[esp32_ble_client] Keep INIT when a connect is rejected before registration

The ble_client.connect action can reach connect() while the client is still in INIT; dropping it to IDLE there skipped the only registration path until the next disable cycle.
[esp32_ble_tracker] Quiet the teardown of a scan that is still starting
2026-09-10 14:57:32 +00:00 · 2026-09-10 09:51:47 -05:00 · 2026-09-10 09:34:08 -05:00 · 2026-09-10 08:50:34 -05:00 · 2026-09-10 08:48:00 -05:00 · 2026-09-10 08:34:25 -05:00
77 changed files with 1845 additions and 994 deletions
@@ -33,7 +33,7 @@ jobs:
        and will be closed if no further activity occurs within 7 days.

        If you are the author of this PR, please leave a comment if you want
-        to keep it open. Also, please rebase your PR onto the latest dev
+        to keep it open. Also, please merge the latest dev branch into your
        branch to ensure that it's up to date with the latest changes.

        Thank you for your contribution!
@@ -58,6 +58,9 @@ esp_err_t AudioReader::add_sink(const std::weak_ptr<ring_buffer::RingBuffer> &ou
  if (current_audio_file_ != nullptr) {
    // A transfer buffer isn't ncessary for a local file
    this->file_ring_buffer_ = output_ring_buffer.lock();
+    if (this->file_ring_buffer_ == nullptr) {
+      return ESP_ERR_INVALID_STATE;
+    }
    return ESP_OK;
  }

@@ -51,14 +51,14 @@ void AudioTransferBuffer::increase_buffer_length(size_t bytes) { this->buffer_le

 void AudioTransferBuffer::clear_buffered_data() {
  this->buffer_length_ = 0;
-  if (this->ring_buffer_.use_count() > 0) {
+  if (this->ring_buffer_ != nullptr) {
    this->ring_buffer_->reset();
  }
 }

 void AudioSinkTransferBuffer::clear_buffered_data() {
  this->buffer_length_ = 0;
-  if (this->ring_buffer_.use_count() > 0) {
+  if (this->ring_buffer_ != nullptr) {
    this->ring_buffer_->reset();
  }
 #ifdef USE_SPEAKER
@@ -69,7 +69,7 @@ void AudioSinkTransferBuffer::clear_buffered_data() {
 }

 bool AudioTransferBuffer::has_buffered_data() const {
-  if (this->ring_buffer_.use_count() > 0) {
+  if (this->ring_buffer_ != nullptr) {
    return ((this->ring_buffer_->available() > 0) || (this->available() > 0));
  }
  return (this->available() > 0);
@@ -144,7 +144,7 @@ size_t AudioSourceTransferBuffer::transfer_data_from_source(TickType_t ticks_to_
  size_t bytes_to_read = AudioTransferBuffer::free();
  size_t bytes_read = 0;
  if (bytes_to_read > 0) {
-    if (this->ring_buffer_.use_count() > 0) {
+    if (this->ring_buffer_ != nullptr) {
      bytes_read = this->ring_buffer_->read((void *) this->get_buffer_end(), bytes_to_read, ticks_to_wait);
    }

@@ -161,7 +161,7 @@ size_t AudioSinkTransferBuffer::transfer_data_to_sink(TickType_t ticks_to_wait,
      bytes_written = this->speaker_->play(this->data_start_, this->available(), ticks_to_wait);
    } else
 #endif
-        if (this->ring_buffer_.use_count() > 0) {
+        if (this->ring_buffer_ != nullptr) {
      bytes_written =
          this->ring_buffer_->write_without_replacement((void *) this->data_start_, this->available(), ticks_to_wait);
    } else if (this->sink_callback_ != nullptr) {
@@ -186,7 +186,7 @@ bool AudioSinkTransferBuffer::has_buffered_data() const {
    return (this->speaker_->has_buffered_data() || (this->available() > 0));
  }
 #endif
-  if (this->ring_buffer_.use_count() > 0) {
+  if (this->ring_buffer_ != nullptr) {
    return ((this->ring_buffer_->available() > 0) || (this->available() > 0));
  }
  return (this->available() > 0);
@@ -45,15 +45,7 @@ void BluedroidGattClient::setup() {

 void BluedroidGattClient::loop() {
  if (!esp32_ble::global_ble->is_active()) {
-    // Stack down: no CLOSE_EVT will come. Settle a live link so the consumer
-    // frees its slot, then re-register the app on the next enable.
-    auto down_st = this->state();
-    if (down_st != ClientState::IDLE && down_st != ClientState::INIT) {
-      this->release_services();
-      this->set_idle_();
-      this->listener_->on_connection_state(false, 0, ble_device_base::GATT_ERR_NOT_CONNECTED);
-    }
-    this->set_state(ClientState::INIT);
+    // ble_before_disabled_event_handler() settles the slot.
    return;
  }
  auto st = this->state();
@@ -65,7 +57,7 @@ void BluedroidGattClient::loop() {
      ESP_LOGE(TAG, "gattc app register failed: app_id=%d code=%d", this->app_id, ret);
      this->mark_failed();
    }
-    // Do not wait for REG_EVT; a dropped event must not wedge the slot.
+    // Do not wait for REG_EVT; connect() rejects until it lands.
    this->set_idle_();
  } else if (st == ClientState::DISCONNECTING || this->disconnect_pending()) {
    // The one teardown safety net: a lost CLOSE_EVT, or a scheduled
@@ -78,8 +70,8 @@ void BluedroidGattClient::loop() {
      this->listener_->on_connection_state(false, 0, ESP_GATT_CONN_TIMEOUT);
    }
  } else {
-    // The loop stays on while a link exists (stack-down watch, pre-started
-    // search flush); it settles only back at IDLE.
+    // The loop stays on while a link exists (pre-started search flush); it
+    // settles only back at IDLE.
    this->deliver_pending_search_();
    if (this->state() == ClientState::IDLE) {
      this->disable_loop();
@@ -87,6 +79,22 @@ void BluedroidGattClient::loop() {
  }
 }

+// Stack down: no CLOSE_EVT will come. Settle a live link so the consumer
+// frees its slot, then register the app again on the next enable.
+void BluedroidGattClient::ble_before_disabled_event_handler() {
+  auto st = this->state();
+  if (st != ClientState::IDLE && st != ClientState::INIT) {
+    this->release_services();
+    this->set_idle_();
+    this->listener_->on_connection_state(false, 0, ble_device_base::GATT_ERR_NOT_CONNECTED);
+  }
+  // The interface belongs to the torn-down stack.
+  this->gattc_if_ = ESP_GATT_IF_NONE;
+  this->set_state(ClientState::INIT);
+  // An idle slot runs no loop; the INIT branch must run to register again.
+  this->enable_loop();
+}
+
 void BluedroidGattClient::dump_config() {
  ESP_LOGCONFIG(TAG, "Bluedroid GATT client %d", this->connection_index_);
  if (this->is_failed()) {
@@ -97,6 +105,11 @@ void BluedroidGattClient::dump_config() {
 // ---- contract ops ----

 int BluedroidGattClient::connect(uint64_t address, uint8_t addr_type) {
+  if (this->gattc_if_ == ESP_GATT_IF_NONE) {
+    // Bluedroid drops an open on an unknown interface without any event.
+    ESP_LOGW(TAG, "[%d] Connect rejected, GATT app not registered", this->connection_index_);
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  }
  // Only from idle: clobbering DISCONNECTING would open a new link the
  // stale CLOSE_EVT then tears down.
  if (this->state() != ClientState::IDLE) {
@@ -56,6 +56,7 @@ class BluedroidGattClient final : public esp32_ble_tracker::ESPBTClient, public
  void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) override;
  void connect() override;
  void disconnect() override;
+  void ble_before_disabled_event_handler() override;
  bool wants_parsed_advertisements() override { return false; }
  void on_scan_end() override {}
  bool parse_device(const ble_device_base::ESPBTDevice &device) override { return false; }
@@ -3,6 +3,7 @@ import logging
 import esphome.codegen as cg
 from esphome.components import web_server_base, wifi
 from esphome.components.web_server_base import CONF_WEB_SERVER_BASE_ID
+from esphome.config_helpers import filter_source_files_from_platform
 import esphome.config_validation as cv
 from esphome.const import (
    CONF_AP,
@@ -14,6 +15,7 @@ from esphome.const import (
    PLATFORM_LN882X,
    PLATFORM_RP2,
    PLATFORM_RTL87XX,
+    PlatformFramework,
 )
 from esphome.core import CORE, coroutine_with_priority
 from esphome.coroutine import CoroPriority
@@ -74,7 +76,17 @@ def _final_validate(config: ConfigType) -> None:
            "Add 'ap:' to your WiFi configuration to enable the captive portal."
        )

-    web_server_base.consume_captive_dns_sockets(config, "captive_portal")
+    # Register socket needs for DNS server and additional HTTP connections
+    # - 1 UDP socket for DNS server
+    # - 3 TCP sockets for captive portal detection probes + configuration requests
+    #   OS captive portal detection makes multiple probe requests that stay in TIME_WAIT.
+    #   Need headroom for actual user configuration requests.
+    #   LRU purging will reclaim idle sockets to prevent exhaustion from repeated attempts.
+    # The listening socket is registered by web_server_base (shared HTTP server).
+    from esphome.components import socket
+
+    socket.consume_sockets(3, "captive_portal")(config)
+    socket.consume_sockets(1, "captive_portal", socket.SocketType.UDP)(config)


 FINAL_VALIDATE_SCHEMA = _final_validate
@@ -94,4 +106,16 @@ async def to_code(config: ConfigType) -> None:
    if config[CONF_COMPRESSION] == "gzip":
        cg.add_define("USE_CAPTIVE_PORTAL_GZIP")

-    web_server_base.add_captive_dns_library()
+    if CORE.using_arduino and (CORE.is_esp8266 or CORE.is_libretiny or CORE.is_rp2):
+        cg.add_library("DNSServer", None)
+
+
+# Only compile the ESP-IDF DNS server when using ESP-IDF framework
+FILTER_SOURCE_FILES = filter_source_files_from_platform(
+    {
+        "dns_server_esp32_idf.cpp": {
+            PlatformFramework.ESP32_ARDUINO,
+            PlatformFramework.ESP32_IDF,
+        },
+    }
+)
@@ -102,7 +102,17 @@ void CaptivePortal::start() {
    this->base_->add_handler_without_auth(this);
  }

-  this->dns_.start(wifi::global_wifi_component->wifi_soft_ap_ip());
+  network::IPAddress ip = wifi::global_wifi_component->wifi_soft_ap_ip();
+
+#if defined(USE_ESP32)
+  // Create DNS server instance for ESP-IDF
+  this->dns_server_ = make_unique<DNSServer>();
+  this->dns_server_->start(ip);
+#elif defined(USE_ARDUINO)
+  this->dns_server_ = make_unique<DNSServer>();
+  this->dns_server_->setErrorReplyCode(DNSReplyCode::NoError);
+  this->dns_server_->start(53, ESPHOME_F("*"), ip);
+#endif

  this->initialized_ = true;
  this->active_ = true;
@@ -1,11 +1,16 @@
 #pragma once
 #include "esphome/core/defines.h"
 #ifdef USE_CAPTIVE_PORTAL
+#include <memory>
+#if defined(USE_ESP32)
+#include "dns_server_esp32_idf.h"
+#elif defined(USE_ARDUINO)
+#include <DNSServer.h>
+#endif
 #include "esphome/core/component.h"
 #include "esphome/core/helpers.h"
 #include "esphome/core/preferences.h"
 #include "esphome/components/web_server_base/web_server_base.h"
-#include "esphome/components/web_server_base/captive_dns.h"

 namespace esphome::captive_portal {

@@ -14,7 +19,17 @@ class CaptivePortal final : public AsyncWebHandler, public Component {
  CaptivePortal(web_server_base::WebServerBase *base);
  void setup() override;
  void dump_config() override;
-  void loop() override { this->dns_.loop(); }
+  void loop() override {
+#if defined(USE_ESP32)
+    if (this->dns_server_ != nullptr) {
+      this->dns_server_->process_next_request();
+    }
+#elif defined(USE_ARDUINO)
+    if (this->dns_server_ != nullptr) {
+      this->dns_server_->processNextRequest();
+    }
+#endif
+  }
  float get_setup_priority() const override;
  void start();
  bool is_active() const { return this->active_; }
@@ -22,7 +37,10 @@ class CaptivePortal final : public AsyncWebHandler, public Component {
    this->active_ = false;
    this->disable_loop();  // Stop processing DNS requests
    this->base_->deinit();
-    this->dns_.stop();
+    if (this->dns_server_ != nullptr) {
+      this->dns_server_->stop();
+      this->dns_server_ = nullptr;
+    }
  }

  bool canHandle(AsyncWebServerRequest *request) const override {
@@ -42,7 +60,9 @@ class CaptivePortal final : public AsyncWebHandler, public Component {
  web_server_base::WebServerBase *base_;
  bool initialized_{false};
  bool active_{false};
-  web_server_base::CaptiveDNS dns_;
+#if defined(USE_ARDUINO) || defined(USE_ESP32)
+  std::unique_ptr<DNSServer> dns_server_{nullptr};
+#endif
 };

 extern CaptivePortal *global_captive_portal;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
@@ -1,5 +1,5 @@
 #include "dns_server_esp32_idf.h"
-#if defined(USE_ESP32) && (defined(USE_CAPTIVE_PORTAL) || defined(USE_WEBSERVER_CAPTIVE))
+#ifdef USE_ESP32

 #include "esphome/core/log.h"
 #include "esphome/core/hal.h"
@@ -7,9 +7,9 @@
 #include <lwip/sockets.h>
 #include <lwip/inet.h>

-namespace esphome::web_server_base {
+namespace esphome::captive_portal {

-static const char *const TAG = "web_server_base.dns";
+static const char *const TAG = "captive_portal.dns";

 // DNS constants
 static constexpr uint16_t DNS_PORT = 53;
@@ -202,6 +202,6 @@ void DNSServer::process_next_request() {
  }
 }

-}  // namespace esphome::web_server_base
+}  // namespace esphome::captive_portal

-#endif  // USE_ESP32 && (USE_CAPTIVE_PORTAL || USE_WEBSERVER_CAPTIVE)
+#endif  // USE_ESP32
@@ -1,15 +1,11 @@
 #pragma once
-#include "esphome/core/defines.h"
-// Small DNS server that answers every query with the access point address, so a
-// phone joining the AP opens the captive portal or web_server page on its own.
-// Shared by captive_portal and the web_server AP mode.
-#if defined(USE_ESP32) && (defined(USE_CAPTIVE_PORTAL) || defined(USE_WEBSERVER_CAPTIVE))
+#ifdef USE_ESP32

 #include "esphome/core/helpers.h"
 #include "esphome/components/network/ip_address.h"
 #include "esphome/components/socket/socket.h"

-namespace esphome::web_server_base {
+namespace esphome::captive_portal {

 class DNSServer {
 public:
@@ -31,6 +27,6 @@ class DNSServer {
  uint8_t buffer_[DNS_BUFFER_SIZE];
 };

-}  // namespace esphome::web_server_base
+}  // namespace esphome::captive_portal

-#endif  // USE_ESP32 && (USE_CAPTIVE_PORTAL || USE_WEBSERVER_CAPTIVE)
+#endif  // USE_ESP32
@@ -44,7 +44,7 @@ bool DeepSleepComponent::prepare_to_sleep_() {
          this->status_set_warning();
          ESP_LOGV(TAG, "Waiting for pin to switch state to enter deep sleep...");
        }
-        this->next_enter_deep_sleep_ = true;
+        this->defer_sleep_();
        return false;
      }
    }
@@ -17,6 +17,7 @@ void DeepSleepComponent::setup() {

 void DeepSleepComponent::schedule_sleep_() {
  this->next_enter_deep_sleep_ = false;
+  this->disable_loop();
  const optional<uint32_t> run_duration = get_run_duration_();
  if (run_duration.has_value()) {
    ESP_LOGI(TAG, "Scheduling in %" PRIu32 " ms", *run_duration);
@@ -45,7 +46,7 @@ void DeepSleepComponent::loop() {

 void DeepSleepComponent::begin_sleep(bool manual) {
  if (this->prevent_ && !manual) {
-    this->next_enter_deep_sleep_ = true;
+    this->defer_sleep_();
    return;
  }

@@ -190,6 +190,11 @@ class DeepSleepComponent final : public Component {
  void schedule_sleep_();
  bool should_teardown_();

+  void defer_sleep_() {
+    this->next_enter_deep_sleep_ = true;
+    this->enable_loop();
+  }
+
 #ifdef USE_BK72XX
  bool pin_prevents_sleep_(WakeUpPinItem &pin_item) const;
  bool get_real_pin_state_(InternalGPIOPin &pin) const { return (pin.digital_read() ^ pin.is_inverted()); }
@@ -100,7 +100,7 @@ bool DeepSleepComponent::prepare_to_sleep_() {
      this->status_set_warning();
      ESP_LOGW(TAG, "Waiting for wakeup pin state change");
    }
-    this->next_enter_deep_sleep_ = true;
+    this->defer_sleep_();
    return false;
  }
  return true;
@@ -83,18 +83,23 @@ void ESP32BLE::setup() {
  }
 }

-void ESP32BLE::enable() {
-  if (this->state_ != BLE_COMPONENT_STATE_DISABLED)
-    return;
-
-  this->state_ = BLE_COMPONENT_STATE_ENABLE;
-}
-
-void ESP32BLE::disable() {
-  if (this->state_ == BLE_COMPONENT_STATE_DISABLED)
-    return;
-
-  this->state_ = BLE_COMPONENT_STATE_DISABLE;
+// Queue the transition for loop(). A pending transition the other way is
+// cancelled instead, since nothing was torn down or brought up yet; any other
+// state is already there or on its way.
+void ESP32BLE::request_state_(bool enable) {
+  if (enable) {
+    if (this->state_ == BLE_COMPONENT_STATE_DISABLED) {
+      this->state_ = BLE_COMPONENT_STATE_ENABLE;
+    } else if (this->state_ == BLE_COMPONENT_STATE_DISABLE) {
+      this->state_ = BLE_COMPONENT_STATE_ACTIVE;
+    }
+  } else {
+    if (this->state_ == BLE_COMPONENT_STATE_ACTIVE) {
+      this->state_ = BLE_COMPONENT_STATE_DISABLE;
+    } else if (this->state_ == BLE_COMPONENT_STATE_ENABLE) {
+      this->state_ = BLE_COMPONENT_STATE_DISABLED;
+    }
+  }
 }

 #ifdef USE_ESP32_BLE_ADVERTISING
@@ -580,7 +585,11 @@ void ESP32BLE::loop_handle_state_transition_not_active_() {
      this->mark_failed();
      return;
    }
-    this->state_ = BLE_COMPONENT_STATE_DISABLED;
+    this->drain_ble_events_();
+    // A status callback may have asked for BLE back; the stack is down now, so
+    // that request becomes a bring-up.
+    this->state_ =
+        this->state_ == BLE_COMPONENT_STATE_ACTIVE ? BLE_COMPONENT_STATE_ENABLE : BLE_COMPONENT_STATE_DISABLED;
  } else if (this->state_ == BLE_COMPONENT_STATE_ENABLE) {
    ESP_LOGD(TAG, "Enabling");
    this->state_ = BLE_COMPONENT_STATE_OFF;
@@ -102,8 +102,8 @@ class ESP32BLE final : public Component {
  }
  uint32_t get_advertising_cycle_time() const { return this->advertising_cycle_time_; }

-  void enable();
-  void disable();
+  void enable() { this->request_state_(true); }
+  void disable() { this->request_state_(false); }
  ESPHOME_ALWAYS_INLINE bool is_active() { return this->state_ == BLE_COMPONENT_STATE_ACTIVE; }
  void setup() override;
  void loop() override;
@@ -176,6 +176,15 @@ class ESP32BLE final : public Component {

  bool ble_setup_();
  bool ble_dismantle_();
+  void request_state_(bool enable);
+  // Drop what the old stack queued; the next stack reuses the same interface ids.
+  void drain_ble_events_() {
+    BLEEvent *ble_event;
+    while ((ble_event = this->ble_events_.pop()) != nullptr) {
+      this->ble_event_pool_.release(ble_event);
+    }
+    this->ble_events_.get_and_reset_dropped_count();
+  }
  bool ble_pre_setup_();
 #ifdef USE_ESP32_BLE_ADVERTISING
  void advertising_init_();
@@ -42,7 +42,7 @@ void BLEClientBase::set_state(espbt::ClientState st) {

 void BLEClientBase::loop() {
  if (!esp32_ble::global_ble->is_active()) {
-    this->set_state(espbt::ClientState::INIT);
+    // ble_before_disabled_event_handler() resets the client.
    return;
  }
  if (this->state() == espbt::ClientState::INIT) {
@@ -72,6 +72,21 @@ void BLEClientBase::loop() {

 float BLEClientBase::get_setup_priority() const { return setup_priority::AFTER_BLUETOOTH; }

+void BLEClientBase::ble_before_disabled_event_handler() {
+  auto st = this->state();
+  if (st != espbt::ClientState::IDLE && st != espbt::ClientState::INIT) {
+    // No CLOSE_EVT will come: free the services and settle the link.
+    this->release_services();
+    this->set_idle_();
+    this->on_disconnect_complete(ESP_GATT_CONN_TERMINATE_LOCAL_HOST);
+  }
+  // The interface belongs to the torn-down stack.
+  this->gattc_if_ = ESP_GATT_IF_NONE;
+  this->set_state(espbt::ClientState::INIT);
+  // An idle client runs no loop; the INIT branch must run to register again.
+  this->enable_loop();
+}
+
 void BLEClientBase::dump_config() {
  ESP_LOGCONFIG(TAG,
                "  Address: %s\n"
@@ -93,6 +108,10 @@ bool BLEClientBase::parse_device(const espbt::ESPBTDevice &device) {
    return false;
  if (this->state() != espbt::ClientState::IDLE)
    return false;
+  // Not registered on this stack yet; promoting now would stop the scan for a
+  // connect that connect() rejects anyway.
+  if (this->gattc_if_ == ESP_GATT_IF_NONE)
+    return false;

  this->log_event_("Found device");
  if (ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_DEBUG)
@@ -117,6 +136,15 @@ void BLEClientBase::connect() {
             this->connection_index_, this->address_str_);
    return;
  }
+  if (this->gattc_if_ == ESP_GATT_IF_NONE) {
+    // Bluedroid drops an open on an unknown interface without any event.
+    this->log_warning_("Connect rejected, GATT app not registered");
+    // INIT stays so loop() still registers; only a promoted client goes back.
+    if (this->state() == espbt::ClientState::DISCOVERED) {
+      this->set_state(espbt::ClientState::IDLE);
+    }
+    return;
+  }
  ESP_LOGI(TAG, "[%d] [%s] 0x%02x Connecting", this->connection_index_, this->address_str_, this->remote_addr_type_);
  this->paired_ = false;
  // A registration whose event never arrived must not block this connection's release.
@@ -199,7 +227,10 @@ void BLEClientBase::release_services() {
 #ifndef CONFIG_BT_GATTC_CACHE_NVS_FLASH
  // Only the cache clean makes the stack's database unsafe to walk.
  this->services_released_ = true;
-  esp_ble_gattc_cache_clean(this->remote_bda_);
+  // A stack on its way down frees its own cache.
+  if (esp32_ble::global_ble->is_active()) {
+    esp_ble_gattc_cache_clean(this->remote_bda_);
+  }
 #endif
 }

@@ -41,6 +41,7 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
  void connect() override;
  esp_err_t pair();
  void disconnect() override;
+  void ble_before_disabled_event_handler() override;
  void unconditional_disconnect();
  void release_services();

@@ -114,7 +115,7 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
 #endif

  // Group 3: 4-byte types
-  int gattc_if_;
+  int gattc_if_{ESP_GATT_IF_NONE};
  esp_gatt_status_t status_{ESP_GATT_OK};

