr bool SUPPORTS_CACHE_CLEARING = true;
-#elif defined(USE_RP2040_BLE) && defined(USE_BLE_GATT_CLIENT)
+#elif defined(USE_BLE_GATT_BACKEND_RP2)
 // The rp2 BTstack backend pairs (just works + bonding); it has no service
-// cache to clear. Keyed on the backend, not the generic client define, so a
-// future backend without pairing keeps the stub arm below.
+// cache to clear.
 static constexpr bool SUPPORTS_PAIRING = true;
 static constexpr bool SUPPORTS_CACHE_CLEARING = false;
 #else
@@ -64,13 +65,14 @@ static constexpr bool SUPPORTS_PAIRING = false;
 static constexpr bool SUPPORTS_CACHE_CLEARING = false;
 #endif
 
-// Address-scoped (not connection-scoped) maintenance requests.
-#if (defined(USE_ESP32) || defined(USE_RP2040_BLE)) && defined(USE_BLE_GATT_CLIENT)
+// Address-scoped (not connection-scoped) maintenance requests; keyed on the
+// stack (the calls need no backend instance).
+#if (defined(USE_ESP32_BLE) || defined(USE_RP2040_BLE)) && defined(USE_BLE_GATT_CLIENT)
 conn_err_t unpair_device(uint64_t address);
 #else
 inline conn_err_t unpair_device(uint64_t) { return GATT_NOT_CONNECTED; }
 #endif
-#if defined(USE_ESP32) && defined(USE_BLE_GATT_CLIENT)
+#if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT)
 conn_err_t clear_gatt_cache(uint64_t address);
 #else
 inline conn_err_t clear_gatt_cache(uint64_t) { return GATT_NOT_CONNECTED; }

esphome/components/bluetooth_connection/bluetooth_connection_bluedroid.cpp

@@ -2,10 +2,11 @@
 
 #if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT)
 
+#include "bluetooth_connection.h"
+
 // The in-place streamer serves the proxy's service-discovery API; backend-only
 // builds compile without the proxy headers or the streamer.
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
-#include "bluetooth_connection.h"
 #include "bluetooth_connection_hub.h"
 
 #include "esphome/components/bluetooth_proxy/bluetooth_proxy.h"
@@ -300,6 +301,9 @@ int BluedroidGattClient::update_connection_params(uint16_t min_interval, uint16_
 
 void BluedroidGattClient::release_services() {
   this->service_total_ = 0;
+#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
+  this->table_.free();
+#endif
   // Always set: terminates any in-flight stream on every cache config.
   this->services_released_ = true;
 #ifndef CONFIG_BT_GATTC_CACHE_NVS_FLASH
@@ -312,6 +316,24 @@ void BluedroidGattClient::release_services() {
 #endif
 }
 
+#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
+ble_device_base::GattServiceTable BluedroidGattClient::get_service_table() {
+  // Lifetime: every teardown path (CLOSE_EVT, the safety timeout, stack-down,
+  // passive DISCONNECT) routes through release_services(), so a materialized
+  // table cannot outlive its link.
+  if (this->table_.empty() &&
+      (this->services_released_ || this->service_total_ == 0 ||
+       !this->table_.build(this->gattc_if_, this->conn_id_, this->service_total_, this->connection_index_))) {
+    // Released / no services / failed build all collapse to empty; the
+    // build failures warned above, log the quiet two.
+    ESP_LOGD(TAG, "[%d] No service table (released=%d, services=%u)", this->connection_index_, this->services_released_,
+             this->service_total_);
+    return {};
+  }
+  return this->table_.view();
+}
+#endif  // USE_BLUEDROID_GATT_SERVICE_TABLE
+
 // ---- internals ----
 
 bool BluedroidGattClient::check_addr_(const esp_bd_addr_t &addr) const {
@@ -358,6 +380,11 @@ void BluedroidGattClient::log_gattc_warning_(const char *operation, int code) {
 // ---- service streaming ----
 
 int BluedroidGattClient::handle_search_cmpl_(esp_gatt_status_t status) {
+#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
+  // Re-discovery moves the counts the table view derives offsets from; free
+  // the stale table.
+  this->table_.free();
+#endif
   // Step down from the fast discovery params.
   this->update_conn_params_(MEDIUM_MIN_CONN_INTERVAL, MEDIUM_MAX_CONN_INTERVAL, 0, MEDIUM_CONN_TIMEOUT, "medium");
   if (status != ESP_GATT_OK) {

esphome/components/bluetooth_connection/bluetooth_connection_bluedroid.h

@@ -11,6 +11,9 @@
 
 #if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT)
 
+#include "bluetooth_connection.h"
+#include "gatt_service_table_bluedroid.h"
+
 #include "esphome/components/ble_device_base/ble_gatt_client.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 #include "esphome/core/component.h"
@@ -72,11 +75,16 @@ class BluedroidGattClient final : public esp32_ble_tracker::ESPBTClient, public
   int notify_characteristic(uint16_t handle, bool enable);
   int pair();
   int update_connection_params(uint16_t min_interval, uint16_t max_interval, uint16_t latency, uint16_t timeout);
-  // Contract stub: the proxy streams in place; the on-demand materializer
-  // for direct consumers lands with #18205. NOTE: a direct consumer reaching
-  // this stub gets an empty table indistinguishable from a service-less
-  // peer - do not ship one against this backend before the materializer.
+  // On-demand table for direct consumers; the proxy streams instead, so the
+  // materializer compiles only under USE_BLUEDROID_GATT_SERVICE_TABLE (emitted by
+  // direct-consumer codegen, never by the proxy).
+#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
+  ble_device_base::GattServiceTable get_service_table();
+#else
+  // A direct consumer reaching this stub misconfigured its codegen
+  // (service_table=False): the empty table reads as a service-less peer.
   ble_device_base::GattServiceTable get_service_table() { return {}; }
+#endif
   void release_services();
 
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
@@ -105,6 +113,9 @@ class BluedroidGattClient final : public esp32_ble_tracker::ESPBTClient, public
 
   // Group 1: pointers / composed objects
   ble_device_base::GattClientListener *listener_{nullptr};
+#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
+  BluedroidServiceTable table_;
+#endif
   // Group 2: 4-byte types
   uint32_t disconnecting_started_{0};
 

esphome/components/bluetooth_connection/bluetooth_connection_gatt_backend.h

@@ -12,10 +12,12 @@
 
 #include "esphome/components/ble_device_base/ble_gatt_client.h"
 
-#if defined(USE_RP2040_BLE)
+// Arms are keyed on codegen-emitted per-backend defines (_PLATFORM_BACKENDS
+// in __init__.py), so they are order-independent.
+#if defined(USE_BLE_GATT_BACKEND_RP2)
 #include "bluetooth_connection_rp2.h"
 #define ESPHOME_BLE_GATT_CONNECTION_TYPE bluetooth_connection::RP2GattClient
-#elif defined(USE_ESP32_BLE)
+#elif defined(USE_BLE_GATT_BACKEND_BLUEDROID)
 #include "bluetooth_connection_bluedroid.h"
 #define ESPHOME_BLE_GATT_CONNECTION_TYPE bluetooth_connection::BluedroidGattClient
 #elif defined(USE_BLE_GATT_CLIENT_STUB_BACKEND)

esphome/components/bluetooth_connection/gatt_service_table_bluedroid.cpp

@@ -0,0 +1,198 @@
+#include "gatt_service_table_bluedroid.h"
+
+#if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT) && defined(USE_BLUEDROID_GATT_SERVICE_TABLE)
+
+#include "esphome/core/log.h"
+
+namespace esphome::bluetooth_connection {
+
+static const char *const TAG = "gatt_service_table";
+
+// A stack that never reports end-of-range would otherwise walk forever.
+static constexpr uint16_t MAX_DESCRIPTORS_PER_CHARACTERISTIC = 64;
+
+// Shared enumeration for both build passes: an identical walk order is what
+// lets the counting pass size the block the filling pass fills.
+// INVALID_OFFSET/NOT_FOUND mean end-of-range; anything else is a failure.
+template<typename ServiceFn, typename CharFn, typename DescFn>
+bool BluedroidServiceTable::walk_(ServiceFn &&on_service, CharFn &&on_char, DescFn &&on_desc) {
+  for (uint16_t s = 0; s < this->service_total_; s++) {
+    esp_gattc_service_elem_t svc;
+    uint16_t svc_count = 1;
+    auto svc_status = esp_ble_gattc_get_service(this->gattc_if_, this->conn_id_, nullptr, &svc, &svc_count, s);
+    if (svc_status != ESP_GATT_OK || svc_count == 0) {
+      this->log_walk_warning_("esp_ble_gattc_get_service", svc_status);
+      return false;
+    }
+    if (!on_service(s, svc)) {
+      return false;
+    }
+    uint16_t svc_chars = 0;
+    auto count_status = esp_ble_gattc_get_attr_count(this->gattc_if_, this->conn_id_, ESP_GATT_DB_CHARACTERISTIC,
+                                                     svc.start_handle, svc.end_handle, 0, &svc_chars);
+    if (count_status != ESP_GATT_OK) {
+      this->log_walk_warning_("esp_ble_gattc_get_attr_count", count_status);
+      return false;
+    }
+    for (uint16_t c = 0; c < svc_chars; c++) {
+      esp_gattc_char_elem_t chr;
+      uint16_t char_count = 1;
+      auto status = esp_ble_gattc_get_all_char(this->gattc_if_, this->conn_id_, svc.start_handle, svc.end_handle, &chr,
+                                               &char_count, c);
+      if (status != ESP_GATT_OK || char_count == 0) {
+        // An early terminator contradicts svc_chars from the same cache;
+        // never build a silently truncated table.
+        this->log_walk_warning_("esp_ble_gattc_get_all_char", status);
+        return false;
+      }
+      if (!on_char(svc, chr)) {
+        return false;
+      }
+      for (uint16_t d = 0;; d++) {
+        if (d == MAX_DESCRIPTORS_PER_CHARACTERISTIC) {
+          // A stack that never reports end-of-range; fail like every other
+          // inconsistency instead of truncating the table silently.
+          ESP_LOGW(TAG, "[%d] Descriptor walk exceeded %u entries", this->log_index_,
+                   MAX_DESCRIPTORS_PER_CHARACTERISTIC);
+          return false;
+        }
+        esp_gattc_descr_elem_t desc;
+        uint16_t desc_count = 1;
+        auto desc_status =
+            esp_ble_gattc_get_all_descr(this->gattc_if_, this->conn_id_, chr.char_handle, &desc, &desc_count, d);
+        if (desc_status == ESP_GATT_INVALID_OFFSET || desc_status == ESP_GATT_NOT_FOUND) {
+          break;
+        }
+        if (desc_status != ESP_GATT_OK || desc_count == 0) {
+          this->log_walk_warning_("esp_ble_gattc_get_all_descr", desc_status);
+          return false;
+        }
+        if (!on_desc(chr, desc)) {
+          return false;
+        }
+      }
+    }
+  }
+  return true;
+}
+
+bool BluedroidServiceTable::count_services(esp_gatt_if_t gattc_if, uint16_t conn_id, uint16_t *total) {
+  uint16_t primary = 0;
+  uint16_t secondary = 0;
+  if (esp_ble_gattc_get_attr_count(gattc_if, conn_id, ESP_GATT_DB_PRIMARY_SERVICE, 0x0001, 0xFFFF, 0, &primary) !=
+          ESP_GATT_OK ||
+      esp_ble_gattc_get_attr_count(gattc_if, conn_id, ESP_GATT_DB_SECONDARY_SERVICE, 0x0001, 0xFFFF, 0, &secondary) !=
+          ESP_GATT_OK) {
+    // A failed count must not read as an authoritative empty database.
+    return false;
+  }
+  *total = primary + secondary;
+  return true;
+}
+
+bool BluedroidServiceTable::build(esp_gatt_if_t gattc_if, uint16_t conn_id, uint16_t service_total, uint8_t log_index) {
+  this->free();
+  this->gattc_if_ = gattc_if;
+  this->conn_id_ = conn_id;
+  this->service_total_ = service_total;
+  this->log_index_ = log_index;
+
+  // Pass 1: count, so one exact-size block holds the whole table.
+  uint16_t char_total = 0;
+  uint16_t desc_total = 0;
+  bool counted = this->walk_([](uint16_t, const esp_gattc_service_elem_t &) { return true; },
+                             [&](const esp_gattc_service_elem_t &, const esp_gattc_char_elem_t &) {
+                               char_total++;
+                               return true;
+                             },
+                             [&](const esp_gattc_char_elem_t &, const esp_gattc_descr_elem_t &) {
+                               desc_total++;
+                               return true;
+                             });
+  if (!counted) {
+    ESP_LOGW(TAG, "[%d] Service table walk failed during count", this->log_index_);
+    this->free();
+    return false;
+  }
+
+  // The arrays share one block; carving stays aligned because each struct's
+  // strictest member is the UUID and array sizes are multiples of it.
+  static_assert(alignof(ble_device_base::GattService) >= alignof(ble_device_base::GattCharacteristic) &&
+                alignof(ble_device_base::GattCharacteristic) >= alignof(ble_device_base::GattDescriptor));
+  size_t svc_bytes = this->service_total_ * sizeof(ble_device_base::GattService);
+  size_t char_bytes = char_total * sizeof(ble_device_base::GattCharacteristic);
+  size_t total_bytes = svc_bytes + char_bytes + desc_total * sizeof(ble_device_base::GattDescriptor);
+  RAMAllocator<uint8_t> allocator(RAMAllocator<uint8_t>::ALLOC_INTERNAL);
+  this->storage_ = allocator.allocate(total_bytes);
+  if (this->storage_ == nullptr) {
+    ESP_LOGW(TAG, "[%d] Service table allocation failed (%u bytes)", this->log_index_,
+             static_cast<unsigned>(total_bytes));
+    this->free();
+    return false;
+  }
+  auto *services = reinterpret_cast<ble_device_base::GattService *>(this->storage_);
+  auto *characteristics = reinterpret_cast<ble_device_base::GattCharacteristic *>(this->storage_ + svc_bytes);
+  auto *descriptors = reinterpret_cast<ble_device_base::GattDescriptor *>(this->storage_ + svc_bytes + char_bytes);
+
+  // Pass 2: fill, bounded by the pass-1 totals. A bound trip or a shortfall
+  // means the cached database changed between the passes; fail the build
+  // rather than serve an inconsistent table (the consumer retries).
+  uint16_t char_index = 0;
+  uint16_t desc_index = 0;
+  ble_device_base::GattService *cur_service = nullptr;
+  ble_device_base::GattCharacteristic *cur_char = nullptr;
+  bool filled = this->walk_(
+      [&](uint16_t s, const esp_gattc_service_elem_t &svc) {
+        cur_service = &services[s];
+        cur_service->uuid = ble_device_base::ESPBTUUID::from_uuid(svc.uuid);
+        cur_service->start_handle = svc.start_handle;
+        cur_service->end_handle = svc.end_handle;
+        cur_service->first_characteristic = char_index;
+        cur_service->characteristic_count = 0;
+        return true;
+      },
+      [&](const esp_gattc_service_elem_t &svc, const esp_gattc_char_elem_t &chr) {
+        if (char_index >= char_total) {
+          return false;
+        }
+        cur_char = &characteristics[char_index++];
+        cur_char->uuid = ble_device_base::ESPBTUUID::from_uuid(chr.uuid);
+        cur_char->value_handle = chr.char_handle;
+        // Bluedroid addresses descriptors by characteristic handle, so the
+        // table's end_handle only needs the service-bounded upper bound.
+        cur_char->end_handle = svc.end_handle;
+        cur_char->properties = chr.properties;
+        cur_char->first_descriptor = desc_index;
+        cur_char->descriptor_count = 0;
+        cur_service->characteristic_count++;
+        return true;
+      },
+      [&](const esp_gattc_char_elem_t &, const esp_gattc_descr_elem_t &desc) {
+        if (desc_index >= desc_total) {
+          return false;
+        }
+        descriptors[desc_index].uuid = ble_device_base::ESPBTUUID::from_uuid(desc.uuid);
+        descriptors[desc_index].handle = desc.handle;
+        desc_index++;
+        cur_char->descriptor_count++;
+        return true;
+      });
+  if (!filled || char_index != char_total || desc_index != desc_total) {
+    // Walk error or the database changed between passes; better an empty
+    // table than a corrupt one.
+    ESP_LOGW(TAG, "[%d] Service table walk mismatch, discarding", this->log_index_);
+    this->free();
+    return false;
+  }
+  this->char_total_ = char_total;
+  this->desc_total_ = desc_total;
+  return true;
+}
+
+void BluedroidServiceTable::log_walk_warning_(const char *operation, int code) {
+  ESP_LOGW(TAG, "[%d] %s failed, status=%d", this->log_index_, operation, code);
+}
+
+}  // namespace esphome::bluetooth_connection
+
+#endif  // USE_ESP32_BLE && USE_BLE_GATT_CLIENT && USE_BLUEDROID_GATT_SERVICE_TABLE

esphome/components/bluetooth_connection/gatt_service_table_bluedroid.h

@@ -0,0 +1,80 @@
+// Owning two-pass materializer of one Bluedroid GATT database snapshot into
+// the neutral GattServiceTable layout, shared by the BluedroidGattClient
+// backend and ble_client's esp32 engine.
+
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT) && defined(USE_BLUEDROID_GATT_SERVICE_TABLE)
+
+#include "esphome/components/ble_device_base/ble_gatt_client.h"
+#include "esphome/core/helpers.h"
+
+#include <esp_gattc_api.h>
+
+namespace esphome::bluetooth_connection {
+
+class BluedroidServiceTable {
+ public:
+  ~BluedroidServiceTable() { this->free(); }
+  // Owns storage_; a copy would double-free.
+  BluedroidServiceTable() = default;
+  BluedroidServiceTable(const BluedroidServiceTable &) = delete;
+  BluedroidServiceTable &operator=(const BluedroidServiceTable &) = delete;
+
+  /// The service count build() requires: the stack's PRIMARY+SECONDARY
+  /// attribute totals, never the SEARCH_RES event count.
+  static bool count_services(esp_gatt_if_t gattc_if, uint16_t conn_id, uint16_t *total);
+
+  /// Two-pass build from the stack's cached database (service_total from
+  /// count_services()). log_index labels warnings. Frees any previous table
+  /// first; on failure the table is left empty.
+  bool build(esp_gatt_if_t gattc_if, uint16_t conn_id, uint16_t service_total, uint8_t log_index);
+
+  // The view is carved from the storage block and the counts on each call
+  // (a cold path) rather than cached, saving a per-instance table member.
+  ble_device_base::GattServiceTable view() const {
+    size_t svc_bytes = this->service_total_ * sizeof(ble_device_base::GattService);
+    size_t char_bytes = this->char_total_ * sizeof(ble_device_base::GattCharacteristic);
+    return {reinterpret_cast<const ble_device_base::GattService *>(this->storage_),
+            reinterpret_cast<const ble_device_base::GattCharacteristic *>(this->storage_ + svc_bytes),
+            reinterpret_cast<const ble_device_base::GattDescriptor *>(this->storage_ + svc_bytes + char_bytes),
+            this->service_total_,
+            this->char_total_,
+            this->desc_total_};
+  }
+
+  // Always resets the counts: a failed build must never leave a non-zero
+  // service_total_ behind a null table.
+  void free() {
+    if (this->storage_ != nullptr) {
+      RAMAllocator<uint8_t> allocator(RAMAllocator<uint8_t>::ALLOC_INTERNAL);
+      allocator.deallocate(this->storage_, 0);
+      this->storage_ = nullptr;
+    }
+    this->service_total_ = 0;
+    this->char_total_ = 0;
+    this->desc_total_ = 0;
+  }
+
+  bool empty() const { return this->storage_ == nullptr; }
+
+ private:
+  template<typename ServiceFn, typename CharFn, typename DescFn>
+  bool walk_(ServiceFn &&on_service, CharFn &&on_char, DescFn &&on_desc);
+  void log_walk_warning_(const char *operation, int code);
+
+  uint8_t *storage_{nullptr};
+  uint16_t service_total_{0};
+  uint16_t char_total_{0};
+  uint16_t desc_total_{0};
+  // Walk context, set by build().
+  uint16_t conn_id_{0};
+  esp_gatt_if_t gattc_if_{};  // uint8_t width
+  uint8_t log_index_{0};
+};
+
+}  // namespace esphome::bluetooth_connection
+
+#endif  // USE_ESP32_BLE && USE_BLE_GATT_CLIENT && USE_BLUEDROID_GATT_SERVICE_TABLE

esphome/components/bluetooth_proxy/__init__.py

@@ -98,9 +98,15 @@ def _esp32_config_schema() -> cv.All:
                 raise cv.Invalid(
                     "Connections can only be used if the proxy is set to active"
                 )
+            # Explicit entries claim slots like the generated ones; dev
+            # historically skipped this, letting an explicit-connections
+            # config evade the controller budget.
+            bluetooth_connection.consume_gatt_slot(
+                "bluetooth_proxy", len(config[CONF_CONNECTIONS])
+            )(config)
         elif config[CONF_ACTIVE]:
             connection_slots: int = config[CONF_CONNECTION_SLOTS]
-            esp32_ble.consume_connection_slots(connection_slots, "bluetooth_proxy")(
+            bluetooth_connection.consume_gatt_slot("bluetooth_proxy", connection_slots)(
                 config
             )
 
@@ -157,14 +163,14 @@ def _rp2_config_schema() -> cv.All:
     connection_schema = bluetooth_connection.hub_connection_schema(PLATFORM_RP2)
 
     def populate_connections(config: ConfigType) -> ConfigType:
-        from esphome.components import rp2040_ble
-
         # One wrapper + backend pair per slot, declared during validation so
         # their ids exist for codegen (the esp32 arm's `connections` pattern).
         if not config[CONF_ACTIVE]:
             return config
         connection_slots: int = config[CONF_CONNECTION_SLOTS]
-        rp2040_ble.consume_connection_slots(connection_slots, "bluetooth_proxy")(config)
+        bluetooth_connection.consume_gatt_slot("bluetooth_proxy", connection_slots)(
+            config
+        )
         return {
             **config,
             CONF_CONNECTIONS: [connection_schema({}) for _ in range(connection_slots)],
@@ -214,7 +220,9 @@ async def _connections_to_code(var: cg.MockObj, config: ConfigType) -> None:
         # sends those requests and their handlers and encoders are dead.
         cg.add_define("USE_BLUETOOTH_PROXY_CONNECTIONS")
     for connection_conf in connections:
-        backend = await bluetooth_connection.new_gatt_backend(connection_conf)
+        backend = await bluetooth_connection.new_gatt_backend(
+            connection_conf, service_table=False
+        )
         connection = cg.new_Pvariable(connection_conf[CONF_ID])
         cg.add(connection.set_backend(backend))
         cg.add(var.register_connection(connection))

esphome/components/bme680/bme680.cpp

@@ -327,10 +327,12 @@ void BME680Component::read_data_() {
 
   ESP_LOGD(TAG, "Got temperature=%.1f°C pressure=%.1fhPa humidity=%.1f%% gas_resistance=%.1fΩ", temperature, pressure,
            humidity, gas_resistance);
-  if (!gas_valid)
+  if (!gas_valid) {
     ESP_LOGW(TAG, "Gas measurement unsuccessful, reading invalid!");
-  if (!heat_stable)
+  }
+  if (!heat_stable) {
     ESP_LOGW(TAG, "Heater unstable, reading invalid! (Normal for a few readings after a power cycle)");
+  }
 
   if (this->temperature_sensor_ != nullptr)
     this->temperature_sensor_->publish_state(temperature);

esphome/components/bme680_bsec/bme680_bsec.cpp

@@ -162,8 +162,9 @@ void BME680BSECComponent::dump_config() {
                 "  Supply Voltage: %sV\n"
                 "  Sample Rate: %s\n"
                 "  State Save Interval: %" PRIu32 "ms",
-                this->temperature_offset_, this->iaq_mode_ == IAQ_MODE_STATIC ? "Static" : "Mobile",
-                this->supply_voltage_ == SUPPLY_VOLTAGE_3V3 ? "3.3" : "1.8",
+                this->temperature_offset_,
+                this->iaq_mode_ == IAQ_MODE_STATIC ? LOG_STR_LITERAL("Static") : LOG_STR_LITERAL("Mobile"),
+                this->supply_voltage_ == SUPPLY_VOLTAGE_3V3 ? LOG_STR_LITERAL("3.3") : LOG_STR_LITERAL("1.8"),
                 BME680_BSEC_SAMPLE_RATE_LOG(this->sample_rate_), this->state_save_interval_ms_);
 
