[crypto] fix mbedtls version check for v3.6.6

2026-06-18 19:33:32 +00:00 · 2026-04-09 19:16:33 +08:00
989 changed files with 35472 additions and 92559 deletions
@@ -49,7 +49,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -73,16 +73,13 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
    - name: Run linkspector
-      uses: umbrelladocs/action-linkspector@963b6264d7de32c904942a70b488d3407453049e # v1.5.1
-      env:
-        PUPPETEER_EXECUTABLE_PATH: /usr/bin/google-chrome
+      uses: umbrelladocs/action-linkspector@652f85bc57bb1e7d4327260decc10aa68f7694c3 # v1.4.0
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        reporter: github-pr-review
@@ -92,7 +89,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -111,7 +108,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -151,7 +148,7 @@ jobs:
      CXX: ${{ matrix.compiler_cpp }}
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -170,7 +167,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -189,7 +186,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -241,12 +238,9 @@ jobs:
          - gcc_ver: 14
            gcc_download_url: https://developer.arm.com/-/media/Files/downloads/gnu/14.2.rel1/binrel/arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi.tar.xz
            gcc_extract_dir: arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi
-          - gcc_ver: 15
-            gcc_download_url: https://developer.arm.com/-/media/Files/downloads/gnu/15.2.rel1/binrel/arm-gnu-toolchain-15.2.rel1-x86_64-arm-none-eabi.tar.xz
-            gcc_extract_dir: arm-gnu-toolchain-15.2.rel1-x86_64-arm-none-eabi
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -279,7 +273,7 @@ jobs:
      CXX: g++-${{ matrix.gcc_ver }}
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -312,7 +306,7 @@ jobs:
      CXX: clang++-${{ matrix.clang_ver }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -335,7 +329,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -366,7 +360,7 @@ jobs:
      CXX: ${{ matrix.CXX }}
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -382,3 +376,33 @@ jobs:
      run: |
        script/check-posix-build
        script/check-simulation-build
+
+  android-ndk:
+    name: android-ndk
+    runs-on: ubuntu-24.04
+    container:
+      image: openthread/environment
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - name: Install unzip
+      run: apt update && apt install -y unzip
+    - name: Setup NDK
+      id: setup-ndk
+      uses: nttld/setup-ndk@afb4c9964b521afb97c864b7d40b11e6911bd410 # v1.5.0
+      with:
+        ndk-version: r25c
+        local-cache: true
+
+    - name: Build
+      env:
+        NDK: ${{ steps.setup-ndk.outputs.ndk-path }}
+      run: |
+        rm -rf build/ && OT_CMAKE_NINJA_TARGET="ot-daemon ot-ctl" script/cmake-build android-ndk
+        rm -rf build/ && OT_CMAKE_NINJA_TARGET="ot-cli" script/cmake-build android-ndk
@@ -54,7 +54,7 @@ jobs:

    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -67,7 +67,7 @@ jobs:
        sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev

    - name: Initialize CodeQL
-      uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+      uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -81,6 +81,6 @@ jobs:
        ./script/test build

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+      uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
      with:
        category: "/language:${{matrix.language}}"
@@ -61,7 +61,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -83,18 +83,18 @@ jobs:

      - name: Login to Docker Hub
        if: success() && github.repository == 'openthread/openthread' && github.event_name != 'pull_request'
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Build and push by digest
        if: success()
        id: build
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          file: etc/docker/environment/Dockerfile
          platforms: ${{ matrix.platform }}
@@ -111,7 +111,7 @@ jobs:

      - name: Upload digest
        if: success() && github.repository == 'openthread/openthread' && github.event_name != 'pull_request'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
@@ -125,25 +125,25 @@ jobs:
      - build
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - name: Download digests
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Login to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Docker meta
        id: meta
@@ -53,7 +53,7 @@ jobs:

    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
    
@@ -75,7 +75,7 @@ jobs:
        output-sarif: true

    - name: Upload Crash
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      if: failure() && steps.build.outcome == 'success'
      with:
        name: ${{ matrix.sanitizer }}-artifacts
@@ -83,7 +83,7 @@ jobs:

    - name: Upload Sarif
      if: always() && steps.build.outcome == 'success'
-      uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+      uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
      with:
        sarif_file: cifuzz-sarif/results.sarif
        checkout_path: cifuzz-sarif
@@ -48,7 +48,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -63,7 +63,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -1,89 +0,0 @@
-#
-#  Copyright (c) 2026, The OpenThread Authors.
-#  All rights reserved.
-#
-#  Redistribution and use in source and binary forms, with or without
-#  modification, are permitted provided that the following conditions are met:
-#  1. Redistributions of source code must retain the above copyright
-#     notice, this list of conditions and the following disclaimer.
-#  2. Redistributions in binary form must reproduce the above copyright
-#     notice, this list of conditions and the following disclaimer in the
-#     documentation and/or other materials provided with the distribution.
-#  3. Neither the name of the copyright holder nor the
-#     names of its contributors may be used to endorse or promote products
-#     derived from this software without specific prior written permission.
-#
-#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-#  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-#  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-#  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
-#  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-#  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-#  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-#  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-#  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-#  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-#  POSSIBILITY OF SUCH DAMAGE.
-#
-
-name: Monthly CalVer Release
-
-on:
-  schedule:
-    # Runs at 00:00 UTC on the 1st day of every month
-    - cron: '0 0 1 * *'
-  
-  # Allows you to trigger the workflow manually from the GitHub Actions UI
-  workflow_dispatch:
-    inputs:
-      tag_override:
-        description: 'Custom Tag Name (e.g., v2026.05.1). Leave blank for auto CalVer.'
-        required: false
-        type: string
-
-jobs:
-  create-release:
-    name: Create Monthly Release
-    runs-on: ubuntu-24.04
-    
-    # Required permission to create tags and releases
-    permissions:
-      contents: write 
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
-
-      - name: Generate CalVer Tag Name
-        id: generate_tag
-        env:
-          TAG_OVERRIDE: ${{ inputs.tag_override }}
-        # Formats the date as vYYYY.MM.0 (e.g., v2026.06.0) or uses override if provided
-        run: |
-          if [ -n "$TAG_OVERRIDE" ]; then
-            CALVER_TAG="$TAG_OVERRIDE"
-          else
-            CALVER_TAG="v$(date +'%Y.%m').0"
-          fi
-          echo "TAG_NAME=$CALVER_TAG" >> $GITHUB_ENV
-          echo "Generated tag: $CALVER_TAG"
-
-      - name: Create GitHub Release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        # Uses the built-in GitHub CLI to create the tag and release simultaneously
-        run: |
-          gh release create "$TAG_NAME" \
-            --target "${{ github.ref_name }}" \
-            --title "OpenThread $TAG_NAME" \
-            --generate-notes
@@ -45,18 +45,14 @@ permissions:

 jobs:

-  nexus-cert-tests:
-    name: nexus-cert-tests
+  nexus-tests:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit

-    - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
-
    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        submodules: recursive
@@ -76,134 +72,3 @@ jobs:
    - name: Run Nexus Tests
      run: |
        top_builddir=build/nexus ./tests/nexus/run_nexus_tests.sh
-
-  nexus-core-tests:
-    name: nexus-core-tests
-    runs-on: ubuntu-24.04
-    steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-      with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
-
-    - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
-
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        submodules: recursive
-
-    - name: Bootstrap
-      env:
-        PR_BODY: "${{ github.event.pull_request.body }}"
-      run: |
-        sudo apt-get update
-        sudo apt-get --no-install-recommends install -y ninja-build lcov
-
-    - name: Build Nexus
-      run: |
-        mkdir -p build/nexus
-        top_builddir=build/nexus ./tests/nexus/build.sh
-
-    - name: Run Core Tests
-      run: |
-        cd build/nexus && ctest -L core --output-on-failure
-
-    - name: Run TREL Tests
-      run: |
-        cd build/nexus && ctest -L trel --output-on-failure
-
-  nexus-long-routes-tests:
-    name: nexus-long-routes-tests
-    runs-on: ubuntu-24.04
-    steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-      with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
-
-    - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
-
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        submodules: recursive
-
-    - name: Bootstrap
-      env:
-        PR_BODY: "${{ github.event.pull_request.body }}"
-      run: |
-        sudo apt-get update
-        sudo apt-get --no-install-recommends install -y ninja-build lcov
-
-    - name: Build Nexus
-      run: |
-        mkdir -p build/nexus
-        top_builddir=build/nexus ./tests/nexus/build.sh long_routes
-
-    - name: Run LONG_ROUTES Tests
-      run: |
-        cd build/nexus && ctest -L long_routes --output-on-failure
-
-  nexus-grpc-tests:
-    name: nexus-grpc-tests
-    runs-on: ubuntu-24.04
-    steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-      with:
-        egress-policy: audit
-
-    - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
-
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        submodules: recursive
-
-    - name: Bootstrap
-      run: |
-        sudo apt-get update
-        sudo apt-get --no-install-recommends install -y ninja-build libgrpc++-dev libprotobuf-dev protobuf-compiler-grpc
-
-    - name: Build Nexus
-      run: |
-        mkdir -p build/nexus
-        OT_NEXUS_GRPC=ON top_builddir=build/nexus ./tests/nexus/build.sh
-
-    - name: Run GRPC Tests
-      run: |
-        cd build/nexus && ./tests/nexus/nexus_grpc
-
-  nexus-wasm-tests:
-    name: nexus-wasm-tests
-    runs-on: ubuntu-24.04
-    steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-      with:
-        egress-policy: audit
-
-    - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
-
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        submodules: recursive
-
-    - name: Bootstrap
-      run: |
-        sudo apt-get update
-        sudo apt-get --no-install-recommends install -y ninja-build
-
-    - name: Set up Emscripten
-      uses: mymindstorm/setup-emsdk@v14
-
-    - name: Build Nexus WASM
-      run: |
-        mkdir -p build/nexus
-        top_builddir=build/nexus ./tests/nexus/build.sh wasm
-
-    - name: Run WASM Smoke Test
-      run: |
-        node tests/nexus/test_wasm_bindings.mjs build/nexus/tests/nexus/nexus_live_demo.js
@@ -1,91 +0,0 @@
-#
-#  Copyright (c) 2026, The OpenThread Authors.
-#  All rights reserved.
-#
-#  Redistribution and use in source and binary forms, with or without
-#  modification, are permitted provided that the following conditions are met:
-#  1. Redistributions of source code must retain the above copyright
-#     notice, this list of conditions and the following disclaimer.
-#  2. Redistributions in binary form must reproduce the above copyright
-#     notice, this list of conditions and the following disclaimer in the
-#     documentation and/or other materials provided with the distribution.
-#  3. Neither the name of the copyright holder nor the
-#     names of its contributors may be used to endorse or promote products
-#     derived from this software without specific prior written permission.
-#
-#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-#  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-#  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-#  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
-#  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-#  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-#  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-#  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-#  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-#  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-#  POSSIBILITY OF SUCH DAMAGE.
-#
-
-name: OTBR DinD
-
-on:
-  push:
-    branches-ignore:
-      - 'dependabot/**'
-  pull_request:
-    branches:
-      - 'main'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-
-  dind-dns-sd:
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        mdns: ["", "--mdnsresponder"]
-    env:
-      PR_BODY: "${{ github.event.pull_request.body }}"
-    steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-      with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
-
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        submodules: recursive
-
-    - name: Clone ot-br-posix and replace openthread submodule
-      run: |
-        OPENTHREAD_DIR=$(pwd)
-        ./script/git-tool clone https://github.com/openthread/ot-br-posix.git --depth 1 --recurse-submodules --shallow-submodules /tmp/ot-br-posix
-        cd /tmp/ot-br-posix
-        rm -rf third_party/openthread/repo
-        mkdir -p third_party/openthread/repo
-        rsync -r --exclude=.git --exclude=build --exclude=ot_testing "${OPENTHREAD_DIR}/." third_party/openthread/repo
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-
-    - name: Build DinD Runner Image
-      run: |
-        cd /tmp/ot-br-posix
-        docker build -t otbr-dind-runner -f etc/docker/test/Dockerfile.dind_runner .
-
-    - name: Run DinD Integration Test
-      run: |
-        cd /tmp/ot-br-posix
-        docker run --privileged --rm \
-          -v /tmp/ot-br-posix:/usr/src/ot-br-posix \
-          -w /usr/src/ot-br-posix \
-          -e DOCKER_HOST=unix:///var/run/docker.sock \
-          otbr-dind-runner \
-          bash -c "dockerd --host=unix:///var/run/docker.sock >/dev/null 2>&1 & ./tests/scripts/test_dind_dns_sd.sh ${{ matrix.mdns }}"
@@ -45,6 +45,74 @@ permissions:

 jobs:

+  backbone-router:
+    runs-on: ubuntu-22.04
+    env:
+      REFERENCE_DEVICE: 1
+      VIRTUAL_TIME: 0
+      TEST_TIMEOUT: 1800
+      PACKET_VERIFICATION: 1
+      THREAD_VERSION: 1.4
+      INTER_OP: 1
+      COVERAGE: 1
+      MULTIPLY: 1
+      PYTHONUNBUFFERED: 1
+      VERBOSE: 1
+      # The Border Routing and DUA feature can coexist, but current wireshark
+      # packet verification can't handle it because of the order of context ID
+      # of OMR prefix and Domain prefix is not deterministic.
+      BORDER_ROUTING: 0
+      DISCOVERY_PROXY: 0
+    steps:
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - name: Build OTBR Docker
+      env:
+        PR_BODY: "${{ github.event.pull_request.body }}"
+      run: |
+        ./script/test build_otbr_docker
+    - name: Bootstrap
+      run: |
+        sudo rm /etc/apt/sources.list.d/* && sudo apt-get update
+        sudo apt-get --no-install-recommends install -y python3-setuptools python3-wheel ninja-build lcov
+        sudo bash script/install_socat
+        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
+    - name: Build
+      run: |
+        ./script/test build
+    - name: Get Thread-Wireshark
+      run: |
+        ./script/test get_thread_wireshark
+    - name: Run
+      run: |
+        export CI_ENV="$(bash <(curl -s https://codecov.io/env)) -e GITHUB_ACTIONS -e COVERAGE"
+        echo "CI_ENV=${CI_ENV}"
+        sudo -E ./script/test cert_suite ./tests/scripts/thread-cert/backbone/*.py || (sudo chmod a+r ot_testing/* && false)
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-thread-1-3-backbone-docker
+        path: /tmp/coverage/
+        retention-days: 1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() }}
+      with:
+        name: thread-1-3-backbone-results
+        path: |
+          ot_testing/*.pcap
+          ot_testing/*.json
+          ot_testing/*.log
+          ot_testing/coredump_*
+          ot_testing/otbr-agent_*
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-thread-1-3-backbone
+        path: tmp/coverage.info
+        retention-days: 1
+
  thread-border-router:
    runs-on: ubuntu-22.04
    strategy:
@@ -69,12 +137,31 @@ jobs:
            packet_verification: 1
            nat64: 0
            description: "MATN"
+          - otbr_mdns: "mDNSResponder"
+            otbr_trel: 0
+            cert_scripts: ./tests/scripts/thread-cert/border_router/LowPower/*.py
+            packet_verification: 1
+            nat64: 0
+            description: "LowPower"
          - otbr_mdns: "mDNSResponder"
            otbr_trel: 0
            cert_scripts: ./tests/scripts/thread-cert/border_router/internet/*.py
            packet_verification: 1
            nat64: 1
            description: "internet access"
+          - otbr_mdns: "avahi"
+            otbr_trel: 0
+            cert_scripts: ./tests/scripts/thread-cert/border_router/*.py
+            packet_verification: 1
+            nat64: 0
+            description: ""
+          - otbr_mdns: "avahi"
+            otbr_trel: 0
+            cert_scripts: ./tests/scripts/thread-cert/border_router/*.py
+            packet_verification: 1
+            nat64: 0
+            use_core_firewall: 1
+            description: "core-firewall"
    name: BR ${{ matrix.description }} (${{ matrix.otbr_mdns }}, TREL=${{matrix.otbr_trel}})
    env:
      REFERENCE_DEVICE: 1
@@ -122,12 +209,12 @@ jobs:
        export CI_ENV="$(bash <(curl -s https://codecov.io/env)) -e GITHUB_ACTIONS -e COVERAGE"
        echo "CI_ENV=${CI_ENV}"
        sudo -E ./script/test cert_suite ${{ matrix.cert_scripts }} || (sudo chmod a+r ot_testing/* && false)
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: cov-br-docker-${{ matrix.description }}-${{ matrix.otbr_mdns }}-${{matrix.otbr_trel}}
        path: /tmp/coverage/
        retention-days: 1
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      if: ${{ failure() }}
      with:
        name: br-results-${{ matrix.description }}-${{ matrix.otbr_mdns }}-${{matrix.otbr_trel}}
@@ -140,7 +227,7 @@ jobs:
    - name: Generate Coverage
      run: |
        ./script/test generate_coverage gcc
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: cov-br-${{ matrix.description }}-${{ matrix.otbr_mdns }}-${{matrix.otbr_trel}}
        path: tmp/coverage.info
@@ -148,6 +235,7 @@ jobs:

  upload-coverage:
    needs:
+    - backbone-router
    - thread-border-router
    runs-on: ubuntu-22.04
    steps:
@@ -157,7 +245,7 @@ jobs:
    - name: Bootstrap
      run: |
        sudo apt-get --no-install-recommends install -y lcov
-    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+    - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        path: coverage/
        pattern: cov-*
@@ -168,7 +256,7 @@ jobs:
        script/test combine_coverage
    - name: Upload Coverage
      continue-on-error: true
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
      with:
@@ -58,7 +58,7 @@ jobs:
      REAL_DEVICE: 0
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -80,7 +80,7 @@ jobs:
        PYTHONPATH=./tests/scripts/thread-cert pytype tools/otci
    - name: Build
      run: |
-        ./script/cmake-build simulation -DOT_THREAD_VERSION=1.4 -DOT_MLR=ON -DOT_BACKBONE_ROUTER=ON \
+        ./script/cmake-build simulation -DOT_THREAD_VERSION=1.4 -DOT_DUA=ON -DOT_MLR=ON -DOT_BACKBONE_ROUTER=ON \
        -DOT_CSL_RECEIVER=ON -DOT_SIMULATION_VIRTUAL_TIME=${VIRTUAL_TIME}
    - name: Install OTCI Python Library
      run: |
@@ -58,14 +58,14 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        submodules: recursive
-    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+    - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
      with:
        go-version: "1.23"
    - name: Set up Python
@@ -84,7 +84,7 @@ jobs:
          cd /tmp/otns
          ./script/test py-unittests
        )
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      if: ${{ failure() }}
      with:
        name: unittests-pcaps
@@ -94,7 +94,7 @@ jobs:
    - name: Generate Coverage
      run: |
        ./script/test generate_coverage gcc
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: cov-otns-unittests
        path: tmp/coverage.info
@@ -107,7 +107,7 @@ jobs:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          submodules: recursive
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version: "1.23"
      - name: Set up Python
@@ -126,7 +126,7 @@ jobs:
            cd /tmp/otns
            ./script/test py-examples
          )
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        if: ${{ failure() }}
        with:
          name: examples-pcaps
@@ -136,7 +136,7 @@ jobs:
      - name: Generate Coverage
        run: |
          ./script/test generate_coverage gcc
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: cov-otns-examples
          path: tmp/coverage.info
@@ -164,14 +164,14 @@ jobs:
      STRESS_LEVEL: ${{ matrix.stress_level }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          submodules: recursive
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version: "1.23"
      - name: Set up Python
@@ -190,7 +190,7 @@ jobs:
            cd /tmp/otns
            ./script/test stress-tests ${{ matrix.suite }}
          )
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        if: ${{ failure() }}
        with:
          name: stress-tests-${{ matrix.suite }}-pcaps
@@ -200,7 +200,7 @@ jobs:
      - name: Generate Coverage
        run: |
          ./script/test generate_coverage gcc
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: cov-otns-stress-tests-${{ matrix.suite }}
          path: tmp/coverage.info
@@ -214,7 +214,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -224,7 +224,7 @@ jobs:
      - name: Bootstrap
        run: |
          sudo apt-get --no-install-recommends install -y lcov
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          path: coverage/
          pattern: cov-*
@@ -52,7 +52,7 @@ jobs:
      CXXFLAGS: -DCLI_COAP_SECURE_USE_COAP_DEFAULT_HANDLER=1 -DOPENTHREAD_CONFIG_MLE_MAX_CHILDREN=15
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -83,7 +83,7 @@ jobs:
          CRASHED=$(./script/test check_crash | tail -1)
          [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
          echo "CRASHED_RCP=$CRASHED" >> $GITHUB_ENV
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      if: ${{ failure() && env.CRASHED_RCP == '1' }}
      with:
        name: core-expect-rcp
@@ -92,7 +92,7 @@ jobs:
    - name: Generate Coverage
      run: |
        ./script/test generate_coverage gcc
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: cov-expects-linux-1
        path: tmp/coverage.info
@@ -117,13 +117,13 @@ jobs:
          CRASHED=$(./script/test check_crash | tail -1)
          [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
          echo "CRASHED_TUN=$CRASHED" >> $GITHUB_ENV
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      if: ${{ failure() && env.CRASHED_TUN == '1' }}
      with:
        name: core-expect-linux
        path: |
          ./ot-core-dump/*
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      if: ${{ failure() }}
      with:
        name: syslog-expect-linux
@@ -131,12 +131,57 @@ jobs:
    - name: Generate Coverage
      run: |
        ./script/test generate_coverage gcc
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: cov-expects-linux-2
        path: tmp/coverage.info
        retention-days: 1

