errorFlag constants update

* enable all constants inherited from WLED-MM * shorten comments about ERR_PERSISTENT_THRESHOLD (not implemented yet
Update index.js
2026-06-22 21:01:52 +00:00 · 2026-06-22 22:01:01 +02:00 · 2026-06-21 22:28:57 +02:00 · 2026-06-21 21:47:52 +02:00 · 2026-06-21 21:43:55 +02:00 · 2026-06-21 21:28:31 +02:00
64 changed files with 1544 additions and 508 deletions
@@ -6,6 +6,8 @@
 #   docs/cpp.instructions.md          — C++ coding conventions
 #   docs/web.instructions.md          — Web UI coding conventions
 #   docs/cicd.instructions.md         — GitHub Actions / CI-CD conventions
+#   docs/hardening.instructions.md    — basic rules for code hardening and robustness
+#   docs/securecode.instructions.md   — more detailed checklists for common vulnerabilities
 #
 # NOTE: This file must be committed (tracked by git) for CodeRabbit to read
 # it from the repository.  If it is listed in .gitignore, CodeRabbit will
@@ -15,7 +17,7 @@ language: en-US

 reviews:
  # generic review setting, see https://docs.coderabbit.ai/reference/configuration#reference
-  auto_apply_labels: true
+  auto_apply_labels: false
  # abort_on_close: false
  high_level_summary: true
  review_status: true
@@ -29,15 +31,21 @@ reviews:
      - 16_x
      - 0_15_x
      - V5
-      - V5_C6
    ignore_title_keywords:
      - WIP
+  tools:
+    fbinfer:
+      enabled: false   # Arduino.h not available on Linux analysis host
+    cppcheck:
+      enabled: true    # cppcheck works fine without Arduino headers
+    clang:
+      enabled: true    # clang tidy likewise works

  path_instructions:
    - path: "**/*.{cpp,h,hpp,ino}"
      instructions: >
        Follow the C++ coding conventions documented in docs/cpp.instructions.md
-        and the general project guidelines in .github/copilot-instructions.md.
+        and the general project guidelines in AGENTS.md and .github/copilot-instructions.md.

        Key rules: 2-space indentation (no tabs), camelCase functions/variables,
        PascalCase classes, UPPER_CASE macros. No C++ exceptions — use return codes and debug macros.
@@ -45,8 +53,37 @@ reviews:
        Hot-path optimization guidelines (attributes, uint_fast types, caching,
        unsigned range checks) apply from pixel set/get operations and strip.show() downward —
        NOT to effect functions in FX.cpp, which have diverse contributor styles.
-# disabled - the below instruction has no effect
-# When initially reviewing a PR, summarize good practices (top 5) and create a prioritized list of suggested improvements (focus on major ones).
+
+        When reviewing PRs labeled "AI" or when source code appears to be AI-generated, perform these additional checks:
+        1. VERIFY all referenced preprocessor macros, constants and flags exist by searching the codebase - do not trust the AI's claims about what exists.
+        2. CHECK for reinvention: search for existing functions/patterns that already solve the same problem.
+        3. CHECK for singleton data (defined but never used) and for dead/disabled code, and suggest to remove them.
+        4. VERIFY comments match code behavior - AI frequently generates plausible but incorrect comments.
+        5. VERIFY numerical stability / accuracy of arithmetic expressions. AI is often wrong when it comes to math and numbers.
+        6. CHECK for implied but weakly justified assumptions - like usermod loop() call frequency - and ask for clarification.
+        7. FLAG changes that appear unrelated: deleted comments, unnecessary re-formatting or re-factoring, and modifications in files that seem unrelated to the PR description.
+
+    # ── Security hardening — firmware (trust-boundary-aware) ────────────────
+    - path: "wled00/**/*.{cpp,h,hpp,ino}"
+      instructions: >
+        Apply the WLED security hardening rules from docs/hardening.instructions.md,
+        and consult docs/securecode.instructions.md when more details are needed for actionable recommendations.
+
+        Trust Boundary Model — enforce input-validation and bounds-checking rules
+        ONLY at the first untrusted ingress point. Untrusted ingress points are:
+          - HTTP/JSON API request bodies and query parameters (/json/*, /win, etc.)
+          - WebSocket message payloads
+          - UDP datagrams (parsePacket() / recvfrom() and protocol wrappers for
+            E1.31, DDP, Art-Net, TPM2.net)
+          - TCP socket reads
+          - Serial/UART command input
+          - ESP-NOW raw messages input
+
+        A value that has been validated and range-clamped at its ingress handler is
+        considered TRUSTED for all subsequent WLED core processing. Do NOT flag or suggest
+        repeated bounds/range checks or internal uses of already-sanitized data.
+        When it is unclear whether a value has been sanitized upstream, prefer
+        requesting clarification over raising a false-positive finding.

    - path: "wled00/data/**"
      instructions: >
@@ -55,8 +92,21 @@ reviews:
        Key rules: indent HTML and JavaScript with tabs, CSS with tabs.
        Files here are built into wled00/html_*.h and wled00/js_*.h by tools/cdata.js — never
        edit those generated headers directly.
-# disabled - the below instruction has no effect
-# When initially reviewing a PR, summarize good practices (top 5) and create a prioritized list of suggested improvements (focus on major ones).
+
+    # ── Security hardening — WebUI (always an ingress/output surface) ────────
+    - path: "wled00/data/**"
+      instructions: >
+        Apply the WLED web UI security rules from docs/securecode.instructions.md
+        (sections WEB1-WEB7).
+
+        The Trust Boundary Model does NOT reduce scope here: the WebUI is both
+        an ingress point (user input, postMessage, fetched config data) and an
+        output/rendering surface. Always flag DOM XSS risks, unsafe
+        innerHTML / document.write / insertAdjacentHTML / outerHTML assignments,
+        postMessage handlers without origin validation, eval() / new Function(),
+        unsafe location.href or location.replace() assignments, and DOM insertion
+        from fetched or config-derived data — regardless of where the data
+        originates.

    - path: "wled00/html_*.h"
      instructions: >
@@ -76,8 +126,33 @@ reviews:
        Each usermod lives in its own directory under usermods/ and is implemented
        as a .cpp file with a dedicated library.json file to manage dependencies. 
        Follow the same C++ conventions as the core firmware (docs/cpp.instructions.md).
-# disabled - the below instruction has no effect
-# When initially reviewing a PR, summarize good practices (top 6) and create a prioritized list of suggested improvements (skip minor ones).
+
+    # ── Security hardening — usermods (trust-boundary-aware, narrow scope) ───
+    - path: "usermods/**/*.{cpp,h,hpp}"
+      instructions: >
+        For usermods, the untrusted ingress points are:
+          - readFromConfig(JsonObject& root) and calls to getJsonValue()
+          - readFromJsonState(JsonObject& obj)  — JSON is parsed, but values are client-supplied
+          - onMqttMessage(char* topic, char* payload)  — raw network strings, no core sanitization
+          - onEspNowMessage(uint8_t* sender, uint8_t* payload, uint8_t len)  — raw radio bytes
+          - onUdpPacket(uint8_t* payload, size_t len)  — raw UDP buffer, no core filtering
+        Values retrieved at these ingress points are considered trusted only after the
+        usermod itself has validated and range-clamped them.
+
+        Flag ONLY downstream uses of ingress-derived values where an out-of-range or
+        unexpected value can cause misbehaviour that is not already guarded, for example:
+          - `switch` statements on an ingress-derived value with no `default` branch,
+            or with a missing `break` where fall-through is unintentional
+          - array or buffer indexing with an ingress-derived value where the index is
+            not clamped before use
+          - arithmetic with an ingress-derived value that can overflow or produce a
+            negative result used as a size or count
+
+        Do NOT flag:
+          - getJsonValue() call sites themselves (type coercion is handled by ArduinoJson)
+          - Internal logic that operates on values already confirmed safe at ingress
+          - Repeated range checks on values that have already been clamped
+          - General memory-safety patterns unrelated to ingress-derived data flow

    - path: ".github/workflows/*.{yml,yaml}"
      instructions: >
@@ -89,8 +164,6 @@ reviews:
        scoped to least privilege. Never interpolate github.event.* values directly
        into run: steps — pass them through an env: variable to prevent script
        injection. Do not use pull_request_target unless fully justified.
-# disabled - the below instruction has no effect
-# When initially reviewing a PR, summarize good practices (top 6) and create a prioritized list of suggested improvements.

    - path: "**/*.instructions.md"
      instructions: |
@@ -108,6 +181,73 @@ reviews:
        3. If new AI-facing rules were added without updating a related HUMAN_ONLY
           reference section, note this as a suggestion (not a required fix).

+    # ── Secrets / sensitive information scanning ────────────────────────────
+    - path: "platformio*.ini*"
+      instructions: >
+        Scan for secrets, passwords, and other sensitive information accidentally
+        committed to PlatformIO configuration files (platformio.ini,
+        platformio_override.ini, platformio_override.ini.sample).
+
+        Flag any of the following:
+          - build_flags entries that define credentials as literal values, e.g.:
+              -DWIFI_SSID=\"<YOUR_SSID>\" -DWIFI_PASS=\"<YOUR_PASSWORD>\"
+              -DOTA_PASS=\"<OTA_PASSWORD>\" -DMQTT_PASS=\"<MQTT_PASSWORD>\"
+            Flag only when the value is not a recognisable placeholder (see below).
+          - upload_flags or upload_port values that embed a password or auth token (e.g., --auth=<PASSWORD> or any URL using credential-bearing userinfo).
+          - Any key = <value> pair whose key name contains "pass", "password",
+            "secret", "token", "key", "credential", or "auth" where the value is
+            a non-empty, non-placeholder literal string.
+          - Hardcoded IP addresses or hostnames paired with credentials in the
+            same environment section.
+          - API keys or access tokens as literal strings in any field.
+
+        Do NOT flag:
+          - Values that are clearly template placeholders (e.g., YOUR_SSID,
+            <YOUR_PASSWORD>, changeme, example_token, your_password_here).
+          - Values that use PlatformIO environment variable substitution (${sysenv.WIFI_PASS} or ${env:WIFI_PASS}).
+          - Comments that only explain what a field should contain.
+          - platformio_override.ini.sample entries that contain only
+            placeholder/example values.
+
+    - path: "usermods/**/library.json"
+      instructions: >
+        Scan for secrets and sensitive information in usermod dependency manifests.
+
+        Flag any of the following:
+          - Dependency URLs that embed credentials in the URL itself (e.g., any URL containing credential-bearing userinfo).
+          - Personal access tokens, OAuth tokens, or API keys as literal strings
+            anywhere in the file.
+          - Values matching well-known secret patterns: GitHub PATs (ghp_...,
+            github_pat_...), AWS access keys (AKIA...), or similarly structured
+            high-entropy tokens.
+
+        Do NOT flag:
+          - Plain HTTPS or SSH URLs without embedded credentials.
+          - Version specifiers, semver ranges, or commit SHA references that
+            contain no credential prefix.
+          - Repository owner/name path segments (not credential material).
+
+    - path: "usermods/**/{readme,README,Readme}.md"
+      instructions: >
+        Scan for secrets, passwords, and sensitive information in usermod
+        documentation files, including inside code blocks, inline code, and prose.
+
+        Flag any of the following:
+          - Hardcoded Wi-Fi SSID or password values that appear to be real (non-placeholder) 
+            strings in configuration or installation examples.
+          - Hardcoded OTA, AP, or MQTT passwords in code snippets or step-by-step
+            instructions.
+          - API keys, bearer tokens, or access tokens shown as literal values.
+          - Example platformio_override.ini snippets that contain real-looking
+            credential values instead of placeholders.
+          - Hardcoded IP addresses combined with credentials in the same example.
+
+        Do NOT flag:
+          - Values that are clearly template placeholders (e.g., YOUR_SSID,
+            <password>, my_secret, changeme, ****).
+          - Generic prose describing what a field means without supplying a value.
+          - Asterisk-masked values (e.g., ******, ••••••).
+
  finishing_touches:
    # Docstrings | Options for generating Docstrings for your PRs/MRs.
    docstrings:
@@ -0,0 +1,14 @@
+{
+  "features": {
+    "ghcr.io/ar90n/devcontainer-features/platformio:1": {
+      "version": "1.0.2",
+      "resolved": "ghcr.io/ar90n/devcontainer-features/platformio@sha256:4a28f8c147d81ff996afebe6f43e453355b6373dd4022960351090b532ac9dd3",
+      "integrity": "sha256:4a28f8c147d81ff996afebe6f43e453355b6373dd4022960351090b532ac9dd3"
+    },
+    "ghcr.io/devcontainers/features/node:2": {
+      "version": "2.0.0",
+      "resolved": "ghcr.io/devcontainers/features/node@sha256:fedd4c11f7adfb64283b578dddc7da906728daa25fa293351c9d913231acf12f",
+      "integrity": "sha256:fedd4c11f7adfb64283b578dddc7da906728daa25fa293351c9d913231acf12f"
+    }
+  }
+}
@@ -1,11 +1,10 @@
 {
-	"name": "Python 3",
-	"build": {
-		"dockerfile": "Dockerfile",
-		"context": "..",
-		"args": { 
-			// Update 'VARIANT' to pick a Python version: 3, 3.6, 3.7, 3.8, 3.9
-			"VARIANT": "3"
+	"name": "WLED-dev",
+	"image": "mcr.microsoft.com/devcontainers/python:3",
+	"features": {
+    	"ghcr.io/ar90n/devcontainer-features/platformio:1": {},
+		"ghcr.io/devcontainers/features/node:2": {
+			"version": "v20.18.3"
 		}
 	},

@@ -43,7 +42,8 @@
 			},
 			"extensions": [
 				"ms-python.python",
-				"platformio.platformio-ide"
+				"platformio.platformio-ide",
+				"ms-vscode.cpptools-extension-pack"
 			]
 		}
 	},
@@ -52,7 +52,7 @@
 	// "forwardPorts": [],

 	// Use 'postCreateCommand' to run commands after the container is created.
-	"postCreateCommand": "bash -i -c 'nvm install && npm ci'",
+	"postCreateCommand": "",

 	// Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
 	"remoteUser": "vscode"
@@ -5,7 +5,9 @@ body:
  - type: markdown
    attributes:
      value: |
-        Please quickly search existing issues first before submitting a bug.
+        Please quickly search existing issues first before submitting a bug.  
+        Please don't submit long error analyses created by an AI agent, these are often totally wrong.  
+        Just describe the problem in your own words.
  - type: textarea
    id: what-happened
    attributes:
@@ -50,7 +50,7 @@ For detailed build timeouts, development workflows, troubleshooting, and validat
 main                # Main development trunk (daily/nightly) 17.0.0-dev
  ├── V5            # special branch: code rework for esp-idf 5.5.x (unstable)
      ├── V5-C6     # special branch: integration of new MCU types: esp32-c5, esp32-c6, esp32-p4 (unstable)
-16_x                # current beta, preparations for next release 16.0.0
+16_x                # maintenance for release 16.x.y
 0_15_x              # maintenance (bugfixes only) for current release 0.15.4
 (tag) v0.14.4       # previous version 0.14.4 (no maintenance)
 (tag) v0.13.3       # old version 0.13.3 (no maintenance)
@@ -60,6 +60,7 @@ main                # Main development trunk (daily/nightly) 17.0.0-dev

 - ``main``: development trunk (daily/nightly)
 - ``V5`` and ``V5-C6``: code rework for esp-idf 5.5.x (unstable) - branched from ``main``.
+- ``16_x``: maintenance for release 16.x.y
 - ``0_15_x``: bugfixing / maintenance for release 0.15.x

 ### Repository Structure
@@ -120,20 +121,8 @@ docs/                  # Contributor docs, coding guidelines

 Refer to `docs/cpp.instructions.md` and `docs/web.instructions.md` for language-specific conventions, and `docs/cicd.instructions.md` for GitHub Actions workflows.

-### Attribution for AI-generated code
-Using AI-generated code can hide the source of the inspiration / knowledge / sources it used. 
- Document attribution of inspiration / knowledge / sources used in the code, e.g. link to GitHub repositories or other websites describing the principles / algorithms used.
- When a larger block of code is generated by an AI tool, embed it into `// AI: below section was generated by an AI` ... `// AI: end` comments (see C++ guidelines).
- Every non-trivial AI-generated function should have a brief comment describing what it does. Explain parameters when their names alone are not self-explanatory.
- AI-generated code must be well documented with meaningful comments that explain intent, assumptions, and non-obvious logic. Do not rephrase source code; explain concepts and reasoning.
-
 ### Pull Request Expectations

 - **No force-push on open PRs.** Once a pull request is open and being reviewed, do not force-push (`git push --force`) to the branch. Force-pushing rewrites history that reviewers may have already commented on, making it impossible to track incremental changes. Use regular commits or `git merge` to incorporate feedback; the branch will be squash-merged when it is accepted.
 - **Modifications to ``platformio.ini`` MUST be approved explicitly** by a *maintainer* or *WLED organisation Member*. Modifications to the global build environment may break github action builds. Always flag them.
 - **Document your changes in the PR.** Every pull request should include a clear description of *what* changed and *why*. If the change affects user-visible behavior, describe the expected impact. Link to related issues where applicable. Provide screenshots to showcase new features.
-
-### Supporting Reviews and Discussions
- **For "is it worth doing?" debates** about proposed reliability, safety, or data-integrity mechanisms (CRC checks, backups, power-loss protection): suggest a software **FMEA** (Failure Mode and Effects Analysis). 
-  Clarify the main feared events, enumerate failure modes, assess each mitigation's effectiveness per failure mode, note common-cause failures, and rate credibility for the typical WLED use case.
-
@@ -35,6 +35,7 @@ default_envs = nodemcuv2
               esp32s3dev_16MB_opi
               esp32s3dev_8MB_opi
               esp32s3dev_8MB_qspi
+               esp32s3dev_8MB_none
               esp32s3_4M_qspi
               ; HUB75 release-only envs
               esp32dev_hub75
@@ -34,7 +34,7 @@ jobs:
          # Exclude issues that were closed without resolution from changelog
          excludeLabels: 'stale,wontfix,duplicate,invalid,external,question,use-as-is,not_planned'
      - name: Update Nightly Release
-        uses: andelf/nightly-release@main
+        uses: andelf/nightly-release@5834076edc55cc05975561c9722043f072ac5c26
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
@@ -4,6 +4,9 @@ on:
  pull_request:
    paths:
      - usermods/**
+  push:
+    paths:
+      - usermods/**

 env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
@@ -12,28 +15,40 @@ jobs:

  get_usermod_envs:
    # Only run for pull requests from forks (not from branches within wled/WLED)
-    if: github.event.pull_request.head.repo.full_name != github.repository
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
    name: Gather Usermods
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
      with:
-        python-version: '3.12'
-        cache: 'pip'
-    - name: Install PlatformIO
-      run: pip install -r requirements.txt
-    - name: Get default environments
+        fetch-depth: 0
+    - name: Get changed usermod environments
      id: envs
      run: |
-        echo "usermods=$(find usermods/ -name library.json | xargs dirname | xargs -n 1 basename | jq -R | grep -v PWM_fan | grep -v BME68X_v2| grep -v pixels_dice_tray | jq --slurp -c)" >> $GITHUB_OUTPUT
+        # Usermods whose directories changed in this PR
+        changed=$(git diff --name-only ${{ github.event.pull_request.base.sha }} HEAD \
+          | grep '^usermods/' | cut -d/ -f2 | sort -u || true)
+
+        # All usermods with a library.json (excluding known-incompatible ones)
+        all=$(find usermods/ -name library.json \
+          | xargs dirname | xargs -n 1 basename \
+          | grep -v PWM_fan | grep -v BME68X_v2 | grep -v pixels_dice_tray \
+          | sort || true)
+
+        if [ -z "$changed" ] || [ -z "$all" ]; then
+          echo "usermods=[]" >> $GITHUB_OUTPUT
+        else
+          usermods=$(comm -12 <(echo "$all") <(echo "$changed") | jq -R | jq --slurp -c)
+          echo "usermods=$usermods" >> $GITHUB_OUTPUT
+        fi
    outputs:
      usermods: ${{ steps.envs.outputs.usermods }}


  build:
    # Only run for pull requests from forks (not from branches within wled/WLED)
-    if: github.event.pull_request.head.repo.full_name != github.repository
+    # Skip when no changed usermods were found (e.g. only non-library changes)
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && needs.get_usermod_envs.outputs.usermods != '[]'
    name: Build Enviornments
    runs-on: ubuntu-latest
    needs: get_usermod_envs
@@ -74,4 +89,85 @@ jobs:
        cat platformio_override.ini

    - name: Build firmware
-      run: pio run -e ${{ matrix.environment }}    
+      run: pio run -e ${{ matrix.environment }}
+
+
+  get_custom_build_envs:
+    name: Gather Custom Build Environments
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Find usermods with custom build environments
+      id: custom_envs
+      run: |
+        # On PRs: only scan usermods whose directories changed.
+        # On push: scan all usermods (validates the full set on merge).
+        if [ "${{ github.event_name }}" = "pull_request" ]; then
+          changed=$(git diff --name-only ${{ github.event.pull_request.base.sha }} HEAD \
+            | grep '^usermods/' | cut -d/ -f2 | sort -u || true)
+          if [ -z "$changed" ]; then
+            echo "matrix=[]" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          samples=$(for mod in $changed; do
+            f="usermods/$mod/platformio_override.ini.sample"
+            [ -f "$f" ] && echo "$f"
+          done | sort)
+        else
+          samples=$(find usermods/ -name "platformio_override.ini.sample" | sort)
+        fi
+
+        result='[]'
+        for sample in $samples; do
+          usermod=$(dirname "$sample" | xargs basename)
+          # Skip usermods known to be incompatible (same list as get_usermod_envs)
+          case "$usermod" in PWM_fan|BME68X_v2|pixels_dice_tray) continue ;; esac
+          envs=$(grep -E '^\[env:[^]]+\]' "$sample" | sed 's/^\[env:\(.*\)\]$/\1/')
+          for env in $envs; do
+            result=$(echo "$result" | jq --arg u "$usermod" --arg e "$env" '. + [{usermod: $u, env: $e}]')
+          done
+        done
+        echo "matrix=$(echo "$result" | jq -c '.')" >> $GITHUB_OUTPUT
+    outputs:
+      matrix: ${{ steps.custom_envs.outputs.matrix }}
+
+
+  build_custom:
+    name: Build Custom Env (${{ matrix.usermod }} / ${{ matrix.env }})
+    runs-on: ubuntu-latest
+    needs: get_custom_build_envs
+    if: needs.get_custom_build_envs.outputs.matrix != '[]'
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.get_custom_build_envs.outputs.matrix) }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version-file: '.nvmrc'
+        cache: 'npm'
+    - run: npm ci
+    - name: Cache PlatformIO
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.platformio/.cache
+          ~/.buildcache
+          build_output
+        key: pio-${{ runner.os }}-${{ matrix.env }}-${{ hashFiles('platformio.ini', 'pio-scripts/output_bins.py') }}-${{ hashFiles('wled00/**', 'usermods/**') }}
+        restore-keys: pio-${{ runner.os }}-${{ matrix.env }}-${{ hashFiles('platformio.ini', 'pio-scripts/output_bins.py') }}-
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.12'
+        cache: 'pip'
+    - name: Install PlatformIO
+      run: pip install -r requirements.txt
+    - name: Apply custom build environment
+      run: cp -v "usermods/${{ matrix.usermod }}/platformio_override.ini.sample" platformio_override.ini
+    - name: Build firmware
+      run: pio run -e ${{ matrix.env }}
@@ -1,10 +1,13 @@
-# AGENTS.md — WLED Coding Agent Reference
+# AGENTS.md — WLED AI Coding Agent & AI Code Review Reference

 WLED is C++ firmware for ESP32/ESP8266 microcontrollers controlling addressable LEDs,
 with a web UI (HTML/JS/CSS). Built with PlatformIO (Arduino framework) and Node.js tooling.

 See also: `.github/copilot-instructions.md`, `.github/agent-build.instructions.md`,
-`docs/cpp.instructions.md`, `docs/web.instructions.md`, `docs/cicd.instructions.md`.
+`docs/cpp.instructions.md`, `docs/web.instructions.md`, `docs/cicd.instructions.md`,
+`docs/hardening.instructions.md`, `docs/securecode.instructions.md`.
+
+Always reference these instructions - including coding guidelines in `docs/` - first and fallback to search or bash commands only when you encounter unexpected information that does not match the info here.