   LOG_SENSOR("  ", "Temperature", this->temperature_sensor_);

esphome/components/captive_portal/captive_index.h

@@ -7,146 +7,146 @@ namespace esphome::captive_portal {
 
 #ifdef USE_CAPTIVE_PORTAL_GZIP
 constexpr uint8_t INDEX_GZ[] PROGMEM = {
-    0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x95, 0x16, 0x6b, 0x8f, 0xdb, 0x36, 0xf2, 0x7b, 0x7f,
-    0x05, 0x8f, 0x4d, 0x1b, 0xa9, 0xb1, 0xa8, 0x87, 0xd7, 0xde, 0x44, 0x96, 0x54, 0xa4, 0x7b, 0x2d, 0x5a, 0xa0, 0x69,
-    0x03, 0xec, 0x36, 0xf7, 0x21, 0x08, 0xb0, 0x34, 0x39, 0xb2, 0x98, 0xa5, 0x48, 0x1d, 0x49, 0xbf, 0x62, 0xf8, 0x7e,
-    0xfb, 0x81, 0x92, 0xec, 0xf5, 0x2e, 0x9a, 0x03, 0x0e, 0x86, 0x85, 0x19, 0xce, 0x7b, 0x38, 0x0f, 0x16, 0xff, 0xe0,
-    0x9a, 0xb9, 0x7d, 0x07, 0xa8, 0x71, 0xad, 0xac, 0x0a, 0xff, 0x45, 0x92, 0xaa, 0x55, 0x09, 0xaa, 0x2a, 0x1a, 0xa0,
-    0xbc, 0x2a, 0x5a, 0x70, 0x14, 0xb1, 0x86, 0x1a, 0x0b, 0xae, 0xfc, 0xeb, 0xee, 0x97, 0xe8, 0x75, 0x55, 0x48, 0xa1,
-    0x1e, 0x90, 0x01, 0x59, 0x0a, 0xa6, 0x15, 0x6a, 0x0c, 0xd4, 0x25, 0xa7, 0x8e, 0xe6, 0xa2, 0xa5, 0x2b, 0x18, 0x45,
-    0x14, 0x6d, 0xa1, 0xdc, 0x08, 0xd8, 0x76, 0xda, 0x38, 0xc4, 0xb4, 0x72, 0xa0, 0x5c, 0x89, 0xb7, 0x82, 0xbb, 0xa6,
-    0xe4, 0xb0, 0x11, 0x0c, 0xa2, 0x1e, 0x99, 0x08, 0x25, 0x9c, 0xa0, 0x32, 0xb2, 0x8c, 0x4a, 0x28, 0xd3, 0xc9, 0xda,
-    0x82, 0xe9, 0x11, 0xba, 0x94, 0x50, 0x2a, 0x8d, 0xab, 0xc2, 0x32, 0x23, 0x3a, 0x87, 0xbc, 0xab, 0x65, 0xab, 0xf9,
-    0x5a, 0x42, 0x15, 0xc7, 0xd4, 0x5a, 0x70, 0x36, 0x16, 0x8a, 0xc3, 0x8e, 0xd0, 0x6b, 0xb8, 0xa6, 0x2c, 0x4d, 0xc8,
-    0x67, 0xfb, 0x0d, 0xd7, 0x6c, 0xdd, 0x82, 0x72, 0x44, 0x6a, 0x46, 0x9d, 0xd0, 0x8a, 0x58, 0xa0, 0x86, 0x35, 0x65,
-    0x59, 0xe2, 0x1f, 0x2d, 0xdd, 0x00, 0xfe, 0xfe, 0xfb, 0xe0, 0xcc, 0xb4, 0x02, 0xf7, 0xb3, 0x04, 0x0f, 0xda, 0x9f,
-    0xf6, 0x77, 0x74, 0xf5, 0x07, 0x6d, 0x21, 0xc0, 0xd4, 0x0a, 0x0e, 0x38, 0xfc, 0x98, 0x7c, 0x22, 0xd6, 0xed, 0x25,
-    0x10, 0x2e, 0x6c, 0x27, 0xe9, 0xbe, 0xc4, 0x4b, 0xa9, 0xd9, 0x03, 0x0e, 0x17, 0xf5, 0x5a, 0x31, 0xaf, 0x1c, 0xe9,
-    0x00, 0xc2, 0x83, 0x04, 0x87, 0x5c, 0xf9, 0x8e, 0xba, 0x86, 0xb4, 0x74, 0x17, 0x0c, 0x80, 0x50, 0x41, 0xf6, 0x43,
-    0x00, 0xaf, 0xd2, 0x24, 0x09, 0x27, 0xfd, 0x27, 0x09, 0xe3, 0x34, 0x49, 0x16, 0x06, 0xdc, 0xda, 0x28, 0x44, 0x83,
-    0xfb, 0xa2, 0xa3, 0xae, 0x41, 0xbc, 0xc4, 0xef, 0xd2, 0x0c, 0xa5, 0x6f, 0x48, 0x36, 0xfb, 0x9d, 0x5c, 0xa3, 0x2b,
-    0x92, 0xcd, 0xd8, 0x75, 0x34, 0x43, 0xe9, 0x55, 0x34, 0x43, 0x59, 0x46, 0x66, 0x28, 0xf9, 0x82, 0x51, 0x2d, 0xa4,
-    0x2c, 0xb1, 0xd2, 0x0a, 0x30, 0xb2, 0xce, 0xe8, 0x07, 0x28, 0x31, 0x5b, 0x1b, 0x03, 0xca, 0xdd, 0x68, 0xa9, 0x0d,
-    0x8e, 0xab, 0x6f, 0xfe, 0x2f, 0x85, 0xce, 0x50, 0x65, 0x6b, 0x6d, 0xda, 0x12, 0xf7, 0xd9, 0x0f, 0x5e, 0x1c, 0xdc,
-    0x11, 0xf9, 0x4f, 0x78, 0x41, 0x8c, 0xb4, 0x11, 0x2b, 0xa1, 0x4a, 0xec, 0x35, 0xbe, 0xc6, 0x71, 0x75, 0x1f, 0x1e,
-    0xcf, 0xd1, 0x53, 0x1f, 0xfd, 0x18, 0x0f, 0x0f, 0x3e, 0xde, 0x17, 0x76, 0xb3, 0x42, 0xbb, 0x56, 0x2a, 0x5b, 0xe2,
-    0xc6, 0xb9, 0x2e, 0x8f, 0xe3, 0xed, 0x76, 0x4b, 0xb6, 0x53, 0xa2, 0xcd, 0x2a, 0xce, 0x92, 0x24, 0x89, 0xed, 0x66,
-    0x85, 0xd1, 0x50, 0x08, 0x38, 0xbb, 0xc2, 0xa8, 0x01, 0xb1, 0x6a, 0x5c, 0x0f, 0x57, 0x2f, 0x0e, 0x70, 0x2c, 0x3c,
-    0x47, 0x75, 0xff, 0xe9, 0xc2, 0x8a, 0xb9, 0xb0, 0x02, 0x3f, 0xd2, 0x00, 0x9f, 0xc2, 0x7c, 0xd9, 0x87, 0x79, 0x4d,
-    0x33, 0x94, 0xa1, 0xa4, 0xff, 0x65, 0x91, 0x87, 0x47, 0x2c, 0x7a, 0x86, 0xa1, 0x0b, 0xcc, 0x43, 0xed, 0x3c, 0x7a,
-    0x73, 0x96, 0x4d, 0xfd, 0xc9, 0x26, 0x4d, 0x1e, 0x0f, 0xbc, 0xc0, 0xaf, 0xf3, 0x4b, 0x3c, 0xca, 0x3e, 0x5c, 0x32,
-    0x78, 0x6b, 0x4d, 0xfa, 0x61, 0x4e, 0x67, 0x68, 0x36, 0x9e, 0xcc, 0x22, 0x0f, 0x9f, 0x31, 0x34, 0xdb, 0x64, 0x4d,
-    0xda, 0x46, 0xf3, 0x68, 0x46, 0xa7, 0x68, 0x3a, 0x3a, 0x32, 0x45, 0xd3, 0x4d, 0xd6, 0xcc, 0x3f, 0xcc, 0x2f, 0xcf,
-    0xa2, 0xe9, 0x97, 0x97, 0x71, 0x85, 0xc3, 0x1c, 0xe3, 0xc7, 0xc8, 0xf9, 0x65, 0xe4, 0xe4, 0xb3, 0x16, 0x2a, 0xc0,
-    0x38, 0x3c, 0xd6, 0xe0, 0x58, 0x13, 0xe0, 0x98, 0x69, 0x55, 0x8b, 0x15, 0xf9, 0x6c, 0xb5, 0xc2, 0x21, 0x71, 0x0d,
-    0xa8, 0xe0, 0x24, 0xea, 0x05, 0xa1, 0xa7, 0x04, 0xcf, 0x29, 0x2e, 0x3c, 0x9c, 0xeb, 0xdf, 0x09, 0x27, 0xa1, 0x74,
-    0xc4, 0x37, 0xec, 0xe4, 0x6f, 0xba, 0xe2, 0xa7, 0xfd, 0x6f, 0x3c, 0xc0, 0x2d, 0x65, 0x38, 0x24, 0x42, 0x29, 0x30,
-    0x77, 0xb0, 0x73, 0x25, 0x7e, 0xf7, 0xf6, 0x06, 0xbd, 0xe5, 0xdc, 0x80, 0xb5, 0x39, 0xc2, 0xaf, 0x1c, 0x69, 0x29,
-    0xfb, 0xba, 0x78, 0x93, 0x3e, 0x95, 0xfe, 0x97, 0xf8, 0x45, 0xa0, 0x3f, 0xc0, 0x6d, 0xb5, 0x79, 0x18, 0xe5, 0xbd,
-    0xfd, 0x85, 0x6f, 0x23, 0x56, 0x7e, 0x55, 0x8d, 0x02, 0x87, 0xc3, 0x89, 0xf8, 0x3a, 0x83, 0xb5, 0x82, 0xe3, 0x70,
-    0x22, 0xbf, 0xce, 0xd1, 0x59, 0xdf, 0xbc, 0x8e, 0xd0, 0xce, 0x12, 0x2b, 0x05, 0x83, 0x20, 0x0d, 0x49, 0xad, 0xcd,
-    0xcf, 0x94, 0x35, 0x8f, 0x09, 0xb2, 0x43, 0x47, 0xab, 0x47, 0x3d, 0xcc, 0x00, 0x75, 0x30, 0xaa, 0x0a, 0x30, 0x17,
-    0x1b, 0x1c, 0x2e, 0x14, 0x61, 0x92, 0x5a, 0xeb, 0x47, 0x46, 0xe9, 0x9d, 0xf3, 0xe1, 0xe0, 0x89, 0x1a, 0x22, 0xfd,
-    0xf5, 0xee, 0xdd, 0xef, 0xe5, 0x7d, 0x41, 0x87, 0x01, 0x89, 0xbf, 0xc5, 0xa8, 0x67, 0x3e, 0x33, 0x46, 0x12, 0x6a,
-    0xe7, 0x2b, 0x5e, 0x07, 0x96, 0x18, 0x6b, 0x45, 0x78, 0x2c, 0x6c, 0x47, 0xd5, 0x73, 0xb6, 0x3e, 0xa6, 0xaa, 0x88,
-    0x3d, 0xad, 0x2a, 0x62, 0x5a, 0xbd, 0x38, 0x98, 0xc0, 0xfa, 0xe1, 0xf6, 0x10, 0x1e, 0xef, 0x27, 0x8a, 0xfc, 0x7b,
-    0x0d, 0x66, 0x7f, 0x0b, 0x12, 0x98, 0xd3, 0x26, 0xc0, 0xe4, 0x89, 0x60, 0x48, 0x1c, 0xec, 0xdc, 0xcd, 0x38, 0x7f,
-    0x2d, 0xf1, 0x87, 0x13, 0x45, 0xb4, 0x62, 0x52, 0xb0, 0x87, 0xf2, 0x1c, 0x71, 0x78, 0x10, 0x64, 0x43, 0xe5, 0x1a,
-    0x4e, 0x3c, 0x92, 0xd4, 0x9a, 0xad, 0x6d, 0x10, 0x1e, 0x27, 0x8c, 0xd0, 0xae, 0x03, 0xc5, 0x6f, 0x1a, 0x21, 0x79,
-    0xa0, 0xc2, 0x63, 0xf8, 0x78, 0xd3, 0xcf, 0x8c, 0xfb, 0xd5, 0xf0, 0xd1, 0x80, 0xfc, 0x4f, 0xf9, 0xd2, 0x2f, 0x87,
-    0x97, 0x9f, 0x70, 0x48, 0xfa, 0xf8, 0xef, 0x1f, 0x37, 0x84, 0x6f, 0xef, 0x57, 0xbb, 0x56, 0x4e, 0x7c, 0xe8, 0xd1,
-    0x7c, 0x16, 0x1e, 0xef, 0x8f, 0xe1, 0x31, 0x5c, 0x14, 0xf1, 0x30, 0xe7, 0xab, 0xa2, 0x1f, 0xb9, 0xd5, 0x0f, 0x87,
-    0xa5, 0xde, 0x45, 0x56, 0x7c, 0x11, 0x6a, 0x95, 0x0b, 0xd5, 0x80, 0x11, 0xee, 0xc8, 0xc5, 0x66, 0x22, 0x54, 0xb7,
-    0x76, 0x87, 0x8e, 0x72, 0xee, 0x29, 0xb3, 0x6e, 0xb7, 0xa8, 0xb5, 0x72, 0x9e, 0x13, 0xf2, 0x14, 0xda, 0xe3, 0x40,
-    0xef, 0x27, 0x4c, 0xfe, 0x66, 0xf6, 0xdd, 0x71, 0xa9, 0xf9, 0xfe, 0xe0, 0xd3, 0x10, 0x51, 0x29, 0x56, 0x2a, 0x67,
-    0xa0, 0x1c, 0x98, 0x41, 0xa8, 0xa6, 0xad, 0x90, 0xfb, 0xdc, 0x52, 0x65, 0x23, 0x0b, 0x46, 0xd4, 0xc7, 0xe5, 0xda,
-    0x39, 0xad, 0x0e, 0x4b, 0x6d, 0x38, 0x98, 0x3c, 0x59, 0x0c, 0x40, 0x64, 0x28, 0x17, 0x6b, 0x9b, 0x93, 0xa9, 0x81,
-    0x76, 0xb1, 0xa4, 0xec, 0x61, 0x65, 0xf4, 0x5a, 0xf1, 0x88, 0xf9, 0xc9, 0x9b, 0x7f, 0x9b, 0xd6, 0x74, 0x0a, 0x6c,
-    0x31, 0x62, 0x75, 0x5d, 0x2f, 0xa4, 0x50, 0x10, 0x0d, 0xb3, 0x2d, 0xcf, 0xc8, 0x95, 0x17, 0xbb, 0x70, 0x93, 0x64,
-    0xfe, 0x60, 0xf0, 0x31, 0x4d, 0x92, 0xef, 0x16, 0xa7, 0x70, 0x92, 0x05, 0x5b, 0x1b, 0xab, 0x4d, 0xde, 0x69, 0xe1,
-    0xdd, 0x3c, 0xb6, 0x54, 0xa8, 0x4b, 0xef, 0x7d, 0xd9, 0x2c, 0xc6, 0x75, 0x94, 0x0b, 0xd5, 0x9b, 0xe9, 0x97, 0xd2,
-    0xa2, 0x15, 0x6a, 0xd8, 0xa9, 0x79, 0x36, 0x4f, 0xba, 0xdd, 0xf1, 0x54, 0x09, 0x87, 0x13, 0x77, 0x2d, 0x61, 0xb7,
-    0xf8, 0xbc, 0xb6, 0x4e, 0xd4, 0xfb, 0x68, 0xdc, 0xc9, 0xb9, 0xed, 0x28, 0x83, 0x68, 0x09, 0x6e, 0x0b, 0xa0, 0x16,
-    0xbd, 0x8d, 0x48, 0x38, 0x68, 0xed, 0x98, 0xa7, 0xb3, 0x9a, 0xbe, 0x60, 0x9f, 0xea, 0xfa, 0x5f, 0xdc, 0xbe, 0x8a,
-    0x0e, 0x2d, 0x35, 0x2b, 0xa1, 0xa2, 0xa5, 0x76, 0x4e, 0xb7, 0x79, 0x74, 0xdd, 0xed, 0x16, 0xe3, 0x91, 0x57, 0x96,
-    0xa7, 0xde, 0xcd, 0x7e, 0xd7, 0x9e, 0xf2, 0x9d, 0x76, 0x3b, 0x64, 0xb5, 0x14, 0x7c, 0xe4, 0xeb, 0x59, 0x50, 0x72,
-    0x4e, 0x4f, 0x3a, 0xeb, 0x76, 0xc8, 0x9f, 0x9d, 0x52, 0x7d, 0x55, 0xbf, 0xa6, 0x69, 0xf2, 0x37, 0x37, 0xc2, 0xeb,
-    0x3a, 0x5b, 0xd6, 0xe7, 0x4c, 0xf9, 0xb5, 0xe9, 0x57, 0x4b, 0x5f, 0x5a, 0x45, 0x3c, 0xbc, 0x6e, 0x7c, 0x65, 0x54,
-    0x85, 0xcf, 0x70, 0x55, 0x34, 0x29, 0x12, 0xbc, 0x6c, 0x29, 0xab, 0x2e, 0x66, 0x5b, 0x11, 0x37, 0xe9, 0x89, 0xd4,
-    0xa4, 0xd5, 0x93, 0xb9, 0x35, 0xd0, 0x7a, 0xef, 0xab, 0x1b, 0xad, 0x14, 0x30, 0x27, 0xd4, 0x0a, 0x39, 0x8d, 0xc6,
-    0x14, 0x10, 0x42, 0x8a, 0xa5, 0xa9, 0xde, 0x4b, 0xa0, 0x16, 0xd0, 0x96, 0x0a, 0x47, 0x8a, 0x78, 0xe0, 0x1f, 0x3a,
-    0x5d, 0xf0, 0x52, 0x81, 0x3b, 0xf7, 0x76, 0x33, 0x1d, 0x0c, 0xdc, 0x82, 0xf3, 0x9a, 0xbc, 0x81, 0x69, 0x55, 0xf8,
-    0x15, 0x8c, 0x68, 0xdf, 0xa5, 0x65, 0xbc, 0x15, 0xb5, 0xf0, 0x4f, 0x98, 0xaa, 0xe8, 0x8b, 0xdc, 0x6b, 0xf0, 0x79,
-    0x1e, 0x9e, 0x5b, 0x3d, 0x24, 0x41, 0xad, 0x5c, 0x53, 0x4e, 0x33, 0xd4, 0x49, 0xca, 0xa0, 0xd1, 0x92, 0x83, 0x29,
-    0x6f, 0x6f, 0x7f, 0xfb, 0x67, 0xe5, 0x9d, 0x79, 0x94, 0xeb, 0xec, 0xc3, 0x20, 0xe6, 0x81, 0x51, 0x6a, 0x7e, 0x35,
-    0x3c, 0xb2, 0x3a, 0x6a, 0xed, 0x56, 0x1b, 0xfe, 0x44, 0xc7, 0xfb, 0xf1, 0x70, 0xd0, 0xd3, 0xff, 0xfb, 0x56, 0xa9,
-    0x6e, 0xe9, 0x06, 0x8a, 0x78, 0x44, 0x8a, 0xd8, 0x3b, 0x3c, 0xd0, 0x9b, 0x91, 0xaf, 0x49, 0xab, 0x3f, 0xef, 0xde,
-    0xa2, 0xbf, 0x3a, 0x4e, 0x1d, 0x0c, 0x69, 0xeb, 0xa3, 0x6a, 0xc1, 0x35, 0x9a, 0x97, 0xef, 0xff, 0xbc, 0xbd, 0x3b,
-    0x47, 0xb8, 0xee, 0x99, 0x10, 0x28, 0x36, 0x3c, 0xf7, 0xd6, 0xd2, 0x89, 0x8e, 0x1a, 0xd7, 0xab, 0x8d, 0xfc, 0x14,
-    0x39, 0xc5, 0xd0, 0xd3, 0x6b, 0x21, 0x61, 0x08, 0x63, 0x10, 0xac, 0xd0, 0xc9, 0xab, 0x93, 0xb5, 0x67, 0x7e, 0xc5,
-    0xc3, 0x6d, 0xc7, 0xc3, 0xd5, 0xc7, 0xfd, 0xcb, 0xf7, 0xbf, 0x81, 0xdb, 0x13, 0xb5, 0x09, 0x0b, 0x00, 0x00};
+    0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x95, 0x56, 0x6d, 0x8f, 0xdb, 0x36, 0x0c, 0xfe, 0xbe,
+    0x5f, 0xa1, 0x79, 0xdd, 0x6a, 0xaf, 0xb1, 0xfc, 0x92, 0x4b, 0xda, 0x3a, 0x96, 0x8b, 0xee, 0xd6, 0x62, 0x03, 0xd6,
+    0xad, 0xc0, 0xdd, 0xba, 0x0f, 0x45, 0x01, 0x2b, 0x32, 0x1d, 0xab, 0x27, 0x4b, 0x9e, 0xa4, 0xbc, 0x35, 0xc8, 0x7e,
+    0xfb, 0x20, 0xdb, 0xc9, 0xe5, 0x8a, 0x16, 0xd8, 0x10, 0xc4, 0xa0, 0x44, 0xf2, 0xe1, 0x8b, 0x28, 0x52, 0xf9, 0xb7,
+    0x95, 0x62, 0x76, 0xdf, 0x01, 0x6a, 0x6c, 0x2b, 0x8a, 0xdc, 0x7d, 0x91, 0xa0, 0x72, 0x45, 0x40, 0x16, 0x79, 0x03,
+    0xb4, 0x2a, 0xf2, 0x16, 0x2c, 0x45, 0xac, 0xa1, 0xda, 0x80, 0x25, 0x7f, 0xde, 0xbe, 0x0e, 0x9f, 0x15, 0xb9, 0xe0,
+    0xf2, 0x0e, 0x69, 0x10, 0x84, 0x33, 0x25, 0x51, 0xa3, 0xa1, 0x26, 0x15, 0xb5, 0x34, 0xe3, 0x2d, 0x5d, 0xc1, 0xa8,
+    0x22, 0x69, 0x0b, 0x64, 0xc3, 0x61, 0xdb, 0x29, 0x6d, 0x11, 0x53, 0xd2, 0x82, 0xb4, 0xc4, 0xdb, 0xf2, 0xca, 0x36,
+    0xa4, 0x82, 0x0d, 0x67, 0x10, 0xf6, 0x8b, 0x09, 0x97, 0xdc, 0x72, 0x2a, 0x42, 0xc3, 0xa8, 0x00, 0x92, 0x4c, 0xd6,
+    0x06, 0x74, 0xbf, 0xa0, 0x4b, 0x01, 0x44, 0x2a, 0xaf, 0xc8, 0x0d, 0xd3, 0xbc, 0xb3, 0xc8, 0xb9, 0x4a, 0x5a, 0x55,
+    0xad, 0x05, 0x20, 0xa6, 0x95, 0x31, 0x4a, 0xf3, 0x15, 0x97, 0x45, 0xa5, 0xd8, 0xba, 0x05, 0x69, 0xb1, 0x50, 0x8c,
+    0x5a, 0xae, 0x24, 0x36, 0x40, 0x35, 0x6b, 0x08, 0x21, 0xe5, 0x0b, 0x43, 0x37, 0x50, 0xfe, 0xf0, 0x83, 0x7f, 0x16,
+    0x5a, 0x81, 0x7d, 0x25, 0xc0, 0x91, 0xe6, 0xa7, 0xfd, 0x2d, 0x5d, 0xfd, 0x4e, 0x5b, 0xf0, 0x4b, 0x6a, 0x78, 0x05,
+    0x65, 0xf0, 0x3e, 0xfe, 0x80, 0x8d, 0xdd, 0x0b, 0xc0, 0x15, 0x37, 0x9d, 0xa0, 0x7b, 0x52, 0x2e, 0x85, 0x62, 0x77,
+    0x65, 0xb0, 0xa8, 0xd7, 0x92, 0x39, 0x70, 0x04, 0x3e, 0x04, 0x07, 0x01, 0x16, 0x49, 0xf2, 0x86, 0xda, 0x06, 0xb7,
+    0x74, 0xe7, 0x0f, 0x04, 0x97, 0x7e, 0xfa, 0xa3, 0x0f, 0x4f, 0x92, 0x38, 0x0e, 0x26, 0xfd, 0x27, 0x0e, 0xa2, 0x24,
+    0x8e, 0x17, 0x1a, 0xec, 0x5a, 0x4b, 0x64, 0xfd, 0x32, 0xef, 0xa8, 0x6d, 0x50, 0x45, 0xbc, 0x37, 0x49, 0x8a, 0x92,
+    0xe7, 0x38, 0x9d, 0xfd, 0x86, 0x9f, 0xa2, 0x2b, 0x9c, 0xce, 0xd8, 0xd3, 0x70, 0x86, 0x92, 0xab, 0x70, 0x86, 0xd2,
+    0x14, 0xcf, 0x50, 0xfc, 0xc9, 0x43, 0x35, 0x17, 0x82, 0x78, 0x52, 0x49, 0xf0, 0x90, 0xb1, 0x5a, 0xdd, 0x01, 0xf1,
+    0xd8, 0x5a, 0x6b, 0x90, 0xf6, 0x5a, 0x09, 0xa5, 0xbd, 0xa8, 0xf8, 0xe6, 0x7f, 0x01, 0x5a, 0x4d, 0xa5, 0xa9, 0x95,
+    0x6e, 0x89, 0xd7, 0xa7, 0xdb, 0x7f, 0x74, 0x90, 0x47, 0xe4, 0x3e, 0xc1, 0x05, 0x33, 0x1c, 0xf2, 0x4a, 0x3c, 0x87,
+    0xf8, 0xcc, 0x8b, 0x8a, 0x32, 0x38, 0x9e, 0xa3, 0xb7, 0x2e, 0xfa, 0x31, 0x1e, 0xed, 0xbf, 0x2f, 0x73, 0xb3, 0x59,
+    0xa1, 0x5d, 0x2b, 0xa4, 0x21, 0x5e, 0x63, 0x6d, 0x97, 0x45, 0xd1, 0x76, 0xbb, 0xc5, 0xdb, 0x29, 0x56, 0x7a, 0x15,
+    0xa5, 0x71, 0x1c, 0x47, 0x66, 0xb3, 0xf2, 0xd0, 0x70, 0xf2, 0x5e, 0x7a, 0xe5, 0xa1, 0x06, 0xf8, 0xaa, 0xb1, 0x3d,
+    0x5d, 0x3c, 0x3a, 0xc0, 0x31, 0x77, 0x12, 0x45, 0xf9, 0xe1, 0xc2, 0x8a, 0xbc, 0xb0, 0x02, 0x2f, 0x2e, 0xf2, 0xf6,
+    0xb8, 0x0f, 0xf3, 0x29, 0x4d, 0x51, 0x8a, 0xe2, 0xfe, 0x97, 0x86, 0x8e, 0x1e, 0x57, 0xe1, 0x67, 0x2b, 0x74, 0xb1,
+    0x72, 0x54, 0x3b, 0x0f, 0x9f, 0x9f, 0x75, 0x13, 0xb7, 0xb3, 0x49, 0xe2, 0xfb, 0x0d, 0xa7, 0xf0, 0xcb, 0xfc, 0x72,
+    0x1d, 0xa6, 0xef, 0x2e, 0x05, 0x9c, 0xb5, 0x26, 0x79, 0x37, 0xa7, 0x33, 0x34, 0x1b, 0x77, 0x66, 0xa1, 0xa3, 0xcf,
+    0x2b, 0x34, 0xdb, 0xa4, 0x4d, 0xd2, 0x86, 0xf3, 0x70, 0x46, 0xa7, 0x68, 0x3a, 0x3a, 0x32, 0x45, 0xd3, 0x4d, 0xda,
+    0xcc, 0xdf, 0xcd, 0x2f, 0xf7, 0xc2, 0xe9, 0xa7, 0xc7, 0x2e, 0xb9, 0x59, 0x59, 0xde, 0x47, 0xae, 0x2f, 0x23, 0xc7,
+    0x1f, 0x15, 0x97, 0x7e, 0xe9, 0xf2, 0x0f, 0x96, 0x35, 0x7e, 0x19, 0x31, 0x25, 0x6b, 0xbe, 0xc2, 0x1f, 0x8d, 0x92,
+    0x65, 0x80, 0x6d, 0x03, 0xd2, 0x3f, 0xa9, 0xfa, 0x36, 0x38, 0xd8, 0x9e, 0xe3, 0x7f, 0x81, 0x73, 0xae, 0x7f, 0xcb,
+    0xad, 0x00, 0x62, 0xb1, 0xbb, 0xa1, 0x93, 0x2f, 0xdc, 0x8a, 0x9f, 0xf6, 0xbf, 0x56, 0x7e, 0xd9, 0x52, 0x56, 0x06,
+    0x98, 0x4b, 0x09, 0xfa, 0x16, 0x76, 0x96, 0x94, 0x6f, 0x5e, 0x5e, 0xa3, 0x97, 0x55, 0xa5, 0xc1, 0x98, 0x0c, 0x95,
+    0x4f, 0x2c, 0x6e, 0x29, 0xfb, 0xba, 0x7a, 0x93, 0x3c, 0xd4, 0xfe, 0x8b, 0xbf, 0xe6, 0xe8, 0x77, 0xb0, 0x5b, 0xa5,
+    0xef, 0x46, 0x7d, 0x67, 0x7f, 0xe1, 0xae, 0x91, 0x26, 0x5f, 0x85, 0x91, 0x60, 0xcb, 0x60, 0xc2, 0xbf, 0x2e, 0x60,
+    0x0c, 0xaf, 0xca, 0x60, 0x42, 0xbf, 0x2e, 0xd1, 0x19, 0x77, 0x79, 0x2d, 0xa6, 0x9d, 0xc1, 0x46, 0x70, 0x06, 0x7e,
+    0x12, 0xe0, 0x5a, 0xe9, 0x57, 0x94, 0x35, 0x0f, 0x12, 0xe4, 0x5c, 0x51, 0xf7, 0x38, 0x4c, 0x03, 0xb5, 0x30, 0x42,
+    0xf9, 0x65, 0xc5, 0x37, 0x65, 0xb0, 0x50, 0x98, 0x09, 0x6a, 0x8c, 0x6b, 0x19, 0xc4, 0x39, 0xe7, 0xc2, 0x29, 0x27,
+    0x6a, 0x88, 0xf4, 0x97, 0xdb, 0x37, 0xbf, 0x91, 0x32, 0xa7, 0x43, 0x47, 0xf4, 0xbe, 0xf3, 0x50, 0x2f, 0x4c, 0xbc,
+    0x51, 0x30, 0x14, 0x50, 0xdb, 0xbe, 0xe2, 0x7d, 0x8b, 0xb5, 0x31, 0x3c, 0x38, 0xe6, 0xa6, 0xa3, 0xf2, 0x73, 0x31,
+    0x17, 0x93, 0x57, 0xe4, 0x91, 0xe3, 0x15, 0x79, 0x44, 0x8b, 0x47, 0x07, 0xe9, 0xf7, 0xcd, 0xed, 0x2e, 0x38, 0x3a,
+    0x6b, 0x7f, 0xaf, 0x41, 0xef, 0x6f, 0x40, 0x00, 0xb3, 0x4a, 0xfb, 0x25, 0xbe, 0x54, 0x74, 0x45, 0x01, 0x3b, 0x7b,
+    0x3d, 0x36, 0x5c, 0x8b, 0xdd, 0xe6, 0x44, 0x61, 0x25, 0x99, 0xe0, 0xec, 0x8e, 0x9c, 0x23, 0x0e, 0x0e, 0x1c, 0x6f,
+    0xa8, 0x58, 0xc3, 0x49, 0x86, 0xe2, 0x5a, 0xb1, 0xb5, 0xf1, 0x83, 0xe3, 0x44, 0x63, 0xda, 0x75, 0x20, 0xab, 0xeb,
+    0x86, 0x8b, 0xca, 0x57, 0xc1, 0x31, 0xb8, 0x3f, 0xe9, 0xcf, 0x8c, 0xbb, 0x59, 0xf0, 0x5e, 0x83, 0xf8, 0x87, 0x3c,
+    0x76, 0xd3, 0xe0, 0xf1, 0x87, 0x32, 0xc0, 0x7d, 0xfc, 0xe5, 0xfd, 0x48, 0x70, 0xd7, 0xfb, 0xc9, 0xae, 0x15, 0x13,
+    0x17, 0x7a, 0x38, 0x9f, 0x05, 0xc7, 0xf2, 0x18, 0x1c, 0x83, 0x45, 0x1e, 0x0d, 0x8d, 0xbd, 0xc8, 0xfb, 0x96, 0xdb,
+    0x8f, 0x94, 0x9e, 0x32, 0x0d, 0x80, 0x7d, 0xd0, 0xe2, 0x7f, 0x3c, 0x2c, 0xd5, 0x2e, 0x34, 0xfc, 0x13, 0x97, 0xab,
+    0x8c, 0xcb, 0x06, 0x34, 0xb7, 0xc7, 0x8a, 0x6f, 0x26, 0x5c, 0x76, 0x6b, 0x7b, 0xe8, 0x68, 0x55, 0x39, 0xce, 0xac,
+    0xdb, 0x2d, 0x6a, 0x25, 0xad, 0x93, 0x84, 0x2c, 0x81, 0xf6, 0x38, 0xf0, 0xfb, 0xe6, 0x93, 0x3d, 0x9f, 0x7d, 0x7f,
+    0x5c, 0xaa, 0x6a, 0x7f, 0x70, 0x19, 0x0a, 0xa9, 0xe0, 0x2b, 0x99, 0x31, 0x90, 0x16, 0xf4, 0xa0, 0x54, 0xd3, 0x96,
+    0x8b, 0x7d, 0x66, 0xa8, 0x34, 0xa1, 0x01, 0xcd, 0xeb, 0xe3, 0x72, 0x6d, 0xad, 0x92, 0x07, 0xe6, 0x9a, 0x6d, 0xf6,
+    0x5d, 0x5d, 0xd7, 0x0b, 0xb6, 0xd6, 0x46, 0xe9, 0xac, 0x53, 0xbc, 0xd7, 0x5b, 0x52, 0x76, 0xb7, 0xd2, 0x6a, 0x2d,
+    0xab, 0x70, 0x14, 0x4a, 0x6a, 0x3a, 0x05, 0xb6, 0x58, 0x2a, 0x5d, 0x81, 0xce, 0xe2, 0x91, 0x08, 0x35, 0xad, 0xf8,
+    0xda, 0x64, 0x78, 0xaa, 0xa1, 0x5d, 0x0c, 0xee, 0x24, 0x71, 0xfc, 0xfd, 0xe2, 0xe4, 0x79, 0x7c, 0xe9, 0x37, 0x4e,
+    0x9d, 0x94, 0xe0, 0x12, 0xc2, 0xa1, 0x57, 0x66, 0x29, 0xbe, 0xd2, 0xd0, 0x1e, 0x5b, 0xca, 0xe5, 0xa5, 0xf7, 0xae,
+    0xa2, 0x16, 0x2d, 0x97, 0xc3, 0x28, 0xcd, 0xd2, 0x79, 0xdc, 0xed, 0x16, 0xe3, 0xe4, 0xca, 0xb8, 0xec, 0x11, 0xfa,
+    0xf9, 0x75, 0x3c, 0x15, 0xc9, 0xe1, 0xe3, 0xda, 0x58, 0x5e, 0xef, 0xc3, 0x71, 0x24, 0x67, 0xa6, 0xa3, 0x0c, 0xc2,
+    0x25, 0xd8, 0x2d, 0x80, 0x5c, 0xf4, 0xb0, 0x21, 0xb7, 0xd0, 0x9a, 0x53, 0x6a, 0x4e, 0x70, 0xb5, 0x80, 0xdd, 0x19,
+    0xa6, 0xaf, 0xe5, 0xc3, 0x7f, 0x96, 0x76, 0x05, 0x76, 0x68, 0xa9, 0x5e, 0x71, 0x19, 0x2e, 0x95, 0xb5, 0xaa, 0xcd,
+    0xc2, 0xa7, 0xdd, 0x6e, 0x31, 0x6e, 0x39, 0xb0, 0x2c, 0x89, 0xbb, 0xdd, 0xb1, 0x1f, 0xc3, 0xa7, 0x7c, 0x5f, 0xd5,
+    0xcf, 0x68, 0x12, 0x7f, 0x21, 0xc7, 0x55, 0x5d, 0xa7, 0xcb, 0xfa, 0x94, 0xe3, 0xa4, 0xdb, 0x21, 0xa3, 0x04, 0xaf,
+    0x46, 0xb8, 0x1e, 0x09, 0xc5, 0xe7, 0xd4, 0x26, 0xb3, 0x6e, 0x87, 0x92, 0xcb, 0xcc, 0xb8, 0x89, 0xea, 0xa6, 0x8e,
+    0xab, 0xb5, 0x22, 0x8f, 0x86, 0x97, 0x8e, 0xab, 0x8c, 0x22, 0x77, 0x19, 0x2e, 0xf2, 0x26, 0x41, 0xbc, 0x22, 0x2d,
+    0x65, 0xc5, 0x45, 0xdb, 0xcb, 0xa3, 0x26, 0x39, 0xb1, 0x9a, 0xa4, 0x78, 0xd0, 0xd2, 0x06, 0x5e, 0xef, 0x7d, 0x71,
+    0xad, 0xa4, 0x04, 0x66, 0xb9, 0x5c, 0x21, 0xab, 0xd0, 0x98, 0x02, 0x8c, 0x71, 0xbe, 0xd4, 0xc5, 0x5b, 0x01, 0xd4,
+    0x00, 0xda, 0x52, 0x6e, 0x71, 0x1e, 0x0d, 0xf2, 0x43, 0x13, 0xe0, 0x15, 0x91, 0x60, 0xcf, 0xd7, 0xbe, 0x99, 0x0e,
+    0x06, 0x6e, 0xc0, 0x3a, 0x24, 0x67, 0x60, 0x5a, 0xe4, 0x6e, 0x3a, 0x23, 0xda, 0x5f, 0x60, 0x12, 0x6d, 0x79, 0xcd,
+    0xdd, 0xeb, 0xa6, 0xc8, 0xfb, 0x22, 0x77, 0x08, 0x2e, 0xcf, 0xc3, 0xd3, 0xab, 0xa7, 0x04, 0xc8, 0x95, 0x6d, 0xc8,
+    0x34, 0x45, 0x9d, 0xa0, 0x0c, 0x1a, 0x25, 0x2a, 0xd0, 0xe4, 0xe6, 0xe6, 0xd7, 0x9f, 0x0b, 0xe7, 0xcc, 0xbd, 0x5e,
+    0x67, 0xee, 0x06, 0x35, 0x47, 0x8c, 0x5a, 0xf3, 0xab, 0xe1, 0xc1, 0xd5, 0x51, 0x63, 0xb6, 0x4a, 0x57, 0x0f, 0x30,
+    0xde, 0x8e, 0x9b, 0x03, 0x4e, 0xff, 0xef, 0xaf, 0x4a, 0x71, 0x43, 0x37, 0x90, 0x47, 0xe3, 0x22, 0x8f, 0x9c, 0xc3,
+    0x03, 0xbf, 0x19, 0xe5, 0x9a, 0xa4, 0xf8, 0xe3, 0xf6, 0x25, 0xfa, 0xb3, 0xab, 0xa8, 0x85, 0x21, 0x6d, 0x7d, 0x54,
+    0x2d, 0xd8, 0x46, 0x55, 0xe4, 0xed, 0x1f, 0x37, 0xb7, 0xe7, 0x08, 0xd7, 0xbd, 0x10, 0x02, 0xc9, 0x86, 0xa7, 0xdf,
+    0x5a, 0x58, 0xde, 0x51, 0x6d, 0x7b, 0xd8, 0xd0, 0x35, 0x98, 0x53, 0x0c, 0x3d, 0xbf, 0xe6, 0x02, 0x86, 0x30, 0x06,
+    0xc5, 0x02, 0x9d, 0xbc, 0x3a, 0x59, 0xfb, 0xcc, 0xaf, 0x68, 0x38, 0xed, 0x68, 0x38, 0xfa, 0xa8, 0x7f, 0x05, 0xff,
+    0x0b, 0x54, 0xcf, 0x54, 0x8b, 0x15, 0x0b, 0x00, 0x00};
 