  // Group 4: Arrays
@@ -139,7 +140,7 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
  uint8_t pending_notify_regs_{0};
  bool auto_connect_{false};
  bool paired_{false};
-  // Set only when release_services() cleans the stack's GATT cache, which no API may then walk
+  // Always set by release_services(); the stack's GATT database must not be walked after it
  bool services_released_{false};
  // 8 bytes used, no padding

@@ -155,10 +156,11 @@ class BLEClientBase : public espbt::ESPBTClient, public Component {
  void log_connection_params_(const char *param_type);
  void handle_connection_result_(esp_err_t ret);
  /// Hook called once a connection has been fully torn down (after release_services() and
-  /// set_idle_()), from both the CLOSE_EVT handler and the DISCONNECTING safety timeout.
+  /// set_idle_()): CLOSE_EVT, the DISCONNECTING safety timeout, or the BLE stack going down.
  /// Subclasses with extra per-connection accounting (e.g. bluetooth_proxy slot state)
-  /// override this to release that state. `reason` is the controller reason code, or
-  /// ESP_GATT_CONN_TIMEOUT for the safety-timeout path.
+  /// override this to release that state. `reason` is the controller reason code,
+  /// ESP_GATT_CONN_TIMEOUT for the safety timeout, or ESP_GATT_CONN_TERMINATE_LOCAL_HOST
+  /// for the stack going down.
  virtual void on_disconnect_complete(esp_err_t reason) {}
  /// Transition to IDLE and reset conn_id — call when the connection is fully dead.
  void set_idle_() {
@@ -74,11 +74,11 @@ void ESP32BLETracker::on_ota_global_state(ota::OTAState state, float progress, u

 void ESP32BLETracker::loop() {
  if (!this->parent_->is_active()) {
-    this->ble_was_disabled_ = true;
    return;
-  } else if (this->ble_was_disabled_) {
+  }
+  if (this->ble_was_disabled_) {
    this->ble_was_disabled_ = false;
-    // If the BLE stack was disabled, we need to start the scan again.
+    // First start after boot or after the stack came back.
    if (this->scan_continuous_) {
      this->start_scan();
    }
@@ -218,7 +218,24 @@ void ESP32BLETracker::stop_scan() {
  this->stop_scan_();
 }

-void ESP32BLETracker::ble_before_disabled_event_handler() { this->stop_scan_(); }
+void ESP32BLETracker::ble_before_disabled_event_handler() {
+  // Tell the controller to stop; a scan still starting has nothing to stop yet.
+  if (this->scanner_state_ == ScannerState::RUNNING || this->scanner_state_ == ScannerState::FAILED) {
+    this->stop_scan_();
+  }
+#ifdef ESPHOME_ESP32_BLE_TRACKER_CLIENT_COUNT
+  for (auto *client : this->clients_) {
+    client->ble_before_disabled_event_handler();
+  }
+  this->skip_next_scan_end_ = false;
+#endif
+  // The stop above never completes (stack torn down, events dropped); settle
+  // here so start_scan_() sees IDLE once the stack is back.
+  if (this->scanner_state_ != ScannerState::IDLE) {
+    this->cleanup_scan_state_(true);
+  }
+  this->ble_was_disabled_ = true;
+}

 bool ESP32BLETracker::stop_scan_() {
  if (this->scanner_state_ != ScannerState::RUNNING && this->scanner_state_ != ScannerState::FAILED) {
@@ -113,6 +113,9 @@ class ESPBTClient : public ESPBTDeviceListener {
  virtual void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) = 0;
  virtual void connect() = 0;
  virtual void disconnect() = 0;
+  /// Called right before the BLE stack is dismantled. Nothing in flight will
+  /// complete, and the GATT app must register again once the stack is back.
+  virtual void ble_before_disabled_event_handler() {}
  bool disconnect_pending() const { return this->want_disconnect_; }
  void cancel_pending_disconnect() { this->want_disconnect_ = false; }

@@ -41,7 +41,10 @@ const noise::NoiseContext &ESPHomeOTAComponent::noise_context_() const {
 #endif
 static constexpr uint16_t OTA_BLOCK_SIZE = 8192;
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_HANDSHAKE = 20000;  // milliseconds for initial handshake
-static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 90000;       // milliseconds for data transfer
+// Milliseconds for data transfer. Covers the lwIP retransmit run seen in
+// practice for a lost chunk ack (1.5 + 3 + 6 + 12 + 24 + 48 s); the CLI waits
+// longer (espota2.DATA_PHASE_TIMEOUT) so the device is free before it retries
+static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 105000;

 // Single-instance pointer — multi-port configs are rejected in final_validate.
 // NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables)
@@ -118,21 +118,24 @@ void I2SAudioSpeakerBase::loop() {
        break;
      }

+      // Still starting up or winding down from a previous run
+      if ((this->tx_handle_ != nullptr) || (this->speaker_task_handle_ != nullptr)) {
+        break;
+      }
+
      if (this->start_i2s_driver(this->audio_stream_info_) != ESP_OK) {
        ESP_LOGE(TAG, "Driver failed to start; retrying in 1 second");
        this->status_momentary_error("driver-failure", 1000);
        break;
      }

-      if (this->speaker_task_handle_ == nullptr) {
-        xTaskCreate(I2SAudioSpeakerBase::speaker_task, "speaker_task", TASK_STACK_SIZE, (void *) this, TASK_PRIORITY,
-                    &this->speaker_task_handle_);
+      xTaskCreate(I2SAudioSpeakerBase::speaker_task, "speaker_task", TASK_STACK_SIZE, (void *) this, TASK_PRIORITY,
+                  &this->speaker_task_handle_);

-        if (this->speaker_task_handle_ == nullptr) {
-          ESP_LOGE(TAG, "Task failed to start, retrying in 1 second");
-          this->status_momentary_error("task-failure", 1000);
-          this->stop_i2s_driver_();  // Stops the driver to return the lock; will be reloaded in next attempt
-        }
+      if (this->speaker_task_handle_ == nullptr) {
+        ESP_LOGE(TAG, "Task failed to start, retrying in 1 second");
+        this->status_momentary_error("task-failure", 1000);
+        this->stop_i2s_driver_();  // Stops the driver to return the lock; will be reloaded in next attempt
      }
      break;
    case speaker::STATE_RUNNING:   // Intentional fallthrough
@@ -218,8 +221,8 @@ size_t I2SAudioSpeakerBase::play(const uint8_t *data, size_t length, TickType_t
 }

 bool I2SAudioSpeakerBase::has_buffered_data() const {
-  if (this->audio_ring_buffer_.use_count() > 0) {
-    std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->audio_ring_buffer_.lock();
+  std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->audio_ring_buffer_.lock();
+  if (temp_ring_buffer != nullptr) {
    return temp_ring_buffer->available() > 0;
  }
  return false;
@@ -129,7 +129,7 @@ void MicroWakeWord::setup() {
      return;
    }
    std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (this->ring_buffer_.use_count() > 1) {
+    if (temp_ring_buffer != nullptr) {
      // Producer-only write: never touches consumer state. If the buffer is full, ask the inference task
      // to drain it - reset() is a consumer operation and must run on the inference task's thread.
      // Disable partial writes so audio chunks are either fully accepted or rejected and handled below.
@@ -446,9 +446,9 @@ void MicroWakeWord::loop() {
    xEventGroupClearBits(this->event_group_, EventGroupBits::TASK_STOPPING);
  }

-  if ((event_group_bits & EventGroupBits::TASK_STOPPED)) {
+  // Retries on a subsequent loop if the task is still running on the other core
+  if ((event_group_bits & EventGroupBits::TASK_STOPPED) && this->inference_task_.deallocate()) {
    ESP_LOGD(TAG, "Inference task is finished, freeing task resources");
-    this->inference_task_.deallocate();
    xEventGroupClearBits(this->event_group_, ALL_BITS);
    xQueueReset(this->detection_queue_);
    this->set_state_(State::STOPPED);
@@ -48,7 +48,7 @@ class MicrophoneSource final {
  template<typename F> void add_data_callback(F &&data_callback) {
    this->mic_->add_data_callback([this, data_callback](const std::vector<uint8_t> &data) {
      if (this->enabled_ || this->passive_) {
-        if (this->processed_samples_.use_count() == 0) {
+        if (this->processed_samples_ == nullptr) {
          // Create vector if its unused
          this->processed_samples_ = std::make_shared<std::vector<uint8_t>>();
        }
@@ -218,7 +218,7 @@ size_t SourceSpeaker::play(const uint8_t *data, size_t length, TickType_t ticks_
  }
  size_t bytes_written = 0;
  std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-  if (temp_ring_buffer.use_count() > 0) {
+  if (temp_ring_buffer != nullptr) {
    // Only write to the ring buffer if the reference is valid
    bytes_written = temp_ring_buffer->write_without_replacement(data, length, ticks_to_wait);
    if (bytes_written > 0) {
@@ -250,14 +250,14 @@ esp_err_t SourceSpeaker::start_() {
  // avoids unnecessary single-frame splices.
  const size_t ring_buffer_size =
      (this->audio_stream_info_.ms_to_bytes(this->buffer_duration_ms_) / bytes_per_frame) * bytes_per_frame;
-  if (this->audio_source_.use_count() == 0) {
+  if (this->audio_source_ == nullptr) {
    std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (!temp_ring_buffer) {
+    if (temp_ring_buffer == nullptr) {
      temp_ring_buffer = ring_buffer::RingBuffer::create(ring_buffer_size);
      this->ring_buffer_ = temp_ring_buffer;
    }

-    if (!temp_ring_buffer) {
+    if (temp_ring_buffer == nullptr) {
      return ESP_ERR_NO_MEM;
    }

@@ -278,7 +278,7 @@ void SourceSpeaker::stop() { this->send_command_(SOURCE_SPEAKER_COMMAND_STOP); }
 void SourceSpeaker::finish() { this->send_command_(SOURCE_SPEAKER_COMMAND_FINISH); }

 bool SourceSpeaker::has_buffered_data() const {
-  return ((this->audio_source_.use_count() > 0) && this->audio_source_->has_buffered_data());
+  return ((this->audio_source_ != nullptr) && this->audio_source_->has_buffered_data());
 }

 void SourceSpeaker::set_mute_state(bool mute_state) {
@@ -382,8 +382,8 @@ void MixerSpeaker::loop() {
    ESP_LOGV(TAG, "Stopping");
    xEventGroupClearBits(this->event_group_, MIXER_TASK_STATE_STOPPING);
  }
-  if (event_group_bits & MIXER_TASK_STATE_STOPPED) {
-    this->task_.deallocate();
+  // Retries on a subsequent loop if the task is still running on the other core
+  if ((event_group_bits & MIXER_TASK_STATE_STOPPED) && this->task_.deallocate()) {
    ESP_LOGD(TAG, "Stopped");
    xEventGroupClearBits(this->event_group_, MIXER_TASK_ALL_BITS);
    this->all_stopped_since_ms_ = 0;
@@ -496,7 +496,7 @@ void MixerSpeaker::audio_mixer_task(void *params) {
        if (speaker->is_running() && !speaker->get_pause_state()) {
          // Speaker is running and not paused, so it possibly can provide audio data
          std::shared_ptr<audio::RingBufferAudioSource> audio_source = speaker->get_audio_source().lock();
-          if (audio_source.use_count() == 0) {
+          if (audio_source == nullptr) {
            // No audio source allocated, so skip processing this speaker
            continue;
          }
@@ -26,44 +26,129 @@ static const uint8_t MLX90614_ID4 = 0x3F;

 static const char *const TAG = "mlx90614";

+// The EEPROM cell has a limited number of write cycles, so stop retrying after a few failures
+static constexpr uint8_t EMISSIVITY_WRITE_ATTEMPTS = 3;
+
+// SMBus packet error code: CRC-8 with polynomial 0x07, MSB first
+static uint8_t crc8_pec(const uint8_t *data, uint8_t len) { return crc8(data, len, 0x00, 0x07, true); }
+
 void MLX90614Component::setup() {
-  if (!this->write_emissivity_()) {
-    ESP_LOGE(TAG, ESP_LOG_MSG_COMM_FAIL);
-    this->mark_failed();
+  if (std::isnan(this->emissivity_)) {
    return;
  }
+  this->emissivity_write_attempts_ = EMISSIVITY_WRITE_ATTEMPTS;
+  this->try_write_emissivity_();
+  if (this->emissivity_write_attempts_ != 0) {
+    this->status_set_warning(LOG_STR("Failed to write emissivity, will retry"));
+  }
+}
+
+void MLX90614Component::try_write_emissivity_() {
+  if (this->emissivity_write_attempts_ == 0) {
+    return;
+  }
+  if (this->write_emissivity_()) {
+    this->emissivity_write_attempts_ = 0;
+    return;
+  }
+  if (--this->emissivity_write_attempts_ == 0) {
+    ESP_LOGE(TAG, "Giving up on writing emissivity after %u attempts", EMISSIVITY_WRITE_ATTEMPTS);
+    this->emissivity_write_failed_ = true;
+  }
 }

 bool MLX90614Component::write_emissivity_() {
-  if (std::isnan(this->emissivity_))
+  // Skip the write when the EEPROM already holds the desired value to save write cycles
+  uint16_t current_emissivity;
+  if (this->read_register_(MLX90614_EMISSIVITY, current_emissivity) != i2c::ERROR_OK) {
+    return false;
+  }
+
+  const auto desired_emissivity = static_cast<uint16_t>(this->emissivity_ * 0xFFFF);
+  if (current_emissivity == desired_emissivity) {
    return true;
-  uint16_t value = (uint16_t) (this->emissivity_ * 65535);
-  if (!this->write_bytes_(MLX90614_EMISSIVITY, 0)) {
-    return false;
  }
-  delay(10);
-  if (!this->write_bytes_(MLX90614_EMISSIVITY, value)) {
-    return false;
-  }
-  delay(10);
-  return true;
+
+  return this->write_register_(MLX90614_EMISSIVITY, desired_emissivity);
 }

-bool MLX90614Component::write_bytes_(uint8_t reg, uint16_t data) {
+bool MLX90614Component::write_register_(uint8_t reg, uint16_t data) {
+  // The PEC covers the whole write transaction: SLA+W, command, data low, data high
  uint8_t buf[5];
  buf[0] = this->address_ << 1;
  buf[1] = reg;
-  buf[2] = data & 0xFF;
-  buf[3] = data >> 8;
-  buf[4] = crc8(buf, 4, 0x00, 0x07, true);
-  return this->write_bytes(reg, buf + 2, 3);
+
+  // See datasheet 8.3.3.1 EEPROM write sequence
+  // 1. Write 0x0000 into the cell of interest (erases the cell)
+  buf[2] = buf[3] = 0;
+  buf[4] = crc8_pec(buf, 4);
+  auto ec = this->write_register(reg, buf + 2, 3);
+  if (ec != i2c::ERROR_OK) {
+    ESP_LOGW(TAG, "Can't erase register 0x%02X, error %d", reg, ec);
+    return false;
+  }
+
+  // 2. Wait at least 5ms
+  delay(10);
+
+  // 3. Write the new value
+  if (data != 0) {
+    buf[2] = data & 0xFF;
+    buf[3] = data >> 8;
+    buf[4] = crc8_pec(buf, 4);
+    ec = this->write_register(reg, buf + 2, 3);
+    if (ec != i2c::ERROR_OK) {
+      ESP_LOGW(TAG, "Can't write register 0x%02X, error %d", reg, ec);
+      return false;
+    }
+    // 4. Wait at least 5ms
+    delay(10);
+  }
+
+  // 5. Read back to confirm the value was stored
+  uint16_t read_back;
+  ec = this->read_register_(reg, read_back);
+  if (ec != i2c::ERROR_OK) {
+    ESP_LOGW(TAG, "Can't check register 0x%02X value, error %d", reg, ec);
+    return false;
+  }
+
+  if (read_back != data) {
+    ESP_LOGW(TAG, "Read back mismatch on register 0x%02X. Expected 0x%04X, got 0x%04X", reg, data, read_back);
+    return false;
+  }
+
+  return true;
+}
+
+i2c::ErrorCode MLX90614Component::read_register_(uint8_t reg, uint16_t &data) {
+  // The PEC covers the whole read transaction: SLA+W, command, SLA+R, data low, data high
+  uint8_t buf[6];
+  buf[0] = this->address_ << 1;
+  buf[1] = reg;
+  buf[2] = (this->address_ << 1) | 0x01;
+
+  const auto ec = this->read_register(reg, buf + 3, 3);
+  if (ec != i2c::ERROR_OK) {
+    ESP_LOGW(TAG, "i2c read error %d", ec);
+    return ec;
+  }
+
+  const auto expected_pec = crc8_pec(buf, 5);
+  if (buf[5] != expected_pec) {
+    ESP_LOGW(TAG, "i2c CRC error. Expected 0x%02X, got 0x%02X", expected_pec, buf[5]);
+    return i2c::ERROR_CRC;
+  }
+
+  data = encode_uint16(buf[4], buf[3]);
+  return i2c::ERROR_OK;
 }

 void MLX90614Component::dump_config() {
  ESP_LOGCONFIG(TAG, "MLX90614:");
  LOG_I2C_DEVICE(this);
-  if (this->is_failed()) {
-    ESP_LOGE(TAG, ESP_LOG_MSG_COMM_FAIL);
+  if (this->emissivity_write_attempts_ != 0) {
+    ESP_LOGW(TAG, "  Emissivity not written yet, will retry");
  }
  LOG_UPDATE_INTERVAL(this);
  LOG_SENSOR("  ", "Ambient", this->ambient_sensor_);
@@ -71,33 +156,41 @@ void MLX90614Component::dump_config() {
 }

 void MLX90614Component::update() {
-  uint8_t emissivity[3];
-  if (this->read_register(MLX90614_EMISSIVITY, emissivity, 3) != i2c::ERROR_OK) {
-    this->status_set_warning();
-    return;
+  // Temperature reads run regardless of the emissivity state so a failure still shows up as NAN
+  this->try_write_emissivity_();
+
+  // Publishes NAN on a bus or CRC failure so a stuck reading is visible instead of silently stale
+  auto publish_sensor = [this](sensor::Sensor *sensor, uint8_t reg) {
+    if (sensor == nullptr) {
+      return i2c::ERROR_OK;
+    }
+
+    uint16_t raw;
+    const auto ec = this->read_register_(reg, raw);
+    if (ec != i2c::ERROR_OK) {
+      sensor->publish_state(NAN);
+      return ec;
+    }
+
+    // Bit 15 set means the device flagged the reading as invalid
+    const float temperature = (raw & 0x8000) ? NAN : raw * 0.02f - 273.15f;
+    ESP_LOGD(TAG, "'%s': Got temperature=%.1f°C", sensor->get_name().c_str(), temperature);
+    sensor->publish_state(temperature);
+    return ec;
+  };
+
+  const auto object_ec = publish_sensor(this->object_sensor_, MLX90614_TEMPERATURE_OBJECT_1);
+  const auto ambient_ec = publish_sensor(this->ambient_sensor_, MLX90614_TEMPERATURE_AMBIENT);
+
+  if (object_ec != i2c::ERROR_OK || ambient_ec != i2c::ERROR_OK) {
+    this->status_set_warning(LOG_STR("Failed to read some sensors"));
+  } else if (this->emissivity_write_failed_) {
+    this->status_set_warning(LOG_STR("Failed to write emissivity"));
+  } else if (this->emissivity_write_attempts_ != 0) {
+    this->status_set_warning(LOG_STR("Failed to write emissivity, will retry"));
+  } else {
+    this->status_clear_warning();
  }
-  uint8_t raw_object[3];
-  if (this->read_register(MLX90614_TEMPERATURE_OBJECT_1, raw_object, 3) != i2c::ERROR_OK) {
-    this->status_set_warning();
-    return;
-  }
-
-  uint8_t raw_ambient[3];
-  if (this->read_register(MLX90614_TEMPERATURE_AMBIENT, raw_ambient, 3) != i2c::ERROR_OK) {
-    this->status_set_warning();
-    return;
-  }
-
-  float ambient = raw_ambient[1] & 0x80 ? NAN : encode_uint16(raw_ambient[1], raw_ambient[0]) * 0.02f - 273.15f;
-  float object = raw_object[1] & 0x80 ? NAN : encode_uint16(raw_object[1], raw_object[0]) * 0.02f - 273.15f;
-
-  ESP_LOGD(TAG, "Got Temperature=%.1f°C Ambient=%.1f°C", object, ambient);
-
-  if (this->ambient_sensor_ != nullptr && !std::isnan(ambient))
-    this->ambient_sensor_->publish_state(ambient);
-  if (this->object_sensor_ != nullptr && !std::isnan(object))
-    this->object_sensor_->publish_state(object);
-  this->status_clear_warning();
 }

 }  // namespace esphome::mlx90614
@@ -18,13 +18,18 @@ class MLX90614Component final : public PollingComponent, public i2c::I2CDevice {
  void set_emissivity(float emissivity) { emissivity_ = emissivity; }

 protected:
+  void try_write_emissivity_();
  bool write_emissivity_();

-  bool write_bytes_(uint8_t reg, uint16_t data);
+  bool write_register_(uint8_t reg, uint16_t data);
+  i2c::ErrorCode read_register_(uint8_t reg, uint16_t &data);

  sensor::Sensor *ambient_sensor_{nullptr};
  sensor::Sensor *object_sensor_{nullptr};

  float emissivity_{NAN};
+  // Remaining attempts to program the emissivity EEPROM cell, bounded to limit cell wear
+  uint8_t emissivity_write_attempts_{0};
+  bool emissivity_write_failed_{false};
 };
 }  // namespace esphome::mlx90614
@@ -26,30 +26,34 @@ namespace esphome::network {

 /// Return whether the node is connected to the network (through wifi, eth, ...)
 ESPHOME_ALWAYS_INLINE inline bool is_connected() {
+  // With a single interface enabled the checks below collapse to `if (x) return true; return false;`, which
+  // clang-tidy wants folded into one return. Keep the per-interface form so every enabled interface is checked.
+  // NOLINTBEGIN(readability-simplify-boolean-expr)
 #ifdef USE_ETHERNET
  if (ethernet::global_eth_component != nullptr && ethernet::global_eth_component->is_connected())
    return true;
 #endif

 #ifdef USE_MODEM
-  if (modem::global_modem_component != nullptr)
-    return modem::global_modem_component->is_connected();
+  if (modem::global_modem_component != nullptr && modem::global_modem_component->is_connected())
+    return true;
 #endif

 #ifdef USE_WIFI
-  if (wifi::global_wifi_component != nullptr)
-    return wifi::global_wifi_component->is_connected();
+  if (wifi::global_wifi_component != nullptr && wifi::global_wifi_component->is_connected())
+    return true;
 #endif

 #ifdef USE_OPENTHREAD
-  if (openthread::global_openthread_component != nullptr)
-    return openthread::global_openthread_component->is_connected();
+  if (openthread::global_openthread_component != nullptr && openthread::global_openthread_component->is_connected())
+    return true;
 #endif

 #ifdef USE_HOST
  return true;  // Assume it's connected
 #endif
  return false;
+  // NOLINTEND(readability-simplify-boolean-expr)
 }