 ## Build Commands

@@ -25,7 +28,7 @@ required C headers for firmware compilation.
 Tests use Node.js built-in test runner (`node:test`). The single test file is
 `tools/cdata-test.js`. Run it with:

-```sh
+```bash
 npm test                   # runs all tests via `node --test`
 node --test tools/cdata-test.js  # run just that file directly
 ```
@@ -39,7 +42,7 @@ target environments. Always build after code changes: `pio run -e esp32dev`.

 ### Recovery / Troubleshooting

-```sh
+```bash
 npm run build -- -f              # force web UI rebuild
 rm -f wled00/html_*.h wled00/js_*.h && npm run build  # clean + rebuild UI
 pio run --target clean           # clean PlatformIO build artifacts
@@ -48,7 +51,7 @@ rm -rf node_modules && npm ci    # reinstall Node.js deps

 ## Project Structure

-```
+```text
 wled00/              # Main firmware source (C++)
  data/              # Web UI source (HTML/JS/CSS) — tabs for indentation
  html_*.h, js_*.h   # Auto-generated (NEVER edit or commit)
@@ -61,6 +64,19 @@ docs/                # Coding convention docs
 .github/workflows/   # CI/CD (GitHub Actions)
 ```

+### Branch / Release Structure
+
+```text
+main                # Main development trunk (daily/nightly) 17.0.0-dev. Target branch for PRs.
+  ├── V5            # special branch: code rework for esp-idf 5.5.x (unstable)
+      ├── V5-C6     # special branch: integration of new MCU types: esp32-c5, esp32-c6, esp32-p4 (unstable)
+16_x                # maintenance for release 16.0.x
+0_15_x              # maintenance (bugfixes only) for previous release 0.15.x
+(tag) v0.14.4       # old version 0.14.4 (no maintenance)
+(tag) v0.13.3       # old version 0.13.3 (no maintenance)
+(tag) v0. ... . ... # historical versions 0.12.x and before
+```
+
 ## C++ Code Style (wled00/, usermods/)

 ### Formatting
@@ -70,6 +86,10 @@ docs/                # Coding convention docs
 - Space after keywords (`if (...)`, `for (...)`), no space before function parens (`doStuff(a)`)
 - No enforced line-length limit

+### Comments
+- `//` for inline (always space after), `/* */` for block comments
+- Important: AI-generated source code blocks **must be mark with `// AI: below section was generated by an AI` / `// AI: end`**
+
 ### Naming Conventions
 | Kind | Convention | Examples |
 |---|---|---|
@@ -105,16 +125,24 @@ docs/                # Coding convention docs
 - No VLAs — use fixed arrays or heap allocation
 - Call `reserve()` on strings/vectors to pre-allocate and avoid fragmentation

+#### ESP32 PSRAM guidelines
+
+- **Check availability**: Test chip availability with `psramFound() && ESP.getPsramSize() > 0` before assuming PSRAM is present. Never rely on `BOARD_HAS_PSRAM`only.
+- **DMA compatibility**: on ESP32 (classic), PSRAM buffers are **not DMA-capable**. On ESP32-S3 with octal PSRAM (`CONFIG_SPIRAM_MODE_OCT`), PSRAM buffers *can* be used with DMA when `CONFIG_SOC_PSRAM_DMA_CAPABLE` is defined.
+- **Fragmentation**: PSRAM allocations fragment less than DRAM because the region is larger. But avoid mixing small and large allocations in PSRAM — small allocations waste the MMU page granularity.
+- **Performance**: Prefer DRAM (or IRAM) for hot-path data that is *frequently* used. Prefer PSRAM for capacity-oriented buffers where slightly slower access times can be tolerated.
+
+Background Info:
+
+- PSRAM access is up to 18× slower than DRAM on ESP32 (dual-SPI bus), 3–10× slower than DRAM on ESP32-S3/-S2 with quad-SPI bus. On ESP32-S3 with octal PSRAM (`CONFIG_SPIRAM_MODE_OCT`), the penalty is smaller (~2×) because the 8-line DTR bus can transfer 8 bits in parallel. On ESP32-P4 with hex PSRAM (`CONFIG_SPIRAM_MODE_HEX`), the 16-line bus runs at 200 MHz which brings it on-par with DRAM.
+- Consider that ESP32 often crashes when the largest DRAM chunk gets below 10 KB.
+
 ### Preprocessor / Feature Flags
 - Feature toggling: `WLED_DISABLE_*` and `WLED_ENABLE_*` flags (exact names matter!)
 - `WLED_DISABLE_*`: `2D`, `ADALIGHT`, `ALEXA`, `MQTT`, `OTA`, `INFRARED`, `WEBSOCKETS`, etc.
 - `WLED_ENABLE_*`: `DMX`, `GIF`, `HUB75MATRIX`, `JSONLIVE`, `WEBSOCKETS`, etc.
 - Platform: `ARDUINO_ARCH_ESP32`, `ESP8266`, `CONFIG_IDF_TARGET_ESP32S3`

-### Comments
- `//` for inline (always space after), `/* */` for block comments
- AI-generated blocks: mark with `// AI: below section was generated by an AI` / `// AI: end`
-
 ### Math Functions
 - Use `sin8_t()`, `cos8_t()` — NOT `sin8()`, `cos8()` (removed, won't compile)
 - Use `sin_approx()` / `cos_approx()` instead of `sinf()` / `cosf()`
@@ -130,6 +158,13 @@ docs/                # Coding convention docs
 - `delay(1)` in custom FreeRTOS tasks (NOT `yield()`) — feeds IDLE watchdog
 - Do not use `delay()` in effects (FX.cpp) or hot pixel path

+#### ESP32 Task Synchronization
+
+- Use FreeRTOS mutexes, semaphores or queues when true concurrent access from multiple FreeRTOS tasks is possible, and race-conditions can lead to unexpected behaviour.
+- **Avoid `portENTER_CRITICAL()` / `portEXIT_CRITICAL()`**, as these functions stall the complete system and may cause LEDs flickering. Prefer FreeRTOS mutexes, semaphores or queues.
+- **Important**: Not every shared resource needs a mutex. Some synchronization is guaranteed by the overall control flow, for example when function calls are sequenced within the same loop iteration.
+- Consider using `std::atomic` or RAII scoped guards as alternatives to mutexes, semaphores or queues.
+
 ## Web UI Code Style (wled00/data/)

 - **Tab indentation** for HTML, JS, and CSS
@@ -148,17 +183,26 @@ class MyUsermod : public Usermod {
    bool enabled = false;
    static const char _name[];
  public:
-    void setup() override { /* ... */ }
-    void loop() override { /* ... */ }
-    void addToConfig(JsonObject& root) override { /* ... */ }
-    bool readFromConfig(JsonObject& root) override { /* ... */ }
+    void setup() override { /* ... */ }                          // runs once at start-up
+    void loop() override { /* ... */ }                           // runs once per main loop iteration
+    void addToConfig(JsonObject& root) override { /* ... */ }    // create/add persistent settings (usermod settings)
+    bool readFromConfig(JsonObject& root) override { /* ... */ } // read from persistent settings (usermod settings UI)
    uint16_t getId() override { return USERMOD_ID_MYMOD; }
+    void addToJsonInfo(JsonObject& root) override { /* ... */ }  // Add custom items to the "info" page and to /json/info
+    void appendConfigData() override { /* ... */ }               // Customize the settings page: dropdowns, checkboxes, extra text, etc. Buffer size is limited!
 };
 const char MyUsermod::_name[] PROGMEM = "MyUsermod";
 static MyUsermod myUsermod;
 REGISTER_USERMOD(myUsermod);
 ```

+refer to detailed examples in `usermods/EXAMPLE/`, `usermods/user_fx/` and [in the user documentation for custom features](https://kno.wled.ge/advanced/custom-features/).
+
+- Activate via `custom_usermods = ` in platformio build config. The `usermod_v2_` prefix or `_v2` suffix can be omitted.
+- Base new usermods on `usermods/EXAMPLE/` (never edit the example directly)
+- Store repeated strings as `static const char[] PROGMEM`
+- Add usermod IDs to `wled00/const.h` **only when a unique ID is required** (see below)
+
 ### Usermod IDs

 A unique ID (registered in `wled00/const.h` and overriding `getId()`) is **only required** when a usermod needs one or more of the following:
@@ -169,14 +213,18 @@ A unique ID (registered in `wled00/const.h` and overriding `getId()`) is **only

 If none of the above apply, the usermod may omit `getId()` (or return the default `USERMOD_ID_UNSPECIFIED`) and does **not** need an entry in `const.h`.

- Add usermod IDs to `wled00/const.h` **only when a unique ID is required** (see above)
- Activate via `custom_usermods` in platformio build config
- Base new usermods on `usermods/EXAMPLE/` (never edit the example directly)
- Store repeated strings as `static const char[] PROGMEM`
+### Usermod `loop()`
+
+- Called once per main loop iteration. Usermods should simply `return` when `!enabled`.
+- Frequency of calls varies with system load:
+    * up to 2000 times/sec with few LEDs and little background activity,
+    * between 20 and 300 times/second during high workload from effects and other usermods,
+    * (worst case) down to 1-3 times/sec during FS activity or when serving lots of network API requests.

 ## CI/CD

 CI runs on every push/PR via GitHub Actions (`.github/workflows/wled-ci.yml`):
+
 1. `npm test` (web UI build validation)
 2. Firmware compilation for all default environments (~22 targets)
 3. Post-link validation of usermod linkage (`validate_modules.py`)
@@ -185,12 +233,35 @@ No automated linting is configured. Match existing code style in files you edit.

 ## General Rules

- Repository language is English
+- Important: Repository language is **English**. This applies to source code (including comments), commit messages and any kind of documentation for developer or users.
 - The `docs/` folder is for developer/contributor information (coding conventions, architecture, etc.). User documentation is maintained in the [wled/WLED-Docs](https://github.com/wled/WLED-Docs) repository.
- Never edit or commit auto-generated `wled00/html_*.h` / `wled00/js_*.h`
+- Never edit or commit auto-generated `wled00/html_*.h` / `wled00/js_*.h`.
 - When updating an existing PR, retain the original description. Only modify it to ensure technical accuracy. Add change logs after the existing description.
- No force-push on open PRs
- Changes to `platformio.ini` require maintainer approval
- Remove dead/unused code — justify or delete it
- Verify feature-flag spelling exactly (misspellings are silently ignored by preprocessor)
+- No force-push on open PRs!
+- Important: **Changes to `platformio.ini` require maintainer approval**!
+- PRs should respect `.gitignore` and not upload files like  `platformio_override.ini`. PR authors may add buildenv examples for custom boards into `platformio_override.ini.sample`.
+- Remove dead/unused code — justify or delete it.
+- Verify feature-flag spelling exactly (misspellings are silently ignored by preprocessor).
 - Provide references when making analyses or recommendations. Support factual claims with verifiable citations, references or concrete evidence; **never fabricate citations**.
+- **Highlight user-visible breaking changes and ripple effects** during reviews. Ask for confirmation that these were introduced intentionally.
+
+### Security Hardening
+
+When writing or reviewing code in `wled00/`, `usermods/`, `wled00/data/`, or `.github/workflows/`,
+consult `docs/hardening.instructions.md` (concise checklist) and `docs/securecode.instructions.md` (detailed rules with examples).
+These files define WLED's threat model, trust boundary model, and WLED-specific constraints (no TLS baseline, no UDP authentication for protocol-defined
+multicast/broadcast, firewall-isolated deployment assumed).
+
+### Attribution for AI-generated code
+
+Using AI-generated code can hide the source of the inspiration / knowledge / sources it used.
+
+- Document attribution of inspiration / knowledge / sources used in the code, e.g. link to GitHub repositories or other websites describing the principles / algorithms used.
+- When a larger block of code is generated by an AI tool, embed it into `// AI: below section was generated by an AI` ... `// AI: end` comments (see Comments section).
+- Every non-trivial AI-generated function should have a brief comment describing what it does. Explain parameters when their names alone are not self-explanatory.
+- AI-generated code must be well documented with meaningful comments that explain intent, assumptions, and non-obvious logic. Do not rephrase source code; explain concepts and reasoning.
+
+### Supporting Reviews and Discussions
+
+- **For "is it worth doing?" debates** about proposed reliability, safety, or data-integrity mechanisms (CRC checks, backups, power-loss protection): suggest a software **FMEA** (Failure Mode and Effects Analysis).
+  Clarify the main feared events, enumerate failure modes, assess each mitigation's effectiveness per failure mode, note common-cause failures, and rate credibility for the typical WLED use case.
@@ -10,8 +10,8 @@ We'll work with you to refine your contribution, but we'll also push back if som
 Here are a few suggestions to make it easier for you to contribute:

 ### Important Developer Infos
-* [Project Structure, Files and Directories](.github/copilot-instructions.md#project-structure-overview) (in our AI instructions)
-* [Instructions for creating usermods](.github/copilot-instructions.md#usermod-guidelines) (in our AI instructions)
+* [Project Structure, Files and Directories](AGENTS.md#project-structure) (in our AI instructions)
+* [Instructions for creating usermods](AGENTS.md#usermod-pattern) (in our AI instructions)
 * KB: [Compiling WLED](https://kno.wled.ge/advanced/compiling-wled/) - slightly outdated but still helpful :-)
 * Arduino IDE is not supported any more. Use VSCode with the PlatformIO extension. 
 * [Compiling in VSCode/Platformio](https://github.com/wled/WLED-Docs/issues/161) - modern way without command line or platformio.ini changes.
@@ -141,8 +141,6 @@ Sometimes you might hit merge conflicts with `main` that are harder to solve. He
 ### Additional Resources
 Want to know more? Check out:
 - 📚 [GitHub Desktop documentation](https://docs.github.com/en/desktop) - if you prefer GUI tools
- 🎓 [How to properly submit a PR](https://github.com/wled-dev/WLED/wiki/How-to-properly-submit-a-PR) - detailed tips and tricks
-

 ## After Approval
 Once approved, a maintainer will merge your PR (possibly squashing commits). 
@@ -515,6 +515,8 @@ void myTask(void*) {

 - **LittleFS filenames**: File paths passed to `file.open()` must not exceed 255 bytes (`LFS_NAME_MAX`). Validate constructed paths (e.g., `/ledmap_` + segment name + `.json`) stay within this limit (assume standard configurations, like WLED_MAX_SEGNAME_LEN = 64).

+- In C/C++, additive operators (`+`, `-`) have HIGHER precedence than shift operators (`<<`, `>>`). Therefore `x - edge0 << 8` correctly parses as `(x - edge0) << 8`. Do NOT flag this pattern as a precedence bug. When reviewing WLED fixed-point code or any C/C++ shift expressions, verify against cppreference before claiming precedence issues with mixed `-`/`+` and `<<`/`>>` expressions.
+
 - **Float-to-unsigned conversion is undefined behavior when the value is out of range.** Converting a negative `float` directly to an unsigned integer type (`uint8_t`, `uint16_t`, …) is UB per the C++ standard — the Xtensa (ESP32) toolchain may silently wrap, but RISC-V (ESP32-C3/C5/C6/P4) can produce different results due to clamping. Cast through a signed integer first:
  ```cpp
  // Undefined behavior — avoid:
@@ -413,7 +413,7 @@ WLED provides convenience wrappers with automatic fallback. **Always prefer thes