 #else  // Brotli (default, smaller)
 constexpr uint8_t INDEX_BR[] PROGMEM = {
-    0x1b, 0x08, 0x0b, 0x00, 0xe4, 0x7f, 0x9b, 0xad, 0xbb, 0x97, 0x53, 0xde, 0xb7, 0x25, 0x0e, 0x69, 0xd4, 0x69, 0x89,
-    0xba, 0xa5, 0x55, 0x22, 0x04, 0x27, 0xeb, 0x00, 0x52, 0xac, 0xbc, 0xec, 0x5f, 0xfb, 0xb5, 0x7a, 0x12, 0x0a, 0xd6,
-    0x48, 0x84, 0x4a, 0x48, 0x5a, 0xcb, 0xbd, 0xb7, 0x72, 0x66, 0x4e, 0x62, 0xd8, 0xbd, 0x7f, 0x88, 0x68, 0x86, 0x28,
-    0xd6, 0xf1, 0xda, 0x2c, 0xa2, 0x32, 0x5c, 0xdd, 0xab, 0xb2, 0x15, 0xbc, 0x24, 0x13, 0xe6, 0xbd, 0x0c, 0x52, 0x63,
-    0x82, 0x88, 0x6d, 0x74, 0x71, 0x51, 0x9c, 0xe2, 0x40, 0x56, 0xea, 0xb0, 0x5c, 0xb7, 0x1d, 0x81, 0x3a, 0x0c, 0xf2,
-    0xd7, 0xa8, 0x5c, 0x35, 0x2d, 0x43, 0xb3, 0x42, 0x37, 0x7c, 0x60, 0xd8, 0xc1, 0x95, 0x91, 0x94, 0x3c, 0x29, 0x20,
-    0x96, 0x20, 0xf6, 0x24, 0xb7, 0x83, 0x4a, 0x06, 0xf1, 0xc3, 0x2f, 0x88, 0x50, 0x55, 0x35, 0x2d, 0xe8, 0xb6, 0x21,
-    0x38, 0x61, 0x8e, 0x44, 0x2a, 0xac, 0x39, 0xcf, 0x74, 0xaa, 0x31, 0x7f, 0x62, 0x32, 0x9b, 0x99, 0x42, 0x0a, 0xf6,
-    0x6f, 0xd8, 0x89, 0x3f, 0x49, 0xb1, 0xa2, 0x52, 0x0a, 0x8e, 0xb3, 0x27, 0x0b, 0x07, 0x07, 0x58, 0xb0, 0x8f, 0xaa,
-    0xdc, 0x68, 0x12, 0x0f, 0x95, 0xbf, 0xc7, 0x36, 0xd5, 0x60, 0x5a, 0xc7, 0x80, 0xac, 0x52, 0xf7, 0xa7, 0x2d, 0xb6,
-    0x64, 0xda, 0xda, 0x11, 0x8d, 0x6a, 0xe5, 0xba, 0xe9, 0xda, 0xdc, 0x62, 0xc3, 0xcb, 0xae, 0xc1, 0xe1, 0x11, 0xb6,
-    0x33, 0x29, 0x04, 0x09, 0xfe, 0x09, 0x08, 0xc2, 0x1f, 0x98, 0x16, 0x26, 0x0d, 0xce, 0xd7, 0x75, 0xfb, 0xd7, 0xa5,
-    0x82, 0xd7, 0x32, 0x44, 0x72, 0xc1, 0xc2, 0xe4, 0x15, 0xcb, 0x50, 0xfc, 0xd3, 0x58, 0x64, 0x34, 0x41, 0x32, 0xbe,
-    0x1f, 0x08, 0x43, 0x16, 0x14, 0xf7, 0x70, 0x2c, 0x1c, 0x61, 0x09, 0x78, 0x73, 0xd1, 0x30, 0xf6, 0xed, 0x85, 0x55,
-    0x50, 0x02, 0xf0, 0x68, 0x50, 0x5c, 0x1a, 0xd7, 0x3b, 0x8e, 0xf2, 0x23, 0xc8, 0x88, 0x39, 0xd0, 0x84, 0xf7, 0xa6,
-    0xd1, 0xa3, 0xfb, 0xe5, 0x44, 0xc0, 0x4c, 0x2f, 0x6f, 0x19, 0x70, 0x75, 0xf6, 0x1c, 0xb8, 0xce, 0x89, 0x4f, 0x01,
-    0x8d, 0xa1, 0x71, 0xf2, 0x97, 0xf8, 0xe7, 0xd3, 0xf1, 0xe1, 0xfa, 0xfc, 0xc8, 0x03, 0x78, 0x14, 0xa0, 0x3d, 0x28,
-    0xb7, 0xeb, 0x26, 0x52, 0x59, 0xa8, 0xb5, 0x0d, 0x5c, 0x8a, 0x6b, 0xe5, 0xf6, 0x30, 0xd6, 0xf7, 0x71, 0x31, 0xe8,
-    0xbd, 0xc9, 0xfa, 0xf5, 0x71, 0x9d, 0xff, 0xf6, 0x69, 0x62, 0x5f, 0xb5, 0xc7, 0x06, 0x43, 0x54, 0xb5, 0x87, 0xf1,
-    0xcc, 0x84, 0xe8, 0xb7, 0x56, 0x38, 0x43, 0x6a, 0xa6, 0x2f, 0x53, 0xd1, 0x89, 0x48, 0x8d, 0x72, 0x75, 0x4a, 0x17,
-    0xf6, 0x8d, 0xb2, 0xeb, 0xb1, 0x6b, 0x29, 0x1e, 0xd5, 0x74, 0xc7, 0xb3, 0xf4, 0xf1, 0x04, 0x0d, 0xbf, 0x08, 0x81,
-    0x8f, 0xfe, 0x8d, 0xfc, 0xf2, 0x35, 0x92, 0xa0, 0x24, 0x88, 0x12, 0x6a, 0xe6, 0x2f, 0x01, 0x94, 0x5c, 0x4b, 0xf9,
-    0x6b, 0x9a, 0xf6, 0x1a, 0x35, 0x11, 0x8a, 0xc6, 0x04, 0x8d, 0x50, 0x64, 0x48, 0x2d, 0x8b, 0xdf, 0xdf, 0xa1, 0xd1,
-    0xfd, 0x21, 0xd7, 0x40, 0x96, 0x00, 0xb1, 0x9f, 0x54, 0xc2, 0xe1, 0x00, 0x79, 0x15, 0x80, 0xf8, 0xca, 0x8e, 0xc5,
-    0x06, 0x03, 0xdf, 0x72, 0x49, 0xc0, 0x08, 0x27, 0x90, 0xe3, 0x14, 0xc2, 0xac, 0xc3, 0x83, 0xc9, 0xf6, 0x9d, 0x12,
-    0xab, 0x46, 0xae, 0x03, 0x74, 0x1d, 0x27, 0xce, 0x91, 0x1d, 0x4e, 0xb4, 0xbe, 0x80, 0xe7, 0x6a, 0x6d, 0x0a, 0x20,
-    0x47, 0x6b, 0x00, 0x4e, 0x25, 0x52, 0xe6, 0xf5, 0xe9, 0x43, 0x84, 0xc1, 0x0d, 0x4b, 0x04, 0xb3, 0x91, 0x49, 0xf5,
-    0xe9, 0xc4, 0x2e, 0x1b, 0xf9, 0x98, 0xf9, 0xea, 0x9e, 0xb8, 0xf6, 0x53, 0xf8, 0x42, 0xc2, 0x60, 0x5c, 0xa9, 0xd2,
-    0xfe, 0x0a, 0xe5, 0xd4, 0x7d, 0x36, 0x76, 0x04, 0x12, 0x38, 0xa1, 0xc4, 0x30, 0xb8, 0xf2, 0x69, 0x86, 0x5b, 0xe7,
-    0xe5, 0xa0, 0xc0, 0xfe, 0x91, 0x19, 0x03, 0x1e, 0xa9, 0x93, 0x26, 0x49, 0x58, 0xd5, 0xf6, 0x33, 0x4e, 0x0a, 0x89,
-    0x64, 0x1e, 0xb4, 0x7a, 0x5d, 0x0d, 0x12, 0xcf, 0x2b, 0xdd, 0x35, 0x90, 0x55, 0xc3, 0x0e, 0xcd, 0x0e, 0xad, 0x6b,
-    0x8f, 0x43, 0xd0, 0xb4, 0x6a, 0xdb, 0x4b, 0xe5, 0xa4, 0x9b, 0x09, 0x23, 0x1a, 0x43, 0xa9, 0xff, 0x61, 0x8b, 0x07,
-    0xd6, 0x0f, 0x83, 0x23, 0xbe, 0x8a, 0x66, 0xa2, 0x10, 0x2f, 0x11, 0x01, 0x0d, 0xc6, 0x96, 0xba, 0x87, 0xaa, 0xa8,
-    0x44, 0x7c, 0x1e, 0x34, 0xdb, 0xba, 0x41, 0x90, 0xf0, 0x7a, 0xdb, 0x63, 0x60, 0x96, 0x8d, 0x64, 0xcb, 0x2f, 0x28,
-    0x96, 0x04, 0xd5, 0xc0, 0x7a, 0xe8, 0xec, 0xd1, 0x61, 0x1b, 0x09, 0x4b, 0x4c, 0x6e, 0x1b, 0x31, 0x98, 0x9c, 0x6d,
-    0xdb, 0xd0, 0xec, 0xa4, 0x0f, 0x0a, 0xe0, 0xc8, 0x35, 0xc4, 0x93, 0xdc, 0xee, 0x19, 0x00, 0x80, 0x07, 0xf5, 0xcf,
-    0xe0, 0x7f, 0x75, 0xf8, 0x52, 0x3a, 0xfc, 0x0d, 0x84, 0xa5, 0xc1, 0xb2, 0x1c, 0x25, 0x40, 0xc5, 0x8b, 0xb3, 0xdb,
-    0x7a, 0x1b, 0x44, 0xff, 0x79, 0x9a, 0x26, 0xc4, 0xe7, 0x9e, 0x78, 0x4c, 0xa5, 0x94, 0xab, 0x78, 0x34, 0x9d, 0xb5,
-    0xb7, 0x24, 0x26, 0xe7, 0x9a, 0xf3, 0xe5, 0x2a, 0x35, 0x4b, 0xbe, 0x74, 0xd7, 0x01, 0xbc, 0x71, 0x72, 0x03, 0x5c,
-    0x40, 0x24, 0x17, 0x61, 0x5b, 0x7b, 0x19, 0xc2, 0x7f, 0x4e, 0x5b, 0x24, 0xfb, 0x8b, 0xc3, 0x51, 0x00, 0x3d, 0x09,
-    0x04, 0x05, 0x72, 0x64, 0xf6, 0xf0, 0x6b, 0x99, 0x38, 0x93, 0x5b, 0xac, 0x0c, 0xff, 0x40, 0x7b, 0x53, 0xba, 0xab,
-    0x61, 0xc9, 0xa2, 0xde, 0xd6, 0x2b, 0x0c, 0xbd, 0x85, 0xac, 0x4c, 0x64, 0x8b, 0xe6, 0x69, 0x2b, 0x56, 0x10, 0x1b,
-    0x08, 0x59, 0x6c, 0x55, 0x0a, 0xaa, 0x93, 0x85, 0x1d, 0x45, 0xda, 0xc6, 0x39, 0xe6, 0x6a, 0xab, 0x71, 0x73, 0x46,
-    0x0f, 0xf7, 0xab, 0x4e, 0x88, 0xae, 0x8c, 0xe0, 0x91, 0xda, 0x35, 0x8c, 0xd3, 0x18, 0x92, 0x3d, 0xab, 0x2f, 0x0d,
-    0xd6, 0xc9, 0x06, 0xdb, 0xc2, 0x62, 0xcb, 0x8a, 0x23, 0x5b, 0x28, 0x2e, 0x9b, 0x96, 0xc4, 0xc1, 0x42, 0xa9, 0x8d,
-    0x69, 0xe5, 0x8f, 0x89, 0x12, 0x11, 0x9a, 0x56, 0x3b, 0x3c, 0x2b, 0xb4, 0xb2, 0x7b, 0xfd, 0xdb, 0x80, 0x92, 0xb4,
-    0xca, 0x44, 0x37, 0x8c, 0x94, 0x2f, 0x4a, 0xb4, 0xc4, 0x28, 0x83, 0x8a, 0x78, 0xcb, 0xd2, 0x5c, 0x5c, 0x35, 0x29,
-    0x95, 0x35, 0x2f, 0x99, 0x28, 0x4f, 0x22, 0x18, 0x70, 0x85, 0xee, 0x2c, 0xb9, 0xef, 0x14, 0x57, 0x73, 0x23, 0x45,
-    0xae, 0xdc, 0x54, 0x56, 0x55, 0x78, 0x56, 0xad, 0x48, 0x26, 0x27, 0xbf, 0xcb, 0xd7, 0x54, 0xa9, 0xa8, 0xd7, 0xb5,
-    0x71, 0x9c, 0xe7, 0x79, 0x89, 0x5c, 0xa9, 0x6a, 0x53, 0xe8, 0xfa, 0x0d, 0x69, 0x36, 0xed, 0xad, 0x33, 0xc9, 0x75,
-    0x17, 0xe9, 0x8f, 0x31, 0x58, 0xa6, 0x27, 0xfc, 0x79, 0xc6, 0xb6, 0xd5, 0x65, 0x90, 0x31, 0xc6, 0x9d, 0x29, 0x95,
-    0x83, 0xe5, 0x4e, 0xbb, 0xd7, 0xdc, 0x8e, 0xd0, 0x3a, 0x54, 0x27, 0xce, 0xf5, 0xdb, 0xbd, 0x89, 0x3c, 0x61, 0xb3,
-    0x71, 0x23, 0xc7, 0x55, 0x9e, 0xea, 0x50, 0xe4, 0x37, 0xae, 0x72, 0x34, 0x66, 0xb9, 0x6e, 0x2c, 0x0a, 0x69, 0x8d,
-    0x94, 0x8b, 0x98, 0x08, 0x05, 0x3c, 0x45, 0x45, 0xe1, 0x6c, 0x22, 0xc5, 0x8f, 0x1f, 0x9f, 0x3f, 0xd2, 0x01, 0x12,
-    0xec, 0x86, 0x2f, 0x87, 0x8b, 0x47, 0x30, 0xd0, 0x77, 0x77, 0x1a, 0x13, 0x2d, 0xc6, 0x31, 0x65, 0x77, 0xd8, 0x8c,
-    0xe7, 0xe0, 0x16, 0xf9, 0x4b, 0xd4, 0xc5, 0xa8, 0x67, 0x79, 0xe7, 0xc3, 0x07, 0x94, 0x46, 0xa3, 0x8c, 0x67, 0xd3,
-    0xff, 0x5f, 0x96, 0xfa, 0xed, 0xa7, 0xd3, 0xdd, 0x4f, 0x27, 0x49, 0x27, 0xcf, 0xa4, 0x02, 0xc3, 0x27, 0x3c, 0x96,
-    0x64, 0x24, 0x55, 0xc8, 0x36, 0x45, 0x68, 0x90, 0xea, 0x03, 0x0b, 0x46, 0xa7, 0x8d, 0xb4, 0x26, 0x91, 0x07, 0x4c,
-    0x80, 0x7b, 0x93, 0xa8, 0x10, 0xcb, 0x5e, 0x8d, 0x42, 0x86, 0x3e, 0x2a, 0x7c, 0x99, 0x79, 0x8e, 0xcb, 0x43, 0x28};
+    0x1b, 0x14, 0x0b, 0x00, 0xe4, 0x6f, 0xcd, 0xfc, 0x7b, 0x2e, 0x27, 0xd2, 0x21, 0x2b, 0x58, 0xea, 0x16, 0xf8, 0xa5,
+    0xb6, 0x47, 0x14, 0xb3, 0x4c, 0x56, 0xcc, 0x20, 0x5b, 0x1d, 0xfe, 0x7d, 0xfb, 0xb5, 0x7a, 0x12, 0x0a, 0xd6, 0x48,
+    0x84, 0xa2, 0x21, 0x69, 0x0d, 0x77, 0x33, 0xf3, 0x77, 0xcf, 0x4c, 0x21, 0xf1, 0xde, 0xee, 0x7d, 0x44, 0xbc, 0xd3,
+    0xc4, 0x33, 0x89, 0x1a, 0x69, 0x68, 0x48, 0x57, 0xa7, 0x17, 0x0b, 0x4d, 0x91, 0xac, 0x30, 0x48, 0x21, 0x4d, 0x4c,
+    0x10, 0x57, 0x46, 0x14, 0x17, 0xd5, 0x21, 0x0e, 0xb4, 0x50, 0x87, 0xad, 0x62, 0xda, 0x11, 0x68, 0xc3, 0x20, 0x7f,
+    0x2d, 0xdc, 0x57, 0xeb, 0x2c, 0x36, 0xdb, 0xc4, 0x84, 0x0f, 0xac, 0xec, 0x08, 0x91, 0xa3, 0x92, 0x27, 0x45, 0xc4,
+    0x1e, 0xa4, 0x9e, 0x72, 0x3b, 0xc2, 0xe3, 0x20, 0x7d, 0xf8, 0x05, 0x09, 0xea, 0xe3, 0xa6, 0x3f, 0x11, 0x8b, 0x16,
+    0x11, 0x6b, 0x26, 0x91, 0x1a, 0x2c, 0x19, 0x24, 0xf7, 0x5d, 0x44, 0x82, 0x49, 0x44, 0x15, 0xce, 0x39, 0xdc, 0xcb,
+    0x8f, 0x5b, 0xe1, 0xe2, 0x42, 0x96, 0xa2, 0x10, 0x3c, 0x20, 0xa5, 0x65, 0x85, 0x49, 0x6a, 0x06, 0x08, 0xd1, 0xcb,
+    0x41, 0xb8, 0x49, 0x20, 0x73, 0x71, 0xfe, 0x55, 0x61, 0x45, 0xc6, 0x95, 0x72, 0xc8, 0xf0, 0xa5, 0xe9, 0xe6, 0x3a,
+    0xb9, 0xc3, 0x8a, 0x9f, 0xb5, 0xc1, 0xc9, 0x15, 0x56, 0x93, 0x38, 0x8a, 0x48, 0xf0, 0x4f, 0x38, 0x22, 0xe1, 0x8d,
+    0x55, 0xbb, 0x8c, 0xc3, 0xb0, 0x68, 0xcc, 0x7f, 0x6f, 0xf8, 0xc9, 0x9b, 0x38, 0x41, 0xf1, 0x94, 0x25, 0xf9, 0x6b,
+    0x56, 0xa2, 0xec, 0xa7, 0xbd, 0x2e, 0x69, 0x8e, 0xe2, 0xec, 0x36, 0x94, 0x24, 0x2c, 0x12, 0x1d, 0x4e, 0x76, 0x7e,
+    0x23, 0xcc, 0xf2, 0x6e, 0x35, 0x1a, 0x9c, 0xed, 0x6f, 0x15, 0x3f, 0xc9, 0x72, 0xdc, 0xfd, 0x13, 0x0f, 0x16, 0x8a,
+    0x23, 0x4f, 0xf9, 0x2e, 0x63, 0x44, 0x91, 0x77, 0xe0, 0xb3, 0xd1, 0x78, 0x74, 0xdb, 0x4a, 0x2c, 0xd8, 0xe8, 0xf9,
+    0x2c, 0x03, 0xbe, 0xae, 0xac, 0x4e, 0x42, 0x01, 0xc4, 0x4b, 0x40, 0xe7, 0x94, 0x34, 0x85, 0x2c, 0xfe, 0xf5, 0x74,
+    0x75, 0xd8, 0xdc, 0xec, 0x6a, 0x00, 0x3f, 0x3f, 0x81, 0x77, 0xa8, 0xcd, 0xde, 0x6d, 0x5a, 0x47, 0xa1, 0x99, 0x36,
+    0x87, 0xb6, 0x78, 0x35, 0x3c, 0x9a, 0x64, 0x15, 0x7c, 0x56, 0x76, 0x22, 0xce, 0x46, 0xe5, 0x17, 0x57, 0x05, 0xfc,
+    0x09, 0x69, 0xae, 0x39, 0xaa, 0xee, 0xc9, 0x4e, 0x7f, 0x99, 0x2a, 0x65, 0x82, 0x7e, 0xeb, 0x23, 0x4f, 0x42, 0xd5,
+    0xca, 0xcb, 0x42, 0x74, 0x2e, 0xd2, 0xa2, 0x62, 0x57, 0xd0, 0xa9, 0x7b, 0x4b, 0xac, 0x7b, 0x65, 0x13, 0x47, 0x0f,
+    0x2d, 0x3d, 0xf6, 0xbc, 0x78, 0x5c, 0xa3, 0xc9, 0x57, 0x4b, 0x10, 0x62, 0x68, 0x19, 0x7f, 0xfd, 0x1a, 0xcb, 0x51,
+    0x1e, 0x41, 0x39, 0x55, 0xf3, 0x97, 0x30, 0xca, 0x37, 0xb6, 0x42, 0x1d, 0x2d, 0x8c, 0xc6, 0x65, 0x8a, 0xd2, 0x89,
+    0x88, 0xa6, 0x28, 0xbd, 0x56, 0x7c, 0x2d, 0x5e, 0x0d, 0x2f, 0x9e, 0xc3, 0xa5, 0x80, 0xaf, 0xcc, 0x00, 0xde, 0xe6,
+    0x5a, 0x8b, 0xda, 0xff, 0x1f, 0x16, 0xc8, 0x83, 0x5e, 0xe5, 0xea, 0x25, 0x86, 0x70, 0x55, 0x25, 0x01, 0x14, 0x0c,
+    0x77, 0xd8, 0x31, 0x21, 0xcc, 0x79, 0x15, 0x3b, 0x32, 0x3a, 0xd3, 0xc5, 0x30, 0xaf, 0x03, 0xd8, 0x3e, 0x44, 0xb8,
+    0x63, 0xb5, 0x74, 0x4f, 0x41, 0x4b, 0xf0, 0x24, 0x74, 0xb2, 0x06, 0xb2, 0x7b, 0x06, 0x60, 0xdc, 0xc1, 0x3e, 0x0e,
+    0x6f, 0x1e, 0x3c, 0x42, 0xa0, 0xdb, 0x36, 0x43, 0x30, 0x71, 0xcc, 0xd6, 0x1a, 0xbd, 0x38, 0x61, 0x19, 0x3f, 0xf2,
+    0xdf, 0xf4, 0x53, 0x3d, 0xc1, 0x14, 0xbe, 0x50, 0x1c, 0x2c, 0xf3, 0xaa, 0x74, 0x36, 0xcb, 0xbd, 0x7a, 0x4b, 0xa3,
+    0x1c, 0x90, 0x40, 0x5b, 0x4a, 0x0f, 0x83, 0x6e, 0x9e, 0x96, 0x28, 0x3d, 0x77, 0x43, 0x05, 0x0e, 0x39, 0x26, 0x15,
+    0xb8, 0x6b, 0x4e, 0x3a, 0x62, 0xc2, 0xda, 0xde, 0x8e, 0x29, 0x29, 0x0b, 0x09, 0xa2, 0xb3, 0xa7, 0x1e, 0x9a, 0x0c,
+    0x8f, 0xa1, 0x46, 0x6f, 0x92, 0xf3, 0x9e, 0xb5, 0xc5, 0x7e, 0x0e, 0x8d, 0xeb, 0x55, 0x08, 0xfa, 0xc9, 0xd8, 0x4e,
+    0xe3, 0xd0, 0xca, 0x2a, 0x96, 0x11, 0x7e, 0xb1, 0xd4, 0x7f, 0x8f, 0x1d, 0xb3, 0xc3, 0xa0, 0x89, 0x6f, 0x93, 0x99,
+    0x55, 0x48, 0x97, 0x08, 0x79, 0x66, 0xe9, 0x4a, 0x6b, 0xa0, 0x29, 0xf2, 0x10, 0x1f, 0x22, 0xa2, 0x1b, 0x41, 0xdf,
+    0xa3, 0xde, 0x62, 0x60, 0x8e, 0xa1, 0x60, 0xc4, 0xd5, 0xce, 0x81, 0x47, 0x84, 0x3b, 0x66, 0x60, 0x74, 0xa7, 0x74,
+    0xcc, 0x48, 0xe0, 0xe1, 0xd5, 0x0c, 0x15, 0x98, 0x3d, 0xa7, 0x9c, 0xb2, 0xec, 0xba, 0x0f, 0x2c, 0x52, 0x14, 0x7b,
+    0xe2, 0x49, 0x6e, 0x0f, 0x8c, 0x00, 0xe0, 0x81, 0xf6, 0x57, 0xe4, 0x3f, 0xbf, 0x7c, 0xa9, 0x5e, 0xfe, 0x01, 0xc2,
+    0x64, 0xb0, 0x05, 0x60, 0x01, 0xaa, 0x78, 0x65, 0xb2, 0xeb, 0x56, 0x41, 0xf2, 0xbf, 0xa3, 0x45, 0x4e, 0x3c, 0x78,
+    0xe2, 0xa1, 0x0d, 0xa9, 0x2a, 0xc0, 0x8a, 0xc0, 0x6f, 0xe4, 0x66, 0xbe, 0x72, 0x35, 0x5e, 0xf7, 0x3b, 0x42, 0x53,
+    0xd4, 0xe6, 0x66, 0xb6, 0x78, 0xcd, 0xaa, 0x6f, 0xf4, 0x26, 0x80, 0x3a, 0x4e, 0x74, 0x80, 0x17, 0x88, 0x44, 0x23,
+    0xa6, 0x3a, 0x6f, 0x87, 0xb8, 0xd0, 0x4d, 0xd3, 0xfc, 0x7c, 0xd6, 0x38, 0x2a, 0x00, 0x28, 0x01, 0xa2, 0x40, 0x94,
+    0x6c, 0x1e, 0x8a, 0xed, 0xe3, 0x92, 0x9d, 0x90, 0xe3, 0x0d, 0x02, 0x4e, 0x15, 0x30, 0xed, 0x8f, 0x5b, 0x99, 0xaa,
+    0x7a, 0x4e, 0xb9, 0xec, 0x91, 0xe2, 0x9f, 0xd4, 0xca, 0x46, 0xaf, 0x87, 0x19, 0x4b, 0xad, 0xea, 0xe6, 0x6c, 0x8d,
+    0x53, 0x4b, 0x29, 0xee, 0x1e, 0x96, 0xd8, 0x94, 0x30, 0x3a, 0x9c, 0xb0, 0x4c, 0xdb, 0xe2, 0xa1, 0x7f, 0xc7, 0x11,
+    0xdd, 0xe3, 0x9d, 0x36, 0x44, 0xd3, 0x93, 0x14, 0x9c, 0x4c, 0x9d, 0xdd, 0x3a, 0x7c, 0x41, 0xb1, 0x8f, 0x14, 0xd9,
+    0x4e, 0x61, 0xd9, 0x3a, 0xe3, 0x0d, 0x76, 0xca, 0x6c, 0xac, 0x73, 0xaf, 0xad, 0x94, 0x87, 0x30, 0xf1, 0x30, 0x2f,
+    0x8b, 0xed, 0x4a, 0xed, 0xbc, 0xc2, 0xf2, 0x7c, 0x30, 0xa3, 0x0b, 0x28, 0x64, 0x3b, 0x8c, 0xd4, 0xc3, 0x42, 0xb9,
+    0xa3, 0x44, 0x51, 0x80, 0x07, 0x5a, 0x3d, 0x14, 0x33, 0x99, 0xbf, 0x2a, 0x6b, 0x2b, 0x19, 0x47, 0x72, 0x9e, 0xd4,
+    0xb4, 0x6d, 0x72, 0xdd, 0x8a, 0x4b, 0x33, 0x55, 0xbc, 0xb4, 0xcd, 0xc8, 0x2b, 0x17, 0x2f, 0x74, 0xeb, 0x22, 0x17,
+    0x94, 0x08, 0x27, 0x27, 0xc2, 0x5b, 0x17, 0xb4, 0xa9, 0x22, 0x16, 0x9d, 0xd4, 0xfc, 0xc7, 0x15, 0xa3, 0x9b, 0x86,
+    0x1f, 0xad, 0x45, 0xd3, 0x87, 0x94, 0x5b, 0x31, 0x36, 0xaa, 0xe4, 0x66, 0x8d, 0xcc, 0x31, 0x05, 0x5b, 0xc4, 0x40,
+    0xc0, 0xb8, 0xeb, 0x91, 0x18, 0x22, 0x8c, 0x31, 0x1e, 0xad, 0xd0, 0x3a, 0x98, 0x07, 0xb5, 0x6f, 0x11, 0xba, 0x11,
+    0xa6, 0x14, 0x35, 0x5a, 0xe7, 0x55, 0xdf, 0xb7, 0x4c, 0x03, 0x61, 0xa3, 0x74, 0x23, 0xdf, 0x55, 0x1f, 0x02, 0x51,
+    0x09, 0xb7, 0xba, 0xd5, 0x0c, 0x67, 0xab, 0x98, 0x70, 0x14, 0x64, 0x8d, 0xf4, 0x8b, 0x54, 0x44, 0x07, 0x6f, 0xe0,
+    0x69, 0x32, 0xca, 0x48, 0xe5, 0xd3, 0xa7, 0x17, 0x8f, 0x45, 0x84, 0x04, 0xb7, 0xd1, 0xbb, 0xe1, 0xf6, 0x01, 0x0a,
+    0xf6, 0xee, 0x2b, 0x32, 0xd2, 0xc5, 0xf8, 0xa6, 0xec, 0x0f, 0x1b, 0x09, 0x1d, 0xfc, 0xa2, 0xbf, 0x54, 0x5d, 0x2c,
+    0x62, 0xf4, 0x77, 0xde, 0xad, 0xa0, 0x50, 0x6a, 0xb4, 0xe3, 0x5f, 0xda, 0xff, 0x6b, 0xb1, 0x78, 0xf7, 0xf9, 0xc1,
+    0xa6, 0xa8, 0x93, 0xe8, 0xe4, 0x11, 0x56, 0xa0, 0x5b, 0x85, 0xa7, 0x92, 0x7a, 0x58, 0x45, 0x95, 0xa9, 0x63, 0x83,
+    0xb4, 0x1f, 0x18, 0x31, 0x7a, 0x6d, 0xa1, 0x8d, 0x8c, 0xdc, 0x91, 0x02, 0x3c, 0x9c, 0x92, 0x42, 0x8e, 0x03, 0x02,
+    0xc5, 0x0c, 0x43, 0x54, 0xf9, 0xb2, 0x85, 0x39, 0x2e, 0x77, 0xad, 0x00};
 