 /// Return whether the network is disabled: every configured interface with a
@@ -88,12 +88,12 @@ def encryption_schema(config: ConfigType | None) -> ConfigType:

 async def to_code(config: ConfigType) -> None:
    cg.add_define("USE_NOISE")
-    cg.add_library("esphome/noise-c", "0.1.24")
+    cg.add_library("esphome/noise-c", "0.1.26")
    # noise-c depends on libsodium, but declaring it here too lets the
    # library manager see the full set up front instead of discovering
    # libsodium only after noise-c has downloaded, so the two can download
    # in parallel. The version must match noise-c's library.json.
-    cg.add_library("esphome/libsodium", "1.10021.6")
+    cg.add_library("esphome/libsodium", "1.10021.8")
    # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
    cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
    cg.add_build_flag("-DHAVE_INLINE_ASM=1")
@@ -153,8 +153,8 @@ void ResamplerSpeaker::loop() {
    ESP_LOGV(TAG, "Stopping");
    xEventGroupClearBits(this->event_group_, ResamplingEventGroupBits::STATE_STOPPING);
  }
-  if (event_group_bits & ResamplingEventGroupBits::STATE_STOPPED) {
-    this->task_.deallocate();
+  // Retries on a subsequent loop if the task is still running on the other core
+  if ((event_group_bits & ResamplingEventGroupBits::STATE_STOPPED) && this->task_.deallocate()) {
    ESP_LOGD(TAG, "Stopped");
    xEventGroupClearBits(this->event_group_, ResamplingEventGroupBits::ALL_BITS);
  }
@@ -235,7 +235,7 @@ size_t ResamplerSpeaker::play(const uint8_t *data, size_t length, TickType_t tic
    bytes_written = this->output_speaker_->play(data, length, ticks_to_wait);
  } else {
    std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (temp_ring_buffer) {
+    if (temp_ring_buffer != nullptr) {
      // Only write to the ring buffer if the reference is valid
      bytes_written = temp_ring_buffer->write_without_replacement(data, length, ticks_to_wait);
    } else {
@@ -299,7 +299,7 @@ bool ResamplerSpeaker::has_buffered_data() const {
  bool has_ring_buffer_data = false;
  if (this->requires_resampling_()) {
    std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (temp_ring_buffer) {
+    if (temp_ring_buffer != nullptr) {
      has_ring_buffer_data = (temp_ring_buffer->available() > 0);
    }
  }
@@ -342,7 +342,7 @@ void ResamplerSpeaker::resample_task(void *params) {
      std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = ring_buffer::RingBuffer::create(
          this_resampler->audio_stream_info_.ms_to_bytes(this_resampler->buffer_duration_ms_));

-      if (!temp_ring_buffer) {
+      if (temp_ring_buffer == nullptr) {
        err = ESP_ERR_NO_MEM;
      } else {
        this_resampler->ring_buffer_ = temp_ring_buffer;
@@ -30,6 +30,7 @@ CONF_SENDSPIN_ID = "sendspin_id"
 CONF_INITIAL_STATIC_DELAY = "initial_static_delay"
 CONF_FIXED_DELAY = "fixed_delay"
 CONF_DECODE_MEMORY = "decode_memory"
+CONF_CODECS = "codecs"

 # Matches ARTWORK_MAX_SLOTS in sendspin-cpp.
 MAX_ARTWORK_SLOTS = 4
@@ -44,6 +45,20 @@ CODEC_FORMAT_OPUS = SendspinCodecFormat.enum("OPUS")
 CODEC_FORMAT_PCM = SendspinCodecFormat.enum("PCM")
 CODEC_FORMAT_UNSUPPORTED = SendspinCodecFormat.enum("UNSUPPORTED")

+CODEC_FLAC = "flac"
+CODEC_OPUS = "opus"
+CODEC_PCM = "pcm"
+
+CODECS = {
+    CODEC_FLAC: CODEC_FORMAT_FLAC,
+    CODEC_OPUS: CODEC_FORMAT_OPUS,
+    CODEC_PCM: CODEC_FORMAT_PCM,
+}
+
+# Opus only supports 48 kHz audio, so it is left out of the default list at other rates.
+DEFAULT_CODECS = [CODEC_FLAC, CODEC_OPUS, CODEC_PCM]
+OPUS_SAMPLE_RATE = 48000
+
 SendspinImageFormat = sendspin_library_ns.enum("SendspinImageFormat", is_class=True)
 IMAGE_FORMAT_JPEG = SendspinImageFormat.enum("JPEG")
 IMAGE_FORMAT_PNG = SendspinImageFormat.enum("PNG")
@@ -286,16 +301,13 @@ async def to_code(config: ConfigType) -> None:
    if data.player_support:
        cg.add_define("USE_SENDSPIN_PLAYER", True)

-        # Configures the player role. We always assume support for 16 bits per sample mono and stereo FLAC, Opus, and PCM at the configured sample rate
-        # (with Opus only supported at 48 kHz since that's the only sample rate it supports). Users can configure the specific formats via the Sendspin server
+        # Configures the player role. Each configured codec is advertised for 16 bits per sample
+        # mono and stereo at the configured sample rate. The order is a preference order, both for
+        # the codecs themselves and for stereo over mono.
        player_cfg = data.player_config
        sample_rate = player_cfg[CONF_SAMPLE_RATE]

-        # OPUS only supports 48 kHz audio
-        codecs = [CODEC_FORMAT_FLAC]
-        if sample_rate == 48000:
-            codecs.append(CODEC_FORMAT_OPUS)
-        codecs.append(CODEC_FORMAT_PCM)
+        codecs = [CODECS[codec] for codec in player_cfg[CONF_CODECS]]

        def _audio_format(codec: MockObj, channels: int) -> cg.StructInitializer:
            return cg.StructInitializer(
@@ -13,11 +13,16 @@ from esphome.cpp_generator import MockObj, TemplateArgsType
 from esphome.types import ConfigType

 from .. import (
+    CODEC_OPUS,
+    CODECS,
+    CONF_CODECS,
    CONF_DECODE_MEMORY,
    CONF_FIXED_DELAY,
    CONF_INITIAL_STATIC_DELAY,
    CONF_SENDSPIN_ID,
+    DEFAULT_CODECS,
    MEMORY_LOCATIONS,
+    OPUS_SAMPLE_RATE,
    SendspinHub,
    register_player_config,
    request_controller_support,
@@ -49,10 +54,32 @@ DisableStaticDelayAdjustmentAction = sendspin_ns.class_(
 )


+def _resolve_codecs(config: ConfigType) -> ConfigType:
+    """Validate the codec preference list, filling in the default when it is not set."""
+    sample_rate = config[CONF_SAMPLE_RATE]
+    if (codecs := config.get(CONF_CODECS)) is None:
+        config[CONF_CODECS] = [
+            codec
+            for codec in DEFAULT_CODECS
+            if codec != CODEC_OPUS or sample_rate == OPUS_SAMPLE_RATE
+        ]
+        return config
+
+    if len(set(codecs)) != len(codecs):
+        raise cv.Invalid("Each codec may only be listed once", path=[CONF_CODECS])
+    if CODEC_OPUS in codecs and sample_rate != OPUS_SAMPLE_RATE:
+        raise cv.Invalid(
+            f"Codec '{CODEC_OPUS}' requires a {CONF_SAMPLE_RATE} of {OPUS_SAMPLE_RATE}",
+            path=[CONF_CODECS],
+        )
+    return config
+
+
 def _register(config: ConfigType) -> ConfigType:
    request_controller_support()
    register_player_config(
        {
+            CONF_CODECS: config[CONF_CODECS],
            CONF_SAMPLE_RATE: config[CONF_SAMPLE_RATE],
            CONF_BUFFER_SIZE: config[CONF_BUFFER_SIZE],
            CONF_INITIAL_STATIC_DELAY: config[CONF_INITIAL_STATIC_DELAY],
@@ -85,9 +112,13 @@ CONFIG_SCHEMA = cv.All(
                min=16000, max=96000
            ),
            cv.Optional(CONF_DECODE_MEMORY): cv.one_of(*MEMORY_LOCATIONS, lower=True),
+            cv.Optional(CONF_CODECS): cv.All(
+                cv.ensure_list(cv.enum(CODECS, lower=True)), cv.Length(min=1)
+            ),
        }
    ),
    cv.only_on_esp32,
+    _resolve_codecs,
    _register,
 )

@@ -202,8 +202,15 @@ AudioPipelineState AudioPipeline::process_state() {
    if (!this->is_playing_) {
      // The tasks have been stopped for two ``process_state`` calls in a row, so delete the tasks
      if (this->read_task_.is_created() || this->decode_task_.is_created()) {
-        this->read_task_.deallocate();
-        this->decode_task_.deallocate();
+        // Both are attempted every time; a task that is still running on the other core is freed by a
+        // subsequent call, and freeing an already freed task succeeds without doing anything
+        bool read_task_freed = this->read_task_.deallocate();
+        bool decode_task_freed = this->decode_task_.deallocate();
+        if (!read_task_freed || !decode_task_freed) {
+          // A task is still running on the other core, so keep the pipeline in its current state and try
+          // again on the next call
+          return AudioPipelineState::PLAYING;
+        }
        if (this->hard_stop_) {
          // Stop command was sent, so immediately end the playback
          this->speaker_->stop();
@@ -315,17 +322,17 @@ void AudioPipeline::read_task(void *params) {
      if (err == ESP_OK) {
        size_t file_ring_buffer_size = this_pipeline->buffer_size_;

-        std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer;
+        std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this_pipeline->raw_file_ring_buffer_.lock();

-        if (!this_pipeline->raw_file_ring_buffer_.use_count()) {
+        if (temp_ring_buffer == nullptr) {
          temp_ring_buffer = ring_buffer::RingBuffer::create(file_ring_buffer_size);
          this_pipeline->raw_file_ring_buffer_ = temp_ring_buffer;
        }

-        if (!this_pipeline->raw_file_ring_buffer_.use_count()) {
+        if (temp_ring_buffer == nullptr) {
          err = ESP_ERR_NO_MEM;
        } else {
-          reader->add_sink(this_pipeline->raw_file_ring_buffer_);
+          err = reader->add_sink(temp_ring_buffer);
        }
      }

@@ -396,7 +403,9 @@ void AudioPipeline::decode_task(void *params) {
          make_unique<audio::AudioDecoder>(this_pipeline->transfer_buffer_size_, this_pipeline->transfer_buffer_size_);

      esp_err_t err = decoder->start(this_pipeline->current_audio_file_type_);
-      decoder->add_source(this_pipeline->raw_file_ring_buffer_);
+      if (err == ESP_OK) {
+        err = decoder->add_source(this_pipeline->raw_file_ring_buffer_);
+      }

      if (err != ESP_OK) {
        // Send specific error message
@@ -2,7 +2,13 @@ from esphome import automation
 import esphome.codegen as cg
 from esphome.components import binary_sensor
 import esphome.config_validation as cv
-from esphome.const import CONF_CONDITION, CONF_ID, CONF_LAMBDA, CONF_STATE
+from esphome.const import (
+    CONF_CONDITION,
+    CONF_DEVICE_CLASS,
+    CONF_ID,
+    CONF_LAMBDA,
+    CONF_STATE,
+)
 from esphome.cpp_generator import LambdaExpression

 from .. import template_ns
@@ -12,7 +18,11 @@ TemplateBinarySensor = template_ns.class_(
 )

 CONFIG_SCHEMA = (
-    binary_sensor.binary_sensor_schema(TemplateBinarySensor)
+    cv.with_visibility(
+        binary_sensor.binary_sensor_schema(TemplateBinarySensor),
+        cv.Visibility.UI,
+        CONF_DEVICE_CLASS,
+    )
    .extend(
        {
            cv.Exclusive(CONF_LAMBDA, CONF_CONDITION): cv.returning_lambda,
@@ -1,10 +1,14 @@
 from esphome.components import button
+import esphome.config_validation as cv
+from esphome.const import CONF_DEVICE_CLASS

 from .. import template_ns

 TemplateButton = template_ns.class_("TemplateButton", button.Button)

-CONFIG_SCHEMA = button.button_schema(TemplateButton)
+CONFIG_SCHEMA = cv.with_visibility(
+    button.button_schema(TemplateButton), cv.Visibility.UI, CONF_DEVICE_CLASS
+)


 async def to_code(config):
@@ -6,6 +6,7 @@ from esphome.const import (
    CONF_ASSUMED_STATE,
    CONF_CLOSE_ACTION,
    CONF_CURRENT_OPERATION,
+    CONF_DEVICE_CLASS,
    CONF_ID,
    CONF_LAMBDA,
    CONF_OPEN_ACTION,
@@ -38,7 +39,11 @@ CONF_HAS_POSITION = "has_position"
 CONF_TOGGLE_ACTION = "toggle_action"

 CONFIG_SCHEMA = (
-    cover.cover_schema(TemplateCover)
+    cv.with_visibility(
+        cover.cover_schema(TemplateCover),
+        cv.Visibility.UI,
+        CONF_DEVICE_CLASS,
+    )
    .extend(
        {
            cv.Optional(CONF_LAMBDA): cv.returning_lambda,
@@ -1,7 +1,7 @@
 import esphome.codegen as cg
 from esphome.components import event
 import esphome.config_validation as cv
-from esphome.const import CONF_EVENT_TYPES
+from esphome.const import CONF_DEVICE_CLASS, CONF_EVENT_TYPES

 from .. import template_ns

@@ -9,7 +9,9 @@ CODEOWNERS = ["@nohat"]

 TemplateEvent = template_ns.class_("TemplateEvent", event.Event, cg.Component)

-CONFIG_SCHEMA = event.event_schema(TemplateEvent).extend(
+CONFIG_SCHEMA = cv.with_visibility(
+    event.event_schema(TemplateEvent), cv.Visibility.UI, CONF_DEVICE_CLASS
+).extend(
    {
        cv.Required(CONF_EVENT_TYPES): cv.ensure_list(cv.string_strict),
    }
@@ -3,6 +3,7 @@ import esphome.codegen as cg
 from esphome.components import number
 import esphome.config_validation as cv
 from esphome.const import (
+    CONF_DEVICE_CLASS,
    CONF_ID,
    CONF_INITIAL_VALUE,
    CONF_LAMBDA,
@@ -12,6 +13,7 @@ from esphome.const import (
    CONF_RESTORE_VALUE,
    CONF_SET_ACTION,
    CONF_STEP,
+    CONF_UNIT_OF_MEASUREMENT,
 )

 from .. import template_ns
@@ -46,7 +48,12 @@ def validate(config):


 CONFIG_SCHEMA = cv.All(
-    number.number_schema(TemplateNumber)
+    cv.with_visibility(
+        number.number_schema(TemplateNumber),
+        cv.Visibility.UI,
+        CONF_DEVICE_CLASS,
+        CONF_UNIT_OF_MEASUREMENT,
+    )
    .extend(
        {
            cv.Required(CONF_MAX_VALUE): cv.float_,
@@ -2,7 +2,16 @@ from esphome import automation
 import esphome.codegen as cg
 from esphome.components import sensor
 import esphome.config_validation as cv
-from esphome.const import CONF_ID, CONF_LAMBDA, CONF_STATE
+from esphome.const import (
+    CONF_ACCURACY_DECIMALS,
+    CONF_DEVICE_CLASS,
+    CONF_FORCE_UPDATE,
+    CONF_ID,
+    CONF_LAMBDA,
+    CONF_STATE,
+    CONF_STATE_CLASS,
+    CONF_UNIT_OF_MEASUREMENT,
+)

 from .. import template_ns

@@ -11,9 +20,14 @@ TemplateSensor = template_ns.class_(
 )

 CONFIG_SCHEMA = (
-    sensor.sensor_schema(
-        TemplateSensor,
-        accuracy_decimals=1,
+    cv.with_visibility(
+        sensor.sensor_schema(TemplateSensor, accuracy_decimals=1),
+        cv.Visibility.UI,
+        CONF_UNIT_OF_MEASUREMENT,
+        CONF_ACCURACY_DECIMALS,
+        CONF_DEVICE_CLASS,
+        CONF_STATE_CLASS,
+        CONF_FORCE_UPDATE,
    )
    .extend(
        {
@@ -4,6 +4,7 @@ from esphome.components import switch
 import esphome.config_validation as cv
 from esphome.const import (
    CONF_ASSUMED_STATE,
+    CONF_DEVICE_CLASS,
    CONF_ID,
    CONF_LAMBDA,
    CONF_OPTIMISTIC,
@@ -31,7 +32,11 @@ def validate(config):


 CONFIG_SCHEMA = cv.All(
-    switch.switch_schema(TemplateSwitch)
+    cv.with_visibility(
+        switch.switch_schema(TemplateSwitch),
+        cv.Visibility.UI,
+        CONF_DEVICE_CLASS,
+    )
    .extend(
        {
            cv.Optional(CONF_LAMBDA): cv.returning_lambda,
@@ -3,7 +3,7 @@ import esphome.codegen as cg
 from esphome.components import text_sensor
 from esphome.components.text_sensor import TextSensorPublishAction
 import esphome.config_validation as cv
-from esphome.const import CONF_ID, CONF_LAMBDA, CONF_STATE
+from esphome.const import CONF_DEVICE_CLASS, CONF_ID, CONF_LAMBDA, CONF_STATE

 from .. import template_ns

@@ -12,7 +12,11 @@ TemplateTextSensor = template_ns.class_(
 )

 CONFIG_SCHEMA = (
-    text_sensor.text_sensor_schema()
+    cv.with_visibility(
+        text_sensor.text_sensor_schema(),
+        cv.Visibility.UI,
+        CONF_DEVICE_CLASS,
+    )
    .extend(
        {
            cv.GenerateID(): cv.declare_id(TemplateTextSensor),
@@ -6,6 +6,7 @@ from esphome.const import (
    CONF_ASSUMED_STATE,
    CONF_CLOSE_ACTION,
    CONF_CURRENT_OPERATION,
+    CONF_DEVICE_CLASS,
    CONF_ID,
    CONF_LAMBDA,
    CONF_OPEN_ACTION,
@@ -36,7 +37,11 @@ CONF_HAS_POSITION = "has_position"
 CONF_TOGGLE_ACTION = "toggle_action"

 CONFIG_SCHEMA = (
-    valve.valve_schema(TemplateValve)
+    cv.with_visibility(
+        valve.valve_schema(TemplateValve),
+        cv.Visibility.UI,
+        CONF_DEVICE_CLASS,
+    )
    .extend(
        {
            cv.Optional(CONF_LAMBDA): cv.returning_lambda,
@@ -12,7 +12,6 @@ from esphome.components.logger import request_log_listener
 from esphome.components.web_server_base import CONF_WEB_SERVER_BASE_ID
 import esphome.config_validation as cv
 from esphome.const import (
-    CONF_AP,
    CONF_AUTH,
    CONF_COMPRESSION,
    CONF_CSS_INCLUDE,
@@ -24,19 +23,15 @@ from esphome.const import (
    CONF_JS_URL,
    CONF_LOCAL,
    CONF_LOG,
-    CONF_MANUAL_IP,
    CONF_NAME,
-    CONF_NETWORKS,
    CONF_OTA,
    CONF_PASSWORD,
    CONF_PORT,
-    CONF_STATIC_IP,
    CONF_TYPE,
    CONF_USERNAME,
    CONF_VERSION,
    CONF_WEB_SERVER,
    CONF_WEB_SERVER_ID,
-    CONF_WIFI,
    PLATFORM_BK72XX,
    PLATFORM_ESP32,
    PLATFORM_ESP8266,
@@ -51,23 +46,7 @@ from esphome.types import ConfigType

 _LOGGER = logging.getLogger(__name__)

-
-def AUTO_LOAD() -> list[str]:
-    # No config parameter on purpose: that would make this a late (dynamic) auto-load and
-    # ota.web_server's dependency on web_server_base would not be satisfied in time.
-    auto_load = ["json", "web_server_base"]
-    # The AP mode DNS server (web_server_base/dns_server_esp32_idf) uses socket; only
-    # configs with a WiFi access point can end up in AP mode. CORE.raw_config is set
-    # after package merging, so a wifi block from a package is visible here.
-    wifi = CORE.raw_config.get(CONF_WIFI) if CORE.raw_config else None
-    if (
-        CORE.is_esp32
-        and wifi is not None
-        and (not isinstance(wifi, dict) or CONF_AP in wifi)
-    ):
-        auto_load.append("socket")
-    return auto_load
-
+AUTO_LOAD = ["json", "web_server_base"]

 AUTH_TYPE_BASIC = "basic"
 AUTH_TYPE_DIGEST = "digest"
@@ -226,6 +205,9 @@ def _final_validate_sorting(config: ConfigType) -> None:
        )


+FINAL_VALIDATE_SCHEMA = _final_validate_sorting
+
+
 def _consume_web_server_sockets(config: ConfigType) -> ConfigType:
    """Register socket needs for web_server component."""
    from esphome.components import socket
@@ -352,95 +334,6 @@ async def add_entity_config(entity: MockObj, config: ConfigType) -> None:
    )


-def wifi_is_ap_only(wifi_config: ConfigType | None) -> bool:
-    """AP only: an access point and no network to join, so the device is only ever reached
-    through its own AP."""
-    return (
-        wifi_config is not None
-        and CONF_AP in wifi_config
-        and not wifi_config.get(CONF_NETWORKS)
-    )
-
-
-def serve_local(config: ConfigType, wifi_config: ConfigType | None) -> bool:
-    """Embed the interface unless ``local:`` says otherwise; AP only WiFi has no internet
-    for the hosted page. Version 1 has no local mode."""
-    if (local := config.get(CONF_LOCAL)) is not None:
-        return local
-    return config[CONF_VERSION] != 1 and wifi_is_ap_only(wifi_config)
-
-
-def serve_captive(config: ConfigType, full_config: ConfigType) -> bool:
-    """web_server runs its own captive portal while the AP is up: embedded interface plus
-    an access point, unless captive_portal (which owns that role) is configured. Only on
-    port 80: the OS captive portal probes and the DHCP portal URI always use port 80, so
-    a portal on another port could never be discovered."""
-    wifi_config = full_config.get(CONF_WIFI)
-    return (
-        "captive_portal" not in full_config
-        and config[CONF_PORT] == 80
-        and wifi_config is not None
-        and CONF_AP in wifi_config
-        and serve_local(config, wifi_config)
-    )
-
-
-def _final_validate_ap_mode(config: ConfigType) -> None:
-    full_config = fv.full_config.get()
-    wifi_config = full_config.get(CONF_WIFI)
-    captive = serve_captive(config, full_config)
-    local = serve_local(config, wifi_config)
-    if captive:
-        web_server_base.consume_captive_dns_sockets(config, "web_server")
-    # Surface behavior that the config does not spell out.
-    if local and CONF_LOCAL not in config:
-        _LOGGER.info(
-            "WiFi is AP only: embedding the web interface in the firmware "
-            "(local: true, roughly 13 KB of flash for version 2, 78 KB for version 3)%s. "
-            "Set 'local: false' to load it from the internet instead.",
-            " and serving it as a captive portal on the access point"
-            if captive
-            else "",
-        )
-    elif captive:
-        _LOGGER.info(
-            "web_server will act as a captive portal while the %saccess point is active.",
-            "" if wifi_is_ap_only(wifi_config) else "fallback ",
-        )
-    if not wifi_is_ap_only(wifi_config):
-        return
-    if not local:
-        _LOGGER.warning(
-            "WiFi is AP only and the web_server interface is loaded from the internet, "
-            "which browsers on the access point usually cannot reach; the page stays "
-            "blank. %s so the interface is embedded in the firmware.",
-            "Remove 'local: false'"
-            if config.get(CONF_LOCAL) is False
-            else "Migrate to version 2 or 3",
-        )
-    elif config[CONF_PORT] != 80:
-        ap_ip = "192.168.4.1"
-        if (manual_ip := wifi_config[CONF_AP].get(CONF_MANUAL_IP)) is not None:
-            ap_ip = str(manual_ip[CONF_STATIC_IP])
-        _LOGGER.warning(
-            "WiFi is AP only and web_server uses port %d. The interface cannot open "
-            "automatically on the access point (captive portal detection only works on "
-            "port 80); open http://%s:%d/ manually, or remove 'port:' to use 80.",
-            config[CONF_PORT],
-            ap_ip,
-            config[CONF_PORT],
-        )
-
-
-def _final_validate(config: ConfigType) -> None:
-    # Called one after the other rather than via cv.All: these return None.
-    _final_validate_sorting(config)
-    _final_validate_ap_mode(config)
-
-
-FINAL_VALIDATE_SCHEMA = _final_validate
-
-
 def build_index_html(config: ConfigType) -> str:
    html = "<!DOCTYPE html><html><head><meta charset=UTF-8><link rel=icon href=data:>"
    css_include = config.get(CONF_CSS_INCLUDE)
@@ -541,12 +434,8 @@ async def to_code(config: ConfigType) -> None:
        with path.open(encoding="utf-8") as js_file:
            add_resource_as_progmem("JS_INCLUDE", js_file.read())
    cg.add(var.set_include_internal(config[CONF_INCLUDE_INTERNAL]))
-    if serve_local(config, CORE.config.get(CONF_WIFI)):
+    if CONF_LOCAL in config and config[CONF_LOCAL]:
        cg.add_define("USE_WEBSERVER_LOCAL")
-    if serve_captive(config, CORE.config):
-        # AP mode: DNS server plus redirect of unknown URLs so phones open the interface
-        cg.add_define("USE_WEBSERVER_CAPTIVE")
-        web_server_base.add_captive_dns_library()
    if config[CONF_COMPRESSION] == "gzip":
        cg.add_define("USE_WEBSERVER_GZIP")

