Release v0.3.0

Added

• IoT Client — OTA firmware upgrade support(#3).
  • iot_ota_report_version — reports the device's current firmware version
    (auto-called during iot_client_init from iot_client_config_t.sw_ver, so
    the cloud can evaluate upgrades against the running version).
  • iot_ota_check_upgrade — queries the cloud for a pending upgrade and
    returns version, download URL (cdnUrl preferred, httpsUrl fallback),
    file size, and MD5/HMAC hashes. Takes no sw_ver argument — the cloud
    compares against the version already reported at init.
  • iot_ota_report_status — drives the upgrade lifecycle
    (UPGRADING → FINI / EXEC / ABORT).
• RTC TCP Client (tuya_ai) — received images delivered via on_image callback(#6).
  • New tai_image_msg_t + on_image callback (message-struct API); format/width/height parsed from image-params on START/ONE_SHOT.
  • TAI_PKT_IMAGE now handled in tai_proto_dispatch (was dropped as unknown) — strips the 8-byte media header and emits each chunk for the caller to reassemble START..END / ONE_SHOT.

Changed

• PAL / common — TCP connect timeout(#1).
  • tcp_connect takes a timeout_ms, bounded by select() (0 = single non-blocking attempt).
  • Threaded through all call sites (ai-tcp, HTTP, MQTT's new MQTT_CONNECT_TIMEOUT_MS).
  • tls_config_t's two timeouts collapse into connect_timeout_ms — one deadline for TCP connect + TLS handshake (removes handshake_timeout_ms).
• common / TLS — ESP-IDF cert-bundle decoupled via callback(#2).
• iot-client / common — memory-management pass(#4).
  • iot_client_t inlines https_url/mqtt_url as char[64] and the DP context as inline storage (were strdup / lazy malloc), _Static_assert-guarded.
  • Per-op allocations removed: stacked atop sign buffer + MQTT subscribe/publish topics; HTTP request-header and response share one allocation; DP report/state returns the cJSON string directly; tai_pkt_log formats into a stack buffer.
  • mbedTLS global config (allocator, record sizes) left to the integrator — removed the SDK-side MBEDTLS_USER_CONFIG_FILE wiring, ownership documented in common/tls.h.
• RTC TCP Client (tuya_ai) — protocol-layer redesign.
  • Receive callbacks are now struct-based (ABI break).
  • Downstream audio-params re-read per stream.
  • Scatter-gather streaming send.
  • Smaller receive buffers via a smaller max fragment.

Fixed

• RTC TCP Client (tuya_ai) — protocol-layer redesign.
  • tai_disconnect holds the send lock across the transport close (fixes a use-after-free).
  • Unknown downstream Packet/Event types are tolerated (logged + skipped); malformed packets stay fail-fast.
  • Oversized inbound frame is fail-fast (TAI_PROTO_ERR_OVERSIZED) instead of stalling to the liveness timeout.
  • on_disconnect fires at most once per Connection, for terminal disconnects only.
  • on_disconnect is no longer fired on the connecting thread.
  • Unsigned ClientHello framed into a TAI_TX_CTRL_BUF_SIZE buffer (was a fixed 256 B).
  • A send failure after committing bytes no longer rolls back the sequence number.
  • gen_id fails cleanly when the RNG errors, instead of emitting an uninitialized id.
  • Graceful peer TLS close (close_notify) surfaced as a comms error, detected immediately.
  • Shared process-wide RNG (rng_bytes) serialized by a pal mutex (fixes a CTR-DRBG data race).
  • iot_init now fails if RNG seeding fails.
  • tai_connect completes on the server's AuthenticateResponse (type 3), not only a SessionNew ack.
  • tai_disconnect returns promptly on an idle link (worker poll capped by TAI_WORKER_POLL_CAP_MS).
• PAL (FreeRTOS) — allocator mismatch: the worker-thread struct is freed with pal_free, not vPortFree.
• atop — atop_activate_request stack-allocates its response like the other ATOP calls, fixing an OOM leak of the POST-body buffer on the response-malloc-failure path.
• common / TLS — hardening follow-ups.
  • Restored human-readable X.509 verification diagnostics (mbedtls_x509_crt_verify_info).
  • rng_bytes() / pv23_encrypt() reject a NULL pal; redundant memset/strlen dropped in tls_connect.