 // Backwards compatibility alias
 #define INDEX_GZ INDEX_BR

esphome/components/climate/climate.cpp

@@ -749,33 +749,39 @@ void Climate::dump_traits_(const char *tag) {
   }
   if (!traits.get_supported_modes().empty()) {
     ESP_LOGCONFIG(tag, "  Supported modes:");
-    for (ClimateMode m : traits.get_supported_modes())
+    for (ClimateMode m : traits.get_supported_modes()) {
       ESP_LOGCONFIG(tag, "  - %s", LOG_STR_ARG(climate_mode_to_string(m)));
+    }
   }
   if (!traits.get_supported_fan_modes().empty()) {
     ESP_LOGCONFIG(tag, "  Supported fan modes:");
-    for (ClimateFanMode m : traits.get_supported_fan_modes())
+    for (ClimateFanMode m : traits.get_supported_fan_modes()) {
       ESP_LOGCONFIG(tag, "  - %s", LOG_STR_ARG(climate_fan_mode_to_string(m)));
+    }
   }
   if (!traits.get_supported_custom_fan_modes().empty()) {
     ESP_LOGCONFIG(tag, "  Supported custom fan modes:");
-    for (const char *s : traits.get_supported_custom_fan_modes())
+    for (const char *s : traits.get_supported_custom_fan_modes()) {
       ESP_LOGCONFIG(tag, "  - %s", s);
+    }
   }
   if (!traits.get_supported_presets().empty()) {
     ESP_LOGCONFIG(tag, "  Supported presets:");
-    for (ClimatePreset p : traits.get_supported_presets())
+    for (ClimatePreset p : traits.get_supported_presets()) {
       ESP_LOGCONFIG(tag, "  - %s", LOG_STR_ARG(climate_preset_to_string(p)));
+    }
   }
   if (!traits.get_supported_custom_presets().empty()) {
     ESP_LOGCONFIG(tag, "  Supported custom presets:");
-    for (const char *s : traits.get_supported_custom_presets())
+    for (const char *s : traits.get_supported_custom_presets()) {
       ESP_LOGCONFIG(tag, "  - %s", s);
+    }
   }
   if (!traits.get_supported_swing_modes().empty()) {
     ESP_LOGCONFIG(tag, "  Supported swing modes:");
-    for (ClimateSwingMode m : traits.get_supported_swing_modes())
+    for (ClimateSwingMode m : traits.get_supported_swing_modes()) {
       ESP_LOGCONFIG(tag, "  - %s", LOG_STR_ARG(climate_swing_mode_to_string(m)));
+    }
   }
 }
 

esphome/components/const/__init__.py

@@ -14,8 +14,10 @@ CONF_CHANNEL_COLORS = "channel_colors"
 CONF_CLIMATE_ID = "climate_id"
 CONF_CO2_EQUIVALENT = "co2_equivalent"
 CONF_COLOR_DEPTH = "color_depth"
+CONF_COLUMNS = "columns"
 CONF_CRC_ENABLE = "crc_enable"
 CONF_DATA_BITS = "data_bits"
+CONF_DESCRIPTION = "description"
 CONF_DRAW_ROUNDING = "draw_rounding"
 CONF_ENABLE_OTA_DOWNGRADE_PROTECTION = "enable_ota_downgrade_protection"
 CONF_ENABLED = "enabled"
@@ -24,6 +26,7 @@ CONF_GYROSCOPE_RANGE = "gyroscope_range"
 CONF_IAQ = "iaq"
 CONF_IGNORE_NOT_FOUND = "ignore_not_found"
 CONF_IS_WRGB = "is_wrgb"
+CONF_KEYS = "keys"
 CONF_LABEL = "label"
 CONF_LIBRETINY = "libretiny"
 CONF_LOOP = "loop"

esphome/components/cs5460a/cs5460a.cpp

@@ -249,7 +249,7 @@ bool CS5460AComponent::check_status_() {
     bool dir = status & (1 << 21);
     if (current_gain_ < 0)
       dir = !dir;
-    ESP_LOGI(TAG, "Energy counter %s pulse", dir ? "negative" : "positive");
+    ESP_LOGI(TAG, "Energy counter %s pulse", dir ? LOG_STR_LITERAL("negative") : LOG_STR_LITERAL("positive"));
     clear |= 1 << 22;
   }
 