@@ -44,10 +44,6 @@
 #include "esphome/components/radio_frequency/radio_frequency.h"
 #endif

-#ifdef USE_WEBSERVER_CAPTIVE
-#include "esphome/components/wifi/wifi_component.h"
-#endif
-
 #ifdef USE_WEBSERVER_LOCAL
 #if USE_WEBSERVER_VERSION == 2
 #include "server_index_v2.h"
@@ -338,15 +334,7 @@ void DeferredUpdateEventSourceList::on_client_disconnect_(DeferredUpdateEventSou
 }
 #endif

-#ifdef USE_WEBSERVER_CAPTIVE
-WebServer *global_web_server = nullptr;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
-#endif
-
-WebServer::WebServer(web_server_base::WebServerBase *base) : base_(base) {
-#ifdef USE_WEBSERVER_CAPTIVE
-  global_web_server = this;
-#endif
-}
+WebServer::WebServer(web_server_base::WebServerBase *base) : base_(base) {}

 #ifdef USE_WEBSERVER_CSS_INCLUDE
 void WebServer::set_css_include(const char *css_include) { this->css_include_ = css_include; }
@@ -392,11 +380,6 @@ void WebServer::setup() {
  this->base_->add_handler(&this->events_);
 #endif
  this->base_->add_handler(this);
-#ifdef USE_WEBSERVER_CAPTIVE
-  // Not-found fallback (outside the auth middleware): the OS captive portal probes hit
-  // arbitrary URLs and must get the redirect without credentials.
-  this->base_->get_server()->onNotFound([this](AsyncWebServerRequest *request) { this->handle_not_found_(request); });
-#endif

  // OTA is now handled by the web_server OTA platform

@@ -412,52 +395,16 @@ void WebServer::setup() {
  });
 }
 void WebServer::loop() {
-  bool keep_looping = this->events_.loop();
-#ifdef USE_WEBSERVER_CAPTIVE
-  this->dns_.loop();
-  keep_looping |= this->dns_.is_running();
-#endif
-  // No SSE clients connected (and no captive DNS to serve); stop looping until a new client connects via
+  // No SSE clients connected; stop looping until a new client connects via
  // enable_loop_soon_any_context(). This is safe because:
  // - set_interval/set_timeout/defer run via the Scheduler, independent of loop()
  // - deferrable_send_state early-outs when no clients are connected
  // - try_send_nodefer (log, ping) iterates sessions which are empty
  // - REST API handlers use defer() which runs via the Scheduler
-  if (!keep_looping)
+  if (!this->events_.loop())
    this->disable_loop();
 }

-#ifdef USE_WEBSERVER_CAPTIVE
-void WebServer::start_captive() {
-  // CaptiveDNS::start() no-ops too; this guard just avoids repeating the log and enable_loop
-  if (this->dns_.is_running())
-    return;
-  network::IPAddress ip = wifi::global_wifi_component->wifi_soft_ap_ip();
-  this->dns_.start(ip);
-  this->enable_loop();
-  char ip_buf[network::IP_ADDRESS_BUFFER_SIZE];
-  ESP_LOGI(TAG, "AP mode: serving the web interface as captive portal at http://%s/", ip.str_to(ip_buf));
-}
-
-void WebServer::end_captive() { this->dns_.stop(); }
-
-void WebServer::handle_not_found_(AsyncWebServerRequest *request) {
-  // OS captive portal probe (or any other unknown page) while the AP is up: send the browser
-  // to the real page. A redirect rather than the page itself, because the interface resolves
-  // its /events and REST paths relative to the page URL.
-  if (this->dns_.is_running() && request->method() == HTTP_GET) {
-    // Captive mode requires port 80 (enforced at validation), so no port suffix is needed.
-    char location[7 + network::IP_ADDRESS_BUFFER_SIZE + 1];
-    size_t pos = buf_append_str(location, sizeof(location), 0, "http://");
-    wifi::global_wifi_component->wifi_soft_ap_ip().str_to(location + pos);
-    buf_append_str(location, sizeof(location), strlen(location), "/");
-    request->redirect(location);
-    return;
-  }
-  request->send(404);
-}
-#endif
-
 #ifdef USE_LOGGER
 void WebServer::on_log(uint8_t level, const char *tag, const char *message, size_t message_len) {
  (void) level;
@@ -4,9 +4,6 @@

 #include "esphome/components/json/json_util.h"
 #include "esphome/components/web_server_base/web_server_base.h"
-#ifdef USE_WEBSERVER_CAPTIVE
-#include "esphome/components/web_server_base/captive_dns.h"
-#endif
 #ifdef USE_WEBSERVER
 #include "esphome/core/component.h"
 #include "esphome/core/controller.h"
@@ -279,18 +276,6 @@ class WebServer final : public Controller, public Component, public AsyncWebHand
  /// Handle an index request under '/'.
  void handle_index_request(AsyncWebServerRequest *request);

-#ifdef USE_WEBSERVER_CAPTIVE
-  /** AP mode: run a DNS server that answers every name with the AP address and redirect any
-   * unknown URL to the interface, so a phone joining the AP opens it through the OS captive
-   * portal check. Started and ended by the wifi component with the access point. start may run
-   * before setup() (wifi sets up first): safe because enable_loop() is a no-op before setup;
-   * nothing but the DNS server may be touched, in particular not base_ or the handlers.
-   */
-  void start_captive();
-  void end_captive();
-  bool is_captive() const { return this->dns_.is_running(); }
-#endif
-
  /// Return the webserver configuration as JSON.
  json::SerializationBuffer<> get_config_json();

@@ -612,10 +597,6 @@ class WebServer final : public Controller, public Component, public AsyncWebHand
 #elif USE_ARDUINO
  DeferredUpdateEventSourceList events_;
 #endif
-#ifdef USE_WEBSERVER_CAPTIVE
-  void handle_not_found_(AsyncWebServerRequest *request);
-  web_server_base::CaptiveDNS dns_;
-#endif

 #if USE_WEBSERVER_VERSION == 1
  const char *css_url_{nullptr};
@@ -715,9 +696,5 @@ class WebServer final : public Controller, public Component, public AsyncWebHand
 #endif
 };

-#ifdef USE_WEBSERVER_CAPTIVE
-extern WebServer *global_web_server;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
-#endif
-
 }  // namespace esphome::web_server
 #endif
@@ -1,9 +1,8 @@
 from pathlib import Path

 import esphome.codegen as cg
-from esphome.config_helpers import filter_source_files_from_platform
 import esphome.config_validation as cv
-from esphome.const import CONF_ID, PlatformFramework
+from esphome.const import CONF_ID
 from esphome.core import CORE, coroutine_with_priority
 from esphome.coroutine import CoroPriority
 from esphome.helpers import copy_file_if_changed
@@ -27,22 +26,6 @@ WebServerBase = web_server_base_ns.class_("WebServerBase")
 CONF_WEB_SERVER_BASE_ID = "web_server_base_id"


-def consume_captive_dns_sockets(config: ConfigType, name: str) -> None:
-    """Register the sockets a captive portal needs on top of the shared HTTP server:
-    1 UDP socket for the DNS server and 3 TCP sockets for the OS captive portal probes,
-    which make several requests that linger in TIME_WAIT."""
-    from esphome.components import socket
-
-    socket.consume_sockets(3, name)(config)
-    socket.consume_sockets(1, name, socket.SocketType.UDP)(config)
-
-
-def add_captive_dns_library() -> None:
-    """Pull in the Arduino DNSServer library used by CaptiveDNS off ESP32."""
-    if CORE.using_arduino and (CORE.is_esp8266 or CORE.is_libretiny or CORE.is_rp2):
-        cg.add_library("DNSServer", None)
-
-
 def _consume_web_server_base_sockets(config: ConfigType) -> ConfigType:
    """Register the shared listening socket for the HTTP server.

@@ -98,15 +81,3 @@ async def to_code(config: ConfigType) -> None:
            cg.add_platformio_option("extra_scripts", ["pre:fix_rp2040_hash.py"])
        # https://github.com/ESP32Async/ESPAsyncWebServer/blob/main/library.json
        cg.add_library("ESP32Async/ESPAsyncWebServer", "3.9.6")
-
-
-# The DNS server used for captive portals on ESP32; other platforms use the Arduino
-# DNSServer library. Its source is also guarded by USE_CAPTIVE_PORTAL / USE_WEBSERVER_CAPTIVE.
-FILTER_SOURCE_FILES = filter_source_files_from_platform(
-    {
-        "dns_server_esp32_idf.cpp": {
-            PlatformFramework.ESP32_ARDUINO,
-            PlatformFramework.ESP32_IDF,
-        },
-    }
-)
@@ -1,58 +0,0 @@
-#pragma once
-#include "esphome/core/defines.h"
-// DNS server that answers every name with the access point address, so a phone joining the
-// AP runs its captive portal check against the device. Shared by captive_portal and the
-// web_server AP mode; hides the ESP32 (own implementation) vs Arduino (DNSServer library) split.
-#if defined(USE_CAPTIVE_PORTAL) || defined(USE_WEBSERVER_CAPTIVE)
-#include <memory>
-
-#include "esphome/components/network/ip_address.h"
-#include "esphome/core/helpers.h"
-#include "esphome/core/progmem.h"
-#if defined(USE_ESP32)
-#include "dns_server_esp32_idf.h"
-#elif defined(USE_ARDUINO)
-#include <DNSServer.h>
-#endif
-
-namespace esphome::web_server_base {
-
-// The server object only exists while running, so an idle owner (AP not up) pays one pointer.
-class CaptiveDNS {
- public:
-  void start(const network::IPAddress &ip) {
-    if (this->dns_server_ != nullptr)
-      return;
-    this->dns_server_ = make_unique<DNSServer>();
-#if defined(USE_ESP32)
-    this->dns_server_->start(ip);
-#elif defined(USE_ARDUINO)
-    this->dns_server_->setErrorReplyCode(DNSReplyCode::NoError);
-    this->dns_server_->start(53, ESPHOME_F("*"), ip);
-#endif
-  }
-  void stop() {
-    if (this->dns_server_ == nullptr)
-      return;
-    this->dns_server_->stop();
-    this->dns_server_ = nullptr;
-  }
-  /// Answer one pending query; call from the owner's loop() while running.
-  void loop() {
-    if (this->dns_server_ == nullptr)
-      return;
-#if defined(USE_ESP32)
-    this->dns_server_->process_next_request();
-#elif defined(USE_ARDUINO)
-    this->dns_server_->processNextRequest();
-#endif
-  }
-  bool is_running() const { return this->dns_server_ != nullptr; }
-
- protected:
-  // ESP32: web_server_base::DNSServer from dns_server_esp32_idf.h; Arduino: the library class.
-  std::unique_ptr<DNSServer> dns_server_;
-};
-
-}  // namespace esphome::web_server_base
-#endif  // USE_CAPTIVE_PORTAL || USE_WEBSERVER_CAPTIVE
@@ -325,9 +325,9 @@ StringRef AsyncWebServerRequest::url_to(std::span<char, URL_BUF_SIZE> buffer) co
  return StringRef(buffer.data(), decoded_len);
 }

-void AsyncWebServerRequest::redirect(const char *url) {
+void AsyncWebServerRequest::redirect(const std::string &url) {
  httpd_resp_set_status(*this, "302 Found");
-  httpd_resp_set_hdr(*this, "Location", url);
+  httpd_resp_set_hdr(*this, "Location", url.c_str());
  httpd_resp_set_hdr(*this, "Connection", "close");
  httpd_resp_send(*this, nullptr, 0);
 }
@@ -126,8 +126,7 @@ class AsyncWebServerRequest {
  void requestAuthentication() const;
 #endif

-  void redirect(const char *url);
-  void redirect(const std::string &url) { this->redirect(url.c_str()); }
+  void redirect(const std::string &url);

  inline void ESPHOME_ALWAYS_INLINE send(AsyncWebServerResponse *response) {
    httpd_resp_send(*this, response->get_content_data(), response->get_content_size());
@@ -36,9 +36,6 @@
 #ifdef USE_CAPTIVE_PORTAL
 #include "esphome/components/captive_portal/captive_portal.h"
 #endif
-#ifdef USE_WEBSERVER_CAPTIVE
-#include "esphome/components/web_server/web_server.h"
-#endif

 #ifdef USE_IMPROV
 #include "esphome/components/esp32_improv/esp32_improv_component.h"
@@ -744,9 +741,9 @@ void WiFiComponent::start() {
    if (captive_portal::global_captive_portal != nullptr) {
      this->wifi_sta_pre_setup_();
      this->start_scanning();
+      captive_portal::global_captive_portal->start();
    }
 #endif
-    this->start_ap_portal_();
 #endif  // USE_WIFI_AP
  }
 #ifdef USE_IMPROV
@@ -807,8 +804,8 @@ void WiFiComponent::loop() {
          this->check_connecting_finished(now);
          break;
        }
-        // Use longer cooldown when a portal/improv is active to avoid disrupting a user on the AP
-        bool portal_active = this->is_ap_portal_active_() || this->is_esp32_improv_active_();
+        // Use longer cooldown when captive portal/improv is active to avoid disrupting user config
+        bool portal_active = this->is_captive_portal_active_() || this->is_esp32_improv_active_();
        uint32_t cooldown_duration = portal_active ? WIFI_COOLDOWN_WITH_AP_ACTIVE_MS : WIFI_COOLDOWN_DURATION_MS;
        if (now - this->action_started_ > cooldown_duration) {
          // After cooldown we either restarted the adapter because of
@@ -886,11 +883,13 @@ void WiFiComponent::loop() {
        ESP_LOGI(TAG, "Starting fallback AP");
        this->setup_ap_config_();
 #ifdef USE_CAPTIVE_PORTAL
-        // Reset so we force one full scan after captive portal starts
-        // (previous scans were filtered because captive portal wasn't active yet)
-        this->has_completed_scan_after_captive_portal_start_ = false;
+        if (captive_portal::global_captive_portal != nullptr) {
+          // Reset so we force one full scan after captive portal starts
+          // (previous scans were filtered because captive portal wasn't active yet)
+          this->has_completed_scan_after_captive_portal_start_ = false;
+          captive_portal::global_captive_portal->start();
+        }
 #endif
-        this->start_ap_portal_();
      }
    }
 #endif  // USE_WIFI_AP
@@ -1637,8 +1636,10 @@ void WiFiComponent::check_connecting_finished(uint32_t now) {
    this->retry_phase_ = WiFiRetryPhase::INITIAL_CONNECT;
    this->num_retried_ = 0;
    if (this->has_ap()) {
-#ifdef USE_WIFI_AP
-      this->end_ap_portal_();
+#ifdef USE_CAPTIVE_PORTAL
+      if (this->is_captive_portal_active_()) {
+        captive_portal::global_captive_portal->end();
+      }
 #endif
      ESP_LOGD(TAG, "Disabling AP");
      this->wifi_mode_({}, false);
@@ -1965,10 +1966,10 @@ bool WiFiComponent::transition_to_phase_(WiFiRetryPhase new_phase) {
      break;

    case WiFiRetryPhase::RESTARTING_ADAPTER:
-      // Skip actual adapter restart if a portal/improv is active
+      // Skip actual adapter restart if captive portal/improv is active
      // This allows state machine to reset num_retried_ and trigger fresh scan
-      // without disrupting the portal/improv connection
-      if (!this->is_ap_portal_active_() && !this->is_esp32_improv_active_()) {
+      // without disrupting the captive portal/improv connection
+      if (!this->is_captive_portal_active_() && !this->is_esp32_improv_active_()) {
        this->restart_adapter();
      } else {
        // Even when skipping full restart, disconnect to clear driver state
@@ -2227,38 +2228,6 @@ bool WiFiComponent::is_captive_portal_active_() {
  return false;
 #endif
 }
-
-bool WiFiComponent::is_ap_portal_active_() {
-#ifdef USE_WEBSERVER_CAPTIVE
-  if (web_server::global_web_server->is_captive())
-    return true;
-#endif
-  return this->is_captive_portal_active_();
-}
-
-#ifdef USE_WIFI_AP
-// global_web_server needs no null check: codegen always instantiates WebServer when
-// USE_WEBSERVER_CAPTIVE is defined, and the constructor assigns the global.
-void WiFiComponent::start_ap_portal_() {
-#ifdef USE_CAPTIVE_PORTAL
-  if (captive_portal::global_captive_portal != nullptr)
-    captive_portal::global_captive_portal->start();
-#endif
-#ifdef USE_WEBSERVER_CAPTIVE
-  web_server::global_web_server->start_captive();
-#endif
-}
-
-void WiFiComponent::end_ap_portal_() {
-#ifdef USE_CAPTIVE_PORTAL
-  if (this->is_captive_portal_active_())
-    captive_portal::global_captive_portal->end();
-#endif
-#ifdef USE_WEBSERVER_CAPTIVE
-  web_server::global_web_server->end_captive();
-#endif
-}
-#endif  // USE_WIFI_AP
 bool WiFiComponent::is_esp32_improv_active_() {
 #ifdef USE_IMPROV
  return esp32_improv::global_improv_component != nullptr && esp32_improv::global_improv_component->is_active();
@@ -797,12 +797,6 @@ class WiFiComponent final : public Component {
  network::IPAddress wifi_dns_ip_(int num);

  bool is_captive_portal_active_();
-  /// captive_portal or the web_server AP mode is serving a user on the access point
-  bool is_ap_portal_active_();
-#ifdef USE_WIFI_AP
-  void start_ap_portal_();
-  void end_ap_portal_();
-#endif
  bool is_esp32_improv_active_();

 #ifdef USE_WIFI_FAST_CONNECT
@@ -1130,16 +1130,10 @@ bool WiFiComponent::wifi_ap_ip_config_(const optional<ManualIP> &manual_ip) {
    return false;
  }

-#if (defined(USE_CAPTIVE_PORTAL) || defined(USE_WEBSERVER_CAPTIVE)) && ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 4, 0)
-  // Configure DHCP Option 114 (Captive Portal URI) if captive portal or the web_server AP
-  // mode is enabled. This provides a standards-compliant way for clients to discover the portal
-#ifdef USE_WEBSERVER_CAPTIVE
-  // web_server AP mode always serves the portal when compiled in
-  const bool has_portal = true;
-#else
-  const bool has_portal = captive_portal::global_captive_portal != nullptr;
-#endif
-  if (has_portal) {
+#if defined(USE_CAPTIVE_PORTAL) && ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 4, 0)
+  // Configure DHCP Option 114 (Captive Portal URI) if captive portal is enabled
+  // This provides a standards-compliant way for clients to discover the captive portal
+  if (captive_portal::global_captive_portal != nullptr) {
    // Buffer must be static - dhcps_set_option_info stores pointer, doesn't copy
    static char captive_portal_uri[24];        // "http://" (7) + IPv4 max (15) + null
    memcpy(captive_portal_uri, "http://", 7);  // NOLINT(bugprone-not-null-terminated-result) - str_to null-terminates
@@ -4,6 +4,7 @@ from __future__ import annotations

 from collections.abc import Callable
 from contextlib import contextmanager, suppress
+import copy
 from datetime import datetime
 from ipaddress import (
    AddressValueError,
@@ -419,6 +420,37 @@ class Required(vol.Required):
        self.visibility: Visibility | None = visibility


+def with_visibility(schema: Schema, visibility: Visibility, *keys: str) -> Schema:
+    """Return a copy of ``schema`` with the given ``keys`` re-marked at ``visibility``.
+
+    Lets a platform override the editor :class:`Visibility` of fields it
+    inherits from a shared schema builder — without that builder needing a
+    visibility parameter of its own. The canonical use is a ``template``
+    platform promoting the value metadata its user is expected to define
+    (``device_class``, ``unit_of_measurement``, …) onto the main form:
+
+        CONFIG_SCHEMA = cv.with_visibility(
+            sensor.sensor_schema(TemplateSensor),
+            cv.Visibility.UI,
+            CONF_DEVICE_CLASS, CONF_UNIT_OF_MEASUREMENT,
+        )
+
+    The original marker's key, default and validator are preserved; only the
+    visibility changes, and the input ``schema`` is left untouched. Raises if
+    a requested key is not present so typos fail at schema-build time.
+    """
+    wanted = {str(k) for k in keys}
+    overrides = {}
+    for marker, validator in schema.schema.items():
+        if str(marker) in wanted:
+            marker = copy.copy(marker)
+            marker.visibility = visibility
+            overrides[marker] = validator
+    if missing := wanted - {str(m) for m in overrides}:
+        raise ValueError(f"with_visibility: keys not in schema: {sorted(missing)}")
+    return schema.extend(overrides)
+
+
 class FinalExternalInvalid(Invalid):
    """Represents an invalid value in the final validation phase where the path should not be prepended."""