+  thread-cert:
+    runs-on: ubuntu-22.04
+    env:
+      COVERAGE: 1
+      PYTHONUNBUFFERED: 1
+      THREAD_VERSION: 1.1
+      VIRTUAL_TIME: 1
+      OT_VT_USE_UNIX_SOCKET: 1
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo apt-get update
+        sudo apt-get --no-install-recommends install -y lcov ninja-build
+        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
+    - name: Build
+      run: |
+        OT_NODE_TYPE=rcp ./script/test build
+    - name: Run
+      run: |
+        MAX_JOBS=$(getconf _NPROCESSORS_ONLN) ./script/test cert_suite ./tests/scripts/thread-cert/Cert_*.py ./tests/scripts/thread-cert/test_*.py
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() }}
+      with:
+        name: thread-cert
+        path: ot_testing
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-thread-cert
+        path: tmp/coverage.info
+
  pty-linux:
    name: pty-linux OT_DAEMON=${{ matrix.OT_DAEMON }}
    runs-on: ubuntu-24.04
@@ -150,7 +195,7 @@ jobs:
      OT_READLINE: 'readline'
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -185,7 +230,7 @@ jobs:
    - name: Generate Coverage
      run: |
        ./script/test generate_coverage gcc
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: cov-pty-linux-${{ matrix.OT_DAEMON }}
        path: tmp/coverage.info
@@ -196,7 +241,7 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -226,7 +271,7 @@ jobs:
      OT_READLINE: 'off'
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -259,7 +304,7 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -282,7 +327,7 @@ jobs:
    - name: Generate Coverage
      run: |
        ./script/test generate_coverage gcc
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: cov-rcp-stack-reset
        path: tmp/coverage.info
@@ -292,10 +337,11 @@ jobs:
    needs:
    - expects-linux
    - pty-linux
+    - thread-cert
    runs-on: ubuntu-22.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -305,7 +351,7 @@ jobs:
    - name: Bootstrap
      run: |
        sudo apt-get --no-install-recommends install -y lcov
-    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+    - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        path: coverage/
        pattern: cov-*
@@ -314,7 +360,7 @@ jobs:
      run: |
        script/test combine_coverage
    - name: Upload Coverage
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
      with:
@@ -87,7 +87,7 @@ jobs:
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v3.1.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v3.1.0
        with:
          name: SARIF file
          path: results.sarif
@@ -95,6 +95,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v2.1.27
+        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v2.1.27
        with:
          sarif_file: results.sarif
@@ -0,0 +1,472 @@
+#
+#  Copyright (c) 2020, The OpenThread Authors.
+#  All rights reserved.
+#
+#  Redistribution and use in source and binary forms, with or without
+#  modification, are permitted provided that the following conditions are met:
+#  1. Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+#  2. Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#  3. Neither the name of the copyright holder nor the
+#     names of its contributors may be used to endorse or promote products
+#     derived from this software without specific prior written permission.
+#
+#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+#  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+#  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+#  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+#  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+#  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+#  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+#  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+#  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+#  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+#  POSSIBILITY OF SUCH DAMAGE.
+#
+
+name: Simulation 1.1
+
+on:
+  push:
+    branches-ignore:
+      - 'dependabot/**'
+  pull_request:
+    branches:
+      - 'main'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+
+  packet-verification:
+    runs-on: ubuntu-24.04
+    env:
+      PACKET_VERIFICATION: 1
+      REFERENCE_DEVICE: 1
+      THREAD_VERSION: 1.1
+      VIRTUAL_TIME: 1
+      TEST_TIMEOUT: 300
+      OT_VT_USE_UNIX_SOCKET: 1
+      MULTIPLY: 3
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo apt-get update
+        sudo apt-get --no-install-recommends install -y ninja-build lcov
+        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
+    - name: Build
+      run: |
+        ./script/test build
+    - name: Get Thread-Wireshark
+      run: |
+        ./script/test get_thread_wireshark
+    - name: Run
+      run: |
+        ./script/test cert_suite ./tests/scripts/thread-cert/Cert_*.py ./tests/scripts/thread-cert/test_*.py
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() }}
+      with:
+        name: packet-verification-pcaps
+        path: |
+          *.pcap
+          *.json
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-packet-verification
+        path: tmp/coverage.info
+        retention-days: 1
+
+  cli-ftd:
+    runs-on: ubuntu-24.04
+    env:
+      CFLAGS: -m32
+      CXXFLAGS: -m32
+      LDFLAGS: -m32
+      COVERAGE: 1
+      REFERENCE_DEVICE: 1
+      THREAD_VERSION: 1.1
+      VIRTUAL_TIME: 1
+      TEST_TIMEOUT: 300
+      OT_VT_USE_UNIX_SOCKET: 1
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo apt-get update
+        sudo apt-get --no-install-recommends install -y lcov ninja-build g++-multilib
+        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
+    - name: Build
+      run: |
+        ./script/test build
+    - name: Run
+      run: |
+        ./script/test cert_suite ./tests/scripts/thread-cert/Cert_*.py ./tests/scripts/thread-cert/test_*.py
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() }}
+      with:
+        name: cli-ftd-thread-cert
+        path: ot_testing
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-cli-ftd
+        path: tmp/coverage.info
+        retention-days: 1
+
+  cli-mtd:
+    name: cli-mtd MESSAGE_USE_HEAP=${{ matrix.message_use_heap }}
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        message_use_heap: [0, 1]
+    env:
+      CFLAGS: -m32
+      CXXFLAGS: -m32
+      LDFLAGS: -m32
+      COVERAGE: 1
+      REFERENCE_DEVICE: 1
+      THREAD_VERSION: 1.1
+      USE_MTD: 1
+      VIRTUAL_TIME: 1
+      TEST_TIMEOUT: 300
+      OT_VT_USE_UNIX_SOCKET: 1
+      MESSAGE_USE_HEAP: ${{ matrix.message_use_heap }}
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo apt-get update
+        sudo apt-get --no-install-recommends install -y lcov ninja-build g++-multilib
+        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
+    - name: Build
+      run: |
+        ./script/test build
+    - name: Run
+      run: |
+        ./script/test cert_suite ./tests/scripts/thread-cert/Cert_*.py ./tests/scripts/thread-cert/test_*.py
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() }}
+      with:
+        name: cli-mtd-thread-cert
+        path: ot_testing
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-cli-mtd-${{ matrix.message_use_heap }}
+        path: tmp/coverage.info
+        retention-days: 1
+
+  cli-time-sync:
+    runs-on: ubuntu-24.04
+    env:
+      CFLAGS: -m32
+      CXXFLAGS: -m32
+      LDFLAGS: -m32
+      COVERAGE: 1
+      REFERENCE_DEVICE: 1
+      THREAD_VERSION: 1.1
+      VIRTUAL_TIME: 1
+      TEST_TIMEOUT: 300
+      OT_VT_USE_UNIX_SOCKET: 1
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo apt-get update
+        sudo apt-get --no-install-recommends install -y g++-multilib lcov ninja-build
+        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
+    - name: Build
+      run: |
+        OT_OPTIONS="-DOT_TIME_SYNC=ON" ./script/test build
+    - name: Run
+      run: |
+        ./script/test cert_suite ./tests/scripts/thread-cert/Cert_*.py ./tests/scripts/thread-cert/test_*.py
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() }}
+      with:
+        name: cli-time-sync-thread-cert
+        path: ot_testing
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-cli-time-sync
+        path: tmp/coverage.info
+        retention-days: 1
+
+  expects:
+    runs-on: ubuntu-24.04
+    env:
+      CFLAGS: -DCLI_COAP_SECURE_USE_COAP_DEFAULT_HANDLER=1 -DOPENTHREAD_CONFIG_MLE_MAX_CHILDREN=15
+      CXXFLAGS: -DCLI_COAP_SECURE_USE_COAP_DEFAULT_HANDLER=1 -DOPENTHREAD_CONFIG_MLE_MAX_CHILDREN=15
+      THREAD_VERSION: 1.1
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo apt-get --no-install-recommends install -y expect ninja-build lcov
+        sudo bash script/install_socat
+        pip install bleak 'cryptography==43.0.0'
+    - name: Run
+      run: |
+        ulimit -c unlimited
+        ./script/test prepare_coredump_upload
+        OT_OPTIONS='-DOT_TIME_SYNC=ON -DOT_FULL_LOGS=ON -DOT_LOG_OUTPUT=PLATFORM_DEFINED' VIRTUAL_TIME=0 ./script/test build expect
+    - name: Check Crash
+      if: ${{ failure() }}
+      run: |
+          CRASHED=$(./script/test check_crash | tail -1)
+          [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
+          echo "CRASHED_CLI=$CRASHED" >> $GITHUB_ENV
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() && env.CRASHED_CLI == '1' }}
+      with:
+        name: core-expect-cli
+        path: |
+          ./ot-core-dump/*
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-expects
+        path: tmp/coverage.info
+        retention-days: 1
+
+  ot-commissioner:
+    runs-on: ubuntu-24.04
+    env:
+      THREAD_VERSION: 1.1
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      env:
+        PR_BODY: "${{ github.event.pull_request.body }}"
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y avahi-daemon avahi-utils lcov
+        script/git-tool clone https://github.com/openthread/ot-commissioner.git /tmp/ot-commissioner --depth 1 --branch main
+    - name: Build
+      run: |
+        cd /tmp/ot-commissioner
+        script/bootstrap.sh
+        cmake -GNinja                            \
+              -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
+              -DCMAKE_CXX_STANDARD=11            \
+              -DCMAKE_CXX_STANDARD_REQUIRED=ON   \
+              -DCMAKE_BUILD_TYPE=Release         \
+              -DCMAKE_INSTALL_PREFIX=/usr/local  \
+              -DOT_COMM_COVERAGE=ON              \
+              -DOT_COMM_CCM=OFF                  \
+              -S . -B build
+        cmake --build build
+        sudo cmake --install build
+    - name: Run
+      run: |
+        export OT_COMM_OPENTHREAD="$(pwd)"
+        cd /tmp/ot-commissioner/tests/integration
+        ./bootstrap.sh
+        ./run_tests.sh
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-ot-commissioner
+        path: tmp/coverage.info
+        retention-days: 1
+
+  multiple-instance:
+    runs-on: ubuntu-24.04
+    env:
+      COVERAGE: 1
+      THREAD_VERSION: 1.1
+      VIRTUAL_TIME: 1
+      TEST_TIMEOUT: 300
+      OT_VT_USE_UNIX_SOCKET: 1
+      CXXFLAGS: "-DOPENTHREAD_CONFIG_LOG_PREPEND_UPTIME=0"
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo apt-get --no-install-recommends install -y lcov ninja-build
+        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
+    - name: Build
+      run: |
+        OT_OPTIONS="-DOT_MULTIPLE_INSTANCE=ON" ./script/test build
+    - name: Run
+      run: |
+        ./script/test cert_suite ./tests/scripts/thread-cert/Cert_*.py ./tests/scripts/thread-cert/test_*.py
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() }}
+      with:
+        name: ot_testing
+        path: build/simulation/tests/scripts/thread-cert
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-multiple-instance
+        path: tmp/coverage.info
+        retention-days: 1
+
+  simulation-local-host:
+    runs-on: ubuntu-24.04
+    env:
+      COVERAGE: 1
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - name: Bootstrap
+      run: |
+        sudo apt-get --no-install-recommends install -y expect ninja-build lcov
+    - name: Run
+      run: |
+        ./script/check-simulation-local-host
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-simulation-local-host
+        path: tmp/coverage.info
+        retention-days: 1
+
+  upload-coverage:
+    needs:
+    - packet-verification
+    - cli-ftd
+    - cli-mtd
+    - cli-time-sync
+    - expects
+    - ot-commissioner
+    - multiple-instance
+    runs-on: ubuntu-22.04
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - name: Bootstrap
+      run: |
+        sudo apt-get --no-install-recommends install -y lcov
+    - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+      with:
+        path: coverage/
+        pattern: cov-*
+        merge-multiple: true
+    - name: Combine Coverage
+      run: |
+        script/test combine_coverage
+    - name: Upload Coverage
+      uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+      env:
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      with:
+        files: final.info
+        fail_ci_if_error: true
@@ -0,0 +1,458 @@
+#
+#  Copyright (c) 2020, The OpenThread Authors.
+#  All rights reserved.
+#
+#  Redistribution and use in source and binary forms, with or without
+#  modification, are permitted provided that the following conditions are met:
+#  1. Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+#  2. Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#  3. Neither the name of the copyright holder nor the
+#     names of its contributors may be used to endorse or promote products
+#     derived from this software without specific prior written permission.
+#
+#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+#  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+#  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+#  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+#  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+#  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+#  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+#  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+#  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+#  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+#  POSSIBILITY OF SUCH DAMAGE.
+#
+
+name: Simulation 1.4
+
+on:
+  push:
+    branches-ignore:
+      - 'dependabot/**'
+  pull_request:
+    branches:
+      - 'main'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
+  cancel-in-progress: true
+
+permissions:  # added using https://github.com/step-security/secure-workflows
+  contents: read
+
+jobs:
+
+  thread-1-4:
+    name: thread-1-4-${{ matrix.compiler.c }}-${{ matrix.arch }}
+    runs-on: ubuntu-22.04
+    env:
+      CFLAGS: -${{ matrix.arch }}
+      CXXFLAGS: -${{ matrix.arch }}
+      LDFLAGS: -${{ matrix.arch }}
+      COVERAGE: 1
+      THREAD_VERSION: 1.4
+      VIRTUAL_TIME: 1
+      TEST_TIMEOUT: 300
+      OT_VT_USE_UNIX_SOCKET: 1
+      INTER_OP: 1
+      INTER_OP_BBR: 1
+      CC: ${{ matrix.compiler.c }}
+      CXX: ${{ matrix.compiler.cxx }}
+    strategy:
+      fail-fast: false
+      matrix:
+        compiler: [{c: "gcc", cxx: "g++", gcov: "gcc"}, { c: "clang", cxx: "clang++", gcov: "llvm"}]
+        arch: ["m32", "m64"]
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo dpkg --add-architecture i386
+        sudo apt-get update
+        sudo apt-get --no-install-recommends install -y ninja-build llvm lcov
+        sudo apt-get --no-install-recommends install -y g++-multilib libreadline-dev:i386 libncurses-dev:i386
+        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
+    - name: Build
+      run: |
+        ./script/test build
+    - name: Run
+      run: |
+        ulimit -c unlimited
+        ./script/test prepare_coredump_upload
+        ./script/test unit
+        ./script/test cert_suite tests/scripts/thread-cert/v1_2_*
+    - name: Check Crash
+      if: ${{ failure() }}
+      run: |
+          CRASHED=$(./script/test check_crash | tail -1)
+          [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
+          echo "CRASHED=$CRASHED" >> $GITHUB_ENV
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() }}
+      with:
+        name: thread-1-4-${{ matrix.compiler.c }}-${{ matrix.arch }}-pcaps
+        path: "*.pcap"
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() && env.CRASHED == '1' }}
+      with:
+        name: core-packet-verification-thread-1-4
+        path: |
+          ./ot-core-dump/*
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage "${{ matrix.compiler.gcov }}"
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-thread-1-4-${{ matrix.compiler.c }}-${{ matrix.arch }}
+        path: tmp/coverage.info
+        retention-days: 1
+
+  packet-verification-low-power:
+    runs-on: ubuntu-24.04
+    env:
+      REFERENCE_DEVICE: 1
+      VIRTUAL_TIME: 1
+      TEST_TIMEOUT: 300
+      OT_VT_USE_UNIX_SOCKET: 1
+      COVERAGE: 1
+      PACKET_VERIFICATION: 1
+      THREAD_VERSION: 1.4
+      MAC_FILTER: 1
+      INTER_OP: 1
+      INTER_OP_BBR: 0
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo apt-get update
+        sudo apt-get --no-install-recommends install -y ninja-build lcov
+        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
+    - name: Build
+      run: |
+        ./script/test build
+    - name: Build with OT_CSL_RECEIVER_LOCAL_TIME_SYNC
+      run: |
+        OT_BUILDDIR="${PWD}/build_csl_receiver_local_time_sync" OT_OPTIONS="-DOT_CSL_RECEIVER_LOCAL_TIME_SYNC=ON" ./script/test build
+    - name: Get Thread-Wireshark
+      run: |
+        ./script/test get_thread_wireshark
+    - name: Run
+      run: |
+        ulimit -c unlimited
+        ./script/test prepare_coredump_upload
+        for i in {1..10}
+        do
+          ./script/test cert_suite ./tests/scripts/thread-cert/v1_2_LowPower*.py
+        done
+    - name: Run with OT_CSL_RECEIVER_LOCAL_TIME_SYNC
+      run: |
+        OT_BUILDDIR="${PWD}/build_csl_receiver_local_time_sync" ./script/test cert_suite ./tests/scripts/thread-cert/v1_2_LowPower*.py
+    - name: Check Crash
+      if: ${{ failure() }}
+      run: |
+          CRASHED=$(./script/test check_crash | tail -1)
+          [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
+          echo "CRASHED=$CRASHED" >> $GITHUB_ENV
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() }}
+      with:
+        name: packet-verification-low-power-pcaps
+        path: |
+          *.pcap
+          *.json
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() && env.CRASHED == '1' }}
+      with:
+        name: core-packet-verification-low-power
+        path: |
+          ./ot-core-dump/*
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-packet-verification-low-power
+        path: tmp/coverage.info
+        retention-days: 1
+
+  packet-verification-1-1-on-1-4:
+    runs-on: ubuntu-24.04
+    env:
+      REFERENCE_DEVICE: 1
+      VIRTUAL_TIME: 1
+      OT_VT_USE_UNIX_SOCKET: 1
+      PACKET_VERIFICATION: 1
+      THREAD_VERSION: 1.4
+      INTER_OP_BBR: 1
+      MULTIPLY: 3
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo apt-get update
+        sudo apt-get --no-install-recommends install -y ninja-build lcov
+        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
+    - name: Build
+      run: |
+        ./script/test build
+    - name: Get Thread-Wireshark
+      run: |
+        ./script/test get_thread_wireshark
+    - name: Run
+      run: |
+        ./script/test cert_suite ./tests/scripts/thread-cert/Cert_*.py ./tests/scripts/thread-cert/test_*.py
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() }}
+      with:
+        name: packet-verification-1.1-on-1.4-pcaps
+        path: |
+          *.pcap
+          *.json
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-packet-verification-1-1-on-1-4
+        path: tmp/coverage.info
+        retention-days: 1
+
+  channel-manager-csl:
+    runs-on: ubuntu-24.04
+    env:
+      CFLAGS: -m32
+      CXXFLAGS: -m32
+      LDFLAGS: -m32
+      COVERAGE: 1
+      THREAD_VERSION: 1.4
+      VIRTUAL_TIME: 1
+      OT_VT_USE_UNIX_SOCKET: 1
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo apt-get update
+        sudo apt-get --no-install-recommends install -y g++-multilib lcov ninja-build
+        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
+    - name: Build
+      run: |
+        OT_OPTIONS="-DOT_CHANNEL_MANAGER_CSL=ON" ./script/test build
+    - name: Run
+      run: |
+        ulimit -c unlimited
+        ./script/test cert_suite ./tests/scripts/thread-cert/addon_test_channel_manager_autocsl*.py
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() }}
+      with:
+        name: channel-manager-csl
+        path: ot_testing
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-channel-manager-csl
+        path: tmp/coverage.info
+        retention-days: 1
+
+  expects:
+    runs-on: ubuntu-24.04
+    env:
+      COVERAGE: 1
+      THREAD_VERSION: 1.4
+      VIRTUAL_TIME: 0
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo apt-get --no-install-recommends install -y expect ninja-build lcov
+        sudo bash script/install_socat
+        pip install bleak 'cryptography==43.0.0'
+    - name: Run RCP Mode
+      run: |
+        ulimit -c unlimited
+        ./script/test prepare_coredump_upload
+        OT_OPTIONS=-DOT_READLINE=OFF OT_NODE_TYPE=rcp ./script/test build expect
+    - name: Check Crash
+      if: ${{ failure() }}
+      run: |
+          CRASHED=$(./script/test check_crash | tail -1)
+          [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
+          echo "CRASHED=$CRASHED" >> $GITHUB_ENV
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() && env.CRASHED == '1' }}
+      with:
+        name: core-expect-1-4
+        path: |
+          ./ot-core-dump/*
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-expects
+        path: tmp/coverage.info
+        retention-days: 1
+
+  thread-1-4-posix:
+    runs-on: ubuntu-24.04
+    env:
+      COVERAGE: 1
+      PYTHONUNBUFFERED: 1
+      READLINE: readline
+      THREAD_VERSION: 1.4
+      OT_NODE_TYPE: rcp
+      USE_MTD: 1
+      VIRTUAL_TIME: 1
+      OT_VT_USE_UNIX_SOCKET: 1
+      INTER_OP: 1
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Bootstrap
+      run: |
+        sudo apt-get update
+        sudo apt-get --no-install-recommends install -y libreadline6-dev ninja-build llvm lcov
+        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
+    - name: Build
+      run: |
+        ./script/test build
+    - name: Run
+      run: |
+        ulimit -c unlimited
+        ./script/test prepare_coredump_upload
+        ./script/test cert tests/scripts/thread-cert/v1_2_LowPower_5_3_01_SSEDAttachment.py
+        ./script/test cert tests/scripts/thread-cert/v1_2_LowPower_6_1_07_PreferringARouterOverAReed.py
+        ./script/test cert tests/scripts/thread-cert/v1_2_router_5_1_1.py
+        ./script/test cert tests/scripts/thread-cert/v1_2_test_csl_transmission.py
+        ./script/test cert tests/scripts/thread-cert/v1_2_test_enhanced_frame_pending.py
+        ./script/test cert tests/scripts/thread-cert/v1_2_test_parent_selection.py
+    - name: Check Crash
+      if: ${{ failure() }}
+      run: |
+          CRASHED=$(./script/test check_crash | tail -1)
+          [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
+          echo "CRASHED=$CRASHED" >> $GITHUB_ENV
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() }}
+      with:
+        name: thread-1-4-posix-pcaps
+        path: "*.pcap"
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      if: ${{ failure() && env.CRASHED == '1' }}
+      with:
+        name: core-thread-1-4-posix
+        path: |
+            ./ot-core-dump/*
+    - name: Generate Coverage
+      run: |
+        ./script/test generate_coverage gcc
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: cov-thread-1-4-posix
+        path: tmp/coverage.info
+        retention-days: 1
+
+  upload-coverage:
+    needs:
+    - thread-1-4
+    - packet-verification-low-power
+    - packet-verification-1-1-on-1-4
+    - expects
+    - thread-1-4-posix
+    runs-on: ubuntu-22.04
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - name: Bootstrap
+      run: |
+        sudo apt-get --no-install-recommends install -y lcov
+    - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+      with:
+        path: coverage/
+        pattern: cov-*
+        merge-multiple: true
+    - name: Combine Coverage
+      run: |
+        script/test combine_coverage
+    - name: Upload Coverage
+      uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+      env:
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      with:
+        files: final.info
+        fail_ci_if_error: true
@@ -1,258 +0,0 @@
-#
-#  Copyright (c) 2020, The OpenThread Authors.
-#  All rights reserved.
-#
-#  Redistribution and use in source and binary forms, with or without
-#  modification, are permitted provided that the following conditions are met:
-#  1. Redistributions of source code must retain the above copyright
-#     notice, this list of conditions and the following disclaimer.
-#  2. Redistributions in binary form must reproduce the above copyright
-#     notice, this list of conditions and the following disclaimer in the
-#     documentation and/or other materials provided with the distribution.
-#  3. Neither the name of the copyright holder nor the
-#     names of its contributors may be used to endorse or promote products
-#     derived from this software without specific prior written permission.
-#
-#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-#  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-#  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-#  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
-#  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-#  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-#  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-#  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-#  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-#  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-#  POSSIBILITY OF SUCH DAMAGE.
-#
-
-name: Simulation
-
-on:
-  push:
-    branches-ignore:
-      - 'dependabot/**'
-  pull_request:
-    branches:
-      - 'main'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-
-  ot-commissioner:
-    runs-on: ubuntu-24.04
-    steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-      with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
-
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        submodules: recursive
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-      with:
-        python-version: '3.12'
-        cache: pip
-    - name: Bootstrap
-      env:
-        PR_BODY: "${{ github.event.pull_request.body }}"
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y avahi-daemon avahi-utils lcov
-        script/git-tool clone https://github.com/openthread/ot-commissioner.git /tmp/ot-commissioner --depth 1 --branch main
-    - name: Build
-      run: |
-        cd /tmp/ot-commissioner
-        script/bootstrap.sh
-        cmake -GNinja                            \
-              -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
-              -DCMAKE_CXX_STANDARD=11            \
-              -DCMAKE_CXX_STANDARD_REQUIRED=ON   \
-              -DCMAKE_BUILD_TYPE=Release         \
-              -DCMAKE_INSTALL_PREFIX=/usr/local  \
-              -DOT_COMM_COVERAGE=ON              \
-              -DOT_COMM_CCM=OFF                  \
-              -S . -B build
-        cmake --build build
-        sudo cmake --install build
-    - name: Run
-      run: |
-        export OT_COMM_OPENTHREAD="$(pwd)"
-        cd /tmp/ot-commissioner/tests/integration
-        ./bootstrap.sh
-        ./run_tests.sh
-    - name: Generate Coverage
-      run: |
-        ./script/test generate_coverage gcc
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-      with:
-        name: cov-ot-commissioner
-        path: tmp/coverage.info
-        retention-days: 1
-
-  simulation-local-host:
-    runs-on: ubuntu-24.04
-    env:
-      COVERAGE: 1
-    steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-      with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
-
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        submodules: recursive
-    - name: Bootstrap
-      run: |
-        sudo apt-get --no-install-recommends install -y expect ninja-build lcov
-    - name: Run
-      run: |
-        ./script/check-simulation-local-host
-    - name: Generate Coverage
-      run: |
-        ./script/test generate_coverage gcc
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-      with:
-        name: cov-simulation-local-host
-        path: tmp/coverage.info
-        retention-days: 1
-
-  channel-manager-csl:
-    runs-on: ubuntu-24.04
-    env:
-      CFLAGS: -m32
-      CXXFLAGS: -m32
-      LDFLAGS: -m32
-      COVERAGE: 1
-      VIRTUAL_TIME: 1
-      OT_VT_USE_UNIX_SOCKET: 1
-    steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-      with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
-
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        submodules: recursive
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-      with:
-        python-version: '3.12'
-        cache: pip
-    - name: Bootstrap
-      run: |
-        sudo apt-get update
-        sudo apt-get --no-install-recommends install -y g++-multilib lcov ninja-build
-        python3 -m pip install -r tests/scripts/thread-cert/requirements.txt
-    - name: Build
-      run: |
-        OT_OPTIONS="-DOT_CHANNEL_MANAGER_CSL=ON" ./script/test build
-    - name: Run
-      run: |
-        ulimit -c unlimited
-        ./script/test cert_suite ./tests/scripts/thread-cert/addon_test_channel_manager_autocsl*.py
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-      if: ${{ failure() }}
-      with:
-        name: channel-manager-csl
-        path: ot_testing
-    - name: Generate Coverage
-      run: |
-        ./script/test generate_coverage gcc
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-      with:
-        name: cov-channel-manager-csl
-        path: tmp/coverage.info
-        retention-days: 1
-
-  expects:
-    runs-on: ubuntu-24.04
-    env:
-      COVERAGE: 1
-      VIRTUAL_TIME: 0
-    steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-      with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
-
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        submodules: recursive
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-      with:
-        python-version: '3.12'
-        cache: pip
-    - name: Bootstrap
-      run: |
-        sudo apt-get --no-install-recommends install -y expect ninja-build lcov
-        sudo bash script/install_socat
-        pip install bleak 'cryptography==43.0.0'
-    - name: Run RCP Mode
-      run: |
-        ulimit -c unlimited
-        ./script/test prepare_coredump_upload
-        OT_OPTIONS=-DOT_READLINE=OFF OT_NODE_TYPE=rcp ./script/test build expect
-    - name: Check Crash
-      if: ${{ failure() }}
-      run: |
-          CRASHED=$(./script/test check_crash | tail -1)
-          [[ $CRASHED -eq "1" ]] && echo "Crashed!" || echo "Not crashed."
-          echo "CRASHED=$CRASHED" >> $GITHUB_ENV
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-      if: ${{ failure() && env.CRASHED == '1' }}
-      with:
-        name: core-expect
-        path: |
-          ./ot-core-dump/*
-    - name: Generate Coverage
-      run: |
-        ./script/test generate_coverage gcc
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-      with:
-        name: cov-expects
-        path: tmp/coverage.info
-        retention-days: 1
-
-  upload-coverage:
-    needs:
-    - ot-commissioner
-    - simulation-local-host
-    - channel-manager-csl
-    - expects
-    runs-on: ubuntu-22.04
-    steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-      with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
-
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        submodules: recursive
-    - name: Bootstrap
-      run: |
-        sudo apt-get --no-install-recommends install -y lcov
-    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        path: coverage/
-        pattern: cov-*
-        merge-multiple: true
-    - name: Combine Coverage
-      run: |
-        script/test combine_coverage
-    - name: Upload Coverage
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-      env:
-        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-      with:
-        files: final.info
-        fail_ci_if_error: true
@@ -1,5 +1,5 @@
 #
-#  Copyright (c) 2026, The OpenThread Authors.
+#  Copyright (c) 2020, The OpenThread Authors.
 #  All rights reserved.
 #
 #  Redistribution and use in source and binary forms, with or without
@@ -26,51 +26,84 @@
 #  POSSIBILITY OF SUCH DAMAGE.
 #

-name: Size Report
+name: Size

 on:
-  workflow_run:
-    workflows: ["Size Check"]
-    types:
-      - completed
+  push:
+    branches-ignore:
+      - 'dependabot/**'
+  pull_request_target:
+    branches:
+      - 'main'

 permissions:
  contents: read
-  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
+  cancel-in-progress: true

 jobs:

+  size-check:
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - name: Fetch Pull Request ref
+      if: ${{ github.event_name == 'pull_request_target' }}
+      run: |
+        git fetch --depth 2 origin pull/${{ github.event.pull_request.number }}/merge
+        echo "OT_SHA_NEW=$(git rev-parse FETCH_HEAD)" >> $GITHUB_ENV
+    - name: Run
+      env:
+        PR_BODY: "${{ github.event.pull_request.body }}"
+        PR_NUMBER: "${{ github.event.pull_request.number }}"
+      run: |
+        ./script/check-size
+        cat /tmp/ot-size-report/report_pr >> $GITHUB_STEP_SUMMARY
+    - name: Upload report
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: report_pr
+        path: /tmp/ot-size-report/report_pr
+
+
  size-report:
-    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
+    needs:
+    - size-check
+    permissions:
+      pull-requests: write
+    if: github.event_name == 'pull_request_target'
    runs-on: ubuntu-24.04
    steps:
    - name: Download report
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: report_pr
        path: /tmp/ot-size-report
-        run-id: ${{ github.event.workflow_run.id }}
-        github-token: ${{ secrets.GITHUB_TOKEN }}