@@ -319,7 +319,9 @@ void CS5460AComponent::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "CS5460A:\n"
                 "  Init status: %s",
-                state == COMPONENT_STATE_LOOP ? "OK" : (state == COMPONENT_STATE_FAILED ? "failed" : "other"));
+                state == COMPONENT_STATE_LOOP
+                    ? LOG_STR_LITERAL("OK")
+                    : (state == COMPONENT_STATE_FAILED ? LOG_STR_LITERAL("failed") : LOG_STR_LITERAL("other")));
   LOG_PIN("  CS Pin: ", cs_);
   ESP_LOGCONFIG(TAG,
                 "  Samples / cycle: %" PRIu32 "\n"
@@ -330,9 +332,10 @@ void CS5460AComponent::dump_config() {
                 "  Current HPF: %s\n"
                 "  Voltage HPF: %s\n"
                 "  Pulse energy: %.2f Wh",
-                samples_, phase_offset_, pga_gain_ == CS5460A_PGA_GAIN_50X ? "50x" : "10x", current_gain_,
-                voltage_gain_, current_hpf_ ? "enabled" : "disabled", voltage_hpf_ ? "enabled" : "disabled",
-                pulse_energy_wh_);
+                samples_, phase_offset_,
+                pga_gain_ == CS5460A_PGA_GAIN_50X ? LOG_STR_LITERAL("50x") : LOG_STR_LITERAL("10x"), current_gain_,
+                voltage_gain_, current_hpf_ ? LOG_STR_LITERAL("enabled") : LOG_STR_LITERAL("disabled"),
+                voltage_hpf_ ? LOG_STR_LITERAL("enabled") : LOG_STR_LITERAL("disabled"), pulse_energy_wh_);
   LOG_SENSOR("  ", "Voltage", voltage_sensor_);
   LOG_SENSOR("  ", "Current", current_sensor_);
   LOG_SENSOR("  ", "Power", power_sensor_);

esphome/components/d01/d01.cpp

@@ -0,0 +1,45 @@
+#include "d01.h"
+#include "esphome/core/log.h"
+
+// uart specification for d01 sensor from https://manuals.plus/ae/1005006417362019:
+//
+// A frame of serial output data includes 4 bytes, formatted as follows:
+// __Characteristic byte: Fixed value 0xA5.
+// __Data byte: DATAH is the high 7 bits of the concentration value, and DATAL is the low 7 bits of the concentration
+// value.
+// __Check byte: The low 7 bits of the sum of all bytes before the check byte.
+//
+// If the serial output is 4 bytes of data: 0*A5 0*01 0*2C 0*52, then DATAH = 0*01 = 1, DATAL = 0*2C = 44.
+// Concentration value = 1*128 + 44 = 172 µg/m³.
+//
+// The PM2.5 dust concentration value obtained from the dust sensor needs to be calibrated with a K value coefficient
+// based on the TSI instrument's photometric method. It is generally recommended to use 0.4.
+
+namespace esphome::d01 {
+
+static const char *const TAG = "d01";
+
+static const uint8_t D01_FRAME_HEADER = 0xA5;
+
+void D01SensorComponent::dump_config() { LOG_SENSOR("  ", "D01 PM2.5", this); }
+
+void D01SensorComponent::loop() {
+  uint8_t buf[4];
+  while (this->available() >= 4) {
+    if (this->peek() != D01_FRAME_HEADER) {
+      this->read();
+      continue;
+    }
+    this->read_array(buf, 4);
+    uint8_t sum = (buf[0] + buf[1] + buf[2]) & 0x7F;
+    if (sum != buf[3]) {
+      ESP_LOGW(TAG, "checksum mismatch");
+      continue;
+    }
+    uint16_t latest_concentration = (buf[1] & 0x7F) * 128 + (buf[2] & 0x7F);
+    ESP_LOGV(TAG, "Unadjusted PM2.5 Concentration: %d µg/m³", latest_concentration);
+    this->publish_state(latest_concentration);
+  }
+}
+
+}  // namespace esphome::d01

esphome/components/d01/d01.h

@@ -0,0 +1,14 @@
+#pragma once
+#include "esphome/core/component.h"
+#include "esphome/components/sensor/sensor.h"
+#include "esphome/components/uart/uart.h"
+
+namespace esphome::d01 {
+
+class D01SensorComponent final : public sensor::Sensor, public Component, public uart::UARTDevice {
+ public:
+  void dump_config() override;
+  void loop() override;
+};
+
+}  // namespace esphome::d01

esphome/components/d01/sensor.py

@@ -0,0 +1,45 @@
+import esphome.codegen as cg
+from esphome.components import sensor, uart
+import esphome.config_validation as cv
+from esphome.const import (
+    DEVICE_CLASS_PM25,
+    ICON_BLUR,
+    STATE_CLASS_MEASUREMENT,
+    UNIT_MICROGRAMS_PER_CUBIC_METER,
+)
+from esphome.types import ConfigType
+
+CODEOWNERS = ["@ch604"]
+DEPENDENCIES = ["uart"]
+
+d01_ns = cg.esphome_ns.namespace("d01")
+D01SensorComponent = d01_ns.class_(
+    "D01SensorComponent", sensor.Sensor, uart.UARTDevice, cg.Component
+)
+
+
+CONFIG_SCHEMA = (
+    sensor.sensor_schema(
+        D01SensorComponent,
+        unit_of_measurement=UNIT_MICROGRAMS_PER_CUBIC_METER,
+        icon=ICON_BLUR,
+        accuracy_decimals=0,
+        device_class=DEVICE_CLASS_PM25,
+        state_class=STATE_CLASS_MEASUREMENT,
+    )
+    .extend(cv.COMPONENT_SCHEMA)
+    .extend(uart.UART_DEVICE_SCHEMA)
+)
+
+FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
+    "d01",
+    baud_rate=9600,
+    require_rx=True,
+    require_tx=False,
+)
+
+
+async def to_code(config: ConfigType) -> None:
+    var = await sensor.new_sensor(config)
+    await cg.register_component(var, config)
+    await uart.register_uart_device(var, config)

esphome/components/dht/dht.cpp

@@ -20,8 +20,8 @@ void DHT::dump_config() {
                 "DHT:\n"
                 "  %sModel: %s\n"
                 "  Internal pull-up: %s",
-                this->is_auto_detect_ ? "Auto-detected " : "",
-                this->model_ == DHT_MODEL_DHT11 ? "DHT11" : "DHT22 or equivalent",
+                this->is_auto_detect_ ? LOG_STR_LITERAL("Auto-detected ") : "",
+                this->model_ == DHT_MODEL_DHT11 ? LOG_STR_LITERAL("DHT11") : LOG_STR_LITERAL("DHT22 or equivalent"),
                 ONOFF(this->t_pin_->get_flags() & gpio::FLAG_PULLUP));
   LOG_PIN("  Pin: ", this->t_pin_);
   LOG_UPDATE_INTERVAL(this);
@@ -154,8 +154,9 @@ bool HOT IRAM_ATTR DHT::read_sensor_(float *temperature, float *humidity, bool r
     }
   }
   if (error_code != 0) {
-    if (report_errors)
+    if (report_errors) {
       ESP_LOGW(TAG, ESP_LOG_MSG_COMM_FAIL);
+    }
     return false;
   }
 

esphome/components/ds1603l/ds1603l.cpp

@@ -0,0 +1,68 @@
+#include "ds1603l.h"
+
+#include <cstring>
+
+#include "esphome/core/helpers.h"
+#include "esphome/core/log.h"
+
+namespace esphome::ds1603l {
+
+static const char *const TAG = "ds1603l.sensor";
+
+void DS1603L::loop() {
+  // Assemble frames one byte at a time so a stream that starts mid-frame can realign
+  uint8_t byte;
+  while (this->available() > 0 && this->read_byte(&byte)) {
+    if (this->rx_count_ == 0 && byte != HEADER_BYTE) {
+      ESP_LOGV(TAG, "Skipping byte 0x%02X while looking for header", byte);
+      continue;
+    }
+
+    this->rx_buffer_[this->rx_count_++] = byte;
+    if (this->rx_count_ < FRAME_SIZE) {
+      continue;
+    }
+
+    if (this->parse_data_()) {
+      this->rx_count_ = 0;
+    } else {
+      // The header byte was part of the payload of a misaligned frame, so realign instead of dropping everything
+      this->resync_();
+    }
+  }
+}
+
+void DS1603L::dump_config() { LOG_SENSOR("", "DS1603L", this); }
+
+bool DS1603L::parse_data_() {
+  uint8_t header = this->rx_buffer_[0];
+  uint8_t data_h = this->rx_buffer_[1];
+  uint8_t data_l = this->rx_buffer_[2];
+  uint8_t checksum = this->rx_buffer_[3];
+
+  uint8_t computed_checksum = (header + data_h + data_l) & 0xFF;
+
+  ESP_LOGV(TAG, "Data: Header=0x%02X, Data_H=0x%02X, Data_L=0x%02X, Checksum=0x%02X", header, data_h, data_l, checksum);
+
+  if (checksum != computed_checksum) {
+    ESP_LOGW(TAG, "Checksum mismatch: received 0x%02X, expected 0x%02X", checksum, computed_checksum);
+    return false;
+  }
+
+  this->publish_state(encode_uint16(data_h, data_l));
+  return true;
+}
+
+void DS1603L::resync_() {
+  // Drop the byte that was treated as the header, then look for the next candidate header in what is left
+  size_t start = 1;
+  while (start < this->rx_count_ && this->rx_buffer_[start] != HEADER_BYTE) {
+    start++;
+  }
+  this->rx_count_ -= start;
+  if (this->rx_count_ > 0) {
+    memmove(this->rx_buffer_, this->rx_buffer_ + start, this->rx_count_);
+  }
+}
+
+}  // namespace esphome::ds1603l

esphome/components/ds1603l/ds1603l.h

@@ -0,0 +1,30 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+#include "esphome/components/sensor/sensor.h"
+#include "esphome/components/uart/uart.h"
+#include "esphome/core/component.h"
+
+namespace esphome::ds1603l {
+
+class DS1603L final : public sensor::Sensor, public Component, public uart::UARTDevice {
+ public:
+  void loop() override;
+  void dump_config() override;
+
+ protected:
+  static constexpr uint8_t HEADER_BYTE = 0xFF;
+  static constexpr size_t FRAME_SIZE = 4;
+
+  // Validates the checksum of the frame in rx_buffer_ and publishes it. Returns false if the frame is invalid.
+  bool parse_data_();
+  // Drops the first buffered byte and realigns the buffer on the next possible header byte.
+  void resync_();
+
+  uint8_t rx_buffer_[FRAME_SIZE];  // Buffer for the frame being assembled
+  size_t rx_count_{0};             // Number of bytes currently in rx_buffer_
+};
+
+}  // namespace esphome::ds1603l

esphome/components/ds1603l/sensor.py

@@ -0,0 +1,43 @@
+import esphome.codegen as cg
+from esphome.components import sensor, uart
+import esphome.config_validation as cv
+from esphome.const import (
+    DEVICE_CLASS_DISTANCE,
+    STATE_CLASS_MEASUREMENT,
+    UNIT_MILLIMETER,
+)
+from esphome.types import ConfigType
+
+CODEOWNERS = ["@JakeLC15"]
+DEPENDENCIES = ["uart"]
+
+ds1603l_ns = cg.esphome_ns.namespace("ds1603l")
+DS1603L = ds1603l_ns.class_("DS1603L", sensor.Sensor, cg.Component, uart.UARTDevice)
+
+
+CONFIG_SCHEMA = (
+    sensor.sensor_schema(
+        DS1603L,
+        unit_of_measurement=UNIT_MILLIMETER,
+        accuracy_decimals=0,
+        device_class=DEVICE_CLASS_DISTANCE,
+        state_class=STATE_CLASS_MEASUREMENT,
+    )
+    .extend(uart.UART_DEVICE_SCHEMA)
+    .extend(cv.COMPONENT_SCHEMA)
+)
+
+FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
+    "ds1603l",
+    baud_rate=9600,
+    require_tx=False,
+    require_rx=True,
+    data_bits=8,
+    stop_bits=1,
+)
+
+
+async def to_code(config: ConfigType) -> None:
+    var = await sensor.new_sensor(config)
+    await cg.register_component(var, config)
+    await uart.register_uart_device(var, config)

esphome/components/emc2101/emc2101.cpp

@@ -93,7 +93,7 @@ void Emc2101Component::dump_config() {
   if (this->is_failed()) {
     ESP_LOGE(TAG, ESP_LOG_MSG_COMM_FAIL);
   }
-  ESP_LOGCONFIG(TAG, "  Mode: %s", this->dac_mode_ ? "DAC" : "PWM");
+  ESP_LOGCONFIG(TAG, "  Mode: %s", this->dac_mode_ ? LOG_STR_LITERAL("DAC") : LOG_STR_LITERAL("PWM"));
   if (this->dac_mode_) {
     ESP_LOGCONFIG(TAG, "  DAC Conversion Rate: %X", this->dac_conversion_rate_);
   } else {

esphome/components/ens210/ens210.cpp

@@ -216,7 +216,7 @@ void ENS210Component::extract_measurement_(uint32_t val, int *data, int *status)
 // Sets ENS210 to low (true) or high (false) power. Returns false on I2C problems.
 bool ENS210Component::set_low_power_(bool enable) {
   uint8_t low_power_cmd = enable ? 0x01 : 0x00;
-  ESP_LOGD(TAG, "Enable low power: %s", enable ? "true" : "false");
+  ESP_LOGD(TAG, "Enable low power: %s", enable ? LOG_STR_LITERAL("true") : LOG_STR_LITERAL("false"));
   bool result = this->write_byte(ENS210_REGISTER_SYS_CTRL, low_power_cmd);
   delay(ENS210_BOOTING_MS);
   return result;

esphome/components/epaper_spi/epaper_spi_uc8179.cpp

@@ -0,0 +1,139 @@
+#include "epaper_spi_uc8179.h"
+
+#include <algorithm>
+
+#include "esphome/core/log.h"
+
+namespace esphome::epaper_spi {
+
+static constexpr const char *const TAG = "epaper_spi.uc8179";
+
+bool EPaperUC8179::initialise(bool partial) {
+  EPaperBase::initialise(partial);  // send the model init sequence
+  this->partial_ = partial;
+  ESP_LOGV(TAG, "Power on");
+  // POWER ON must precede the waveform/mode registers and the data transfer
+  // (the original driver powers on and busy-waits before writing them).
+  // The state machine busy-waits before entering TRANSFER_DATA.
+  this->command(0x04);
+  // Give the busy line time to assert before the state machine polls it
+  this->next_delay_ = 100;
+  return true;
+}
+
+// Set up the refresh mode. Must be called after power-on has completed.
+void EPaperUC8179::set_refresh_mode_() {
+  if (!this->is_using_partial_update_()) {
+    return;  // plain full refresh uses the mode set by the init sequence
+  }
+  // Fast and partial refresh use flipped data polarity and a floating border
+  this->cmd_data(0x50, {0xA9, 0x07});
+  // Force the waveform via the temperature registers: 0x5A selects the fast
+  // full-refresh waveform, 0x6E the partial-refresh waveform
+  this->cmd_data(0xE0, {0x02});
+  if (this->partial_) {
+    this->cmd_data(0xE5, {0x6E});
+    this->command(0x91);  // enter partial mode
+    // Set the partial window to the full screen
+    const uint16_t x_end = this->width_ - 1;
+    const uint16_t y_end = this->height_ - 1;
+    this->cmd_data(0x90, {0x00, 0x00, static_cast<uint8_t>(x_end >> 8), static_cast<uint8_t>(x_end & 0xFF), 0x00, 0x00,
+                          static_cast<uint8_t>(y_end >> 8), static_cast<uint8_t>(y_end & 0xFF), 0x01});
+  } else {
+    this->cmd_data(0xE5, {0x5A});
+    this->command(0x92);  // exit partial mode
+  }
+}
+
+bool HOT EPaperUC8179::transfer_data() {
+  const uint32_t start_time = millis();
+  const size_t buffer_length = this->buffer_length_;
+  if (this->current_data_index_ == 0) {
+    this->set_refresh_mode_();
+  }
+  // Fast full refresh sends the previous-image plane as well, so that every pixel transitions
+  const bool two_pass = this->is_using_partial_update_() && !this->partial_;
+  // Plain full refresh sends inverted data (buffer is 1=white, the wire wants 0=white);
+  // in fast/partial mode the data polarity is flipped via the VCOM/data-interval
+  // register instead, so the new-image plane is sent unmodified
+  const bool invert_new_data = !this->is_using_partial_update_();
+
+  uint8_t bytes_to_send[MAX_TRANSFER_SIZE];
+
+  // Phase 1 (fast full refresh only): previous image via 0x10 (DTM1), inverse of the new image
+  if (two_pass && this->current_data_index_ < buffer_length) {
+    if (this->current_data_index_ == 0) {
+      this->command(0x10);  // DATA START TRANSMISSION 1 (previous image)
+    }
+    this->start_data_();
+    while (this->current_data_index_ < buffer_length) {
+      const size_t bytes_to_copy = std::min(MAX_TRANSFER_SIZE, buffer_length - this->current_data_index_);
+      for (size_t i = 0; i < bytes_to_copy; i++) {
+        bytes_to_send[i] = ~this->buffer_[this->current_data_index_ + i];
+      }
+      this->write_array(bytes_to_send, bytes_to_copy);
+      this->current_data_index_ += bytes_to_copy;
+      if (millis() - start_time > MAX_TRANSFER_TIME) {
+        this->disable();
+        return false;
+      }
+    }
+    this->disable();
+  }
+
+  // Phase 2: new image via 0x13 (DTM2)
+  const size_t offset = two_pass ? buffer_length : 0;
+  const size_t total = offset + buffer_length;
+  if (this->current_data_index_ < total) {
+    if (this->current_data_index_ == offset) {
+      this->command(0x13);  // DATA START TRANSMISSION 2 (new image)
+    }
+    this->start_data_();
+    while (this->current_data_index_ < total) {
+      const size_t bytes_to_copy = std::min(MAX_TRANSFER_SIZE, total - this->current_data_index_);
+      const size_t data_idx = this->current_data_index_ - offset;
+      for (size_t i = 0; i < bytes_to_copy; i++) {
+        const uint8_t byte = this->buffer_[data_idx + i];
+        bytes_to_send[i] = invert_new_data ? ~byte : byte;
+      }
+      this->write_array(bytes_to_send, bytes_to_copy);
+      this->current_data_index_ += bytes_to_copy;
+      if (millis() - start_time > MAX_TRANSFER_TIME) {
+        this->disable();
+        return false;
+      }
+    }
+    this->disable();
+  }
+
+  this->current_data_index_ = 0;
+  return true;
+}
+
+void EPaperUC8179::power_on() {
+  // Power-on is sent at the end of initialise() instead, because the
+  // waveform/mode registers and the data transfer must follow it
+}
+
+void EPaperUC8179::refresh_screen(bool /*partial*/) {
+  ESP_LOGV(TAG, "Refresh");
+  this->command(0x12);  // DISPLAY REFRESH
+  // Delay the next busy poll: the busy line takes a short time to assert after
+  // the refresh command, and polling too early would read it as already idle
+  this->next_delay_ = 100;
+}
+
+void EPaperUC8179::power_off() {
+  ESP_LOGV(TAG, "Power off");
+  this->command(0x02);  // POWER OFF
+}
+
+void EPaperUC8179::deep_sleep() {
+  // Deep sleep loses the previous-image RAM that partial refresh compares against
+  if (!this->is_using_partial_update_()) {
+    ESP_LOGV(TAG, "Deep sleep");
+    this->cmd_data(0x07, {0xA5});  // DEEP SLEEP with check code
+  }
+}
+
+}  // namespace esphome::epaper_spi

esphome/components/epaper_spi/epaper_spi_uc8179.h

@@ -0,0 +1,52 @@
+#pragma once
+
+#include "epaper_spi.h"
+
+namespace esphome::epaper_spi {
+
+/**
+ * Monochrome e-paper displays using the UC8179 controller.
+ * Supports: 7.5" V2 (EPD_7in5_V2), 800x480 pixels, as used by the
+ * Waveshare 7.5" V2 HAT and the Seeed reTerminal E1001.
+ *
+ * Buffer layout: 1 bit per pixel, 1=white, 0=black (the base class default).
+ *
+ * The INITIALISE state sends the panel configuration followed by power-on
+ * (0x04); the state machine busy-waits for power-on to complete before
+ * TRANSFER_DATA, which first writes the waveform/mode registers (these are
+ * only accepted while powered) and then the image data. The state machine
+ * busy-waits again before triggering REFRESH_SCREEN (0x12).
+ *
+ * Three refresh modes are used, following the Waveshare EPD_7in5_V2 examples:
+ * - full_update_every == 1: plain full refresh. The new image is sent
+ *   inverted to DTM2 (0x13) and the controller uses its normal waveform.
+ * - full_update_every > 1, full update: fast full refresh. The data polarity
+ *   is flipped via the VCOM/data-interval register, a fast waveform is forced
+ *   via the temperature registers, and the image is sent to both DTM1 (0x10,
+ *   inverted) and DTM2 (0x13) so that every pixel transitions.
+ * - full_update_every > 1, partial update: partial refresh. A partial-update
+ *   waveform is forced, partial mode is entered with a full-screen window and
+ *   only DTM2 is sent; the controller compares against its previous-image RAM.
+ */
+class EPaperUC8179 final : public EPaperBase {
+ public:
+  EPaperUC8179(const char *name, uint16_t width, uint16_t height, const uint8_t *init_sequence,
+               size_t init_sequence_length)
+      : EPaperBase(name, width, height, init_sequence, init_sequence_length, DISPLAY_TYPE_BINARY) {
+    this->buffer_length_ = this->row_width_ * height;
+  }
+
+ protected:
+  bool initialise(bool partial) override;
+  bool transfer_data() override;
+  void refresh_screen(bool partial) override;
+  void power_on() override;
+  void power_off() override;
+  void deep_sleep() override;
+  void set_refresh_mode_();
+
+  // Set by initialise() so transfer_data() knows which planes to send
+  bool partial_{};
+};
+
+}  // namespace esphome::epaper_spi

esphome/components/epaper_spi/models/uc8179.py

@@ -0,0 +1,93 @@
+"""Monochrome e-paper displays using the UC8179 controller.
+
+Supported models:
+- waveshare-7.5in-v2: 7.5" mono display, 800x480 pixels (EPD_7in5_V2)
+- seeed-reterminal-e1001: Seeed reTerminal E1001, which uses the same
+  7.5" 800x480 panel on an integrated ESP32-S3 board
+
+Panel configuration and power-on (0x04) are both sent during the INITIALISE
+state; the state machine's built-in busy wait then covers the power-on delay
+before the waveform/mode registers and image data are transferred.
+
+These displays support fast full and partial refresh: set ``full_update_every``
+greater than 1 to enable it. Every ``full_update_every``-th update is a fast
+full refresh, with partial refreshes in between.
+"""
+
+from typing import Any
+
+from esphome.const import CONF_DATA_RATE
+
+from . import EpaperModel
+
+
+class UC8179(EpaperModel):
+    """EpaperModel class for monochrome displays using the UC8179 controller."""
+
+    def __init__(
+        self,
+        name: str,
+        class_name: str = "EPaperUC8179",
+        data_rate: str = "10MHz",
+        **defaults: Any,
+    ) -> None:
+        defaults.setdefault(CONF_DATA_RATE, data_rate)
+        super().__init__(name, class_name, **defaults)
+
+    def get_init_sequence(self, config: dict) -> tuple:
+        """Generate the initialization sequence for UC8179 mono displays.
+
+        Panel configuration only — the driver appends power-on (0x04) at the
+        end of the INITIALISE state, and the state machine busy-waits for it
+        to complete before the data transfer starts.
+        """
+        width, height = self.get_dimensions(config)
+        return (
+            # POWER SETTING
+            (0x01, 0x07, 0x07, 0x3F, 0x3F),
+            # BOOSTER SOFT START
+            (0x06, 0x17, 0x17, 0x28, 0x17),
+            # PANEL SETTING (black/white mode, LUT from OTP)
+            (0x00, 0x1F),
+            # RESOLUTION SETTING (width x height)
+            (
+                0x61,
+                (width >> 8) & 0xFF,
+                width & 0xFF,
+                (height >> 8) & 0xFF,
+                height & 0xFF,
+            ),
+            # DUAL SPI MODE (disabled)
+            (0x15, 0x00),
+            # VCOM AND DATA INTERVAL SETTING
+            (0x50, 0x10, 0x07),
+            # TCON SETTING
+            (0x60, 0x22),
+        )
+
+
+uc8179 = UC8179("uc8179")
+
+# Waveshare 7.5" V2 mono (EPD_7in5_V2) — 800x480, UC8179 controller
+waveshare_7_5_v2 = uc8179.extend(
+    "waveshare-7.5in-v2",
+    width=800,
+    height=480,
+)
+
+# Seeed reTerminal E1001 — 7.5" mono e-paper (800x480), same panel as the
+# Waveshare 7.5" V2, driven by an integrated ESP32-S3 board
+waveshare_7_5_v2.extend(
+    "seeed-reterminal-e1001",
+    cs_pin=10,
+    dc_pin=11,
+    reset_pin=12,
+    busy_pin={
+        "number": 13,
+        "inverted": True,
+        "mode": {
+            "input": True,
+            "pullup": True,
+        },
+    },
+)

esphome/components/esp32/__init__.py

@@ -10,7 +10,6 @@ import subprocess
 from typing import Any
 
 from esphome import yaml_util
-from esphome.build_helpers.pch import PCH_PREFIX_HEADER, pch_enabled, pch_extra_scripts
 import esphome.codegen as cg
 from esphome.components.const import CONF_ENABLE_OTA_DOWNGRADE_PROTECTION
 from esphome.config_helpers import filter_source_files_from_defines
@@ -58,7 +57,6 @@ from esphome.coroutine import CoroPriority, coroutine_with_priority
 from esphome.espidf.component import generate_idf_components
 import esphome.final_validate as fv
 from esphome.helpers import copy_file_if_changed, rmtree, write_file_if_changed
-from esphome.platformio.toolchain import copy_pch_script
 from esphome.schema_extractors import SCHEMA_EXTRACT, schema_extractor
 from esphome.types import ConfigType
 from esphome.writer import clean_build, clean_cmake_cache
@@ -184,6 +182,13 @@ SIGNED_OTA_V1_ECDSA_VARIANTS = {
     VARIANT_ESP32,
 }
 