@@ -371,7 +371,6 @@
 #define USE_WEBSERVER
 #define USE_WEBSERVER_AUTH
 #define USE_WEBSERVER_AUTH_DIGEST
-#define USE_WEBSERVER_CAPTIVE
 #define USE_WEBSERVER_OTA
 #define USE_WEBSERVER_PORT 80  // NOLINT
 #define USE_WEBSERVER_GZIP
@@ -485,7 +484,6 @@
 #define USE_WEBSERVER
 #define USE_WEBSERVER_AUTH
 #define USE_WEBSERVER_AUTH_DIGEST
-#define USE_WEBSERVER_CAPTIVE
 #define USE_WEBSERVER_PORT 80  // NOLINT
 #endif

@@ -543,7 +541,6 @@
 #define USE_WEBSERVER
 #define USE_WEBSERVER_AUTH
 #define USE_WEBSERVER_AUTH_DIGEST
-#define USE_WEBSERVER_CAPTIVE
 #define USE_WEBSERVER_PORT 80  // NOLINT
 #define USE_ESPHOME_TASK_LOG_BUFFER
 #define ESPHOME_TASK_LOG_BUFFER_SIZE 768
@@ -40,16 +40,31 @@ bool StaticTask::create(TaskFunction_t fn, const char *name, uint32_t stack_size
  return true;
 }

-void StaticTask::destroy() {
-  if (this->handle_ != nullptr) {
-    TaskHandle_t handle = this->handle_;
-    this->handle_ = nullptr;
-    vTaskDelete(handle);
+bool StaticTask::destroy() {
+  if (this->handle_ == nullptr) {
+    return true;
  }
+
+  // Suspending takes the task off the ready and event lists, so nothing can schedule it again. It only asks
+  // the other core to yield though, so the task may still be running on it for a moment.
+  vTaskSuspend(this->handle_);
+  if (eTaskGetState(this->handle_) != eSuspended) {
+    // The task is still running on the other core and using its stack. Deleting it now would only put it on
+    // the termination list and return, so the caller has to try again once it has been swapped out.
+    return false;
+  }
+
+  // The task cannot run again, so the delete completes right away instead of being left to the idle task.
+  TaskHandle_t handle = this->handle_;
+  this->handle_ = nullptr;
+  vTaskDelete(handle);
+  return true;
 }

-void StaticTask::deallocate() {
-  this->destroy();
+bool StaticTask::deallocate() {
+  if (!this->destroy()) {
+    return false;
+  }
  if (this->stack_buffer_ != nullptr) {
    RAMAllocator<StackType_t> allocator(this->use_psram_ ? RAMAllocator<StackType_t>::ALLOC_EXTERNAL
                                                         : RAMAllocator<StackType_t>::ALLOC_INTERNAL);
@@ -57,6 +72,7 @@ void StaticTask::deallocate() {
    this->stack_buffer_ = nullptr;
    this->stack_size_ = 0;
  }
+  return true;
 }

 }  // namespace esphome
@@ -11,6 +11,7 @@ namespace esphome {

 /** Helper for FreeRTOS static task management.
 * Bundles TaskHandle_t, StaticTask_t, and the stack buffer into one object with create/destroy methods.
+ * Call destroy() and deallocate() from another task: a task cannot free the stack it is still running on.
 */
 class StaticTask {
 public:
@@ -23,7 +24,7 @@ class StaticTask {
  /// @brief Allocate stack and create task.
  /// @param fn         Task function
  /// @param name       Task name (for debug)
-  /// @param stack_size Stack size in StackType_t words
+  /// @param stack_size Stack size in bytes (StackType_t is a byte on ESP-IDF)
  /// @param param      Parameter passed to task function
  /// @param priority   FreeRTOS task priority
  /// @param use_psram  If true, allocate stack in PSRAM; otherwise internal RAM
@@ -31,11 +32,17 @@ class StaticTask {
  bool create(TaskFunction_t fn, const char *name, uint32_t stack_size, void *param, UBaseType_t priority,
              bool use_psram);

-  /// @brief Delete the task but keep the stack buffer allocated for reuse by a subsequent create() call.
-  void destroy();
+  /// @brief Delete the task, keeping the stack buffer allocated for reuse by a subsequent create() call.
+  /// The task must have finished its work and parked itself, either suspended or blocked indefinitely: it is
+  /// suspended here so that it cannot be scheduled again, and it is given no chance to clean up.
+  /// @return true if the task was deleted; false if it is still running on another core, in which case the
+  /// caller should try again later.
+  bool destroy();

-  /// @brief Delete the task (if running) and free the stack buffer.
-  void deallocate();
+  /// @brief Delete the task (if created) and free the stack buffer.
+  /// @return true if the stack buffer was freed; false if the task is still running on another core, in
+  /// which case the caller should try again later.
+  bool deallocate();

 protected:
  TaskHandle_t handle_{nullptr};
@@ -96,6 +96,10 @@ UPLOAD_BUFFER_SIZE = UPLOAD_BLOCK_SIZE * 8
 # across the addresses on top of that.
 EXTRA_UPLOAD_ATTEMPTS = 2
 UPLOAD_RETRY_DELAY = 5.0
+# Data phase timeout; must stay longer than the device's OTA_SOCKET_TIMEOUT_DATA
+# (105 s) so a stalled session is gone before a retry, and long enough for lwIP
+# to get a lost chunk ack through after the retransmit run seen in practice
+DATA_PHASE_TIMEOUT = 160.0

 _LOGGER = logging.getLogger(__name__)

@@ -694,8 +698,7 @@ def perform_ota(

    _LOGGER.info("Handshake complete")

-    # Timeout must match device-side OTA_SOCKET_TIMEOUT_DATA to prevent premature failures
-    sock.settimeout(90.0)
+    sock.settimeout(DATA_PHASE_TIMEOUT)

    if extended_proto:
        send_check(sock, ota_type, "ota type")
@@ -854,7 +857,7 @@ def run_ota_impl_(
    # clean up a half-open connection (its handshake watchdog runs at 20s);
    # moving on to the next address family stays immediate. Known limitation:
    # a silent mid-transfer drop with no reset can wedge the device until its
-    # 90s data timeout, which outlasts this budget; the retries target the
+    # 105s data timeout, which outlasts this budget; the retries target the
    # common failures where the device resets or closes the link promptly.
    total_attempts = len(res) + EXTRA_UPLOAD_ATTEMPTS
    last_error = ""
@@ -45,7 +45,7 @@ lib_deps_base =
 lib_deps =
    ${common.lib_deps_base}
    https://github.com/dudanov/MideaUART.git#eeea6c3e9b4474f067054592b435be1c4e466815 ; midea
-    esphome/noise-c@0.1.24                 ; noise (api, ota)
+    esphome/noise-c@0.1.26                 ; noise (api, ota)
    improv/Improv@1.2.7                    ; improv_serial / esp32_improv
    kikuchan98/pngle@1.1.0                 ; online_image
    ; Using the repository directly, otherwise ESP-IDF can't use the library
@@ -244,7 +244,7 @@ lib_deps =
    ${common:idf-component-libs.lib_deps}
    ESP32Async/ESPAsyncWebServer@3.9.6    ; web_server_base
    droscy/esp_wireguard@0.4.5            ; wireguard
-    esphome/noise-c@0.1.24                ; noise (api, ota)
+    esphome/noise-c@0.1.26                ; noise (api, ota)
    ESP32Async/AsyncTCP@3.4.5             ; async_tcp
    DNSServer                             ; captive_portal
    heman/AsyncMqttClient-esphome@2.0.0   ; mqtt
@@ -641,7 +641,7 @@ build_unflags =
 extends = common
 platform = platformio/native
 lib_deps =
-    esphome/noise-c@0.1.24  ; used by noise (api, ota)
+    esphome/noise-c@0.1.26  ; used by noise (api, ota)
    lvgl/lvgl@9.5.0         ; lvgl
 build_flags =
    ${common.build_flags}
@@ -10,7 +10,7 @@ tzlocal==5.4.4    # from time
 tzdata>=2026.3  # from time
 pyserial==3.5
 platformio==6.1.19
-esptool==5.3.1
+esptool==5.4.0
 click==8.3.3
 aioesphomeapi==46.3.0
 aiohappyeyeballs==2.7.1  # Happy Eyeballs for requests downloads; already pulled in by aioesphomeapi
@@ -1,27 +1,49 @@
 #!/bin/sh
 # Prepare the dev environment for a new checkout or worktree.
 #
-# Installed into the git hooks directory by script/setup. Deliberately tiny and
-# self-contained: it stays valid on branches where script/setup does not exist,
-# and simply does nothing there.
+# Installed into the git hooks directory by script/setup.py. Deliberately tiny
+# and self-contained: it stays valid on branches where the setup script does not
+# exist, and simply does nothing there.

 # $3 is 1 for a branch checkout, 0 for a file checkout.
 [ "$3" = "1" ] || exit 0

 top=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0

-# This also runs on ordinary branch switches, where there is nothing to do.
+# This also runs on ordinary branch switches, where there is nothing to do. Both
+# layouts are checked because git for Windows runs hooks under its own bundled
+# shell, where the environment lives in venv/Scripts rather than venv/bin.
 [ -x "$top/venv/bin/python" ] && exit 0
-[ -x "$top/script/setup" ] || exit 0
+[ -f "$top/venv/Scripts/python.exe" ] && exit 0
+
+# Branches from before the setup script moved to Python carry only the shell
+# entry point, so whichever one the checked out branch has is used.
+py=
+if [ -f "$top/script/setup.py" ]; then
+  # The interpreter goes by different names across platforms, and on Windows
+  # "python3" is often a stub that opens the app store instead of running
+  # anything, so each candidate is tried before it is used. Doing nothing is the
+  # right outcome when none of them work.
+  for candidate in "python3" "python" "py -3"; do
+    # Unquoted on purpose: the launcher candidate is a command plus a flag.
+    if $candidate -c "" >/dev/null 2>&1; then
+      py=$candidate
+      break
+    fi
+  done
+  [ -n "$py" ] || exit 0
+elif ! [ -x "$top/script/setup" ]; then
+  exit 0
+fi

 # Every worktree shares the hooks directory of the checkout it was created
-# from, and the script/setup run below is the one from whichever branch was just
+# from, and the setup script run below is the one from whichever branch was just
 # checked out. Older branches install their own pre-commit hook without checking
 # for a worktree: that moves the shared hook aside as pre-commit.legacy and
 # replaces it with one tied to this worktree's virtual environment, so commits
 # break in every checkout. To rule that out, the hooks directory is copied
-# before script/setup runs and put back exactly as it was afterwards, including
-# removing any file script/setup added.
+# before the setup script runs and put back exactly as it was afterwards,
+# including removing any file the setup script added.
 hooks=$(git rev-parse --path-format=absolute --git-path hooks 2>/dev/null) || exit 0
 snap=$(mktemp -d "$hooks/.post-checkout.XXXXXX") || exit 0
 cp -p "$hooks"/* "$snap"/ 2>/dev/null
@@ -29,7 +51,13 @@ cp -p "$hooks"/* "$snap"/ 2>/dev/null
 # Clear VIRTUAL_ENV so a checkout made from a shell with an environment already
 # activated still gets its own, rather than having the active one repointed at
 # this working tree.
-env -u VIRTUAL_ENV "$top/script/setup"
+unset VIRTUAL_ENV
+if [ -n "$py" ]; then
+  # Unquoted on purpose, as above.
+  $py "$top/script/setup.py"
+else
+  "$top/script/setup"
+fi
 status=$?

 for f in "$hooks"/*; do
@@ -1,71 +1,7 @@
 #!/usr/bin/env bash
-# Set up ESPHome dev environment
+# Set up ESPHome dev environment.
+#
+# The work is done by setup.py, which script/setup.bat also runs, so the Unix
+# and Windows entry points share one implementation.