 ### PSRAM guidelines

- **Check availability**: always test `psramFound()` before assuming PSRAM is present.
+- **Check availability**: test availability with `psramFound() && ESP.getPsramSize() > 0` before assuming PSRAM is present. Never rely on `BOARD_HAS_PSRAM`only.
 - **DMA compatibility**: on ESP32 (classic), PSRAM buffers are **not DMA-capable** — use `d_malloc_only()` to allocate DMA buffers in DRAM only. On ESP32-S3 with octal PSRAM (`CONFIG_SPIRAM_MODE_OCT`), PSRAM buffers *can* be used with DMA when `CONFIG_SOC_PSRAM_DMA_CAPABLE` is defined.
 - **JSON documents**: use the `PSRAMDynamicJsonDocument` allocator (defined in `wled.h`) to put large JSON documents in PSRAM:
  ```cpp
@@ -0,0 +1,58 @@
+---
+applyTo: "**/*.{cpp,h,hpp,ino,js,htm,html,css,yml,yaml}"
+description: "WLED strict-mode security review: low-noise checklist."
+---
+
+# WLED Security Review — Low Noise Mode
+
+Use these code hardening rules for automated reviews with minimal false positives.
+
+## WLED Constraints (apply to all rules)
+
+- Assume firewall/DMZ/VPN deployment; focus on realistic LAN-local and supply-chain risks.
+- Do **not** require TLS/HTTPS as a baseline control.
+- Do **not** require authentication for standards-based UDP multicast/broadcast paths where authentication is not defined in the protocol specification.
+
+> **Trust boundary model**: Apply input-validation rules **only at the first untrusted ingress point**
+> (HTTP/JSON API body or query string, WebSocket payload, UDP datagram, TCP read, serial command, ESP-NOW raw messages).
+> Values that have been validated and range-clamped at ingress are **trusted** for internal WLED
+> processing. Do not flag subsequent uses or internal copies of already-sanitized data.
+
+## CRITICAL Rules
+
+1. **No unchecked buffer copies** (`memcpy`, `memmove`, `strcpy`) in firmware paths when source buffer or size comes from an untrusted origin; prefer bounded alternatives (`strncpy`, `strlcpy`); require length validation before copying.
+2. **No user-controlled format strings** in `DEBUG_PRINTF*` and similar logging APIs.
+3. **Validate all untrusted external input** (HTTP/JSON/UDP/serial) before index/length/pin usage.
+4. **Auth required for state-changing control endpoints where feasible** (for example HTTP/JSON); do not flag protocol-defined unauthenticated UDP multicast/broadcast channels solely for missing auth.
+5. **No fail-open on parse/allocation errors** for config/state updates.
+6. **No DOM XSS sinks with untrusted data** (`innerHTML`, unsafe HTML insertion). Server-side generation of JavaScript property-assignment statements (as used in WLED's printSetForm* helpers) is exempt.
+7. **No dynamic code execution** (`eval`, `new Function`, string timers).
+8. **No hardcoded secrets/credentials/tokens/keys** in committed files.
+9. **No sensitive data in logs** (passwords, tokens, Wi-Fi secrets, auth headers).
+10. **No secret exposure in workflows/log output, or in LittleFS files other than `wsec.json`**.
+11. **No unsafe third-party GitHub Action pinning** (`@main`/`@master` disallowed).
+12. **No untrusted expression interpolation in workflow shell commands**.
+
+## IMPORTANT Rules
+
+13. Avoid potentially unbounded string/memory operations (`strcmp`, `strchr`, `strlen`, `sprintf`) in firmware paths; prefer bounded alternatives (`strnlen`, `strncmp`, `snprintf`).
+14. Check integer overflow risks in size/index arithmetic, but consider that unsigned wrap-around on small types might be intentional. 
+15. Reject repeated heap allocation churn in hot render/effect loops.
+16. Avoid repeated `String` growth in hot paths; prefer bounded/pre-allocated buffers.
+17. Ensure UI validation is mirrored by firmware-side validation.
+18. Require strict origin checks for `postMessage` listeners.
+19. Disallow untrusted redirect/navigation targets.
+20. Prevent verbose error responses that leak internals.
+21. Review new dependencies for typosquatting and known vulnerability risk.
+22. Keep workflow `permissions` least-privilege.
+23. Verify new `WLED_ENABLE_*` / `WLED_DISABLE_*` names are valid known flags.
+24. New privileged behavior must not be enabled by insecure defaults; first-use default-credential change required where applicable.
+25. OTA paths (Update.begin(), Update.write()) must verify firmware integrity (checksum/hash); TLS not required.
+26. Flag xTaskCreate/xTaskCreatePinnedToCore tasks with insufficient stack for String/JSON use; flag MDNS.begin() / ArduinoOTA.setHostname() with unsanitized hostnames.
+27. Flag API/config serialization that exposes Wi-Fi/AP/MQTT password fields to unauthenticated clients.
+28. Treat fetched and config-derived strings as untrusted when inserting into the DOM; explicit sanitization required for HTML contexts.
+
+## Reviewer Output Format
+
+- Include severity, exact file and line, and one concrete fix direction.
+- Prioritize CRITICAL findings before IMPORTANT findings.
@@ -0,0 +1,227 @@
+---
+applyTo: "**/*.{cpp,h,hpp,ino,js,htm,html,css,yml,yaml}"
+description: "WLED-focused security review guide based on OWASP Top 10 for embedded firmware and web UI."
+---
+
+# WLED Security Review Standards (Embedded + Web UI)
+
+Use this guide for AI-assisted code reviews in:
+- `wled00/`
+- `usermods/`
+- `.github/workflows/`
+
+## WLED Constraints and Threat Model Assumptions
+
+- Assume typical deployment behind a firewall/DMZ/VPN; prioritize LAN-local and supply-chain risks.
+- Do **not** require TLS/HTTPS as a baseline control for findings in this repo.
+- Do **not** require authentication for standards-based UDP multicast/broadcast protocols where auth is not part of the spec.
+- Do not propose mitigations that break protocol compliance just to add authentication.
+
+### Trust Boundary Model
+
+**Untrusted data** enters WLED only at the following explicit ingress points:
+- HTTP/JSON API request bodies and query parameters (e.g., `/json/*`, `/win`)
+- WebSocket message payloads
+- UDP datagrams (`parsePacket()` / `recvfrom()` and higher-level protocol wrappers)
+- TCP socket reads
+- Serial/UART input used as commands
+- ESP-NOW raw messages input
+
+**Validation and range-clamping applied at the ingress point renders data trusted** for all subsequent use within the WLED core.
+
+**Do not flag:**
+- Repeated bounds or range checks on a value that has already been validated and clamped at its ingress handler.
+- Internal WLED core logic that operates on values confirmed safe by the ingress layer.
+
+If it is unclear whether a value has been sanitized upstream (e.g., passed through multiple function calls without a clear annotation), prefer asking for clarification over raising a false-positive finding.
+
+### Locally-Stored Configuration Files (Robustness, not a primary trust boundary)
+
+Files read from LittleFS (`presets.json`, `cfg.json`, `ledmap.json`, `ir.json`, etc.) are written only via privileged access (`/edit`) and are considered trusted in the threat model. 
+However, parse them defensively (validate structure, clamp array sizes, handle missing keys gracefully) to avoid bootloops from filesystem corruption or accidental malformation.
+
+## Severity
+
+- **CRITICAL** — exploitable vulnerability; block merge.
+- **IMPORTANT** — meaningful risk; fix before or with merge when practical.
+- **SUGGESTION** — defense-in-depth; track for follow-up.
+
+## Scope (WLED-relevant)
+
+Prioritize:
+- C++ memory safety and input validation
+- Auth and access checks for state-changing HTTP/JSON APIs
+- XSS and DOM safety in `wled00/data/*`
+- Secrets handling (`wsec.json`) and secure logging
+- Dependency and GitHub Actions supply-chain hygiene
+- Fail-safe behavior on constrained devices
+
+De-prioritize unless explicitly introduced by a PR:
+- SQL/NoSQL checks, JWT/OAuth flows, GraphQL-specific checks, generic backend framework checks not used by WLED.
+
+## Firmware Security (C++, OWASP A01/A04/A05/A10)
+
+### FW1: Unsafe buffer operations
+- **Severity**: CRITICAL
+- Flag `strcpy`, `sprintf`, unchecked memory access (`memcpy`, `memmove`, `memcmp`, `strcmp`, `strlen`), unchecked pointer arithmetic.
+- Require explicit bounds checks and length validation.
+- Prefer bounded alternatives for string operations (`strnlen`, `strncmp`, `strncpy`, `strlcpy`, `snprintf`).
+- Treat a finding against FW1 as **suggestion** only when the operation is provably bounded
+  and both the destination capacity and copied/compared length are known safe.
+
+### FW2: Format-string injection
+- **Severity**: CRITICAL
+- Do not pass untrusted input as a format string to `DEBUG_PRINTF*` or similar APIs.
+
+### FW3: Integer overflow in length and offset math
+- **Severity**: IMPORTANT
+- Review `count * size`, index math, narrowing casts before allocations or copies.
+
+### FW4: Unvalidated external input
+- **Severity**: CRITICAL
+- At each **untrusted ingress point** (see Trust Boundary Model above), validate and clamp values from HTTP/JSON/UDP/serial before use as lengths, indices, IDs, or pin references.
+- Do not flag repeated range checks on values that have already been validated at their ingress point.
+- In UDP handlers (`parsePacket()`, `read()`, and any lower-level socket wrappers), validate `packetSize` before buffer writes and clamp protocol-specific universe/channel ranges to valid limits.
+
+### FW5: Missing auth checks on state-changing endpoints (where auth is feasible)
+- **Severity**: CRITICAL
+- HTTP/JSON and other control paths that support auth must enforce configured auth policy.
+- Do not flag the HTTP endpoint `/reset` as state-changing. This endpoint triggers a reboot, causing a short interruption without loss of user data.
+- Do not flag standards-based UDP multicast/broadcast paths solely for lacking authentication when authentication is not defined in the protocol specification.
+
+### FW6: Fail-open behavior after parse or allocation errors
+- **Severity**: IMPORTANT
+- On error, reject update and preserve safe previous state.
+- Explicitly check parse status (`DeserializationError error = deserializeJson(...); if (error) return/reject;`) and avoid silently applying unsafe zero/default values to safety-relevant fields (for example LED count and pin assignment).
+
+### FW7: Heap churn in hot paths
+- **Severity**: IMPORTANT
+- Avoid repeated dynamic allocation in render/effect loops; prefer pre-allocation and reuse.
+- Flag allocation patterns in loop and ISR-adjacent paths that can trigger fragmentation or timing instability.
+
+### FW8: Unsafe use of `String` in performance-critical paths
+- **Severity**: IMPORTANT
+- In hot paths, avoid repeated `String` growth; reserve or use fixed buffers.
+- Flag repeated `String` concatenation inside loop-heavy or ISR-adjacent code.
+
+### FW9: Unsafe feature flag names
+- **Severity**: IMPORTANT
+- Verify all new `WLED_ENABLE_*`/`WLED_DISABLE_*` names are valid known flags; typos silently alter build behavior.
+
+### FW10: OTA integrity verification (without TLS requirement)
+- **Severity**: IMPORTANT
+- OTA update flows should validate firmware integrity using the checksum/hash/signature mechanism available in the firmware/platform implementation.
+- Do not require TLS/certificate pinning as a mandatory review criterion.
+- In OTA paths (`Update.begin()`, `Update.write()`, and related flows), flag flashing without integrity verification.
+
+### FW11: FreeRTOS task stack and recursion safety
+- **Severity**: IMPORTANT
+- In `xTaskCreate`/`xTaskCreatePinnedToCore` tasks that process `String`/JSON-heavy data, verify stack-size sufficiency and avoid unbounded recursion.
+
+### FW12: mDNS and hostname sanitization
+- **Severity**: IMPORTANT
+- For `MDNS.begin()`, `MDNS.addService()`, and `ArduinoOTA.setHostname()`, ensure user-provided hostnames are RFC-compliant (letters/digits/hyphen, no leading/trailing hyphen) and clamped to 63 characters.
+
+### FW13: Outbound URL validation (no HTTPS requirement)
+- **Severity**: SUGGESTION
+- When using user-provided URL strings with `HTTPClient.begin()`/equivalent, validate scheme/format and constrain host targets (allowlist or equivalent policy).
+- Do not require HTTPS/TLS as a baseline review rule.
+
+### FW14: Optional unicast UDP source filtering
+- **Severity**: SUGGESTION
+- For unicast UDP receive paths, prefer optional user-configurable source filtering.
+- Do not require this for multicast/broadcast protocol flows.
+
+## Web UI Security (`wled00/data/*`, OWASP A01/A02/A05)
+
+### WEB1: DOM XSS through `innerHTML`
+- **Severity**: CRITICAL
+- Prefer `textContent`; if HTML is required, sanitize trusted content path explicitly.
+
+### WEB2: Dynamic code execution
+- **Severity**: CRITICAL
+- Reject `eval`, `new Function`, and string-based timer execution.
+
+### WEB3: `postMessage` without origin validation
+- **Severity**: IMPORTANT
+- Require strict origin allowlist checks before processing payloads.
+
+### WEB4: Unsafe redirects/navigation
+- **Severity**: IMPORTANT
+- Do not navigate directly from untrusted query/input without relative-path or allowlist checks.
+
+### WEB5: Client-only validation
+- **Severity**: IMPORTANT
+- UI validation is not sufficient; equivalent firmware-side validation is required.
+
+### WEB6: Direct DOM insertion from fetched/config data
+- **Severity**: IMPORTANT
+- Treat fetched and config-derived strings as untrusted unless proven otherwise.
+
+### WEB7: CSRF checks for state-changing HTTP routes (advisory)
+- **Severity**: SUGGESTION
+- For state-changing HTTP routes (for example `/json/state`, `/win`), prefer `Origin`/`Referer` header validation as low-cost defense-in-depth for deployments that are not directly internet-exposed.
+- Treat this as advisory only, since some legitimate clients may omit these headers.
+
+## Secrets and Logging (OWASP A04/A09/A10)
+
+### SEC1: Hardcoded secrets and credentials
+- **Severity**: CRITICAL
+- Reject committed API keys, passwords, tokens, private keys, or test backdoors with potential security impact.
+
+### SEC2: Sensitive values in logs
+- **Severity**: CRITICAL
+- Do not log passwords, tokens, Wi-Fi keys, auth headers, or full sensitive payloads.
+
+### SEC3: Insecure defaults
+- **Severity**: IMPORTANT
+- Reject new default credentials or insecure auto-enable behavior for privileged functions.
+- For setup/onboarding flows, require first-change behavior for default credentials where applicable.
+
+### SEC4: Overly detailed error responses
+- **Severity**: IMPORTANT
+- Avoid exposing stack traces or internal details to API/UI consumers.
+
+### SEC5: Credential exposure in API/config responses
+- **Severity**: IMPORTANT
+- Flag API/config serialization that exposes password-like fields (for example Wi-Fi/AP/MQTT passwords) to unauthenticated or untrusted clients.
+
+### SEC6: Security-relevant event logging coverage
+- **Severity**: SUGGESTION
+- Prefer explicit logging for auth failures, OTA attempts, config resets, and AP activation events, without logging secret values.
+
+## Supply Chain and CI/CD (OWASP A03/A08)
+
+### SC1: New dependency risk
+- **Severity**: IMPORTANT
+- Review new npm/pip/PlatformIO dependencies for legitimacy, pinning, and known vulnerabilities.
+
+### SC2: Workflow permission hardening regressions
+- **Severity**: IMPORTANT
+- Check for broad `permissions`, unpinned third-party actions, or unsafe secret exposure.
+- Flag mutable third-party action refs (`@main`, `@master`, broad tags) where SHA pinning is expected by project policy.
+- Flag overly broad permissions such as `write-all` without clear need.
+
+### SC3: Script injection in workflows
+- **Severity**: IMPORTANT
+- Avoid direct interpolation of untrusted `${{ github.event.* }}` values in `run` commands.
+
+## Reviewer Checklist
+
+- [ ] No new memory-safety hazards (bounds, overflow, unsafe copies/format strings)
+- [ ] External input is validated and range-clamped at ingress points (HTTP/JSON, WebSocket, UDP, TCP, serial, ESP-NOW)
+- [ ] State-changing API paths enforce auth policy
+- [ ] OTA paths enforce integrity verification (without requiring TLS baseline)
+- [ ] Suggested rule patterns are checked where relevant (UDP bounds, hostname sanitization, workflow pinning/permissions)
+- [ ] Web UI changes avoid unsafe DOM execution/injection patterns
+- [ ] No secrets added; no sensitive logging introduced
+- [ ] Error handling remains fail-safe and non-leaky
+- [ ] Dependency/workflow changes are supply-chain safe
+- [ ] Feature-flag names are valid and not typoed
+
+## AI Review Behavior
+
+- Prefer concrete, file/line-specific findings over generic guidance.
+- Prioritize **CRITICAL** and **IMPORTANT** findings.
+- Skip irrelevant framework checks not used by WLED.
+- If control-flow trust is unclear, ask for clarification instead of guessing.
@@ -30,6 +30,7 @@ default_envs = nodemcuv2
               esp32s3dev_16MB_opi
               esp32s3dev_8MB_opi
               esp32s3dev_8MB_qspi
+               esp32s3dev_8MB_none
               esp32s3_4M_qspi
               usermods

@@ -195,6 +196,7 @@ platform_packages = platformio/toolchain-xtensa @ ~2.100300.220621 #2.40802.2005

 platform = ${esp8266.platform_wled_default}
 build_unflags = ${common.build_unflags}
+custom_usermods = 
 build_flags =
  -DESP8266
  -DFP_IN_IROM
@@ -297,8 +299,18 @@ AR_lib_deps =  ;; for pre-usermod-library platformio_override compatibility
 ;; please note that you can NOT update existing ESP32 installs with a "V4" build. Also updating by OTA will not work properly.
 ;; You need to completely erase your device (esptool erase_flash) first, then install the "V4" build from VSCode+platformio.

+;; tasmota platform (default)
 platform = https://github.com/tasmota/platform-espressif32/releases/download/2024.06.00/platform-espressif32.zip ;; Tasmota Arduino Core 2.0.18 with IPv6 support, based on IDF 4.4.8
 platform_packages =
+
+;; espressif platform (optional - needs 300KB extra flash)
+;;; arduino-esp32 2.0.17 + esp-idf 4.4.7
+;; platform = espressif32@ ~6.13.0
+;; platform_packages =
+;;; arduino-esp32 2.0.14 + esp-idf 4.4.6
+;; platform = espressif32@ ~6.6.0
+;; platform_packages = platformio/framework-arduinoespressif32 @ 3.20014.231204
+
 build_unflags = ${common.build_unflags}
 build_flags = -g
  -Wshadow=compatible-local ;; emit warning in case a local variable "shadows" another local one
@@ -478,7 +490,7 @@ build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_RELEASE_NAME=
  -D WLED_DISABLE_PARTICLESYSTEM1D
  -D WLED_DISABLE_PARTICLESYSTEM2D
  -D WLED_DISABLE_PIXELFORGE
-custom_usermods = audioreactive
+;; custom_usermods = audioreactive ;; pushed program flash size over the limits

 [env:esp32dev]
 extends = esp32
@@ -599,6 +611,19 @@ build_flags = ${common.build_flags} ${esp32s3.build_flags} -D WLED_RELEASE_NAME=
  -DBOARD_HAS_PSRAM
  ;; -DLOLIN_WIFI_FIX ;; uncomment if you have WiFi connectivity problems

+[env:esp32s3dev_8MB_none]
+;; ESP32-S3 development board, 8MB FLASH, no PSRAM
+extends = esp32s3
+board = esp32-s3-devkitc-1 ;; generic dev board
+custom_usermods = audioreactive
+build_unflags = ${esp32s3.build_unflags} -DBOARD_HAS_PSRAM ;; make sure PSRAM support is removed
+build_flags = ${common.build_flags} ${esp32s3.build_flags} -D WLED_RELEASE_NAME=\"ESP32-S3_8MB_none\"
+  -D WLED_WATCHDOG_TIMEOUT=0
+  ;-D ARDUINO_USB_CDC_ON_BOOT=0  ;; -D ARDUINO_USB_MODE=1 ;; for boards with serial-to-USB chip
+  -D ARDUINO_USB_CDC_ON_BOOT=1 ;; -D ARDUINO_USB_MODE=1      ;; for boards with USB-OTG connector only (USBCDC or "TinyUSB")
+board_build.f_flash = 80000000L
+board_build.flash_mode = qio
+
 [env:esp32S3_wroom2]
 ;; For ESP32-S3 WROOM-2, a.k.a. ESP32-S3 DevKitC-1 v1.1
 ;; with >= 16MB FLASH and >= 8MB PSRAM (memory_type: opi_opi)
@@ -649,6 +674,21 @@ board_build.partitions = ${esp32.default_partitions}
 board_build.f_flash = 80000000L
 board_build.flash_mode = qio

+[env:esp32s3_4M_none]
+;; ESP32-S3 with 4MB FLASH, no PSRAM
+extends = esp32s3
+board = esp32-s3-devkitc-1
+custom_usermods = audioreactive
+build_unflags = ${esp32s3.build_unflags} -D BOARD_HAS_PSRAM ;; make sure PSRAM support is removed
+build_flags = ${common.build_flags} ${esp32s3.build_flags} -D WLED_RELEASE_NAME=\"ESP32-S3_4M_none\"
+  -DARDUINO_USB_CDC_ON_BOOT=1 ;; -DARDUINO_USB_MODE=1      ;; for boards with USB-OTG connector only (USBCDC or "TinyUSB")
+  -DLOLIN_WIFI_FIX ; seems to work much better with this
+  -D WLED_WATCHDOG_TIMEOUT=0
+board_build.partitions = ${esp32.default_partitions}
+board_build.f_flash = 80000000L
+board_build.flash_mode = qio
+
+
 [env:lolin_s2_mini]
 extends = esp32s2
 board = lolin_s2_mini
@@ -691,6 +731,7 @@ board_build.partitions = ${esp32.extreme_partitions}  ; We're gonna need a bigge
 ;; Core HUB75 flags - common to every HUB75 build
 build_flags =
  -D WLED_ENABLE_HUB75MATRIX -D NO_GFX
+  -D NO_CIE1931 ;; disable driver-internal gamma correction
  -D WLED_DEBUG_BUS
  -D LED_TYPES=TYPE_HUB75MATRIX_HS
  ; -D WLED_DEBUG
@@ -731,8 +772,8 @@ build_flags = ${common.build_flags} ${esp32_idf_V4.build_flags} ${hub75.build_fl
 ; HD-WF2 - NOTE: this board has NO PSRAM, so BOARD_HAS_PSRAM must not be set
 ; (BOARD_HAS_PSRAM causes the DMA library to allocate only in SPIRAM, which fails without PSRAM)
 extends = env:esp32s3dev_8MB_qspi
-board_build.partitions = ${esp32.extended_partitions} ;; 1.65MB firmware, 700KB filesystem
-build_unflags = -DBOARD_HAS_PSRAM
+board_build.partitions = ${esp32.extended_partitions} ;; 1.65MB firmware, 700KB filesystem - only 4MB flash usable on this board
+build_unflags = ${esp32s3.build_unflags} -DBOARD_HAS_PSRAM
 build_flags = ${common.build_flags} ${esp32s3.build_flags} ${hub75.build_flags} ${hub75.s3_build_flags} ${hub75.i2s_disable_flags}
              -D WLED_RELEASE_NAME=\"ESP32-S3_HD-WF2\"
              -D HD_WF2_PINOUT ;; Huidu HD-WF2 specific GPIO wiring
@@ -750,6 +791,21 @@ lib_deps = ${esp32s3.lib_deps}
           ${hub75.lib_deps}
 ;; board_build.partitions = tools/partitions-8MB_spiffs-tinyuf2.csv ;; supports adafruit UF2 bootloader

+[env:waveshare_esp32s3_32MB_hub75]
+;; Waveshare ESP32-S3-RGB-Matrix (memory_type: opi_opi); see https://docs.waveshare.com/ESP32-S3-RGB-Matrix
+extends = env:esp32S3_wroom2_32MB
+monitor_filters = esp32_exception_decoder
+build_unflags = ${env:esp32S3_wroom2_32MB.build_unflags}
+  -D WLED_RELEASE_NAME=\"ESP32-S3_WROOM-2_32MB\" ;; need to un-set the relese name before setting a new one
+build_flags = ${common.build_flags} ${esp32s3.build_flags} ${hub75.build_flags} ${hub75.s3_build_flags} ${hub75.i2s_disable_flags}
+  -D WLED_RELEASE_NAME=\"ESP32-S3_Waveshare_HUB75\"
+  -D WAVESHARE_S3_PINOUT
+;  -D WLED_USE_SD_SPI
+;  -D SD_PRINT_HOME_DIR
+;  -D WLED_DEBUG
+lib_deps = ${esp32s3.lib_deps}
+  ${hub75.lib_deps}
+
 [env:esp32s3dev_16MB_opi_hub75]
 ;; MOONHUB HUB75 adapter board (lilygo T7-S3 with 16MB flash and octal PSRAM)
 extends = env:esp32s3dev_8MB_opi
@@ -5,7 +5,7 @@
 # Please visit documentation: https://docs.platformio.org/page/projectconf.html

 [platformio]
-default_envs = WLED_generic8266_1M, esp32dev_V4_dio80  # put the name(s) of your own build environment here. You can define as many as you need
+default_envs = WLED_generic8266_1M, esp32dev_dio80  # put the name(s) of your own build environment here. You can define as many as you need

 #----------
 # SAMPLE
@@ -30,10 +30,18 @@ lib_deps = ${esp8266.lib_deps}
 ;  https://github.com/blazoncek/QuickESPNow.git#optional-debug  ;; exludes debug library

 build_unflags = ${common.build_unflags}
-build_flags = ${common.build_flags} ${esp8266.build_flags}
+build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_RELEASE_NAME=\"ESP8266_generic_1M\"
+  -D WLED_DISABLE_PARTICLESYSTEM1D -D WLED_DISABLE_PARTICLESYSTEM2D
+  -D WLED_DISABLE_PIXELFORGE
+  -D WLED_DISABLE_OTA -D WLED_DISABLE_2D
 ;
 ; *** To use the below defines/overrides, copy and paste each onto its own line just below build_flags in the section above.
-; 
+; *** Note: on adding custom usermods
+;     custom_usermods entries are a separate key in the env section (not inside build_flags). Place them on their own line in the env.
+;     Multiple usermods are separated by a space, the names can be found in the library.json file of the usermod.
+;     Example: use the default usermods from the esp32dev env and add the Temperature and four_line_display_ALT usermods
+;     custom_usermods = ${env:esp32dev.custom_usermods} Temperature four_line_display_ALT
+;
 ; Set a release name that may be used to distinguish required binary for flashing
 ;   -D WLED_RELEASE_NAME=\"ESP32_MULTI_USREMODS\"
 ;
@@ -98,17 +106,17 @@ build_flags = ${common.build_flags} ${esp8266.build_flags}
 ;   -D WLED_DEBUG_PORT=7868
 ;
 ; Use Autosave usermod and set it to do save after 90s
-;   -D USERMOD_AUTO_SAVE
+;   custom_usermods = ${env:esp32dev.custom_usermods} auto_save
 ;   -D AUTOSAVE_AFTER_SEC=90
 ;
 ; Use AHT10/AHT15/AHT20 usermod
-;   -D USERMOD_AHT10
+;   custom_usermods = ${env:esp32dev.custom_usermods} AHT10_v2
 ;
 ; Use INA226 usermod
-;   -D USERMOD_INA226
+;   custom_usermods = ${env:esp32dev.custom_usermods} INA226_v2
 ;
 ; Use 4 Line Display usermod with SPI display
-;   -D USERMOD_FOUR_LINE_DISPLAY
+;   custom_usermods = ${env:esp32dev.custom_usermods} four_line_display_ALT
 ;   -DFLD_SPI_DEFAULT
 ;   -D FLD_TYPE=SSD1306_SPI64
 ;   -D FLD_PIN_CLOCKSPI=14
@@ -118,22 +126,22 @@ build_flags = ${common.build_flags} ${esp8266.build_flags}
 ;   -D FLD_PIN_RESET=27
 ;
 ; Use Rotary encoder usermod (in conjunction with 4LD)
-;   -D USERMOD_ROTARY_ENCODER_UI
+;   custom_usermods = ${env:esp32dev.custom_usermods} rotary_encoder_ui_ALT
 ;   -D ENCODER_DT_PIN=5
 ;   -D ENCODER_CLK_PIN=18
 ;   -D ENCODER_SW_PIN=19
 ;
 ; Use Dallas DS18B20 temperature sensor usermod and configure it to use GPIO13
-;   -D USERMOD_DALLASTEMPERATURE
+;   custom_usermods = ${env:esp32dev.custom_usermods} Temperature
 ;   -D TEMPERATURE_PIN=13
 ;
 ; Use Multi Relay usermod and configure it to use 6 relays and appropriate GPIO
-;   -D USERMOD_MULTI_RELAY
+;   custom_usermods = ${env:esp32dev.custom_usermods} multi_relay
 ;   -D MULTI_RELAY_MAX_RELAYS=6
 ;   -D MULTI_RELAY_PINS=12,23,22,21,24,25
 ;