+# Variants that support execution from PSRAM
+PSRAM_XIP_VARIANTS = {
+    VARIANT_ESP32S3,
+    VARIANT_ESP32P4,
+    VARIANT_ESP32S31,
+}
+
 # NVS encryption (HMAC peripheral scheme) is only available on variants that
 # expose the HMAC peripheral (SOC_HMAC_SUPPORTED in soc_caps.h). The original
 # ESP32 and ESP32-C2 do not have it. New variants with an HMAC peripheral
@@ -216,11 +221,13 @@ COMPILER_OPTIMIZATIONS = {
 # builds that need them.
 DEFAULT_EXCLUDED_IDF_COMPONENTS = (
     "app_trace",  # CPU trace/SystemView support - unused by ESPHome
+    "bt",  # Bluetooth stack - re-included by request_bluetooth(); its REQUIRES pulls the WiFi stack back
     "cmock",  # Unit testing mock framework - ESPHome doesn't use IDF's testing
     "console",  # Console REPL - unused by ESPHome; espressif/mdns pulls it back when configured
     "driver",  # Legacy driver shim - only needed by esp32_touch, esp32_can for legacy headers
     "esp-tls",  # TLS wrapper - re-included by http_request, mqtt, web_server_idf
     "esp_adc",  # ADC driver - only needed by adc component
+    "esp_coex",  # WiFi/BT coexistence - re-included by esp32_ble_tracker, zigbee; esp_wifi/bt pull it back
     "esp_driver_cam",  # Camera driver - the esp32-camera managed component pulls it back
     "esp_driver_dac",  # DAC driver - only needed by esp32_dac component
     "esp_driver_gptimer",  # General purpose timer - re-included by ac_dimmer, opentherm, Arduino BLE libs
@@ -238,6 +245,7 @@ DEFAULT_EXCLUDED_IDF_COMPONENTS = (
     "esp_driver_twai",  # TWAI/CAN driver - only needed by esp32_can component
     "esp_eth",  # Ethernet driver - only needed by ethernet component
     "esp_gdbstub",  # GDB stub panic handler - unused by ESPHome; bt pulls it back
+    "esp_hal_ieee802154",  # 802.15.4 HAL - ieee802154 pulls it back
     "esp_hid",  # HID host/device support - ESPHome doesn't implement HID functionality
     "esp_http_client",  # HTTP client - only needed by http_request component
     "esp_http_server",  # HTTP server - re-included by web_server_idf, esp32_camera_web_server
@@ -245,8 +253,11 @@ DEFAULT_EXCLUDED_IDF_COMPONENTS = (
     "esp_https_server",  # HTTPS server - ESPHome has its own web server
     "esp_lcd",  # LCD controller drivers - only needed by display component
     "esp_local_ctrl",  # Local control over HTTPS/BLE - ESPHome has native API
+    "esp_phy",  # RF PHY - re-included by internal_temperature on the original ESP32; esp_wifi/bt/ieee802154 pull it back
+    "esp_wifi",  # WiFi stack - re-included by request_wifi(), espnow; bt pulls it back for BLE builds
     "espcoredump",  # Core dump support - ESPHome has its own debug component
     "fatfs",  # FAT filesystem - ESPHome doesn't use filesystem storage
+    "ieee802154",  # 802.15.4 radio - IDF openthread and the Zigbee libs pull it back
     "json",  # cJSON library - ESPHome uses ArduinoJson instead
     "mqtt",  # ESP-IDF MQTT library - ESPHome has its own MQTT implementation
     "nvs_sec_provider",  # NVS encryption key provider - re-included when CONFIG_NVS_ENCRYPTION is set
@@ -262,6 +273,7 @@ DEFAULT_EXCLUDED_IDF_COMPONENTS = (
     "unity",  # Unit testing framework - ESPHome doesn't use IDF's testing
     "wear_levelling",  # Flash wear levelling for fatfs - unused since fatfs unused
     "wifi_provisioning",  # WiFi provisioning - ESPHome uses its own improv implementation
+    "wpa_supplicant",  # WPA supplicant - re-included by request_wifi() for esp_eap_client.h
 )
 
 # Additional IDF managed components to exclude for Arduino framework builds
@@ -711,6 +723,9 @@ def request_wifi(ap: bool = False) -> None:
     net.wifi = True
     if ap:
         net.wifi_ap = True
+    include_builtin_idf_component("esp_wifi")
+    # wifi_component.cpp includes esp_eap_client.h/esp_wpa2.h
+    include_builtin_idf_component("wpa_supplicant")
 
 
 def request_ethernet() -> None:
@@ -722,11 +737,14 @@ def request_bluetooth() -> None:
     """Request the Bluetooth controller."""
     net = _network_sdkconfig()
     net.bluetooth = True
+    include_builtin_idf_component("bt")
 
 
 def request_software_coexistence() -> None:
     """Request WiFi/BT software coexistence (only valid alongside WiFi)."""
     _network_sdkconfig().software_coexistence = True
+    # Callers include esp_coexist.h directly.
+    include_builtin_idf_component("esp_coex")
 
 
 def add_idf_component(
@@ -1512,7 +1530,7 @@ def final_validate(config) -> None:
             )
         )
     if advanced[CONF_EXECUTE_FROM_PSRAM]:
-        if config[CONF_VARIANT] not in {VARIANT_ESP32S3, VARIANT_ESP32P4}:
+        if config[CONF_VARIANT] not in PSRAM_XIP_VARIANTS:
             errs.append(
                 cv.Invalid(
                     f"'{CONF_EXECUTE_FROM_PSRAM}' is not available on this esp32 variant",
@@ -2306,6 +2324,8 @@ async def _reconcile_network_sdkconfig() -> None:
 
     # WiFi stack: disable only when Ethernet is present and WiFi is not. WiFi
     # relies on the IDF default (enabled), so it is never written True here.
+    # esp_wifi is excluded by default on IDF, so this only matters for Arduino
+    # or when bt pulls it back.
     wifi_disabled = net.ethernet and not net.wifi
     if wifi_disabled:
         set_idf_sdkconfig_default("CONFIG_ESP_WIFI_ENABLED", False)
@@ -2435,11 +2455,6 @@ async def to_code(config):
 
         cg.add_platformio_option("lib_ldf_mode", "off")
         cg.add_platformio_option("lib_compat_mode", "strict")
-        # CI-speed only: this toolchain is being dropped, so the pch gets
-        # the same curated prefix as host with no further investment
-        cg.add_platformio_option("extra_scripts", pch_extra_scripts())
-        if pch_enabled():
-            cg.add_platformio_option("build_src_flags", f"-include {PCH_PREFIX_HEADER}")
         cg.add_platformio_option("platform", conf[CONF_PLATFORM_VERSION])
         cg.add_platformio_option("board", config[CONF_BOARD])
         cg.add_platformio_option("board_upload.flash_size", config[CONF_FLASH_SIZE])
@@ -2719,13 +2734,7 @@ async def to_code(config):
     _configure_lwip_max_sockets(conf)
 
     if advanced[CONF_EXECUTE_FROM_PSRAM]:
-        if variant == VARIANT_ESP32S3:
-            add_idf_sdkconfig_option("CONFIG_SPIRAM_FETCH_INSTRUCTIONS", True)
-            add_idf_sdkconfig_option("CONFIG_SPIRAM_RODATA", True)
-        elif variant == VARIANT_ESP32P4:
-            add_idf_sdkconfig_option("CONFIG_SPIRAM_XIP_FROM_PSRAM", True)
-        else:
-            raise ValueError("Unhandled ESP32 variant")
+        add_idf_sdkconfig_option("CONFIG_SPIRAM_XIP_FROM_PSRAM", True)
 
     # Apply LWIP core locking for better socket performance
     # This is already enabled by default in Arduino framework, where it provides
@@ -3241,7 +3250,13 @@ def _write_sdkconfig():
     if write_file_if_changed(internal_path, contents):
         # internal changed, update real one
         write_file_if_changed(sdk_path, contents)
-        clean_build(clear_pio_cache=False)
+        if not CORE.using_toolchain_esp_idf:
+            # PIO's dependency tracking under-declares sdkconfig inputs
+            # (ldgen, linker scripts); without a clean the image can be
+            # unbootable (esphome#15336). The esp-idf toolchain tracks
+            # sdkconfig via IDF's cmake and has_outdated_files(), so a
+            # reconfigure suffices there; everything else fails safe.
+            clean_build(clear_pio_cache=False)
 
 
 def _write_idf_component_yml():
@@ -3357,8 +3372,6 @@ def _write_idf_component_yml():
 def copy_files():
     _write_sdkconfig()
     _write_idf_component_yml()
-    if not CORE.using_toolchain_esp_idf:
-        copy_pch_script()
 
     if "partitions.csv" not in CORE.data[KEY_ESP32][KEY_EXTRA_BUILD_FILES]:
         flash_size = CORE.data[KEY_ESP32][KEY_FLASH_SIZE]

esphome/components/esp32/gpio_esp32_s31.py

@@ -5,11 +5,14 @@ import esphome.config_validation as cv
 from esphome.const import CONF_INPUT, CONF_MODE, CONF_NUMBER, CONF_SCL, CONF_SDA
 from esphome.pins import check_strapping_pin
 
-# Per the ESP32-S31 datasheet (page 96):
+# Per the ESP32-S31 IDF DOCS and datasheet:
+# https://docs.espressif.com/projects/esp-idf/en/v6.1/esp32s31/api-reference/peripherals/gpio.html
 # https://documentation.espressif.com/esp32-s31_datasheet_en.pdf
-_ESP32S31_SPI_FLASH_PINS: set[int] = {27, 28, 29, 31, 32, 33}
-# GPIO60/GPIO61 set the boot mode; GPIO37 selects the JTAG signal source.
-_ESP32S31_STRAPPING_PINS: set[int] = {37, 60, 61}
+_ESP32S31_SPI_FLASH_PINS: set[int] = {26, 27, 28, 30, 31, 32}
+_ESP32S31_INVALID_PINS: set[int] = {29, 41}
+# GPIO60/GPIO61 set the boot mode; GPIO37 selects the JTAG signal source;
+# GPIO36 sets the VDD_SPI voltage.
+_ESP32S31_STRAPPING_PINS: set[int] = {36, 37, 60, 61}
 # LP I2C is fixed to GPIO6 (SCL) / GPIO7 (SDA) per the datasheet IO MUX table.
 _ESP32S31_I2C_LP_PINS = {"SDA": 7, "SCL": 6}
 
@@ -19,6 +22,8 @@ _LOGGER = logging.getLogger(__name__)
 def esp32_s31_validate_gpio_pin(value: int) -> int:
     if value < 0 or value > 61:
         raise cv.Invalid(f"Invalid pin number: {value} (must be 0-61)")
+    if value in _ESP32S31_INVALID_PINS:
+        raise cv.Invalid(f"GPIO{value} does not exist on ESP32-S31.")
     if value in _ESP32S31_SPI_FLASH_PINS:
         raise cv.Invalid(
             f"GPIO{value} is reserved for the SPI flash interface on ESP32-S31 and cannot be used."
@@ -33,6 +38,10 @@ def esp32_s31_validate_supports(value: dict[str, Any]) -> dict[str, Any]:
 
     if num < 0 or num > 61:
         raise cv.Invalid(f"Invalid pin number: {num} (must be 0-61)")
+    # Checked here as well so ignore_pin_validation_error cannot bypass it;
+    # these pins are not bonded and can never work
+    if num in _ESP32S31_INVALID_PINS:
+        raise cv.Invalid(f"GPIO{num} does not exist on ESP32-S31.")
     if is_input:
         # All ESP32 pins support input mode
         pass

esphome/components/esp32_camera_web_server/camera_web_server.cpp

@@ -210,8 +210,9 @@ esp_err_t CameraWebServer::streaming_handler_(struct httpd_req *req) {
     if (!image) {
       // A shutdown is not a lost frame: wait_for_image_() returns empty as soon
       // as running_ clears, and the loop condition below ends the stream anyway.
-      if (this->running_)
+      if (this->running_) {
         ESP_LOGW(TAG, "STREAM: failed to acquire frame");
+      }
       res = ESP_FAIL;
     }
     if (res == ESP_OK) {

esphome/components/esp8266/__init__.py

@@ -3,10 +3,8 @@ from pathlib import Path
 import platform
 import re
 import subprocess
-import time
 from typing import Any
 
-from esphome.build_helpers.pch import pch_extra_scripts
 import esphome.codegen as cg
 import esphome.config_validation as cv
 from esphome.const import (
@@ -16,7 +14,6 @@ from esphome.const import (
     CONF_FRAMEWORK,
     CONF_PLATFORM_VERSION,
     CONF_SOURCE,
-    CONF_TOOLCHAIN,
     CONF_VERSION,
     KEY_CORE,
     KEY_FRAMEWORK_VERSION,
@@ -24,7 +21,6 @@ from esphome.const import (
     KEY_TARGET_PLATFORM,
     PLATFORM_ESP8266,
     ThreadModel,
-    Toolchain,
 )
 from esphome.core import (
     CORE,
@@ -35,13 +31,12 @@ from esphome.core import (
 )
 from esphome.core.config import BOARD_MAX_LENGTH
 from esphome.helpers import IS_MACOS, copy_file_if_changed
-from esphome.platformio.toolchain import copy_ccache_script, copy_pch_script
+from esphome.platformio.toolchain import copy_ccache_script
 from esphome.storage_json import StorageJSON
 from esphome.types import ConfigType
 
-from .boards import BOARDS, ESP8266_BOARD_BUILD, ESP8266_LD_SCRIPTS, board_ld_script
+from .boards import BOARDS, ESP8266_LD_SCRIPTS, board_ld_script
 from .const import (
-    BUILD_FLASH_MODES,
     CONF_EARLY_PIN_INIT,
     CONF_ENABLE_SERIAL,
     CONF_ENABLE_SERIAL1,
@@ -51,7 +46,6 @@ from .const import (
     KEY_FLASH_SIZE,
     KEY_LDSCRIPT,
     KEY_PIN_INITIAL_STATES,
-    KEY_SCANF_FLOAT,
     KEY_SERIAL1_REQUIRED,
     KEY_SERIAL_REQUIRED,
     KEY_WAVEFORM_REQUIRED,
@@ -111,53 +105,6 @@ def set_core_data(config: ConfigType) -> ConfigType:
     return config
 
 
-_TOOLCHAINS = (Toolchain.PLATFORMIO, Toolchain.ARDUINO)
-_validate_toolchain = cv.toolchain_enum(_TOOLCHAINS)
-_resolve_toolchain = cv.resolve_toolchain("ESP8266", _TOOLCHAINS, Toolchain.PLATFORMIO)
-
-
-def _validate_native_toolchain(config: ConfigType) -> ConfigType:
-    """Constraints of the native (non-PlatformIO) Arduino toolchain."""
-    if not CORE.using_toolchain_arduino:
-        return config
-    from esphome.arduino8266.framework import MIN_FRAMEWORK_VERSION
-
-    conf = config[CONF_FRAMEWORK]
-    version = cv.Version.parse(conf[CONF_VERSION])
-    if version < MIN_FRAMEWORK_VERSION:
-        raise cv.Invalid(
-            "'toolchain: arduino' requires framework version "
-            f"{MIN_FRAMEWORK_VERSION} or newer"
-        )
-    # platform_version is a PlatformIO concept; drop it (as esp32's native
-    # toolchain does), warning when a custom pin is discarded. The floor
-    # above guarantees the schema-derived default is the ARDUINO_4 spec.
-    if (
-        conf.pop(CONF_PLATFORM_VERSION, _ARDUINO_4_PLATFORM_SPEC)
-        != _ARDUINO_4_PLATFORM_SPEC
-    ):
-        _LOGGER.warning(
-            "'platform_version' is ignored by 'toolchain: arduino'; the native "
-            "toolchain downloads the framework and compiler directly"
-        )
-    if conf[CONF_SOURCE] != _format_framework_arduino_version(version):
-        raise cv.Invalid(
-            "'toolchain: arduino' does not support a custom framework source; "
-            "use 'toolchain: platformio'"
-        )
-    # BOARDS is a subset of ESP8266_BOARD_BUILD today; the second clause is
-    # a drift guard for the independently regenerated tables
-    if (
-        config[CONF_BOARD] not in BOARDS
-        or config[CONF_BOARD] not in ESP8266_BOARD_BUILD
-    ):
-        raise cv.Invalid(
-            f"Board '{config[CONF_BOARD]}' is not supported by "
-            "'toolchain: arduino'; use 'toolchain: platformio'"
-        )
-    return config
-
-
 def get_download_types(storage_json: StorageJSON) -> list[dict[str, str]]:
     """Binary-download entries for a built ESP8266 firmware.
 
@@ -191,7 +138,7 @@ def _format_framework_arduino_version(ver: cv.Version) -> str:
     if ver <= cv.Version(2, 6, 2):
         return f"~2.{ver.major}{ver.minor:02d}{ver.patch:02d}.0"
     # Same encoding the native toolchain uses for its package download, so a
-    # custom-source check against this value cannot drift from what it fetches.
+    # version bump cannot drift between the two paths.
     from esphome.arduino8266.framework import framework_package_version
 
     try:
@@ -247,7 +194,7 @@ def _arduino_check_versions(value: ConfigType) -> ConfigType:
     platform_version = value.get(CONF_PLATFORM_VERSION)
     if platform_version is None:
         if version >= cv.Version(3, 1, 0):
-            platform_version = _ARDUINO_4_PLATFORM_SPEC
+            platform_version = _parse_platform_version(str(ARDUINO_4_PLATFORM_VERSION))
         elif version >= cv.Version(3, 0, 0):
             platform_version = _parse_platform_version(str(ARDUINO_3_PLATFORM_VERSION))
         elif version >= cv.Version(2, 5, 0):
@@ -274,10 +221,6 @@ def _parse_platform_version(value: Any) -> str:
         return value
 
 
-# The platform_version derived for every core >= 3.1.0 config
-_ARDUINO_4_PLATFORM_SPEC = _parse_platform_version(str(ARDUINO_4_PLATFORM_VERSION))
-
-
 ARDUINO_FRAMEWORK_SCHEMA = cv.All(
     cv.Schema(
         {
@@ -294,6 +237,7 @@ ARDUINO_FRAMEWORK_SCHEMA = cv.All(
 )
 
 
+BUILD_FLASH_MODES = ["qio", "qout", "dio", "dout"]
 CONFIG_SCHEMA = cv.All(
     cv.Schema(
         {
@@ -310,30 +254,15 @@ CONFIG_SCHEMA = cv.All(
             cv.Optional(CONF_ENABLE_SERIAL1): cv.boolean,
             cv.Optional(CONF_ENABLE_FULL_PRINTF, default=False): cv.boolean,
             cv.Optional(CONF_ENABLE_SCANF_FLOAT): cv.boolean,
-            cv.Optional(
-                CONF_TOOLCHAIN, visibility=cv.Visibility.ADVANCED
-            ): _validate_toolchain,
         }
     ),
-    _resolve_toolchain,
-    _validate_native_toolchain,
+    # Until the native toolchain lands, PlatformIO is the only backend;
+    # reject a --toolchain this platform cannot serve yet.
+    cv.require_platformio_toolchain("ESP8266"),
     set_core_data,
 )
 
 
-def native_toolchain_module():
-    """The native build backend for the resolved toolchain, if any.
-
-    ``__main__`` dispatches from its own toolchain-keyed table; this helper
-    serves the component's internal callers.
-    """
-    if not CORE.using_toolchain_arduino:
-        return None
-    from esphome.arduino8266 import toolchain
-
-    return toolchain
-
-
 def check_rosetta() -> None:
     """Fail fast when the x86_64 ESP8266 toolchain cannot run on this Mac.
 
@@ -387,13 +316,12 @@ def _choose_ld_script(board: str, ver: cv.Version) -> str | None:
 
 @coroutine_with_priority(CoroPriority.PLATFORM)
 async def to_code(config: ConfigType) -> None:
-    use_platformio = CORE.using_toolchain_platformio
     cg.add(esp8266_ns.setup_preferences())
 
-    if use_platformio:
-        cg.add_platformio_option("lib_ldf_mode", "off")
-        cg.add_platformio_option("lib_compat_mode", "strict")
-        cg.add_platformio_option("board", config[CONF_BOARD])
+    cg.add_platformio_option("lib_ldf_mode", "off")
+    cg.add_platformio_option("lib_compat_mode", "strict")
+
+    cg.add_platformio_option("board", config[CONF_BOARD])
     cg.add_build_flag("-DUSE_ESP8266")
     cg.set_cpp_standard("gnu++20")
     cg.add_define("ESPHOME_BOARD", config[CONF_BOARD])
@@ -409,33 +337,28 @@ async def to_code(config: ConfigType) -> None:
             "enabling scanf float support (~8KB flash)"
         )
 
-    # The native generator reads the same decision (KEY_SCANF_FLOAT)
-    CORE.data[KEY_ESP8266][KEY_SCANF_FLOAT] = bool(enable_scanf_float)
-    if use_platformio:
-        extra_scripts = [
-            "pre:ccache.py",
-            "pre:testing_mode.py",
-            "pre:exclude_updater.py",
-            "pre:exclude_waveform.py",
-            "pre:relocate_ratetable.py",
-        ]
-        if not enable_scanf_float:
-            extra_scripts.append("pre:remove_float_scanf.py")
-        extra_scripts.extend(pch_extra_scripts())
-        extra_scripts.append("post:post_build.py")
-        cg.add_platformio_option("extra_scripts", extra_scripts)
+    extra_scripts = [
+        "pre:ccache.py",
+        "pre:testing_mode.py",
+        "pre:exclude_updater.py",
+        "pre:exclude_waveform.py",
+        "pre:relocate_ratetable.py",
+    ]
+    if not enable_scanf_float:
+        extra_scripts.append("pre:remove_float_scanf.py")
+    extra_scripts.append("post:post_build.py")
+    cg.add_platformio_option("extra_scripts", extra_scripts)
 
     conf = config[CONF_FRAMEWORK]
+    cg.add_platformio_option("framework", "arduino")
     cg.add_build_flag("-DUSE_ARDUINO")
     cg.add_build_flag("-DUSE_ESP8266_FRAMEWORK_ARDUINO")
     cg.add_build_flag("-Wno-nonnull-compare")
-    if use_platformio:
-        cg.add_platformio_option("framework", "arduino")
-        cg.add_platformio_option("platform", conf[CONF_PLATFORM_VERSION])
-        cg.add_platformio_option(
-            "platform_packages",
-            [f"platformio/framework-arduinoespressif8266@{conf[CONF_SOURCE]}"],
-        )
+    cg.add_platformio_option("platform", conf[CONF_PLATFORM_VERSION])
+    cg.add_platformio_option(
+        "platform_packages",
+        [f"platformio/framework-arduinoespressif8266@{conf[CONF_SOURCE]}"],
+    )
 
     # Default for platformio is LWIP2_LOW_MEMORY with:
     #  - MSS=536
@@ -473,8 +396,7 @@ async def to_code(config: ConfigType) -> None:
     # Force-include inline std::__throw_* overrides so GCC dead-strips the unused
     # libstdc++ error message strings (e.g. "basic_string::_M_create") from DRAM.
     # See throw_stubs.h for details. Must be prepended before <string>, so this
-    # uses build_src_flags with -include. Unconditional: the native build
-    # generator reads the same option, keeping one source of truth.
+    # uses build_src_flags with -include.
     cg.add_platformio_option(
         "build_src_flags", "-include esphome/components/esp8266/throw_stubs.h"
     )
@@ -504,8 +426,6 @@ async def to_code(config: ConfigType) -> None:
     # implementation in the Arduino ESP8266 core.
     cg.add_build_flag("-Wl,--wrap=millis")
 
-    # Unconditional: the native build generator reads the same option,
-    # keeping one source of truth
     cg.add_platformio_option("board_build.flash_mode", config[CONF_BOARD_FLASH_MODE])
 
     ver: cv.Version = CORE.data[KEY_CORE][KEY_FRAMEWORK_VERSION]
@@ -514,7 +434,7 @@ async def to_code(config: ConfigType) -> None:
         cg.RawExpression(f"VERSION_CODE({ver.major}, {ver.minor}, {ver.patch})"),
     )
 
-    if use_platformio and config[CONF_BOARD] in BOARDS:
+    if config[CONF_BOARD] in BOARDS:
         ld_script = _choose_ld_script(config[CONF_BOARD], ver)
 
         if ld_script is not None:
@@ -556,24 +476,8 @@ async def finalize_serial_config() -> None:
         cg.add_build_flag("-DNO_GLOBAL_SERIAL1")
 
 
-# Called by __main__.compile_program; returning False falls through to the
-# PlatformIO toolchain.
-def run_compile(args, config: ConfigType) -> bool:
-    # Positive check: the native backend only runs when explicitly resolved
-    toolchain = native_toolchain_module()
-    if toolchain is None:
-        return False
-    if toolchain.run_compile(config, CORE.verbose) != 0:
-        raise EsphomeError("ESP8266 native build failed")
-    return True
-
-
 # Called by writer.py
 def copy_files() -> None:
-    # Native builds skip the PlatformIO extra scripts; the build generator
-    # carries their logic
-    if CORE.using_toolchain_arduino:
-        return
     dir = Path(__file__).parent
     for script in (
         "post_build",
@@ -588,7 +492,6 @@ def copy_files() -> None:
             CORE.relative_build_path(f"{script}.py"),
         )
     copy_ccache_script()
-    copy_pch_script()
 
 
 # ESP logs stack trace decoder, based on https://github.com/me-no-dev/EspExceptionDecoder
@@ -631,75 +534,22 @@ ESP8266_EXCEPTION_CODES = {
 }
 
 
-_DECODE_WARNED_AT: dict[str, float] = {}
+def _decode_pc(config: ConfigType, addr: str) -> None:
+    from esphome.platformio import toolchain
 