-set -e
-
-cd "$(dirname "$0")/.."
-if [ -n "$VIRTUAL_ENV" ]; then
-  # A virtual environment is already active (e.g. the devcontainer's pre-provisioned
-  # esphome-venv). Install into it rather than creating a ./venv in the workspace.
-  venv_state=active
-elif [ -x venv/bin/python ]; then
-  # Reuse the environment from an earlier run, so this script can be run again
-  # at any time to pick up dependency changes.
-  venv_state=reused
-  source venv/bin/activate
-else
-  venv_state=created
-  # --clear replaces a partial environment left behind by an interrupted run.
-  if [ -x "$(command -v uv)" ]; then
-    uv venv --clear --seed venv
-  else
-    python3 -m venv --clear venv
-  fi
-  source venv/bin/activate
-fi
-
-if ! [ -x "$(command -v uv)" ]; then
-  python3 -m pip install uv
-fi
-
-uv pip install setuptools wheel
-uv pip install -e ".[dev,test]" --config-settings editable_mode=compat
-
-# A worktree shares one git hooks directory with the main checkout it was
-# created from, so hooks are installed from the main checkout only. Installing
-# from a worktree would point the shared hook at that worktree's virtual
-# environment, breaking it for everyone once the worktree is removed.
-git_dir="$(git rev-parse --absolute-git-dir 2>/dev/null || true)"
-common_dir="$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null || true)"
-if [ -n "$common_dir" ] && [ "$git_dir" = "$common_dir" ]; then
-  # --overwrite replaces any hook already in place. Without it, prek finds a
-  # previously installed pre-commit hook, moves it aside to
-  # .git/hooks/pre-commit.legacy and keeps calling it, so every commit would
-  # run both tools.
-  prek install --overwrite
-
-  # Prepares the virtual environment for new checkouts and worktrees. Installed
-  # once here, it covers every worktree created from this checkout.
-  if [ -d "$common_dir/hooks" ]; then
-    cp script/git-hooks/post-checkout "$common_dir/hooks/post-checkout"
-    chmod +x "$common_dir/hooks/post-checkout"
-  fi
-fi
-
-mkdir -p .temp
-
-echo
-echo
-case "$venv_state" in
-  created)
-    echo "Virtual environment created at ./venv. Run 'source venv/bin/activate' to use it."
-    ;;
-  reused)
-    echo "Dependencies updated in the existing ./venv. Run 'source venv/bin/activate' to use it."
-    ;;
-  active)
-    echo "Dependencies installed into the active virtual environment:"
-    echo "  $VIRTUAL_ENV"
-    echo "It is already active in this shell, so no 'source venv/bin/activate' is needed."
-    ;;
-esac
+exec python3 "$(dirname "$0")/setup.py" "$@"
@@ -1,28 +1 @@
-@echo off
-
-if defined VIRTUAL_ENV goto :install
-
-echo Starting the Virtual Environment
-python -m venv venv
-call venv/Scripts/activate
-echo Running the Virtual Environment
-
-:install
-
-echo Installing required packages...
-
-python.exe -m pip install --upgrade pip
-
-pip3 install -r requirements.txt -r requirements_test.txt -r requirements_dev.txt
-pip3 install setuptools wheel
-pip3 install -e ".[dev,test]" --config-settings editable_mode=compat
-
-rem --overwrite replaces any hook already in place. Without it, prek finds a
-rem previously installed pre-commit hook, moves it aside to
-rem .git/hooks/pre-commit.legacy and keeps calling it, so every commit would
-rem run both tools.
-prek install --overwrite
-
-echo .
-echo .
-echo Virtual environment created. Run 'venv/Scripts/activate' to use it.
+@python "%~dp0setup.py" %*
@@ -0,0 +1,222 @@
+#!/usr/bin/env python3
+"""Set up the ESPHome development environment.
+
+Shared implementation behind script/setup and script/setup.bat, so the Unix and
+Windows entry points cannot drift apart. Uses only the standard library: it runs
+before any dependency has been installed.
+"""
+
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import sysconfig
+
+MIN_PYTHON = (3, 12)
+
+ROOT = Path(__file__).resolve().parent.parent
+DEFAULT_VENV = ROOT / "venv"
+POST_CHECKOUT_HOOK = ROOT / "script" / "git-hooks" / "post-checkout"
+
+# State of the environment the dependencies end up in, used for the closing
+# message.
+VENV_ACTIVE = "active"
+VENV_REUSED = "reused"
+VENV_CREATED = "created"
+
+
+def bin_dir(venv: Path) -> Path:
+    """Return the directory holding a virtual environment's executables.
+
+    The "venv" scheme resolves to bin on Unix and Scripts on Windows, so the
+    layout does not have to be hardcoded here.
+    """
+    base = str(venv)
+    return Path(
+        sysconfig.get_path("scripts", "venv", vars={"base": base, "platbase": base})
+    )
+
+
+def venv_python(venv: Path) -> Path:
+    """Return the path to a virtual environment's interpreter."""
+    name = "python.exe" if os.name == "nt" else "python"
+    return bin_dir(venv) / name
+
+
+def run(command: list[str], env: dict[str, str] | None = None) -> None:
+    """Run a command, aborting the whole script if it fails."""
+    print(f"+ {' '.join(command)}", flush=True)
+    result = subprocess.run(command, cwd=ROOT, env=env, check=False)
+    if result.returncode != 0:
+        # Some tools fail without printing anything, so name the step that broke.
+        print(
+            f"Failed with exit code {result.returncode}: {command[0]}", file=sys.stderr
+        )
+        raise SystemExit(result.returncode)
+
+
+def git_output(*args: str) -> str:
+    """Return the trimmed output of a git command, or "" if it cannot be run."""
+    try:
+        result = subprocess.run(
+            ["git", *args], cwd=ROOT, capture_output=True, text=True, check=False
+        )
+    except OSError:
+        # Git is not required to install the dependencies, only to install hooks.
+        return ""
+    if result.returncode != 0:
+        return ""
+    return result.stdout.strip()
+
+
+def create_venv(venv: Path) -> None:
+    """Create a virtual environment, replacing anything already at the path."""
+    # --clear replaces a partial environment left behind by an interrupted run.
+    if (uv := shutil.which("uv")) is not None:
+        run([uv, "venv", "--clear", "--seed", str(venv)])
+    else:
+        run([sys.executable, "-m", "venv", "--clear", str(venv)])
+
+
+def venv_environment(venv: Path) -> dict[str, str]:
+    """Return the environment child processes need to target a virtual env.
+
+    Equivalent to sourcing the environment's activate script: tools such as uv
+    and prek pick the environment up from VIRTUAL_ENV and PATH.
+    """
+    env = dict(os.environ)
+    env["VIRTUAL_ENV"] = str(venv)
+    env.pop("PYTHONHOME", None)
+    path = str(bin_dir(venv))
+    # An empty entry would be appended if PATH is unset, and on Unix that means
+    # the working directory is searched for executables.
+    if existing := env.get("PATH"):
+        path = os.pathsep.join([path, existing])
+    env["PATH"] = path
+    return env
+
+
+def find_uv(venv: Path, env: dict[str, str]) -> str:
+    """Return the path to uv, installing it into the environment if needed."""
+    if (uv := shutil.which("uv", path=env["PATH"])) is not None:
+        return uv
+    run([str(venv_python(venv)), "-m", "pip", "install", "uv"], env=env)
+    if (uv := shutil.which("uv", path=env["PATH"])) is not None:
+        return uv
+    raise SystemExit("uv could not be installed, aborting.")
+
+
+def install_dependencies(venv: Path, env: dict[str, str]) -> None:
+    """Install ESPHome and its development dependencies into the environment."""
+    uv = find_uv(venv, env)
+    run([uv, "pip", "install", "setuptools", "wheel"], env=env)
+    # The dev and test extras pull in requirements_dev.txt and
+    # requirements_test.txt, and the package itself pulls in requirements.txt,
+    # so this single install covers every requirements file.
+    run(
+        [
+            uv,
+            "pip",
+            "install",
+            "-e",
+            ".[dev,test]",
+            "--config-settings",
+            "editable_mode=compat",
+        ],
+        env=env,
+    )
+
+
+def install_git_hooks(env: dict[str, str]) -> None:
+    """Install the git hooks, but only when run from the main checkout.
+
+    A worktree shares one git hooks directory with the main checkout it was
+    created from. Installing from a worktree would point the shared hook at that
+    worktree's virtual environment, breaking it for everyone once the worktree is
+    removed.
+    """
+    git_dir = git_output("rev-parse", "--absolute-git-dir")
+    common_dir = git_output("rev-parse", "--path-format=absolute", "--git-common-dir")
+    if not git_dir or not common_dir or Path(git_dir) != Path(common_dir):
+        return
+
+    prek = shutil.which("prek", path=env["PATH"])
+    if prek is None:
+        raise SystemExit("prek was not installed, aborting.")
+    # --overwrite replaces any hook already in place. Without it, prek finds a
+    # previously installed pre-commit hook, moves it aside to
+    # .git/hooks/pre-commit.legacy and keeps calling it, so every commit would
+    # run both tools.
+    run([prek, "install", "--overwrite"], env=env)
+
+    # Prepares the virtual environment for new checkouts and worktrees. Installed
+    # once here, it covers every worktree created from this checkout.
+    hooks_dir = Path(common_dir) / "hooks"
+    if hooks_dir.is_dir():
+        installed = hooks_dir / "post-checkout"
+        shutil.copyfile(POST_CHECKOUT_HOOK, installed)
+        installed.chmod(0o755)
+
+
+def activate_hint() -> str:
+    """Return the command that activates the environment this script creates."""
+    activate = bin_dir(DEFAULT_VENV).relative_to(ROOT) / "activate"
+    if os.name == "nt":
+        return str(activate)
+    return f"source {activate.as_posix()}"
+
+
+def report(state: str, venv: Path) -> None:
+    """Print the closing message for the environment that was set up."""
+    location = f"./{DEFAULT_VENV.name}"
+    print()
+    print()
+    if state == VENV_ACTIVE:
+        print("Dependencies installed into the active virtual environment:")
+        print(f"  {venv}")
+        print(
+            f"It is already active in this shell, so no '{activate_hint()}' is needed."
+        )
+    elif state == VENV_REUSED:
+        print(
+            f"Dependencies updated in the existing {location}. "
+            f"Run '{activate_hint()}' to use it."
+        )
+    else:
+        print(
+            f"Virtual environment created at {location}. "
+            f"Run '{activate_hint()}' to use it."
+        )
+
+
+def main() -> None:
+    """Set up the development environment."""
+    if sys.version_info < MIN_PYTHON:
+        raise SystemExit(
+            f"ESPHome needs Python {MIN_PYTHON[0]}.{MIN_PYTHON[1]} or newer, "
+            f"but this is Python {sys.version.split()[0]}."
+        )
+
+    # A virtual environment that is already active (for example the
+    # devcontainer's pre-provisioned esphome-venv) is installed into rather than
+    # creating a ./venv in the workspace.
+    if active := os.environ.get("VIRTUAL_ENV"):
+        state, venv = VENV_ACTIVE, Path(active)
+    elif venv_python(DEFAULT_VENV).is_file():
+        # Reuse the environment from an earlier run, so this script can be run
+        # again at any time to pick up dependency changes.
+        state, venv = VENV_REUSED, DEFAULT_VENV
+    else:
+        state, venv = VENV_CREATED, DEFAULT_VENV
+        create_venv(venv)
+
+    env = venv_environment(venv)
+    install_dependencies(venv, env)
+    install_git_hooks(env)
+    (ROOT / ".temp").mkdir(exist_ok=True)
+    report(state, venv)
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,90 @@
+"""Validation tests for the sendspin media_source platform.
+
+These cover the codec preference list, whose rejection branches a compile test
+cannot reach: a `test*.yaml` can only assert that a configuration is accepted.
+"""
+
+from typing import Any
+
+import pytest
+
+from esphome import config_validation as cv
+from esphome.components.sendspin import CONF_CODECS, _get_data
+from esphome.components.sendspin.media_source import CONFIG_SCHEMA
+from esphome.const import PlatformFramework
+from esphome.types import ConfigType
+from tests.component_tests.types import SetCoreConfigCallable
+
+
+def _media_source_config(**overrides: Any) -> ConfigType:
+    """Build a minimal valid media source config, allowing field overrides."""
+    config: ConfigType = {
+        "id": "sendspin_media_source",
+        "sendspin_id": "sendspin_hub",
+    }
+    config.update(overrides)
+    return config
+
+
+def test_default_codecs_at_48_khz(set_core_config: SetCoreConfigCallable) -> None:
+    """Every codec is advertised when the sample rate suits all of them."""
+    set_core_config(PlatformFramework.ESP32_IDF)
+
+    config = CONFIG_SCHEMA(_media_source_config())
+
+    assert config[CONF_CODECS] == ["flac", "opus", "pcm"]
+
+
+def test_default_codecs_drop_opus_at_other_rates(
+    set_core_config: SetCoreConfigCallable,
+) -> None:
+    """Opus only supports 48 kHz, so it leaves the default list at other rates."""
+    set_core_config(PlatformFramework.ESP32_IDF)
+
+    config = CONFIG_SCHEMA(_media_source_config(sample_rate=44100))
+
+    assert config[CONF_CODECS] == ["flac", "pcm"]
+
+
+def test_configured_order_is_preserved(set_core_config: SetCoreConfigCallable) -> None:
+    """The list is a preference order, so it reaches the player role as written."""
+    set_core_config(PlatformFramework.ESP32_IDF)
+
+    CONFIG_SCHEMA(_media_source_config(codecs=["pcm", "flac"]))
+
+    assert _get_data().player_config[CONF_CODECS] == ["pcm", "flac"]
+
+
+def test_empty_codec_list_rejected(set_core_config: SetCoreConfigCallable) -> None:
+    """A player with no codecs at all could never be given a stream."""
+    set_core_config(PlatformFramework.ESP32_IDF)
+
+    with pytest.raises(cv.Invalid, match="length of value must be at least 1"):
+        CONFIG_SCHEMA(_media_source_config(codecs=[]))
+
+
+def test_duplicate_codec_rejected(set_core_config: SetCoreConfigCallable) -> None:
+    """A repeated codec has no meaning in a preference order."""
+    set_core_config(PlatformFramework.ESP32_IDF)
+
+    with pytest.raises(cv.Invalid, match="may only be listed once"):
+        CONFIG_SCHEMA(_media_source_config(codecs=["flac", "flac"]))
+
+
+def test_unknown_codec_rejected(set_core_config: SetCoreConfigCallable) -> None:
+    """Only codecs the player role can decode are accepted."""
+    set_core_config(PlatformFramework.ESP32_IDF)
+
+    with pytest.raises(cv.Invalid, match="Unknown value"):
+        CONFIG_SCHEMA(_media_source_config(codecs=["mp3"]))
+
+
+def test_opus_at_wrong_sample_rate_rejected(
+    set_core_config: SetCoreConfigCallable,
+) -> None:
+    """Asking for Opus at a rate it cannot handle fails rather than silently
+    dropping the stated preference."""
+    set_core_config(PlatformFramework.ESP32_IDF)
+
+    with pytest.raises(cv.Invalid, match="requires a sample_rate of 48000"):
+        CONFIG_SCHEMA(_media_source_config(codecs=["opus"], sample_rate=44100))
@@ -0,0 +1,76 @@
+"""The template platforms surface value-describing metadata on the main form.
+
+Hardware platforms get sensible defaults for unit/device_class/etc., so those
+fields fall through to the editor's advanced disclosure. A ``template`` entity
+has no such defaults -- the user is expected to define them -- so the template
+platforms pass ``visibility=cv.Visibility.UI`` to promote them onto the form.
+"""
+
+from __future__ import annotations
+
+import importlib
+
+import pytest
+
+import esphome.config_validation as cv
+
+
+def _markers(schema: cv.Schema) -> dict[str, object]:
+    s = schema
+    if hasattr(s, "validators"):
+        # cv.All -> the schema is the first validator.
+        s = s.validators[0]
+    return {str(k): k for k in s.schema}
+
+
+@pytest.mark.parametrize(
+    ("platform", "fields"),
+    [
+        (
+            "sensor",
+            [
+                "unit_of_measurement",
+                "accuracy_decimals",
+                "device_class",
+                "state_class",
+                "force_update",
+            ],
+        ),
+        ("binary_sensor", ["device_class"]),
+        ("switch", ["device_class"]),
+        ("cover", ["device_class"]),
+        ("button", ["device_class"]),
+        ("valve", ["device_class"]),
+        ("event", ["device_class"]),
+        ("text_sensor", ["device_class"]),
+        ("number", ["device_class", "unit_of_measurement"]),
+    ],
+)
+def test_template_metadata_is_ui(platform: str, fields: list[str]) -> None:
+    mod = importlib.import_module(f"esphome.components.template.{platform}")
+    markers = _markers(mod.CONFIG_SCHEMA)
+    for field in fields:
+        assert markers[field].visibility is cv.Visibility.UI, f"{platform}.{field}"
+
+
+def test_template_sensor_promotion_preserves_defaults() -> None:
+    """Promoting to UI must not drop the fields' defaults."""
+    from esphome.components.template.sensor import CONFIG_SCHEMA
+
+    markers = _markers(CONFIG_SCHEMA)
+    assert markers["accuracy_decimals"].default() == 1
+    assert markers["force_update"].default() is False
+
+
+def test_hardware_platform_metadata_not_promoted() -> None:
+    """Without ``visibility=`` the builders leave metadata unset.
+
+    Unset markers fall through to the consumer's ``Optional`` default of
+    advanced, so hardware platforms are unaffected by the template promotion.
+    """
+    from esphome.components import binary_sensor, sensor
+
+    hw_sensor = _markers(sensor.sensor_schema(device_class="temperature"))
+    assert hw_sensor["device_class"].visibility is None
+    hw_bs = _markers(binary_sensor.binary_sensor_schema(device_class="motion"))
+    assert hw_bs["device_class"].visibility is None
@@ -1,11 +0,0 @@
-# STA with AP fallback plus local: true opts the fallback into captive AP mode; exercises
-# the runtime start (fallback branch in wifi loop) and end (on STA connect) paths.
-wifi:
-  ssid: MySSID
-  password: password1
-  ap:
-    ssid: "ESPHome-Test"
-    password: "Test1234!"
-
-web_server:
-  local: true
@@ -1,9 +0,0 @@
-# AP mode: with a WiFi access point and the interface embedded in the firmware, web_server
-# runs its own captive portal (DNS server, unknown URLs redirect to the page).
-wifi:
-  ap:
-    ssid: "ESPHome-Test"
-    password: "Test1234!"
-
-web_server:
-  local: true
@@ -1,2 +0,0 @@
-packages:
-  web_server: !include common-ap-fallback.yaml
@@ -1,2 +0,0 @@
-packages:
-  web_server: !include common-ap-mode.yaml
@@ -1,2 +0,0 @@
-packages:
-  web_server: !include common-ap-mode.yaml
@@ -1,143 +1,154 @@
 {
-  "tests/integration/test_action_concurrent_reentry.py": 57.91,
-  "tests/integration/test_addressable_light_transition.py": 21.25,
-  "tests/integration/test_alarm_control_panel_state_transitions.py": 70.71,
-  "tests/integration/test_api_action_metadata.py": 66.6,
-  "tests/integration/test_api_action_responses.py": 36.1,
-  "tests/integration/test_api_action_timeout.py": 68.86,
-  "tests/integration/test_api_conditional_memory.py": 15.48,
-  "tests/integration/test_api_custom_services.py": 18.77,
-  "tests/integration/test_api_get_time_response_timezone.py": 21.08,
-  "tests/integration/test_api_homeassistant.py": 65.59,
-  "tests/integration/test_api_homeassistant_action_no_subscriber.py": 18.44,
-  "tests/integration/test_api_homeassistant_binary_sensor_initial_state.py": 15.05,
-  "tests/integration/test_api_list_entities_backpressure.py": 13.88,
-  "tests/integration/test_api_message_size_batching.py": 29.98,
-  "tests/integration/test_api_reboot_timeout.py": 16.05,
-  "tests/integration/test_api_string_lambda.py": 15.31,
-  "tests/integration/test_api_vv_logging.py": 19.28,
-  "tests/integration/test_api_zero_psk_provisioning.py": 31.5,
-  "tests/integration/test_areas_and_devices.py": 24.95,
-  "tests/integration/test_automation_wait_actions.py": 20.92,
-  "tests/integration/test_automations.py": 35.19,
-  "tests/integration/test_batch_delay_zero_rapid_transitions.py": 17.99,
-  "tests/integration/test_binary_sensor_autorepeat_filter.py": 20.39,
-  "tests/integration/test_binary_sensor_invalidate_state.py": 18.41,
-  "tests/integration/test_blocking_warning_log_time_not_charged_to_next_operation.py": 24.69,
-  "tests/integration/test_build_info.py": 18.7,
-  "tests/integration/test_camera_mock.py": 16.23,
-  "tests/integration/test_climate_control_action.py": 21.14,
-  "tests/integration/test_climate_custom_modes.py": 20.74,
-  "tests/integration/test_continuation_actions.py": 16.81,
-  "tests/integration/test_cover_control_action.py": 20.34,
-  "tests/integration/test_crc8_helper.py": 9.36,
-  "tests/integration/test_device_id_in_state.py": 44.67,
-  "tests/integration/test_duplicate_entities.py": 23.58,
-  "tests/integration/test_entity_icon.py": 34.35,
-  "tests/integration/test_fan_turn_on_action.py": 24.23,
-  "tests/integration/test_fnv1_hash_object_id.py": 16.21,
-  "tests/integration/test_fnv1a_hash.py": 13.38,
-  "tests/integration/test_gpio_expander_cache.py": 13.06,
-  "tests/integration/test_host_logger_thread_safety.py": 23.66,
-  "tests/integration/test_host_mode_basic.py": 8.01,
-  "tests/integration/test_host_mode_batch_delay.py": 21.0,
-  "tests/integration/test_host_mode_climate_basic_state.py": 22.14,
-  "tests/integration/test_host_mode_climate_control.py": 19.39,
-  "tests/integration/test_host_mode_empty_string_options.py": 21.76,
-  "tests/integration/test_host_mode_entity_fields.py": 29.61,
-  "tests/integration/test_host_mode_fan_preset.py": 20.01,
-  "tests/integration/test_host_mode_many_entities.py": 39.08,
-  "tests/integration/test_host_mode_many_entities_multiple_connections.py": 23.92,
-  "tests/integration/test_host_mode_noise_encryption.py": 42.42,
-  "tests/integration/test_host_mode_reconnect.py": 3.41,
-  "tests/integration/test_host_mode_sensor.py": 22.96,
-  "tests/integration/test_host_ota.py": 29.5,
-  "tests/integration/test_host_preferences.py": 16.06,
-  "tests/integration/test_host_preferences_suspend_resume.py": 18.71,
-  "tests/integration/test_improv_serial_uart.py": 20.22,
-  "tests/integration/test_large_message_batching.py": 26.56,
-  "tests/integration/test_legacy_area.py": 22.72,
-  "tests/integration/test_legacy_climate_compat.py": 14.13,
-  "tests/integration/test_legacy_fan_compat.py": 14.33,
-  "tests/integration/test_light_automations.py": 18.81,
-  "tests/integration/test_light_binary_effect_off_phase.py": 8.38,
-  "tests/integration/test_light_calls.py": 21.88,
-  "tests/integration/test_light_constant_brightness.py": 59.45,
-  "tests/integration/test_light_control_action.py": 31.91,
-  "tests/integration/test_light_dim_relative_action.py": 14.43,
-  "tests/integration/test_light_effect_zero_brightness.py": 25.05,
-  "tests/integration/test_light_initial_state.py": 18.97,
-  "tests/integration/test_light_toggle_action.py": 17.44,
-  "tests/integration/test_lock_automations.py": 18.9,
-  "tests/integration/test_logger_buffered_recursion_guard.py": 18.2,
-  "tests/integration/test_loop_disable_enable.py": 63.35,
-  "tests/integration/test_loop_interval_decoupling.py": 17.7,
-  "tests/integration/test_loop_interval_default_not_pulled_forward.py": 21.56,
-  "tests/integration/test_micros_to_millis.py": 15.89,
-  "tests/integration/test_multi_click_trigger.py": 17.23,
-  "tests/integration/test_multi_device_preferences.py": 19.4,
-  "tests/integration/test_noise_encryption_key_protection.py": 72.59,
-  "tests/integration/test_object_id_api_verification.py": 19.22,
-  "tests/integration/test_object_id_friendly_name_no_mac_suffix.py": 16.77,
-  "tests/integration/test_object_id_no_friendly_name.py": 45.8,
-  "tests/integration/test_online_image_auto_detects_image_bmp_mime.py": 86.73,
-  "tests/integration/test_online_image_auto_detects_redirected_image_bmp_mime.py": 40.4,
-  "tests/integration/test_online_image_bmp.py": 37.24,
-  "tests/integration/test_oversized_payloads.py": 55.75,
-  "tests/integration/test_preference_key_stability.py": 25.49,
-  "tests/integration/test_runtime_stats.py": 29.81,
-  "tests/integration/test_safe_mode_loop_runs.py": 6.26,
-  "tests/integration/test_scheduler_blocking_warning.py": 37.98,
-  "tests/integration/test_scheduler_bulk_cleanup.py": 18.67,
-  "tests/integration/test_scheduler_defer_cancel.py": 18.46,
-  "tests/integration/test_scheduler_defer_cancel_regular.py": 16.34,
-  "tests/integration/test_scheduler_defer_fifo_simple.py": 18.26,
-  "tests/integration/test_scheduler_defer_stress.py": 17.74,
-  "tests/integration/test_scheduler_heap_stress.py": 3.89,
-  "tests/integration/test_scheduler_internal_id_no_collision.py": 20.01,
-  "tests/integration/test_scheduler_interval_reschedule.py": 16.29,
-  "tests/integration/test_scheduler_interval_zero_coerced.py": 16.09,
-  "tests/integration/test_scheduler_null_name.py": 14.69,
-  "tests/integration/test_scheduler_numeric_id_test.py": 17.08,
-  "tests/integration/test_scheduler_pool.py": 19.88,
-  "tests/integration/test_scheduler_rapid_cancellation.py": 4.42,
-  "tests/integration/test_scheduler_recursive_timeout.py": 4.3,
-  "tests/integration/test_scheduler_removed_item_race.py": 15.49,
-  "tests/integration/test_scheduler_self_keyed.py": 25.77,
-  "tests/integration/test_scheduler_simultaneous_callbacks.py": 14.84,
-  "tests/integration/test_scheduler_string_test.py": 15.42,
-  "tests/integration/test_script_array_params.py": 12.73,
-  "tests/integration/test_script_delay_params.py": 12.69,
-  "tests/integration/test_script_queued.py": 20.38,
-  "tests/integration/test_script_queued_idle_loop.py": 25.06,
-  "tests/integration/test_script_wait_on_boot.py": 15.67,
-  "tests/integration/test_select_stringref_trigger.py": 19.48,
-  "tests/integration/test_sensor_filters_delta.py": 27.62,
-  "tests/integration/test_sensor_filters_ring_buffer.py": 20.27,
-  "tests/integration/test_sensor_filters_sliding_window.py": 56.28,
-  "tests/integration/test_sensor_filters_value_list.py": 20.6,
-  "tests/integration/test_sensor_timeout_filter.py": 22.21,
-  "tests/integration/test_socket_wake_gate_tcp.py": 16.37,
-  "tests/integration/test_status_flags.py": 29.68,
-  "tests/integration/test_strftime_to.py": 17.42,
-  "tests/integration/test_syslog.py": 18.39,
-  "tests/integration/test_template_alarm_control_panel_many_sensors.py": 25.61,
-  "tests/integration/test_template_text_save.py": 19.16,
-  "tests/integration/test_text_command.py": 16.43,
-  "tests/integration/test_text_sensor_raw_state.py": 17.19,
-  "tests/integration/test_uart_mock_ld2410.py": 37.0,
-  "tests/integration/test_uart_mock_ld2412.py": 40.82,
-  "tests/integration/test_uart_mock_ld2420.py": 32.7,
-  "tests/integration/test_uart_mock_ld2450.py": 32.84,
-  "tests/integration/test_uart_mock_modbus.py": 548.87,
-  "tests/integration/test_udp.py": 16.67,
-  "tests/integration/test_use_address_runtime.py": 27.26,
-  "tests/integration/test_valve_control_action.py": 24.58,
-  "tests/integration/test_varint_five_byte_device_id.py": 22.5,
-  "tests/integration/test_wait_until_mid_loop_timing.py": 22.05,
-  "tests/integration/test_wait_until_on_boot.py": 10.37,
-  "tests/integration/test_wait_until_ordering.py": 18.23,
-  "tests/integration/test_wait_until_reentrant_restart.py": 19.35,
-  "tests/integration/test_wake_loop_forces_phase_b.py": 17.83,
-  "tests/integration/test_water_heater_template.py": 25.7
+  "tests/integration/test_action_concurrent_reentry.py": 30.48,
+  "tests/integration/test_addressable_light_transition.py": 42.1,
+  "tests/integration/test_alarm_control_panel_state_transitions.py": 35.76,
+  "tests/integration/test_api_action_metadata.py": 22.35,
+  "tests/integration/test_api_action_responses.py": 30.31,
+  "tests/integration/test_api_action_timeout.py": 34.73,
+  "tests/integration/test_api_conditional_memory.py": 18.35,
+  "tests/integration/test_api_custom_services.py": 15.99,
+  "tests/integration/test_api_get_time_response_timezone.py": 24.21,
+  "tests/integration/test_api_homeassistant.py": 33.77,
+  "tests/integration/test_api_homeassistant_action_no_subscriber.py": 20.8,
+  "tests/integration/test_api_homeassistant_binary_sensor_initial_state.py": 23.55,
+  "tests/integration/test_api_list_entities_backpressure.py": 23.04,
+  "tests/integration/test_api_message_size_batching.py": 27.31,
+  "tests/integration/test_api_reboot_timeout.py": 29.32,
+  "tests/integration/test_api_string_lambda.py": 14.9,
+  "tests/integration/test_api_vv_logging.py": 26.25,
+  "tests/integration/test_api_zero_psk_provisioning.py": 38.19,
+  "tests/integration/test_areas_and_devices.py": 27.52,
+  "tests/integration/test_automation_wait_actions.py": 24.25,
+  "tests/integration/test_automations.py": 36.02,
+  "tests/integration/test_batch_delay_zero_rapid_transitions.py": 18.46,
+  "tests/integration/test_binary_sensor_autorepeat_filter.py": 17.47,
+  "tests/integration/test_binary_sensor_invalidate_state.py": 14.79,
+  "tests/integration/test_blocking_warning_log_time_not_charged_to_next_operation.py": 21.52,
+  "tests/integration/test_build_info.py": 21.42,
+  "tests/integration/test_camera_mock.py": 17.02,
+  "tests/integration/test_climate_control_action.py": 26.56,
+  "tests/integration/test_climate_custom_modes.py": 18.82,
+  "tests/integration/test_continuation_actions.py": 20.39,
+  "tests/integration/test_cover_control_action.py": 19.91,
+  "tests/integration/test_crc8_helper.py": 16.73,
+  "tests/integration/test_device_id_in_state.py": 58.41,
+  "tests/integration/test_duplicate_entities.py": 30.76,
+  "tests/integration/test_entity_icon.py": 25.34,
+  "tests/integration/test_fan_turn_on_action.py": 23.64,
+  "tests/integration/test_fnv1_hash_object_id.py": 25.44,
+  "tests/integration/test_fnv1a_hash.py": 20.85,
+  "tests/integration/test_gpio_expander_cache.py": 14.42,
+  "tests/integration/test_host_logger_thread_safety.py": 21.31,
+  "tests/integration/test_host_mode_basic.py": 2.65,
+  "tests/integration/test_host_mode_batch_delay.py": 22.21,
+  "tests/integration/test_host_mode_climate_basic_state.py": 27.12,
+  "tests/integration/test_host_mode_climate_control.py": 21.57,
+  "tests/integration/test_host_mode_empty_string_options.py": 27.17,
+  "tests/integration/test_host_mode_entity_fields.py": 30.1,
+  "tests/integration/test_host_mode_fan_preset.py": 17.55,
+  "tests/integration/test_host_mode_many_entities.py": 38.98,
+  "tests/integration/test_host_mode_many_entities_multiple_connections.py": 23.82,
+  "tests/integration/test_host_mode_noise_encryption.py": 39.84,
+  "tests/integration/test_host_mode_reconnect.py": 13.1,
+  "tests/integration/test_host_mode_sensor.py": 22.17,
+  "tests/integration/test_host_ota.py": 92.05,
+  "tests/integration/test_host_preferences.py": 20.29,
+  "tests/integration/test_host_preferences_suspend_resume.py": 15.02,
+  "tests/integration/test_improv_serial_uart.py": 30.15,
+  "tests/integration/test_large_message_batching.py": 25.84,
+  "tests/integration/test_legacy_area.py": 21.24,
+  "tests/integration/test_legacy_climate_compat.py": 17.34,
+  "tests/integration/test_legacy_fan_compat.py": 22.6,
+  "tests/integration/test_light_automations.py": 29.13,
+  "tests/integration/test_light_binary_effect_off_phase.py": 33.99,
+  "tests/integration/test_light_calls.py": 26.81,
+  "tests/integration/test_light_constant_brightness.py": 25.0,
+  "tests/integration/test_light_control_action.py": 25.57,
+  "tests/integration/test_light_dim_relative_action.py": 21.4,
+  "tests/integration/test_light_effect_zero_brightness.py": 19.65,
+  "tests/integration/test_light_initial_state.py": 17.58,
+  "tests/integration/test_light_toggle_action.py": 28.28,
+  "tests/integration/test_lock_automations.py": 23.3,
+  "tests/integration/test_logger_buffered_recursion_guard.py": 22.96,
+  "tests/integration/test_loop_disable_enable.py": 16.18,
+  "tests/integration/test_loop_interval_decoupling.py": 25.19,
+  "tests/integration/test_loop_interval_default_not_pulled_forward.py": 20.59,
+  "tests/integration/test_lvgl_headless_render.py": 87.78,
+  "tests/integration/test_micros_to_millis.py": 18.73,
+  "tests/integration/test_multi_click_trigger.py": 24.2,
+  "tests/integration/test_multi_device_preferences.py": 20.52,
+  "tests/integration/test_noise_encryption_key_protection.py": 19.1,
+  "tests/integration/test_object_id_api_verification.py": 26.24,
+  "tests/integration/test_object_id_friendly_name_no_mac_suffix.py": 14.88,
+  "tests/integration/test_object_id_no_friendly_name.py": 61.27,
+  "tests/integration/test_online_image_auto_detects_image_bmp_mime.py": 82.32,
+  "tests/integration/test_online_image_auto_detects_redirected_image_bmp_mime.py": 46.03,
+  "tests/integration/test_online_image_bmp.py": 34.21,
+  "tests/integration/test_oversized_payloads.py": 62.75,
+  "tests/integration/test_preference_key_stability.py": 26.8,
+  "tests/integration/test_runtime_stats.py": 28.26,
+  "tests/integration/test_safe_mode_loop_runs.py": 18.14,
+  "tests/integration/test_scheduler_blocking_warning.py": 28.7,
+  "tests/integration/test_scheduler_bulk_cleanup.py": 20.73,
+  "tests/integration/test_scheduler_defer_cancel.py": 22.99,
+  "tests/integration/test_scheduler_defer_cancel_regular.py": 21.97,
+  "tests/integration/test_scheduler_defer_fifo_simple.py": 24.15,
+  "tests/integration/test_scheduler_defer_stress.py": 23.11,
+  "tests/integration/test_scheduler_heap_stress.py": 20.2,
+  "tests/integration/test_scheduler_internal_id_no_collision.py": 23.75,
+  "tests/integration/test_scheduler_interval_reschedule.py": 15.32,
+  "tests/integration/test_scheduler_interval_zero_coerced.py": 20.1,
+  "tests/integration/test_scheduler_null_name.py": 17.43,
+  "tests/integration/test_scheduler_numeric_id_test.py": 25.51,
+  "tests/integration/test_scheduler_pool.py": 24.22,
+  "tests/integration/test_scheduler_rapid_cancellation.py": 24.01,
+  "tests/integration/test_scheduler_recursive_timeout.py": 22.94,
+  "tests/integration/test_scheduler_removed_item_race.py": 23.07,
+  "tests/integration/test_scheduler_self_keyed.py": 18.43,
+  "tests/integration/test_scheduler_simultaneous_callbacks.py": 21.99,
+  "tests/integration/test_scheduler_string_test.py": 17.27,
+  "tests/integration/test_script_array_params.py": 4.59,
+  "tests/integration/test_script_delay_params.py": 22.46,
+  "tests/integration/test_script_queued.py": 25.24,
+  "tests/integration/test_script_queued_idle_loop.py": 5.04,
+  "tests/integration/test_script_wait_on_boot.py": 21.77,
+  "tests/integration/test_sdl_headless_screenshot.py": 19.23,
+  "tests/integration/test_select_stringref_trigger.py": 19.31,
+  "tests/integration/test_sensor_filters_delta.py": 25.92,
+  "tests/integration/test_sensor_filters_ring_buffer.py": 22.39,
+  "tests/integration/test_sensor_filters_sliding_window.py": 57.93,
+  "tests/integration/test_sensor_filters_value_list.py": 20.32,
+  "tests/integration/test_sensor_timeout_filter.py": 25.35,
+  "tests/integration/test_snapshot_display.py": 19.7,
+  "tests/integration/test_socket_wake_gate_tcp.py": 14.5,
+  "tests/integration/test_status_flags.py": 33.83,
+  "tests/integration/test_strftime_to.py": 17.64,
+  "tests/integration/test_syslog.py": 24.49,
+  "tests/integration/test_template_alarm_control_panel_many_sensors.py": 24.81,
+  "tests/integration/test_template_climate_basic.py": 15.28,
+  "tests/integration/test_template_climate_custom_modes.py": 25.07,
+  "tests/integration/test_template_climate_nonoptimistic.py": 24.25,
+  "tests/integration/test_template_climate_on_control_ordering.py": 24.09,
+  "tests/integration/test_template_climate_publish_all_fields.py": 17.78,
+  "tests/integration/test_template_climate_sensor_push.py": 17.42,
+  "tests/integration/test_template_climate_set_actions.py": 23.63,
+  "tests/integration/test_template_climate_two_point_temperature.py": 25.19,
+  "tests/integration/test_template_text_save.py": 17.88,
+  "tests/integration/test_text_command.py": 22.71,
+  "tests/integration/test_text_sensor_raw_state.py": 25.17,
+  "tests/integration/test_uart_mock_ld2410.py": 58.15,
+  "tests/integration/test_uart_mock_ld2412.py": 61.14,
+  "tests/integration/test_uart_mock_ld2420.py": 33.87,
+  "tests/integration/test_uart_mock_ld2450.py": 26.06,
+  "tests/integration/test_uart_mock_modbus.py": 391.79,
+  "tests/integration/test_udp.py": 7.38,
+  "tests/integration/test_use_address_runtime.py": 24.09,
+  "tests/integration/test_valve_control_action.py": 23.22,
+  "tests/integration/test_varint_five_byte_device_id.py": 17.93,
+  "tests/integration/test_wait_until_mid_loop_timing.py": 22.26,
+  "tests/integration/test_wait_until_on_boot.py": 17.46,
+  "tests/integration/test_wait_until_ordering.py": 11.89,
+  "tests/integration/test_wait_until_reentrant_restart.py": 22.88,
+  "tests/integration/test_wake_loop_forces_phase_b.py": 16.6,
+  "tests/integration/test_water_heater_template.py": 19.66
 }
@@ -35,8 +35,8 @@ def _load_script():
 def test_spec_key_collapses_destinations() -> None:
    """Two specs delivering one package share a directory and one key."""
    mod = _load_script()
-    assert mod.spec_key("esphome/noise-c @ 0.1.24") == "noise-c"
-    assert mod.spec_key("esphome/noise-c@0.1.24") == "noise-c"
+    assert mod.spec_key("esphome/noise-c @ 0.1.26") == "noise-c"
+    assert mod.spec_key("esphome/noise-c@0.1.26") == "noise-c"
    assert mod.spec_key("ESP32Async/AsyncTCP @ ^3.4.10") == mod.spec_key(
        "esp32async/asynctcp @ 3.5.0"
    )
@@ -54,23 +54,23 @@ def test_parse_specs_and_cli_args(tmp_path: Path) -> None:
        "[env:a]\n"
        "platform = fake/platform@1\n"
        "lib_deps =\n"
-        "    esphome/noise-c @ 0.1.24\n"
+        "    esphome/noise-c @ 0.1.26\n"
        "    ${common.lib_deps}\n"
        "    internal_lib\n"
        "[env:b]\n"
        "lib_deps =\n"
-        "    esphome/noise-c @ 0.1.24\n"
+        "    esphome/noise-c @ 0.1.26\n"
    )
    mod = _load_script()
    args = Namespace(libraries=True, platforms=True, tools=False)
    libs, platforms, tools = mod.parse_specs(str(ini), args)
    # exact-string duplicates collapse; distinct version pins survive
-    assert libs == ["esphome/noise-c @ 0.1.24"]
+    assert libs == ["esphome/noise-c @ 0.1.26"]
    assert platforms == ["fake/platform@1"]
    assert tools == []
    assert mod.build_cli_args(libs, platforms, tools) == [
        "-l",
-        "esphome/noise-c @ 0.1.24",
+        "esphome/noise-c @ 0.1.26",
        "-p",
        "fake/platform@1",
    ]
@@ -162,13 +162,13 @@ def test_parallel_install_behavior(tmp_path: Path) -> None:
    mod.parallel_install(
        cls,
        [
-            "esphome/noise-c @ 0.1.24",
-            "esphome/noise-c @ 0.1.24",
+            "esphome/noise-c @ 0.1.26",
+            "esphome/noise-c @ 0.1.26",
            "esphome/already @ 1.0",
            "https://x/framework.tar.xz",
        ],
    )
-    assert cls.calls == ["esphome/noise-c @ 0.1.24"]
+    assert cls.calls == ["esphome/noise-c @ 0.1.26"]
    assert cls.lock_events == ["lock", "unlock"]