 ; Use PIR sensor usermod and configure it to use GPIO4 and timer of 60s
-;   -D USERMOD_PIRSWITCH
+;   custom_usermods = ${env:esp32dev.custom_usermods} PIR_sensor_switch
 ;   -D PIR_SENSOR_PIN=4   # use -1 to disable usermod
 ;   -D PIR_SENSOR_OFF_SEC=60
 ;   -D PIR_SENSOR_MAX_SENSORS=2 # max allowable sensors (uses OR logic for triggering)
@@ -146,12 +154,12 @@ build_flags = ${common.build_flags} ${esp8266.build_flags}
 ;   -D I2S_CKPIN=19
 ;
 ; Use PWM fan usermod
-;   -D USERMOD_PWM_FAN
+;   custom_usermods = ${env:esp32dev.custom_usermods} PWM_fan
 ;   -D TACHO_PIN=33
 ;   -D PWM_PIN=32
 ;
 ;  Use POV Display usermod
-;   -D USERMOD_POV_DISPLAY
+;   custom_usermods = ${env:esp32dev.custom_usermods} pov_display
 ; Use built-in or custom LED as a status indicator (assumes LED is connected to GPIO16)
 ;   -D STATUSLED=16
 ;
@@ -184,6 +192,7 @@ build_flags = ${common.build_flags} ${esp8266.build_flags}
 ; configure I2C and SPI interface (for various hardware)
 ;   -D I2CSDAPIN=33 # initialise interface
 ;   -D I2CSCLPIN=35 # initialise interface
+;   # HW_PIN_* informs the WebUI about default pins - don't initialise interface
 ;   -D HW_PIN_SCL=35
 ;   -D HW_PIN_SDA=33
 ;   -D HW_PIN_CLOCKSPI=7
@@ -219,7 +228,8 @@ platform = ${esp8266.platform_wled_default}
 platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_4m1m}
 build_unflags = ${common.build_unflags}
-build_flags = ${common.build_flags} ${esp8266.build_flags}
+build_flags = ${common.build_flags} ${esp8266.build_flags}  -D WLED_RELEASE_NAME=\"ESP8266_ESP07\" #-DWLED_DISABLE_2D
+  -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:d1_mini]
@@ -229,7 +239,8 @@ platform_packages = ${esp8266.platform_packages}
 upload_speed = 921600
 board_build.ldscript = ${common.ldscript_4m1m}
 build_unflags = ${common.build_unflags}
-build_flags = ${common.build_flags} ${esp8266.build_flags}
+build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_RELEASE_NAME=\"ESP8266_D1MINI\" #-DWLED_DISABLE_2D
+  -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}
 monitor_filters = esp8266_exception_decoder

@@ -239,7 +250,8 @@ platform = ${esp8266.platform_wled_default}
 platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_4m1m}
 build_unflags = ${common.build_unflags}
-build_flags = ${common.build_flags} ${esp8266.build_flags}
+build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_RELEASE_NAME=\"ESP8266_HT_D1MINI\" #-DWLED_DISABLE_2D
+  -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:h803wf]
@@ -248,30 +260,24 @@ platform = ${esp8266.platform_wled_default}
 platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_4m1m}
 build_unflags = ${common.build_unflags}
-build_flags = ${common.build_flags} ${esp8266.build_flags} -D DATA_PINS=1 -D WLED_DISABLE_INFRARED
+build_flags = ${common.build_flags} ${esp8266.build_flags} -D DATA_PINS=1 -D WLED_DISABLE_INFRARED  -D WLED_RELEASE_NAME=\"ESP8266_HT803WF\" #-DWLED_DISABLE_2D
+  -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:esp32dev_qio80]
 extends = env:esp32dev  # we want to extend the existing esp32dev environment (and define only updated options)
 board = esp32dev
-build_flags = ${common.build_flags} ${esp32.build_flags} #-D WLED_DISABLE_BROWNOUT_DET
-lib_deps = ${esp32.lib_deps}
+build_flags = ${common.build_flags} ${esp32_idf_V4.build_flags} -D WLED_RELEASE_NAME=\"ESP32_qio80\" #-D WLED_DISABLE_BROWNOUT_DET
+lib_deps = ${esp32_idf_V4.lib_deps}
 monitor_filters = esp32_exception_decoder
 board_build.f_flash = 80000000L
 board_build.flash_mode = qio

-[env:esp32dev_V4_dio80]
-;; experimental ESP32 env using ESP-IDF V4.4.x
-;; Warning: this build environment is not stable!!
-;; please erase your device before installing.
-extends = esp32_idf_V4  # based on newer "esp-idf V4" platform environment
-board = esp32dev
-build_flags = ${common.build_flags}  ${esp32_idf_V4.build_flags} #-D WLED_DISABLE_BROWNOUT_DET
-lib_deps = ${esp32_idf_V4.lib_deps}
-monitor_filters = esp32_exception_decoder
-board_build.partitions = ${esp32.default_partitions}  ;; if you get errors about "out of program space", change this to ${esp32.extended_partitions} or even ${esp32.big_partitions}
-board_build.f_flash = 80000000L
-board_build.flash_mode = dio
+[env:esp32dev_dio80]
+extends = env:esp32dev_qio80          # we want to extend the previous environment, to change flash speed
+build_unflags = ${env:esp32dev_qio80.build_unflags} -D WLED_RELEASE_NAME=\"ESP32_qio80\"      # need to remove the previous WLED_RELEASE_NAME
+build_flags =   ${env:esp32dev_qio80.build_flags}   -D WLED_RELEASE_NAME=\"ESP32_dio80\"      # ... and then we can set a new one
+board_build.flash_mode = dio          # change flash mode to "dio", for boards that cannot not start with "qio" mode

 [env:esp32s2_saola]
 extends = esp32s2
@@ -281,25 +287,19 @@ platform_packages = ${esp32s2.platform_packages}
 framework = arduino
 board_build.flash_mode = qio
 upload_speed = 460800
-build_flags = ${common.build_flags} ${esp32s2.build_flags}
+build_flags = ${common.build_flags} ${esp32s2.build_flags} -D WLED_RELEASE_NAME=\"ESP32-S2_saola\"
  ;-DLOLIN_WIFI_FIX ;; try this in case Wifi does not work
  -DARDUINO_USB_CDC_ON_BOOT=1
 lib_deps = ${esp32s2.lib_deps}

-[env:esp32s3dev_8MB_PSRAM_qspi]
-;; ESP32-TinyS3 development board, with 8MB FLASH and PSRAM (memory_type: qio_qspi)
-extends = env:esp32s3dev_8MB_PSRAM_opi
-;board = um_tinys3 ;    -> needs workaround from https://github.com/wled-dev/WLED/pull/2905#issuecomment-1328049860
-board = esp32-s3-devkitc-1 ;; generic dev board; the next line adds PSRAM support
-board_build.arduino.memory_type = qio_qspi ;; use with PSRAM: 2MB or  4MB
-
 [env:esp8285_4CH_MagicHome]
 board = esp8285
 platform = ${esp8266.platform_wled_default}
 platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_1m128k}
 build_unflags = ${common.build_unflags}
-build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_DISABLE_OTA
+build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_DISABLE_OTA  -D WLED_RELEASE_NAME=\"ESP8285_4CH_MagicHome\" #-DWLED_DISABLE_2D
+  -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:esp8285_H801]
@@ -308,7 +308,8 @@ platform = ${esp8266.platform_wled_default}
 platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_1m128k}
 build_unflags = ${common.build_unflags}
-build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_DISABLE_OTA
+build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_DISABLE_OTA  -D WLED_RELEASE_NAME=\"ESP8285_H801\" #-DWLED_DISABLE_2D
+  -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:d1_mini_5CH_Shojo_PCB]
@@ -318,6 +319,8 @@ platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_4m1m}
 build_unflags = ${common.build_unflags}
 build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_USE_SHOJO_PCB ;; NB: WLED_USE_SHOJO_PCB is not used anywhere in the source code. Not sure why its needed.
+  -D WLED_RELEASE_NAME=\"ESP8266_5CH_Shojo_PCB\" #-DWLED_DISABLE_2D
+  -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:d1_mini_debug]
@@ -327,7 +330,8 @@ platform = ${esp8266.platform_wled_default}
 platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_4m1m}
 build_unflags = ${common.build_unflags}
-build_flags = ${common.build_flags} ${esp8266.build_flags} ${common.debug_flags}
+build_flags = ${common.build_flags} ${esp8266.build_flags} ${common.debug_flags} -D WLED_RELEASE_NAME=\"ESP8266_D1MINI_DEBUG\" #-DWLED_DISABLE_2D
+  -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:d1_mini_ota]
@@ -339,7 +343,8 @@ platform = ${esp8266.platform_wled_default}
 platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_4m1m}
 build_unflags = ${common.build_unflags}
-build_flags = ${common.build_flags} ${esp8266.build_flags}
+build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_RELEASE_NAME=\"ESP8266_D1MINI_OTA\" #-DWLED_DISABLE_2D
+  -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:anavi_miracle_controller]
@@ -349,6 +354,8 @@ platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_4m1m}
 build_unflags = ${common.build_unflags}
 build_flags = ${common.build_flags} ${esp8266.build_flags} -D DATA_PINS=12 -D IRPIN=-1 -D RLYPIN=2
+  -D WLED_RELEASE_NAME=\"ESP8266_ANAVI_MIRACLE\" #-DWLED_DISABLE_2D
+  -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:esp32c3dev_2MB]
@@ -359,6 +366,7 @@ platform = ${esp32c3.platform}
 platform_packages = ${esp32c3.platform_packages}
 board = esp32-c3-devkitm-1
 build_flags = ${common.build_flags} ${esp32c3.build_flags}
+  -D WLED_RELEASE_NAME=\"ESP32-C3_2MB\"
  -D WLED_WATCHDOG_TIMEOUT=0
  -D WLED_DISABLE_OTA
  ; -DARDUINO_USB_CDC_ON_BOOT=1 ;; for virtual CDC USB
@@ -375,6 +383,7 @@ board_upload.maximum_size = 2097152
 extends = esp32              ;; use default esp32 platform
 board = esp32dev
 upload_speed = 460800
+custom_usermods = ${env:esp32dev.custom_usermods} Temperature four_line_display_ALT
 build_flags = ${common.build_flags} ${esp32.build_flags}
  -D WLED_RELEASE_NAME=\"ESP32_wemos_shield\"
  -D DATA_PINS=16
@@ -382,12 +391,8 @@ build_flags = ${common.build_flags} ${esp32.build_flags}
  -D BTNPIN=17
  -D IRPIN=18
  -UWLED_USE_MY_CONFIG
-  -D USERMOD_DALLASTEMPERATURE
-  -D USERMOD_FOUR_LINE_DISPLAY
  -D TEMPERATURE_PIN=23
 lib_deps = ${esp32.lib_deps}
-  OneWire@~2.3.5          ;; needed for USERMOD_DALLASTEMPERATURE
-  olikraus/U8g2 @ ^2.28.8 ;; needed for USERMOD_FOUR_LINE_DISPLAY
 board_build.partitions = ${esp32.default_partitions}

 [env:esp32_pico-D4]
@@ -410,12 +415,14 @@ board_build.f_flash = 80000000L
 [env:m5atom]
 extends = env:esp32dev  # we want to extend the existing esp32dev environment (and define only updated options)
 build_flags = ${common.build_flags} ${esp32.build_flags} -D DATA_PINS=27 -D BTNPIN=39
+  -D WLED_RELEASE_NAME=\"ESP32_m5atom\"

 [env:sp501e]
 board = esp_wroom_02
 platform = ${esp8266.platform_wled_default}
 board_build.ldscript = ${common.ldscript_2m512k}
 build_flags = ${common.build_flags} ${esp8266.build_flags} -D DATA_PINS=3 -D BTNPIN=1
+  -D WLED_RELEASE_NAME=\"ESP8266_sp501e\" -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:sp511e]
@@ -423,6 +430,7 @@ board = esp_wroom_02
 platform = ${esp8266.platform_wled_default}
 board_build.ldscript = ${common.ldscript_2m512k}
 build_flags = ${common.build_flags} ${esp8266.build_flags} -D DATA_PINS=3 -D BTNPIN=2 -D IRPIN=5 -D WLED_MAX_BUTTONS=3
+  -D WLED_RELEASE_NAME=\"ESP8266_sp511e\" -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:Athom_RGBCW]        ;7w and 5w(GU10) bulbs
@@ -432,7 +440,8 @@ platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_2m512k}
 build_unflags = ${common.build_unflags}
 build_flags = ${common.build_flags} ${esp8266.build_flags} -D BTNPIN=-1 -D RLYPIN=-1 -D DATA_PINS=4,12,14,13,5
-                                            -D LED_TYPES=TYPE_ANALOG_5CH -D WLED_DISABLE_INFRARED -D WLED_MAX_CCT_BLEND=0
+              -D LED_TYPES=TYPE_ANALOG_5CH -D WLED_DISABLE_INFRARED -D WLED_MAX_CCT_BLEND=0
+              -D WLED_RELEASE_NAME=\"ESP8285_Athom_RGBCW\" -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:Athom_15w_RGBCW]        ;15w bulb
@@ -442,7 +451,8 @@ platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_2m512k}
 build_unflags = ${common.build_unflags}
 build_flags = ${common.build_flags} ${esp8266.build_flags} -D BTNPIN=-1 -D RLYPIN=-1 -D DATA_PINS=4,12,14,5,13
-                                            -D LED_TYPES=TYPE_ANALOG_5CH -D WLED_DISABLE_INFRARED -D WLED_MAX_CCT_BLEND=0 -D WLED_USE_IC_CCT
+              -D LED_TYPES=TYPE_ANALOG_5CH -D WLED_DISABLE_INFRARED -D WLED_MAX_CCT_BLEND=0 -D WLED_USE_IC_CCT
+              -D WLED_RELEASE_NAME=\"ESP8285_Athom_15W_RGBCW\" -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:Athom_3Pin_Controller]        ;small controller with only data
@@ -452,6 +462,7 @@ platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_2m512k}
 build_unflags = ${common.build_unflags}
 build_flags = ${common.build_flags} ${esp8266.build_flags} -D BTNPIN=0 -D RLYPIN=-1 -D DATA_PINS=1 -D WLED_DISABLE_INFRARED
+              -D WLED_RELEASE_NAME=\"ESP8285_Athom_3Pin\" -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:Athom_4Pin_Controller]       ; With clock and data interface
@@ -461,6 +472,7 @@ platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_2m512k}
 build_unflags = ${common.build_unflags}
 build_flags = ${common.build_flags} ${esp8266.build_flags} -D BTNPIN=0 -D RLYPIN=12 -D DATA_PINS=1 -D WLED_DISABLE_INFRARED
+              -D WLED_RELEASE_NAME=\"ESP8285_Athom_4Pin\" -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:Athom_5Pin_Controller]      ;Analog light strip controller
@@ -470,6 +482,7 @@ platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_2m512k}
 build_unflags = ${common.build_unflags}
 build_flags = ${common.build_flags} ${esp8266.build_flags} -D BTNPIN=0 -D RLYPIN=-1 DATA_PINS=4,12,14,13 -D WLED_DISABLE_INFRARED
+              -D WLED_RELEASE_NAME=\"ESP8285_Athom_5Pin\" -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:MY9291]
@@ -478,7 +491,8 @@ platform = ${esp8266.platform_wled_default}
 platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_1m128k}
 build_unflags = ${common.build_unflags}
-build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_DISABLE_OTA -D USERMOD_MY9291
+custom_usermods = ${env:esp01_1m_full.custom_usermods} MY9291
+build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_DISABLE_OTA -D WLED_RELEASE_NAME=\"ESP8266_MY9291\" -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 # ------------------------------------------------------------------------------
@@ -492,7 +506,7 @@ platform = ${esp8266.platform_wled_default}
 platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_2m512k}
 build_unflags = ${common.build_unflags}
-build_flags = ${common.build_flags} ${esp8266.build_flags}
+build_flags = ${common.build_flags} ${esp8266.build_flags} -D WLED_RELEASE_NAME=\"ESP8266_CODM06_2MB\" -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 [env:codm-controller-0_6-rev2]
@@ -501,47 +515,20 @@ platform = ${esp8266.platform_wled_default}
 platform_packages = ${esp8266.platform_packages}
 board_build.ldscript = ${common.ldscript_4m1m}
 build_unflags = ${common.build_unflags}
-build_flags = ${common.build_flags} ${esp8266.build_flags}
+build_flags = ${common.build_flags} ${esp8266.build_flags}  -D WLED_RELEASE_NAME=\"ESP8266_CODM06R2_4MB\" -D WLED_DISABLE_PARTICLESYSTEM2D
 lib_deps = ${esp8266.lib_deps}

 # ------------------------------------------------------------------------------
 # EleksTube-IPS
+# See usermods/EleksTube_IPS/platformio_override.ini.sample
 # ------------------------------------------------------------------------------
-[env:elekstube_ips]
-extends = esp32              ;; use default esp32 platform
-board = esp32dev
-upload_speed = 921600
-custom_usermods = ${env:esp32dev.custom_usermods} RTC EleksTube_IPS
-build_flags = ${common.build_flags} ${esp32.build_flags} -D WLED_DISABLE_BROWNOUT_DET -D WLED_DISABLE_INFRARED
-  -D DATA_PINS=12
-  -D RLYPIN=27
-  -D BTNPIN=34
-  -D PIXEL_COUNTS=6
-  # Display config
-  -D ST7789_DRIVER
-  -D TFT_WIDTH=135
-  -D TFT_HEIGHT=240
-  -D CGRAM_OFFSET
-  -D TFT_SDA_READ
-  -D TFT_MOSI=23
-  -D TFT_SCLK=18
-  -D TFT_DC=25
-  -D TFT_RST=26
-  -D SPI_FREQUENCY=40000000
-  -D USER_SETUP_LOADED
-monitor_filters = esp32_exception_decoder


 # ------------------------------------------------------------------------------
 # Usermod examples
 # ------------------------------------------------------------------------------

-# 433MHz RF remote example for esp32dev
-[env:esp32dev_usermod_RF433]
-extends = env:esp32dev
-custom_usermods =
-  ${env:esp32dev.custom_usermods}
-  RF433
+# 433MHz RF remote example: see usermods/usermod_v2_RF433/platformio_override.ini.sample

 # External usermod from a git repository.
 # The library's `library.json` must include `"build": {"libArchive": false}`.
@@ -7,81 +7,97 @@
  <a href="https://kno.wled.ge"><img src="https://img.shields.io/badge/quick_start-wiki-blue.svg?style=flat-square"></a>
  <a href="https://github.com/Aircoookie/WLED-App"><img src="https://img.shields.io/badge/app-wled-blue.svg?style=flat-square"></a>
  <a href="https://gitpod.io/#https://github.com/wled-dev/WLED"><img src="https://img.shields.io/badge/Gitpod-ready--to--code-blue?style=flat-square&logo=gitpod"></a>
-
-  </p>
+</p>

 # Welcome to WLED! ✨

-A fast and feature-rich implementation of an ESP32 and ESP8266 webserver to control NeoPixel (WS2812B, WS2811, SK6812) LEDs or also SPI based chipsets like the WS2801 and APA102!
+A fast and feature-rich firmware for ESP32 microcontrollers to control addressable LEDs — from simple strips to large 2D matrices and HUB75 panels.

-Originally created by [Aircoookie](https://github.com/Aircoookie)
+Originally created by [Aircoookie](https://github.com/Aircoookie), now maintained by a community of contributors.

 ## ⚙️ Features
- WS2812FX library with more than 100 special effects  
- FastLED noise effects and 50 palettes  
- Modern UI with color, effect and segment controls  
- Segments to set different effects and colors to user defined parts of the LED string  
- Settings page - configuration via the network  
- Access Point and station mode - automatic failsafe AP  
- [Up to 10 LED outputs](https://kno.wled.ge/features/multi-strip/#esp32) per instance
- Support for RGBW strips  
- Up to 250 user presets to save and load colors/effects easily, supports cycling through them.  
- Presets can be used to automatically execute API calls  
- Nightlight function (gradually dims down)  
- Full OTA software updateability (HTTP + ArduinoOTA), password protectable  
- Configurable analog clock (Cronixie, 7-segment and EleksTube IPS clock support via usermods) 
- Configurable Auto Brightness limit for safe operation  
- Filesystem-based config for easier backup of presets and settings  

-## 💡 Supported light control interfaces
- WLED app for [Android](https://play.google.com/store/apps/details?id=ca.cgagnier.wlednativeandroid) and [iOS](https://apps.apple.com/gb/app/wled-native/id6446207239)
- JSON and HTTP request APIs  
- MQTT   
- E1.31, Art-Net, DDP and TPM2.net
- [diyHue](https://github.com/diyhue/diyHue) (Wled is supported by diyHue, including Hue Sync Entertainment under udp. Thanks to [Gregory Mallios](https://github.com/gmallios))
- [Hyperion](https://github.com/hyperion-project/hyperion.ng)
- UDP realtime  
- Alexa voice control (including dimming and color)  
- Sync to Philips hue lights  
- Adalight (PC ambilight via serial) and TPM2  
- Sync color of multiple WLED devices (UDP notifier)  
- Infrared remotes (24-key RGB, receiver required)  
- Simple timers/schedules (time from NTP, timezones/DST supported)  
+### Effects & Visuals
+- [**200+ built-in effects**](https://kno.wled.ge/features/effects/) including classic animations, audio-reactive, and 2D/matrix effects
+- [50+ color palettes](https://kno.wled.ge/features/palettes/) plus a built-in **custom palette editor** (PixelForge)
+- [**2D LED matrix support**](https://kno.wled.ge/advanced/mapping/) with dedicated 2D effects and flexible panel mapping
+- [**HUB75 RGB matrix panel support**](https://kno.wled.ge/advanced/HUB75/) (ESP32)
+- [**AudioReactive**](https://kno.wled.ge/advanced/audio-reactive/) effects — included by default, responding to sound via microphone, line-in, or network audio source
+- Effect blending for smooth transitions between animations
+- Antialiased drawing functions for smooth graphics
+
+### Segments & Control
+- [**Segments**](https://kno.wled.ge/features/segments/) — apply different effects, colors and palettes to independent parts of your LED setup simultaneously
+- Up to **250 presets** to save and recall colors, effects and segment configurations — supports [playlists](https://kno.wled.ge/features/presets/) for automated cycling
+- Nightlight function with configurable dimming curve
+- Configurable **Auto Brightness Limiter** (per output) for safe operation
+
+### Hardware Support
+- **ESP32** (all variants: original, S2, S3, C3)
+- [**Up to 17 LED outputs**](https://kno.wled.ge/features/multi-strip/) on ESP32 using parallel I2S + RMT
+- [Addressable LED support](https://kno.wled.ge/basics/compatible-led-strips/): WS2812B, WS2811, WS2815, SK6812, WS2805, TM1914, APA102, WS2801, LPD8806, and many more
+- RGBW, [RGB+CCT](https://kno.wled.ge/features/cct/) and white-only strips
+- PWM outputs for analog LEDs and dimmers
+- [**Ethernet** support](https://kno.wled.ge/features/ethernet-lan/) for a wide range of boards (QuinLED, LILYGO, Olimex, and more)
+- Filesystem-based config for easy backup and restore of presets and settings
+- Full OTA firmware updates (HTTP + ArduinoOTA), password-protectable
+
+### Connectivity & Integrations
+- **WLED app** for [Android](https://play.google.com/store/apps/details?id=ca.cgagnier.wlednativeandroid) and [iOS](https://apps.apple.com/gb/app/wled-native/id6446207239)
+- [JSON](https://kno.wled.ge/interfaces/json-api/) and [HTTP request](https://kno.wled.ge/interfaces/http-api/) APIs
+- **Multi-WiFi** — connect to up to 3 networks with automatic AP fallback
+- **ESP-NOW** wireless sync between devices (no WiFi router required)
+- [**MQTT**](https://kno.wled.ge/interfaces/mqtt/) with Home Assistant discovery
+- [**E1.31, Art-Net**](https://kno.wled.ge/interfaces/e1.31-dmx/), [DDP](https://kno.wled.ge/interfaces/ddp/) and [TPM2.net](https://kno.wled.ge/interfaces/udp-realtime/) for DMX/professional lighting control
+- [UDP realtime sync](https://kno.wled.ge/interfaces/udp-notifier/) across multiple WLED devices
+- Alexa voice control (on/off, brightness, color)
+- [Philips Hue sync](https://kno.wled.ge/interfaces/philips-hue/)
+- [diyHue](https://github.com/diyhue/diyHue) and [Hyperion](https://github.com/hyperion-project/hyperion.ng) integration
+- [Adalight / TPM2](https://kno.wled.ge/interfaces/serial/) (PC ambilight via serial)
+- [Infrared remote control](https://kno.wled.ge/interfaces/infrared/) (24-key RGB, receiver required)
+- Timers and schedules (NTP time sync, full timezone and DST support)
+
+### Developer-Friendly
+- **Usermod system** — extend WLED with community or custom modules without modifying core code
+- Large and active [usermod library](https://kno.wled.ge/advanced/community-usermods/) including AudioReactive, temperature sensors, rotary encoders, displays, and much more
+- Well-documented [JSON API](https://kno.wled.ge/interfaces/json-api/)
+- Licensed under the **EUPL v1.2**

 ## 📲 Quick start guide and documentation

-See the [documentation on our official site](https://kno.wled.ge)!
+See the [documentation at kno.wled.ge](https://kno.wled.ge)!

-[On this page](https://kno.wled.ge/basics/tutorials/) you can find excellent tutorials and tools to help you get your new project up and running!
+[Tutorials and getting-started guides](https://kno.wled.ge/basics/tutorials/) to help you get your project running quickly.

 ## 🖼️ User interface
+
 <img src="/images/macbook-pro-space-gray-on-the-wooden-table.jpg" width="50%"><img src="/images/walking-with-iphone-x.jpg" width="50%">

 ## 💾 Compatible hardware

-See [here](https://kno.wled.ge/basics/compatible-hardware)!
+See the [compatible hardware list](https://kno.wled.ge/basics/compatible-hardware) on the wiki.

 ## ✌️ Other

-Licensed under the EUPL v1.2 license  
-Credits [here](https://kno.wled.ge/about/contributors/)!
-CORS proxy by [Corsfix](https://corsfix.com/)
+Licensed under the [EUPL v1.2](https://raw.githubusercontent.com/wled-dev/WLED/main/LICENSE).  
+Credits to all [contributors](https://kno.wled.ge/about/contributors/)!  
+CORS proxy by [Corsfix](https://corsfix.com/).

 Join the Discord server to discuss everything about WLED!

 <a href="https://discord.gg/QAh7wJHrRM"><img src="https://discordapp.com/api/guilds/473448917040758787/widget.png?style=banner2" width="25%"></a>

-Check out the WLED [Discourse forum](https://wled.discourse.group)!  
+Check out the WLED [Discourse forum](https://wled.discourse.group)!

-You can also send me mails to [dev.aircoookie@gmail.com](mailto:dev.aircoookie@gmail.com), but please, only do so if you want to talk to me privately.  
+If you'd like to reach the original creator privately: [dev.aircoookie@gmail.com](mailto:dev.aircoookie@gmail.com).

-If WLED really brightens up your day, you can [![](https://img.shields.io/badge/send%20me%20a%20small%20gift-paypal-blue.svg?style=flat-square)](https://paypal.me/aircoookie)
+If WLED brightens up your day, you can [send a gift to Aircoookie via PayPal](https://paypal.me/aircoookie).

+---

-*Disclaimer:*   
+*Disclaimer:*

-If you are prone to photosensitive epilepsy, we recommended you do **not** use this software.  
-If you still want to try, don't use strobe, lighting or noise modes or high effect speed settings.
-
-As per the EUPL license, I assume no liability for any damage to you or any other person or equipment.  
+If you are prone to photosensitive epilepsy, we recommend you do **not** use this software.  
+If you still want to try, avoid strobe, lightning or noise modes and high effect speed settings.

+As per the EUPL license, no liability is assumed for any damage to you or any other person or equipment.
@@ -28,18 +28,19 @@ class ADS1115Usermod : public Usermod {
    }

    void loop() {
-      if (isEnabled && millis() - lastTime > loopInterval) {
-        lastTime = millis();
+      if (!isEnabled || strip.isUpdating() || millis() - lastTime <= loopInterval)
+        return;

-        // If we don't have new data, skip this iteration.
-        if (!ads.conversionComplete()) {
-          return;
-        }
+      lastTime = millis();

-        updateResult();
-        moveToNextChannel();
-        startReading();
+      // If we don't have new data, skip this iteration.
+      if (!ads.conversionComplete()) {
+        return;
      }
+
+      updateResult();
+      moveToNextChannel();
+      startReading();
    }

    void addToJsonInfo(JsonObject& root)
@@ -69,6 +70,8 @@ class ADS1115Usermod : public Usermod {
    {
      JsonObject top = root.createNestedObject(F("ADC ADS1115"));
      
+      top[F("Loop Interval")] = loopInterval;
+