-
-def _warn_decode_problem(key: str, message: str, *args) -> bool:
-    """Warn, deduplicated briefly so a burst of stack-dump addresses warns
-    once but a later dump warns again; returns whether it warned so the
-    caller can mark suppressed addresses individually."""
-    now = time.monotonic()
-    last = _DECODE_WARNED_AT.get(key)
-    if last is not None and now - last < 30:
-        return False
-    _DECODE_WARNED_AT[key] = now
-    _LOGGER.warning(message, *args)
-    return True
-
-
-def _decode_pc(config: ConfigType, addr: str, *, bulk: bool = False) -> None:
-    """Decode one crash address. ``bulk``: the caller is scanning every
-    8-hex stack word, most of which are not code addresses -- unmappable
-    ones log at debug so real frames are not buried."""
-    if (native_toolchain := native_toolchain_module()) is not None:
-        addr2line = native_toolchain.get_addr2line_path()
-        elf = native_toolchain.get_elf_path()
-        for path in (addr2line, elf):
-            if not path.is_file():
-                _warn_decode_problem(
-                    str(path), "Cannot decode crash addresses: %s missing", path
-                )
-                # The detailed warning names no address; mark named
-                # registers, but bulk stack words at debug (~150 per dump)
-                log = _LOGGER.debug if bulk else _LOGGER.warning
-                log("Not decoded %s (toolchain file missing)", addr)
-                return
-        addr2line, elf = str(addr2line), str(elf)
-    else:
-        from esphome.platformio import toolchain
-
-        idedata = toolchain.get_idedata(config)
-        if not idedata.addr2line_path or not idedata.firmware_elf_path:
-            _warn_decode_problem(
-                "no-addr2line",
-                "Cannot decode crash addresses: no addr2line or ELF in idedata",
-            )
-            log = _LOGGER.debug if bulk else _LOGGER.warning
-            log("Not decoded %s (no addr2line or ELF)", addr)
-            return
-        addr2line, elf = idedata.addr2line_path, idedata.firmware_elf_path
-    command = [addr2line, "-pfiaC", "-e", elf, addr]
+    idedata = toolchain.get_idedata(config)
+    if not idedata.addr2line_path or not idedata.firmware_elf_path:
+        _LOGGER.debug("decode_pc no addr2line")
+        return
+    command = [idedata.addr2line_path, "-pfiaC", "-e", idedata.firmware_elf_path, addr]
     try:
         translation = subprocess.check_output(command, close_fds=False).decode().strip()
-    except Exception as err:  # noqa: BLE001  # pylint: disable=broad-except
-        # Warn, not debug: a failing addr2line must be visible. The warning
-        # is rate-limited across a dump, so mark every undecoded address
-        # inline or the rest read as merely unmappable
-        if not _warn_decode_problem(
-            "addr2line-failed", "Could not decode crash address %s (%s)", addr, err
-        ):
-            # The detailed warning already named this address; mark only
-            # the rate-limited ones, and bulk stack words at debug
-            log = _LOGGER.debug if bulk else _LOGGER.warning
-            log("Not decoded %s (addr2line failed)", addr)
+    except Exception:  # noqa: BLE001  # pylint: disable=broad-except
         _LOGGER.debug("Caught exception for command %s", command, exc_info=1)
         return
 
     if "?? ??:0" in translation:
-        # A named register that fails to decode is confusing silence; a
-        # bulk stack word failing is the expected common case
-        log = _LOGGER.debug if bulk else _LOGGER.warning
-        log("Not decoded %s (address not in %s)", addr, elf)
+        # Nothing useful
         return
     translation = translation.replace(" at ??:?", "").replace(":?", "")
     _LOGGER.warning("Decoded %s", translation)
@@ -769,6 +619,6 @@ def process_stacktrace(config: ConfigType, line: str, backtrace_state: bool) ->
 
     if backtrace_state:
         for addr in re.finditer(STACKTRACE_ESP8266_BACKTRACE_PC_RE, line):
-            _decode_pc(config, addr.group(), bulk=True)
+            _decode_pc(config, addr.group())
 
     return backtrace_state

esphome/components/esp8266/const.py

@@ -16,6 +16,7 @@ KEY_WAVEFORM_REQUIRED = "waveform_required"
 KEY_SERIAL_REQUIRED = "serial_required"
 KEY_SERIAL1_REQUIRED = "serial1_required"
 # Set for the native (non-PlatformIO) toolchain's build generator
+KEY_FLASH_MODE = "flash_mode"
 KEY_SCANF_FLOAT = "scanf_float"
 # Per-board flash-layout override consumed by board_ld_script()
 KEY_LDSCRIPT = "ldscript"
@@ -72,6 +73,3 @@ def enable_serial1() -> None:
             enable_serial1()
     """
     CORE.data.setdefault(KEY_ESP8266, {})[KEY_SERIAL1_REQUIRED] = True
-
-
-BUILD_FLASH_MODES = ("qio", "qout", "dio", "dout")

esphome/components/esphome/ota/__init__.py

@@ -1,12 +1,20 @@
 import logging
 
 import esphome.codegen as cg
+from esphome.components.noise import (
+    decode_encryption_key,
+    encryption_schema,
+    is_reserved_key,
+)
 from esphome.components.ota import BASE_OTA_SCHEMA, OTAComponent, ota_to_code
 from esphome.config_helpers import merge_config
 import esphome.config_validation as cv
 from esphome.const import (
+    CONF_API,
+    CONF_ENCRYPTION,
     CONF_ESPHOME,
     CONF_ID,
+    CONF_KEY,
     CONF_NUM_ATTEMPTS,
     CONF_OTA,
     CONF_PASSWORD,
@@ -15,6 +23,7 @@ from esphome.const import (
     CONF_REBOOT_TIMEOUT,
     CONF_SAFE_MODE,
     CONF_VERSION,
+    CONF_WEB_SERVER,
 )
 from esphome.core import CORE, coroutine_with_priority
 from esphome.coroutine import CoroPriority
@@ -22,6 +31,7 @@ import esphome.final_validate as fv
 from esphome.types import ConfigType
 
 CONF_ALLOW_PARTITION_ACCESS = "allow_partition_access"
+CONF_CAPTIVE_PORTAL = "captive_portal"
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -30,7 +40,15 @@ CODEOWNERS = ["@esphome/core"]
 DEPENDENCIES = ["network"]
 
 
-AUTO_LOAD = ["sha256", "socket"]
+def AUTO_LOAD(config: ConfigType) -> list[str]:
+    """Auto-load noise only when encryption is configured."""
+    base = ["sha256", "socket"]
+    # A falsy config is a tooling probe for the maximal set (None from
+    # dependency resolution, {} from the components-graph platform probe);
+    # a validated config always carries defaults, never empty
+    if not config or CONF_ENCRYPTION in config:
+        return base + ["noise"]
+    return base
 
 
 esphome = cg.esphome_ns.namespace("esphome")
@@ -67,11 +85,24 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
                     CONF_PASSWORD in merged_ota_esphome_configs_by_port[conf_port]
                     and CONF_PASSWORD in ota_conf
                     and merged_ota_esphome_configs_by_port[conf_port][CONF_PASSWORD]
-                    != ota_conf.get(CONF_PASSWORD)
+                    != ota_conf[CONF_PASSWORD]
                 ):
                     raise cv.Invalid(
                         f"Found multiple configurations but {CONF_PASSWORD} is inconsistent"
                     )
+                # Encryption blocks conflict only when both pin a key; a bare
+                # `encryption:` (a package/device split) is compatible with a
+                # keyed one, and merge_config yields the keyed result
+                merged_key = (
+                    merged_ota_esphome_configs_by_port[conf_port]
+                    .get(CONF_ENCRYPTION, {})
+                    .get(CONF_KEY)
+                )
+                other_key = ota_conf.get(CONF_ENCRYPTION, {}).get(CONF_KEY)
+                if merged_key and other_key and merged_key != other_key:
+                    raise cv.Invalid(
+                        f"Found multiple configurations but {CONF_ENCRYPTION} is inconsistent"
+                    )
 
                 ports_with_merged_configs.append(conf_port)
                 merged_ota_esphome_configs_by_port[conf_port] = merge_config(
@@ -94,6 +125,20 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
 
     new_ota_conf.extend(merged_ota_esphome_configs_by_port.values())
 
+    api_conf = full_conf.get(CONF_API) or {}
+    for ota_conf in merged_ota_esphome_configs_by_port.values():
+        # Merging same-port blocks can combine a password from one block with
+        # encryption from another; re-check the exclusion on the merged result.
+        _validate_no_password_with_encryption(ota_conf)
+        if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
+            _resolve_encryption_key(encryption_conf, api_conf)
+    if any(
+        conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf
+    ) and any(
+        CONF_ENCRYPTION in conf for conf in merged_ota_esphome_configs_by_port.values()
+    ):
+        _warn_web_server_ota(full_conf)
+
     full_conf[CONF_OTA] = new_ota_conf
     fv.full_config.set(full_conf)
 
@@ -107,6 +152,73 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
         )
 
 
+def _warn_web_server_ota(full_conf: ConfigType) -> None:
+    """The web_server ota platform accepts the same image over plaintext HTTP
+    with basic auth, bypassing the encryption; warn rather than fail so the
+    operator keeps the recovery path."""
+    if CONF_CAPTIVE_PORTAL in full_conf and CONF_WEB_SERVER not in full_conf:
+        # The captive_portal auto-load: the endpoint only exists while the
+        # fallback AP is active
+        _LOGGER.warning(
+            "OTA encryption does not cover the %s OTA platform (auto-loaded "
+            "by captive_portal); the plaintext /update endpoint stays "
+            "reachable while the fallback AP is active",
+            CONF_WEB_SERVER,
+        )
+    else:
+        _LOGGER.warning(
+            "OTA encryption does not cover the %s OTA platform; its "
+            "plaintext /update endpoint accepts the same image",
+            CONF_WEB_SERVER,
+        )
+
+
+def _resolve_encryption_key(encryption_conf: ConfigType, api_conf: ConfigType) -> None:
+    """Resolve the one encryption key per device into the ota block.
+
+    An explicit ota key must match the api key, a bare block inherits it,
+    a runtime provisioned api key cannot be inherited, and the all-zeros
+    provisioning sentinel is rejected (the device treats it as no key).
+    """
+    api_key = api_conf.get(CONF_ENCRYPTION, {}).get(CONF_KEY)
+    if ota_key := encryption_conf.get(CONF_KEY):
+        if api_key and ota_key != api_key:
+            raise cv.Invalid(
+                f"'{CONF_OTA}' {CONF_ENCRYPTION} {CONF_KEY} must match the "
+                f"'{CONF_API}' {CONF_ENCRYPTION} {CONF_KEY}; omit the "
+                f"'{CONF_OTA}' {CONF_KEY} to use the '{CONF_API}' one"
+            )
+    elif not api_key:
+        if CONF_ENCRYPTION in api_conf:
+            raise cv.Invalid(
+                f"the '{CONF_API}' {CONF_ENCRYPTION} {CONF_KEY} is provisioned at "
+                f"runtime and cannot be inherited at build time; set an explicit "
+                f"'{CONF_OTA}' {CONF_ENCRYPTION} {CONF_KEY}"
+            )
+        raise cv.Invalid(
+            f"'{CONF_OTA}' {CONF_ENCRYPTION} has no {CONF_KEY} and there is no "
+            f"'{CONF_API}' {CONF_ENCRYPTION} {CONF_KEY} to inherit; set one of them"
+        )
+    else:
+        encryption_conf[CONF_KEY] = api_key
+    if is_reserved_key(encryption_conf[CONF_KEY]):
+        raise cv.Invalid(
+            f"The all-zeros {CONF_KEY} is reserved and provides no protection; "
+            f"generate a real key with: openssl rand -base64 32"
+        )
+
+
+# Also called on merged same-port configs in final validate, where schemas
+# do not run
+def _validate_no_password_with_encryption(config: ConfigType) -> ConfigType:
+    if CONF_PASSWORD in config and CONF_ENCRYPTION in config:
+        raise cv.Invalid(
+            f"'{CONF_PASSWORD}' cannot be combined with '{CONF_ENCRYPTION}'; the "
+            f"encryption key already authenticates the uploader, remove '{CONF_PASSWORD}'"
+        )
+    return config
+
+
 def _consume_ota_sockets(config: ConfigType) -> ConfigType:
     """Register socket needs for OTA component."""
     from esphome.components import socket
@@ -134,6 +246,7 @@ CONFIG_SCHEMA = cv.All(
             ): cv.port,
             cv.Optional(CONF_ALLOW_PARTITION_ACCESS, default=False): cv.boolean,
             cv.Optional(CONF_PASSWORD): cv.sensitive(),
+            cv.Optional(CONF_ENCRYPTION): encryption_schema,
             cv.Optional(CONF_NUM_ATTEMPTS): cv.invalid(
                 f"'{CONF_SAFE_MODE}' (and its related configuration variables) has moved from 'ota' to its own component. See https://esphome.io/components/safe_mode"
             ),
@@ -147,12 +260,24 @@ CONFIG_SCHEMA = cv.All(
     )
     .extend(BASE_OTA_SCHEMA)
     .extend(cv.COMPONENT_SCHEMA),
+    _validate_no_password_with_encryption,
     _consume_ota_sockets,
 )
 
 FINAL_VALIDATE_SCHEMA = ota_esphome_final_validate
 
 
+def FILTER_SOURCE_FILES() -> list[str]:
+    """Filter out the noise transport when no ota entry configures encryption."""
+    for ota_conf in CORE.config.get(CONF_OTA, []):
+        if (
+            ota_conf.get(CONF_PLATFORM) == CONF_ESPHOME
+            and ota_conf.get(CONF_ENCRYPTION) is not None
+        ):
+            return []
+    return ["ota_esphome_noise.cpp"]
+
+
 @coroutine_with_priority(CoroPriority.OTA_UPDATES)
 async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
@@ -171,6 +296,12 @@ async def to_code(config: ConfigType) -> None:
     if config.get(CONF_ALLOW_PARTITION_ACCESS):
         cg.add_define("USE_OTA_PARTITIONS")
 
+    if (encryption_conf := config.get(CONF_ENCRYPTION)) is not None:
+        # A missing key was resolved from the api component in final validate.
+        key = encryption_conf[CONF_KEY]
+        cg.add_define("USE_OTA_ENCRYPTION")
+        cg.add(var.set_noise_psk(list(decode_encryption_key(key))))
+
     # Build flag so lwip_fast_select.c (a .c file that can't include defines.h) sees it.
     cg.add_build_flag("-DUSE_OTA_PLATFORM_ESPHOME")
 

esphome/components/esphome/ota/ota_esphome.cpp

@@ -27,7 +27,6 @@ namespace esphome {
 
 static const char *const TAG = "esphome.ota";
 static constexpr uint16_t OTA_BLOCK_SIZE = 8192;
-static constexpr size_t OTA_BUFFER_SIZE = 1024;                  // buffer size for OTA data transfer
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_HANDSHAKE = 20000;  // milliseconds for initial handshake
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 90000;       // milliseconds for data transfer
 
@@ -105,6 +104,11 @@ void ESPHomeOTAComponent::dump_config() {
     ESP_LOGCONFIG(TAG, "  Password configured");
   }
 #endif
+#ifdef USE_OTA_ENCRYPTION
+  if (this->noise_ctx_.has_psk()) {
+    ESP_LOGCONFIG(TAG, "  Encryption configured");
+  }
+#endif
 #ifdef USE_OTA_PARTITIONS
   ESP_LOGCONFIG(TAG,
                 "  Partition access allowed\n"
@@ -128,7 +132,8 @@ void ESPHomeOTAComponent::dump_config() {
   esp_partition_iterator_release(it);
   esp_bootloader_desc_t bootloader_desc;
   esp_err_t err = esp_ota_get_bootloader_description(nullptr, &bootloader_desc);
-  ESP_LOGCONFIG(TAG, "  Bootloader: ESP-IDF %s", (err == ESP_OK) ? bootloader_desc.idf_ver : "version unknown");
+  ESP_LOGCONFIG(TAG, "  Bootloader: ESP-IDF %s",
+                (err == ESP_OK) ? bootloader_desc.idf_ver : LOG_STR_LITERAL("version unknown"));
 #endif  // USE_ESP32
 #endif  // USE_OTA_PARTITIONS
 }
@@ -148,8 +153,10 @@ void ESPHomeOTAComponent::loop() {
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04;
+static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_NOISE = 0x08;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02;
+static constexpr uint8_t SERVER_FEATURE_SUPPORTS_NOISE = 0x04;
 
 void ESPHomeOTAComponent::handle_handshake_() {
   /// Handle the OTA handshake and authentication.
@@ -201,8 +208,7 @@ void ESPHomeOTAComponent::handle_handshake_() {
       }
 
       // Validate magic bytes
-      static const uint8_t MAGIC_BYTES[5] = {0x6C, 0x26, 0xF7, 0x5C, 0x45};
-      if (memcmp(this->handshake_buf_, MAGIC_BYTES, 5) != 0) {
+      if (memcmp(this->handshake_buf_, MAGIC_BYTES, sizeof(MAGIC_BYTES)) != 0) {
         ESP_LOGW(TAG, "Magic bytes mismatch! 0x%02X-0x%02X-0x%02X-0x%02X-0x%02X", this->handshake_buf_[0],
                  this->handshake_buf_[1], this->handshake_buf_[2], this->handshake_buf_[3], this->handshake_buf_[4]);
         this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_MAGIC);
@@ -234,6 +240,19 @@ void ESPHomeOTAComponent::handle_handshake_() {
       }
       this->ota_features_ = this->handshake_buf_[0];
       ESP_LOGV(TAG, "Features: 0x%02X", this->ota_features_);
+
+#ifdef USE_OTA_ENCRYPTION
+      // Fail closed: with a PSK configured the client must negotiate encryption
+      // (which requires the extended protocol); refuse plaintext uploads.
+      static constexpr uint8_t NOISE_REQUIRED_FEATURES =
+          CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
+      if (this->noise_ctx_.has_psk() && (this->ota_features_ & NOISE_REQUIRED_FEATURES) != NOISE_REQUIRED_FEATURES) {
+        ESP_LOGW(TAG, "Client does not support encryption");
+        this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_ENCRYPTION_REQUIRED);
+        return;
+      }
+#endif
+
       this->transition_ota_state_(OTAState::FEATURE_ACK);
 
       const bool supports_compression =
@@ -249,6 +268,11 @@ void ESPHomeOTAComponent::handle_handshake_() {
         this->handshake_buf_[1] = (supports_compression ? SERVER_FEATURE_SUPPORTS_COMPRESSION : 0);
 #ifdef USE_OTA_PARTITIONS
         this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS;
+#endif
+#ifdef USE_OTA_ENCRYPTION
+        if (this->noise_ctx_.has_psk()) {
+          this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
+        }
 #endif
       } else {
         this->handshake_buf_[0] =
@@ -264,6 +288,20 @@ void ESPHomeOTAComponent::handle_handshake_() {
       if (!this->try_write_(ack_size, LOG_STR("ack feature"))) {
         return;
       }
+#ifdef USE_OTA_ENCRYPTION
+      // With a PSK configured the rest of the session runs inside the noise
+      // transport; the client sends the first handshake frame next, so there
+      // is nothing to do until data arrives.
+      if (this->noise_ctx_.has_psk()) {
+        // handshake_buf_ still holds the feature ack composed above; a
+        // would-block re-entry lands here without rebuilding it
+        if (!this->noise_start_session_(this->handshake_buf_[1])) {
+          return;
+        }
+        this->transition_ota_state_(OTAState::NOISE_HANDSHAKE);
+        return;
+      }
+#endif
 #ifdef USE_OTA_PASSWORD
       // If password is set, move to auth phase
       if (!this->password_.empty()) {
@@ -301,6 +339,16 @@ void ESPHomeOTAComponent::handle_handshake_() {
       this->handle_data_();
       return;
 
+#ifdef USE_OTA_ENCRYPTION
+    case OTAState::NOISE_HANDSHAKE:
+      if (!this->handle_noise_handshake_()) {
+        return;
+      }
+      this->transition_ota_state_(OTAState::DATA);
+      this->handle_data_();
+      return;
+#endif
+
     default:
       break;
   }
@@ -339,6 +387,8 @@ void ESPHomeOTAComponent::handle_data_() {
   ///   Raw TCP (8266, RP2040):  setblocking is no-op; SO_RCVTIMEO uses
   ///                            wakeable_delay() in read();
   ///                            write() always returns immediately
+  // Backend calls overwrite this with OK; reset to UNKNOWN before any
+  // goto error that follows a successful begin()/write()
   ota::OTAResponseTypes error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
   size_t total = 0;
   uint32_t last_progress = 0;
@@ -360,11 +410,11 @@ void ESPHomeOTAComponent::handle_data_() {
   this->client_->setblocking(true);
 
   // Acknowledge auth OK - 1 byte
-  this->write_byte_(ota::OTA_RESPONSE_AUTH_OK);
+  this->data_write_byte_(ota::OTA_RESPONSE_AUTH_OK);
 
   if (this->extended_proto_) {
     // Read ota type, 1 byte
-    if (!this->readall_(buf, 1)) {
+    if (!this->data_readall_(buf, 1)) {
       this->log_read_error_(LOG_STR("OTA type"));
       goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
     }
@@ -373,7 +423,7 @@ void ESPHomeOTAComponent::handle_data_() {
   ESP_LOGV(TAG, "OTA type is 0x%02x", ota_type);
 
   // Read size, 4 bytes MSB first
-  if (!this->readall_(buf, 4)) {
+  if (!this->data_readall_(buf, 4)) {
     this->log_read_error_(LOG_STR("size"));
     goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
   }
@@ -404,11 +454,12 @@ void ESPHomeOTAComponent::handle_data_() {
     goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
 
   // Acknowledge prepare OK - 1 byte
-  this->write_byte_(ota::OTA_RESPONSE_UPDATE_PREPARE_OK);
+  this->data_write_byte_(ota::OTA_RESPONSE_UPDATE_PREPARE_OK);
 
   // Read binary MD5, 32 bytes
-  if (!this->readall_(buf, 32)) {
+  if (!this->data_readall_(buf, 32)) {
     this->log_read_error_(LOG_STR("MD5 checksum"));
+    error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
     goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
   }
   sbuf[32] = '\0';
@@ -416,7 +467,7 @@ void ESPHomeOTAComponent::handle_data_() {
   this->backend_->set_update_md5(sbuf);
 
   // Acknowledge MD5 OK - 1 byte
-  this->write_byte_(ota::OTA_RESPONSE_BIN_MD5_OK);
+  this->data_write_byte_(ota::OTA_RESPONSE_BIN_MD5_OK);
 
   // Track when we last received data so a silently-vanished peer (no FIN/RST
   // delivered, e.g. uploader killed mid-transfer or NAT/router dropped state)
@@ -432,19 +483,35 @@ void ESPHomeOTAComponent::handle_data_() {
     }
     size_t remaining = ota_size - total;
     size_t requested = remaining < OTA_BUFFER_SIZE ? remaining : OTA_BUFFER_SIZE;
-    ssize_t read = this->client_->read(buf, requested);
-    if (read == -1) {
-      const int err = errno;
-      if (this->would_block_(err)) {
-        // read() already waited up to SO_RCVTIMEO for data, just feed WDT
-        App.feed_wdt();
-        continue;
+    ssize_t read;
+#ifdef USE_OTA_ENCRYPTION
+    if (this->noise_ != nullptr) {
+      // One frame per call; noise_read_data_ waits internally (readall_), so
+      // there is no would-block retry here and failures are already logged.
+      read = this->noise_read_data_(buf, requested);
+      if (read <= 0) {
+        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
+        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+      }
+    } else
+#endif
+    {
+      read = this->client_->read(buf, requested);
+      if (read == -1) {
+        const int err = errno;
+        if (this->would_block_(err)) {
+          // read() already waited up to SO_RCVTIMEO for data, just feed WDT
+          App.feed_wdt();
+          continue;
+        }
+        ESP_LOGW(TAG, "Read err %d", err);
+        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
+        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+      } else if (read == 0) {
+        ESP_LOGW(TAG, "Remote closed");
+        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
+        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
       }
-      ESP_LOGW(TAG, "Read err %d", err);
-      goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-    } else if (read == 0) {
-      ESP_LOGW(TAG, "Remote closed");
-      goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
     }
 
     last_data_ms = millis();
@@ -456,7 +523,7 @@ void ESPHomeOTAComponent::handle_data_() {
     total += read;
 #if USE_OTA_VERSION == 2
     while (size_acknowledged + OTA_BLOCK_SIZE <= total || (total == ota_size && size_acknowledged < ota_size)) {
-      this->write_byte_(ota::OTA_RESPONSE_CHUNK_OK);
+      this->data_write_byte_(ota::OTA_RESPONSE_CHUNK_OK);
       size_acknowledged += OTA_BLOCK_SIZE;
     }
 #endif
@@ -475,7 +542,7 @@ void ESPHomeOTAComponent::handle_data_() {
   }
 
   // Acknowledge receive OK - 1 byte
-  this->write_byte_(ota::OTA_RESPONSE_RECEIVE_OK);
+  this->data_write_byte_(ota::OTA_RESPONSE_RECEIVE_OK);
 
   error_code = this->backend_->end();
   if (error_code != ota::OTA_RESPONSE_OK) {
@@ -484,10 +551,10 @@ void ESPHomeOTAComponent::handle_data_() {
   }
 
   // Acknowledge Update end OK - 1 byte
-  this->write_byte_(ota::OTA_RESPONSE_UPDATE_END_OK);
+  this->data_write_byte_(ota::OTA_RESPONSE_UPDATE_END_OK);
 
   // Read ACK
-  if (!this->readall_(buf, 1) || buf[0] != ota::OTA_RESPONSE_OK) {
+  if (!this->data_readall_(buf, 1) || buf[0] != ota::OTA_RESPONSE_OK) {
     this->log_read_error_(LOG_STR("ack"));
     // do not go to error, this is not fatal
   }
@@ -510,7 +577,7 @@ void ESPHomeOTAComponent::handle_data_() {
   App.safe_reboot();
 
 error:
-  this->write_byte_(static_cast<uint8_t>(error_code));
+  this->data_write_byte_(static_cast<uint8_t>(error_code));
 