@@ -205,7 +205,7 @@ def test_parallel_install_runs_dependency_waves(tmp_path: Path) -> None:
    mod = _load_script()
    cls = _reset_fake(str(tmp_path))
    cls.deps = {
-        "esphome/noise-c @ 0.1.24": [
+        "esphome/noise-c @ 0.1.26": [
            {"owner": "esphome", "name": "libsodium", "version": "^1.0"},
            {"name": "SPI"},
        ],
@@ -213,12 +213,12 @@ def test_parallel_install_runs_dependency_waves(tmp_path: Path) -> None:
            {"owner": "esphome", "name": "libsodium", "version": "^1.0"},
        ],
    }
-    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.24", "esphome/wg @ 1.0"])
+    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.26", "esphome/wg @ 1.0"])
    assert len(cls.calls) == 3  # the shared dep installs exactly once
    assert {mod.spec_key(c) for c in cls.calls} == {"noise-c", "wg", "libsodium"}
    # Wave-1 strings carry no compatibility; the dependency wave does
    compats = dict(cls.compat_calls)
-    assert compats["esphome/noise-c @ 0.1.24"] is None
+    assert compats["esphome/noise-c @ 0.1.26"] is None
    dep_compat = next(v for k, v in cls.compat_calls if "libsodium" in k)
    assert dep_compat is not None  # mirrors pio's install_dependency

@@ -229,11 +229,11 @@ def test_dependency_wave_excludes_url_specs(tmp_path: Path) -> None:
    mod = _load_script()
    cls = _reset_fake(str(tmp_path))
    cls.deps = {
-        "esphome/noise-c @ 0.1.24": [
+        "esphome/noise-c @ 0.1.26": [
            {"name": "vendored", "version": "https://github.com/x/y.git"},
        ],
    }
-    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.24"])
+    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.26"])
    assert {mod.spec_key(c) for c in cls.calls} == {"noise-c"}


@@ -348,13 +348,13 @@ def test_warm_store_still_walks_dependencies(tmp_path: Path) -> None:
    """Already-installed top-level packages still feed the dependency
    wave; a warm store can be missing a transitive dep."""
    mod = _load_script()
-    cls = _reset_fake(str(tmp_path), installed={"esphome/noise-c @ 0.1.24"})
+    cls = _reset_fake(str(tmp_path), installed={"esphome/noise-c @ 0.1.26"})
    cls.deps = {
-        "esphome/noise-c @ 0.1.24": [
+        "esphome/noise-c @ 0.1.26": [
            {"owner": "esphome", "name": "libsodium", "version": "^1.0"},
        ],
    }
-    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.24"])
+    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.26"])
    assert [mod.spec_key(c) for c in cls.calls] == ["libsodium"]


@@ -0,0 +1,562 @@
+"""Tests for script/setup.py."""
+
+import importlib.util
+import os
+from pathlib import Path, PurePosixPath, PureWindowsPath
+import runpy
+import sys
+from types import ModuleType
+from unittest.mock import Mock, call, patch
+
+import pytest
+
+_SCRIPT = Path(__file__).parents[2] / "script" / "setup.py"
+
+
+def _load_module() -> ModuleType:
+    spec = importlib.util.spec_from_file_location("script_setup", _SCRIPT)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+@pytest.fixture
+def script_setup() -> ModuleType:
+    """Fresh import of script/setup.py, isolated from other tests."""
+    return _load_module()
+
+
+# --- bin_dir / venv_python / activate_hint -----------------------------------
+
+
+def test_bin_dir_matches_host_layout(script_setup: ModuleType, tmp_path: Path) -> None:
+    """The venv scheme resolves to Scripts on Windows and bin everywhere else."""
+    expected = "Scripts" if os.name == "nt" else "bin"
+    assert script_setup.bin_dir(tmp_path) == tmp_path / expected
+
+
+# Both flavours are exercised on every host. Pure paths are used because a real
+# Path refuses to change flavour: PosixPath cannot be built on Windows, and
+# WindowsPath cannot be built on Unix.
+
+
+def test_venv_python_posix(script_setup: ModuleType, tmp_path: Path) -> None:
+    with (
+        patch.object(
+            script_setup, "bin_dir", return_value=PurePosixPath("/x/venv/bin")
+        ),
+        patch.object(script_setup.os, "name", "posix"),
+    ):
+        result = script_setup.venv_python(tmp_path)
+    assert result == PurePosixPath("/x/venv/bin/python")
+
+
+def test_venv_python_nt(script_setup: ModuleType, tmp_path: Path) -> None:
+    with (
+        patch.object(
+            script_setup, "bin_dir", return_value=PureWindowsPath(r"C:\x\venv\Scripts")
+        ),
+        patch.object(script_setup.os, "name", "nt"),
+    ):
+        result = script_setup.venv_python(tmp_path)
+    assert result == PureWindowsPath(r"C:\x\venv\Scripts\python.exe")
+
+
+def test_activate_hint_posix(script_setup: ModuleType) -> None:
+    with (
+        patch.object(script_setup, "ROOT", PurePosixPath("/x")),
+        patch.object(
+            script_setup, "bin_dir", return_value=PurePosixPath("/x/venv/bin")
+        ),
+        patch.object(script_setup.os, "name", "posix"),
+    ):
+        hint = script_setup.activate_hint()
+    assert hint == "source venv/bin/activate"
+
+
+def test_activate_hint_nt(script_setup: ModuleType) -> None:
+    with (
+        patch.object(script_setup, "ROOT", PureWindowsPath(r"C:\x")),
+        patch.object(
+            script_setup, "bin_dir", return_value=PureWindowsPath(r"C:\x\venv\Scripts")
+        ),
+        patch.object(script_setup.os, "name", "nt"),
+    ):
+        hint = script_setup.activate_hint()
+    # The nt branch returns str(activate) as-is, skipping the "source " prefix.
+    assert hint == r"venv\Scripts\activate"
+
+
+# --- run -----------------------------------------------------------------
+
+
+def test_run_success(script_setup: ModuleType) -> None:
+    with patch.object(
+        script_setup.subprocess, "run", return_value=Mock(returncode=0)
+    ) as mock_run:
+        script_setup.run(["echo", "hi"])
+    mock_run.assert_called_once_with(
+        ["echo", "hi"], cwd=script_setup.ROOT, env=None, check=False
+    )
+
+
+def test_run_failure_raises_system_exit_with_code(
+    script_setup: ModuleType, capsys: pytest.CaptureFixture[str]
+) -> None:
+    with (
+        patch.object(script_setup.subprocess, "run", return_value=Mock(returncode=7)),
+        pytest.raises(SystemExit) as excinfo,
+    ):
+        script_setup.run(["false"])
+    assert excinfo.value.code == 7
+    assert "Failed with exit code 7: false" in capsys.readouterr().err
+
+
+# --- git_output ------------------------------------------------------------
+
+
+def test_git_output_success_strips_stdout(script_setup: ModuleType) -> None:
+    with patch.object(
+        script_setup.subprocess,
+        "run",
+        return_value=Mock(returncode=0, stdout="  /repo/.git \n"),
+    ) as mock_run:
+        result = script_setup.git_output("rev-parse", "--absolute-git-dir")
+    assert result == "/repo/.git"
+    mock_run.assert_called_once_with(
+        ["git", "rev-parse", "--absolute-git-dir"],
+        cwd=script_setup.ROOT,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+
+def test_git_output_nonzero_returncode_is_empty(script_setup: ModuleType) -> None:
+    with patch.object(
+        script_setup.subprocess,
+        "run",
+        return_value=Mock(returncode=1, stdout="whatever"),
+    ):
+        assert script_setup.git_output("status") == ""
+
+
+def test_git_output_oserror_is_empty(script_setup: ModuleType) -> None:
+    with patch.object(script_setup.subprocess, "run", side_effect=OSError("no git")):
+        assert script_setup.git_output("status") == ""
+
+
+# --- create_venv -----------------------------------------------------------
+
+
+def test_create_venv_uses_uv_when_present(
+    script_setup: ModuleType, tmp_path: Path
+) -> None:
+    venv = tmp_path / "venv"
+    with (
+        patch.object(script_setup.shutil, "which", return_value="/usr/bin/uv"),
+        patch.object(
+            script_setup.subprocess, "run", return_value=Mock(returncode=0)
+        ) as mock_run,
+    ):
+        script_setup.create_venv(venv)
+    mock_run.assert_called_once_with(
+        ["/usr/bin/uv", "venv", "--clear", "--seed", str(venv)],
+        cwd=script_setup.ROOT,
+        env=None,
+        check=False,
+    )
+
+
+def test_create_venv_falls_back_to_venv_module(
+    script_setup: ModuleType, tmp_path: Path
+) -> None:
+    venv = tmp_path / "venv"
+    with (
+        patch.object(script_setup.shutil, "which", return_value=None),
+        patch.object(
+            script_setup.subprocess, "run", return_value=Mock(returncode=0)
+        ) as mock_run,
+    ):
+        script_setup.create_venv(venv)
+    mock_run.assert_called_once_with(
+        [sys.executable, "-m", "venv", "--clear", str(venv)],
+        cwd=script_setup.ROOT,
+        env=None,
+        check=False,
+    )
+
+
+# --- venv_environment --------------------------------------------------------
+
+
+def test_venv_environment_sets_virtual_env_and_prepends_path(
+    script_setup: ModuleType, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    venv = tmp_path / "venv"
+    monkeypatch.setenv("PYTHONHOME", "/somewhere")
+    monkeypatch.setenv("PATH", "/usr/bin:/bin")
+    env = script_setup.venv_environment(venv)
+    assert env["VIRTUAL_ENV"] == str(venv)
+    assert "PYTHONHOME" not in env
+    expected_prefix = str(script_setup.bin_dir(venv)) + os.pathsep
+    assert env["PATH"] == expected_prefix + "/usr/bin:/bin"
+
+
+def test_venv_environment_path_fallback_when_unset(
+    script_setup: ModuleType, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    venv = tmp_path / "venv"
+    monkeypatch.delenv("PATH", raising=False)
+    env = script_setup.venv_environment(venv)
+    # No trailing separator: an empty PATH entry means "search the cwd".
+    assert env["PATH"] == str(script_setup.bin_dir(venv))
+
+
+# --- find_uv -----------------------------------------------------------------
+
+
+def test_find_uv_found_immediately(script_setup: ModuleType, tmp_path: Path) -> None:
+    venv = tmp_path / "venv"
+    env = {"PATH": "/usr/bin"}
+    with (
+        patch.object(script_setup.shutil, "which", return_value="/usr/bin/uv"),
+        patch.object(script_setup.subprocess, "run") as mock_run,
+    ):
+        result = script_setup.find_uv(venv, env)
+    assert result == "/usr/bin/uv"
+    mock_run.assert_not_called()
+
+
+def test_find_uv_installed_then_found(script_setup: ModuleType, tmp_path: Path) -> None:
+    venv = tmp_path / "venv"
+    env = {"PATH": "/usr/bin"}
+    with (
+        patch.object(script_setup.shutil, "which", side_effect=[None, "/usr/bin/uv"]),
+        patch.object(
+            script_setup.subprocess, "run", return_value=Mock(returncode=0)
+        ) as mock_run,
+    ):
+        result = script_setup.find_uv(venv, env)
+    assert result == "/usr/bin/uv"
+    mock_run.assert_called_once_with(
+        [str(script_setup.venv_python(venv)), "-m", "pip", "install", "uv"],
+        cwd=script_setup.ROOT,
+        env=env,
+        check=False,
+    )
+
+
+def test_find_uv_still_missing_raises_system_exit(
+    script_setup: ModuleType, tmp_path: Path
+) -> None:
+    venv = tmp_path / "venv"
+    env = {"PATH": "/usr/bin"}
+    with (
+        patch.object(script_setup.shutil, "which", side_effect=[None, None]),
+        patch.object(script_setup.subprocess, "run", return_value=Mock(returncode=0)),
+        pytest.raises(SystemExit, match="uv could not be installed"),
+    ):
+        script_setup.find_uv(venv, env)
+
+
+# --- install_dependencies -----------------------------------------------------
+
+
+def test_install_dependencies_installs_setuptools_then_project(
+    script_setup: ModuleType, tmp_path: Path
+) -> None:
+    venv = tmp_path / "venv"
+    env = {"PATH": "/usr/bin"}
+    with (
+        patch.object(script_setup.shutil, "which", return_value="/usr/bin/uv"),
+        patch.object(
+            script_setup.subprocess, "run", return_value=Mock(returncode=0)
+        ) as mock_run,
+    ):
+        script_setup.install_dependencies(venv, env)
+    assert mock_run.call_args_list == [
+        call(
+            ["/usr/bin/uv", "pip", "install", "setuptools", "wheel"],
+            cwd=script_setup.ROOT,
+            env=env,
+            check=False,
+        ),
+        call(
+            [
+                "/usr/bin/uv",
+                "pip",
+                "install",
+                "-e",
+                ".[dev,test]",
+                "--config-settings",
+                "editable_mode=compat",
+            ],
+            cwd=script_setup.ROOT,
+            env=env,
+            check=False,
+        ),
+    ]
+
+
+# --- install_git_hooks ---------------------------------------------------------
+
+
+def _fake_git_output(git_dir: str, common_dir: str):
+    def _run(*args: str) -> str:
+        if "--absolute-git-dir" in args:
+            return git_dir
+        return common_dir
+
+    return _run
+
+
+def test_install_git_hooks_returns_early_when_git_dir_empty(
+    script_setup: ModuleType,
+) -> None:
+    env = {"PATH": "/usr/bin"}
+    with (
+        patch.object(
+            script_setup, "git_output", side_effect=_fake_git_output("", "/repo/.git")
+        ),
+        patch.object(script_setup.subprocess, "run") as mock_run,
+    ):
+        script_setup.install_git_hooks(env)
+    mock_run.assert_not_called()
+
+
+def test_install_git_hooks_returns_early_when_common_dir_empty(
+    script_setup: ModuleType,
+) -> None:
+    env = {"PATH": "/usr/bin"}
+    with (
+        patch.object(
+            script_setup, "git_output", side_effect=_fake_git_output("/repo/.git", "")
+        ),
+        patch.object(script_setup.subprocess, "run") as mock_run,
+    ):
+        script_setup.install_git_hooks(env)
+    mock_run.assert_not_called()
+
+
+def test_install_git_hooks_returns_early_for_worktree(
+    script_setup: ModuleType,
+) -> None:
+    """A worktree's git-dir differs from the shared common-dir."""
+    env = {"PATH": "/usr/bin"}
+    with (
+        patch.object(
+            script_setup,
+            "git_output",
+            side_effect=_fake_git_output("/repo/.git/worktrees/wt", "/repo/.git"),
+        ),
+        patch.object(script_setup.subprocess, "run") as mock_run,
+    ):
+        script_setup.install_git_hooks(env)
+    mock_run.assert_not_called()
+
+
+def test_install_git_hooks_missing_prek_raises_system_exit(
+    script_setup: ModuleType,
+) -> None:
+    env = {"PATH": "/usr/bin"}
+    with (
+        patch.object(
+            script_setup,
+            "git_output",
+            side_effect=_fake_git_output("/repo/.git", "/repo/.git"),
+        ),
+        patch.object(script_setup.shutil, "which", return_value=None),
+        patch.object(script_setup.subprocess, "run") as mock_run,
+        pytest.raises(SystemExit, match="prek was not installed"),
+    ):
+        script_setup.install_git_hooks(env)
+    mock_run.assert_not_called()
+
+
+def test_install_git_hooks_happy_path_installs_hook(
+    script_setup: ModuleType, tmp_path: Path
+) -> None:
+    env = {"PATH": "/usr/bin"}
+    common_dir = tmp_path / "repo" / ".git"
+    hooks_dir = common_dir / "hooks"
+    hooks_dir.mkdir(parents=True)
+    source_hook = tmp_path / "post-checkout"
+    source_hook.write_text("#!/bin/sh\necho post-checkout\n")
+
+    with (
+        patch.object(script_setup, "POST_CHECKOUT_HOOK", source_hook),
+        patch.object(
+            script_setup,
+            "git_output",
+            side_effect=_fake_git_output(str(common_dir), str(common_dir)),
+        ),
+        patch.object(script_setup.shutil, "which", return_value="/usr/bin/prek"),
+        patch.object(
+            script_setup.subprocess, "run", return_value=Mock(returncode=0)
+        ) as mock_run,
+    ):
+        script_setup.install_git_hooks(env)
+
+    mock_run.assert_called_once_with(
+        ["/usr/bin/prek", "install", "--overwrite"],
+        cwd=script_setup.ROOT,
+        env=env,
+        check=False,
+    )
+    installed = hooks_dir / "post-checkout"
+    assert installed.read_text() == source_hook.read_text()
+    if os.name != "nt":
+        # Windows has no POSIX permission bits for chmod to set.
+        assert (installed.stat().st_mode & 0o777) == 0o755
+
+
+def test_install_git_hooks_skips_copy_when_hooks_dir_missing(
+    script_setup: ModuleType, tmp_path: Path
+) -> None:
+    """The prek install still runs when the hooks directory does not exist."""
+    env = {"PATH": "/usr/bin"}
+    common_dir = tmp_path / "repo" / ".git"
+    common_dir.mkdir(parents=True)  # no "hooks" subdirectory created
+
+    with (
+        patch.object(
+            script_setup,
+            "git_output",
+            side_effect=_fake_git_output(str(common_dir), str(common_dir)),
+        ),
+        patch.object(script_setup.shutil, "which", return_value="/usr/bin/prek"),
+        patch.object(
+            script_setup.subprocess, "run", return_value=Mock(returncode=0)
+        ) as mock_run,
+    ):
+        script_setup.install_git_hooks(env)
+
+    mock_run.assert_called_once()
+    assert not (common_dir / "hooks").exists()
+
+
+# --- report ------------------------------------------------------------------
+
+
+def test_report_active_state(
+    script_setup: ModuleType, capsys: pytest.CaptureFixture
+) -> None:
+    venv = Path("/opt/esphome-venv")
+    script_setup.report(script_setup.VENV_ACTIVE, venv)
+    out = capsys.readouterr().out
+    assert "Dependencies installed into the active virtual environment:" in out
+    assert str(venv) in out
+    assert "is already active in this shell" in out
+
+
+def test_report_reused_state(
+    script_setup: ModuleType, capsys: pytest.CaptureFixture
+) -> None:
+    script_setup.report(script_setup.VENV_REUSED, script_setup.DEFAULT_VENV)
+    out = capsys.readouterr().out
+    assert "Dependencies updated in the existing ./venv" in out
+
+
+def test_report_created_state(
+    script_setup: ModuleType, capsys: pytest.CaptureFixture
+) -> None:
+    script_setup.report(script_setup.VENV_CREATED, script_setup.DEFAULT_VENV)
+    out = capsys.readouterr().out
+    assert "Virtual environment created at ./venv" in out
+
+
+# --- main --------------------------------------------------------------------
+
+
+def test_main_raises_system_exit_when_python_too_old(
+    script_setup: ModuleType,
+) -> None:
+    with (
+        patch.object(script_setup.sys, "version_info", (3, 11, 5)),
+        pytest.raises(SystemExit, match="ESPHome needs Python 3.12"),
+    ):
+        script_setup.main()
+
+
+def test_main_uses_active_virtual_env(
+    script_setup: ModuleType, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    active_venv = tmp_path / "active-venv"
+    monkeypatch.setenv("VIRTUAL_ENV", str(active_venv))
+    with (
+        patch.object(script_setup, "ROOT", tmp_path),
+        patch.object(script_setup, "create_venv") as mock_create_venv,
+        patch.object(script_setup, "install_dependencies") as mock_install_deps,
+        patch.object(script_setup, "install_git_hooks") as mock_install_hooks,
+        patch.object(script_setup, "report") as mock_report,
+    ):
+        script_setup.main()
+    mock_create_venv.assert_not_called()
+    mock_install_deps.assert_called_once()
+    mock_install_hooks.assert_called_once()
+    mock_report.assert_called_once_with(script_setup.VENV_ACTIVE, active_venv)
+    assert (tmp_path / ".temp").is_dir()
+
+
+def test_main_reuses_existing_venv(
+    script_setup: ModuleType, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("VIRTUAL_ENV", raising=False)
+    default_venv = tmp_path / "venv"
+    python_path = script_setup.venv_python(default_venv)
+    python_path.parent.mkdir(parents=True)
+    python_path.touch()
+
+    with (
+        patch.object(script_setup, "ROOT", tmp_path),
+        patch.object(script_setup, "DEFAULT_VENV", default_venv),
+        patch.object(script_setup, "create_venv") as mock_create_venv,
+        patch.object(script_setup, "install_dependencies") as mock_install_deps,
+        patch.object(script_setup, "install_git_hooks") as mock_install_hooks,
+        patch.object(script_setup, "report") as mock_report,
+    ):
+        script_setup.main()
+    mock_create_venv.assert_not_called()
+    mock_install_deps.assert_called_once()
+    mock_install_hooks.assert_called_once()
+    mock_report.assert_called_once_with(script_setup.VENV_REUSED, default_venv)
+    assert (tmp_path / ".temp").is_dir()
+
+
+def test_main_creates_new_venv(
+    script_setup: ModuleType, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("VIRTUAL_ENV", raising=False)
+    default_venv = tmp_path / "venv"  # does not exist yet
+
+    with (
+        patch.object(script_setup, "ROOT", tmp_path),
+        patch.object(script_setup, "DEFAULT_VENV", default_venv),
+        patch.object(script_setup, "create_venv") as mock_create_venv,
+        patch.object(script_setup, "install_dependencies") as mock_install_deps,
+        patch.object(script_setup, "install_git_hooks") as mock_install_hooks,
+        patch.object(script_setup, "report") as mock_report,
+    ):
+        script_setup.main()
+    mock_create_venv.assert_called_once_with(default_venv)
+    mock_install_deps.assert_called_once()
+    mock_install_hooks.assert_called_once()
+    mock_report.assert_called_once_with(script_setup.VENV_CREATED, default_venv)
+    assert (tmp_path / ".temp").is_dir()
+
+
+def test_run_as_script_calls_main(tmp_path: Path) -> None:
+    """The __main__ guard runs the whole flow, with every side effect stubbed."""
+    completed = Mock(returncode=0, stdout="")
+    with (
+        patch("subprocess.run", return_value=completed) as mock_run,
+        patch("shutil.which", return_value="/usr/bin/uv"),
+        patch("pathlib.Path.mkdir") as mock_mkdir,
+        patch.dict(os.environ, {"VIRTUAL_ENV": str(tmp_path / "env")}),
+    ):
+        runpy.run_path(str(_SCRIPT), run_name="__main__")
+
+    # The dependency install ran, and git reported no hooks directory to touch.
+    assert mock_run.called
+    mock_mkdir.assert_called_once_with(exist_ok=True)
@@ -1,150 +0,0 @@
-"""Tests for the web_server AP mode helpers."""
-
-import logging
-
-import pytest
-
-from esphome.components.web_server import (
-    _final_validate_ap_mode,
-    serve_captive,
-    serve_local,
-)
-from esphome.const import (
-    CONF_AP,
-    CONF_LOCAL,
-    CONF_NETWORKS,
-    CONF_PORT,
-    CONF_SSID,
-    CONF_VERSION,
-    CONF_WIFI,
-)
-import esphome.final_validate as fv
-
-AP_ONLY = {CONF_AP: {}}
-AP_FALLBACK = {CONF_AP: {}, CONF_NETWORKS: [{CONF_SSID: "x"}]}
-STA_ONLY = {CONF_NETWORKS: [{CONF_SSID: "x"}]}
-
-
-@pytest.mark.parametrize(
-    ("web_server_config", "wifi_config", "expected"),
-    [
-        # AP only: embed the interface, the AP has no internet.
-        ({CONF_VERSION: 2}, AP_ONLY, True),
-        ({CONF_VERSION: 3}, AP_ONLY, True),
-        # Explicit setting always wins.
-        ({CONF_VERSION: 2, CONF_LOCAL: False}, AP_ONLY, False),
-        ({CONF_VERSION: 2, CONF_LOCAL: True}, STA_ONLY, True),
-        # AP fallback, no AP, no wifi, or version 1 (no local mode): hosted page.
-        ({CONF_VERSION: 2}, AP_FALLBACK, False),
-        ({CONF_VERSION: 2}, STA_ONLY, False),
-        ({CONF_VERSION: 2}, None, False),
-        ({CONF_VERSION: 1}, AP_ONLY, False),
-    ],
-)
-def test_serve_local(
-    web_server_config: dict, wifi_config: dict | None, expected: bool
-) -> None:
-    """The interface is embedded for AP only WiFi unless local is set explicitly."""
-    assert serve_local(web_server_config, wifi_config) is expected
-
-
-@pytest.mark.parametrize(
-    ("web_server_config", "full_config", "expected"),
-    [
-        # AP only: local is implied, web_server is the captive portal.
-        ({CONF_VERSION: 2}, {CONF_WIFI: AP_ONLY}, True),
-        # Captive portal probes only work on port 80.
-        ({CONF_VERSION: 2, CONF_PORT: 8080}, {CONF_WIFI: AP_ONLY}, False),
-        # AP fallback needs an explicit local: true to be captive.
-        ({CONF_VERSION: 2}, {CONF_WIFI: AP_FALLBACK}, False),
-        ({CONF_VERSION: 2, CONF_LOCAL: True}, {CONF_WIFI: AP_FALLBACK}, True),
-        # captive_portal owns the role when configured.
-        ({CONF_VERSION: 2}, {CONF_WIFI: AP_ONLY, "captive_portal": {}}, False),
-        # No AP, no wifi, hosted page, or version 1: never captive.
-        ({CONF_VERSION: 2, CONF_LOCAL: True}, {CONF_WIFI: STA_ONLY}, False),
-        ({CONF_VERSION: 2, CONF_LOCAL: True}, {}, False),
-        ({CONF_VERSION: 2, CONF_LOCAL: False}, {CONF_WIFI: AP_ONLY}, False),
-        ({CONF_VERSION: 1}, {CONF_WIFI: AP_ONLY}, False),
-    ],
-)
-def test_serve_captive(
-    web_server_config: dict, full_config: dict, expected: bool
-) -> None:
-    web_server_config.setdefault(CONF_PORT, 80)
-    assert serve_captive(web_server_config, full_config) is expected
-
-
-@pytest.mark.parametrize(
-    ("web_server_config", "expect_warning"),
-    [
-        # Explicit local: false on an AP only device: the hosted page will stay blank.
-        ({CONF_VERSION: 2, CONF_PORT: 80, CONF_LOCAL: False}, True),
-        # Default: embedded and captive, nothing to warn about.
-        ({CONF_VERSION: 2, CONF_PORT: 80}, False),
-    ],
-)
-def test_final_validate_ap_mode_warns_for_hosted_page(
-    web_server_config: dict, expect_warning: bool, caplog: pytest.LogCaptureFixture
-) -> None:
-    token = fv.full_config.set({"web_server": web_server_config, CONF_WIFI: AP_ONLY})
-    try:
-        with caplog.at_level(logging.WARNING):
-            _final_validate_ap_mode(web_server_config)
-    finally:
-        fv.full_config.reset(token)
-    assert ("stays blank" in caplog.text) is expect_warning
-
-
-def test_final_validate_ap_mode_warns_for_non_default_port(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    """Captive portal detection needs port 80; other ports get a hint, not captive mode."""
-    config = {CONF_VERSION: 2, CONF_PORT: 8080}
-    token = fv.full_config.set({"web_server": config, CONF_WIFI: AP_ONLY})
-    try:
-        with caplog.at_level(logging.WARNING):
-            _final_validate_ap_mode(config)
-    finally:
-        fv.full_config.reset(token)
-    assert "cannot open automatically" in caplog.text
-    assert "http://192.168.4.1:8080/" in caplog.text
-
-
-def test_final_validate_ap_mode_port_warning_uses_manual_ip(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    """The manual URL in the port warning honors wifi.ap.manual_ip."""
-    from esphome.const import CONF_MANUAL_IP, CONF_STATIC_IP
-
-    config = {CONF_VERSION: 2, CONF_PORT: 8080}
-    wifi = {CONF_AP: {CONF_MANUAL_IP: {CONF_STATIC_IP: "10.0.0.1"}}}
-    token = fv.full_config.set({"web_server": config, CONF_WIFI: wifi})
-    try:
-        with caplog.at_level(logging.WARNING):
-            _final_validate_ap_mode(config)
-    finally:
-        fv.full_config.reset(token)
-    assert "http://10.0.0.1:8080/" in caplog.text
-
-
-@pytest.mark.parametrize(
-    ("wifi_config", "expected"),
-    [
-        # Explicit local: true on a fallback AP: announce the captive fallback role.
-        (AP_FALLBACK, "fallback access point"),
-        # Explicit local: true on AP only skips the implied-local info; still announce.
-        (AP_ONLY, "captive portal while the access point"),
-    ],
-)
-def test_final_validate_ap_mode_informs_explicit_local_captive(
-    wifi_config: dict, expected: str, caplog: pytest.LogCaptureFixture
-) -> None:
-    """Explicit local: true logs that web_server becomes the captive portal."""
-    config = {CONF_VERSION: 2, CONF_PORT: 80, CONF_LOCAL: True}
-    token = fv.full_config.set({"web_server": config, CONF_WIFI: wifi_config})
-    try:
-        with caplog.at_level(logging.INFO):
-            _final_validate_ap_mode(config)
-    finally:
-        fv.full_config.reset(token)
-    assert expected in caplog.text
@@ -1394,6 +1394,35 @@ def test_entity_metadata_visibility_hints() -> None:
    assert web["web_server"].visibility is advanced