      for (uint8_t i = 0; i < channelsCount; i++) {
        ChannelSettings* settingsPtr = &(channelSettings[i]);
        JsonObject channel = top.createNestedObject(settingsPtr->settingName);
@@ -79,8 +82,6 @@ class ADS1115Usermod : public Usermod {
        channel[F("Offset")] = settingsPtr->offset;
        channel[F("Decimals")] = settingsPtr->decimals;
      }
-
-      top[F("Loop Interval")] = loopInterval;
    }

    bool readFromConfig(JsonObject& root)
@@ -2,7 +2,7 @@
  "name": "ADS1115_v2",
  "build": { "libArchive": false },
  "dependencies": {
-    "Adafruit BusIO": "https://github.com/adafruit/Adafruit_BusIO#1.13.2",
-    "Adafruit ADS1X15": "https://github.com/adafruit/Adafruit_ADS1X15#2.4.0"
+    "Adafruit BusIO": "https://github.com/adafruit/Adafruit_BusIO#1.17.4",
+    "Adafruit ADS1X15": "https://github.com/adafruit/Adafruit_ADS1X15#2.6.2"
  }
 }
@@ -1,10 +1,29 @@
-# ADS1115 16-Bit ADC with four inputs
+# ADS1115 Usermod

-This usermod will read from an ADS1115 ADC. The voltages are displayed in the Info section of the web UI.
+Reads values from an ADS1115 16-bit ADC and exposes them in the `Info` tab.

-Configuration is performed via the Usermod menu. There are no parameters to set in code!
+## Features
+- Reads values from an ADS1115 over I2C.
+- Supports 8 ADS1115 input modes:
+	- 4 single-ended inputs (`AIN0` to `AIN3`)
+	- 4 differential pairs (`AIN0-AIN1`, `AIN0-AIN3`, `AIN1-AIN3`, `AIN2-AIN3`)
+- Per-channel configuration in the Usermod settings:
+	- Enable/disable
+	- Display name
+	- Units
+	- Multiplier and offset
+	- Decimal precision
+- Configurable measurement loop interval.
+- Publishes configured channel values to the `Info` tab.

-## Installation 
+## Compatibility
+- Requires an ADS1115 module connected via I2C.
+- Works on targets with I2C support.
+- Default ADC gain is `1x` (input range `+/-4.096V`).

-Add 'ADS1115' to `custom_usermods` in your platformio environment.
+## Installation
+- Add `ADS1115` to `custom_usermods` in your `platformio.ini` (or `platformio_override.ini`).
+
+## Author
+- Dima Zhemkov [@dima-zhemkov](https://github.com/dima-zhemkov)

@@ -1,5 +0,0 @@
-[env:aht10_example]
-extends = env:esp32dev
-build_flags =
-  ${common.build_flags} ${esp32.build_flags}
-  ; -D USERMOD_AHT10_DEBUG ; -- add a debug status to the info modal
@@ -25,6 +25,8 @@ class Animated_Staircase : public Usermod {
    unsigned int topMaxDist        = 50;    // default maximum measured distance in cm, top
    unsigned int bottomMaxDist     = 50;    // default maximum measured distance in cm, bottom
    bool togglePower               = false; // toggle power on/off with staircase on/off
+    bool topAPinInvert             = false; // invert output of top sensor
+    bool bottomAPinInvert          = false; // invert output of bottom sensor

    /* runtime variables */
    bool initDone = false;
@@ -91,6 +93,8 @@ class Animated_Staircase : public Usermod {
    static const char _topEchoCm[];
    static const char _bottomEchoCm[];
    static const char _togglePower[];
+    static const char _topPIRorTrigger_pin_invert[];
+    static const char _bottomPIRorTrigger_pin_invert[];

    void publishMqtt(bool bottom, const char* state) {
 #ifndef WLED_DISABLE_MQTT
@@ -156,6 +160,12 @@ class Animated_Staircase : public Usermod {
      return pulseIn(echoPin, HIGH, maxTimeUs) > 0;
    }

+    bool readPIRPin(int8_t pin, bool invert) {
+      if (pin < 0) return false;
+        bool v = digitalRead(pin);
+      return invert ? !v : v;
+    }
+
    bool checkSensors() {
      bool sensorChanged = false;

@@ -164,15 +174,15 @@ class Animated_Staircase : public Usermod {

        bottomSensorRead = bottomSensorWrite ||
          (!useUSSensorBottom ?
-            (bottomPIRorTriggerPin<0 ? false : digitalRead(bottomPIRorTriggerPin)) :
+            (bottomPIRorTriggerPin<0 ? false : readPIRPin(bottomPIRorTriggerPin, bottomAPinInvert)) :
            ultrasoundRead(bottomPIRorTriggerPin, bottomEchoPin, bottomMaxDist*59)  // cm to us
          );
        topSensorRead = topSensorWrite ||
          (!useUSSensorTop ?
-            (topPIRorTriggerPin<0 ? false : digitalRead(topPIRorTriggerPin)) :
+            (topPIRorTriggerPin<0 ? false : readPIRPin(topPIRorTriggerPin, topAPinInvert)) :
            ultrasoundRead(topPIRorTriggerPin, topEchoPin, topMaxDist*59)   // cm to us
          );
-
+     
        if (bottomSensorRead != bottomSensorState) {
          bottomSensorState = bottomSensorRead; // change previous state
          sensorChanged = true;
@@ -439,18 +449,20 @@ class Animated_Staircase : public Usermod {
      if (staircase.isNull()) {
        staircase = root.createNestedObject(FPSTR(_name));
      }
-      staircase[FPSTR(_enabled)]                   = enabled;
-      staircase[FPSTR(_segmentDelay)]              = segment_delay_ms;
-      staircase[FPSTR(_onTime)]                    = on_time_ms / 1000;
-      staircase[FPSTR(_useTopUltrasoundSensor)]    = useUSSensorTop;
-      staircase[FPSTR(_topPIRorTrigger_pin)]       = topPIRorTriggerPin;
-      staircase[FPSTR(_topEcho_pin)]               = useUSSensorTop ? topEchoPin : -1;
-      staircase[FPSTR(_useBottomUltrasoundSensor)] = useUSSensorBottom;
-      staircase[FPSTR(_bottomPIRorTrigger_pin)]    = bottomPIRorTriggerPin;
-      staircase[FPSTR(_bottomEcho_pin)]            = useUSSensorBottom ? bottomEchoPin : -1;
-      staircase[FPSTR(_topEchoCm)]                 = topMaxDist;
-      staircase[FPSTR(_bottomEchoCm)]              = bottomMaxDist;
-      staircase[FPSTR(_togglePower)]               = togglePower;
+      staircase[FPSTR(_enabled)]                       = enabled;
+      staircase[FPSTR(_segmentDelay)]                  = segment_delay_ms;
+      staircase[FPSTR(_onTime)]                        = on_time_ms / 1000;
+      staircase[FPSTR(_useTopUltrasoundSensor)]        = useUSSensorTop;
+      staircase[FPSTR(_topPIRorTrigger_pin)]           = topPIRorTriggerPin;
+      staircase[FPSTR(_topEcho_pin)]                   = useUSSensorTop ? topEchoPin : -1;
+      staircase[FPSTR(_useBottomUltrasoundSensor)]     = useUSSensorBottom;
+      staircase[FPSTR(_bottomPIRorTrigger_pin)]        = bottomPIRorTriggerPin;
+      staircase[FPSTR(_bottomEcho_pin)]                = useUSSensorBottom ? bottomEchoPin : -1;
+      staircase[FPSTR(_topEchoCm)]                     = topMaxDist;
+      staircase[FPSTR(_bottomEchoCm)]                  = bottomMaxDist;
+      staircase[FPSTR(_togglePower)]                   = togglePower;
+      staircase[FPSTR(_topPIRorTrigger_pin_invert)]    = topAPinInvert;
+      staircase[FPSTR(_bottomPIRorTrigger_pin_invert)] = bottomAPinInvert;
      DEBUG_PRINTLN(F("Staircase config saved."));
    }

@@ -462,11 +474,13 @@ class Animated_Staircase : public Usermod {
    bool readFromConfig(JsonObject& root) {
      bool oldUseUSSensorTop = useUSSensorTop;
      bool oldUseUSSensorBottom = useUSSensorBottom;
+      bool oldTopAPinInvert = topAPinInvert;
+      bool oldBottomAPinInvert = bottomAPinInvert;
      int8_t oldTopAPin = topPIRorTriggerPin;
      int8_t oldTopBPin = topEchoPin;
      int8_t oldBottomAPin = bottomPIRorTriggerPin;
      int8_t oldBottomBPin = bottomEchoPin;
-
+     
      JsonObject top = root[FPSTR(_name)];
      if (top.isNull()) {
        DEBUG_PRINT(FPSTR(_name));
@@ -485,10 +499,12 @@ class Animated_Staircase : public Usermod {
      useUSSensorTop     = top[FPSTR(_useTopUltrasoundSensor)] | useUSSensorTop;
      topPIRorTriggerPin = top[FPSTR(_topPIRorTrigger_pin)] | topPIRorTriggerPin;
      topEchoPin         = top[FPSTR(_topEcho_pin)] | topEchoPin;
-
+      topAPinInvert      = top[FPSTR(_topPIRorTrigger_pin_invert)] | topAPinInvert;
+     
      useUSSensorBottom     = top[FPSTR(_useBottomUltrasoundSensor)] | useUSSensorBottom;
      bottomPIRorTriggerPin = top[FPSTR(_bottomPIRorTrigger_pin)] | bottomPIRorTriggerPin;
      bottomEchoPin         = top[FPSTR(_bottomEcho_pin)] | bottomEchoPin;
+      bottomAPinInvert      = top[FPSTR(_bottomPIRorTrigger_pin_invert)] | bottomAPinInvert;

      topMaxDist    = top[FPSTR(_topEchoCm)] | topMaxDist;
      topMaxDist    = min(150,max(30,(int)topMaxDist));     // max distance ~1.5m (a lag of 9ms may be expected)
@@ -554,14 +570,15 @@ const char Animated_Staircase::_segmentDelay[]              PROGMEM = "segment-d
 const char Animated_Staircase::_onTime[]                    PROGMEM = "on-time-s";
 const char Animated_Staircase::_useTopUltrasoundSensor[]    PROGMEM = "useTopUltrasoundSensor";
 const char Animated_Staircase::_topPIRorTrigger_pin[]       PROGMEM = "topPIRorTrigger_pin";
+const char Animated_Staircase::_topPIRorTrigger_pin_invert[]    PROGMEM = "topPIRorTrigger_pin_invert";
 const char Animated_Staircase::_topEcho_pin[]               PROGMEM = "topEcho_pin";
 const char Animated_Staircase::_useBottomUltrasoundSensor[] PROGMEM = "useBottomUltrasoundSensor";
 const char Animated_Staircase::_bottomPIRorTrigger_pin[]    PROGMEM = "bottomPIRorTrigger_pin";
+const char Animated_Staircase::_bottomPIRorTrigger_pin_invert[] PROGMEM = "bottomPIRorTrigger_pin_invert";
 const char Animated_Staircase::_bottomEcho_pin[]            PROGMEM = "bottomEcho_pin";
 const char Animated_Staircase::_topEchoCm[]                 PROGMEM = "top-dist-cm";
 const char Animated_Staircase::_bottomEchoCm[]              PROGMEM = "bottom-dist-cm";
 const char Animated_Staircase::_togglePower[]               PROGMEM = "toggle-on-off";

-
 static Animated_Staircase animated_staircase;
 REGISTER_USERMOD(animated_staircase);
@@ -8,13 +8,13 @@
 ; USERMOD_DHT_MQTT                 - publish measurements to the MQTT broker
 ; USERMOD_DHT_STATS                - For debug, report delay stats

-[env:d1_mini_usermod_dht_C]
-extends = env:d1_mini
-custom_usermods = ${env:d1_mini.custom_usermods} DHT
-build_flags = ${env:d1_mini.build_flags} -D USERMOD_DHT_CELSIUS
+[env:esp8266_2m_usermod_dht_C]
+extends = env:esp8266_2m
+custom_usermods = ${env:esp8266_2m.custom_usermods} DHT
+build_flags = ${env:esp8266_2m.build_flags} -D USERMOD_DHT_CELSIUS

-[env:custom32_LEDPIN_16_usermod_dht_C]
-extends = env:custom32_LEDPIN_16
-custom_usermods = ${env:custom32_LEDPIN_16.custom_usermods} DHT
-build_flags = ${env:custom32_LEDPIN_16.build_flags} -D USERMOD_DHT_CELSIUS -D USERMOD_DHT_STATS
+[env:esp32dev_LEDPIN_16_usermod_dht_C]
+extends = env:esp32dev
+custom_usermods = ${env:esp32dev.custom_usermods} DHT
+build_flags = ${env:esp32dev.build_flags} -D LEDPIN=16 -D USERMOD_DHT_CELSIUS -D USERMOD_DHT_STATS

@@ -114,7 +114,7 @@ class MyExampleUsermod : public Usermod {
    void loop() override {
      // if usermod is disabled or called during strip updating just exit
      // NOTE: on very long strips strip.isUpdating() may always return true so update accordingly
-      if (!enabled || strip.isUpdating()) return;
+      if (!enabled || (strip.isUpdating() && (millis() - lastTime < 200))) return; // adjust "200" (in millisecond) to your needs - prevents starvation with very long strips 

      // do your magic here
      if (millis() - lastTime > 1000) {
@@ -176,7 +176,7 @@ class MyExampleUsermod : public Usermod {
      JsonObject usermod = root[FPSTR(_name)];
      if (!usermod.isNull()) {
        // expect JSON usermod data in usermod name object: {"ExampleUsermod:{"user0":10}"}
-        userVar0 = usermod["user0"] | userVar0; //if "user0" key exists in JSON, update, else keep old value
+        userVar0 = usermod["user0"] | userVar0; //if "user0" key exists in JSON, update, else keep old value (userVar0 is defined in wled.h)
      }
      // you can as well check WLED state JSON keys
      //if (root["bri"] == 255) Serial.println(F("Don't burn down your garage!"));
@@ -1,5 +1,5 @@
 {
-  "name:": "EleksTube_IPS",
+  "name": "EleksTube_IPS",
  "build": { "libArchive": false },
  "dependencies": {
    "TFT_eSPI" : "2.5.33"
@@ -1,6 +0,0 @@
-[env:ina226_example]
-extends = env:esp32dev
-custom_usermods = ${env:esp32dev.custom_usermods} INA226_v2
-build_flags =
-  ${env:esp32dev.build_flags}
-  ; -D USERMOD_INA226_DEBUG ; -- add a debug status to the info modal
@@ -1,6 +1,5 @@
 ; Options
 ; -------
-; USERMOD_SN_PHOTORESISTOR                      - define this to have this user mod included wled00\usermods_list.cpp
 ; USERMOD_SN_PHOTORESISTOR_MEASUREMENT_INTERVAL - the number of milliseconds between measurements, defaults to 60 seconds
 ; USERMOD_SN_PHOTORESISTOR_FIRST_MEASUREMENT_AT - the number of milliseconds after boot to take first measurement, defaults to 20 seconds
 ; USERMOD_SN_PHOTORESISTOR_REFERENCE_VOLTAGE    - the voltage supplied to the sensor, defaults to 5v
@@ -8,9 +7,10 @@
 ; USERMOD_SN_PHOTORESISTOR_RESISTOR_VALUE       - the resistor size, defaults to 10000.0 (10K hms)
 ; USERMOD_SN_PHOTORESISTOR_OFFSET_VALUE         - the offset value to report on, defaults to 25
 ;
-[env:usermod_sn_photoresistor_d1_mini]
-extends = env:d1_mini
+[env:usermod_sn_photoresistor_esp8266_2m]
+extends = env:esp8266_2m
+custom_usermods = ${env:esp8266_2m.custom_usermods} SN_Photoresistor
 build_flags =
-    ${common.build_flags_esp8266}
-    -D USERMOD_SN_PHOTORESISTOR
-lib_deps = ${env.lib_deps}
+    ${env:esp8266_2m.build_flags}
+    -D USERMOD_SN_PHOTORESISTOR_MEASUREMENT_INTERVAL=60
+lib_deps = ${env:esp8266_2m.lib_deps}
@@ -1,4 +1,4 @@
 {
-  "name:": "ST7789_display",
+  "name": "ST7789_display",
  "build": { "libArchive": false }
 }
@@ -1,8 +0,0 @@
-[env:esp32dev]
-build_flags = ${common.build_flags_esp32} 
-; PIN defines - uncomment and change, if needed:
-;  -D LEDPIN=2
-   -D BTNPIN=35
-;  -D IRPIN=4
-;  -D RLYPIN=12
-;  -D RLYMDE=1
@@ -1,5 +0,0 @@
-; Options
-; -------
-; USERMOD_DALLASTEMPERATURE_MEASUREMENT_INTERVAL - the number of milliseconds between measurements, defaults to 60 seconds
-;
-
@@ -1300,7 +1300,12 @@ class AudioReactive : public Usermod {

      size_t packetSize = fftUdp.parsePacket();
 #ifdef ARDUINO_ARCH_ESP32
-      if ((packetSize > 0) && ((packetSize < 5) || (packetSize > UDPSOUND_MAX_PACKET))) fftUdp.flush(); // discard invalid packets (too small or too big) - only works on esp32
+      if ((packetSize > 0) && ((packetSize < 5) || (packetSize > UDPSOUND_MAX_PACKET)))
+        #if ESP_IDF_VERSION_MAJOR < 5
+        fftUdp.flush(); // discard invalid packets (too small or too big) - only works on esp32
+        #else
+        fftUdp.clear(); // function was renamed in newer frameworks
+        #endif
 #endif
      if ((packetSize > 5) && (packetSize <= UDPSOUND_MAX_PACKET)) {
        //DEBUGSR_PRINTLN("Received UDP Sync Packet");
@@ -1533,14 +1538,9 @@ class AudioReactive : public Usermod {
      // We cannot wait indefinitely before processing audio data
      if (strip.isUpdating() && (millis() - lastUMRun < 2)) return;   // be nice, but not too nice

-      // suspend local sound processing when "real time mode" is active (E131, UDP, ADALIGHT, ARTNET)
-      if (  (realtimeOverride == REALTIME_OVERRIDE_NONE)  // please add other overrides here if needed
-          &&( (realtimeMode == REALTIME_MODE_GENERIC)
-            ||(realtimeMode == REALTIME_MODE_E131)
-            ||(realtimeMode == REALTIME_MODE_UDP)
-            ||(realtimeMode == REALTIME_MODE_ADALIGHT)
-            ||(realtimeMode == REALTIME_MODE_ARTNET) ) )  // please add other modes here if needed
-      {
+      // suspend local sound processing when "real time mode" is active (E131, UDP, ADALIGHT, ARTNET, DDP, DMX)
+      //  exception: sound input is still needed when useMainSegmentOnly - other segments are still running with local input.
+      if (realtimeMode && !realtimeOverride && !useMainSegmentOnly) {
        #if defined(ARDUINO_ARCH_ESP32) && defined(WLED_DEBUG)
        if ((disableSoundProcessing == false) && (audioSyncEnabled == 0)) {  // we just switched to "disabled"
          DEBUG_PRINTLN(F("[AR userLoop]  realtime mode active - audio processing suspended."));
@@ -1617,7 +1617,11 @@ class AudioReactive : public Usermod {
            have_new_sample = receiveAudioData();
            if (have_new_sample) last_UDPTime = millis();
 #ifdef ARDUINO_ARCH_ESP32
+            #if ESP_IDF_VERSION_MAJOR < 5
            else fftUdp.flush(); // Flush udp input buffers if we haven't read it - avoids hickups in receive mode. Does not work on 8266.
+            #else
+            else fftUdp.clear(); // function was renamed in newer frameworks
+            #endif
 #endif
            lastTime = millis();
          }
@@ -1722,7 +1726,7 @@ class AudioReactive : public Usermod {
          );
      }
      micDataReal = 0.0f;                     // just to be sure
-      if (enabled) disableSoundProcessing = false;
+      if (enabled) disableSoundProcessing = false;  // allows FFT_Task to run at least once, even when loop() might disable again
      updateIsRunning = init;
    }

@@ -2067,6 +2071,13 @@ class AudioReactive : public Usermod {
      bool configComplete = !top.isNull();
      bool oldEnabled = enabled;
      bool oldAddPalettes = addPalettes;
+    #ifdef ARDUINO_ARCH_ESP32
+      auto oldDMType = dmType;
+      auto oldI2SsdPin = i2ssdPin;
+      auto oldI2swsPin = i2swsPin;
+      auto oldI2SckPin = i2sckPin;
+      auto oldI2SmclkPin = mclkPin;
+    #endif

      configComplete &= getJsonValue(top[FPSTR(_enabled)], enabled);
      configComplete &= getJsonValue(top[FPSTR(_addPalettes)], addPalettes);
@@ -2108,6 +2119,15 @@ class AudioReactive : public Usermod {
        // add/remove custom/audioreactive palettes
        if ((oldAddPalettes && !addPalettes) || (oldAddPalettes && !enabled)) removeAudioPalettes();
        if ((addPalettes && !oldAddPalettes && enabled) || (addPalettes && !oldEnabled && enabled)) createAudioPalettes();
+	    #ifdef ARDUINO_ARCH_ESP32
+        // notify user when a reboot is necessary
+          if ((audioSource != nullptr) && (oldDMType != dmType)) errorFlag = ERR_REBOOT_NEEDED;  // changing mic type requires reboot
+          if (   (audioSource != nullptr) && (enabled==true)
+              && ((oldI2SsdPin != i2ssdPin) || (oldI2swsPin != i2swsPin) || (oldI2SckPin != i2sckPin)) ) errorFlag = ERR_REBOOT_NEEDED;  // changing mic pins requires reboot
+          if ((audioSource != nullptr) && (oldI2SmclkPin != mclkPin)) errorFlag = ERR_REBOOT_NEEDED;  // changing MCLK pin requires reboot
+          if ((oldDMType != dmType) && (oldDMType == 0)) errorFlag = ERR_POWEROFF_NEEDED;  // changing from analog mic requires power cycle
+          if ((oldDMType != dmType) && (dmType == 0)) errorFlag = ERR_POWEROFF_NEEDED;  // changing to analog mic requires power cycle
+        #endif
      } // else setup() will create palettes
      return configComplete;
    }
@@ -13,7 +13,7 @@ board_build.partitions = ${esp32.large_partitions}
 board_build.f_flash = 80000000L
 board_build.flash_mode = qio
 monitor_filters = esp32_exception_decoder
-build_flags = ${common.build_flags} ${esp32s3.build_flags} -D WLED_RELEASE_NAME=T-QT-PRO-8MB
+build_flags = ${common.build_flags} ${esp32s3.build_flags} -D WLED_RELEASE_NAME=\"T-QT-PRO-8MB_dice\"
  -D CONFIG_LITTLEFS_FOR_IDF_3_2 -D WLED_WATCHDOG_TIMEOUT=0
  -D ARDUINO_USB_CDC_ON_BOOT=1 -D ARDUINO_USB_MODE=1      ;; for boards with USB-OTG connector only (USBCDC or "TinyUSB")
  
@@ -75,7 +75,7 @@ board_build.partitions = ${esp32.large_partitions}
 board_build.f_flash = 80000000L
 board_build.flash_mode = qio
 monitor_filters = esp32_exception_decoder
-build_flags = ${common.build_flags} ${esp32s3.build_flags} -D WLED_RELEASE_NAME=ESP32-S3_8MB_qspi
+build_flags = ${common.build_flags} ${esp32s3.build_flags} -D WLED_RELEASE_NAME=\"ESP32-S3_8MB_qspi_dice\"
  -D CONFIG_LITTLEFS_FOR_IDF_3_2 -D WLED_WATCHDOG_TIMEOUT=0
  -D ARDUINO_USB_CDC_ON_BOOT=1 -D ARDUINO_USB_MODE=1      ;; for boards with USB-OTG connector only (USBCDC or "TinyUSB")
  
@@ -105,7 +105,7 @@ lib_deps = ${esp32s3.lib_deps}
 # https://github.com/wled-dev/WLED/issues/1382
 ; [env:esp32dev_dice]
 ; extends = env:esp32dev
-; build_flags = ${common.build_flags} ${esp32.build_flags} -D WLED_RELEASE_NAME=ESP32
+; build_flags = ${common.build_flags} ${esp32.build_flags} -D WLED_RELEASE_NAME=\"ESP32_dice\"
 ;   ; Enable Pixels dice mod
 ;   -D USERMOD_PIXELS_DICE_TRAY
 ; lib_deps = ${esp32.lib_deps}
@@ -1,5 +1,5 @@
 {
-  "name:": "pov_display",
+  "name": "pov_display",
  "build": { "libArchive": false},
  "platforms": ["espressif32"]
 }
@@ -143,7 +143,13 @@ void ShtUsermod::appendDeviceToMqttDiscoveryMessage(JsonDocument& root) {
  device[F("ids")] = escapedMac.c_str();
  device[F("name")] = serverDescription;
  device[F("sw")] = versionString;
+  // AI: below section was generated by an AI
+  #ifdef ARDUINO_ARCH_ESP32
  device[F("mdl")] = ESP.getChipModel();
+  #else
+  device[F("mdl")] = F("ESP8266");
+  #endif
+  // AI: end
  device[F("mf")] = F("espressif");
 }

@@ -2,10 +2,10 @@
 default_envs = esp32dev_fld

 [env:esp32dev_fld]
-extends = env:esp32dev_V4
-custom_usermods = ${env:esp32dev_V4.custom_usermods} four_line_display_ALT
+extends = env:esp32dev
+custom_usermods = ${env:esp32dev.custom_usermods} four_line_display_ALT
 build_flags =
-    ${env:esp32dev_V4.build_flags}
+    ${env:esp32dev.build_flags}
    -D FLD_TYPE=SH1106
    -D I2CSCLPIN=27
    -D I2CSDAPIN=26
@@ -2,10 +2,10 @@
 default_envs = esp32dev_re

 [env:esp32dev_re]
-extends = env:esp32dev_V4
-custom_usermods = ${env:esp32dev_V4.custom_usermods} rotary_encoder_ui_ALT
+extends = env:esp32dev
+custom_usermods = ${env:esp32dev.custom_usermods} rotary_encoder_ui_ALT
 build_flags =
-    ${env:esp32dev_V4.build_flags}
+    ${env:esp32dev.build_flags}
    -D USERMOD_ROTARY_ENCODER_GPIO=INPUT
    -D ENCODER_DT_PIN=21
    -D ENCODER_CLK_PIN=23
@@ -1061,7 +1061,7 @@ void mode_traffic_light(void) {
      case 0: SEGMENT.setPixelColor(i, 0x00FF0000); mdelay = 150 + (100 * (uint32_t)(255 - SEGMENT.speed));break;
      case 1: SEGMENT.setPixelColor(i, 0x00FF0000); mdelay = 150 + (20 * (uint32_t)(255 - SEGMENT.speed)); SEGMENT.setPixelColor(i+1, 0x00EECC00); break;
      case 2: SEGMENT.setPixelColor(i+2, 0x0000FF00); mdelay = 150 + (100 * (uint32_t)(255 - SEGMENT.speed));break;
-      case 3: SEGMENT.setPixelColor(i+1, 0x00EECC00); mdelay = 150 + (20 * (uint32_t)(255 - SEGMENT.speed));break;
+      case 3: SEGMENT.setPixelColor(i+1, gamma32inv(0x00EECC00)); mdelay = 150 + (20 * (uint32_t)(255 - SEGMENT.speed));break; // gamma inversion to restore original pre 16.0 looks
    }
  }

@@ -2345,7 +2345,7 @@ void mode_colortwinkle() {
          unsigned index = i >> 3;
          unsigned  bitNum = i & 0x07;
          bitWrite(SEGENV.data[index], bitNum, true);
-          SEGMENT.setPixelColor(i, ColorFromPalette(SEGPALETTE, hw_random8(), 64, NOBLEND));
+          SEGMENT.setPixelColor(i, ColorFromPalette(SEGPALETTE, hw_random8(), gamma8inv(64), NOBLEND));  // note on gamma8inv: inverting results in non-linear brightness fade as originally designed
          break; //only spawn 1 new pixel per frame per 50 LEDs
        }
      }
@@ -2616,7 +2616,7 @@ static CRGBW twinklefox_one_twinkle(uint32_t ms, uint8_t salt, bool cat)
  unsigned hue = slowcycle8 - salt;
  CRGBW c;
  if (bright > 0) {
-    c = ColorFromPalette(SEGPALETTE, hue, bright, NOBLEND);
+    c = ColorFromPalette(SEGPALETTE, hue, gamma8inv(bright), NOBLEND); // note on gamma8inv: inverting results in non-linear brightness fade as originally designed
    if (!SEGMENT.check1) {
      // This code takes a pixel, and if its in the 'fading down'
      // part of the cycle, it adjusts the color a little bit like the
@@ -2651,19 +2651,18 @@ static void twinklefox_base(bool cat)
  if (SEGMENT.speed > 100) SEGENV.aux0 = 3 + ((255 - SEGMENT.speed) >> 3);
  else SEGENV.aux0 = 22 + ((100 - SEGMENT.speed) >> 1);

-  // Set up the background color, "bg".
+  // Set up the background color, "bg". Note: using gamma invert for brightness as the FX was written without any gamma correction, it will dim down too much now
  CRGBW bg = SEGCOLOR(1);
-  unsigned bglight = bg.getAverageLight();
+  unsigned bglight = bg.getRGBaverage();
  if (bglight > 64) {
-    bg = color_fade(bg, 16, true); // very bright, so scale to 1/16th
+    bg = color_fade(bg, gamma8inv(16), true); // very bright, so scale to 1/16th
  } else if (bglight > 16) {
-    bg = color_fade(bg, 64, true); // not that bright, so scale to 1/4th
+    bg = color_fade(bg, gamma8inv(64), true); // not that bright, so scale to 1/4
  } else {
-    bg = color_fade(bg, 86, true); // dim, scale to 1/3rd.
+    bg = color_fade(bg, gamma8inv(86), true); // dim, scale to 1/3rd
  }
-  bg = gamma32inv(bg); // need to invert gamma as the FX was written without any gamma correction and it will dim down too much otherwise

-  unsigned backgroundBrightness = bg.getAverageLight();
+  bglight = bg.getRGBaverage(); // update after scaling

  for (unsigned i = 0; i < SEGLEN; i++) {

@@ -2680,8 +2679,8 @@ static void twinklefox_base(bool cat)
    // on the "brightness = f( time )" idea.
    CRGBW c = twinklefox_one_twinkle(myclock30, myunique8, cat);

-    unsigned cbright = c.getAverageLight();
-    int deltabright = cbright - backgroundBrightness;
+    unsigned cbright = c.getRGBaverage();
+    int deltabright = cbright - bglight;
    if (deltabright >= 32 || (bg==0)) {
      // If the new pixel is significantly brighter than the background color,
      // use the new color.
@@ -4183,14 +4182,14 @@ void mode_pacifica()
  uint32_t nowOld = strip.now;

  CRGBPalette16 pacifica_palette_1 =
-    { 0x000507, 0x000409, 0x00030B, 0x00030D, 0x000210, 0x000212, 0x000114, 0x000117,
-      0x000019, 0x00001C, 0x000026, 0x000031, 0x00003B, 0x000046, 0x14554B, 0x28AA50 };
+    { 0x002229, 0x001E2F, 0x001934, 0x001938, 0x00143F, 0x001443, 0x00B047, 0x00B04C,  // note: palettes are gamma inverted using gamma 2.0 to get closer to pre 16.0 looks
+      0x00004F, 0x000054, 0x000062, 0x00006F, 0x00007A, 0x000085, 0x47938A, 0x64D08E };
  CRGBPalette16 pacifica_palette_2 =
-    { 0x000507, 0x000409, 0x00030B, 0x00030D, 0x000210, 0x000212, 0x000114, 0x000117,
-      0x000019, 0x00001C, 0x000026, 0x000031, 0x00003B, 0x000046, 0x0C5F52, 0x19BE5F };
+    { 0x002229, 0x001E2F, 0x001934, 0x001938, 0x00143F, 0x001443, 0x00B047, 0x00B04C,