   // Abort backend before cleanup - cleanup_connection_() destroys the backend.
   // Always call abort() unconditionally: backends register external partitions before
@@ -677,6 +744,9 @@ void ESPHomeOTAComponent::cleanup_connection_() {
   this->backend_ = nullptr;
 #ifdef USE_OTA_PASSWORD
   this->cleanup_auth_();
+#endif
+#ifdef USE_OTA_ENCRYPTION
+  this->noise_ = nullptr;
 #endif
   // Intentionally no disable_loop() — letting loop() run one more iteration catches
   // any connection that queued on the listener mid-session (otherwise the wake flag,

esphome/components/esphome/ota/ota_esphome.h

@@ -4,6 +4,9 @@
 #ifdef USE_OTA
 #include "esphome/components/ota/ota_backend_factory.h"
 #include "esphome/components/socket/socket.h"
+#ifdef USE_OTA_ENCRYPTION
+#include "esphome/components/noise/noise_handshake.h"
+#endif
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "esphome/core/preferences.h"
@@ -24,7 +27,10 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
     AUTH_SEND,  // Sending authentication request
     AUTH_READ,  // Reading authentication data
 #endif          // USE_OTA_PASSWORD
-    DATA,       // BLOCKING! Processing OTA data (update, etc.)
+#ifdef USE_OTA_ENCRYPTION
+    NOISE_HANDSHAKE,  // Exchanging Noise handshake frames
+#endif
+    DATA,  // BLOCKING! Processing OTA data (update, etc.)
   };
 #ifdef USE_OTA_PASSWORD
   void set_auth_password(const std::string &password) { password_ = password; }
@@ -38,6 +44,10 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   }
 #endif  // USE_OTA_PASSWORD
 
+#ifdef USE_OTA_ENCRYPTION
+  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
+#endif
+
   /// Manually set the port OTA should listen on
   void set_port(uint16_t port) { this->port_ = port; }
 
@@ -63,6 +73,48 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   bool writeall_(const uint8_t *buf, size_t len);
   inline bool write_byte_(uint8_t byte) { return this->writeall_(&byte, 1); }
 
+#ifdef USE_OTA_ENCRYPTION
+  // Heap-allocated only while an encrypted OTA session is active.
+  struct NoiseSession {
+    ~NoiseSession();
+    noise::NoiseResponderHandshake handshake;
+    NoiseCipherState *send_cipher{nullptr};
+    NoiseCipherState *recv_cipher{nullptr};
+    uint16_t frame_len{0};  // total frame size once the header is parsed, 0 until then
+    uint16_t frame_pos{0};  // bytes read or written so far
+    bool writing{false};    // a produced handshake frame is still being flushed
+    uint8_t frame_buf[noise::FRAME_HEADER_SIZE + 1 + noise::MAX_HANDSHAKE_SIZE];
+  };
+  bool noise_start_session_(uint8_t server_feature_flags);
+  bool handle_noise_handshake_();
+  bool noise_try_read_frame_();
+  bool noise_try_write_frame_();
+  void noise_send_reject_(const LogString *reason);
+  ssize_t noise_decrypt_(uint8_t *buf, size_t len);
+  ssize_t noise_read_frame_blocking_(uint8_t *buf, size_t min_ciphertext, size_t max_ciphertext);
+  bool noise_readall_(uint8_t *buf, size_t len);
+  ssize_t noise_read_data_(uint8_t *buf, size_t capacity);
+  bool noise_write_byte_(uint8_t byte);
+#endif  // USE_OTA_ENCRYPTION
+
+  // Data-phase I/O dispatch: through the noise transport when a session is
+  // active, straight to the socket otherwise.
+  inline bool data_write_byte_(uint8_t byte) {
+#ifdef USE_OTA_ENCRYPTION
+    if (this->noise_ != nullptr)
+      return this->noise_write_byte_(byte);
+#endif
+    return this->write_byte_(byte);
+  }
+  // When encrypted, buf must have room for len + noise::MAC_SIZE bytes.
+  inline bool data_readall_(uint8_t *buf, size_t len) {
+#ifdef USE_OTA_ENCRYPTION
+    if (this->noise_ != nullptr)
+      return this->noise_readall_(buf, len);
+#endif
+    return this->readall_(buf, len);
+  }
+
   bool try_read_(size_t to_read, const LogString *desc);
   bool try_write_(size_t to_write, const LogString *desc);
 
@@ -91,6 +143,10 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   std::string password_;
   std::unique_ptr<uint8_t[]> auth_buf_;
 #endif  // USE_OTA_PASSWORD
+#ifdef USE_OTA_ENCRYPTION
+  noise::NoiseContext noise_ctx_;
+  std::unique_ptr<NoiseSession> noise_;
+#endif  // USE_OTA_ENCRYPTION
 
   socket::ListenSocket *server_{nullptr};
   std::unique_ptr<socket::Socket> client_;
@@ -98,6 +154,18 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
 
   uint32_t client_connect_time_{0};
   static constexpr size_t HANDSHAKE_BUF_SIZE = 5;
+  // Buffer size for OTA data transfer. The upload client derives its maximum
+  // encrypted frame plaintext from this (espota2.NOISE_MAX_PLAINTEXT is this
+  // minus the 16-byte MAC); both must change together.
+  static constexpr size_t OTA_BUFFER_SIZE = 1040;
+#ifdef USE_OTA_ENCRYPTION
+  // espota2.NOISE_MAX_PLAINTEXT; shrinking the buffer would reject every
+  // frame a current CLI sends
+  static constexpr size_t NOISE_CLIENT_MAX_PLAINTEXT = 1024;
+  static_assert(OTA_BUFFER_SIZE >= NOISE_CLIENT_MAX_PLAINTEXT + noise::MAC_SIZE,
+                "OTA_BUFFER_SIZE must fit a full encrypted data frame");
+#endif
+  static constexpr uint8_t MAGIC_BYTES[5] = {0x6C, 0x26, 0xF7, 0x5C, 0x45};
 #ifdef USE_OTA_PARTITIONS
   uint32_t running_app_offset_{0};
   size_t running_app_size_{0};

esphome/components/esphome/ota/ota_esphome_noise.cpp

@@ -0,0 +1,279 @@
+#include "ota_esphome.h"
+#ifdef USE_OTA
+#ifdef USE_OTA_ENCRYPTION
+#include "esphome/components/noise/noise.h"
+#include "esphome/components/ota/ota_backend.h"
+#include "esphome/core/log.h"
+
+#include <cstring>
+#include <new>
+
+#ifdef USE_ESP8266
+#include <pgmspace.h>
+#endif
+
+namespace esphome {
+
+static const char *const TAG = "esphome.ota";
+
+#ifdef USE_ESP8266
+static constexpr char OTA_NOISE_PROLOGUE_INIT[] PROGMEM = "NoiseOTAInit";
+#else
+static constexpr char OTA_NOISE_PROLOGUE_INIT[] = "NoiseOTAInit";
+#endif
+static constexpr size_t OTA_NOISE_PROLOGUE_INIT_LEN = sizeof(OTA_NOISE_PROLOGUE_INIT) - 1;
+
+ESPHomeOTAComponent::NoiseSession::~NoiseSession() {
+  if (this->send_cipher != nullptr) {
+    noise_cipherstate_free(this->send_cipher);
+  }
+  if (this->recv_cipher != nullptr) {
+    noise_cipherstate_free(this->recv_cipher);
+  }
+}
+
+/** Allocate the session and start the responder handshake.
+ *
+ * The prologue binds the whole plaintext preamble, so any tampering with the
+ * negotiation (a stripped feature flag, a changed version) breaks the first
+ * handshake MAC on either side:
+ *   "NoiseOTAInit" | magic(5) | OK,version | client_features | FEATURE_FLAGS,server_flags
+ */
+bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
+  // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks)
+  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession());
+  if (this->noise_ == nullptr) {
+    ESP_LOGW(TAG, "Session allocation failed");
+    this->cleanup_connection_();
+    return false;
+  }
+
+  static constexpr size_t PROLOGUE_ACK_LEN = 2;  // OTA_RESPONSE_OK + version
+  static constexpr size_t PROLOGUE_CLIENT_FEATURES_LEN = 1;
+  static constexpr size_t PROLOGUE_FEATURE_ACK_LEN = 2;  // OTA_RESPONSE_FEATURE_FLAGS + server flags
+  uint8_t prologue[OTA_NOISE_PROLOGUE_INIT_LEN + sizeof(MAGIC_BYTES) + PROLOGUE_ACK_LEN + PROLOGUE_CLIENT_FEATURES_LEN +
+                   PROLOGUE_FEATURE_ACK_LEN];
+#ifdef USE_ESP8266
+  memcpy_P(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
+#else
+  std::memcpy(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
+#endif
+  uint8_t *p = prologue + OTA_NOISE_PROLOGUE_INIT_LEN;
+  // Magic bytes, already validated in MAGIC_READ
+  std::memcpy(p, MAGIC_BYTES, sizeof(MAGIC_BYTES));
+  p += sizeof(MAGIC_BYTES);
+  // Our magic ack
+  *p++ = ota::OTA_RESPONSE_OK;
+  *p++ = USE_OTA_VERSION;
+  // The feature byte the client sent
+  *p++ = this->ota_features_;
+  // The feature ack we sent (noise requires the extended protocol)
+  *p++ = ota::OTA_RESPONSE_FEATURE_FLAGS;
+  *p++ = server_feature_flags;
+
+  int err = this->noise_->handshake.init(this->noise_ctx_.get_psk(), prologue, sizeof(prologue));
+  if (err != 0) {
+    ESP_LOGW(TAG, "Handshake init: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    this->cleanup_connection_();
+    return false;
+  }
+  return true;
+}
+
+/** Drive the non-blocking handshake from loop(); returns true once the
+ * transport ciphers are ready. A would-block returns false and the next
+ * loop() resumes from the NoiseSession cursors; on failure the connection
+ * is cleaned up.
+ */
+bool ESPHomeOTAComponent::handle_noise_handshake_() {
+  NoiseSession &s = *this->noise_;
+  while (true) {
+    if (s.writing) {
+      if (!this->noise_try_write_frame_()) {
+        return false;  // would block, or errored and cleaned up
+      }
+      s.writing = false;
+      s.frame_pos = 0;
+      s.frame_len = 0;
+    }
+    switch (s.handshake.action()) {
+      case noise::NoiseResponderHandshake::Action::ACTION_READ: {
+        if (!this->noise_try_read_frame_()) {
+          return false;
+        }
+        const uint16_t payload_len = s.frame_len - noise::FRAME_HEADER_SIZE;
+        s.frame_pos = 0;
+        s.frame_len = 0;
+        if (s.frame_buf[noise::FRAME_HEADER_SIZE] != noise::HANDSHAKE_STATUS_OK) {
+          ESP_LOGW(TAG, "Bad handshake error byte: %u", s.frame_buf[noise::FRAME_HEADER_SIZE]);
+          this->cleanup_connection_();
+          return false;
+        }
+        int err = s.handshake.read_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, payload_len - 1);
+        if (err != 0) {
+          ESP_LOGW(TAG, "Handshake read: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+          this->noise_send_reject_(noise::reject_reason_for(err));
+          this->cleanup_connection_();
+          return false;
+        }
+        break;
+      }
+      case noise::NoiseResponderHandshake::Action::ACTION_WRITE: {
+        size_t msg_len = 0;
+        int err =
+            s.handshake.write_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, noise::MAX_HANDSHAKE_SIZE, msg_len);
+        if (err != 0) {
+          ESP_LOGW(TAG, "Handshake write: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+          this->cleanup_connection_();
+          return false;
+        }
+        const uint16_t payload_len = msg_len + 1;
+        noise::write_frame_header(s.frame_buf, payload_len);
+        s.frame_buf[noise::FRAME_HEADER_SIZE] = noise::HANDSHAKE_STATUS_OK;
+        s.frame_len = noise::FRAME_HEADER_SIZE + payload_len;
+        s.frame_pos = 0;
+        s.writing = true;
+        break;
+      }
+      case noise::NoiseResponderHandshake::Action::ACTION_SPLIT: {
+        int err = s.handshake.split(s.send_cipher, s.recv_cipher);
+        if (err != 0) {
+          ESP_LOGW(TAG, "Handshake split: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+          this->cleanup_connection_();
+          return false;
+        }
+        ESP_LOGD(TAG, "Noise handshake complete");
+        return true;
+      }
+      default: {
+        ESP_LOGW(TAG, "Bad handshake state");
+        this->cleanup_connection_();
+        return false;
+      }
+    }
+  }
+}
+
+/// Non-blocking read of one handshake frame into the session buffer.
+bool ESPHomeOTAComponent::noise_try_read_frame_() {
+  NoiseSession &s = *this->noise_;
+  while (s.frame_pos < noise::FRAME_HEADER_SIZE) {
+    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, noise::FRAME_HEADER_SIZE - s.frame_pos);
+    if (!this->handle_read_error_(read, LOG_STR("read noise header"))) {
+      return false;
+    }
+    s.frame_pos += read;
+  }
+  if (s.frame_len == 0) {
+    const uint16_t payload_len = encode_uint16(s.frame_buf[1], s.frame_buf[2]);
+    if (s.frame_buf[0] != noise::FRAME_INDICATOR || payload_len < 1 || payload_len > 1 + noise::MAX_HANDSHAKE_SIZE) {
+      ESP_LOGW(TAG, "Bad handshake frame: 0x%02X, %u bytes", s.frame_buf[0], payload_len);
+      this->cleanup_connection_();
+      return false;
+    }
+    s.frame_len = noise::FRAME_HEADER_SIZE + payload_len;
+  }
+  while (s.frame_pos < s.frame_len) {
+    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, s.frame_len - s.frame_pos);
+    if (!this->handle_read_error_(read, LOG_STR("read noise frame"))) {
+      return false;
+    }
+    s.frame_pos += read;
+  }
+  return true;
+}
+
+/// Non-blocking write of the pending session-buffer frame.
+bool ESPHomeOTAComponent::noise_try_write_frame_() {
+  NoiseSession &s = *this->noise_;
+  while (s.frame_pos < s.frame_len) {
+    ssize_t written = this->client_->write(s.frame_buf + s.frame_pos, s.frame_len - s.frame_pos);
+    if (!this->handle_write_error_(written, LOG_STR("write noise frame"))) {
+      return false;
+    }
+    s.frame_pos += written;
+  }
+  return true;
+}
+
+/// Best-effort explicit reject frame so the client can log a readable reason.
+void ESPHomeOTAComponent::noise_send_reject_(const LogString *reason) {
+  // Every reason here comes from noise::reject_reason_for(), so the exported
+  // floor is the exact capacity needed
+  uint8_t data[noise::FRAME_HEADER_SIZE + noise::MAC_FAILURE_PAYLOAD_SIZE];
+  const size_t payload_len =
+      noise::format_reject_payload(data + noise::FRAME_HEADER_SIZE, sizeof(data) - noise::FRAME_HEADER_SIZE, reason);
+  noise::write_frame_header(data, payload_len);
+  this->client_->write(data, noise::FRAME_HEADER_SIZE + payload_len);  // Best effort, non-blocking
+}
+
+/// Decrypt a ciphertext in place; returns the plaintext size or -1.
+ssize_t ESPHomeOTAComponent::noise_decrypt_(uint8_t *buf, size_t len) {
+  NoiseBuffer mbuf;
+  noise_buffer_init(mbuf);
+  noise_buffer_set_inout(mbuf, buf, len, len);
+  int err = noise_cipherstate_decrypt(this->noise_->recv_cipher, &mbuf);
+  if (err != 0) {
+    ESP_LOGW(TAG, "Decrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    return -1;
+  }
+  return mbuf.size;
+}
+
+/** Blocking read of one frame whose ciphertext size must be within the given
+ * bounds, decrypted in place; returns the plaintext size, or -1 on error.
+ * buf needs max_ciphertext capacity.
+ */
+ssize_t ESPHomeOTAComponent::noise_read_frame_blocking_(uint8_t *buf, size_t min_ciphertext, size_t max_ciphertext) {
+  uint8_t header[noise::FRAME_HEADER_SIZE];
+  if (!this->readall_(header, sizeof(header))) {
+    return -1;
+  }
+  const size_t ciphertext_len = encode_uint16(header[1], header[2]);
+  if (header[0] != noise::FRAME_INDICATOR || ciphertext_len < min_ciphertext || ciphertext_len > max_ciphertext) {
+    ESP_LOGW(TAG, "Bad frame: 0x%02X, %zu bytes", header[0], ciphertext_len);
+    return -1;
+  }
+  if (!this->readall_(buf, ciphertext_len)) {
+    return -1;
+  }
+  return this->noise_decrypt_(buf, ciphertext_len);
+}
+
+/** Blocking read of one frame whose plaintext must be exactly len bytes
+ * (control units are one unit per frame). buf needs len + noise::MAC_SIZE
+ * capacity; the plaintext lands at buf[0..len).
+ */
+bool ESPHomeOTAComponent::noise_readall_(uint8_t *buf, size_t len) {
+  return this->noise_read_frame_blocking_(buf, len + noise::MAC_SIZE, len + noise::MAC_SIZE) == (ssize_t) len;
+}
+
+/** Blocking read of one data-phase frame, decrypted in place; returns the
+ * plaintext size, or -1 on error. buf is the OTA_BUFFER_SIZE data buffer.
+ * The ciphertext must fit that buffer and its plaintext must fit what the
+ * caller accepts (the remaining image bytes).
+ */
+ssize_t ESPHomeOTAComponent::noise_read_data_(uint8_t *buf, size_t capacity) {
+  const size_t max_ciphertext = std::min(capacity + noise::MAC_SIZE, OTA_BUFFER_SIZE);
+  return this->noise_read_frame_blocking_(buf, noise::MAC_SIZE + 1, max_ciphertext);
+}
+
+/// Blocking write of one response byte as an encrypted frame.
+bool ESPHomeOTAComponent::noise_write_byte_(uint8_t byte) {
+  uint8_t frame[noise::FRAME_HEADER_SIZE + 1 + noise::MAC_SIZE];
+  frame[noise::FRAME_HEADER_SIZE] = byte;
+  NoiseBuffer mbuf;
+  noise_buffer_init(mbuf);
+  noise_buffer_set_inout(mbuf, frame + noise::FRAME_HEADER_SIZE, 1, 1 + noise::MAC_SIZE);
+  int err = noise_cipherstate_encrypt(this->noise_->send_cipher, &mbuf);
+  if (err != 0) {
+    ESP_LOGW(TAG, "Encrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    return false;
+  }
+  noise::write_frame_header(frame, mbuf.size);
+  return this->writeall_(frame, noise::FRAME_HEADER_SIZE + mbuf.size);
+}
+
+}  // namespace esphome
+#endif  // USE_OTA_ENCRYPTION
+#endif  // USE_OTA

esphome/components/espnow/__init__.py

@@ -155,6 +155,11 @@ async def to_code(config: ConfigType) -> None:
     cg.add_define("USE_ESPNOW")
     cg.add_define("USE_ESPNOW_MAX_PAYLOAD_SIZE", config[CONF_MAX_PAYLOAD_SIZE])
 
+    if CORE.is_esp32:
+        from esphome.components.esp32 import include_builtin_idf_component
+
+        include_builtin_idf_component("esp_wifi")
+
     if CONF_WIFI in CORE.config:
         # Track the Wi-Fi channel via connect events instead of polling every loop
         wifi.request_wifi_connect_state_listener()

esphome/components/fan/fan.cpp

@@ -334,8 +334,9 @@ void Fan::dump_traits_(const char *tag, const char *prefix) {
   }
   if (traits.supports_preset_modes()) {
     ESP_LOGCONFIG(tag, "%s  Supported presets:", prefix);
-    for (const char *s : traits.supported_preset_modes())
+    for (const char *s : traits.supported_preset_modes()) {
       ESP_LOGCONFIG(tag, "%s    - %s", prefix, s);
+    }
   }
 }
 

esphome/components/feedback/feedback_cover.cpp

@@ -93,7 +93,8 @@ void FeedbackCover::set_open_sensor(binary_sensor::BinarySensor *open_feedback)
 
   // setup callbacks to react to sensor changes
   open_feedback->add_on_state_callback([this](bool state) {
-    ESP_LOGD(TAG, "'%s' - Open feedback '%s'.", this->name_.c_str(), state ? "STARTED" : "ENDED");
+    ESP_LOGD(TAG, "'%s' - Open feedback '%s'.", this->name_.c_str(),
+             state ? LOG_STR_LITERAL("STARTED") : LOG_STR_LITERAL("ENDED"));
     this->recompute_position_();
     if (!state && this->infer_endstop_ && this->current_trigger_operation_ == COVER_OPERATION_OPENING) {
       this->endstop_reached_(true);
@@ -106,7 +107,8 @@ void FeedbackCover::set_close_sensor(binary_sensor::BinarySensor *close_feedback
   this->close_feedback_ = close_feedback;
 
   close_feedback->add_on_state_callback([this](bool state) {
-    ESP_LOGD(TAG, "'%s' - Close feedback '%s'.", this->name_.c_str(), state ? "STARTED" : "ENDED");
+    ESP_LOGD(TAG, "'%s' - Close feedback '%s'.", this->name_.c_str(),
+             state ? LOG_STR_LITERAL("STARTED") : LOG_STR_LITERAL("ENDED"));
     this->recompute_position_();
     if (!state && this->infer_endstop_ && this->current_trigger_operation_ == COVER_OPERATION_CLOSING) {
       this->endstop_reached_(false);
@@ -144,7 +146,8 @@ void FeedbackCover::endstop_reached_(bool open_endstop) {
   // from a position slightly past the endpoint
   if (this->current_trigger_operation_ == (open_endstop ? COVER_OPERATION_OPENING : COVER_OPERATION_CLOSING)) {
     float dur = (now - this->start_dir_time_) / 1e3f;
-    ESP_LOGD(TAG, "'%s' - %s endstop reached. Took %.1fs.", this->name_.c_str(), open_endstop ? "Open" : "Close", dur);
+    ESP_LOGD(TAG, "'%s' - %s endstop reached. Took %.1fs.", this->name_.c_str(),
+             open_endstop ? LOG_STR_LITERAL("Open") : LOG_STR_LITERAL("Close"), dur);
 
     // if there is no external mechanism, stop the cover
     if (!this->has_built_in_endstop_) {
@@ -366,7 +369,7 @@ void FeedbackCover::start_direction_(CoverOperation dir) {
   // the case when an obstacle appears while moving is handled in the callback
   if (obstacle != nullptr && obstacle->state) {
     ESP_LOGD(TAG, "'%s' - %s obstacle detected. Action not started.", this->name_.c_str(),
-             dir == COVER_OPERATION_OPENING ? "Open" : "Close");
+             dir == COVER_OPERATION_OPENING ? LOG_STR_LITERAL("Open") : LOG_STR_LITERAL("Close"));
     return;
   }
 #endif
@@ -383,9 +386,9 @@ void FeedbackCover::start_direction_(CoverOperation dir) {
     this->set_current_operation_(dir, true);
     this->prev_command_trigger_ = trig;
     ESP_LOGD(TAG, "'%s' - Firing '%s' trigger.", this->name_.c_str(),
-             dir == COVER_OPERATION_OPENING   ? "OPEN"
-             : dir == COVER_OPERATION_CLOSING ? "CLOSE"
-                                              : "STOP");
+             dir == COVER_OPERATION_OPENING   ? LOG_STR_LITERAL("OPEN")
+             : dir == COVER_OPERATION_CLOSING ? LOG_STR_LITERAL("CLOSE")
+                                              : LOG_STR_LITERAL("STOP"));
     trig->trigger();
   }
 }

esphome/components/fingerprint_grow/fingerprint_grow.cpp

@@ -547,8 +547,8 @@ void FingerprintGrowComponent::dump_config() {
                 "  System Identifier Code: 0x%.4X\n"
                 "  Touch Sensing Pin: %s\n"
                 "  Sensor Power Pin: %s",
-                this->system_identifier_code_, this->has_sensing_pin_ ? sensing_pin_buf : "None",
-                this->has_power_pin_ ? power_pin_buf : "None");
+                this->system_identifier_code_, this->has_sensing_pin_ ? sensing_pin_buf : LOG_STR_LITERAL("None"),
+                this->has_power_pin_ ? power_pin_buf : LOG_STR_LITERAL("None"));
   if (this->idle_period_to_sleep_ms_ < UINT32_MAX) {
     ESP_LOGCONFIG(TAG, "  Idle Period to Sleep: %" PRIu32 " ms", this->idle_period_to_sleep_ms_);
   } else {

esphome/components/graphical_display_menu/graphical_display_menu.cpp

@@ -35,18 +35,20 @@ void GraphicalDisplayMenu::setup() {
 }
 
 void GraphicalDisplayMenu::dump_config() {
-  ESP_LOGCONFIG(TAG,
-                "Graphical Display Menu\n"
-                "  Has Display: %s\n"
-                "  Popup Mode: %s\n"
-                "  Advanced Drawing Mode: %s\n"
-                "  Has Font: %s\n"
-                "  Mode: %s\n"
-                "  Active: %s\n"
-                "  Menu items:",
-                YESNO(this->display_ != nullptr), YESNO(this->display_ != nullptr), YESNO(this->display_ == nullptr),
-                YESNO(this->font_ != nullptr),
-                this->mode_ == display_menu_base::MENU_MODE_ROTARY ? "Rotary" : "Joystick", YESNO(this->active_));
+  ESP_LOGCONFIG(
+      TAG,
+      "Graphical Display Menu\n"
+      "  Has Display: %s\n"
+      "  Popup Mode: %s\n"
+      "  Advanced Drawing Mode: %s\n"
+      "  Has Font: %s\n"
+      "  Mode: %s\n"
+      "  Active: %s\n"
+      "  Menu items:",
+      YESNO(this->display_ != nullptr), YESNO(this->display_ != nullptr), YESNO(this->display_ == nullptr),
+      YESNO(this->font_ != nullptr),
+      this->mode_ == display_menu_base::MENU_MODE_ROTARY ? LOG_STR_LITERAL("Rotary") : LOG_STR_LITERAL("Joystick"),
+      YESNO(this->active_));
   for (size_t i = 0; i < this->displayed_item_->items_size(); i++) {
     auto *item = this->displayed_item_->get_item(i);
     ESP_LOGCONFIG(TAG, "  %i: %s (Type: %s, Immediate Edit: %s)", i, item->get_text().c_str(),