    - name: Post Report
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
      id: post-report
      with:
        script: |
          const fs = require('fs')

          const report = fs.readFileSync('/tmp/ot-size-report/report_pr', 'utf8');
-          const pr_number = parseInt(fs.readFileSync('/tmp/ot-size-report/pr_number', 'utf8').trim());
-
          const params = {
-              issue_number: pr_number,
+              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: report,
          }

          const response = await github.rest.issues.listComments({
-            issue_number: pr_number,
+            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
          });
@@ -59,7 +59,7 @@ jobs:
      TORANJ_EVENT_NAME: ${{ github.event_name }}
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -94,7 +94,7 @@ jobs:
      TORANJ_CLI: 1
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -119,7 +119,7 @@ jobs:
      if: "matrix.TORANJ_RADIO != 'multi'"
      run: |
        ./script/test generate_coverage gcc
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      if: "matrix.TORANJ_RADIO != 'multi'"
      with:
        name: cov-toranj-cli-${{ matrix.TORANJ_RADIO }}
@@ -131,7 +131,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -189,7 +189,7 @@ jobs:
    runs-on: macos-14
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -206,13 +206,39 @@ jobs:
      run: |
        ./tests/toranj/build.sh posix-15.4

+  nexus:
+    name: nexus
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: recursive
+    - name: Bootstrap
+      env:
+        PR_BODY: "${{ github.event.pull_request.body }}"
+      run: |
+        sudo apt-get update
+        sudo apt-get --no-install-recommends install -y ninja-build lcov
+    - name: Build & Run
+      run: |
+        ./tests/nexus/build.sh
+        ctest -L core --output-on-failure
+        git clean -dfx
+        ./tests/nexus/build.sh trel
+        ctest -L trel --output-on-failure
+
  upload-coverage:
    needs:
    - toranj-cli
    runs-on: ubuntu-22.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -222,7 +248,7 @@ jobs:
    - name: Bootstrap
      run: |
        sudo apt-get --no-install-recommends install -y lcov
-    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+    - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        path: coverage/
        pattern: cov-*
@@ -231,7 +257,7 @@ jobs:
      run: |
        script/test combine_coverage
    - name: Upload Coverage
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
      with:
@@ -49,7 +49,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -67,7 +67,7 @@ jobs:
      COVERAGE: 1
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -98,7 +98,7 @@ jobs:
    - name: Generate Coverage
      run: |
        ./script/test generate_coverage gcc
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: cov-unit-tests
        path: tmp/coverage.info
@@ -109,7 +109,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -119,7 +119,7 @@ jobs:
    - name: Bootstrap
      run: |
        sudo apt-get --no-install-recommends install -y lcov
-    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+    - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        path: coverage/
        pattern: cov-*
@@ -128,7 +128,7 @@ jobs:
      run: |
        script/test combine_coverage
    - name: Upload Coverage
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
      with:
@@ -45,7 +45,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -49,11 +49,6 @@ set(CMAKE_CXX_STANDARD 11)
 set(CMAKE_C_EXTENSIONS OFF)
 set(CMAKE_C_STANDARD 99)

-if(APPLE)
-    set(CMAKE_AR "/usr/bin/ar")
-    set(CMAKE_RANLIB "/usr/bin/ranlib")
-endif()
-
 message(STATUS "OpenThread Source Directory: ${PROJECT_SOURCE_DIR}")

 target_include_directories(ot-config INTERFACE
@@ -215,7 +215,6 @@
 * @defgroup plat-radio                  Radio
 * @defgroup plat-settings               Settings
 * @defgroup plat-spi-slave              SPI Slave
- * @defgroup plat-tcp                    TCP - Platform
 * @defgroup plat-time                   Time Service
 * @defgroup plat-toolchain              Toolchain
 * @defgroup plat-trel                   TREL - Platform
@@ -170,6 +170,7 @@ ot_option(OT_ANDROID_NDK OPENTHREAD_CONFIG_ANDROID_NDK_ENABLE "enable android ND
 ot_option(OT_ANYCAST_LOCATOR OPENTHREAD_CONFIG_TMF_ANYCAST_LOCATOR_ENABLE "anycast locator")
 ot_option(OT_ASSERT OPENTHREAD_CONFIG_ASSERT_ENABLE "assert function OT_ASSERT()")
 ot_option(OT_BACKBONE_ROUTER OPENTHREAD_CONFIG_BACKBONE_ROUTER_ENABLE "backbone router functionality")
+ot_option(OT_BACKBONE_ROUTER_DUA_NDPROXYING OPENTHREAD_CONFIG_BACKBONE_ROUTER_DUA_NDPROXYING_ENABLE "BBR DUA ND Proxy")
 ot_option(OT_BACKBONE_ROUTER_MULTICAST_ROUTING OPENTHREAD_CONFIG_BACKBONE_ROUTER_MULTICAST_ROUTING_ENABLE "BBR MR")
 ot_option(OT_BLE_TCAT OPENTHREAD_CONFIG_BLE_TCAT_ENABLE "Ble based thread commissioning")
 ot_option(OT_BORDER_ADMITTER OPENTHREAD_CONFIG_BORDER_AGENT_ADMITTER_ENABLE "border agent admitter")
@@ -210,13 +211,13 @@ ot_option(OT_DNS_DSO OPENTHREAD_CONFIG_DNS_DSO_ENABLE "DNS Stateful Operations (
 ot_option(OT_DNS_UPSTREAM_QUERY OPENTHREAD_CONFIG_DNS_UPSTREAM_QUERY_ENABLE "Allow sending DNS queries to upstream")
 ot_option(OT_DNSSD_DISCOVERY_PROXY OPENTHREAD_CONFIG_DNSSD_DISCOVERY_PROXY_ENABLE "DNS-SD discovery proxy")
 ot_option(OT_DNSSD_SERVER OPENTHREAD_CONFIG_DNSSD_SERVER_ENABLE "DNS-SD server")
+ot_option(OT_DUA OPENTHREAD_CONFIG_DUA_ENABLE "Domain Unicast Address (DUA)")
 ot_option(OT_DYNAMIC_STORE_FRAME_AHEAD_COUNTER OPENTHREAD_CONFIG_DYNAMIC_STORE_FRAME_AHEAD_COUNTER_ENABLE "dynamic store frame ahead counter")
 ot_option(OT_ECDSA OPENTHREAD_CONFIG_ECDSA_ENABLE "ECDSA")
 ot_option(OT_EXTERNAL_HEAP OPENTHREAD_CONFIG_HEAP_EXTERNAL_ENABLE "external heap")
 ot_option(OT_FIREWALL OPENTHREAD_POSIX_CONFIG_FIREWALL_ENABLE "firewall")
 ot_option(OT_HISTORY_TRACKER OPENTHREAD_CONFIG_HISTORY_TRACKER_ENABLE "history tracker")
 ot_option(OT_IP6_FRAGM OPENTHREAD_CONFIG_IP6_FRAGMENTATION_ENABLE "ipv6 fragmentation")
-ot_option(OT_IP6_INIT_ADDR_POOL OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE "IPv6 init address pool")
 ot_option(OT_JAM_DETECTION OPENTHREAD_CONFIG_JAM_DETECTION_ENABLE "jam detection")
 ot_option(OT_JOINER OPENTHREAD_CONFIG_JOINER_ENABLE "joiner")
 ot_option(OT_LINK_METRICS_INITIATOR OPENTHREAD_CONFIG_MLE_LINK_METRICS_INITIATOR_ENABLE "link metrics initiator")
@@ -250,7 +251,6 @@ ot_option(OT_PLATFORM_KEY_REF OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE "
 ot_option(OT_PLATFORM_LOG_CRASH_DUMP OPENTHREAD_CONFIG_PLATFORM_LOG_CRASH_DUMP_ENABLE "platform log crash dump")
 ot_option(OT_PLATFORM_NETIF OPENTHREAD_CONFIG_PLATFORM_NETIF_ENABLE "platform netif")
 ot_option(OT_PLATFORM_POWER_CALIBRATION OPENTHREAD_CONFIG_PLATFORM_POWER_CALIBRATION_ENABLE "power calibration")
-ot_option(OT_PLATFORM_TCP OPENTHREAD_CONFIG_PLATFORM_TCP_ENABLE "Platform TCP")
 ot_option(OT_PLATFORM_UDP OPENTHREAD_CONFIG_PLATFORM_UDP_ENABLE "platform UDP")
 ot_option(OT_REFERENCE_DEVICE OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE "test harness reference device")
 ot_option(OT_SEEKER OPENTHREAD_CONFIG_SEEKER_ENABLE "seeker")
@@ -361,7 +361,6 @@ ot_int_option(OT_MLE_MAX_CHILDREN OPENTHREAD_CONFIG_MLE_MAX_CHILDREN "set maximu
 ot_int_option(OT_RCP_RESTORATION_MAX_COUNT OPENTHREAD_SPINEL_CONFIG_RCP_RESTORATION_MAX_COUNT "set max RCP restoration count")
 ot_int_option(OT_RCP_TIME_SYNC_INTERVAL OPENTHREAD_SPINEL_CONFIG_RCP_TIME_SYNC_INTERVAL "set host-RCP time sync interval in microseconds")
 ot_int_option(OT_RCP_TX_WAIT_TIME_SECS OPENTHREAD_SPINEL_CONFIG_RCP_TX_WAIT_TIME_SECS "set RCP TX wait TIME in seconds")
-ot_int_option(OT_VENDOR_OUI OPENTHREAD_CONFIG_NET_DIAG_VENDOR_OUI "set the vendor OUI")

 # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

@@ -37,7 +37,7 @@ COPY . openthread
 RUN set -x \
    && cd openthread \
    && ./script/bootstrap \
-    && mkdir -p build \
+    && mkdir build \
    && cd build \
    && cmake -GNinja -DOT_COMMISSIONER=ON -DOT_JOINER=ON -DOT_PLATFORM=simulation .. \
    && ninja
@@ -138,6 +138,9 @@ if (openthread_enable_core_config_args) {
    # Enable ECDSA support
    openthread_config_ecdsa_enable = false

+    # Enable Domain Unicast Address feature for Thread 1.2
+    openthread_config_dua_enable = false
+
    # Enable Multicast Listener Registration feature for Thread 1.2
    openthread_config_mlr_enable = false

@@ -342,6 +342,7 @@ static int CliUartOutput(void *aContext, const char *aFormat, va_list aArguments
                else
                {
                    // Flush did not succeed, so abandon buffered output.
+                    otLogWarnPlat("Failed to output CLI: %s", otThreadErrorToString(error));
                    break;
                }
            }
@@ -56,7 +56,7 @@ target_link_libraries(ot-cli-ftd PRIVATE
 )

 if(OT_LINKER_MAP)
-    if(APPLE)
+    if("${CMAKE_CXX_COMPILER_ID}" MATCHES "AppleClang")
        target_link_libraries(ot-cli-ftd PRIVATE -Wl,-map,ot-cli-ftd.map)
    else()
        target_link_libraries(ot-cli-ftd PRIVATE -Wl,-Map=ot-cli-ftd.map)
@@ -56,7 +56,7 @@ target_link_libraries(ot-cli-mtd PRIVATE
 )

 if(OT_LINKER_MAP)
-    if(APPLE)
+    if("${CMAKE_CXX_COMPILER_ID}" MATCHES "AppleClang")
        target_link_libraries(ot-cli-mtd PRIVATE -Wl,-map,ot-cli-mtd.map)
    else()
        target_link_libraries(ot-cli-mtd PRIVATE -Wl,-Map=ot-cli-mtd.map)
@@ -60,7 +60,7 @@ target_link_libraries(ot-cli-radio PRIVATE
 )

 if(OT_LINKER_MAP)
-    if(APPLE)
+    if("${CMAKE_CXX_COMPILER_ID}" MATCHES "AppleClang")
        target_link_libraries(ot-cli-radio PRIVATE -Wl,-map,ot-cli-radio.map)
    else()
        target_link_libraries(ot-cli-radio PRIVATE -Wl,-Map=ot-cli-radio.map)
@@ -49,7 +49,7 @@ target_link_libraries(ot-ncp-ftd PRIVATE
 )

 if(OT_LINKER_MAP)
-    if(APPLE)
+    if("${CMAKE_CXX_COMPILER_ID}" MATCHES "AppleClang")
        target_link_libraries(ot-ncp-ftd PRIVATE -Wl,-map,ot-ncp-ftd.map)
    else()
        target_link_libraries(ot-ncp-ftd PRIVATE -Wl,-Map=ot-ncp-ftd.map)
@@ -49,7 +49,7 @@ target_link_libraries(ot-ncp-mtd PRIVATE
 )

 if(OT_LINKER_MAP)
-    if(APPLE)
+    if("${CMAKE_CXX_COMPILER_ID}" MATCHES "AppleClang")
        target_link_libraries(ot-ncp-mtd PRIVATE -Wl,-map,ot-ncp-mtd.map)
    else()
        target_link_libraries(ot-ncp-mtd PRIVATE -Wl,-Map=ot-ncp-mtd.map)
@@ -48,7 +48,7 @@ target_link_libraries(ot-rcp PRIVATE
 )

 if(OT_LINKER_MAP)
-    if(APPLE)
+    if("${CMAKE_CXX_COMPILER_ID}" MATCHES "AppleClang")
        target_link_libraries(ot-rcp PRIVATE -Wl,-map,ot-rcp.map)
    else()
        target_link_libraries(ot-rcp PRIVATE -Wl,-Map=ot-rcp.map)
@@ -60,6 +60,7 @@
 #define OPENTHREAD_CONFIG_DNS_CLIENT_ENABLE 1
 #define OPENTHREAD_CONFIG_DNS_DSO_ENABLE 1
 #define OPENTHREAD_CONFIG_DNS_UPSTREAM_QUERY_ENABLE 1
+#define OPENTHREAD_CONFIG_DUA_ENABLE 1
 #define OPENTHREAD_CONFIG_ECDSA_ENABLE 1
 #define OPENTHREAD_CONFIG_HISTORY_TRACKER_ENABLE 1
 #define OPENTHREAD_CONFIG_IP6_BR_COUNTERS_ENABLE 1
@@ -59,6 +59,7 @@
 #define OPENTHREAD_CONFIG_DNS_CLIENT_ENABLE 1
 #define OPENTHREAD_CONFIG_DNS_DSO_ENABLE 0
 #define OPENTHREAD_CONFIG_DNS_UPSTREAM_QUERY_ENABLE 0
+#define OPENTHREAD_CONFIG_DUA_ENABLE 1
 #define OPENTHREAD_CONFIG_ECDSA_ENABLE 1
 #define OPENTHREAD_CONFIG_HISTORY_TRACKER_ENABLE 0
 #define OPENTHREAD_CONFIG_IP6_BR_COUNTERS_ENABLE 0
@@ -59,6 +59,7 @@
 #define OPENTHREAD_CONFIG_DNS_CLIENT_ENABLE 1
 #define OPENTHREAD_CONFIG_DNS_DSO_ENABLE 0
 #define OPENTHREAD_CONFIG_DNS_UPSTREAM_QUERY_ENABLE 0
+#define OPENTHREAD_CONFIG_DUA_ENABLE 1
 #define OPENTHREAD_CONFIG_ECDSA_ENABLE 1
 #define OPENTHREAD_CONFIG_HISTORY_TRACKER_ENABLE 0
 #define OPENTHREAD_CONFIG_IP6_BR_COUNTERS_ENABLE 0
@@ -90,7 +90,6 @@ add_library(openthread-simulation
    simul_utils.c
    spi-stubs.c
    system.c
-    tcp.c
    trel.c
    uart.c
    virtual_time/alarm-sim.c
@@ -28,15 +28,12 @@

 #include "platform-simulation.h"

-#if OPENTHREAD_CONFIG_BLE_TCAT_ENABLE
-
 #include <errno.h>

 #include <stdio.h>
 #include <stdlib.h>

 #include <openthread/error.h>
-#include <openthread/logging.h>
 #include <openthread/tcat.h>
 #include <openthread/platform/ble.h>

@@ -46,10 +43,7 @@
 #define PLAT_BLE_MSG_DATA_MAX 2048
 static uint8_t sBleBuffer[PLAT_BLE_MSG_DATA_MAX];

-static int  sFd              = -1;
-static bool sIsConnected     = false;
-static bool sIsDisconnecting = false;
-static bool sIsEnabled       = false;
+static int sFd = -1;

 static const uint16_t kPortBase = 10000;
 static uint16_t       sPort     = 0;
@@ -109,59 +103,33 @@ otError otPlatBleGetAdvertisementBuffer(otInstance *aInstance, uint8_t **aAdvert
 otError otPlatBleEnable(otInstance *aInstance)
 {
    OT_UNUSED_VARIABLE(aInstance);
-    if (!sIsEnabled)
-    {
-        initFds();
-        sIsEnabled       = true;
-        sIsConnected     = false;
-        sIsDisconnecting = false;
-    }
+    initFds();
    return OT_ERROR_NONE;
 }

 otError otPlatBleDisable(otInstance *aInstance)
 {
+    deinitFds();
    OT_UNUSED_VARIABLE(aInstance);
-    if (sIsEnabled)
-    {
-        deinitFds();
-        sIsEnabled = false;
-    }
    return OT_ERROR_NONE;
 }

 otError otPlatBleGapAdvStart(otInstance *aInstance, uint16_t aInterval)
 {
    OT_UNUSED_VARIABLE(aInstance);
-    if (sIsConnected || !sIsEnabled)
-    {
-        return OT_ERROR_INVALID_STATE;
-    }
-    otLogDebgPlat("BLE adv start (interval %u)", aInterval);
+    OT_UNUSED_VARIABLE(aInterval);
    return OT_ERROR_NONE;
 }

 otError otPlatBleGapAdvStop(otInstance *aInstance)
 {
    OT_UNUSED_VARIABLE(aInstance);
-    if (!sIsEnabled)
-    {
-        return OT_ERROR_INVALID_STATE;
-    }
-    otLogDebgPlat("BLE adv stop");
    return OT_ERROR_NONE;
 }

 otError otPlatBleGapDisconnect(otInstance *aInstance)
 {
    OT_UNUSED_VARIABLE(aInstance);
-    if (!sIsConnected)
-    {
-        return OT_ERROR_INVALID_STATE;
-    }
-    // Only flag the disconnection here. The 'disconnected' event is delivered asynchronously
-    // by platformBleProcess() (via otPlatBleGapOnDisconnected), per API contract.
-    sIsDisconnecting = true;
    return OT_ERROR_NONE;
 }

@@ -196,6 +164,7 @@ void platformBleDeinit(void) { deinitFds(); }

 void platformBleUpdateFdSet(fd_set *aReadFdSet, fd_set *aWriteFdSet, struct timeval *aTimeout, int *aMaxFd)
 {
+    OT_UNUSED_VARIABLE(aTimeout);
    OT_UNUSED_VARIABLE(aWriteFdSet);

    if (aReadFdSet != NULL && sFd != -1)
@@ -207,13 +176,6 @@ void platformBleUpdateFdSet(fd_set *aReadFdSet, fd_set *aWriteFdSet, struct time
            *aMaxFd = sFd;
        }
    }
-
-    // A pending disconnection must be delivered promptly; ensure the main loop does not block.
-    if (sIsDisconnecting && aTimeout != NULL)
-    {
-        aTimeout->tv_sec  = 0;
-        aTimeout->tv_usec = 0;
-    }
 }

 void platformBleProcess(otInstance *aInstance, const fd_set *aReadFdSet, const fd_set *aWriteFdSet)
@@ -222,14 +184,6 @@ void platformBleProcess(otInstance *aInstance, const fd_set *aReadFdSet, const f

    otEXPECT(sFd != -1);

-    // Deliver a pending disconnection (requested earlier via otPlatBleGapDisconnect)
-    if (sIsDisconnecting)
-    {
-        sIsConnected = false;
-        otPlatBleGapOnDisconnected(aInstance, 0);
-        sIsDisconnecting = false;
-    }
-
    if (FD_ISSET(sFd, aReadFdSet))
    {
        socklen_t len = sizeof(sSockaddr);
@@ -239,14 +193,6 @@ void platformBleProcess(otInstance *aInstance, const fd_set *aReadFdSet, const f
        if (rval > 0)
        {
            otBleRadioPacket myPacket;
-
-            if (!sIsConnected)
-            {
-                sIsConnected = true;
-                otLogDebgPlat("BLE client connected");
-                otPlatBleGapOnConnected(aInstance, 0);
-            }
-
            myPacket.mValue  = sBleBuffer;
            myPacket.mLength = (uint16_t)rval;
            myPacket.mPower  = 0;
@@ -265,27 +211,10 @@ void platformBleProcess(otInstance *aInstance, const fd_set *aReadFdSet, const f
            DieNow(OT_EXIT_FAILURE);
        }
    }
-
 exit:
    return;
 }

-/* Weak stubs for callbacks defined in the FTD/MTD core library, not available for RCP targets. */
-
-OT_TOOL_WEAK void otPlatBleGapOnConnected(otInstance *aInstance, uint16_t aConnectionId)
-{
-    OT_UNUSED_VARIABLE(aInstance);
-    OT_UNUSED_VARIABLE(aConnectionId);
-    assert(false);
-}
-
-OT_TOOL_WEAK void otPlatBleGapOnDisconnected(otInstance *aInstance, uint16_t aConnectionId)
-{
-    OT_UNUSED_VARIABLE(aInstance);
-    OT_UNUSED_VARIABLE(aConnectionId);
-    assert(false);
-}
-
 OT_TOOL_WEAK void otPlatBleGattServerOnWriteRequest(otInstance             *aInstance,
                                                    uint16_t                aHandle,
                                                    const otBleRadioPacket *aPacket)
@@ -294,6 +223,9 @@ OT_TOOL_WEAK void otPlatBleGattServerOnWriteRequest(otInstance             *aIns
    OT_UNUSED_VARIABLE(aHandle);
    OT_UNUSED_VARIABLE(aPacket);
    assert(false);
+    /* In case of rcp there is a problem with linking to otPlatBleGattServerOnWriteRequest
+     * which is available in FTD/MTD library.
+     */
 }

 void otPlatBleGetLinkCapabilities(otInstance *aInstance, otBleLinkCapabilities *aBleLinkCapabilities)
@@ -309,10 +241,6 @@ otError otPlatBleGapAdvSetData(otInstance *aInstance, uint8_t *aAdvertisementDat
    OT_UNUSED_VARIABLE(aInstance);
    OT_UNUSED_VARIABLE(aAdvertisementData);
    OT_UNUSED_VARIABLE(aAdvertisementLen);
-    if (!sIsEnabled)
-    {
-        return OT_ERROR_INVALID_STATE;
-    }
    return OT_ERROR_NONE;
 }

@@ -321,17 +249,11 @@ otError otPlatBleGapAdvUpdateData(otInstance *aInstance, uint8_t *aAdvertisement
    OT_UNUSED_VARIABLE(aInstance);
    OT_UNUSED_VARIABLE(aAdvertisementData);
    OT_UNUSED_VARIABLE(aAdvertisementLen);
-    if (!sIsEnabled)
-    {
-        return OT_ERROR_INVALID_STATE;
-    }
    return OT_ERROR_NONE;
 }

 bool otPlatBleSupportsMultiRadio(otInstance *aInstance)
 {
    OT_UNUSED_VARIABLE(aInstance);
-    return true;
+    return false;
 }
-
-#endif // OPENTHREAD_CONFIG_BLE_TCAT_ENABLE
@@ -172,22 +172,18 @@ exit:
 //---------------------------------------------------------------------------------------------------------------------
 // otPlatInfraIf

-bool otPlatInfraIfHasAddress(otInstance *aInstance, uint32_t aInfraIfIndex, const otIp6Address *aAddress)
+bool otPlatInfraIfHasAddress(uint32_t aInfraIfIndex, const otIp6Address *aAddress)
 {
-    OT_UNUSED_VARIABLE(aInstance);
    OT_UNUSED_VARIABLE(aInfraIfIndex);

    return addressesMatch(aAddress, &sIp6Address);
 }

-otError otPlatInfraIfSendIcmp6Nd(otInstance         *aInstance,
-                                 uint32_t            aInfraIfIndex,
+otError otPlatInfraIfSendIcmp6Nd(uint32_t            aInfraIfIndex,
                                 const otIp6Address *aDestAddress,
                                 const uint8_t      *aBuffer,
                                 uint16_t            aBufferLength)
 {
-    OT_UNUSED_VARIABLE(aInstance);
-
    otError  error = OT_ERROR_FAILED;
    Message *message;

@@ -211,9 +207,8 @@ exit:
    return error;
 }

-otError otPlatInfraIfDiscoverNat64Prefix(otInstance *aInstance, uint32_t aInfraIfIndex)
+otError otPlatInfraIfDiscoverNat64Prefix(uint32_t aInfraIfIndex)
 {
-    OT_UNUSED_VARIABLE(aInstance);
    OT_UNUSED_VARIABLE(aInfraIfIndex);

    return OT_ERROR_NONE;
@@ -363,11 +358,4 @@ OT_TOOL_WEAK void otPlatInfraIfRecvIcmp6Nd(otInstance         *aInstance,
    DieNow(OT_EXIT_FAILURE);
 }

-OT_TOOL_WEAK void otMessageFree(otMessage *aMessage)
-{
-    OT_UNUSED_VARIABLE(aMessage);
-    fprintf(stderr, "\n\rWeak otMessageFree() is incorrectly used\n\r");
-    DieNow(OT_EXIT_FAILURE);
-}
-
 #endif // OPENTHREAD_SIMULATION_IMPLEMENT_INFRA_IF && OPENTHREAD_CONFIG_BORDER_ROUTING_ENABLE
@@ -90,25 +90,6 @@ void platformLoggingDeinit(void)
    }
 }

-#if OPENTHREAD_CONFIG_LOG_INSTANCE_AWARE_API_ENABLE
-
-void otPlatLogOutput(otInstance *aInstance, otLogLevel aLogLevel, const char *aLogLine)
-{
-    OT_UNUSED_VARIABLE(aInstance);
-    OT_UNUSED_VARIABLE(aLogLevel);
-
-    if (sLogFile == NULL)
-    {
-        syslog(LOG_CRIT, "[%lu] %s", (unsigned long)gNodeId, aLogLine);
-    }
-    else
-    {
-        fprintf(sLogFile, "%s\r\n", aLogLine);
-    }
-}
-
-#else
-
 void otPlatLog(otLogLevel aLogLevel, otLogRegion aLogRegion, const char *aFormat, ...)
 {
    OT_UNUSED_VARIABLE(aLogLevel);
@@ -137,11 +118,9 @@ void otPlatLog(otLogLevel aLogLevel, otLogRegion aLogRegion, const char *aFormat
    va_end(args);
 }