+      0x00004F, 0x000054, 0x000062, 0x00006F, 0x00007A, 0x000085, 0x369B90, 0x4FDC9B };
  CRGBPalette16 pacifica_palette_3 =
-    { 0x000208, 0x00030E, 0x000514, 0x00061A, 0x000820, 0x000927, 0x000B2D, 0x000C33,
-      0x000E39, 0x001040, 0x001450, 0x001860, 0x001C70, 0x002080, 0x1040BF, 0x2060FF };
+    { 0x00142C, 0x00193B, 0x002247, 0x002551, 0x002C5A, 0x002F63, 0x00346B, 0x003671,
+      0x003B78, 0x003F7F, 0x00478E, 0x004D9C, 0x0054A9, 0x005AB4, 0x3F7FDC, 0x5A9CFF };

  if (SEGMENT.palette) {
    pacifica_palette_1 = SEGPALETTE;
@@ -4241,10 +4240,10 @@ void mode_pacifica()
      c += CRGB(overage, overage2, qadd8(overage2, overage2));
    }

-    //deepen the blues and greens
-    c.blue  = scale8(c.blue,  145);
-    c.green = scale8(c.green, 200);
-    c |= CRGB( 2, 5, 7);
+    //deepen the blues and greens  note: no longer needed with proper gamma in 16.0
+    //c.blue  = scale8(c.blue,  145);
+    //c.green = scale8(c.green, 200);
+    //c |= CRGB( 2, 5, 7);

    SEGMENT.setPixelColor(i, c);
  }
@@ -4374,8 +4373,8 @@ void mode_noisepal(void) {                                    // Slow noise pale
    SEGENV.step = strip.now;

    unsigned baseI = hw_random8();
-    //palettes[1] = CRGBPalette16(CHSV(baseI+hw_random8(64), 255, hw_random8(128,255)), CHSV(baseI+128, 255, hw_random8(128,255)), CHSV(baseI+hw_random8(92), 192, hw_random8(128,255)), CHSV(baseI+hw_random8(92), 255, hw_random8(128,255)));
-    palettes[1] = CRGBPalette16(CHSV(baseI+hw_random8(64), 255, hw_random8(128,255)), CHSV(baseI+128, 255, hw_random8(128,255)), CHSV(baseI+hw_random8(92), 192, hw_random8(128,255)), CHSV(baseI+hw_random8(92), 255, hw_random8(128,255)));
+    uint32_t minBri = gamma8inv(128); // use gamma inversion on min brightness value to restore pre 16.0 looks (more brilliant palettes)
+    palettes[1] = CRGBPalette16(CHSV(baseI+hw_random8(64), 255, hw_random8(minBri,255)), CHSV(baseI+128, 255, hw_random8(minBri,255)), CHSV(baseI+hw_random8(92), 192, hw_random8(minBri,255)), CHSV(baseI+hw_random8(92), 255, hw_random8(minBri,255)));
  }

  //EVERY_N_MILLIS(10) { //(don't have to time this, effect function is only called every 24ms)
@@ -4760,10 +4759,10 @@ void mode_tv_simulator(void) {
        tvSimulator->actualColorB = temp[n    ];
      }
    }
-    // Apply gamma correction, further expand to 16/16/16
-    nr = (uint8_t)gamma8(tvSimulator->actualColorR) * 257; // New R/G/B
-    ng = (uint8_t)gamma8(tvSimulator->actualColorG) * 257;
-    nb = (uint8_t)gamma8(tvSimulator->actualColorB) * 257;
+    // expand to 16 bit
+    nr = (uint8_t)(tvSimulator->actualColorR) * 257; // New R/G/B
+    ng = (uint8_t)(tvSimulator->actualColorG) * 257;
+    nb = (uint8_t)(tvSimulator->actualColorB) * 257;

  if (SEGENV.aux0 == 0) {  // initialize next iteration
    SEGENV.aux0 = 1;
@@ -5721,7 +5720,7 @@ void mode_2Dmatrix(void) {                  // Matrix2D. By Jeremy Williams. Ada
    SEGENV.step = 0;
  }

-  uint8_t fade = map(SEGMENT.custom1, 0, 255, 50, 250);    // equals trail size
+  uint8_t fade = map(SEGMENT.custom1, 0, 255, 30, 250);    // equals trail size
  uint8_t speed = (256-SEGMENT.speed) >> map(min(rows, 150), 0, 150, 0, 3);    // slower speeds for small displays

  uint32_t spawnColor;
@@ -5730,8 +5729,8 @@ void mode_2Dmatrix(void) {                  // Matrix2D. By Jeremy Williams. Ada
    spawnColor = SEGCOLOR(0);
    trailColor = SEGCOLOR(1);
  } else {
-    spawnColor = RGBW32(175,255,175,0);
-    trailColor = RGBW32(27,130,39,0);
+    spawnColor = RGBW32(gamma8inv(175), gamma8inv(255), gamma8inv(175), 0); // use gamma inversion to restor original pre 16.0 looks
+    trailColor = RGBW32(gamma8inv(27),  gamma8inv(130), gamma8inv(39),  0);
  }

  bool emptyScreen = true;
@@ -7006,8 +7005,8 @@ static const char _data_FX_MODE_MIDNOISE[] PROGMEM = "Midnoise@Fade rate,Max. le
 //////////////////////
 // I am the god of hellfire. . . Volume (only) reactive fire routine. Oh, look how short this is.
 void mode_noisefire(void) {                 // Noisefire. By Andrew Tuline.
-  CRGBPalette16 myPal = CRGBPalette16(CHSV(0,255,2),    CHSV(0,255,4),    CHSV(0,255,8), CHSV(0, 255, 8),  // Fire palette definition. Lower value = darker.
-                                      CHSV(0, 255, 16), CRGB::Red,        CRGB::Red,     CRGB::Red,
+  CRGBPalette16 myPal = CRGBPalette16(CHSV(0,255,20),    CHSV(0,255,30),    CHSV(0,255,40), CHSV(0, 255, 44),  // Fire palette definition. Lower value = darker.
+                                      CHSV(0, 255, 64), CRGB::Red,        CRGB::Red,     CRGB::Red,
                                      CRGB::DarkOrange, CRGB::DarkOrange, CRGB::Orange,  CRGB::Orange,
                                      CRGB::Yellow,     CRGB::Orange,     CRGB::Yellow,  CRGB::Yellow);

@@ -7243,7 +7242,7 @@ void mode_DJLight(void) {                   // Written by ??? Adapted by Will Ta
  if (SEGENV.aux0 != secondHand) {                        // Triggered millis timing.
    SEGENV.aux0 = secondHand;

-    CRGB color = CRGB(fftResult[15]/2, fftResult[5]/2, fftResult[0]/2); // 16-> 15 as 16 is out of bounds
+    CRGB color = CRGB(gamma8inv(fftResult[15]/2), gamma8inv(fftResult[5]/2), gamma8inv(fftResult[0]/2)); // apply gamma inversion to restor pre 16.0 looks
    SEGMENT.setPixelColor(mid, color.fadeToBlackBy(map(fftResult[4], 0, 255, 255, 4)));     // TODO - Update

    // if SEGLEN equals 1 these loops won't execute
@@ -7323,7 +7322,7 @@ void mode_freqmatrix(void) {                // Freqmatrix. By Andreas Pleschung.
      uint8_t i =  lowerLimit!=upperLimit ? map(FFT_MajorPeak, lowerLimit, upperLimit, 0, 255) : FFT_MajorPeak;  // may under/overflow - so we enforce uint8_t
      unsigned b = 255 * intensity;
      if (b > 255) b = 255;
-      color = CHSV(i, 240, (uint8_t)b); // implicit conversion to RGB supplied by FastLED
+      color = CHSV(i, 240, gamma8inv(b)); // use gamma inversion on brightness to restore pre 16.0 looks
    }

    // shift the pixels one pixel up
@@ -7414,7 +7413,7 @@ void mode_freqwave(void) {                  // Freqwave. By Andreas Pleschung.
      int lowerLimit = 80 + 3 * SEGMENT.custom1;
      uint8_t i =  lowerLimit!=upperLimit ? map(FFT_MajorPeak, lowerLimit, upperLimit, 0, 255) : FFT_MajorPeak; // may under/overflow - so we enforce uint8_t
      unsigned b = min(255.0f, 255.0f * intensity);
-      color = CHSV(i, 240, (uint8_t)b); // implicit conversion to RGB supplied by FastLED
+      color = CHSV(i, 240, gamma8inv(b)); // use gamma inversion on brightness to restore pre 16.0 looks
    }

    SEGMENT.setPixelColor(SEGLEN/2, color);
@@ -7521,7 +7520,7 @@ void mode_waterfall(void) {                   // Waterfall. By: Andrew Tuline

    unsigned k = SEGLEN-1;
    if (samplePeak) {
-      pixels[k] = (uint32_t)CRGB(CHSV(92,92,92));
+      pixels[k] = (uint32_t)CRGB(CHSV(92,92,gamma8inv(92))); // use gamma inversion on brightness to restore pre 16.0 looks
    } else {
      pixels[k] = color_blend(SEGCOLOR(1), SEGMENT.color_from_palette(pixCol+SEGMENT.intensity, false, PALETTE_SOLID_WRAP, 0), (uint8_t)my_magnitude);
    }
@@ -7632,7 +7631,7 @@ void mode_2DFunkyPlank(void) {              // Written by ??? Adapted by Will Ta
      int v = map(fftResult[band % 16], 0, 255, 10, 255);
      for (int w = 0; w < barWidth; w++) {
         int xpos = (barWidth * b) + w;
-         SEGMENT.setPixelColorXY(xpos, 0, CHSV(hue, 255, v));
+         SEGMENT.setPixelColorXY(xpos, 0, CHSV(hue, 255, gamma8inv(v))); // use gamma inversion on brightness to restore original pre 16.0 looks
      }
    }

@@ -7981,7 +7980,7 @@ void mode_2Doctopus() {
      byte radius = rMap[XY(x,y)].radius;
      //CRGB c = CHSV(SEGENV.step / 2 - radius, 255, sin8_t(sin8_t((angle * 4 - radius) / 4 + SEGENV.step) + radius - SEGENV.step * 2 + angle * (SEGMENT.custom3/3+1)));
      unsigned intensity = sin8_t(sin8_t((angle * 4 - radius) / 4 + SEGENV.step/2) + radius - SEGENV.step + angle * (SEGMENT.custom3/4+1));
-      intensity = map((intensity*intensity) & 0xFFFF, 0, 65535, 0, 255); // add a bit of non-linearity for cleaner display
+      //intensity = map((intensity*intensity) & 0xFFFF, 0, 65535, 0, 255); // add a bit of non-linearity for cleaner display -> no longer needed with proper gamma correction
      SEGMENT.setPixelColorXY(x, y, ColorFromPalette(SEGPALETTE, SEGENV.step / 2 - radius, intensity));
    }
  }
@@ -618,6 +618,7 @@ class Segment {
      DEBUGFX_PRINTLN();
      #endif
      clearName();
+      stopTransition();   // deallocate "_t" (transition) and with it "_segOld" note: _segOld has _t=null, see copy constructor
      #ifdef WLED_ENABLE_GIF
      endImagePlayback(this);
      #endif
@@ -879,6 +880,7 @@ class WS2812FX {
      printSize(),                                // prints memory usage for strip components
 #endif
      finalizeInit(),                             // initialises strip components
+      updatePixelBuffer(),                        // (re)allocate memory for _pixels[]
      service(),                                  // executes effect functions when due and calls strip.show()
      setCCT(uint16_t k),                         // sets global CCT (either in relative 0-255 value or in K)
      setBrightness(uint8_t b, bool direct = false),    // sets strip brightness
@@ -98,7 +98,7 @@ Segment& Segment::operator= (const Segment &orig) {
  if (this != &orig) {
    // clean destination
    if (name) { p_free(name); name = nullptr; }
-    if (_t) stopTransition(); // also erases _t
+    stopTransition(); // delete _t
    deallocateData();
    p_free(pixels);
    pixels = nullptr;
@@ -131,7 +131,7 @@ Segment& Segment::operator= (Segment &&orig) noexcept {
  //DEBUG_PRINTF_P(PSTR("-- Moving segment: %p -> %p\n"), &orig, this);
  if (this != &orig) {
    if (name) { p_free(name); name = nullptr; } // free old name
-    if (_t) stopTransition(); // also erases _t
+    stopTransition(); // delete _t
    deallocateData(); // free old runtime data
    p_free(pixels);   // free old pixel buffer
    // move source data
@@ -290,6 +290,8 @@ void Segment::loadPalette(CRGBPalette16 &targetPalette, uint8_t pal) {
 }

 // starting a transition has to occur before change so we get current values 1st
+// note: _t is the temporary segment that holds the values transitioned from (palette, colors, brightness,...) and the current segment holds the "to" values
+//       if this is a non FADE transition or an FX change, the _oldSegment is created which is a full copy of the segment before the change
 void Segment::startTransition(uint16_t dur, bool segmentCopy) {
  if (dur == 0 || !isActive()) {
    if (isInTransition()) _t->_dur = 0;
@@ -299,15 +301,42 @@ void Segment::startTransition(uint16_t dur, bool segmentCopy) {
    if (segmentCopy && !_t->_oldSegment) {
      // already in transition but segment copy requested and not yet created
      _t->_oldSegment = new(std::nothrow) Segment(*this); // store/copy current segment settings
-      _t->_start = millis();                              // restart countdown
+      _t->_start = millis(); // restart transition timer
      _t->_dur   = dur;
-      _t->_prevPaletteBlends = 0;
+      _t->_prevPaletteBlends = 0; // reset palette blends
      if (_t->_oldSegment) {
-        _t->_oldSegment->palette = _t->_palette;          // restore original palette and colors (from start of transition)
+        _t->_oldSegment->palette = _t->_palette; // restore original palette, colors, brightness and CCT (from start of transition)
        for (unsigned i = 0; i < NUM_COLORS; i++) _t->_oldSegment->colors[i] = _t->_colors[i];
+        _t->_oldSegment->opacity = _t->_bri;
+        _t->_oldSegment->cct     = _t->_cct;
+        // if already partway through a FADE transition, set old segment's colors to current blend to avoid jumping back to original colors
+        if (_t->_progress > 0) {
+          // already in a transition, see comment below
+          for (unsigned i = 0; i < NUM_COLORS; i++) _t->_oldSegment->colors[i] = color_blend16(_t->_colors[i], colors[i], _t->_progress);
+          _t->_oldSegment->opacity = currentBri(); // update "original" brightness note: _t->_progress is updated in updateTransitionProgress() so still valid here
+          _t->_oldSegment->cct     = currentCCT(); // update "original" CCT (reduces jump)
+        }
        DEBUGFX_PRINTF_P(PSTR("-- Updated transition with segment copy: S=%p T(%p) O[%p] OP[%p]\n"), this, _t, _t->_oldSegment, _t->_oldSegment->pixels);
        if (!_t->_oldSegment->isActive()) stopTransition();
      }
+    } else if (_t->_progress > 0) {
+      // already in a transition: capture the current visual blend as the new "from" state so the incoming change does not cause a visible jump.
+      // _palT already holds the intermediate blended palette and will continue blending toward the new target (see beginDraw()), so no palette action needed.
+      // initial version by @blazoncek (https://github.com/blazoncek/WLED/commit/40d9812)
+      for (unsigned i = 0; i < NUM_COLORS; i++) _t->_colors[i] = color_blend16(_t->_colors[i], colors[i], _t->_progress);
+      _t->_bri = currentBri(); // update "original" brightness note: _t->_progress is updated in updateTransitionProgress() so still valid here
+      _t->_cct = currentCCT(); // update "original" CCT (reduces jump)
+      // restart transition timer only if a pure FADE transition, otherwise let the FX change or non-FADE transition finish
+      // this avoids a re-start of the transition if color or brightness is changed during an ongoing FX or non-FADE transition
+      if (blendingStyle == TRANSITION_FADE) {
+        if (_t->_oldSegment != nullptr) {
+          if (_t->_oldSegment->mode != mode)
+            return; // do not reset transition if this is an FX change, note: the disadvantage is that colors still jump in that case
+        }
+        _t->_start = millis();
+        _t->_dur   = dur;
+        _t->_prevPaletteBlends = 0;
+      }
    }
    return;
  }
@@ -333,6 +362,7 @@ void Segment::startTransition(uint16_t dur, bool segmentCopy) {
 }

 void Segment::stopTransition() {
+  if (_t == nullptr) return; // no ongoing transition
  DEBUG_PRINTF_P(PSTR("-- Stopping transition: S=%p T(%p) O[%p]\n"), this, _t, _t->_oldSegment);
  delete _t;
  _t = nullptr;
@@ -365,7 +395,7 @@ uint8_t Segment::currentBri() const {
  if (prog < 0xFFFFU) {
    // this will blend opacity in new mode if style is FADE (single effect call)
    if (blendingStyle == TRANSITION_FADE) curBri = (prog * curBri + _t->_bri * (0xFFFFU - prog)) / 0xFFFFU;
-    else                                   curBri = Segment::isPreviousMode() ? _t->_bri : curBri;
+    else                                  curBri = Segment::isPreviousMode() ? _t->_bri : curBri;
  }
  return curBri;
 }
@@ -452,7 +482,7 @@ void Segment::setGeometry(uint16_t i1, uint16_t i2, uint8_t grp, uint8_t spc, ui

  DEBUGFX_PRINTF_P(PSTR("Segment geometry: %d,%d -> %d,%d [%d,%d]\n"), (int)i1, (int)i2, (int)i1Y, (int)i2Y, (int)grp, (int)spc);
  markForReset();
-  if (_t) stopTransition(); // we can't use transition if segment dimensions changed
+  stopTransition(); // we can't use transition if segment dimensions changed
  stateChanged = true;      // send UDP/WS broadcast

  // apply change immediately
@@ -1117,7 +1147,7 @@ void Segment::blur(uint8_t blur_amount, bool smear) const {
 * Rotates the color in HSV space, where pos is H. (0=0deg, 256=360deg)
 */
 uint32_t Segment::color_wheel(uint8_t pos) const {
-  if (palette) return color_from_palette(pos, false, false, 0); // only wrap if "always wrap" is set
+  if (palette) return color_from_palette(pos, false, true, 0); // color_wheel is a continuous (moving) wheel, so wrap end->start (restores pre-0.16 behaviour)
  uint8_t w = W(getCurrentColor(0));
  CRGBW rgb;
  rgb = CHSV32(static_cast<uint16_t>(pos << 8), 255, 255);
@@ -1272,11 +1302,17 @@ void WS2812FX::finalizeInit() {
  deserializeMap();     // (re)load default ledmap (will also setUpMatrix() if ledmap does not exist)

  // allocate frame buffer after matrix has been set up (gaps!)
+  updatePixelBuffer();
+  DEBUG_PRINTF_P(PSTR("Heap after strip init: %uB\n"), getFreeHeapSize());
+}
+
+// update global _pixels[] buffer to match getLengthTotal() note: if allocation fails, WLED will not render anything
+void WS2812FX::updatePixelBuffer() {
+  uint32_t requiredMem = getLengthTotal() * sizeof(uint32_t);
  p_free(_pixels); // using realloc on large buffers can cause additional fragmentation instead of reducing it
  // use PSRAM if available: there is no measurable perfomance impact between PSRAM and DRAM on S2/S3 with QSPI PSRAM for this buffer
-  _pixels = static_cast<uint32_t*>(allocate_buffer(getLengthTotal() * sizeof(uint32_t), BFRALLOC_ENFORCE_PSRAM | BFRALLOC_NOBYTEACCESS | BFRALLOC_CLEAR));
-  DEBUG_PRINTF_P(PSTR("strip buffer size: %uB\n"), getLengthTotal() * sizeof(uint32_t));
-  DEBUG_PRINTF_P(PSTR("Heap after strip init: %uB\n"), getFreeHeapSize());
+  _pixels = static_cast<uint32_t*>(allocate_buffer(requiredMem, BFRALLOC_ENFORCE_PSRAM | BFRALLOC_NOBYTEACCESS | BFRALLOC_CLEAR));
+  DEBUG_PRINTF_P(PSTR("strip buffer size: %uB\n"), requiredMem);
 }

 void WS2812FX::service() {
@@ -1730,6 +1766,9 @@ void WS2812FX::show() {
  int oldCCT = Bus::getCCT(); // store original CCT value (since it is global)
  // when cctFromRgb is true we implicitly calculate WW and CW from RGB values (cct==-1)
  if (cctFromRgb) BusManager::setSegmentCCT(-1);
+  // use color gamma correction if enabled, not in realtime mode with gamma disabled or currently overriding RT mode
+  bool useGammaCorrection = gammaCorrectCol && !(realtimeMode && arlsDisableGammaCorrection && !realtimeOverride);
+
  for (size_t i = 0; i < totalLen; i++) {
    // when correctWB is true setSegmentCCT() will convert CCT into K with which we can then
    // correct/adjust RGB value according to desired CCT value, it will still affect actual WW/CW ratio
@@ -1738,8 +1777,8 @@ void WS2812FX::show() {
    }

    uint32_t c = _pixels[i]; // need a copy, do not modify _pixels directly (no byte access allowed on ESP32)
-    if (c > 0 && !(realtimeMode && arlsDisableGammaCorrection))
-        c = gamma32(c); // apply gamma correction if enabled note: applying gamma after brightness has too much color loss
+    if (c > 0 && useGammaCorrection)
+      c = gamma32(c); // apply gamma correction if enabled note: applying gamma after brightness has too much color loss
    BusManager::setPixelColor(getMappedPixelIndex(i), c);
  }
  Bus::setCCT(oldCCT);  // restore old CCT for ABL adjustments
@@ -2080,10 +2119,13 @@ bool WS2812FX::deserializeMap(unsigned n) {
  customMappingSize = 0; // prevent use of mapping if anything goes wrong
  currentLedmap = 0;
  if (n == 0 || isFile) interfaceUpdateCallMode = CALL_MODE_WS_SEND; // schedule WS update (to inform UI)
+  uint32_t lengthTotalBefore = strip.getLengthTotal();

  if (!isFile && n==0 && isMatrix) {
    // 2D panel support creates its own ledmap (on the fly) if a ledmap.json does not exist
    setUpMatrix();
+    if (strip.getLengthTotal() != lengthTotalBefore)
+      strip.updatePixelBuffer(); // allocate _pixels[] to match new length
    return false;
  }

@@ -2131,6 +2173,7 @@ bool WS2812FX::deserializeMap(unsigned n) {
        int index = atoi(number);
        if (index < 0 || index > 65535) index = 0xFFFF; // prevent integer wrap around
        customMappingTable[customMappingSize++] = index;
+        if (end != nullptr) break; // array closing ']' was in this chunk; stop before atoi() coerces trailing JSON keys into bogus entries
        if (customMappingSize >= getLengthTotal()) break;
      } else break; // there was nothing to read, stop
    }
@@ -2158,6 +2201,8 @@ bool WS2812FX::deserializeMap(unsigned n) {
  }

  releaseJSONBufferLock();
+  if (strip.getLengthTotal() != lengthTotalBefore)
+    strip.updatePixelBuffer(); // allocate _pixels[] to match new length
  return (customMappingSize > 0);
 }

@@ -351,26 +351,25 @@ void BusDigital::setColorOrder(uint8_t colorOrder) {
 // credit @willmmiles & @netmindz https://github.com/wled/WLED/pull/4056
 std::vector<LEDType> BusDigital::getLEDTypes() {
  return {
-    {TYPE_WS2812_RGB,    "D",  PSTR("WS281x")},
+    {TYPE_WS2812_RGB,    "D",  PSTR("WS281x RGB")},
+    {TYPE_WS2811_400KHZ, "D",  PSTR("400kHz RGB")},
+    {TYPE_TM1829,        "D",  PSTR("TM1829 RGB")},
+    {TYPE_UCS8903,       "D",  PSTR("UCS8903 RGB")},
+    {TYPE_APA106,        "D",  PSTR("APA106/PL9823 RGB")},
+    {TYPE_TM1914,        "D",  PSTR("TM1914 RGB")},
    {TYPE_SK6812_RGBW,   "D",  PSTR("SK6812/WS2814 RGBW")},
-    {TYPE_TM1814,        "D",  PSTR("TM1814")},
-    {TYPE_WS2811_400KHZ, "D",  PSTR("400kHz")},
-    {TYPE_TM1829,        "D",  PSTR("TM1829")},
-    {TYPE_UCS8903,       "D",  PSTR("UCS8903")},
-    {TYPE_APA106,        "D",  PSTR("APA106/PL9823")},
-    {TYPE_TM1914,        "D",  PSTR("TM1914")},
-    {TYPE_FW1906,        "D",  PSTR("FW1906 GRBCW")},
    {TYPE_UCS8904,       "D",  PSTR("UCS8904 RGBW")},
-    {TYPE_WS2805,        "D",  PSTR("WS2805 RGBCW")},
-    {TYPE_SM16825,       "D",  PSTR("SM16825 RGBCW")},
+    {TYPE_TM1814,        "D",  PSTR("TM1814 RGBW")},
+    {TYPE_FW1906,        "D",  PSTR("FW1906/WS2811 RGBCCT")},
+    {TYPE_WS2805,        "D",  PSTR("WS2805 RGBCCT")},
+    {TYPE_SM16825,       "D",  PSTR("SM16825 RGBCCT")},
    {TYPE_WS2812_1CH_X3, "D",  PSTR("WS2811 White")},
-    //{TYPE_WS2812_2CH_X3, "D",  PSTR("WS281x CCT")}, // not implemented
    {TYPE_WS2812_WWA,    "D",  PSTR("WS281x WWA")}, // amber ignored
-    {TYPE_WS2801,        "2P", PSTR("WS2801")},
-    {TYPE_APA102,        "2P", PSTR("APA102")},
-    {TYPE_LPD8806,       "2P", PSTR("LPD8806")},
-    {TYPE_LPD6803,       "2P", PSTR("LPD6803")},
-    {TYPE_P9813,         "2P", PSTR("PP9813")},
+    {TYPE_WS2801,        "2P", PSTR("WS2801 RGB")},
+    {TYPE_APA102,        "2P", PSTR("APA102 RGB")},
+    {TYPE_LPD8806,       "2P", PSTR("LPD8806 RGB")},
+    {TYPE_LPD6803,       "2P", PSTR("LPD6803 RGB")},
+    {TYPE_P9813,         "2P", PSTR("P9813 RGB")},
  };
 }

@@ -611,7 +610,7 @@ std::vector<LEDType> BusPwm::getLEDTypes() {
    {TYPE_ANALOG_2CH, "AA",     PSTR("PWM CCT")},
    {TYPE_ANALOG_3CH, "AAA",    PSTR("PWM RGB")},
    {TYPE_ANALOG_4CH, "AAAA",   PSTR("PWM RGBW")},
-    {TYPE_ANALOG_5CH, "AAAAA",  PSTR("PWM RGB+CCT")},
+    {TYPE_ANALOG_5CH, "AAAAA",  PSTR("PWM RGBCCT")},
    //{TYPE_ANALOG_6CH, "AAAAAA", PSTR("PWM RGB+DCCT")}, // unimplementable ATM
  };
 }
@@ -813,6 +812,7 @@ BusHub75Matrix::BusHub75Matrix(const BusConfig &bc) : Bus(bc.type, bc.start, bc.

  // mxconfig.driver = HUB75_I2S_CFG::ICN2038S;  // experimental - use specific shift register driver
  // mxconfig.driver = HUB75_I2S_CFG::FM6124;    // try this driver in case you panel stays dark, or when colors look too pastel
+  // Other possible shiftreg drivers: HUB75_I2S_CFG::FM6126A, HUB75_I2S_CFG::ICN2038S, HUB75_I2S_CFG::MBI5124, HUB75_I2S_CFG::DP3246

  // mxconfig.latch_blanking = 3;
  // mxconfig.i2sspeed = HUB75_I2S_CFG::HZ_10M;  // experimental - 5MHZ should be enugh, but colours looks slightly better at 10MHz
@@ -824,8 +824,13 @@ BusHub75Matrix::BusHub75Matrix(const BusConfig &bc) : Bus(bc.type, bc.start, bc.
  mxconfig.chain_length = max((uint8_t) 1, min(chainLength, (uint8_t) 4));

  if (mxconfig.mx_height >= 64 && (mxconfig.chain_length > 1)) {
-    DEBUGBUS_PRINTLN(F("WARNING, only single panel can be used of 64 pixel boards due to memory"));
-    mxconfig.chain_length = 1;
+  #if defined(BOARD_HAS_PSRAM)                    // limitation to one panel only applies to boards without PSRAM
+    if (!psramFound() || ESP.getPsramSize() == 0) // PSRAM sanity check
+  #endif
+    {
+      DEBUGBUS_PRINTLN(F("WARNING, only single panel can be used of 64 pixel boards due to memory"));
+      mxconfig.chain_length = 1;
+    }
  }

  if (bc.type == TYPE_HUB75MATRIX_HS) {
@@ -835,6 +840,7 @@ BusHub75Matrix::BusHub75Matrix(const BusConfig &bc) : Bus(bc.type, bc.start, bc.
      _isVirtual = true;
      mxconfig.mx_width = min((uint8_t) 64, panelWidth) * 2;
      mxconfig.mx_height = min((uint8_t) 64, panelHeight) / 2;
+      mxconfig.driver = HUB75_I2S_CFG::FM6124;  // use FM6124 for "outdoor" 4-scan panels - workaround until we can make the driver user-configurable
  } else {
    DEBUGBUS_PRINTLN("Unknown type");
    return;
@@ -874,6 +880,12 @@ BusHub75Matrix::BusHub75Matrix(const BusConfig &bc) : Bus(bc.type, bc.start, bc.
  // HUB75_I2S_CFG::i2s_pins _pins={R1_PIN, G1_PIN, B1_PIN, R2_PIN, G2_PIN, B2_PIN, A_PIN, B_PIN, C_PIN, D_PIN, E_PIN, LAT_PIN, OE_PIN, CLK_PIN};
  mxconfig.gpio = { 1, 5, 6, 7, 13, 9, 16, 48, 47, 21, 38, 8, 4, 18 };

+#elif defined(WAVESHARE_S3_PINOUT)
+  DEBUGBUS_PRINTLN("MatrixPanel_I2S_DMA - Waveshare S3 with PSRAM, Waveshare pinout");
+
+  // HUB75_I2S_CFG::i2s_pins _pins={R1_PIN, G1_PIN, B1_PIN, R2_PIN, G2_PIN, B2_PIN, A_PIN, B_PIN, C_PIN, D_PIN, E_PIN, LAT_PIN, OE_PIN, CLK_PIN};
+  mxconfig.gpio = {4, 5, 6, 7, 15, 16, 18, 8, 3, 42, 9, 40, 2, 41};
+  
 #else
  DEBUGBUS_PRINTLN("MatrixPanel_I2S_DMA - S3 with PSRAM");
  // HUB75_I2S_CFG::i2s_pins _pins={R1_PIN, G1_PIN, B1_PIN, R2_PIN, G2_PIN, B2_PIN, A_PIN, B_PIN, C_PIN, D_PIN, E_PIN, LAT_PIN, OE_PIN, CLK_PIN};
@@ -990,10 +1002,8 @@ BusHub75Matrix::BusHub75Matrix(const BusConfig &bc) : Bus(bc.type, bc.start, bc.
    }
    setBitArray(_ledsDirty, _len, false);             // reset dirty bits

-    if (mxconfig.double_buff == false) {
-      // create LEDs buffer (initialized to BLACK), prefer DRAM if enough heap is available (faster in case global _pixels buffer is in PSRAM as not both will fit the cache)
-      _ledBuffer = static_cast<CRGB*>(allocate_buffer(_len * sizeof(CRGB), BFRALLOC_PREFER_DRAM | BFRALLOC_CLEAR));
-    }
+    // create LEDs buffer (initialized to BLACK), prefer DRAM if enough heap is available (faster in case global _pixels buffer is in PSRAM as not both will fit the cache)
+    _ledBuffer = static_cast<CRGB*>(allocate_buffer(_len * sizeof(CRGB), BFRALLOC_PREFER_DRAM | BFRALLOC_CLEAR));
  }

  PANEL_CHAIN_TYPE chainType = CHAIN_NONE; // default for quarter-scan panels that do not use chaining