+def test_with_visibility_remarks_keys() -> None:
+    """``with_visibility`` re-marks the named keys, preserving each field's
+    default and validator, without touching the other keys or the input schema.
+    """
+    base = cv.Schema(
+        {
+            cv.Optional("a", default=7): cv.int_,
+            cv.Optional("b", visibility=cv.Visibility.ADVANCED): cv.string,
+        }
+    )
+    promoted = cv.with_visibility(base, cv.Visibility.UI, "a")
+
+    pm = {str(k): k for k in promoted.schema}
+    assert pm["a"].visibility is cv.Visibility.UI  # re-marked
+    assert pm["a"].default() == 7  # default preserved
+    assert pm["b"].visibility is cv.Visibility.ADVANCED  # sibling untouched
+    assert promoted({}) == {"a": 7}  # validator/default still applied
+
+    # The input schema is left untouched (no shared-marker mutation).
+    assert {str(k): k for k in base.schema}["a"].visibility is None
+
+
+def test_with_visibility_unknown_key_raises() -> None:
+    """A key not present in the schema is a typo — fail at build time."""
+    base = cv.Schema({cv.Optional("a"): cv.int_})
+    with pytest.raises(ValueError, match="not in schema"):
+        cv.with_visibility(base, cv.Visibility.UI, "nope")
+
+
 def _wrap_str(value: str) -> ESPHomeDataBase:
    """Wrap a raw string as an ESPHomeDataBase, mimicking a YAML-loaded value."""
    return make_data_base(value)
@@ -416,6 +416,9 @@ def test_perform_ota_no_auth(
        "Update took 14.00 seconds (prepare 2.00, upload 5.00, commit 7.00)"
        in caplog.text
    )
+    # The data phase timeout must outlast the device's 105 s data timeout
+    mock_socket.settimeout.assert_any_call(espota2.DATA_PHASE_TIMEOUT)
+    assert espota2.DATA_PHASE_TIMEOUT > 105.0


@pytest.mark.usefixtures("mock_time")
@@ -1663,7 +1663,7 @@ def test_preinstall_runs_dependency_waves(tmp_path: Path) -> None:
        {"name": "SPI"},
    ]
    m.dependency_to_spec.side_effect = lambda dep: _FakeSpec(name=dep["name"])
-    pf._preinstall(m, [("noise-c@0.1.24", _FakeSpec(name="noise-c"))])
+    pf._preinstall(m, [("noise-c@0.1.26", _FakeSpec(name="noise-c"))])
    assert installed == ["noise-c", "libsodium"]  # dep deduped, SPI left out
    # The dep wave carries its compatibility so _install searches qualified
    dep_call = m._install.call_args_list[-1]
@@ -1683,7 +1683,7 @@ def test_preinstall_dependency_wave_skips_seen_names(tmp_path: Path) -> None:
    m._install.side_effect = lambda spec, skip_dependencies, compatibility=None: (
        installed.append(getattr(spec, "name", str(spec)))
    )
-    pf._preinstall(m, [("noise-c@0.1.24", _FakeSpec(name="noise-c"))])
+    pf._preinstall(m, [("noise-c@0.1.26", _FakeSpec(name="noise-c"))])
    assert installed == ["noise-c"]
Author	SHA1	Message	Date
J. Nick Koston	2b4e94901f	[esp32_ble_client] Keep INIT when a connect is rejected before registration The ble_client.connect action can reach connect() while the client is still in INIT; dropping it to IDLE there skipped the only registration path until the next disable cycle.	2026-09-10 09:51:47 -05:00
J. Nick Koston	decbeb6a80	[esp32_ble_tracker] Quiet the teardown of a scan that is still starting stop_scan_() logs an error for STARTING, which the settle right after it makes moot; only ask the controller to stop a scan that is running. Fold the two adjacent client-count guards and fix the services_released_ comment.	2026-09-10 09:34:08 -05:00
J. Nick Koston	2a9d11f14b	[esp32_ble] Honour an enable made during the disable callbacks The before-disabled callbacks can run user automations (on_scan_end fires when the tracker settles the scanner), so an enable issued there was flipped to ACTIVE and then overwritten by the DISABLED write after the teardown. Turn it into a bring-up instead. ble_client also skips advertisements until its app is registered, so the tracker does not stop the scan for a connect that would be rejected.	2026-09-10 08:50:34 -05:00
J. Nick Koston	7f4de6c5bd	[esp32_ble_tracker] Mark the disable from the hook and trim the transition code The tracker now learns about a disable from the before-disabled handler instead of polling is_active(), so a cancelled disable never reaches it and the scan restart no longer needs an IDLE gate. enable() and disable() are inline wrappers over a per-direction chain, ble_client skips the cache clean on a stack that is going down, and a stale comment and doc are brought up to date.	2026-09-10 08:48:00 -05:00
J. Nick Koston	8b273cc912	[esp32_ble] Fold enable and disable into one request table	2026-09-10 08:34:25 -05:00
J. Nick Koston	441a2c5ae9	[esp32_ble] Share the pending transition cancel	2026-09-10 08:11:24 -05:00
J. Nick Koston	216707f507	[esp32_ble] Cancel a pending transition instead of ignoring the opposite request enable() while a disable was still pending was ignored, so a disable followed by an enable before the next loop pass left BLE off. Cancel the pending transition in both directions; nothing has been torn down or brought up yet. The tracker only restarts its scan after a re-enable from IDLE, since a cancelled disable never stopped it.	2026-09-10 08:06:53 -05:00
J. Nick Koston	64b4465df3	[esp32_ble] Name the event queue drain	2026-09-10 08:02:38 -05:00
J. Nick Koston	6629de81b8	[esp32_ble_client] Settle a live link and clear the interface before the stack goes down Without the replayed close events a connected ble_client kept its services across a ble.disable cycle and grew a second copy on reconnect. Free them and report the disconnect from the hook, forget the old interface, and refuse an open before the app is registered on the new stack, matching the proxy backend.	2026-09-10 07:56:27 -05:00
J. Nick Koston	68cbe019c6	[bluetooth_connection] Keep the stack-down reset in one place The loop backstop only ran one pass earlier than the tracker hook and forced the reset into a helper with extra branches; the hook alone now does the reset. The unregistered-interface check moves to connect(), where it covers both the INIT state and the window before REG_EVT with one predicate.	2026-09-10 07:51:57 -05:00
J. Nick Koston	8c772b4dd4	[esp32_ble] Drop queued events and settle the scanner when the stack is dismantled Events the old stack queued while going down were replayed after the next ble.enable against a fresh stack that hands out the same interface ids, and the scanner relied on that replay to leave STOPPING. Drain the queue after the teardown and put the scanner back to IDLE from the before-disabled handler, since no completion can arrive anymore.	2026-09-10 07:39:51 -05:00
J. Nick Koston	a84269d6b0	[esp32_ble_tracker] Reset GATT clients before the BLE stack is dismantled An idle GATT client slot has its loop disabled, so the stack-down reset in loop() never runs across a ble.disable/ble.enable cycle. The slot keeps the gattc interface of the torn-down stack and never registers again; the next esp_ble_gattc_open on that interface is dropped by Bluedroid without any event and the slot stays in CONNECTING forever, which also blocks scanning. Give ESPBTClient a before-disabled hook, fan it out from the tracker's existing handler, and have both client implementations settle any link, go back to INIT and enable their loop so they register on the new stack. The Bluedroid backend also refuses to open on an unregistered interface instead of waiting for an event that cannot come.	2026-09-10 07:39:22 -05:00
luar123	54706e869c	[deep_sleep] disable loop (#18962 )	2026-09-10 07:18:15 -05:00
Anton Sergunov Jonathan Swoboda Jesse Hills	05f7d5e4f1	[mlx90614] pec validation (#6689 ) Co-authored-by: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com> Co-authored-by: Jesse Hills <3060199+jesserockz@users.noreply.github.com>	2026-09-10 16:14:43 +12:00
Robin ThoniandJesse Hills	ddbd89dd2a	[network] Improve `network::is_connected()` to better handle multiple interfaces (#18999 ) Co-authored-by: Jesse Hills <3060199+jesserockz@users.noreply.github.com>	2026-09-10 04:06:44 +00:00
Jesse Hills	5ed59af920	[template] Surface value metadata on template entity forms (#17545 )	2026-09-10 14:11:13 +12:00
Jesse Hills	4868b498cf	[ci] Ask stale PR authors to merge dev instead of rebasing (#19064 )	2026-09-10 14:09:58 +12:00
Jesse Hills	c66fa81208	[core] Consolidate setup scripts into a cross-platform setup.py (#18856 )	2026-09-10 14:09:49 +12:00
esphome[bot]	58ca345684	[ci] Refresh integration test durations (#19049 )	2026-09-09 13:42:09 -04:00
Remco van Essen	fd598057ef	[sendspin] Fix codec enum codegen when codecs is not set (#19055 )	2026-09-09 08:22:23 -04:00
Jesse Hills	ef7279341f	Merge branch 'beta' into dev	2026-09-09 12:18:55 +12:00
Jesse Hills	69f2a7d556	Merge pull request #19051 from esphome/bump-2026.9.0b3 2026.9.0b3	2026-09-09 12:18:36 +12:00
Jesse Hills	008677298a	Bump version to 2026.9.0b3	2026-09-09 09:54:44 +12:00
Kevin AhrendtandJesse Hills	d2bc056f0a	[sendspin] Add codec preference list to the media source (#19047 ) Co-authored-by: Jesse Hills <3060199+jesserockz@users.noreply.github.com>	2026-09-09 09:54:42 +12:00
J. Nick Koston	42fffd16fe	[esphome][core] Give a lost OTA chunk ack time to be retransmitted (#19041 )	2026-09-09 09:54:42 +12:00
J. Nick Koston	9c16aba6f7	[noise] Bump noise-c to 0.1.26 and libsodium to 1.10021.8 (#19030 )	2026-09-09 09:54:42 +12:00
Kevin Ahrendt	ac79173f4a	[i2s_audio] Fix spurious driver failure (#19045 )	2026-09-09 09:54:42 +12:00
Kevin Ahrendt	0a1e2acbcb	[audio][i2s_audio][micro_wake_word][microphone][mixer][resampler][speaker] Replace use_count() checks with lock and null test (#19046 )	2026-09-09 09:54:42 +12:00
Kevin AhrendtandCopilot Autofix powered by AI	9b6facb20d	[core] Fix use-after-free when deleting a running StaticTask (#19048 ) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-09-09 09:54:42 +12:00
esphome[bot]	f89b9e704c	Bump bundled esphome-device-builder to 1.14.5 (#19040 )	2026-09-09 09:54:42 +12:00
Johnandpre-commit-ci-lite[bot]	f8b2e53609	[atm90e32] Verify offset calibration writes (#18701 ) Co-authored-by: pre-commit-ci-lite[bot] <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com>	2026-09-09 09:54:42 +12:00
raykholo	7660dd7fa7	[anova] Re-assert temperature unit on every poll cycle (#17141 )	2026-09-09 09:54:42 +12:00
Bryan Li Bryan Li Claude Fable 5	c3ce07755f	[rf_bridge] Fix bucket sniffing with Portisch firmware (#17683 ) Co-authored-by: Bryan Li <bryanli@Bryans-MacBook-Pro.local> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-09-09 09:54:42 +12:00
Gytis	f8a4cfa945	[lvgl] Add missing label dependency to qrcode, keyboard and tabview (#18387 )	2026-09-09 09:54:42 +12:00
J. Nick Koston	866ddb6e57	[core] Skip PlatformIO's private-package authorization probe (#18823 )	2026-09-09 09:54:42 +12:00
Jonathan Swoboda	ca864c22b4	[tuya] Build without a network component (#18948 )	2026-09-09 09:54:42 +12:00
Jesse Hills	c9729244af	[udp] Use cv.invalid for relocated packet_transport options (#19032 )	2026-09-09 09:54:42 +12:00
Davide D M	442e4a1ec2	[debug] Check reboot source pref on ESP_RST_WDT and guard against empty source (#17537 )	2026-09-09 09:54:41 +12:00
Pieter ViljoenandJesse Hills	199acdf522	[ble_client] Report Established from nodes that never read services (#17920 ) Co-authored-by: Jesse Hills <3060199+jesserockz@users.noreply.github.com>	2026-09-09 09:54:41 +12:00
Samuel SiebandSamuel Sieb	9340863652	[dallas_temp] filter 85 temp from sensor reset (#17877 ) Co-authored-by: Samuel Sieb <samuel@sieb.net>	2026-09-09 09:54:41 +12:00
AndreKR	d5cff6e9df	[logger] Fix garbled stack traces (#17939 )	2026-09-09 09:54:41 +12:00
Ryan Ronnander	e7f45a0d31	[mqtt] Restore brightness flag in light discovery (#18950 )	2026-09-09 09:54:41 +12:00
mipa87andClaude	628ebe23ec	[audio] Do not treat MP3_STREAM_INFO_CHANGED as a fatal decoder error (#19028 ) Co-authored-by: Claude <noreply@anthropic.com>	2026-09-09 09:54:41 +12:00
mipa87 Claude pre-commit-ci-lite[bot]	823d79c948	[i2s_audio] Keep a start request that arrives while the speaker task stops (#19027 ) Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: pre-commit-ci-lite[bot] <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com>	2026-09-09 09:54:41 +12:00
Kevin AhrendtandJesse Hills	b947094f45	[sendspin] Add codec preference list to the media source (#19047 ) Co-authored-by: Jesse Hills <3060199+jesserockz@users.noreply.github.com>	2026-09-09 09:31:18 +12:00
J. Nick Koston	6c5ab89d5f	[esphome][core] Give a lost OTA chunk ack time to be retransmitted (#19041 )	2026-09-09 09:08:16 +12:00
J. Nick Koston	8f511a365a	[noise] Bump noise-c to 0.1.26 and libsodium to 1.10021.8 (#19030 )	2026-09-09 09:07:06 +12:00
Kevin Ahrendt	006f31af93	[i2s_audio] Fix spurious driver failure (#19045 )	2026-09-09 09:05:02 +12:00
Kevin Ahrendt	5bb112f407	[audio][i2s_audio][micro_wake_word][microphone][mixer][resampler][speaker] Replace use_count() checks with lock and null test (#19046 )	2026-09-09 09:04:34 +12:00
dependabot[bot]	4ab9298ab3	Bump esptool from 5.3.1 to 5.4.0 (#19023 )	2026-09-08 22:11:36 +02:00
Kevin AhrendtandCopilot Autofix powered by AI	3926612281	[core] Fix use-after-free when deleting a running StaticTask (#19048 ) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-09-09 07:46:17 +12:00