-#endif // OPENTHREAD_CONFIG_LOG_INSTANCE_AWARE_API_ENABLE
-
-#else // (OPENTHREAD_CONFIG_LOG_OUTPUT == OPENTHREAD_CONFIG_LOG_OUTPUT_PLATFORM_DEFINED)
+#else

 void platformLoggingInit(const char *aName) { OT_UNUSED_VARIABLE(aName); }
 void platformLoggingDeinit(void) {}

-#endif
+#endif // (OPENTHREAD_CONFIG_LOG_OUTPUT == OPENTHREAD_CONFIG_LOG_OUTPUT_PLATFORM_DEFINED)
@@ -77,9 +77,6 @@
 #define OPENTHREAD_CONFIG_MAC_SOFTWARE_TX_TIMING_ENABLE 1
 #endif

-#ifndef OPENTHREAD_CONFIG_MAC_SOFTWARE_RETX_SECURITY_ENABLE
-#define OPENTHREAD_CONFIG_MAC_SOFTWARE_RETX_SECURITY_ENABLE 1
-#endif
 #endif // OPENTHREAD_RADIO

 #ifndef OPENTHREAD_CONFIG_PLATFORM_USEC_TIMER_ENABLE
@@ -645,6 +645,7 @@ void radioSendMessage(otInstance *aInstance)
    {
        uint64_t sfdTxTime = otPlatTimeGet();

+        sRadioContext.mCslPresent = sTransmitFrame.mInfo.mTxInfo.mCslPresent;
        otEXPECT(otMacFrameProcessTxSfd(&sTransmitFrame, sfdTxTime, &sRadioContext) == OT_ERROR_NONE);
    }

@@ -1060,7 +1061,10 @@ static uint8_t generateAckIeData(uint8_t                   *aLinkMetricsIeData,
    uint8_t offset = 0;

 #if OPENTHREAD_CONFIG_MAC_CSL_RECEIVER_ENABLE
-    if ((sRadioContext.mCslPeriod > 0) && otMacFrameSrcAddrMatchCslReceiverPeer(aReceivedFrame, &sRadioContext))
+    sRadioContext.mCslPresent =
+        (sRadioContext.mCslPeriod > 0) && otMacFrameSrcAddrMatchCslReceiverPeer(aReceivedFrame, &sRadioContext);
+
+    if (sRadioContext.mCslPresent)
    {
        offset += otMacFrameGenerateCslIeTemplate(sAckIeData);
    }
@@ -50,7 +50,6 @@
 #define UTILS_SOCKET_LOCAL_HOST_ADDR "127.0.0.1"
 #define UTILS_SOCKET_GROUP_ADDR "224.0.0.116"
 #define UTILS_SOCKET_GROUP_ADDR6 "ff02::116"
-#define UTILS_SOCKET_GROUP_ADDR6_LO "ff01::116"

 const char *gLocalInterface = UTILS_SOCKET_LOCAL_HOST_ADDR;

@@ -77,21 +76,11 @@ static bool IsAddressLinkLocal(const struct in6_addr *aAddress)
    return ((aAddress->s6_addr[0] & 0xff) == 0xfe) && ((aAddress->s6_addr[1] & 0xc0) == 0x80);
 }

-static bool IsAddressLoopback(const struct in6_addr *aAddress)
-{
-    static const uint8_t sLoopbackAddr[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1};
-    return memcmp(aAddress->s6_addr, sLoopbackAddr, sizeof(aAddress->s6_addr)) == 0;
-}
-
-static void InitRxSocket(utilsSocket           *aSocket,
-                         const struct in_addr  *aIp4Address,
-                         const struct in6_addr *aIp6Address,
-                         unsigned int           aIfIndex)
+static void InitRxSocket(utilsSocket *aSocket, const struct in_addr *aIp4Address, unsigned int aIfIndex)
 {
    int fd;
    int one = 1;
    int rval;
-    int rcvBufSize = 2 * 1024 * 1024;

    fd = socket(aIp4Address ? AF_INET : AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
    ExpectOrExitWithErrorMsg(fd != -1, "socket(RxFd)");
@@ -102,9 +91,6 @@ static void InitRxSocket(utilsSocket           *aSocket,
    rval = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
    ExpectOrExitWithErrorMsg(rval != -1, "setsockopt(RxFd, SO_REUSEPORT)");

-    rval = setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvBufSize, sizeof(rcvBufSize));
-    ExpectOrExitWithErrorMsg(rval != -1, "setsockopt(RxFd, SO_RCVBUF)");
-
    if (aIp4Address)
    {
        struct ip_mreqn     mreq;
@@ -132,13 +118,7 @@ static void InitRxSocket(utilsSocket           *aSocket,
    else
    {
        struct ipv6_mreq     mreq;
-        struct sockaddr_in6 *sockaddr  = &aSocket->mGroupAddr.mSockAddr6;
-        const char          *groupAddr = UTILS_SOCKET_GROUP_ADDR6;
-
-        if (aIp6Address != NULL && IsAddressLoopback(aIp6Address))
-        {
-            groupAddr = UTILS_SOCKET_GROUP_ADDR6_LO;
-        }
+        struct sockaddr_in6 *sockaddr = &aSocket->mGroupAddr.mSockAddr6;

        rval = setsockopt(fd, IPPROTO_IPV6, IPV6_MULTICAST_IF, &aIfIndex, sizeof(aIfIndex));
        ExpectOrExitWithErrorMsg(rval != -1, "setsockopt(RxFd, IPV6_MULTICAST_IF)");
@@ -147,7 +127,8 @@ static void InitRxSocket(utilsSocket           *aSocket,
        sockaddr->sin6_family   = AF_INET6;
        sockaddr->sin6_port     = htons(aSocket->mPortBase);
        sockaddr->sin6_scope_id = aIfIndex; // This specifies network interface for link local scope
-        ExpectOrExitWithErrorMsg(inet_pton(AF_INET6, groupAddr, &sockaddr->sin6_addr), "inet_pton(AF_INET6)");
+        ExpectOrExitWithErrorMsg(inet_pton(AF_INET6, UTILS_SOCKET_GROUP_ADDR6, &sockaddr->sin6_addr),
+                                 "inet_pton(AF_INET6)");

        memset(&mreq, 0, sizeof(mreq));
        mreq.ipv6mr_multiaddr = sockaddr->sin6_addr;
@@ -169,7 +150,7 @@ exit:
    }
 }

-static void InitTxSocketIp6(utilsSocket *aSocket, const struct in6_addr *aAddress, unsigned int aIfIndex)
+void InitTxSocketIp6(utilsSocket *aSocket, const struct in6_addr *aAddress, unsigned int aIfIndex)
 {
    int                 fd;
    int                 one = 1;
@@ -183,7 +164,7 @@ static void InitTxSocketIp6(utilsSocket *aSocket, const struct in6_addr *aAddres
    sockaddr.sin6_family = AF_INET6;
    sockaddr.sin6_addr   = *aAddress;
    sockaddr.sin6_port   = htons(aSocket->mPort);
-    if (IsAddressLinkLocal(aAddress) || IsAddressLoopback(aAddress))
+    if (IsAddressLinkLocal(aAddress))
    {
        sockaddr.sin6_scope_id = aIfIndex;
    }
@@ -302,7 +283,7 @@ static bool TryInitSocketIfname(utilsSocket *aSocket, const char *aLocalInterfac
        DieNow(OT_EXIT_FAILURE);
    }

-    InitRxSocket(aSocket, (addr6 ? NULL : addr4), addr6, ifIndex);
+    InitRxSocket(aSocket, (addr6 ? NULL : addr4), ifIndex);
    aSocket->mInitialized = true;
    aSocket->mUseIp6      = (addr6 != NULL);

@@ -318,7 +299,7 @@ static bool TryInitSocketIp4(utilsSocket *aSocket, const char *aLocalInterface)
    ExpectOrExitWithErrorMsg(inet_pton(AF_INET, aLocalInterface, &addr4), "inet_pton(AF_INET)");

    InitTxSocketIp4(aSocket, &addr4);
-    InitRxSocket(aSocket, &addr4, NULL, 0);
+    InitRxSocket(aSocket, &addr4, 0);
    aSocket->mInitialized = true;
    aSocket->mUseIp6      = false;

@@ -363,7 +344,7 @@ static bool TryInitSocketIp6(utilsSocket *aSocket, const char *aLocalInterface)
        }

        InitTxSocketIp6(aSocket, &addr6, ifIndex);
-        InitRxSocket(aSocket, NULL, &addr6, ifIndex);
+        InitRxSocket(aSocket, NULL, ifIndex);
        aSocket->mInitialized = true;
        aSocket->mUseIp6      = true;
        break;
@@ -1,71 +0,0 @@
-/*
- *  Copyright (c) 2026, The OpenThread Authors.
- *  All rights reserved.
- *
- *  Redistribution and use in source and binary forms, with or without
- *  modification, are permitted provided that the following conditions are met:
- *  1. Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *  2. Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *  3. Neither the name of the copyright holder nor the
- *     names of its contributors may be used to endorse or promote products
- *     derived from this software without specific prior written permission.
- *
- *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- *  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- *  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
- *  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- *  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- *  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- *  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- *  POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "platform-simulation.h"
-
-#include <openthread/platform/tcp.h>
-
-#if OPENTHREAD_CONFIG_PLATFORM_TCP_ENABLE
-
-otError otPlatTcpEnableListener(otPlatTcpListener *aListener, const otPlatTcpSockAddr *aLocalSockAddr)
-{
-    OT_UNUSED_VARIABLE(aListener);
-    OT_UNUSED_VARIABLE(aLocalSockAddr);
-
-    return OT_ERROR_FAILED;
-}
-
-void otPlatTcpDisableListener(otPlatTcpListener *aListener) { OT_UNUSED_VARIABLE(aListener); }
-
-otError otPlatTcpConnect(otPlatTcpConnection     *aConn,
-                         const otPlatTcpSockAddr *aPeerSockAddr,
-                         const otPlatTcpSockAddr *aLocalSockAddr)
-{
-    OT_UNUSED_VARIABLE(aConn);
-    OT_UNUSED_VARIABLE(aPeerSockAddr);
-    OT_UNUSED_VARIABLE(aLocalSockAddr);
-
-    return OT_ERROR_FAILED;
-}
-
-void otPlatTcpNotifyTxPending(otPlatTcpConnection *aConn) { OT_UNUSED_VARIABLE(aConn); }
-
-uint16_t otPlatTcpSend(otPlatTcpConnection *aConn, const uint8_t *aBuffer, uint16_t aLength)
-{
-    OT_UNUSED_VARIABLE(aConn);
-    OT_UNUSED_VARIABLE(aBuffer);
-    OT_UNUSED_VARIABLE(aLength);
-
-    return 0;
-}
-
-void otPlatTcpClose(otPlatTcpConnection *aConn) { OT_UNUSED_VARIABLE(aConn); }
-
-void otPlatTcpAbort(otPlatTcpConnection *aConn) { OT_UNUSED_VARIABLE(aConn); }
-
-#endif // #if OPENTHREAD_CONFIG_PLATFORM_TCP_ENABLE
@@ -120,15 +120,6 @@ otError otPlatDebugUart_logfile(const char *filename)
 }

 #if (OPENTHREAD_CONFIG_LOG_OUTPUT == OPENTHREAD_CONFIG_LOG_OUTPUT_DEBUG_UART)
-
-#if OPENTHREAD_CONFIG_LOG_INSTANCE_AWARE_API_ENABLE
-void otPlatLogOutput(otInstance *aInstance, otLogLevel aLogLevel, const char *aLogLine)
-{
-    OT_UNUSED_VARIABLE(aInstance);
-    otPlatLog(aLogLevel, OT_LOG_REGION_CORE, "%s", aLogLine);
-}
-#endif
-
 /* this should not be a WEAK function */
 void otPlatLog(otLogLevel aLogLevel, otLogRegion aLogRegion, const char *aFormat, ...)
 {
@@ -404,14 +404,8 @@ exit:

 otError otMacFrameProcessTxSfd(otRadioFrame *aFrame, uint64_t aRadioTime, otRadioContext *aRadioContext)
 {
-    otError error = OT_ERROR_NONE;
-
-    aFrame->mInfo.mTxInfo.mTimestamp = aRadioTime;
-
-    VerifyOrExit(!otMacFrameIsSecurityEnabled(aFrame) || !aFrame->mInfo.mTxInfo.mIsSecurityProcessed);
-
 #if OPENTHREAD_CONFIG_MAC_CSL_RECEIVER_ENABLE
-    if (static_cast<Mac::Frame *>(aFrame)->HasCslIe()) // CSL IE should be filled for every transmit attempt
+    if (aRadioContext->mCslPresent) // CSL IE should be filled for every transmit attempt
    {
        otMacFrameSetCslIe(aFrame, aRadioContext->mCslPeriod, ComputeCslPhase(aRadioTime, aRadioContext));
    }
@@ -419,10 +413,8 @@ otError otMacFrameProcessTxSfd(otRadioFrame *aFrame, uint64_t aRadioTime, otRadi
 #if OPENTHREAD_CONFIG_TIME_SYNC_ENABLE
    otMacFrameUpdateTimeIe(aFrame, aRadioTime, aRadioContext);
 #endif
-    error = otMacFrameProcessTransmitSecurity(aFrame, aRadioContext);
-
-exit:
-    return error;
+    aFrame->mInfo.mTxInfo.mTimestamp = aRadioTime;
+    return otMacFrameProcessTransmitSecurity(aFrame, aRadioContext);
 }

 bool otMacFrameSrcAddrMatchCslReceiverPeer(const otRadioFrame *aFrame, const otRadioContext *aRadioContext)
@@ -349,6 +349,7 @@ typedef struct otRadioContext
    uint16_t         mCslPeriod;       ///< In unit of 10 symbols.
    otShortAddress   mCslShortAddress; ///< The short address of the CSL receiver's peer.
    otExtAddress     mCslExtAddress;   ///< The extended address of the CSL receiver's peer.
+    bool             mCslPresent : 1;  ///< Indicates whether the CSL header IE is present.
    otShortAddress   mShortAddress;
    otShortAddress   mAlternateShortAddress;
    otRadioKeyType   mKeyType;
@@ -112,7 +112,6 @@ source_set("openthread") {
    "platform/radio.h",
    "platform/settings.h",
    "platform/spi-slave.h",
-    "platform/tcp.h",
    "platform/time.h",
    "platform/toolchain.h",
    "platform/trel.h",
@@ -43,6 +43,7 @@
 #include <openthread/error.h>
 #include <openthread/instance.h>
 #include <openthread/ip6.h>
+#include <openthread/netdata.h>

 #ifdef __cplusplus
 extern "C" {
@@ -174,6 +175,34 @@ uint8_t otBackboneRouterGetRegistrationJitter(otInstance *aInstance);
 */
 void otBackboneRouterSetRegistrationJitter(otInstance *aInstance, uint8_t aJitter);

+/**
+ * Gets the local Domain Prefix configuration.
+ *
+ * @param[in]  aInstance A pointer to an OpenThread instance.
+ * @param[out] aConfig   A pointer to the Domain Prefix configuration.
+ *
+ * @retval OT_ERROR_NONE       Successfully got the Domain Prefix configuration.
+ * @retval OT_ERROR_NOT_FOUND  No Domain Prefix was configured.
+ */
+otError otBackboneRouterGetDomainPrefix(otInstance *aInstance, otBorderRouterConfig *aConfig);
+
+/**
+ * Configures response status for next DUA registration.
+ *
+ * Note: available only when `OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE` is enabled.
+ *       Only used for test and certification.
+ *
+ * TODO: (DUA) support coap error code and corresponding process for certification purpose.
+ *
+ * @param[in] aInstance A pointer to an OpenThread instance.
+ * @param[in] aMlIid    A pointer to the Mesh Local IID. If NULL, respond with @p aStatus for any
+ *                      coming DUA.req, otherwise only respond the one with matching @p aMlIid.
+ * @param[in] aStatus   The status to respond.
+ */
+void otBackboneRouterConfigNextDuaRegistrationResponse(otInstance                     *aInstance,
+                                                       const otIp6InterfaceIdentifier *aMlIid,
+                                                       uint8_t                         aStatus);
+
 /**
 * Configures the response status for the next Multicast Listener Registration.
 *
@@ -288,6 +317,95 @@ otError otBackboneRouterMulticastListenerGetNext(otInstance
                                                 otBackboneRouterMulticastListenerIterator *aIterator,
                                                 otBackboneRouterMulticastListenerInfo     *aListenerInfo);

+/**
+ * Represents the ND Proxy events.
+ */
+typedef enum
+{
+    OT_BACKBONE_ROUTER_NDPROXY_ADDED   = 0, ///< ND Proxy was added.
+    OT_BACKBONE_ROUTER_NDPROXY_REMOVED = 1, ///< ND Proxy was removed.
+    OT_BACKBONE_ROUTER_NDPROXY_RENEWED = 2, ///< ND Proxy was renewed.
+    OT_BACKBONE_ROUTER_NDPROXY_CLEARED = 3, ///< All ND Proxies were cleared.
+} otBackboneRouterNdProxyEvent;
+
+/**
+ * Pointer is called whenever the Nd Proxy changed.
+ *
+ * @param[in] aContext  The user context pointer.
+ * @param[in] aEvent    The ND Proxy event.
+ * @param[in] aDua      The Domain Unicast Address of the ND Proxy, or NULL if @p aEvent is
+ *                      `OT_BACKBONE_ROUTER_NDPROXY_CLEARED`.
+ */
+typedef void (*otBackboneRouterNdProxyCallback)(void                        *aContext,
+                                                otBackboneRouterNdProxyEvent aEvent,
+                                                const otIp6Address          *aDua);
+
+/**
+ * Sets the Backbone Router ND Proxy callback.
+ *
+ * @param[in] aInstance  A pointer to an OpenThread instance.
+ * @param[in] aCallback  A pointer to the ND Proxy callback.
+ * @param[in] aContext   A user context pointer.
+ */
+void otBackboneRouterSetNdProxyCallback(otInstance                     *aInstance,
+                                        otBackboneRouterNdProxyCallback aCallback,
+                                        void                           *aContext);
+
+/**
+ * Represents the Backbone Router ND Proxy info.
+ */
+typedef struct otBackboneRouterNdProxyInfo
+{
+    otIp6InterfaceIdentifier *mMeshLocalIid;             ///< Mesh-local IID
+    uint32_t                  mTimeSinceLastTransaction; ///< Time since last transaction (Seconds)
+    uint16_t                  mRloc16;                   ///< RLOC16
+} otBackboneRouterNdProxyInfo;
+
+/**
+ * Gets the Backbone Router ND Proxy info.
+ *
+ * @param[in]   aInstance     A pointer to an OpenThread instance.
+ * @param[in]   aDua          The Domain Unicast Address.
+ * @param[out]  aNdProxyInfo  A pointer to the ND Proxy info.
+ *
+ * @retval OT_ERROR_NONE       Successfully got the ND Proxy info.
+ * @retval OT_ERROR_NOT_FOUND  Failed to find the Domain Unicast Address in the ND Proxy table.
+ */
+otError otBackboneRouterGetNdProxyInfo(otInstance                  *aInstance,
+                                       const otIp6Address          *aDua,
+                                       otBackboneRouterNdProxyInfo *aNdProxyInfo);
+
+/**
+ * Represents the Domain Prefix events.
+ */
+typedef enum
+{
+    OT_BACKBONE_ROUTER_DOMAIN_PREFIX_ADDED   = 0, ///< Domain Prefix was added.
+    OT_BACKBONE_ROUTER_DOMAIN_PREFIX_REMOVED = 1, ///< Domain Prefix was removed.
+    OT_BACKBONE_ROUTER_DOMAIN_PREFIX_CHANGED = 2, ///< Domain Prefix was changed.
+} otBackboneRouterDomainPrefixEvent;
+
+/**
+ * Pointer is called whenever the Domain Prefix changed.
+ *
+ * @param[in] aContext       The user context pointer.
+ * @param[in] aEvent         The Domain Prefix event.
+ * @param[in] aDomainPrefix  The new Domain Prefix if added or changed, NULL otherwise.
+ */
+typedef void (*otBackboneRouterDomainPrefixCallback)(void                             *aContext,
+                                                     otBackboneRouterDomainPrefixEvent aEvent,
+                                                     const otIp6Prefix                *aDomainPrefix);
+/**
+ * Sets the Backbone Router Domain Prefix callback.
+ *
+ * @param[in] aInstance  A pointer to an OpenThread instance.
+ * @param[in] aCallback  A pointer to the Domain Prefix callback.
+ * @param[in] aContext   A user context pointer.
+ */
+void otBackboneRouterSetDomainPrefixCallback(otInstance                          *aInstance,
+                                             otBackboneRouterDomainPrefixCallback aCallback,
+                                             void                                *aContext);
+
 /**
 * @}
 */
@@ -138,9 +138,6 @@ otError otBleSecureSetTcatVendorInfo(otInstance *aInstance, const otTcatVendorIn
 /**
 * Enables the TCAT protocol over BLE Secure.
 *
- * Vendor info must be set before calling this function. Depending on the policy defined in the vendor info, TCAT may
- * start in standby mode if the device is commissioned and Thread is enabled.
- *
 * @param[in]  aInstance         A pointer to an OpenThread instance.
 * @param[in]  aJoinHandler      A pointer to a function that is called when a network join or leave
 *                               operation is requested under guidance of the TCAT Commissioner.
@@ -258,11 +258,10 @@ otError otBorderAgentGetMeshCoPServiceTxtData(otInstance *aInstance, otBorderAge
 /**
 * Maximum string length of base name used in `otBorderAgentSetMeshCoPServiceBaseName()`.
 *
- * To ensure name uniqueness and handle potential name conflicts, the OpenThread Border Agent module appends a
- * suffix (e.g., " #XXXX" where "XXXX" represents the last two bytes of the device's Extended Address in hex) to
+ * The full DNS label is constructed by appending the Extended Address of the device (as 16-character hex digits) to
 * the given base name.
 */
-#define OT_BORDER_AGENT_MESHCOP_SERVICE_BASE_NAME_MAX_LENGTH (OT_DNS_MAX_LABEL_SIZE - 13)
+#define OT_BORDER_AGENT_MESHCOP_SERVICE_BASE_NAME_MAX_LENGTH (OT_DNS_MAX_LABEL_SIZE - 17)

 /**
 * Sets the base name to construct the service instance name used when advertising the mDNS `_meshcop._udp` service by
@@ -277,9 +276,8 @@ otError otBorderAgentGetMeshCoPServiceTxtData(otInstance *aInstance, otBorderAge
 * Per the Thread specification, the service instance should be a user-friendly name identifying the device model or
 * product. A recommended format is "VendorName ProductName".
 *
- * To construct the full name and ensure name uniqueness, the OpenThread Border Agent module appends a suffix
- * (e.g., " #XXXX" where "XXXX" represents the last two bytes of the device's Extended Address in hex) to the given
- * base name. If a name conflict is detected on the network, an additional index may be appended (e.g., " #XXXX (1)").
+ * To construct the full name and ensure name uniqueness, the OpenThread Border Agent module will append the Extended
+ * Address of the device (as 16-character hex digits) to the given base name.
 *
 * Note that the same name will be used for the ephemeral key service `_meshcop-e._udp` when the ephemeral key feature
 * is enabled and used.
@@ -61,7 +61,6 @@ extern "C" {
 #define OT_BORDER_AGENT_THREAD_VERSION_SIZE (16) ///< Max size of Thread Version string in `otBorderAgentTxtDataInfo`.
 #define OT_BORDER_AGENT_VENDOR_NAME_SIZE (32)    ///< Max size of Vendor Name string in `otBorderAgentTxtDataInfo`.
 #define OT_BORDER_AGENT_MODEL_NAME_SIZE (32)     ///< Max size of Model Name string in `otBorderAgentTxtDataInfo`.
-#define OT_BORDER_AGENT_VENDOR_OUI_SIZE (3)      ///< Size of Vendor OUI (in bytes) in `otBorderAgentTxtDataInfo`.