@@ -1124,6 +1134,8 @@ void BusHub75Matrix::cleanup() {
  if (display != nullptr) delete display;
  display = nullptr;
  virtualDisp = nullptr; // note: when not using "NO_GFX" this causes a memory leak
+  #else  // runtime reconfiguration is not working on -S3, request reboot from user instead
+    errorFlag = ERR_REBOOT_NEEDED;
  #endif
  if (_ledBuffer != nullptr) d_free(_ledBuffer); _ledBuffer = nullptr;
  if (_ledsDirty != nullptr) d_free(_ledsDirty); _ledsDirty = nullptr;
@@ -184,10 +184,9 @@ class Bus {
              type == TYPE_NET_DDP_RGBW || type == TYPE_NET_ARTNET_RGBW;                   // network types with white channel
    }
    static constexpr bool hasCCT(uint8_t type) {
-      return  type == TYPE_WS2812_2CH_X3 || type == TYPE_WS2812_WWA ||
+      return  type == TYPE_WS2812_WWA    || type == TYPE_SM16825 ||
              type == TYPE_ANALOG_2CH    || type == TYPE_ANALOG_5CH ||
-              type == TYPE_FW1906        || type == TYPE_WS2805     ||
-              type == TYPE_SM16825;
+              type == TYPE_FW1906        || type == TYPE_WS2805;
    }
    static constexpr bool  isTypeValid(uint8_t type)  { return (type > 15 && type < 128); }
    static constexpr bool  isDigital(uint8_t type)    { return (type >= TYPE_DIGITAL_MIN && type <= TYPE_DIGITAL_MAX) || is2Pin(type); }
@@ -1,4 +1,4 @@
-#pragma once
+#pragma once
 #ifndef BusWrapper_h
 #define BusWrapper_h

@@ -50,7 +50,7 @@
 #define I_8266_U1_UCS_4 26
 #define I_8266_DM_UCS_4 27
 #define I_8266_BB_UCS_4 28
-//FW1906 GRBCW
+//FW1906 GRBCCT
 #define I_8266_U0_FW6_5 29
 #define I_8266_U1_FW6_5 30
 #define I_8266_DM_FW6_5 31
@@ -60,7 +60,7 @@
 #define I_8266_U1_APA106_3 34
 #define I_8266_DM_APA106_3 35
 #define I_8266_BB_APA106_3 36
-//WS2805 (RGBCW)
+//WS2805 (RGBCCT)
 #define I_8266_U0_2805_5 37
 #define I_8266_U1_2805_5 38
 #define I_8266_DM_2805_5 39
@@ -70,7 +70,7 @@
 #define I_8266_U1_TM1914_3 42
 #define I_8266_DM_TM1914_3 43
 #define I_8266_BB_TM1914_3 44
-//SM16825 (RGBCW)
+//SM16825 (RGBCCT)
 #define I_8266_U0_SM16825_5 45
 #define I_8266_U1_SM16825_5 46
 #define I_8266_DM_SM16825_5 47
@@ -98,19 +98,19 @@
 //UCS8904 (RGBW)
 #define I_32_RN_UCS_4 25
 #define I_32_I2_UCS_4 26
-//FW1906 GRBCW
+//FW1906 GRBCCT 6 color channels
 #define I_32_RN_FW6_5 29
 #define I_32_I2_FW6_5 30
 //APA106
 #define I_32_RN_APA106_3 33
 #define I_32_I2_APA106_3 34
-//WS2805 (RGBCW)
+//WS2805 (RGBCCT)
 #define I_32_RN_2805_5 37
 #define I_32_I2_2805_5 38
 //TM1914 (RGB)
 #define I_32_RN_TM1914_3 41
 #define I_32_I2_TM1914_3 42
-//SM16825 (RGBCW)
+//SM16825 (RGBCCT)
 #define I_32_RN_SM16825_5 45
 #define I_32_I2_SM16825_5 46

@@ -180,12 +180,12 @@
 #define B_8266_U1_APA106_3 NeoPixelBus<NeoRbgFeature, NeoEsp8266Uart1Apa106Method> //3 chan, esp8266, gpio2
 #define B_8266_DM_APA106_3 NeoPixelBus<NeoGrbFeature, NeoEsp8266DmaApa106Method>  //3 chan, esp8266, gpio3
 #define B_8266_BB_APA106_3 NeoPixelBus<NeoGrbFeature, NeoEsp8266BitBangApa106Method> //3 chan, esp8266, bb (any pin but 16)
-//FW1906 GRBCW
+//FW1906 GRBCCT
 #define B_8266_U0_FW6_5 NeoPixelBus<NeoGrbcwxFeature, NeoEsp8266Uart0Ws2813Method>   //esp8266, gpio1
 #define B_8266_U1_FW6_5 NeoPixelBus<NeoGrbcwxFeature, NeoEsp8266Uart1Ws2813Method>   //esp8266, gpio2
 #define B_8266_DM_FW6_5 NeoPixelBus<NeoGrbcwxFeature, NeoEsp8266Dma800KbpsMethod>   //esp8266, gpio3
 #define B_8266_BB_FW6_5 NeoPixelBus<NeoGrbcwxFeature, NeoEsp8266BitBang800KbpsMethod>   //esp8266, bb
-//WS2805 GRBCW
+//WS2805 GRBCCT
 #define B_8266_U0_2805_5 NeoPixelBus<NeoGrbwwFeature, NeoEsp8266Uart0Ws2805Method> //esp8266, gpio1
 #define B_8266_U1_2805_5 NeoPixelBus<NeoGrbwwFeature, NeoEsp8266Uart1Ws2805Method> //esp8266, gpio2
 #define B_8266_DM_2805_5 NeoPixelBus<NeoGrbwwFeature, NeoEsp8266DmaWs2805Method> //esp8266, gpio3
@@ -195,7 +195,7 @@
 #define B_8266_U1_TM1914_3 NeoPixelBus<NeoRgbTm1914Feature, NeoEsp8266Uart1Tm1914Method>
 #define B_8266_DM_TM1914_3 NeoPixelBus<NeoRgbTm1914Feature, NeoEsp8266DmaTm1914Method>
 #define B_8266_BB_TM1914_3 NeoPixelBus<NeoRgbTm1914Feature, NeoEsp8266BitBangTm1914Method>
-//Sm16825 (RGBWC)
+//Sm16825 (RGBCCT)
 #define B_8266_U0_SM16825_5 NeoPixelBus<NeoRgbwcSm16825eFeature, NeoEsp8266Uart0Ws2813Method>
 #define B_8266_U1_SM16825_5 NeoPixelBus<NeoRgbwcSm16825eFeature, NeoEsp8266Uart1Ws2813Method>
 #define B_8266_DM_SM16825_5 NeoPixelBus<NeoRgbwcSm16825eFeature, NeoEsp8266Dma800KbpsMethod>
@@ -285,11 +285,11 @@
 #define B_32_RN_APA106_3 NeoPixelBus<NeoGrbFeature, NeoEsp32RmtMethod(Apa106)>
 #define B_32_I2_APA106_3 NeoPixelBus<NeoGrbFeature, X1Apa106Method>
 #define B_32_IP_APA106_3 NeoPixelBus<NeoGrbFeature, X8Apa106Method> // parallel I2S
-//FW1906 GRBCW
+//FW1906 GRBCCT 6 color channels
 #define B_32_RN_FW6_5 NeoPixelBus<NeoGrbcwxFeature, NeoEsp32RmtMethod(Ws2812x)>
 #define B_32_I2_FW6_5 NeoPixelBus<NeoGrbcwxFeature, X1800KbpsMethod>
 #define B_32_IP_FW6_5 NeoPixelBus<NeoGrbcwxFeature, X8800KbpsMethod> // parallel I2S
-//WS2805 RGBWC
+//WS2805 RGBCCT
 #define B_32_RN_2805_5 NeoPixelBus<NeoGrbwwFeature, NeoEsp32RmtMethod(Ws2805)>
 #define B_32_I2_2805_5 NeoPixelBus<NeoGrbwwFeature, X1Ws2805Method>
 #define B_32_IP_2805_5 NeoPixelBus<NeoGrbwwFeature, X8Ws2805Method> // parallel I2S
@@ -297,7 +297,7 @@
 #define B_32_RN_TM1914_3 NeoPixelBus<NeoGrbTm1914Feature, NeoEsp32RmtMethod(Tm1914)>
 #define B_32_I2_TM1914_3 NeoPixelBus<NeoGrbTm1914Feature, X1Tm1914Method>
 #define B_32_IP_TM1914_3 NeoPixelBus<NeoGrbTm1914Feature, X8Tm1914Method> // parallel I2S
-//Sm16825 (RGBWC)
+//Sm16825 (RGBCCT)
 #define B_32_RN_SM16825_5 NeoPixelBus<NeoRgbcwSm16825eFeature, NeoEsp32RmtMethod(Ws2812x)>
 #define B_32_I2_SM16825_5 NeoPixelBus<NeoRgbcwSm16825eFeature, X1Ws2812xMethod>
 #define B_32_IP_SM16825_5 NeoPixelBus<NeoRgbcwSm16825eFeature, X8Ws2812xMethod> // parallel I2S
@@ -358,6 +358,7 @@ class PolyBus {
    #ifdef ESP8266
    dotStar_strip->Begin();
    #else
+    if (miso == -1) miso = 127; // note: in arduino core, -1 means "default" not "none", passing 127 as the MISO pin is a workaround to prevent SPI.begin() assign the default pin, see #5670
    if (sck == -1 && mosi == -1) dotStar_strip->Begin();
    else                         dotStar_strip->Begin(sck, miso, mosi, ss);
    #endif
@@ -1315,7 +1316,6 @@ class PolyBus {
      if (offset > 3) offset = 3;
      switch (busType) {
        case TYPE_WS2812_1CH_X3:
-        case TYPE_WS2812_2CH_X3:
        case TYPE_WS2812_RGB:
        case TYPE_WS2812_WWA:
          t = I_8266_U0_NEO_3 + offset; break;
@@ -1358,7 +1358,6 @@ class PolyBus {
      // Now determine actual bus type with the chosen offset
      switch (busType) {
        case TYPE_WS2812_1CH_X3:
-        case TYPE_WS2812_2CH_X3:
        case TYPE_WS2812_RGB:
        case TYPE_WS2812_WWA:
          t = I_32_RN_NEO_3 + offset; break;
@@ -198,6 +198,11 @@ struct CRGBW {
  uint8_t getAverageLight() const {
    return (r + g + b + w) >> 2;
  }
+
+  // get the average of the R, G, B values
+  uint8_t getRGBaverage() const {
+    return ((r + g + b) * 21846) >> 16; // x*21846>>16 is equal to "divide by 3"
+  }
 };

 inline CHSV32::CHSV32(const CRGBW& rgb) {
@@ -319,7 +319,7 @@ static_assert(WLED_MAX_BUSSES <= 32, "WLED_MAX_BUSSES exceeds hard limit");
 #define TYPE_DIGITAL_MIN         16            // first usable digital type
 #define TYPE_WS2812_1CH          18            //white-only chips (1 channel per IC) (unused)
 #define TYPE_WS2812_1CH_X3       19            //white-only chips (3 channels per IC)
-#define TYPE_WS2812_2CH_X3       20            //CCT chips (1st IC controls WW + CW of 1st zone and CW of 2nd zone, 2nd IC controls WW of 2nd zone and WW + CW of 3rd zone)
+//#define TYPE_WS2812_2CH_X3       20            // use FW1906
 #define TYPE_WS2812_WWA          21            //amber + warm + cold white
 #define TYPE_WS2812_RGB          22
 #define TYPE_GS8608              23            //same driver as WS2812, but will require signal 2x per second (else displays test pattern)
@@ -472,6 +472,17 @@ static_assert(WLED_MAX_BUSSES <= 32, "WLED_MAX_BUSSES exceeds hard limit");
 #define ERR_OVERTEMP    30  // An attached temperature sensor has measured above threshold temperature (not implemented)
 #define ERR_OVERCURRENT 31  // An attached current sensor has measured a current above the threshold (not implemented)
 #define ERR_UNDERVOLT   32  // An attached voltmeter has measured a voltage below the threshold (not implemented)
+#define ERR_LOW_MEM     33  // low memory (RAM)
+#define ERR_LOW_SEG_MEM 34  // low memory (effect data RAM)
+#define ERR_LOW_WS_MEM  35  // low memory (ws)
+//#define ERR_LOW_AJAX_MEM 36 // (not used any more) low memory (oappend)
+#define ERR_LOW_BUF     37  // low memory (LED pixels buffer)
+#define ERR_SYS_REBOOT      90  // reboot after error, trying to roll back
+#define ERR_SYS_BROWNOUT    91  // reboot after brownout alert
+#define ERR_PERSISTENT_THRESHOLD 100 // ToDO: errors below this value are non-persistent; persistent errors stay in the UI until restart
+// ERR_PERSISTENT_THRESHOLD is a threshold value only - never assign directly to errorFlag
+#define ERR_REBOOT_NEEDED   100 // reboot needed after changing hardware setting
+#define ERR_POWEROFF_NEEDED 101 // power-cycle needed after changing hardware setting

 // JSON buffer lock owners
 #define JSON_LOCK_UNKNOWN        255
@@ -200,7 +200,7 @@ function sendDDP(ws, start, len, colors) {
 		let pkt = new Uint8Array(11 + dLen); // DDP header is 10 bytes, plus 1 byte for WLED websocket protocol indicator
 		pkt[0] = 0x02; // DDP protocol indicator for WLED websocket. Note: below DDP protocol bytes are offset by 1
 		pkt[1] = 0x40; // flags: 0x40 = no push, 0x41 = push (i.e. render), note: this is DDP protocol byte 0
-		pkt[2] = 0x00; // reserved
+		pkt[2] = 0x00; // upper nibble is reserved, lower nibble is sequence number, if set to 0 no sequence checking is done (if enabled)
 		pkt[3] = 0x0B; // RGB, 8bit per channel
 		pkt[4] = 0x01; // destination id (not used but 0x01 is default output)
 		pkt[5] = (off >> 24) & 255; // DDP protocol 4-7 is offset
@@ -1567,8 +1567,36 @@ function readState(s,command=false)
 			case 19:
 				errstr = "A filesystem error has occured.";
 				break;
+// error code from WLEDMM - not supported yet
+//			case 33:
+//				errstr = "Low Memory (generic RAM).";
+//		  break;
+//			case 34:
+//				errstr = "Low Memory (effect data).";
+//		  break;
+//			case 35:
+//				errstr = "Low Memory (WS data).";
+//		  break;
+//			case 36:
+//				errstr = "Low Memory (oappend buffer).";
+//		  break;
+//			case 37:
+//				errstr = "no memory for LEDs buffer.";
+//		  break;
+			case 90:
+				errstr = "Unexpected Restart.";
+		  break;
+			case 91:
+				errstr = "Brownout Restart.";
+		  break;
+			case 100:
+				errstr = "Please reboot WLED to activate changed settings.";
+		  break;
+			case 101:
+				errstr = "Please switch your device off and back on.";
+		  break;
 		}
-		showToast('Error ' + s.error + ": " + errstr, true);
+		showToast((s.error<100) ? 'Error ': 'Note ' + s.error + ": " + errstr, true);  // show "please restart" as a note, all others as errors
 	}

 	selectedPal = i.pal;
@@ -3597,4 +3625,4 @@ _C.addEventListener('touchstart', lock, false);

 _C.addEventListener('mouseout', move, false);
 _C.addEventListener('mouseup', move, false);
-_C.addEventListener('touchend', move, false);
+_C.addEventListener('touchend', move, false);
@@ -190,7 +190,7 @@
 		}
 	}
 	function pMP() { // populateMacroPresets
-		var presetOpts = '<option value="0">Default Action</option>' + sortedPresetOptions;
+		var presetOpts = '<option value="0">Default Action (0)</option>' + sortedPresetOptions;
 		var fields = ['A0','A1','MC','MN'];
 		for (var f of fields) {
 			var inp = gN(f);
@@ -219,13 +219,38 @@
 			rPS(sel, presetOpts, "data-preset");
 		}
 	}
+	function bAO() { // buildAnalogOptions: analog functions + per-segment opacity (segment 0 included; MD=0 => segment 0)
+		var o = '<optgroup label="Analog Functions"><option value="250">Global brightness (250)</option><option value="249">Effect speed (249)</option><option value="248">Effect intensity (248)</option><option value="247">Palette (247)</option><option value="200">Primary color hue (200)</option></optgroup><optgroup label="Analog Segment Opacity">';
+		for (var j=0; j<=32; j++) o += `<option value="${j}">Segment ${j} opacity</option>`;
+		o += '</optgroup>';
+		return o;
+	}
+	function isAnalogBtn(t) { return t==7 || t==8; } // BTN_TYPE_ANALOG / BTN_TYPE_ANALOG_INVERTED
+	function isSwitchBtn(t) { return t==4 || t==5 || t==9; } // BTN_TYPE_SWITCH / BTN_TYPE_PIR_SENSOR / BTN_TYPE_TOUCH_SWITCH
+	function btnTypeName(t) { // mirrors the button type dropdown on the LED settings page
+		switch (+t) {
+			case 2: return 'Pushbutton';
+			case 3: return 'Push inverted';
+			case 4: return 'Switch';
+			case 5: return 'PIR sensor';
+			case 6: return 'Touch';
+			case 7: return 'Analog';
+			case 8: return 'Analog inverted';
+			case 9: return 'Touch (switch)';
+			default: return 'Disabled';
+		}
+	}
 	function rBPO() { // refreshButtonPresetOptions
-		var presetOpts = '<option value="0">Default Action</option>' + sortedPresetOptions;
+		var presetOpts = '<option value="0">Default Action (0)</option>' + sortedPresetOptions;
+		var analogOpts = bAO();
 		var container = gId("macros");
 		if (!container) return;
+		// analog buttons only have an MD select (MP/ML are hidden 0 inputs); MD uses analog options, never presets
 		var sels = container.querySelectorAll('select[name^="MP"],select[name^="ML"],select[name^="MD"]');
 		for (var sel of sels) {
-			rPS(sel, presetOpts, "data-preset");
+			var bb = sel.closest ? sel.closest(".bb") : null;
+			var t = bb ? parseInt(bb.getAttribute("data-btype")||"0",10) : 0;
+			rPS(sel, isAnalogBtn(t) ? analogOpts : presetOpts, "data-preset");
 		}
 	}
 	function Wd()
@@ -246,33 +271,73 @@
 		if (d.Sf.LTR.value==="S") { d.Sf.LT.value = -1*parseFloat(d.Sf.LT.value); }
 		if (d.Sf.LNR.value==="W") { d.Sf.LN.value = -1*parseFloat(d.Sf.LN.value); }
 	}
-	function addRow(i,p,l,d) {
+	function addRow(i,p,l,d,t) {
+		if (t===undefined) t = 0;
 		var b = String.fromCharCode((i<10?48:55)+i);
-		var presetOpts = '<option value="0">Default Action</option>' + sortedPresetOptions;
+		var presetOpts = '<option value="0">Default Action (0)</option>' + sortedPresetOptions;
+		var typeName = btnTypeName(t);
 		var buttonBlock = document.createElement('div');
 		buttonBlock.className = 'bb';
-		buttonBlock.innerHTML = `
-			<div class="bh">Button ${i}</div>
-			<div class="bs">
-				<div class="ba">
-					<label>Push/Switch</label>
-					<select name="MP${b}" class="s" required>${presetOpts}</select>
+		buttonBlock.setAttribute('data-btype', t); // read back by rBPO() to rebuild selects correctly
+		if (isAnalogBtn(t)) {
+			// analog buttons: MD holds the function/segment; short/long press are unused (firmware defaults missing MP/ML to 0)
+			buttonBlock.innerHTML = `
+				<div class="bh">Analog ${i} - ${typeName}</div>
+				<div class="bs">
+					<div class="ba">
+						<label>Analog function</label>
+						<select name="MD${b}" class="s" required>${bAO()}</select>
+					</div>
 				</div>
-				<div class="ba">
-					<label>Short (on→off)</label>
-					<select name="ML${b}" class="s" required>${presetOpts}</select>
+				<hr style="width:100%;margin:8px 0 0 0;">
+			`;
+			sPSV(buttonBlock.querySelector('select[name="MD'+b+'"]'), String(d), "data-preset");
+		} else if (isSwitchBtn(t)) {
+			// switches: MP fires on On->Off, ML on Off->On; double press (MD) is unused (firmware defaults missing MD to 0)
+			buttonBlock.innerHTML = `
+				<div class="bh">Switch ${i} - ${typeName}</div>
+				<div class="bs">
+					<div class="ba">
+						<label>On → Off</label>
+						<select name="MP${b}" class="s" required>${presetOpts}</select>
+					</div>
+					<div class="ba">
+						<label>Off → On</label>
+						<select name="ML${b}" class="s" required>${presetOpts}</select>
+					</div>
 				</div>
-				<div class="ba">
-					<label>Long (off→on)</label>
-					<select name="MD${b}" class="s" required>${presetOpts}</select>
+				<hr style="width:100%;margin:8px 0 0 0;">
+			`;
+			var switchSels = buttonBlock.querySelectorAll("select");
+			var switchVals = [String(p), String(l)];
+			for (var si=0; si<switchSels.length; si++) {
+				sPSV(switchSels[si], switchVals[si], "data-preset");
+			}
+		} else {
+			// pushbuttons: short (MP), long (ML) and double (MD) press
+			buttonBlock.innerHTML = `
+				<div class="bh">Button ${i} - ${typeName}</div>
+				<div class="bs">
+					<div class="ba">
+						<label>Short press</label>
+						<select name="MP${b}" class="s" required>${presetOpts}</select>
+					</div>
+					<div class="ba">
+						<label>Long press</label>
+						<select name="ML${b}" class="s" required>${presetOpts}</select>
+					</div>
+					<div class="ba">
+						<label>Double press</label>
+						<select name="MD${b}" class="s" required>${presetOpts}</select>
+					</div>
 				</div>
-			</div>
-			<hr style="width:100%;margin:8px 0 0 0;">
-		`;
-		var buttonSels = buttonBlock.querySelectorAll("select");
-		var buttonVals = [String(p), String(l), String(d)];
-		for (var si=0; si<buttonSels.length; si++) {
-			sPSV(buttonSels[si], buttonVals[si], "data-preset");
+				<hr style="width:100%;margin:8px 0 0 0;">
+			`;
+			var buttonSels = buttonBlock.querySelectorAll("select");
+			var buttonVals = [String(p), String(l), String(d)];
+			for (var si=0; si<buttonSels.length; si++) {
+				sPSV(buttonSels[si], buttonVals[si], "data-preset");
+			}
 		}
 		gId("macros").appendChild(buttonBlock);
 	}
@@ -47,6 +47,7 @@
 				d.rsvd = [];
 				d.ro_gpio = [];
 				d.extra = [];
+				d.a_pins = []; // analog pins array
 			}, ()=>{
 				if (d.um_p[0]==-1) d.um_p.shift();	// remove filler
 				d.Sf.SDA.max = d.Sf.SCL.max = d.Sf.MOSI.max = d.Sf.SCLK.max = d.Sf.MISO.max = d.max_gpio;
@@ -194,7 +195,11 @@
 			um += ":"+fld;
 		} else if (typeof(fld) === "number") sel.classList.add("pin"); // a hack to add a class
 		let arr = d.getElementsByName(um);
-		let idx = arr[0].type==="hidden"?1:0; // ignore hidden field
+		if (!arr || arr.length === 0) {
+			console.log("addDD: No elements found for name:", um);
+			return null; // no elements found
+		}
+		let idx = (arr[0] && arr[0].type==="hidden")?1:0; // ignore hidden field
 		if (arr.length > 1+idx) {
 			// we have array of values (usually pins)
 			for (let i of arr) {
@@ -256,6 +261,98 @@
 		e.preventDefault();
 		if (d.Sf.checkValidity()) d.Sf.submit(); //https://stackoverflow.com/q/37323914
 	}
+
+	// TODO: rename this function, needs to be in sync with the now out of tree mod
+	function aOpt(name,el) {
+		let obj = d.getElementsByName(name);
+		if (!obj || obj.length === 0) return; // No elements found
+
+		var select = obj;
+		if (obj[el]) select = obj[el];
+
+		// Check if it's actually a select element with options
+		if (!select.options || !select.options.length) return;
+
+		for (let i=0; i<select.options.length; i++) {
+			let c = select.options[i];
+			let found = false;
+			for (let jj=0; jj<d.a_pins.length; jj++) if (d.a_pins[jj] == c.value) found = true; //value -1 or analog pins
+			if (c.value != -1 && !found) {
+				select.removeChild(c);
+				i--; //decrease i by one because the index has been adjusted
+			}
+			//https://www.javascripttutorial.net/javascript-dom/javascript-add-remove-options/
+			//https://www.javascripttutorial.net/javascript-dom/javascript-remove-items-from-a-select-conditionally/
+		}
+	}
+	function rOpt(name,el,txt,val) {
+		let obj = d.getElementsByName(name);
+		if (!obj || obj.length === 0) return; // No elements found
+		var select = obj;
+		if (obj[el]) select = obj[el];
+
+		// Check if element has childNodes
+		if (!select.childNodes || !select.childNodes.length) return;
+
+		for (let i=0; i<select.childNodes.length; i++) {
+			let c = select.childNodes[i];
+			if (c.value == val) c.text = txt;
+		}
+	}
+	function xOpt(name,el,txt,val) {
+		let obj = d.getElementsByName(name);
+		if (!obj || obj.length === 0) return; // No elements found
+		var select = obj;
+		if (obj[el]) select = obj[el];
+
+		// Check if element has childNodes
+		if (!select.childNodes || !select.childNodes.length) return;
+
+		for (let i=0; i<select.childNodes.length; i++) {
+			let c = select.childNodes[i];
+			if (c.value == val) c.text += txt;
+		}
+	}
+	function dOpt(name,el,valFrom,valTo) {
+		let obj = d.getElementsByName(name);
+		if (!obj || obj.length === 0) return; // No elements found
+		var select = obj;
+		if (obj[el]) select = obj[el];
+
+		// Check if it's actually a select element with options
+		if (!select.options || !select.options.length) return;
+
+		for (let i=0; i<select.options.length; i++) {
+			let c = select.options[i];
+			if (c.value >= valFrom && c.value <= valTo) {
+				select.removeChild(c);
+				i--; //decrease i by one because the index has been adjusted
+			}
+			//https://www.javascripttutorial.net/javascript-dom/javascript-add-remove-options/
+			//https://www.javascripttutorial.net/javascript-dom/javascript-remove-items-from-a-select-conditionally/
+		}
+	}
+	function dRO(name,el) {
+		// Initialize d.ro_gpio if not already set
+		if (!d.ro_gpio) d.ro_gpio = [];
+
+		let obj = d.getElementsByName(name);
+		if (!obj || obj.length === 0) return; // No elements found
+
+		var select = obj;
+		if (obj[el]) select = obj[el];
+
+		// Check if it's actually a select element with options
+		if (!select.options || !select.options.length) return;
+
+		// console.log("dRO", name, el, obj, "s", select, d.ro_gpio);
+		for (let i=0; i<select.options.length; i++) {
+			let c = select.options[i];
+			// console.log("dRO option", c, c.value, d.ro_gpio.includes(c.value));
+			for (let j=0; j<d.ro_gpio.length; j++) if (d.ro_gpio[j] == c.value) c.disabled=true; //if (d.ro_gpio.includes(c.value))
+		}
+	}
+
 	</script>
 </head>

@@ -151,9 +151,9 @@
 		<input type='checkbox' onchange="sV.value=checked?1:''" id="skipValidation">
 		<label for='skipValidation'>Ignore firmware validation</label><br>
 		<button type="submit">Upload</button><br>
-		<span id="rev">
+		<span>
 			<hr class="sml">
-			<button type="button" onclick="cR()">Revert update</button><br>
+			<button id="rev" type="button" onclick="cR()">Revert update</button><br>
 		</span>
 	</div>
 	</form>
@@ -5,7 +5,7 @@
 #define MAX_CHANNELS_PER_UNIVERSE 512

 // forward declarations
-static void handleDDPPacket(e131_packet_t* p);
+static void handleDDPPacket(e131_packet_t* p, size_t packetLen);
 static void handleArtnetPollReply(IPAddress ipAddress);
 static void prepareArtnetPollReply(ArtPollReply *reply);
 static void sendArtnetPollReply(ArtPollReply *reply, IPAddress ipAddress, uint16_t portAddress);
@@ -17,20 +17,31 @@ static void sendArtnetPollReply(ArtPollReply *reply, IPAddress ipAddress, uint16

 //DDP protocol support, called by handleE131Packet
 //handles RGB data only
-static void handleDDPPacket(e131_packet_t* p) {
+static void handleDDPPacket(e131_packet_t* p, size_t packetLen) {
  static bool ddpSeenPush = false;  // have we seen a push yet?
  int lastPushSeq = e131LastSequenceNumber[0];

+  if (packetLen < DDP_HEADER_LEN) return; // too short to safely read any DDP header fields
+
  // reject unsupported color data types (only RGB and RGBW are supported)
-  uint8_t maskedType = p->dataType & 0x3F; // mask out custom and reserved flags, only type bits are relevant
-  if (maskedType != DDP_TYPE_RGB24 && maskedType != DDP_TYPE_RGBW32) return;
+  //uint8_t maskedType = p->dataType & 0x3F; // mask out custom and reserved flags, only type bits are relevant
+  //if (maskedType != DDP_TYPE_RGB24 && maskedType != DDP_TYPE_RGBW32) return;

-  // reject status and config packets (not implemented)
-  if (p->destination == DDP_ID_STATUS || p->destination == DDP_ID_CONFIG) return;
+  // note: for maximum compatibility we do not reject unknonw or malformed data types but simply default to RGB24 and check there is enough data available in the packet to do so
+  //       also we assume 8bit per channel and currently do not support other bit depths

-  //reject late packets belonging to previous frame (assuming 4 packets max. before push)
+  // reject control, status and config packets (not implemented)
+  if (p->destination == DDP_ID_CONTROL || p->destination == DDP_ID_STATUS || p->destination == DDP_ID_CONFIG) return;
+
+  // reject query and response packets (not implemented)
+  if (p->flags & (DDP_FLAGS_QUERY | DDP_FLAGS_REPLY)) return;
+
+  bool push = p->flags & DDP_FLAGS_PUSH; // push flag means "render now"
+  if (!push && (p->flags & DDP_FLAGS_STORAGE)) return; // reject "from storage" flag but still let the push flag pass if set along with it
+
+  //reject late packets belonging to previous frame (assuming 4 packets max. before push, if more are used and packets are very late, they are still accepted)
  if (e131SkipOutOfSequence && lastPushSeq) {
-    int sn = p->sequenceNum & 0xF;
+    int sn = p->sequenceNum & 0xF; // sequence number is 4 bits, 1-15, 0 means unused
    if (sn) {
      if (lastPushSeq > 5) {
        if (sn > (lastPushSeq -5) && sn < lastPushSeq) return;
@@ -40,7 +51,8 @@ static void handleDDPPacket(e131_packet_t* p) {
    }
  }

-  unsigned ddpChannelsPerLed = ((p->dataType & 0b00111000)>>3 == 0b011) ? 4 : 3; // data type 0x1B (formerly 0x1A) is RGBW (type 3, 8 bit/channel)
+  unsigned ddpChannelsPerLed = 3; // default to RGB
+  if ((p->dataType & 0b00111000)>>3 == 0b011) ddpChannelsPerLed = 4; // RGBW data type (see DDP protocol definition)

  uint32_t start =  htonl(p->channelOffset) / ddpChannelsPerLed;
  start += DMXAddress / ddpChannelsPerLed;
@@ -50,8 +62,14 @@ static void handleDDPPacket(e131_packet_t* p) {
  unsigned c = 0;
  if (p->flags & DDP_FLAGS_TIME) c = 4; //packet has timecode flag, we do not support it, but data starts 4 bytes later

+  // ensure the received packet is at least as long as the header claims
+  if (packetLen < DDP_HEADER_LEN + c + dataLen) {
+    DEBUG_PRINTLN(F("DDP packet incomplete"));
+    return;
+  }
+
  unsigned numLeds = stop - start; // stop >= start is guaranteed