 /**
 * Represents the Connection Mode in a Border Agent State Bitmap.
@@ -153,7 +152,6 @@ typedef struct otBorderAgentTxtDataInfo
    bool                     mHasExtAddress : 1;      ///< Indicates whether Extended Address is present.
    bool                     mHasVendorName : 1;      ///< Indicates whether Vendor Name is present.
    bool                     mHasModelName : 1;       ///< Indicates whether Model Name is present.
-    bool                     mHasVendorOui : 1;       ///< Indicates whether Vendor OUI is present.
    char                     mRecordVersion[OT_BORDER_AGENT_RECORD_VERSION_SIZE]; ///< Record Version string.
    otBorderAgentId          mAgentId;                                            ///< Agent ID.
    char                     mThreadVersion[OT_BORDER_AGENT_THREAD_VERSION_SIZE]; ///< Thread Version string.
@@ -169,7 +167,6 @@ typedef struct otBorderAgentTxtDataInfo
    otExtAddress             mExtAddress;                                         ///< Extended Address.
    char                     mVendorName[OT_BORDER_AGENT_VENDOR_NAME_SIZE];       ///< Vendor Name string.
    char                     mModelName[OT_BORDER_AGENT_MODEL_NAME_SIZE];         ///< Model Name string.
-    uint8_t                  mVendorOui[OT_BORDER_AGENT_VENDOR_OUI_SIZE];         ///< Vendor OUI (24-bit).
 } otBorderAgentTxtDataInfo;

 /**
@@ -603,6 +603,7 @@ otError otBorderRoutingGetNextRouterEntry(otInstance                         *aI
 *
 * - It has added at least one external route entry.
 * - It has added at least one prefix entry with both the default-route and on-mesh flags set.
+ * - It has added at least one domain prefix (with both the domain and on-mesh flags set).
 *
 * The list of peer BRs specifically excludes the current device, even if it is itself acting as a BR.
 *
@@ -628,6 +629,7 @@ otError otBorderRoutingGetNextPeerBrEntry(otInstance                           *
 *
 * - It has added at least one external route entry.
 * - It has added at least one prefix entry with both the default-route and on-mesh flags set.
+ * - It has added at least one domain prefix (with both the domain and on-mesh flags set).
 *
 * The list of peer BRs specifically excludes the current device, even if it is itself acting as a BR.
 *
@@ -36,8 +36,6 @@
 #define OPENTHREAD_CLI_H_

 #include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
 #include <stdint.h>

 #include <openthread/error.h>
@@ -49,6 +47,17 @@
 extern "C" {
 #endif

+/**
+ * Represents a CLI command.
+ */
+typedef struct otCliCommand
+{
+    const char *mName; ///< A pointer to the command string.
+    otError (*mCommand)(void   *aContext,
+                        uint8_t aArgsLength,
+                        char   *aArgs[]); ///< A function pointer to process the command.
+} otCliCommand;
+
 /**
 * @addtogroup api-cli
 *
@@ -59,12 +68,7 @@ extern "C" {
 */

 /**
- * Opaque type for a CLI interpreter.
- */
-typedef struct otCliInterpreter otCliInterpreter;
-
-/**
- * Pointer is called to notify about CLI interpreter output.
+ * Pointer is called to notify about Console output.
 *
 * @param[out] aContext    A user context pointer.
 * @param[in]  aFormat     The format string.
@@ -76,62 +80,7 @@ typedef int (*otCliOutputCallback)(void *aContext, const char *aFormat, va_list
    OT_TOOL_PRINTF_STYLE_FORMAT_ARG_CHECK(2, 0);

 /**
- * Gets the size of the CLI interpreter object.
- *
- * @returns The size of the CLI interpreter object in bytes.
- */
-size_t otCliInterpreterGetSize(void);
-
-/**
- * Initializes a CLI interpreter.
- *
- * @param[in]  aBuffer    A pointer to a memory buffer for the CLI interpreter.
- * @param[in]  aSize      The size of the memory buffer.
- * @param[in]  aInstance  The OpenThread instance structure.
- * @param[in]  aCallback  A callback method called to process CLI output.
- * @param[in]  aContext   A user context pointer.
- *
- * @returns A pointer to the initialized CLI interpreter, or `NULL` if @p aSize is too small.
- */
-otCliInterpreter *otCliInterpreterInit(void               *aBuffer,
-                                       size_t              aSize,
-                                       otInstance         *aInstance,
-                                       otCliOutputCallback aCallback,
-                                       void               *aContext);
-
-/**
- * Configures whether or not the CLI interpreter outputs the prompt string.
- *
- * Requires `OPENTHREAD_CONFIG_CLI_PROMPT_ENABLE`.
- *
- * It is enabled by default.
- *
- * @param[in]  aInterpreter  A pointer to a CLI interpreter.
- * @param[in]  aEnable       TRUE to enable outputting the prompt, FALSE to disable.
- */
-void otCliInterpreterSetPromptConfig(otCliInterpreter *aInterpreter, bool aEnable);
-
-/**
- * Feeds input to the CLI interpreter.
- *
- * @param[in]  aInterpreter  A pointer to a CLI interpreter.
- * @param[in]  aLine         A pointer to a null-terminated string.
- */
-void otCliInterpreterInputLine(otCliInterpreter *aInterpreter, char *aLine);
-
-/**
- * Finalizes the CLI interpreter.
- *
- * @param[in]  aInterpreter  A pointer to a CLI interpreter.
- */
-void otCliInterpreterFinalize(otCliInterpreter *aInterpreter);
-
-//--------------------------------------------------------------------------------------------------------------------
-
-/**
- * Initialize the static CLI interpreter.
- *
- * Requires `OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE`.
+ * Initialize the CLI module.
 *
 * @param[in]  aInstance   The OpenThread instance structure.
 * @param[in]  aCallback   A callback method called to process CLI output.
@@ -140,52 +89,26 @@ void otCliInterpreterFinalize(otCliInterpreter *aInterpreter);
 void otCliInit(otInstance *aInstance, otCliOutputCallback aCallback, void *aContext);

 /**
- * Gets the pointer to the static CLI interpreter.
+ * Is called to feed in a console input line.
 *
- * Requires `OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE`.
- *
- * @returns A pointer to the static CLI interpreter.
+ * @param[in]  aBuf        A pointer to a null-terminated string.
 */
-otCliInterpreter *otCliGetStaticInterpreter(void);
+void otCliInputLine(char *aBuf);

 /**
- * Feeds input to the static CLI interpreter.
- *
- * Requires `OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE`.
- *
- * @param[in]  aLine        A pointer to a null-terminated string.
- */
-void otCliInputLine(char *aLine);
-
-/**
- * Represents a user provided CLI command entry.
- */
-typedef struct otCliCommand
-{
-    const char *mName;                                                       ///< The command string.
-    otError (*mCommand)(void *aContext, uint8_t aArgsLength, char *aArgs[]); ///< Command handler function pointer.
-} otCliCommand;
-
-/**
- * Set a user command table on the static CLI interpreter.
- *
- * Requires `OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE`.
+ * Set a user command table.
 *
 * @param[in]  aUserCommands  A pointer to an array with user commands.
- * @param[in]  aLength        The @p aUserCommands length.
- * @param[in]  aContext       The context passed to the handler.
+ * @param[in]  aLength        @p aUserCommands length.
+ * @param[in]  aContext       @p The context passed to the handler.
 *
- * @retval OT_ERROR_NONE     Successfully updated command table with commands from @p aUserCommands.
- * @retval OT_ERROR_NO_BUFS  Maximum number of command entries have already been set.
+ * @retval OT_ERROR_NONE    Successfully updated command table with commands from @p aUserCommands.
+ * @retval OT_ERROR_FAILED  Maximum number of command entries have already been set.
 */
 otError otCliSetUserCommands(const otCliCommand *aUserCommands, uint8_t aLength, void *aContext);

 /**
- * Write a number of bytes to the static CLI interpreter output as a hex string.
- *
- * Requires `OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE`.
- *
- * This is intended for use by user-provided CLI command handlers.
+ * Write a number of bytes to the CLI console as a hex string.
 *
 * @param[in]  aBytes   A pointer to data which should be printed.
 * @param[in]  aLength  @p aBytes length.
@@ -193,11 +116,7 @@ otError otCliSetUserCommands(const otCliCommand *aUserCommands, uint8_t aLength,
 void otCliOutputBytes(const uint8_t *aBytes, uint8_t aLength);

 /**
- * Write formatted string to the static CLI interpreter output.
- *
- * Requires `OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE`.
- *
- * This is intended for use by user-provided CLI command handlers.
+ * Write formatted string to the CLI console
 *
 * @param[in]  aFmt   A pointer to the format string.
 * @param[in]  ...    A matching list of arguments.
@@ -205,11 +124,7 @@ void otCliOutputBytes(const uint8_t *aBytes, uint8_t aLength);
 void otCliOutputFormat(const char *aFmt, ...) OT_TOOL_PRINTF_STYLE_FORMAT_ARG_CHECK(1, 2);

 /**
- * Write a given error code as the result of previous command to the static CLI interpreter output.
- *
- * Requires `OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE`.
- *
- * This is intended for use by user-provided CLI command handlers.
+ * Write error code to the CLI console
 *
 * If the @p aError is `OT_ERROR_PENDING` nothing will be outputted.
 *
@@ -218,7 +133,7 @@ void otCliOutputFormat(const char *aFmt, ...) OT_TOOL_PRINTF_STYLE_FORMAT_ARG_CH
 void otCliAppendResult(otError aError);

 /**
- * Callback to write the OpenThread Log to the static CLI interpreter output.
+ * Callback to write the OpenThread Log to the CLI console
 *
 * @param[in]  aLogLevel   The log level.
 * @param[in]  aLogRegion  The log region.
@@ -233,8 +148,6 @@ void otCliPlatLogv(otLogLevel aLogLevel, otLogRegion aLogRegion, const char *aFo
 *
 * Available when `OPENTHREAD_CONFIG_CLI_VENDOR_COMMANDS_ENABLE` is enabled and
 * `OPENTHREAD_CONFIG_CLI_MAX_USER_CMD_ENTRIES` is greater than 1.
- *
- * Requires `OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE`.
 */
 extern void otCliVendorSetUserCommands(void);

@@ -567,24 +567,6 @@ otError otDatasetGeneratePskc(const char            *aPassPhrase,
 */
 otError otNetworkNameFromString(otNetworkName *aNetworkName, const char *aNameString);

-/**
- * Indicates whether or not the given Operational Dataset TLVs is a valid Active or Pending Dataset.
- *
- * A valid Active Dataset MUST contain all the required TLVs (Active Timestamp, Channel, Channel Mask, Extended PAN ID,
- * Mesh-Local Prefix, Network Key, Network Name, PAN ID, PSKc, and Security Policy).
- *
- * A valid Pending Dataset MUST contain all the required TLVs for an Active Dataset and additionally MUST contain
- * Pending Timestamp and Delay Timer TLVs.
- *
- * This method also checks whether there are duplicated TLVs or the TLVs are not well-formed in the @p aDatasetTlvs.
- *
- * @param[in]  aDatasetTlvs  A pointer to dataset TLVs.
- * @param[in]  aActive       TRUE for Active Dataset, FALSE for Pending Dataset.
- *
- * @returns TRUE if @p aDatasetTlvs is a valid Dataset, FALSE otherwise.
- */
-bool otDatasetIsValid(const otOperationalDatasetTlvs *aDatasetTlvs, bool aActive);
-
 /**
 * Parses an Operational Dataset from a given `otOperationalDatasetTlvs`.
 *
@@ -596,21 +578,6 @@ bool otDatasetIsValid(const otOperationalDatasetTlvs *aDatasetTlvs, bool aActive
 */
 otError otDatasetParseTlvs(const otOperationalDatasetTlvs *aDatasetTlvs, otOperationalDataset *aDataset);

-/**
- * Compares two Operational Dataset TLVs to determine if they contain the same set of TLVs.
- *
- * This function performs a deep comparison. It parses both @p aDatasetTlvsA and @p aDatasetTlvsB and checks if
- * they contain the exact same set of TLVs (same type and same value). The order of TLVs within the
- * `otOperationalDatasetTlvs` does not matter.
- *
- * @param[in]  aDatasetTlvsA  A pointer to dataset TLVs A. Must not be NULL.
- * @param[in]  aDatasetTlvsB  A pointer to dataset TLVs B. Must not be NULL.
- *
- * @returns TRUE if the two Operational Dataset TLVs match, FALSE otherwise (e.g., if any TLV differs,
- *          is missing, or if the TLVs are not well-formed).
- */
-bool otDatasetTlvsCompare(const otOperationalDatasetTlvs *aDatasetTlvsA, const otOperationalDatasetTlvs *aDatasetTlvsB);
-
 /**
 * Converts a given Operational Dataset to `otOperationalDatasetTlvs`.
 *
@@ -633,24 +600,6 @@ void otDatasetConvertToTlvs(const otOperationalDataset *aDataset, otOperationalD
 */
 otError otDatasetUpdateTlvs(const otOperationalDataset *aDataset, otOperationalDatasetTlvs *aDatasetTlvs);

-/**
- * Indicates whether or not a given Operational Dataset (in TLVs format) affects connectivity.
- *
- * A Dataset affects connectivity if it contains a different Channel, PAN ID, Mesh Local Prefix, Network Key, or
- * Security Policy than the current values in use.
- *
- * The following security policy changes are considered to affect connectivity:
- * - Disabling routers (R bit: 1 to 0).
- * - Enabling non-CCM routers (NCR bit: 0 to 1).
- * - Increasing the version threshold for routing (VR field).
- *
- * @param[in]  aInstance     A pointer to an OpenThread instance.
- * @param[in]  aDatasetTlvs  A pointer to Operational Dataset TLVs.
- *
- * @returns TRUE if @p aDatasetTlvs affects connectivity, FALSE otherwise.
- */
-bool otDatasetAffectsConnectivity(otInstance *aInstance, const otOperationalDatasetTlvs *aDatasetTlvs);
-
 /**
 * @}
 */
@@ -52,7 +52,7 @@ extern "C" {
 *
 * @note This number versions both OpenThread platform and user APIs.
 */
-#define OPENTHREAD_API_VERSION (605)
+#define OPENTHREAD_API_VERSION (580)

 /**
 * @addtogroup api-instance
@@ -264,59 +264,17 @@ enum
    OT_IP6_PROTO_DST_OPTS = 60, ///< Destination Options for IPv6
 };

-/**
- * Initializes the IPv6 interface and its external address pools.
- *
- * Requires `OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE`.
- *
- * It provides the memory buffers for the external unicast and multicast address pools and must be called before
- * enabling the IPv6 interface.
- *
- * The provided memory buffers MUST persist and remain valid as long as the OpenThread instance is initialized.
- * OpenThread will use these provided buffers to manage the pools of externally added unicast and multicast
- * addresses (i.e., those added via `otIp6AddUnicastAddress()` and `otIp6SubscribeMulticastAddress()`).
- *
- * This function can only be called once. Subsequent calls will return `OT_ERROR_ALREADY`.
- *
- * The `OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE` feature and this function allow the external unicast/multicast
- * address pools to be configured at run-time after OpenThread instance initialization, rather than build-time.
- * When this feature is disabled, the build-time configs `OPENTHREAD_CONFIG_IP6_MAX_EXT_UCAST_ADDRS` and
- * `OPENTHREAD_CONFIG_IP6_MAX_EXT_MCAST_ADDRS` specify the pool sizes used by the OpenThread stack.
- *
- * This feature allows the OpenThread stack to be compiled as a library without specifying the address pool sizes.
- * It delegates the configuration of the pools to the next layer, allowing the OpenThread stack to be integrated into
- * various projects without requiring a new OpenThread stack configuration to be built.
- *
- * @param[in] aInstance               A pointer to an OpenThread instance.
- * @param[in] aUnicastAddrPool        A pointer to an array of `otNetifAddress`.
- * @param[in] aUnicastAddrPoolSize    The number of entries in @p aUnicastAddrPool.
- * @param[in] aMulticastAddrPool      A pointer to an array of `otNetifMulticastAddress`.
- * @param[in] aMulticastAddrPoolSize  The number of entries in @p aMulticastAddrPool.
- *
- * @retval OT_ERROR_NONE     Successfully initialized the IPv6 interface.
- * @retval OT_ERROR_ALREADY  The IPv6 interface is already initialized.
- */
-otError otIp6Init(otInstance              *aInstance,
-                  otNetifAddress          *aUnicastAddrPool,
-                  uint16_t                 aUnicastAddrPoolSize,
-                  otNetifMulticastAddress *aMulticastAddrPool,
-                  uint16_t                 aMulticastAddrPoolSize);
-
 /**
 * Brings the IPv6 interface up or down.
 *
 * Call this to enable or disable IPv6 communication.
 *
- * When `OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE` is enabled, `otIp6Init()` MUST be called prior to calling
- * this function. If it is not, this function will return `OT_ERROR_INVALID_STATE`.
- *
 * @param[in] aInstance A pointer to an OpenThread instance.
 * @param[in] aEnabled  TRUE to enable IPv6, FALSE otherwise.
 *
 * @retval OT_ERROR_NONE            Successfully brought the IPv6 interface up/down.
 * @retval OT_ERROR_INVALID_STATE   IPv6 interface is not available since device is operating in raw-link mode
- *                                  (applicable only when `OPENTHREAD_CONFIG_LINK_RAW_ENABLE` feature is enabled),
- *                                  or not initialized under `OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE`.
+ *                                  (applicable only when `OPENTHREAD_CONFIG_LINK_RAW_ENABLE` feature is enabled).
 */
 otError otIp6SetEnabled(otInstance *aInstance, bool aEnabled);

@@ -334,8 +292,7 @@ bool otIp6IsEnabled(otInstance *aInstance);
 * Adds a Network Interface Address to the Thread interface.
 *
 * The passed-in instance @p aAddress is copied by the Thread interface. The Thread interface only
- * supports a fixed number of externally added unicast addresses. See `OPENTHREAD_CONFIG_IP6_MAX_EXT_UCAST_ADDRS`
- * and `OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE`.
+ * supports a fixed number of externally added unicast addresses. See `OPENTHREAD_CONFIG_IP6_MAX_EXT_UCAST_ADDRS`.
 *
 * @param[in]  aInstance A pointer to an OpenThread instance.
 * @param[in]  aAddress  A pointer to a Network Interface Address.
@@ -382,9 +339,7 @@ bool otIp6HasUnicastAddress(otInstance *aInstance, const otIp6Address *aAddress)
 * Subscribes the Thread interface to a Network Interface Multicast Address.
 *
 * The passed in instance @p aAddress will be copied by the Thread interface. The Thread interface only
- * supports a fixed number of externally added multicast addresses. See `OPENTHREAD_CONFIG_IP6_MAX_EXT_MCAST_ADDRS`
- * and `OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE`.
- *
+ * supports a fixed number of externally added multicast addresses. See `OPENTHREAD_CONFIG_IP6_MAX_EXT_MCAST_ADDRS`.
 *
 * @param[in]  aInstance A pointer to an OpenThread instance.
 * @param[in]  aAddress  A pointer to an IP Address.
@@ -605,29 +560,6 @@ void otIp6RemoveAllUnsecurePorts(otInstance *aInstance);
 */
 const uint16_t *otIp6GetUnsecurePorts(otInstance *aInstance, uint8_t *aNumEntries);

-/**
- * Sets whether to allow link-local unsecure IPv6 datagrams when the Thread role is disabled.
- *
- * Available only when `OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE` is enabled. This is intended for testing. By default,
- * this is disabled (i.e., unsecure traffic is always dropped regardless of the device's role).
- *
- * @param[in] aInstance  A pointer to an OpenThread instance.
- * @param[in] aAllow     TRUE to allow, FALSE otherwise.
- */
-void otIp6SetAllowUnsecureWhenDisabled(otInstance *aInstance, bool aAllow);
-
-/**
- * Indicates whether allowing link-local unsecure IPv6 datagrams when the Thread role is disabled is enabled.
- *
- * Available only when `OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE` is enabled.
- *
- * @param[in] aInstance  A pointer to an OpenThread instance.
- *
- * @retval TRUE   Does allow unsecure IPv6 datagrams when the Thread role is disabled.
- * @retval FALSE  Does not allow unsecure IPv6 datagrams when the Thread role is disabled.
- */
-bool otIp6IsUnsecureAllowedWhenDisabled(otInstance *aInstance);
-
 /**
 * Test if two IPv6 addresses are the same.
 *
@@ -39,7 +39,6 @@
 #include <stdint.h>

 #include <openthread/error.h>
-#include <openthread/instance.h>
 #include <openthread/platform/logging.h>
 #include <openthread/platform/toolchain.h>

@@ -57,69 +56,24 @@ extern "C" {
 */

 /**
- * Returns the current log level for a given OpenThread instance.
+ * Returns the current log level.
 *
 * If dynamic log level feature `OPENTHREAD_CONFIG_LOG_LEVEL_DYNAMIC_ENABLE` is enabled, this function returns the
- * currently set dynamic log level:
- * - In a single-instance configuration, it returns the instance's log level.
- * - In a multi-instance configuration, it returns the instance-specific log level if it has been explicitly set
- *   (see `otSetLogLevel()`). Otherwise, it returns the global log level (see `otLoggingGetLevel()`).
- *
- * If the dynamic log level feature is not enabled, this function returns the build-time configured log level.
- *
- * @param[in] aInstance  The OpenThread instance.
+ * currently set dynamic log level. Otherwise, this function returns the build-time configured log level.
 *
 * @returns The log level.
 */
-otLogLevel otGetLogLevel(otInstance *aInstance);
-
-/**
- * Sets the log level for a given OpenThread instance.
- *
- * @note This function requires `OPENTHREAD_CONFIG_LOG_LEVEL_DYNAMIC_ENABLE=1`.
- *
- * In a single-instance configuration, this function sets the log level for the instance.
- *
- * In a multi-instance configuration (`OPENTHREAD_CONFIG_MULTIPLE_INSTANCE_ENABLE`), if
- * `OPENTHREAD_CONFIG_LOG_INSTANCE_AWARE_API_ENABLE` is not enabled, this function returns `OT_ERROR_NOT_CAPABLE`.
- * When the log level is explicitly set on an instance, it overrides the global log level set using
- * `otLoggingSetLevel()`.
- *
- * @param[in] aInstance  The OpenThread instance.
- * @param[in] aLogLevel  The log level.
- *
- * @retval OT_ERROR_NONE          Successfully updated the log level.
- * @retval OT_ERROR_INVALID_ARGS  Log level value is invalid.
- * @retval OT_ERROR_NOT_CAPABLE   Instance-aware logging is not enabled in a multi-instance configuration.
- */
-otError otSetLogLevel(otInstance *aInstance, otLogLevel aLogLevel);
-
-/**
- * Returns the current global log level.
- *
- * In a single-instance configuration, this function behaves the same as `otGetLogLevel()`.
- * In a multi-instance configuration, it returns the global log level which is used for all instances.
- *
- * @returns The global log level.
- */
 otLogLevel otLoggingGetLevel(void);

 /**
- * Sets the global log level.
+ * Sets the log level.
 *
 * @note This function requires `OPENTHREAD_CONFIG_LOG_LEVEL_DYNAMIC_ENABLE=1`.
 *
- * In a single-instance configuration, this function behaves the same as `otSetLogLevel()` (which is the recommended
- * function to use).
+ * @param[in]  aLogLevel               The log level.
 *
- * In a multi-instance configuration, it sets the global log level which is used by all instances. The log level can
- * be explicitly set on a specific instance using `otSetLogLevel()`, which will then be used instead of the global
- * value.
- *
- * @param[in]  aLogLevel  The log level.
- *
- * @retval OT_ERROR_NONE          Successfully updated the log level.
- * @retval OT_ERROR_INVALID_ARGS  Log level value is invalid.
+ * @retval OT_ERROR_NONE            Successfully updated log level.
+ * @retval OT_ERROR_INVALID_ARGS    Log level value is invalid.
 */
 otError otLoggingSetLevel(otLogLevel aLogLevel);

@@ -234,7 +234,7 @@ void otMessageSetLoopbackToHostAllowed(otMessage *aMessage, bool aAllowLoopbackT
 * Indicates whether the given message may be looped back in a case of a multicast destination address.
 *
 * If @p aMessage is used along with an `otMessageInfo`, the `mMulticastLoop` field from `otMessageInfo` structure
- * takes precedence and will be used instead of the value set on @p aMessage.
+ * takes precedence and will be used instead of the the value set on @p aMessage.
 *
 * This API is mainly intended for use along with `otIp6Send()` which expects an already prepared IPv6 message.
 *
@@ -73,7 +73,7 @@ typedef struct otBorderRouterConfig
    bool        mOnMesh : 1;       ///< Whether this prefix is considered on-mesh.
    bool        mStable : 1;       ///< Whether this configuration is considered Stable Network Data.
    bool        mNdDns : 1;        ///< Whether this border router can supply DNS information via ND.
-    bool        mDp : 1;           ///< Reserved (previously Thread Domain Prefix flag).
+    bool        mDp : 1;           ///< Whether prefix is a Thread Domain Prefix (added since Thread 1.2).
    uint16_t    mRloc16;           ///< The border router's RLOC16 (value ignored on config add).
 } otBorderRouterConfig;

@@ -425,20 +425,6 @@ const char *otThreadGetVendorSwVersion(otInstance *aInstance);
 */
 const char *otThreadGetVendorAppUrl(otInstance *aInstance);

-/**
- * Represents an unspecified Vendor OUI.
- */
-#define OT_THREAD_UNSPECIFIED_VENDOR_OUI (0xffffffff)
-
-/**
- * Get the vendor OUI-24
- *
- * @param[in]  aInstance      A pointer to an OpenThread instance.
- *
- * @returns The vendor OUI-24 value in hex format, or `OT_THREAD_UNSPECIFIED_VENDOR_OUI` is not specified.
- */
-uint32_t otThreadGetVendorOui(otInstance *aInstance);
-
 /**
 * Set the vendor name string.
 *
@@ -508,20 +494,6 @@ otError otThreadSetVendorSwVersion(otInstance *aInstance, const char *aVendorSwV
 */
 otError otThreadSetVendorAppUrl(otInstance *aInstance, const char *aVendorAppUrl);

-/**
- * Set the vendor OUI-24.
- *
- * Requires `OPENTHREAD_CONFIG_NET_DIAG_VENDOR_INFO_SET_API_ENABLE`.
- *
- * @param[in] aInstance    A pointer to an OpenThread instance.
- * @param[in] aVendorOui   The vendor OUI-24 value in Hexadecimal representation (e.g., OUI 64-16-66 is represented as
- *                         `0x641666`). Must be a 24-bit value.
- *
- * @retval OT_ERROR_NONE          Successfully set the vendor OUI.
- * @retval OT_ERROR_INVALID_ARGS  @p aVendorOui is not a valid 24-bit value.
- */
-otError otThreadSetVendorOui(otInstance *aInstance, uint32_t aVendorOui);
-
 /**
 * Callback function pointer to notify when a Network Diagnostic Reset request message is received for the
 * `OT_NETWORK_DIAGNOSTIC_TLV_NON_PREFERRED_CHANNELS` TLV.
@@ -74,10 +74,10 @@ extern "C" {
 #define OT_BLE_ADV_INTERVAL_MAX 0x4000

 /**
- * Default interval for advertising packet in OT_BLE_ADV_INTERVAL_UNIT units (100 ms).
+ * Default interval for advertising packet (ms).
 */

-#define OT_BLE_ADV_INTERVAL_DEFAULT 160
+#define OT_BLE_ADV_INTERVAL_DEFAULT 100

 /**
 * Unit used to calculate interval duration (0.625ms).
@@ -104,13 +104,13 @@ extern "C" {
 #define OT_BLE_ATT_MTU_DEFAULT 23

 /**
- * Default Tx power value for BLE in dBm.
+ * Default power value for BLE.
 */

 #define OT_BLE_DEFAULT_POWER 0

 /**
- * ToBLE service UUID (a GATT service UUID for Thread over BLE)
+ * TOBLE service UUID
 */

 #define OT_TOBLE_SERVICE_UUID 0xfffb
@@ -130,7 +130,7 @@ typedef struct otBleLinkCapabilities
 */
 typedef struct otBleRadioPacket
 {
-    uint8_t *mValue;  ///< Pointer to the packet data
+    uint8_t *mValue;  ///< The value of an attribute
    uint16_t mLength; ///< Length of the @p mValue.
    int8_t   mPower;  ///< Transmit/receive power in dBm.
 } otBleRadioPacket;
@@ -171,16 +171,18 @@ otError otPlatBleDisable(otInstance *aInstance);
 * @section Bluetooth Low Energy GAP.
 ***************************************************************************/
 /**
- * Gets a platform-provided buffer for BLE advertising data.
+ * Gets BLE Advertising buffer.
 *
 * @note This function shall be used only for BLE Peripheral role.
- * The platform must provide a buffer of at least @p OT_TCAT_ADVERTISEMENT_MAX_LEN bytes.
+ * Returned buffer should have enough space to fit max advertisement
+ * defined by specification.
 *
- * @param[in]  aInstance             The OpenThread instance structure.
- * @param[out] aAdvertisementBuffer  A pointer to be set to the platform-provided advertisement buffer.
+ * @param[in] aInstance          The OpenThread instance structure.
+ * @param[in] aAdvertisementData The formatted TCAT advertisement frame.
+ * @param[in] aAdvertisementLen  The TCAT advertisement frame length.
 *
- * @retval OT_ERROR_NONE      Successfully retrieved the advertisement buffer.
- * @retval OT_ERROR_NO_BUFS   No buffer space available.
+ * @retval OT_ERROR_NONE           Advertising procedure has been started.
+ * @retval OT_ERROR_NO_BUFS        No bufferspace available.
 */
 otError otPlatBleGetAdvertisementBuffer(otInstance *aInstance, uint8_t **aAdvertisementBuffer);

@@ -188,15 +190,13 @@ otError otPlatBleGetAdvertisementBuffer(otInstance *aInstance, uint8_t **aAdvert
 * Sets BLE Advertising data.
 *
 * @note This function shall be used only for BLE Peripheral role.
- * It shall only be called while advertising is not active.
 *
 * @param[in] aInstance          The OpenThread instance structure.
 * @param[in] aAdvertisementData The formatted TCAT advertisement frame.
- * @param[in] aAdvertisementLen  The length of the @p aAdvertisementData frame.
+ * @param[in] aAdvertisementLen  The TCAT advertisement frame length.
 *
- * @retval OT_ERROR_NONE           Advertising data set successfully.
+ * @retval OT_ERROR_NONE           Advertising procedure has been started.
 * @retval OT_ERROR_INVALID_STATE  BLE Device is in invalid state.
- * @retval OT_ERROR_FAILED         Setting of data failed.
 * @retval OT_ERROR_INVALID_ARGS   Invalid value has been supplied.
 */
 otError otPlatBleGapAdvSetData(otInstance *aInstance, uint8_t *aAdvertisementData, uint16_t aAdvertisementLen);
@@ -205,14 +205,12 @@ otError otPlatBleGapAdvSetData(otInstance *aInstance, uint8_t *aAdvertisementDat
 * Updates BLE Advertising data.
 *
 * @note This function shall be used only for BLE Peripheral role.
- * It shall only be called while advertising is active.
 *
 * @param[in] aInstance          The OpenThread instance structure.
 * @param[in] aAdvertisementData The formatted TCAT advertisement frame.
- * @param[in] aAdvertisementLen  The length of the @p aAdvertisementData frame.
+ * @param[in] aAdvertisementLen  The TCAT advertisement frame length.
 *
- * @retval OT_ERROR_NONE           Advertising data updated successfully.
- * @retval OT_ERROR_INVALID_STATE  BLE Device is in invalid state.
+ * @retval OT_ERROR_NONE           Advertising procedure has been started.
 * @retval OT_ERROR_FAILED         Update of data failed.
 * @retval OT_ERROR_INVALID_ARGS   Invalid value has been supplied.
 */
@@ -224,15 +222,11 @@ otError otPlatBleGapAdvUpdateData(otInstance *aInstance, uint8_t *aAdvertisement
 * The BLE device shall use undirected advertising with no filter applied.
 * A single BLE Advertising packet must be sent on all advertising
 * channels (37, 38 and 39).
- * The advertising shall remain active until either otPlatBleGapAdvStop() is
- * called or a BLE Central Device connects (otPlatBleGapOnConnected()).
- * The BLE platform is not obliged to exactly match the requested interval
- * between subsequent advertising packets: it is a requested/desired value.
 *
 * @note This function shall be used only for BLE Peripheral role.
 *
 * @param[in] aInstance  The OpenThread instance structure.
- * @param[in] aInterval  The requested interval between subsequent advertising packets
+ * @param[in] aInterval  The interval between subsequent advertising packets
 *                       in OT_BLE_ADV_INTERVAL_UNIT units.
 *                       Shall be within OT_BLE_ADV_INTERVAL_MIN and
 *                       OT_BLE_ADV_INTERVAL_MAX range or OT_BLE_ADV_INTERVAL_DEFAULT
@@ -257,8 +251,8 @@ otError otPlatBleGapAdvStart(otInstance *aInstance, uint16_t aInterval);
 otError otPlatBleGapAdvStop(otInstance *aInstance);

 /**
- * The BLE driver calls this function to notify OpenThread that a BLE Central Device has
- * been connected. The BLE driver MUST stop advertising before calling this function.
+ * The BLE driver calls this method to notify OpenThread that a BLE Central Device has
+ * been connected.
 *
 * @param[in]  aInstance     The OpenThread instance structure.
 * @param[in]  aConnectionId The identifier of the open connection.
@@ -266,9 +260,8 @@ otError otPlatBleGapAdvStop(otInstance *aInstance);
 extern void otPlatBleGapOnConnected(otInstance *aInstance, uint16_t aConnectionId);

 /**
- * The BLE driver calls this function to notify OpenThread that the BLE Central Device
- * has been disconnected. The BLE driver MUST NOT start advertising before or after this
- * call: this is controlled explicitly via otPlatBleGapAdvStart().
+ * The BLE driver calls this method to notify OpenThread that the BLE Central Device
+ * has been disconnected.
 *
 * @param[in]  aInstance     The OpenThread instance structure.
 * @param[in]  aConnectionId The identifier of the closed connection.
@@ -279,11 +272,7 @@ extern void otPlatBleGapOnDisconnected(otInstance *aInstance, uint16_t aConnecti
 * Disconnects BLE connection.
 *
 * The BLE device shall use the Remote User Terminated Connection (0x13) reason
- * code when disconnecting from the peer BLE device.
- *
- * This function only triggers the disconnection procedure. When OT_ERROR_NONE is returned,
- * the platform MUST report completion of the disconnection asynchronously, by invoking
- * otPlatBleGapOnDisconnected().
+ * code when disconnecting from the peer BLE device..
 *
 * @param[in] aInstance  The OpenThread instance structure.
 *
@@ -308,7 +297,7 @@ otError otPlatBleGapDisconnect(otInstance *aInstance);
 otError otPlatBleGattMtuGet(otInstance *aInstance, uint16_t *aMtu);

 /**
- * The BLE driver calls this function to notify OpenThread that ATT_MTU has been updated.
+ * The BLE driver calls this method to notify OpenThread that ATT_MTU has been updated.
 *
 * @param[in]  aInstance     The OpenThread instance structure.
 * @param[in]  aMtu          The updated ATT_MTU value. It MUST be >=OT_BLE_ATT_MTU_MIN.
@@ -326,7 +315,7 @@ extern void otPlatBleGattOnMtuUpdate(otInstance *aInstance, uint16_t aMtu);
 *
 * @param[in] aInstance   The OpenThread instance structure.
 * @param[in] aHandle     The handle of the attribute to be indicated.
- * @param[in] aPacket     A pointer to the packet containing the value to be indicated.
+ * @param[in] aPacket     A pointer to the packet contains value to be indicated.
 *
 * @retval OT_ERROR_NONE           ATT Handle Value Indication has been sent.
 * @retval OT_ERROR_INVALID_STATE  BLE Device is in invalid state.
@@ -336,31 +325,29 @@ extern void otPlatBleGattOnMtuUpdate(otInstance *aInstance, uint16_t aMtu);
 otError otPlatBleGattServerIndicate(otInstance *aInstance, uint16_t aHandle, const otBleRadioPacket *aPacket);

 /**
- * The BLE driver calls this function to notify OpenThread that an ATT Write Request
+ * The BLE driver calls this method to notify OpenThread that an ATT Write Request
 * packet has been received.
 *
 * @note This function shall be used only for GATT Server.
 *
 * @param[in] aInstance   The OpenThread instance structure.
 * @param[in] aHandle     The handle of the attribute to be written.
- * @param[in] aPacket     A pointer to the packet containing the value to be written to the attribute.
+ * @param[in] aPacket     A pointer to the packet contains value to be written to the attribute.
 */
 extern void otPlatBleGattServerOnWriteRequest(otInstance *aInstance, uint16_t aHandle, const otBleRadioPacket *aPacket);

 /**
- * Retrieve BLE link capabilities from the platform.
+ * Function to retrieve from platform BLE link capabilities.
 *
 * @param[in]   aInstance             The OpenThread instance structure.
- * @param[out]  aBleLinkCapabilities  The pointer to retrieve the BLE link capabilities into.
+ * @param[out]  aBleLinkCapabilities  The pointer to retrieve the BLE ling capabilities.
 */
 void otPlatBleGetLinkCapabilities(otInstance *aInstance, otBleLinkCapabilities *aBleLinkCapabilities);

 /**
- * Check if the platform has multi-radio support for BLE and IEEE 802.15.4.
+ * Function to retrieve from platform multiradio support of BLE and IEEE.
 *
- * @param[in] aInstance The OpenThread instance structure.
- *
- * @returns TRUE if the platform supports simultaneous BLE and IEEE 802.15.4 operation, FALSE otherwise.
+ * @param[in] aInstance             The OpenThread instance structure.
 */
 bool otPlatBleSupportsMultiRadio(otInstance *aInstance);
 /**
@@ -123,9 +123,6 @@ typedef struct otCryptoKey
 * @struct otCryptoContext
 *
 * Stores the context object for platform APIs.
- *
- * If `OPENTHREAD_CONFIG_CRYPTO_PLATFORM_ALLOCS_CONTEXT` is enabled, the platform allocates and populates this.
- * Otherwise OpenThread core allocates and populates this.
 */
 typedef struct otCryptoContext
 {
@@ -328,9 +325,6 @@ void otPlatCryptoFree(void *aPtr);
 * @retval OT_ERROR_FAILED        Failed to initialize HMAC operation.
 * @retval OT_ERROR_INVALID_ARGS  @p aContext was NULL
 *
- * @note If `OPENTHREAD_CONFIG_CRYPTO_PLATFORM_ALLOCS_CONTEXT` is enabled, @p aContext is populated by the platform.
- *       Otherwise OpenThread core allocates and populates it.
- *
 * @note The platform driver shall point the context to the correct object such as psa_mac_operation_t or
 *       mbedtls_md_context_t.
 */
@@ -395,9 +389,6 @@ otError otPlatCryptoHmacSha256Finish(otCryptoContext *aContext, uint8_t *aBuf, s
 * @retval OT_ERROR_INVALID_ARGS  @p aContext was NULL
 * @retval OT_ERROR_NO_BUFS       Cannot allocate the context.
 *
- * @note If `OPENTHREAD_CONFIG_CRYPTO_PLATFORM_ALLOCS_CONTEXT` is enabled, @p aContext is populated by the platform.
- *       Otherwise OpenThread core allocates and populates it.
- *
 * @note The platform driver shall point the context to the correct object such as psa_key_id
 *       or mbedtls_aes_context_t.
 */
@@ -444,13 +435,10 @@ otError otPlatCryptoAesFree(otCryptoContext *aContext);
 *
 * @param[in]  aContext           Context for HKDF operation.
 *
- * @retval OT_ERROR_NONE          Successfully Initialised HKDF operation.
- * @retval OT_ERROR_FAILED        Failed to Initialise HKDF operation.
+ * @retval OT_ERROR_NONE          Successfully Initialised AES operation.
+ * @retval OT_ERROR_FAILED        Failed to Initialise AES operation.
 * @retval OT_ERROR_INVALID_ARGS  @p aContext was NULL
 *
- * @note If `OPENTHREAD_CONFIG_CRYPTO_PLATFORM_ALLOCS_CONTEXT` is enabled, @p aContext is populated by the platform.
- *       Otherwise OpenThread core allocates and populates it.
- *
 * @note The platform driver shall point the context to the correct object such as psa_key_derivation_operation_t
 *       or HmacSha256::Hash
 */
@@ -511,8 +499,6 @@ otError otPlatCryptoHkdfDeinit(otCryptoContext *aContext);
 * @retval OT_ERROR_FAILED        Failed to initialise SHA-256 operation.
 * @retval OT_ERROR_INVALID_ARGS  @p aContext was NULL
 *
- * @note If `OPENTHREAD_CONFIG_CRYPTO_PLATFORM_ALLOCS_CONTEXT` is enabled, @p aContext is populated by the platform.
- *       Otherwise OpenThread core allocates and populates it.
 *
 * @note The platform driver shall point the context to the correct object such as psa_hash_operation_t
 *       or mbedtls_sha256_context.
@@ -53,7 +53,8 @@ extern "C" {
 typedef struct otPlatDsoConnection otPlatDsoConnection;

 /**
- * Can be used by DSO platform implementation to get the OpenThread instance associated with a connection instance.
+ * Can be used by DSO platform implementation to get the the OpenThread instance associated with a
+ * connection instance.
 *
 * @param[in] aConnection   A pointer to the DSO connection.
 *
@@ -123,7 +124,7 @@ extern void otPlatDsoHandleConnected(otPlatDsoConnection *aConnection);
 * Passes the ownership of the @p aMessage to the DSO platform layer, and the platform implementation is
 * expected to free the message once it is no longer needed.
 *
- * The @p aMessage contains the DNS message (starting with DNS header). Note that it does not contain the length
+ * The @p aMessage contains the DNS message (starting with DNS header). Note that it does not contain the the length
 * field that is needed when sending over TLS/TCP transport. The platform layer MUST therefore include the length
 * field when passing the message to TLS/TCP layer.
 *
@@ -47,15 +47,6 @@
 extern "C" {
 #endif

-/**
- * @addtogroup plat-infra-if
- *
- * @brief
- *   This module includes the platform abstraction for the adjacent infrastructure network interface.
- *
- * @{
- */
-
 #define OT_PLAT_INFRA_IF_MAX_LINK_LAYER_ADDR_LENGTH 16 ///< Maximum InfraIf Link-layer address length.

 /**
@@ -67,23 +58,30 @@ typedef struct otPlatInfraIfLinkLayerAddress
    uint8_t mLength;                                               ///< The address length (number of bytes).
 } otPlatInfraIfLinkLayerAddress;

+/**
+ * @addtogroup plat-infra-if
+ *
+ * @brief
+ *   This module includes the platform abstraction for the adjacent infrastructure network interface.
+ *
+ * @{
+ */
+
 /**
 * Tells whether an infra interface has the given IPv6 address assigned.
 *
- * @param[in]  aInstance      The OpenThread instance.
 * @param[in]  aInfraIfIndex  The index of the infra interface.
 * @param[in]  aAddress       The IPv6 address.
 *
 * @returns  TRUE if the infra interface has given IPv6 address assigned, FALSE otherwise.
 */
-bool otPlatInfraIfHasAddress(otInstance *aInstance, uint32_t aInfraIfIndex, const otIp6Address *aAddress);
+bool otPlatInfraIfHasAddress(uint32_t aInfraIfIndex, const otIp6Address *aAddress);

 /**
 * Sends an ICMPv6 Neighbor Discovery message on given infrastructure interface.
 *
 * See RFC 4861: https://tools.ietf.org/html/rfc4861.
 *
- * @param[in]  aInstance      The OpenThread instance.
 * @param[in]  aInfraIfIndex  The index of the infrastructure interface this message is sent to.
 * @param[in]  aDestAddress   The destination address this message is sent to.
 * @param[in]  aBuffer        The ICMPv6 message buffer. The ICMPv6 checksum is left zero and the
@@ -96,8 +94,7 @@ bool otPlatInfraIfHasAddress(otInstance *aInstance, uint32_t aInfraIfIndex, cons
 * @retval OT_ERROR_NONE    Successfully sent the ICMPv6 message.
 * @retval OT_ERROR_FAILED  Failed to send the ICMPv6 message.
 */
-otError otPlatInfraIfSendIcmp6Nd(otInstance         *aInstance,
-                                 uint32_t            aInfraIfIndex,
+otError otPlatInfraIfSendIcmp6Nd(uint32_t            aInfraIfIndex,
                                 const otIp6Address *aDestAddress,
                                 const uint8_t      *aBuffer,
                                 uint16_t            aBufferLength);
@@ -148,7 +145,6 @@ extern otError otPlatInfraIfStateChanged(otInstance *aInstance, uint32_t aInfraI
 *
 * OpenThread will call this method periodically to monitor the presence or change of NAT64 prefix.
 *
- * @param[in]  aInstance      The OpenThread instance.
 * @param[in]  aInfraIfIndex  The index of the infrastructure interface to discover the NAT64 prefix.
 *
 * @retval  OT_ERROR_NONE             Successfully requested NAT64 prefix discovery.
@@ -159,7 +155,7 @@ extern otError otPlatInfraIfStateChanged(otInstance *aInstance, uint32_t aInfraI
 *        discovery). The priority of the discovered prefix is lower than that of the prefix discovered via Router
 *        Advertisements PREF64 option (RFC 8781).
 */
-otError otPlatInfraIfDiscoverNat64Prefix(otInstance *aInstance, uint32_t aInfraIfIndex);
+otError otPlatInfraIfDiscoverNat64Prefix(uint32_t aInfraIfIndex);

 /**
 * The infra interface driver calls this method to notify OpenThread that
@@ -35,7 +35,6 @@
 #ifndef OPENTHREAD_PLATFORM_LOGGING_H_
 #define OPENTHREAD_PLATFORM_LOGGING_H_

-#include <openthread/instance.h>
 #include <openthread/platform/toolchain.h>

 #ifdef __cplusplus
@@ -141,9 +140,6 @@ typedef enum otLogRegion
 /**
 * Outputs logs.
 *
- * This platform API is used to output logs when the configuration `OPENTHREAD_CONFIG_LOG_INSTANCE_AWARE_API_ENABLE`
- * is disabled. When the configuration is enabled, `otPlatLogOutput()` is used instead.
- *
 * Note that the support for log region is removed. The OT core will always emit all logs with `OT_LOG_REGION_CORE`
 * as @p aLogRegion.
 *
@@ -155,31 +151,11 @@ typedef enum otLogRegion
 void otPlatLog(otLogLevel aLogLevel, otLogRegion aLogRegion, const char *aFormat, ...)
    OT_TOOL_PRINTF_STYLE_FORMAT_ARG_CHECK(3, 4);

-/**
- * Outputs a log line.
- *
- * This platform API is an alternative to `otPlatLog()` and is used when the configuration
- * `OPENTHREAD_CONFIG_LOG_INSTANCE_AWARE_API_ENABLE` is enabled.
- *
- * Unlike `otPlatLog()`, this API also provides a pointer to the OpenThread instance  (`otInstance*`) from which the
- * log is generated. This is particularly helpful in a multi-instance setup to distinguish logs from different
- * instances. Additionally, it provides the log line as a fully formatted null-terminated string instead of
- * a format string and variable arguments.
- *
- * @param[in]  aInstance   A pointer to the OpenThread instance.
- * @param[in]  aLogLevel   The log level.
- * @param[in]  aLogLine    A pointer to the null-terminated string containing the log line.
- */
-void otPlatLogOutput(otInstance *aInstance, otLogLevel aLogLevel, const char *aLogLine);
-
 /**
 * Handles OpenThread log level changes.
 *
- * This platform function is optional. An empty weak implementation is provided by OpenThread core.
- *
- * This platform function is called whenever the OpenThread log level changes:
- * - In a single-instance configuration, this is called when the log level changes.
- * - In a multi-instance configuration, this is called when the global log level changes.
+ * This platform function is called whenever the OpenThread log level changes.
+ * This platform function is optional since an empty weak implementation has been provided.
 *
 * @note Only applicable when `OPENTHREAD_CONFIG_LOG_LEVEL_DYNAMIC_ENABLE=1`.
 *
@@ -187,21 +163,6 @@ void otPlatLogOutput(otInstance *aInstance, otLogLevel aLogLevel, const char *aL
 */
 void otPlatLogHandleLevelChanged(otLogLevel aLogLevel);