-  unsigned maxDataIndex = c + numLeds * ddpChannelsPerLed; // validate bounds before accessing data array
+  unsigned maxDataIndex = numLeds * ddpChannelsPerLed; // validate bounds before accessing data array
  if (maxDataIndex > dataLen) {
    DEBUG_PRINTLN(F("DDP packet data bounds exceeded, rejecting."));
    return;
@@ -66,7 +84,6 @@ static void handleDDPPacket(e131_packet_t* p) {
    }
  }

-  bool push = p->flags & DDP_FLAGS_PUSH;
  ddpSeenPush |= push;
  if (!ddpSeenPush || push) { // if we've never seen a push, or this is one, render display
    e131NewData = true;
@@ -76,7 +93,7 @@ static void handleDDPPacket(e131_packet_t* p) {
 }

 //E1.31 and Art-Net protocol support
-void handleE131Packet(e131_packet_t* p, IPAddress clientIP, byte protocol){
+void handleE131Packet(e131_packet_t* p, IPAddress clientIP, byte protocol, size_t packetLen){

  int uni = 0, dmxChannels = 0;
  uint8_t* e131_data = nullptr;
@@ -84,24 +101,33 @@ void handleE131Packet(e131_packet_t* p, IPAddress clientIP, byte protocol){

  if (protocol == P_ARTNET)
  {
+    if (packetLen < 10) return; // need at least art_opcode (offset 8, 2 bytes)
    if (p->art_opcode == ARTNET_OPCODE_OPPOLL) {
      handleArtnetPollReply(clientIP);
      return;
    }
+    if (packetLen < 18) return; // need art_length (offset 16, 2 bytes) for DMX data
    uni = p->art_universe;
    dmxChannels = htons(p->art_length);
+    const int artNetMaxData = (packetLen >= 18) ? (int)(packetLen - 18) : 0; // art_data at offset 18; clamp so e131_data[dmxChannels] stays in bounds
+    if (dmxChannels > artNetMaxData) dmxChannels = artNetMaxData;
+    if (dmxChannels > MAX_CHANNELS_PER_UNIVERSE) dmxChannels = MAX_CHANNELS_PER_UNIVERSE;
    e131_data = p->art_data;
    seq = p->art_sequence_number;
    mde = REALTIME_MODE_ARTNET;
  } else if (protocol == P_E131) {
+    if (packetLen < 126) return; // need up to property_values[0] (offset 125) and property_value_count (offset 123)
    // Ignore PREVIEW data (E1.31: 6.2.6)
    if ((p->options & 0x80) != 0) return;
-    dmxChannels = htons(p->property_value_count) - 1;
+    dmxChannels = htons(p->property_value_count) - 1; // on malformed packets, this can become negative, checked below
    // DMX level data is zero start code. Ignore everything else. (E1.11: 8.5)
-    if (dmxChannels == 0 || p->property_values[0] != 0) return;
+    if (dmxChannels <= 0 || p->property_values[0] != 0) return;
    uni = htons(p->universe);
    e131_data = p->property_values;
    seq = p->sequence_number;
+    const int e131MaxData = (packetLen > 126) ? (int)(packetLen - 126) : 0; // property_values at offset 125; clamp so e131_data[dmxChannels] stays in bounds
+    if (dmxChannels > e131MaxData) dmxChannels = e131MaxData;
+    if (dmxChannels > MAX_CHANNELS_PER_UNIVERSE) dmxChannels = MAX_CHANNELS_PER_UNIVERSE;
    if (e131Priority != 0) {
      if (p->priority < e131Priority ) return;
      // track highest priority & skip all lower priorities
@@ -110,15 +136,17 @@ void handleE131Packet(e131_packet_t* p, IPAddress clientIP, byte protocol){
    }
  } else { //DDP
    realtimeIP = clientIP;
-    handleDDPPacket(p);
+    handleDDPPacket(p, packetLen);
    return;
  }

  #ifdef WLED_ENABLE_DMX
  // does not act on out-of-order packets yet
  if (e131ProxyUniverse > 0 && uni == e131ProxyUniverse) {
+    // Art-Net: art_data is 0-indexed (channel 1 at index 0)
+    // E1.31: property_values[0] is start code, (channel 1 at index 1)
    for (uint16_t i = 1; i <= dmxChannels; i++)
-      dmx.write(i, e131_data[i]);
+      dmx.write(i, mde == REALTIME_MODE_ARTNET ? e131_data[i-1] : e131_data[i]);
    dmx.update();
  }
  #endif
@@ -100,7 +100,7 @@ void initDMXInput();
 void handleDMXInput();

 //e131.cpp
-void handleE131Packet(e131_packet_t* p, IPAddress clientIP, byte protocol);
+void handleE131Packet(e131_packet_t* p, IPAddress clientIP, byte protocol, size_t packetLen);
 void handleDMXData(uint16_t uni, uint16_t dmxChannels, uint8_t* e131_data, uint8_t mde, uint8_t previousUniverses);
 // void handleArtnetPollReply(IPAddress ipAddress);                                          // local function, only used in e131.cpp
 // void prepareArtnetPollReply(ArtPollReply* reply);                                         // local function, only used in e131.cpp
@@ -524,10 +524,10 @@ inline size_t getFreeHeapSize() { return ESP.getFreeHeap(); } // returns free he
 inline size_t getContiguousFreeHeap() { return ESP.getMaxFreeBlockSize(); } // returns largest contiguous free block
 #endif
 #define BFRALLOC_NOBYTEACCESS    (1 << 0) // ESP32 has 32bit accessible DRAM (usually ~50kB free) that must not be byte-accessed
-#define BFRALLOC_PREFER_DRAM     (1 << 1) // prefer DRAM over PSRAM
-#define BFRALLOC_ENFORCE_DRAM    (1 << 2) // use DRAM only, no PSRAM
-#define BFRALLOC_PREFER_PSRAM    (1 << 3) // prefer PSRAM over DRAM
-#define BFRALLOC_ENFORCE_PSRAM   (1 << 4) // use PSRAM if available, otherwise uses DRAM
+#define BFRALLOC_PREFER_DRAM     (1 << 1) // prefer DRAM over PSRAM (can still use PSRAM for larger allocations if DRAM is starting to run low)
+#define BFRALLOC_ENFORCE_DRAM    (1 << 2) // use DRAM only, no PSRAM allowed
+#define BFRALLOC_PREFER_PSRAM    (1 << 3) // prefer PSRAM over DRAM (can still use DRAM if there is loads of free DRAM to optimize speed)
+#define BFRALLOC_ENFORCE_PSRAM   (1 << 4) // use PSRAM if available, falls back to DRAM if PSRAM fails
 #define BFRALLOC_CLEAR           (1 << 5) // clear allocated buffer after allocation
 void *allocate_buffer(size_t size, uint32_t type);

@@ -30,7 +30,7 @@ int fileReadCallback(void) {
 int fileReadBlockCallback(void * buffer, int numberOfBytes) {
  #ifdef CONFIG_IDF_TARGET_ESP32C3
  unsigned t0 = millis();
-  while (strip.isUpdating() && (millis() - t0 < 15)) yield(); // be nice, but not too nice. Waits up to 15ms to avoid glitches
+  while (strip.isUpdating() && (millis() - t0 < 150)) yield(); // be nice, but not too nice. Waits up to 150ms to avoid glitches
  #endif
  return file.read((uint8_t*)buffer, numberOfBytes);
 }
@@ -116,8 +116,8 @@ void handleImprovPacket() {
            return;
          }
        } else if (packetByte > 9) { //RPC data
-          rpcData[packetByte - 10] = next;
          if (packetByte > 137) return; //prevent buffer overflow
+          rpcData[packetByte - 10] = next;
        }
      }
    }
@@ -238,8 +238,8 @@ void handleImprovWifiScan() {
    bool isOpen = WiFi.encryptionType(i) == WIFI_AUTH_OPEN;
    #endif

-    char ssidStr[33];
-    strcpy(ssidStr, WiFi.SSID(i).c_str());
+    char ssidStr[33] = {'\0'};
+    strlcpy(ssidStr, WiFi.SSID(i).c_str(), sizeof(ssidStr));
    const char *str[3] = {ssidStr, rssiStr, isOpen ? "NO":"YES"};
    sendImprovRPCResult(ImprovRPCType::Request_Scan, 3, str);
  }
@@ -258,14 +258,13 @@ static void parseWiFiCommand(char* rpcData) {

  unsigned ssidLen = rpcData[1];
  if (ssidLen > len -1 || ssidLen > 32) return;
-  memset(multiWiFi[0].clientSSID, 0, 32);
+  memset(multiWiFi[0].clientSSID, 0, sizeof(multiWiFi[0].clientSSID));
  memcpy(multiWiFi[0].clientSSID, rpcData+2, ssidLen);

-  memset(multiWiFi[0].clientPass, 0, 64);
+  memset(multiWiFi[0].clientPass, 0, sizeof(multiWiFi[0].clientPass));
  if (len > ssidLen +1) {
    unsigned passLen = rpcData[2+ssidLen];
-    memset(multiWiFi[0].clientPass, 0, 64);
-    memcpy(multiWiFi[0].clientPass, rpcData+3+ssidLen, passLen);
+    memcpy(multiWiFi[0].clientPass, rpcData+3+ssidLen, min(size_t(passLen), sizeof(multiWiFi[0].clientPass)));
  }

  sendImprovStateResponse(0x03); //provisioning
@@ -520,7 +520,9 @@ bool deserializeState(JsonObject root, byte callMode, byte presetId)
    if (root["win"].isNull() && getVal(root["ps"], presetCycCurr, 1, 250) && presetCycCurr > 0 && presetCycCurr < 251 && presetCycCurr != currentPreset) {
      DEBUG_PRINTF_P(PSTR("Preset select: %d\n"), presetCycCurr);
      // b) preset ID only or preset that does not change state (use embedded cycling limits if they exist in getVal())
-      applyPreset(presetCycCurr, callMode); // async load from file system (only preset ID was specified)
+      // async load from file system (only preset ID was specified)
+      // avoid propogating CALL_MODE_INIT, which may cause accidental recursion
+      applyPreset(presetCycCurr, callMode == CALL_MODE_INIT ? CALL_MODE_DIRECT_CHANGE : callMode);
      return stateResponse;
    } else presetCycCurr = currentPreset; // restore presetCycCurr
  }
@@ -87,7 +87,7 @@ const ethernet_settings ethernetBoards[] = {

  // ESP32-ETHERNET-KIT-VE
  {
-    0,                    // eth_address,
+    1,                    // eth_address,
    5,                    // eth_power,
    23,                   // eth_mdc,
    18,                   // eth_mdio,
@@ -448,10 +448,26 @@ void WiFiEvent(WiFiEvent_t event)
      }
      break;
  #ifdef ARDUINO_ARCH_ESP32
+    case ARDUINO_EVENT_WIFI_READY:
+      DEBUG_PRINTLN(F("WiFi-E: driver ready."));
+      break;
    case ARDUINO_EVENT_WIFI_SCAN_DONE:
      // also triggered when connected to selected SSID
      DEBUG_PRINTLN(F("WiFi-E: SSID scan completed."));
      break;
+    case ARDUINO_EVENT_WIFI_STA_START:
+      DEBUG_PRINTLN(F("WiFi-E: STA Started"));
+      break;
+    case ARDUINO_EVENT_WIFI_STA_STOP:
+      DEBUG_PRINTLN(F("WiFi-E: STA Stopped"));
+      break;
+    case ARDUINO_EVENT_WIFI_STA_AUTHMODE_CHANGE:
+      DEBUG_PRINTLN(F("WiFi-E: STA authentication mode change."));
+      break;
+    case ARDUINO_EVENT_WIFI_STA_LOST_IP:
+      DEBUG_PRINTLN(F("WiFi-E: IP address lost."));
+      break;
+
    case ARDUINO_EVENT_WIFI_AP_START:
      DEBUG_PRINTLN(F("WiFi-E: AP Started"));
      break;
@@ -194,8 +194,8 @@ void handlePresets()
    changePreset = true;
  } else {
    if (!fdo["seg"].isNull() || !fdo["on"].isNull() || !fdo["bri"].isNull() || !fdo["nl"].isNull() || !fdo["ps"].isNull() || !fdo[F("playlist")].isNull()) changePreset = true;
-    if (!(tmpMode == CALL_MODE_BUTTON_PRESET && fdo["ps"].is<const char *>() && strchr(fdo["ps"].as<const char *>(),'~') != strrchr(fdo["ps"].as<const char *>(),'~')))
-      fdo.remove("ps"); // remove load request for presets to prevent recursive crash (if not called by button and contains preset cycling string "1~5~")
+    if (!(tmpMode == CALL_MODE_INIT || (tmpMode == CALL_MODE_BUTTON_PRESET && fdo["ps"].is<const char *>() && strchr(fdo["ps"].as<const char *>(),'~') != strrchr(fdo["ps"].as<const char *>(),'~'))))
+      fdo.remove("ps"); // remove load request for presets to prevent recursive crash (if not called by boot preset or button which contains preset cycling string "1~5~")
    deserializeState(fdo, CALL_MODE_NO_NOTIFY, tmpPreset); // may change presetToApply by calling applyPreset()
  }
  if (!errorFlag && tmpPreset < 255 && changePreset) currentPreset = tmpPreset;
@@ -21,10 +21,10 @@
 #include "../network/Network.h"
 #include <string.h>

-// E1.17 ACN Packet Identifier
+// E1.17 ACN Packet Identifier "ASC-E1.17"
 const byte ESPAsyncE131::ACN_ID[12] = { 0x41, 0x53, 0x43, 0x2d, 0x45, 0x31, 0x2e, 0x31, 0x37, 0x00, 0x00, 0x00 };

-// Art-Net Packet Identifier
+// Art-Net Packet Identifier "Art-Net"
 const byte ESPAsyncE131::ART_ID[8]  = { 0x41, 0x72, 0x74, 0x2d, 0x4e, 0x65, 0x74, 0x00 };

 // Constructor
@@ -99,36 +99,43 @@ bool ESPAsyncE131::initMulticast(uint16_t port, uint16_t universe, uint8_t n) {

 void ESPAsyncE131::parsePacket(AsyncUDPPacket _packet) {
  bool error = false;
-  uint8_t protocol = P_E131;
+  uint8_t protocol = P_ARTNET;
+  const size_t pktLen = _packet.length();

  e131_packet_t *sbuff = reinterpret_cast<e131_packet_t *>(_packet.data());
-	
-	//E1.31 packet identifier ("ACS-E1.17")
-  if (memcmp(sbuff->acn_id, ESPAsyncE131::ACN_ID, sizeof(sbuff->acn_id)))
-    protocol = P_ARTNET;
-	
-	if (protocol == P_ARTNET) {
-		if (memcmp(sbuff->art_id, ESPAsyncE131::ART_ID, sizeof(sbuff->art_id)))
-			error = true; //not "Art-Net"
-		if (sbuff->art_opcode != ARTNET_OPCODE_OPDMX && sbuff->art_opcode != ARTNET_OPCODE_OPPOLL)
-			error = true; //not a DMX or poll packet
-	} else { //E1.31 error handling
-		if (htonl(sbuff->root_vector) != ESPAsyncE131::VECTOR_ROOT)
-			error = true;
-		if (htonl(sbuff->frame_vector) != ESPAsyncE131::VECTOR_FRAME)
-			error = true;
-		if (sbuff->dmp_vector != ESPAsyncE131::VECTOR_DMP)
-			error = true;
-		if (sbuff->property_values[0] != 0)
-			error = true;
-	} 
-  
+
+  // E1.31 packet identifier (ACN_ID = "ASC-E1.17"), need at least 16 bytes to safely read acn_id (offset 4, length 12).
+  if (pktLen >= 16) {
+    if (!memcmp(sbuff->acn_id, ESPAsyncE131::ACN_ID, sizeof(sbuff->acn_id)))
+      protocol = P_E131;
+  }
+
+  if (protocol == P_ARTNET) {
+    if (memcmp(sbuff->art_id, ESPAsyncE131::ART_ID, sizeof(sbuff->art_id)))
+      error = true; //not ART_ID = "Art-Net"
+    if (sbuff->art_opcode != ARTNET_OPCODE_OPDMX && sbuff->art_opcode != ARTNET_OPCODE_OPPOLL)
+      error = true; //not a DMX or poll packet
+  } else { //E1.31 error handling
+    if (pktLen < 126) { // need up to property_values[0] at offset 125
+      error = true;
+    } else {
+      if (htonl(sbuff->root_vector) != ESPAsyncE131::VECTOR_ROOT)
+        error = true;
+      if (htonl(sbuff->frame_vector) != ESPAsyncE131::VECTOR_FRAME)
+        error = true;
+      if (sbuff->dmp_vector != ESPAsyncE131::VECTOR_DMP)
+        error = true;
+      if (sbuff->property_values[0] != 0)
+        error = true;
+    }
+  }
+
  if (error && _packet.localPort() == DDP_DEFAULT_PORT) { //DDP packet
    error = false;
    protocol = P_DDP;
  }

  if (!error) {
-    _callback(sbuff, _packet.remoteIP(), protocol);
+    _callback(sbuff, _packet.remoteIP(), protocol, pktLen);
  }
 }
@@ -55,19 +55,24 @@ typedef struct ip_addr ip4_addr_t;
 #define DDP_FLAGS_VER     0xc0    // version mask
 #define DDP_FLAGS_VER1    0x40    // version=1
 #define DDP_FLAGS_PUSH    0x01
-#define DDP_FLAGS_QUERY   0x02
-#define DDP_FLAGS_REPLY   0x04
-#define DDP_FLAGS_STORAGE 0x08
+#define DDP_FLAGS_QUERY   0x02    // unsupported - used by XLights for auto-discovery
+#define DDP_FLAGS_REPLY   0x04    // unsupported - response packet from another display
+#define DDP_FLAGS_STORAGE 0x08    // unsupported - show data from a storage unit instead of from packet data field. Data field defines storage unit (by name, number, URL or whatever mechanism wanted).
 #define DDP_FLAGS_TIME    0x10

 #define DDP_CHANNELS_PER_PACKET 1440 // 480 leds

 #define DDP_TYPE_RGB24  0x0B // 00 001 011 (RGB , 8 bits per channel, 3 channels)
 #define DDP_TYPE_RGBW32 0x1B // 00 011 011 (RGBW, 8 bits per channel, 4 channels)
+#define DDP_TYPE_LEGACY 0x01 // 00 000 001 legacy RGB 8bit definition
+#define DDP_TYPE_UNDEF  0x00 // type and bit depth undefined

-#define DDP_ID_DISPLAY  1
-#define DDP_ID_CONFIG   250
-#define DDP_ID_STATUS   251
+// DDP Source or Destination ID (header byte 3)
+#define DDP_ID_DISPLAY  1    // default output device
+#define DDP_ID_CONTROL  246  // JSON control (not implemented)
+#define DDP_ID_CONFIG   250  // JSON config (not implemented)
+#define DDP_ID_STATUS   251  // JSON status (not implemented)
+#define DDP_ID_ALL      255  // all devices

 #define ARTNET_OPCODE_OPDMX 0x5000
 #define ARTNET_OPCODE_OPPOLL 0x2000
@@ -212,7 +217,7 @@ typedef union {
 } ArtPollReply;

 // new packet callback
-typedef void (*e131_packet_callback_function) (e131_packet_t* p, IPAddress clientIP, byte protocol);
+typedef void (*e131_packet_callback_function) (e131_packet_t* p, IPAddress clientIP, byte protocol, size_t packetLen);

 class ESPAsyncE131 {
 private:
@@ -267,4 +272,4 @@ class E131Priority {
    }
 };

-#endif  // ESPASYNCE131_H_
+#endif  // ESPASYNCE131_H_
@@ -6,7 +6,7 @@

 #define UDP_SEG_SIZE 36
 #define SEG_OFFSET (41)
-#define WLEDPACKETSIZE (41+(WS2812FX::getMaxSegments()*UDP_SEG_SIZE)+0)
+static constexpr size_t WLEDPACKETSIZE = 41+(WS2812FX::getMaxSegments()*UDP_SEG_SIZE);  // make sure this is known at compile-time
 #define UDP_IN_MAXSIZE 1472
 #define PRESUMED_NETWORK_DELAY 3 //how many ms could it take on avg to reach the receiver? This will be added to transmitted times

@@ -268,6 +268,7 @@ static void parseNotifyPacket(const uint8_t *udpIn) {
    size_t inactiveSegs = 0;
    for (size_t i = 0; i < numSrcSegs && i < WS2812FX::getMaxSegments(); i++) {
      unsigned ofs = 41 + i*udpIn[40]; //start of segment offset byte
+      if (ofs + 36 > UDP_IN_MAXSIZE) break; // avoid reading outside of array
      unsigned id = udpIn[0 +ofs];
      DEBUG_PRINTF_P(PSTR("UDP segment received: %u\n"), id);
      if      (id >  strip.getSegmentsNum()) break;
@@ -499,7 +500,7 @@ void handleNotifications()
    packetSize = rgbUdp.parsePacket();
    if (packetSize) {
      if (!receiveDirect) return;
-      if (packetSize > UDP_IN_MAXSIZE || packetSize < 3) return;
+      if (packetSize > UDP_IN_MAXSIZE || packetSize < 3) return;  // packetSize must not exceed buffersize (UDP_IN_MAXSIZE)
      realtimeIP = rgbUdp.remoteIP();
      DEBUG_PRINTLN(rgbUdp.remoteIP());
      uint8_t lbuf[packetSize];
@@ -587,7 +588,9 @@ void handleNotifications()

      unsigned id = (tpmPayloadFrameSize/3)*(packetNum-1); //start LED
      unsigned totalLen = strip.getLengthTotal();
-      for (size_t i = 6; i < tpmPayloadFrameSize + 4U && id < totalLen; i += 3, id++) {
+      // Clamp to prevent buffer overread: loop accesses up to udpIn[tpmPayloadFrameSize + 5]
+      size_t currentPayloadFrameSize = (packetSize >= 5) ? min(tpmPayloadFrameSize, uint16_t(packetSize - 5)) : 0;
+      for (size_t i = 6; i < currentPayloadFrameSize + 4U && id < totalLen; i += 3, id++) {
        setRealtimePixel(id, udpIn[i], udpIn[i+1], udpIn[i+2], 0);
      }
      if (tpmPacketCount == numPackets) { //reset packet count and show if all packets were received
@@ -804,6 +807,7 @@ uint8_t realtimeBroadcast(uint8_t type, IPAddress client, uint16_t length, const

        // write the header
        /*0*/ddpUdp.write(flags);
+        // TODO: sequence number should be 1-15 as 0 means "unused", it has no bad consequences other than out of sequence packet may be accepted
        /*1*/ddpUdp.write(sequenceNumber++ & 0x0F); // sequence may be unnecessary unless we are sending twice (as requested in Sync settings)
        /*2*/ddpUdp.write(isRGBW ?  DDP_TYPE_RGBW32 : DDP_TYPE_RGB24);
        /*3*/ddpUdp.write(DDP_ID_DISPLAY);
@@ -8,6 +8,7 @@
 #else
 #include <Update.h>
 #if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(4, 4, 0)
+  #include "rom/rtc.h"      // for rtc_get_reset_reason()
  #include "esp32/rtc.h"    // for bootloop detection
 #elif ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(3, 3, 0)
  #include "soc/rtc.h"
@@ -920,7 +921,7 @@ void *allocate_buffer(size_t size, uint32_t type) {
      buffer = p_malloc(size); // prefer PSRAM
  }
  else if (type & BFRALLOC_ENFORCE_PSRAM)
-    buffer = heap_caps_malloc(size, MALLOC_CAP_SPIRAM | MALLOC_CAP_8BIT); // use PSRAM only, otherwise return nullptr
+    buffer = p_malloc(size); // use PSRAM if available, fall back to DRAM if not (safeguard for boards without PSRAM #5629)
  buffer = validateFreeHeap(buffer);
  #endif
  if (buffer && (type & BFRALLOC_CLEAR))
@@ -998,6 +999,11 @@ RTC_NOINIT_ATTR static uint32_t bl_crashcounter;
 RTC_NOINIT_ATTR static uint32_t bl_actiontracker;

 static inline ResetReason rebootReason() {
+  // check RTC restart reason first - brownout is not reliably reported by esp_reset_reason()
+  if (rtc_get_reset_reason(0) == RTCWDT_BROWN_OUT_RESET) return ResetReason::Brownout; // core0 brownout
+  #if SOC_CPU_CORES_NUM > 1
+  if (rtc_get_reset_reason(1) == RTCWDT_BROWN_OUT_RESET) return ResetReason::Brownout; // core1 brownout
+  #endif
  esp_reset_reason_t reason = esp_reset_reason();
  if (reason == ESP_RST_BROWNOUT) return ResetReason::Brownout;
  if (reason == ESP_RST_SW) return ResetReason::Software;
@@ -1032,6 +1038,7 @@ static bool detectBootLoop() {
    case ResetReason::Crash:
    {
      DEBUG_PRINTLN(F("crash detected!"));
+      errorFlag = ERR_SYS_REBOOT;
      uint32_t rebootinterval = rtctime - bl_last_boottime;
      if (rebootinterval < BOOTLOOP_INTERVAL_MILLIS) {
        bl_crashcounter++;
@@ -1052,6 +1059,7 @@ static bool detectBootLoop() {
    case ResetReason::Brownout:
      // crash due to brownout can't be detected unless using flash memory to store bootloop variables
      DEBUG_PRINTLN(F("brownout detected"));
+      errorFlag = ERR_SYS_BROWNOUT;
      //restoreConfig(); // TODO: blindly restoring config if brownout detected is a bad idea, need a better way (if at all)
      break;
  }
@@ -1296,6 +1304,9 @@ String computeSHA1(const String& input) {

 #ifdef ESP32
 #include "esp_adc_cal.h"
+#if ESP_IDF_VERSION < ESP_IDF_VERSION_VAL(4,4,7) // backwards compatibility patch
+  #define ADC_ATTEN_DB_12 ADC_ATTEN_DB_11
+#endif
 String generateDeviceFingerprint() {
  uint32_t fp[2] = {0, 0}; // create 64 bit fingerprint
  esp_chip_info_t chip_info;
@@ -178,7 +178,7 @@ void WLED::loop()
    // calling getContiguousFreeHeap() during led update causes glitches on C3
    // this can (probably) be removed once RMT driver for C3 is fixed
    unsigned t0 = millis();
-    while (strip.isUpdating() && (millis() - t0 < 15)) delay(1);    // be nice, but not too nice. Waits up to 15ms
+    while (strip.isUpdating() && (millis() - t0 < 150)) delay(1);    // be nice, but not too nice. Waits up to 150ms
    #endif
    uint32_t heap = getContiguousFreeHeap(); // ESP32 family needs ~10k of contiguous free heap for UI to work properly
    #endif
@@ -503,6 +503,12 @@ void WLED::setup()

  if (needsCfgSave) serializeConfigToFS(); // usermods required new parameters; need to wait for strip to be initialised #4752

+  if (bootPreset > 0) {
+    handlePresets();  // handle boot preset
+    handlePlaylist(); // handle playlist if preset queued one
+    handlePresets();  // handle presets again to give a chance for anything queued by the boot preset or playlist
+  }
+  
  if (strcmp(multiWiFi[0].clientSSID, DEFAULT_CLIENT_SSID) == 0 && !configBackupExists())
    showWelcomePage = true;

@@ -651,6 +657,7 @@ void WLED::initAP(bool resetAP)
  WiFi.softAPConfig(IPAddress(4, 3, 2, 1), IPAddress(4, 3, 2, 1), IPAddress(255, 255, 255, 0));
  WiFi.softAP(apSSID, apPass, apChannel, apHide);
  #ifdef ARDUINO_ARCH_ESP32
+  DEBUG_PRINT(F("access point maxTxPower set to ")); DEBUG_PRINTLN(txPower);
  WiFi.setTxPower(wifi_power_t(txPower));
  #endif

@@ -691,6 +698,7 @@ void WLED::initConnection()
  }
 #endif

+  DEBUG_PRINTLN(F("WiFi disconnect."));
  WiFi.disconnect(true); // close old connections
  delay(5);              // wait for hardware to be ready
 #ifdef ESP8266
@@ -703,6 +711,7 @@ void WLED::initConnection()
 #ifdef ARDUINO_ARCH_ESP32
  // Reset mode to NULL to force a full STA mode transition, so that WiFi.mode(WIFI_STA) below actually applies the hostname (and TX power, etc.).
  // This is required on reconnects when mode is already WIFI_STA.
+  DEBUG_PRINTLN(F("WiFi mode_null: driver teardown / re-init."));
  WiFi.mode(WIFI_MODE_NULL);
  apActive = false;           // the AP is physically torn down by WIFI_MODE_NULL
  delay(5);                   // give the WiFi stack time to complete the mode transition
@@ -786,9 +795,12 @@ void WLED::initConnection()
 #endif // WLED_ENABLE_WPA_ENTERPRISE

 #ifdef ARDUINO_ARCH_ESP32
+    DEBUG_PRINT(F("WiFi maxTxPower set to ")); DEBUG_PRINT(txPower);
+    DEBUG_PRINT(F("; WiFi sleep ")); DEBUG_PRINTLN(noWifiSleep ? F("disabled."):F("enabled."));
    WiFi.setTxPower(wifi_power_t(txPower));
    WiFi.setSleep(!noWifiSleep);
 #else // ESP8266 accepts a hostname set after WiFi interface initialization
+    DEBUG_PRINT(F("WiFi sleep ")); DEBUG_PRINTLN(noWifiSleep ? F("disabled."):F("enabled."));
    wifi_set_sleep_type((noWifiSleep) ? NONE_SLEEP_T : MODEM_SLEEP_T);
    WiFi.hostname(hostname);
 #endif
@@ -274,7 +274,7 @@ using PSRAMDynamicJsonDocument = BasicJsonDocument<PSRAM_Allocator>;
 #define STRINGIFY(X) #X
 #define TOSTRING(X) STRINGIFY(X)

-#define WLED_CODENAME "Niji"
+#define WLED_CODENAME "Kagayaki"

 // AP and OTA default passwords (for maximum security change them!)
 WLED_GLOBAL char apPass[65]  _INIT(WLED_AP_PASS);
@@ -87,19 +87,13 @@ void wsEvent(AsyncWebSocket * server, AsyncWebSocketClient * client, AwsEventTyp
        if (!data || len < offset+1) return; // catch invalid / single-byte payload
        switch (data[0]) {
          case BINARY_PROTOCOL_E131:
-            handleE131Packet((e131_packet_t*)&data[offset], client->remoteIP(), P_E131);
+            handleE131Packet((e131_packet_t*)&data[offset], client->remoteIP(), P_E131, len - offset);
            break;
          case BINARY_PROTOCOL_ARTNET:
-            handleE131Packet((e131_packet_t*)&data[offset], client->remoteIP(), P_ARTNET);
+            handleE131Packet((e131_packet_t*)&data[offset], client->remoteIP(), P_ARTNET, len - offset);
            break;
          case BINARY_PROTOCOL_DDP:
-            if (len < 10 + offset) return; // DDP header is 10 bytes (+1 protocol byte)
-            size_t ddpDataLen = (data[8+offset] << 8) | data[9+offset]; // data length in bytes from DDP header
-            uint8_t flags = data[0+offset];
-            if ((flags & DDP_FLAGS_TIME) ) ddpDataLen += 4; // timecode flag adds 4 bytes to data length
-            if (len < (10 + offset + ddpDataLen)) return; // not enough data, prevent out of bounds read
-            // could be a valid DDP packet, forward to handler
-            handleE131Packet((e131_packet_t*)&data[offset], client->remoteIP(), P_DDP);
+            handleE131Packet((e131_packet_t*)&data[offset], client->remoteIP(), P_DDP, len - offset);
        }
      }
    } else {
@@ -628,7 +628,7 @@ void getSettingsJS(byte subPage, Print& settingsScript)
    printSetFormValue(settingsScript,PSTR("MN"),macroNl);
    int ii = 0;
    for (const auto &button : buttons) {
-      settingsScript.printf_P(PSTR("addRow(%d,%d,%d,%d);"), ii++, button.macroButton, button.macroLongPress, button.macroDoublePress);
+      settingsScript.printf_P(PSTR("addRow(%d,%d,%d,%d,%d);"), ii++, button.macroButton, button.macroLongPress, button.macroDoublePress, button.type);
    }

    settingsScript.printf_P(PSTR("maxTimers=%d;"), WLED_MAX_TIMERS);