-/**
- * Handles OpenThread instance-specific log level changes.
- *
- * This platform function is optional. An empty weak implementation is provided by OpenThread core.
- *
- * This platform function is called whenever the instance-specific log level changes:
- * - In a single-instance configuration, this is called along with `otPlatLogHandleLevelChanged()`.
- * - In a multi-instance configuration, if `OPENTHREAD_CONFIG_LOG_INSTANCE_AWARE_API_ENABLE` is used, this is called
- *   when the instance-specific log level changes.
- *
- * @param[in]  aInstance  A pointer to the OpenThread instance.
- * @param[in]  aLogLevel  The new OpenThread log level for the instance.
- */
-void otPlatLogHandleLogLevelChanged(otInstance *aInstance, otLogLevel aLogLevel);
-
 /**
 * @}
 */
@@ -359,7 +359,7 @@ typedef struct otRadioFrame
             * If `mIsHeaderUpdated` is not set, then the frame counter and key CSL IE not set in the frame by
             * OpenThread core and it is the responsibility of the radio platform to assign them. The platform
             * must update the frame header (assign counter and CSL IE values) before sending the frame over the air,
-             * however if the transmission gets aborted and the frame is never sent over the air (e.g., channel
+             * however if the the transmission gets aborted and the frame is never sent over the air (e.g., channel
             * access error) the platform may choose to not update the header. If the platform updates the header,
             * it must also set this flag before passing the frame back from the `otPlatRadioTxDone()` callback.
             */
@@ -1,439 +0,0 @@
-/*
- *  Copyright (c) 2026, The OpenThread Authors.
- *  All rights reserved.
- *
- *  Redistribution and use in source and binary forms, with or without
- *  modification, are permitted provided that the following conditions are met:
- *  1. Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *  2. Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *  3. Neither the name of the copyright holder nor the
- *     names of its contributors may be used to endorse or promote products
- *     derived from this software without specific prior written permission.
- *
- *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- *  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- *  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
- *  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- *  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- *  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- *  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- *  POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * @file
- * @brief
- *   This file includes the abstraction for the platform TCP
- */
-
-#ifndef OPENTHREAD_PLATFORM_TCP_H_
-#define OPENTHREAD_PLATFORM_TCP_H_
-
-#include <stdbool.h>
-#include <stdint.h>
-
-#include <openthread/error.h>
-#include <openthread/instance.h>
-#include <openthread/ip6.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/**
- * @addtogroup plat-tcp
- *
- * @brief
- *   This module includes the platform abstraction for TCP connections and listeners.
- *
- *   All APIs in this module are applicable only when `OPENTHREAD_CONFIG_PLATFORM_TCP_ENABLE` feature is enabled.
- *
- * @{
- */
-
-/**
- * Represents platform-specific data associated with a connection or a listener.
- *
- * This union is provided to add flexibility for the platform. A platform can choose to store a file descriptor
- * (e.g., an `int` for a POSIX socket) or a pointer to an arbitrary context or state structure needed by the
- * platform implementation.
- *
- * The OpenThread stack guarantees that the `otPlatTcpPlatformData` is fully cleared (all bytes set to zero) when a
- * new listener or connection instance is initialized.
- *
- * For an `otPlatTcpListener`, the `otPlatTcpEnableListener()` call provides an opportunity for the platform to allocate
- * or update this information. The OpenThread stack guarantees that `otPlatTcpDisableListener()` will be invoked on any
- * previously enabled listener, providing a deterministic point for the platform implementation to perform cleanup
- * (e.g., deallocating memory or context structures).
- *
- * For an `otPlatTcpConnection`, the `otPlatTcpConnect()` call or the `otPlatTcpAccept()` callback indicate when a new
- * connection instance is provided, allowing the platform data to be initialized. The platform is responsible for
- * cleaning up this data either before invoking `otPlatTcpHandleDisconnected()` (which invalidates the connection) or
- * from an `otPlatTcpAbort()` call. The OpenThread stack guarantees that it will eventually disconnect or abort any
- * active connection, ensuring a reliable cleanup path.
- */
-typedef union
-{
-    int   mDescriptor; ///< A value (like a file descriptor).
-    void *mContext;    ///< Pointer to arbitrary platform data.
-} otPlatTcpPlatformData;
-
-/**
- * Represents a TCP listener.
- *
- * The OpenThread core owns and manages the `otPlatTcpListener` instances. The platform should track the pointers
- * to these instances and use them when invoking the callbacks. The `otPlatTcpListener *` can be viewed as
- * a "descriptor" or "handle" to the listener.
- */
-typedef struct otPlatTcpListener
-{
-    otPlatTcpPlatformData mData; ///< Platform implementation specific data.
-} otPlatTcpListener;
-
-/**
- * Represents a TCP connection.
- *
- * The OpenThread core owns and manages the `otPlatTcpConnection` instances. The platform should track the pointers
- * to these instances and pass them when invoking the `otPlatTcpHandle*` callbacks. The `otPlatTcpConnection *` can
- * be viewed as a "descriptor" or "handle" to the connection.
- *
- * The `otPlatTcpConnection` instance remains valid as long as the connection is active.
- */
-typedef struct otPlatTcpConnection
-{
-    otPlatTcpPlatformData mData; ///< Platform implementation specific data.
-} otPlatTcpConnection;
-
-/**
- * Represents a TCP socket address.
- */
-typedef struct otPlatTcpSockAddr
-{
-    otSockAddr mSockAddr; ///< The socket address (IP address and port number). Use IPv4-mapped IPv6 for IPv4.
-    uint32_t   mIfIndex;  ///< Interface index. Zero indicates any/unspecified.
-} otPlatTcpSockAddr;
-
-/**
- * Defines the reason for a TCP connection disconnection.
- */
-typedef enum otPlatTcpDisconnectReason
-{
-    OT_PLAT_TCP_DISCONNECT_REASON_CLOSED,  ///< Connection was gracefully closed.
-    OT_PLAT_TCP_DISCONNECT_REASON_TIMEOUT, ///< Connection timed out (e.g., failed to connect or keepalive failure).
-    OT_PLAT_TCP_DISCONNECT_REASON_REFUSED, ///< Connection was refused by the peer (RST received during handshake).
-    OT_PLAT_TCP_DISCONNECT_REASON_RESET,   ///< Connection was reset by the peer (RST received on established conn).
-    OT_PLAT_TCP_DISCONNECT_REASON_ERROR,   ///< Connection was aborted due to other errors.
-} otPlatTcpDisconnectReason;
-
-/**
- * Enables a TCP listener.
- *
- * The platform should start listening for incoming TCP connections on the provided @p aLocalSockAddr. When an
- * incoming connection request is received, the platform must invoke the `otPlatTcpAccept()` callback to accept the
- * request.
- *
- * The @p aLocalSockAddr specifies the local interface, address, and port to bind to. Importantly, the port number
- * within @p aLocalSockAddr must not be zero. The IP address may be unspecified (all zeros) to indicate that the
- * listener should accept connections on any local address.
- *
- * @param[in] aListener      The TCP listener.
- * @param[in] aLocalSockAddr The local socket address to listen on.
- *
- * @retval OT_ERROR_NONE     Successfully enabled or disabled the listener.
- * @retval OT_ERROR_ALREADY  Already listening on the same port/address.
- * @retval OT_ERROR_FAILED   Failed to enable the listener.
- */
-otError otPlatTcpEnableListener(otPlatTcpListener *aListener, const otPlatTcpSockAddr *aLocalSockAddr);
-
-/**
- * Disables a TCP listener.
- *
- * The platform should stop listening for incoming connections on the socket associated with the listener.
- * Any incoming connection requests that have not yet been accepted should be discarded.
- *
- * @param[in] aListener  The TCP listener.
- */
-void otPlatTcpDisableListener(otPlatTcpListener *aListener);
-
-/**
- * Callback to accept an incoming TCP connection request on an active listener.
- *
- * This function is implemented and provided by the OpenThread stack for the platform to use.
- *
- * The callback returns a pointer to an `otPlatTcpConnection` for the new connection. If the callback returns NULL,
- * the incoming connection is rejected.
- *
- * @param[in] aListener      The TCP listener.
- * @param[in] aPeerSockAddr  The peer's socket address.
- *
- * @returns A pointer for the newly accepted connection, or NULL to reject the connection request.
- */
-extern otPlatTcpConnection *otPlatTcpAccept(otPlatTcpListener *aListener, const otPlatTcpSockAddr *aPeerSockAddr);
-
-/**
- * Initiates a TCP connection to a peer.
- *
- * The platform should initiate a TCP connection to the @p aPeerSockAddr.
- *
- * The @p aLocalSockAddr specifies the local address and port to bind to before connecting. It can be NULL if the
- * OpenThread stack does not specify a preference. If provided, fields within @p aLocalSockAddr may still be left
- * unspecified (e.g., the IP address can be all zeros, or the port can be zero). In all such cases, the platform
- * and the underlying TCP stack should automatically select an appropriate local IP address and/or an ephemeral port.
- *
- * If `OT_ERROR_NONE` is returned (indicating successful initialization of the connection process), the platform must
- * subsequently report the status. Upon successful connection establishment, the platform must invoke the
- * `otPlatTcpHandleConnected` callback. If it fails to establish the connection, the `otPlatTcpHandleDisconnected`
- * callback must be called to indicate the failure.
- *
- * @param[in] aConn          The TCP connection.
- * @param[in] aPeerSockAddr  The peer's socket address.
- * @param[in] aLocalSockAddr The local socket address. Can be NULL.
- *
- * @retval OT_ERROR_NONE     Successfully initiated the connection.
- * @retval OT_ERROR_FAILED   Failed to initiate the connection.
- */
-otError otPlatTcpConnect(otPlatTcpConnection     *aConn,
-                         const otPlatTcpSockAddr *aPeerSockAddr,
-                         const otPlatTcpSockAddr *aLocalSockAddr);
-
-/**
- * Indicates whether the TCP connection is currently in the connecting state.
- *
- * This function is provided by the OpenThread stack. The platform can use it to determine if a TCP connection is still
- * waiting for the TCP handshake to complete.
- *
- * @param[in] aConn  The TCP connection.
- *
- * @retval TRUE   The connection is currently in the connecting state.
- * @retval FALSE  The connection is not in the connecting state.
- */
-extern bool otPlatTcpIsConnecting(otPlatTcpConnection *aConn);
-
-/**
- * Callback to notify the connection establishment.
- *
- * This callback is implemented and provided by the OpenThread stack. It must be invoked by the platform to indicate
- * that the TCP handshake is complete and that the connection is now established.
- *
- * The platform must call this after a successful call to `otPlatTcpConnect()` when the connection is established.
- * For incoming connection requests (on an `otPlatTcpListener`), the platform must call this after the
- * `otPlatTcpAccept()` callback returns successfully and when the connection is established.
- *
- * @param[in] aConn   The TCP connection.
- */
-extern void otPlatTcpHandleConnected(otPlatTcpConnection *aConn);
-
-/**
- * Notifies the platform that there is pending data for transmission.
- *
- * This function is called by the OpenThread stack when it has new data for transmission. After this call, the platform
- * should indicate when it is ready to accept the data by invoking the `otPlatTcpHandleTxReady()` callback.
- *
- * The platform can also use `otPlatTcpIsTxPending()` to check if there is pending data for transmission.
- *
- * It is permissible for the platform implementation to invoke the `otPlatTcpHandleTxReady()` callback directly from
- * within `otPlatTcpNotifyTxPending()` before returning, if the underlying TCP transmit buffer is already available.
- * The OpenThread stack will handle this correctly.
- *
- * @param[in] aConn  The TCP connection.
- */
-void otPlatTcpNotifyTxPending(otPlatTcpConnection *aConn);
-
-/**
- * Indicates whether the TCP connection has pending data for transmission.
- *
- * This function is provided by the OpenThread stack. The platform can use it to check if there is any pending data
- * for transmission over the TCP connection.
- *
- * @param[in] aConn  The TCP connection.
- *
- * @retval TRUE   The connection has pending transmit data.
- * @retval FALSE  The connection does not have pending transmit data.
- */
-extern bool otPlatTcpIsTxPending(otPlatTcpConnection *aConn);
-
-/**
- * Callback to notify that the platform is ready to accept more transmit data.
- *
- * This function is implemented and provided by the OpenThread stack for the platform to use.
- *
- * The platform should invoke this callback when it is ready to accept more data for transmission over the TCP
- * connection, in response to a prior `otPlatTcpNotifyTxPending()` call. Upon being called, the OpenThread stack will
- * use `otPlatTcpSend()` to provide the pending TX data to the platform. The stack may call `otPlatTcpSend()` multiple
- * times during the execution of this callback.
- *
- * @param[in] aConn  The TCP connection.
- */
-extern void otPlatTcpHandleTxReady(otPlatTcpConnection *aConn);
-
-/**
- * Sends data over an active TCP connection.
- *
- * This function is called by the OpenThread stack to provide data for the platform to transmit. The data is provided
- * in a buffer. The platform should copy as much data as it can from the given buffer into its underlying platform
- * transmit buffer.
- *
- * The provided @p aBuffer is temporary. The platform must not store the pointer or assume the content remains valid
- * after this function returns. All required data must be copied during this call.
- *
- * The OpenThread stack typically invokes this function from the `otPlatTcpHandleTxReady()` callback. However, the
- * platform implementation must not assume this and should support being called at any time. If there is no space
- * available to accept any data, the platform can return zero.
- *
- * The OpenThread stack may call this function multiple times back-to-back to provide all queued transmit content
- * in chunks. The platform should be prepared to handle consecutive calls efficiently.
- *
- * @param[in] aConn    The TCP connection.
- * @param[in] aBuffer  A pointer to the buffer containing the data to send.
- * @param[in] aLength  The length (in bytes) of the data in the buffer.
- *
- * @returns The actual number of bytes accepted for transmission.
- */
-uint16_t otPlatTcpSend(otPlatTcpConnection *aConn, const uint8_t *aBuffer, uint16_t aLength);
-
-/**
- * Callback to notify the reception of data on a connection.
- *
- * This function is implemented and provided by the OpenThread stack for the platform to use.
- *
- * The platform invokes this callback to provide received data to the OpenThread stack. The provided @p aBuffer
- * only needs to remain valid for the duration of this call. The OpenThread stack will process and copy the
- * bytes as needed, and will not retain the @p aBuffer pointer after the function returns.
- *
- * Since TCP is a stream protocol, data can arrive in arbitrarily sized chunks. The platform does not need to
- * buffer or reassemble these; it can invoke this callback immediately as data is received, even if it is expecting
- * more data. The OpenThread stack handles all stream-level behavior, processing, and retention of the
- * received data. This helps simplify the platform implementation.
- *
- * On certain platforms (such as standard POSIX), a return value of 0 from `read()` or `recv()` indicates an
- * End-of-File (EOF) or graceful closure by the peer. The platform implementation must check for this condition and
- * report it by invoking `otPlatTcpHandleDisconnected()` with the reason set to `OT_PLAT_TCP_DISCONNECT_REASON_CLOSED`.
- * Importantly, calling `otPlatTcpHandleReceive()` with `aLength` set to zero does not signify a graceful closure in
- * the `otPlatTcp` APIs; such a call is treated as a no-op receive event by the OpenThread stack and is ignored.
- *
- * @param[in] aConn    The TCP connection.
- * @param[in] aBuffer  A pointer to the buffer containing the received data. Must not be NULL if @p aLength > 0.
- * @param[in] aLength  The length (in bytes) of the received data.
- */
-extern void otPlatTcpHandleReceive(otPlatTcpConnection *aConn, const uint8_t *aBuffer, uint16_t aLength);
-
-/**
- * Gracefully closes the TCP connection.
- *
- * This function initiates a graceful closure of the connection. The platform should transmit any remaining data
- * before performing the standard TCP connection termination.
- *
- * Once the connection is fully disconnected, or if it is already closed, or if an error occurs during the close
- * operation, the platform must indicate this by invoking the `otPlatTcpHandleDisconnected` callback.
- *
- * The platform must always call `otPlatTcpHandleDisconnected()` to report the final outcome of the connection.
- * It is permissible for the platform implementation to invoke this callback directly from within `otPlatTcpClose()`
- * before returning. The OpenThread stack will handle this correctly.
- *
- * @param[in] aConn   The TCP connection.
- */
-void otPlatTcpClose(otPlatTcpConnection *aConn);
-
-/**
- * Aborts the TCP connection.
- *
- * This function forcefully terminates the connection. Any unsent data is discarded.
- *
- * After this call, the platform must forget the @p aConn. Importantly, it must not invoke any callbacks using the
- * @p aConn any longer, including `otPlatTcpHandleDisconnected`. This effectively indicates to the platform that the
- * OpenThread core is de-allocating the @p aConn instance and it is no longer valid.
- *
- * @param[in] aConn   The TCP connection.
- */
-void otPlatTcpAbort(otPlatTcpConnection *aConn);
-
-/**
- * Callback to notify the connection disconnection.
- *
- * This function is implemented and provided by the OpenThread stack for the platform to use.
- *
- * This callback should be invoked by the platform when it fails to establish a connection, when an established
- * connection is successfully closed (by both endpoints), when it times out, or is reset or aborted.
- *
- * After this callback is invoked, the `otPlatTcpConnection` instance is no longer valid. The platform must not use it
- * in any future callbacks.
- *
- * @param[in] aConn   The TCP connection.
- * @param[in] aReason The reason for the disconnection.
- */
-extern void otPlatTcpHandleDisconnected(otPlatTcpConnection *aConn, otPlatTcpDisconnectReason aReason);
-
-/**
- * Gets the OpenThread instance associated with a given TCP connection.
- *
- * This function is provided by OpenThread core. Platform implementations can use it to get the OpenThread instance
- * associated with an active `otPlatTcpConnection`.
- *
- * @param[in] aConn  The TCP connection.
- *
- * @returns The OpenThread instance.
- */
-extern otInstance *otPlatTcpGetInstanceForConnection(otPlatTcpConnection *aConn);
-
-/**
- * Gets the OpenThread instance associated with a given TCP listener.
- *
- * This function is provided by OpenThread core. Platform implementations can use it to get the OpenThread instance
- * associated with an active `otPlatTcpListener`.
- *
- * @param[in] aListener  The TCP listener.
- *
- * @returns The OpenThread instance.
- */
-extern otInstance *otPlatTcpGetInstanceForListener(otPlatTcpListener *aListener);
-
-/**
- * Iterates through the active TCP listeners.
- *
- * This function can be used to iterate over all currently active TCP listeners associated with the OpenThread
- * instance. It allows platform implementations to process or manage listeners without needing to maintain their own
- * list of active listeners.
- *
- * The iteration is guaranteed to remain consistent even if callbacks (e.g., `otPlatTcpAccept`) are invoked during the
- * process.
- *
- * @param[in] aInstance      The OpenThread instance.
- * @param[in] aPrevListener  A pointer to the previous listener, or `NULL` to start the iteration from the beginning.
- *
- * @returns A pointer to the next listener, or `NULL` if there are no more listeners.
- */
-extern otPlatTcpListener *otPlatTcpIterateListeners(otInstance *aInstance, otPlatTcpListener *aPrevListener);
-
-/**
- * Iterates through the active TCP connections.
- *
- * This function can be used to iterate over all currently active TCP connections associated with the OpenThread
- * instance. It allows platform implementations to process or manage connections without needing to maintain their own
- * list of active connections.
- *
- * The iteration is guaranteed to remain consistent and safe even if callbacks are invoked during the process. For
- * example, if a connection is reported as disconnected via `otPlatTcpHandleDisconnected` during iteration, the
- * OpenThread stack ensures that the connection entry remains valid until the iteration is completed.
- *
- * @param[in] aInstance  The OpenThread instance.
- * @param[in] aPrevConn  A pointer to the previous connection, or `NULL` to start the iteration from the beginning.
- *
- * @returns A pointer to the next connection, or `NULL` if there are no more connections.
- */
-extern otPlatTcpConnection *otPlatTcpIterateConnections(otInstance *aInstance, otPlatTcpConnection *aPrevConn);
-
-/**
- * @}
- */
-
-#ifdef __cplusplus
-} // extern "C"
-#endif
-
-#endif // OPENTHREAD_PLATFORM_TCP_H_
@@ -75,58 +75,6 @@ extern "C" {
 #define OT_TCAT_MAX_DEVICEID_SIZE 64           ///< TCAT max size of device ID.
 #define OT_TCAT_ENABLE_MAX 600                 ///< TCAT_ENABLE_MAX, default max TMF TCAT enable time,  in seconds.

-/**
- * Represents TCAT command TLV type.
- */
-typedef enum otTcatCommandTlvType
-{
-    // Command Class General
-    OT_TCAT_TLV_RESPONSE_WITH_STATUS      = 0x01, ///< TCAT response with status value TLV
-    OT_TCAT_TLV_RESPONSE_WITH_PAYLOAD     = 0x02, ///< TCAT response with payload TLV
-    OT_TCAT_TLV_RESPONSE_EVENT            = 0x03, ///< TCAT response event TLV (reserved)
-    OT_TCAT_TLV_GET_NETWORK_NAME          = 0x08, ///< TCAT network name query TLV
-    OT_TCAT_TLV_DISCONNECT                = 0x09, ///< TCAT disconnect request TLV
-    OT_TCAT_TLV_PING                      = 0x0A, ///< TCAT ping request TLV
-    OT_TCAT_TLV_GET_DEVICE_ID             = 0x0B, ///< TCAT device ID query TLV
-    OT_TCAT_TLV_GET_EXTENDED_PAN_ID       = 0x0C, ///< TCAT extended PAN ID query TLV
-    OT_TCAT_TLV_GET_PROVISIONING_URL      = 0x0D, ///< TCAT provisioning URL query TLV
-    OT_TCAT_TLV_PRESENT_PSKD_HASH         = 0x10, ///< TCAT rights elevation request TLV using PSKd hash
-    OT_TCAT_TLV_PRESENT_PSKC_HASH         = 0x11, ///< TCAT rights elevation request TLV using PSKc hash
-    OT_TCAT_TLV_PRESENT_INSTALL_CODE_HASH = 0x12, ///< TCAT rights elevation TLV using install code
-    OT_TCAT_TLV_REQUEST_RANDOM_CHALLENGE  = 0x13, ///< TCAT random number challenge query TLV
-
-    // Command Class Commissioning
-    OT_TCAT_TLV_SET_ACTIVE_OPERATIONAL_DATASET     = 0x20, ///< TCAT active operational dataset TLV
-    OT_TCAT_TLV_SET_ACTIVE_OPERATIONAL_DATASET_ALT = 0x21, ///< TCAT active dataset alt #1 TLV (reserved)
-    OT_TCAT_TLV_GET_COMMISSIONER_CERTIFICATE       = 0x25, ///< TCAT commissioner certificate query TLV
-    OT_TCAT_TLV_GET_DIAGNOSTIC_TLVS                = 0x26, ///< TCAT diagnostics TLVs query TLV
-    OT_TCAT_TLV_START_THREAD_INTERFACE             = 0x27, ///< TCAT start thread interface request TLV
-    OT_TCAT_TLV_STOP_THREAD_INTERFACE              = 0x28, ///< TCAT stop thread interface request TLV
-
-    // Command Class Extraction
-    OT_TCAT_TLV_GET_ACTIVE_OPERATIONAL_DATASET     = 0x40, ///< TCAT active operational dataset query TLV
-    OT_TCAT_TLV_GET_ACTIVE_OPERATIONAL_DATASET_ALT = 0x41, ///< TCAT active dataset alt #1 query TLV (reserved)
-
-    // Command Class Decommissioning
-    OT_TCAT_TLV_DECOMMISSION = 0x60, ///< TCAT decommission request TLV
-
-    // Command Class Application
-    OT_TCAT_TLV_GET_APPLICATION_LAYERS    = 0x80, ///< TCAT get application layers request TLV
-    OT_TCAT_TLV_SEND_APPLICATION_DATA_1   = 0x81, ///< TCAT send application data 1 TLV
-    OT_TCAT_TLV_SEND_APPLICATION_DATA_2   = 0x82, ///< TCAT send application data 2 TLV
-    OT_TCAT_TLV_SEND_APPLICATION_DATA_3   = 0x83, ///< TCAT send application data 3 TLV
-    OT_TCAT_TLV_SEND_APPLICATION_DATA_4   = 0x84, ///< TCAT send application data 4 TLV
-    OT_TCAT_TLV_SERVICE_NAME_UDP          = 0x89, ///< TCAT service name UDP sub-TLV (not used as a command)
-    OT_TCAT_TLV_SERVICE_NAME_TCP          = 0x8A, ///< TCAT service name TCP sub-TLV (not used as a command)
-    OT_TCAT_TLV_SEND_VENDOR_SPECIFIC_DATA = 0x9F, ///< TCAT send vendor specific command or data TLV
-
-    // Command Class CCM
-    OT_TCAT_TLV_SET_LDEV_ID_OPERATIONAL_CERT = 0xA0, ///< TCAT set LDevID certificate TLV (reserved)
-    OT_TCAT_TLV_SET_LDEV_ID_PRIVATE_KEY      = 0xA1, ///< TCAT set LDevID certificate private key TLV (reserved)
-    OT_TCAT_TLV_SET_DOMAIN_CA_CERT           = 0xA2, ///< TCAT set domain CA certificate TLV (reserved)
-
-} otTcatCommandTlvType;
-
 /**
 * Represents TCAT status code.
 */
@@ -205,6 +153,35 @@ typedef struct otTcatGeneralDeviceId
    uint8_t  mDeviceId[OT_TCAT_MAX_DEVICEID_SIZE];
 } otTcatGeneralDeviceId;

+/**
+ * This structure represents a TCAT vendor information.
+ *
+ * The content of this structure MUST persist and remain unchanged while a TCAT session is running.
+ */
+typedef struct otTcatVendorInfo
+{
+    const char *mProvisioningUrl; ///< Provisioning URL path string
+    const char *mVendorName;      ///< Vendor name string
+    const char *mVendorModel;     ///< Vendor model string
+    const char *mVendorSwVersion; ///< Vendor software version string
+    const char *mVendorData;      ///< Vendor specific data string
+    const char *mPskdString;      ///< Vendor managed pre-shared key for device
+    const char *mInstallCode;     ///< Vendor managed install code string
+    const otTcatAdvertisedDeviceId
+        *mAdvertisedDeviceIds;                     /** Vendor managed advertised device ID array.
+                                                       Array is terminated like C string with OT_TCAT_DEVICE_ID_EMPTY */
+    const otTcatGeneralDeviceId *mGeneralDeviceId; /** Vendor managed general device ID array.
+                                                       (if NULL: device ID is set to EUI-64 in binary format) */
+    const char *mApplicationServiceName[OT_TCAT_APPLICATION_LAYER_MAX_COUNT]; /** Array with application service names
+                                                                                  as C string with maximum length
+                                                                                  OT_TCAT_SERVICE_NAME_MAX_LENGTH or
+                                                                                  NULL if not supported */
+    bool mApplicationServiceIsTcp[OT_TCAT_APPLICATION_LAYER_MAX_COUNT];       /** Array with boolean values indicating
+                                                                                  if the service is of TCP type (otherwise
+                                                                                  UDP) */
+
+} otTcatVendorInfo;
+
 /**
 * Pointer to call when application data or vendor-specific data was received over a TCAT TLS connection.
 * The application may generate a response to an incoming TCAT application data packet. The TCAT agent
@@ -224,12 +201,9 @@ typedef void (*otHandleTcatApplicationDataReceive)(otInstance               *aIn
                                                   void                     *aContext);

 /**
- * Pointer to call to notify of a network join/leave operation initiated under guidance of a TCAT Commissioner.
+ * Pointer to call to notify the completion of a network join/leave operation performed under
+ * guidance of a TCAT Commissioner.
 *
- * @param[in]  aInstance        A pointer to an OpenThread instance.
- * @param[in]  aIsJoin          True if the operation was a network join (OT_TCAT_TLV_START_THREAD_INTERFACE),
- *                              false if it was a network leave (OT_TCAT_TLV_STOP_THREAD_INTERFACE or
- *                              OT_TCAT_TLV_DECOMMISSION).
 * @param[in]  aError           OT_ERROR_NONE if the network join/leave operation was successfully started.
 *                              OT_ERROR_INVALID_STATE if network join was requested but network credentials
 *                                                     were missing or incomplete.
@@ -239,71 +213,7 @@ typedef void (*otHandleTcatApplicationDataReceive)(otInstance               *aIn
 *                                                credential mismatch.
 * @param[in]  aContext         A pointer to arbitrary context information.
 */
-typedef void (*otHandleTcatJoin)(otInstance *aInstance, bool aIsJoin, otError aError, void *aContext);
-
-/**
- * Pointer to call to control if a TCAT TLV of a specific type is supported. The application may allow
- * or reject processing of a received TCAT command based on an application defined policy.
- * If no handler is defined, all received TCAT commands will be allowed if the respective command class
- * is authorized. If a handler is defined and returns false, the TCAT command will be rejected with status
- * OT_TCAT_STATUS_UNSUPPORTED. If the handler returns true, the TCAT command will be allowed if the respective
- * command class is authorized.
- *
- * @param[in]  aInstance                 A pointer to an OpenThread instance.
- * @param[in]  aTlvType                  A TLV type to be authorized.
- * @param[in]  aContext                  A pointer to arbitrary context information.
- *
- * @returns a boolean value indicating whether the TLV type is supported, based on current policy.
- */
-typedef bool (*otHandleTcatTlvSupport)(otInstance *aInstance, otTcatCommandTlvType aTlvType, void *aContext);
-
-/**
- * This structure represents a TCAT vendor information.
- *
- * The content of this structure MUST persist and remain unchanged while a TCAT session is running.
- */
-typedef struct otTcatVendorInfo
-{
-    const char *mProvisioningUrl; ///< Provisioning URL path string
-    const char *mVendorName;      ///< Vendor name string
-    const char *mVendorModel;     ///< Vendor model string
-    const char *mVendorSwVersion; ///< Vendor software version string
-    const char *mVendorData;      ///< Vendor specific data string
-    const char *mPskdString;      ///< Vendor managed pre-shared key for device
-    const char *mInstallCode;     ///< Vendor managed install code string
-
-    /**
-     * Vendor managed advertised device ID array. Array is terminated like C string with OT_TCAT_DEVICE_ID_EMPTY.
-     */
-    const otTcatAdvertisedDeviceId *mAdvertisedDeviceIds;
-
-    /**
-     * Vendor managed general device ID array (if NULL: device ID is set to EUI-64 in binary format)
-     */
-    const otTcatGeneralDeviceId *mGeneralDeviceId;
-
-    /**
-     * Array with application service names as C string with maximum length OT_TCAT_SERVICE_NAME_MAX_LENGTH or NULL if
-     * not supported.
-     */
-    const char *mApplicationServiceName[OT_TCAT_APPLICATION_LAYER_MAX_COUNT];
-
-    /**
-     * Array with boolean values indicating if the service is of TCP type (otherwise UDP).
-     */
-    bool mApplicationServiceIsTcp[OT_TCAT_APPLICATION_LAYER_MAX_COUNT];
-
-    bool mKeepActiveAfterJoining; ///< Continue advertising after thread interface has joined a network
-
-    /**
-     * Prevent activating advertising indefinitely after the TCAT command OT_TCAT_TLV_STOP_THREAD_INTERFACE or
-     * OT_TCAT_TLV_DECOMMISSION has been received.
-     */
-    bool mDoNotActivateAfterLeaving;
-
-    otHandleTcatTlvSupport mTlvSupportHandler; ///< Optional pointer to a function to control TCAT TLV support
-
-} otTcatVendorInfo;
+typedef void (*otHandleTcatJoin)(otError aError, void *aContext);

 /**
 * @}
@@ -628,6 +628,38 @@ const char *otThreadGetDomainName(otInstance *aInstance);
 */
 otError otThreadSetDomainName(otInstance *aInstance, const char *aDomainName);

+/**
+ * Sets or clears the Interface Identifier manually specified for the Thread Domain Unicast Address.
+ *
+ * Available when `OPENTHREAD_CONFIG_DUA_ENABLE` is enabled.
+ *
+ * @note Only available since Thread 1.2.
+ *
+ * @param[in]  aInstance   A pointer to an OpenThread instance.
+ * @param[in]  aIid        A pointer to the Interface Identifier to set or NULL to clear.
+ *
+ * @retval OT_ERROR_NONE           Successfully set/cleared the Interface Identifier.
+ * @retval OT_ERROR_INVALID_ARGS   The specified Interface Identifier is reserved.
+ *
+ * @sa otThreadGetFixedDuaInterfaceIdentifier
+ */
+otError otThreadSetFixedDuaInterfaceIdentifier(otInstance *aInstance, const otIp6InterfaceIdentifier *aIid);
+
+/**
+ * Gets the Interface Identifier manually specified for the Thread Domain Unicast Address.
+ *
+ * Available when `OPENTHREAD_CONFIG_DUA_ENABLE` is enabled.
+ *
+ * @note Only available since Thread 1.2.
+ *
+ * @param[in]  aInstance A pointer to an OpenThread instance.
+ *
+ * @returns A pointer to the Interface Identifier which was set manually, or NULL if none was set.
+ *
+ * @sa otThreadSetFixedDuaInterfaceIdentifier
+ */
+const otIp6InterfaceIdentifier *otThreadGetFixedDuaInterfaceIdentifier(otInstance *aInstance);
+
 /**
 * Gets the thrKeySequenceCounter.
 *
@@ -1040,6 +1072,24 @@ void otThreadSendAddressNotification(otInstance               *aInstance,
                                     otIp6Address             *aTarget,
                                     otIp6InterfaceIdentifier *aMlIid);

+/**
+ * Sends a Proactive Backbone Notification (PRO_BB.ntf) message on the Backbone link.
+ *
+ * Is only available when `OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE` is enabled.
+ *
+ * @param[in]  aInstance                    A pointer to an OpenThread instance.
+ * @param[in]  aTarget                      The target address of the PRO_BB.ntf message.
+ * @param[in]  aMlIid                       The ML-IID of the PRO_BB.ntf message.
+ * @param[in]  aTimeSinceLastTransaction    Time since last transaction (in seconds).
+ *
+ * @retval OT_ERROR_NONE           Successfully sent PRO_BB.ntf on backbone link.
+ * @retval OT_ERROR_NO_BUFS        If insufficient message buffers available.
+ */
+otError otThreadSendProactiveBackboneNotification(otInstance               *aInstance,
+                                                  otIp6Address             *aTarget,
+                                                  otIp6InterfaceIdentifier *aMlIid,
+                                                  uint32_t                  aTimeSinceLastTransaction);
+
 /**
 * Notifies other nodes in the network (if any) and then stops Thread protocol operation.
 *
@@ -153,15 +153,12 @@ uint16_t otThreadGetMaxAllowedChildren(otInstance *aInstance);
 otError otThreadSetMaxAllowedChildren(otInstance *aInstance, uint16_t aMaxChildren);

 /**
- * Indicates whether or not the device is allowed to take router or leader roles.
- *
- * A device is allowed to become a router if it is a Full Thread Device (FTD), is currently configured to be
- * router-eligible (see `otThreadSetRouterEligible(true)`), and the active Security Policy permits routers.
+ * Indicates whether or not the device is router-eligible.
 *
 * @param[in]  aInstance A pointer to an OpenThread instance.
 *
- * @retval TRUE   If the router role is allowed.
- * @retval FALSE  If the router role is not allowed.
+ * @retval TRUE   If device is router-eligible.
+ * @retval FALSE  If device is not router-eligible.
 */
 bool otThreadIsRouterEligible(otInstance *aInstance);

@@ -180,16 +177,14 @@ bool otThreadIsRouterEligible(otInstance *aInstance);
 otError otThreadSetRouterEligible(otInstance *aInstance, bool aEligible);

 /**
- * Sets the preferred Router Id.
- *
- * Requires `OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE`.
+ * Set the preferred Router Id.
 *
 * Upon becoming a router/leader the node attempts to use this Router Id. If the preferred Router Id is not set or if
 * it can not be used, a randomly generated router id is picked. This property can be set only when the device role is
 * either detached or disabled.
 *
- * @note This API is reserved for testing and demo purposes only. Changing settings with this API will render a
- * production application non-compliant with the Thread Specification.
+ * @note This API is reserved for testing and demo purposes only. Changing settings with
+ * this API will render a production application non-compliant with the Thread Specification.
 *
 * @param[in]  aInstance    A pointer to an OpenThread instance.
 * @param[in]  aRouterId    The preferred Router Id.
@@ -629,15 +624,6 @@ otError otThreadGetRouterInfo(otInstance *aInstance, uint16_t aRouterId, otRoute
 */
 otError otThreadGetNextCacheEntry(otInstance *aInstance, otCacheEntryInfo *aEntryInfo, otCacheEntryIterator *aIterator);

-/**
- * Clears the EID cache.
- *
- * Intended for testing only.
- *
- * @param[in]     aInstance   A pointer to an OpenThread instance.
- */
-void otThreadClearEidCache(otInstance *aInstance);
-
 /**
 * Get the Thread PSKc
 *
@@ -54,6 +54,7 @@ build_nrf52840()
        "-DOT_DIAGNOSTIC=ON"
        "-DOT_DNSSD_SERVER=ON"
        "-DOT_DNS_CLIENT=ON"
+        "-DOT_DUA=ON"
        "-DOT_ECDSA=ON"
        "-DOT_FULL_LOGS=ON"
        "-DOT_JAM_DETECTION=ON"
@@ -158,23 +158,31 @@ build_all_features()
    # Build Thread 1.4 with full features
    reset_source
    CFLAGS="${cppflags[*]} ${CFLAGS}" CXXFLAGS="${cppflags[*]} ${CXXFLAGS}" \
-        "$(dirname "$0")"/cmake-build simulation "${options[@]}"
+        "$(dirname "$0")"/cmake-build simulation "${options[@]}" -DOT_DUA=ON

    # Build Thread 1.4 with external heap and msg pool using heap
    reset_source
    CFLAGS="${cppflags[*]} ${CFLAGS} -DOPENTHREAD_CONFIG_MESSAGE_USE_HEAP_ENABLE=1" \
        CXXFLAGS="${cppflags[*]} ${CXXFLAGS} -DOPENTHREAD_CONFIG_MESSAGE_USE_HEAP_ENABLE=1" \
-        "$(dirname "$0")"/cmake-build simulation "${options[@]}"
+        "$(dirname "$0")"/cmake-build simulation "${options[@]}" -DOT_DUA=ON

    # Build Thread 1.4 with full features and no log
    reset_source
    CFLAGS="${cppflags[*]} ${CFLAGS}" CXXFLAGS="${cppflags[*]} ${CXXFLAGS}" \
-        "$(dirname "$0")"/cmake-build simulation "${options[@]}" -DOT_LOG_OUTPUT=NONE
+        "$(dirname "$0")"/cmake-build simulation "${options[@]}" -DOT_DUA=ON -DOT_LOG_OUTPUT=NONE

    # Build Thread 1.4 with full features and full logs
    reset_source
    CFLAGS="${cppflags[*]} ${CFLAGS}" CXXFLAGS="${cppflags[*]} ${CXXFLAGS}" \
-        "$(dirname "$0")"/cmake-build simulation "${options[@]}" -DOT_FULL_LOGS=ON
+        "$(dirname "$0")"/cmake-build simulation "${options[@]}" -DOT_DUA=ON -DOT_FULL_LOGS=ON
+
+    # Build Thread 1.4 Backbone Router without DUA ND Proxying
+    reset_source
+    "$(dirname "$0")"/cmake-build simulation "${options[@]}" -DOT_BACKBONE_ROUTER_DUA_NDPROXYING=OFF
+
+    # Build Thread 1.4 Backbone Router without Multicast Routing
+    reset_source
+    "$(dirname "$0")"/cmake-build simulation "${options[@]}" -DOT_BACKBONE_ROUTER_MULTICAST_ROUTING=OFF

    # Build with Vendor Extension
    reset_source
@@ -188,7 +196,7 @@ build_all_features()

    # Build Thread 1.4 with full features and OT_ASSERT=OFF
    reset_source
-    "$(dirname "$0")"/cmake-build simulation "${options[@]}" -DOT_ASSERT=OFF
+    "$(dirname "$0")"/cmake-build simulation "${options[@]}" -DOT_DUA=ON -DOT_ASSERT=OFF

    # Build with RAM settings
    reset_source
@@ -64,7 +64,6 @@ test_ipv6()

    OT_NODE_TYPE=rcp OT_SIMULATION_LOCAL_HOST=$IFACE_NAME $EXPECT_TEST
    OT_NODE_TYPE=rcp OT_SIMULATION_LOCAL_HOST=$IP6ADDR $EXPECT_TEST
-    OT_NODE_TYPE=rcp OT_SIMULATION_LOCAL_HOST=::1 $EXPECT_TEST
 }

 test_ipv4()
@@ -125,7 +125,7 @@ build_nrf52840()
    git archive "${sha}" | tar x -C "${OT_TMP_DIR}/${folder}/openthread"

    if [ ! -e "${OT_TMP_DIR}/${folder}/openthread/examples/config/${config_name}" ]; then
-        # Check if the config headers are not present, copy from
+        # Check if the the config headers are not present, copy from
        # the main sha.
        case "$1" in
            br)
@@ -67,7 +67,7 @@ OT_CMAKE_NINJA_TARGET=${OT_CMAKE_NINJA_TARGET-}
 OT_SRCDIR="$(cd "$(dirname "$0")"/.. && pwd)"
 readonly OT_SRCDIR

-OT_PLATFORMS=(simulation posix)
+OT_PLATFORMS=(simulation posix android-ndk)
 readonly OT_PLATFORMS

 OT_CLEAN_INTERMEDIATES="${OT_CLEAN_INTERMEDIATES-${GITHUB_ACTION-}}"
@@ -166,6 +166,58 @@ main()
    )

    case "${platform}" in
+        android-ndk)
+            if [ -z "${NDK-}" ]; then
+                echo "
+The 'NDK' environment variable needs to point to the Android NDK toolchain.
+Please ensure the NDK is downloaded and extracted then try to run this script again
+
+For example:
+    NDK=/opt/android-ndk-r25c ./script/cmake-build-android
+
+You can download the NDK at https://developer.android.com/ndk/downloads
+
+            "
+                exit 1
+            fi
+
+            NDK_CMAKE_TOOLCHAIN_FILE="${NDK?}/build/cmake/android.toolchain.cmake"
+            if [ ! -f "${NDK_CMAKE_TOOLCHAIN_FILE}" ]; then
+                echo "
+Could not fild the Android NDK CMake toolchain file
+- NDK=${NDK}
+- NDK_CMAKE_TOOLCHAIN_FILE=${NDK_CMAKE_TOOLCHAIN_FILE}
+
+            "
+                exit 2
+            fi
+            local_options+=(
+                "-DOT_LOG_OUTPUT=PLATFORM_DEFINED"
+
+                # Add Android NDK flags
+                "-DOT_ANDROID_NDK=1"
+                "-DCMAKE_TOOLCHAIN_FILE=${NDK?}/build/cmake/android.toolchain.cmake"
+
+                # Android API needs to be >= android-24 for `getifsaddrs()`
+                "-DANDROID_PLATFORM=android-24"
+
+                # Store thread settings in the CWD when executing ot-cli or ot-daemon
+                '-DOT_POSIX_SETTINGS_PATH="./thread"'
+            )
+
+            # Rewrite platform to posix
+            platform="posix"
+
+            # Check if OT_DAEMON or OT_APP_CLI flags are needed
+            if [[ ${OT_CMAKE_NINJA_TARGET[*]} =~ "ot-daemon" ]] || [[ ${OT_CMAKE_NINJA_TARGET[*]} =~ "ot-ctl" ]]; then
+                local_options+=("-DOT_DAEMON=ON")
+            elif [[ ${OT_CMAKE_NINJA_TARGET[*]} =~ "ot-cli" ]]; then
+                local_options+=("-DOT_APP_CLI=ON")
+            fi
+
+            options+=("${local_options[@]}")
+            ;;
+
        posix)
            local_options+=(
                "-DOT_TCP=OFF"
@@ -65,8 +65,7 @@ try_clone()
        shift
        git clone "$@" 2>&1
    else
-        dest_dir="$(LC_ALL=C git clone "$@" 2>&1 | tee /dev/stderr | sed -n "s/^Cloning into '\([^']*\)'.*/\1/p")"
-        dest_dir="${dest_dir%%$'\n'*}"
+        dest_dir="$(git clone "$@" 2>&1 | tee | cut -d\' -f2)"

        cd "${dest_dir}"
        apply_dependencies
@@ -112,6 +112,7 @@ OT_CLANG_TIDY_BUILD_OPTS=(
    '-DOT_DNS_UPSTREAM_QUERY=ON'
    "-DOT_DNSSD_DISCOVERY_PROXY=ON"
    '-DOT_DNSSD_SERVER=ON'
+    '-DOT_DUA=ON'
    '-DOT_MLR=ON'
    '-DOT_ECDSA=ON'
    '-DOT_HISTORY_TRACKER=ON'
@@ -125,6 +125,7 @@ build_simulation()
    fi

    if [[ ${version} != "1.1" ]]; then
+        options+=("-DOT_DUA=ON")
        options+=("-DOT_MLR=ON")
    fi

@@ -183,6 +184,7 @@ build_posix()
    )

    if [[ ${version} != "1.1" ]]; then
+        options+=("-DOT_DUA=ON")
        options+=("-DOT_MLR=ON")
        options+=("-DOT_LINK_METRICS_INITIATOR=ON")
        options+=("-DOT_LINK_METRICS_SUBJECT=ON")
@@ -344,12 +346,14 @@ do_build_otbr_docker()
        "-DOT_ANYCAST_LOCATOR=ON"
        "-DOT_COVERAGE=ON"
        "-DOT_DNS_CLIENT=ON"
+        "-DOT_DUA=ON"
        "-DOT_MLR=ON"
        "-DOT_NETDATA_PUBLISHER=ON"
        "-DOT_SLAAC=ON"
        "-DOT_SRP_CLIENT=ON"
        "-DOT_FULL_LOGS=ON"
        "-DOT_UPTIME=ON"
+        "-DOTBR_DUA_ROUTING=ON"
        "-DOTBR_DHCP6_PD=ON"
    )
    local args=(
@@ -391,7 +395,7 @@ do_build_otbr_docker()

    (
        if [[ -z ${LOCAL_OTBR_DIR} ]]; then
-            ./script/git-tool clone https://github.com/openthread/ot-br-posix.git --depth 1 --recurse-submodules --shallow-submodules "${otbrdir}"
+            ./script/git-tool clone https://github.com/openthread/ot-br-posix.git --depth 1 "${otbrdir}"
        else
            rsync -r \
                --exclude=third_party/openthread/repo \
@@ -30,7 +30,6 @@ import("../../etc/gn/openthread.gni")
 openthread_cli_sources = [
  "cli.cpp",
  "cli.hpp",
-  "cli_api.cpp",
  "cli_ba.cpp",
  "cli_ba.hpp",
  "cli_bbr.cpp",
@@ -33,7 +33,6 @@ set(COMMON_INCLUDES

 set(COMMON_SOURCES
    cli.cpp
-    cli_api.cpp
    cli_ba.cpp
    cli_bbr.cpp
    cli_br.cpp
@@ -50,6 +50,7 @@ Done
 - [discover](#discover-channel)
 - [dns](#dns-config)
 - [domainname](#domainname)
+- [dua](#dua-iid)
 - [eidcache](#eidcache)
 - [eui64](#eui64)
 - [extaddr](#extaddr)
@@ -173,6 +174,30 @@ BBR Primary: None
 Done
 ```

+### bbr mgmt dua \<status\|coap-code\> [meshLocalIid]
+
+Configure the response status for DUA.req with meshLocalIid in payload. Without meshLocalIid, simply respond any coming DUA.req next with the specified status or COAP code.
+
+Only for testing/reference device.
+
+known status value:
+
+- 0: ST_DUA_SUCCESS
+- 1: ST_DUA_REREGISTER
+- 2: ST_DUA_INVALID
+- 3: ST_DUA_DUPLICATE
+- 4: ST_DUA_NO_RESOURCES
+- 5: ST_DUA_BBR_NOT_PRIMARY
+- 6: ST_DUA_GENERAL_FAILURE
+- 160: COAP code 5.00
+
+```bash
+> bbr mgmt dua 1 2f7c235e5025a2fd
+Done
+> bbr mgmt dua 160
+Done
+```
+
 ### bbr mgmt mlr listener

 Show the Multicast Listeners.
@@ -396,7 +421,7 @@ Requires the `OPENTHREAD_CONFIG_BORDER_AGENT_MESHCOP_SERVICE_ENABLE` feature.

 The name can also be configured using the `OPENTHREAD_CONFIG_BORDER_AGENT_MESHCOP_SERVICE_BASE_NAME` configuration option (which is the recommended way to specify this name). This CLI command (and its corresponding API) is provided for projects where the name needs to be set after device initialization and at run-time.

-Per the Thread specification, the service instance should be a user-friendly name identifying the device model or product. A recommended format is "VendorName ProductName". To construct the full name and ensure name uniqueness, the OpenThread Border Agent module appends a suffix (e.g., " #XXXX" where "XXXX" represents the last two bytes of the device's Extended Address in hex) to the given base name. If a name conflict is detected on the network, an additional index may be appended (e.g., " #XXXX (1)"). Note that the same name will be used for the ephemeral key service `_meshcop-e._udp` when the ephemeral key feature is enabled and used.
+Per the Thread specification, the service instance should be a user-friendly name identifying the device model or product. A recommended format is "VendorName ProductName". To construct the full name and ensure name uniqueness, the OpenThread Border Agent module will append the Extended Address of the device (as 16-character hex digits) to the given base name. Note that the same name will be used for the ephemeral key service `_meshcop-e._udp` when the ephemeral key feature is enabled and used.

 ```bash
 ba servicebasename OpenThreadBorderAgent
@@ -1511,10 +1536,11 @@ The generated output encompasses the following information:
 - Version
 - Current state
 - Uptime and attach time
- Extended MAC address and RLOC16
- Active Operational Dataset (redacted)
+- Channel
+- PAN IDs, extended MAC address, and RLOC16
 - Unicast and multicast IPv6 address list
 - Network Data
+- Partition ID
 - Leader Data
 - Buffer info
 - Network statistics
@@ -1934,6 +1960,34 @@ Set the Thread Domain Name for Thread 1.2 device.
 Done
 ```

+### dua iid
+
+Get the Interface Identifier manually specified for Thread Domain Unicast Address on Thread 1.2 device.
+
+```bash
+> dua iid
+0004000300020001
+Done
+```
+
+### dua iid \<iid\>
+
+Set the Interface Identifier manually specified for Thread Domain Unicast Address on Thread 1.2 device.
+
+```bash
+> dua iid 0004000300020001
+Done
+```
+
+### dua iid clear
+
+Clear the Interface Identifier manually specified for Thread Domain Unicast Address on Thread 1.2 device.
+
+```bash
+> dua iid clear
+Done
+```
+
 ### eidcache

 Print the EID-to-RLOC cache entries.
@@ -2503,7 +2557,7 @@ Locate the closest destination of an anycast address (i.e., find the destination

 `OPENTHREAD_CONFIG_TMF_ANYCAST_LOCATOR_ENABLE` is required.

-The closest destination is determined based on the current routing table and path costs within the Thread mesh.
+The closest destination is determined based on the the current routing table and path costs within the Thread mesh.

 Locate the leader using its anycast address:

@@ -3543,7 +3597,7 @@ Done

 ### prefix

-Get the prefix list in the local Network Data.
+Get the prefix list in the local Network Data. Note: For the Thread 1.2 border router with backbone capability, the local Domain Prefix would be listed as well (with flag `D`), with preceding `-` if backbone functionality is disabled.

 ```bash
 > prefix
@@ -3556,6 +3610,8 @@ Done

 Add a valid prefix to the Network Data.

+Note: The Domain Prefix flag (`D`) is only available for Thread 1.2.
+
 - p: Preferred flag
 - a: Stateless IPv6 Address Autoconfiguration flag
 - d: DHCPv6 IPv6 Address Configuration flag
@@ -3564,6 +3620,7 @@ Add a valid prefix to the Network Data.
 - o: On Mesh flag
 - s: Stable flag
 - n: Nd Dns flag
+- D: Domain Prefix flag
 - prf: Default router preference, which may be 'high', 'med', or 'low'.

 ```bash
@@ -430,6 +430,7 @@ Peer BRs are other devices within the Thread mesh that provide external IP conne

 - It has added at least one external route entry.
 - It has added at least one prefix entry with both the default-route and on-mesh flags set.
+- It has added at least one domain prefix (with both the domain and on-mesh flags set).

 The list of peer BRs specifically excludes the current device, even if it is itself acting as a BR.

@@ -466,6 +466,7 @@ The flags are as follows:
 - `o`: On Mesh flag
 - `s`: Stable flag
 - `n`: Nd Dns flag
+- `D`: Domain Prefix flag

 Print the history as a table.

@@ -283,6 +283,7 @@ Publish an on-mesh prefix entry.
 - o: On Mesh flag
 - s: Stable flag
 - n: Nd Dns flag
+- D: Domain Prefix flag (only available for Thread 1.2).
 - prf: Preference, which may be 'high', 'med', or 'low'.

 ```bash
@@ -351,6 +352,7 @@ On-mesh prefixes are listed under `Prefixes` header:
  - o: On Mesh flag
  - s: Stable flag
  - n: Nd Dns flag
+  - D: Domain Prefix flag (only available for Thread 1.2).
 - Preference `high`, `med`, or `low`
 - RLOC16 of device which added the on-mesh prefix

@@ -49,7 +49,6 @@
 #include <openthread/dataset_ftd.h>
 #include <openthread/diag.h>
 #include <openthread/dns.h>
-#include <openthread/heap.h>
 #include <openthread/icmp6.h>
 #include <openthread/nat64.h>
 #include <openthread/ncp.h>
@@ -71,14 +70,14 @@
 namespace ot {
 namespace Cli {

+Interpreter *Interpreter::sInterpreter = nullptr;
+static OT_DEFINE_ALIGNED_VAR(sInterpreterRaw, sizeof(Interpreter), uint64_t);
+
 Interpreter::Interpreter(Instance *aInstance, otCliOutputCallback aCallback, void *aContext)
    : OutputImplementer(aCallback, aContext)
    , Utils(aInstance, *this)
    , mCommandIsPending(false)
    , mInternalDebugCommand(false)
-#if OPENTHREAD_CONFIG_CLI_PROMPT_ENABLE
-    , mPromptEnabled(true)
-#endif
    , mTimer(*aInstance, HandleTimer, this)
 #if OPENTHREAD_FTD || OPENTHREAD_MTD
 #if OPENTHREAD_CONFIG_SNTP_CLIENT_ENABLE
@@ -164,9 +163,7 @@ void Interpreter::OutputResult(otError aError)
    {
        if (aError != OT_ERROR_NONE)
        {
-            // For internal debug commands, prepending `*` to prevent cli client from treating this as a fatal error and
-            // exit.
-            OutputLine("* Error %u: %s", aError, otThreadErrorToString(aError));
+            OutputLine("Error %u: %s", aError, otThreadErrorToString(aError));
        }

        ExitNow();
@@ -397,35 +394,24 @@ otError Interpreter::ProcessUserCommands(Arg aArgs[])

 otError Interpreter::SetUserCommands(const otCliCommand *aCommands, uint8_t aLength, void *aContext)
 {
-    otError error = OT_ERROR_NONE;
+    otError error = OT_ERROR_FAILED;

    for (UserCommandsEntry &entry : mUserCommands)
    {
-        if (entry.mCommands == aCommands)
-        {
-            // Ignore if already registered.
-            ExitNow();
-        }
-
        if (entry.mCommands == nullptr)
        {
            entry.mCommands = aCommands;
            entry.mLength   = aLength;
            entry.mContext  = aContext;
-            ExitNow();
+
+            error = OT_ERROR_NONE;
+            break;
        }
    }

-    error = OT_ERROR_NO_BUFS;
-
-exit:
    return error;
 }

-#if OPENTHREAD_CONFIG_CLI_PROMPT_ENABLE
-void Interpreter::SetPromptConfig(bool aEnabled) { mPromptEnabled = aEnabled; }
-#endif
-
 #if OPENTHREAD_FTD || OPENTHREAD_MTD

 /**
@@ -751,12 +737,6 @@ void Interpreter::OutputBorderAgentTxtDataInfo(uint8_t aIndentSize, const otBord
        OutputLine(aIndentSize, "ModelName: %s", aInfo.mModelName);
    }

-    if (aInfo.mHasVendorOui)
-    {
-        OutputLine(aIndentSize, "VendorOui: %02X-%02X-%02X", aInfo.mVendorOui[0], aInfo.mVendorOui[1],
-                   aInfo.mVendorOui[2]);
-    }
-
    if (aInfo.mHasStateBitmap)
    {
        uint8_t indent = aIndentSize + kIndentSize;
@@ -1102,6 +1082,70 @@ template <> otError Interpreter::Process<Cmd("domainname")>(Arg aArgs[])
    return ProcessGetSet(aArgs, otThreadGetDomainName, otThreadSetDomainName);
 }

+#if OPENTHREAD_CONFIG_DUA_ENABLE
+template <> otError Interpreter::Process<Cmd("dua")>(Arg aArgs[])
+{
+    otError error = OT_ERROR_NONE;
+
+    /**
+     * @cli dua iid
+     * @code
+     * dua iid
+     * 0004000300020001
+     * Done
+     * @endcode
+     * @par api_copy
+     * #otThreadGetFixedDuaInterfaceIdentifier
+     */
+    if (aArgs[0] == "iid")
+    {
+        if (aArgs[1].IsEmpty())
+        {
+            const otIp6InterfaceIdentifier *iid = otThreadGetFixedDuaInterfaceIdentifier(GetInstancePtr());
+
+            if (iid != nullptr)
+            {
+                OutputBytesLine(iid->mFields.m8);
+            }
+        }
+        /**
+         * @cli dua iid (set,clear)
+         * @code
+         * dua iid 0004000300020001
+         * Done
+         * @endcode
+         * @code
+         * dua iid clear
+         * Done
+         * @endcode
+         * @cparam dua iid @ca{iid|clear}
+         * `dua iid clear` passes a `nullptr` to #otThreadSetFixedDuaInterfaceIdentifier.
+         * Otherwise, you can pass the `iid`.
+         * @par api_copy
+         * #otThreadSetFixedDuaInterfaceIdentifier
+         */
+        else if (aArgs[1] == "clear")
+        {
+            error = otThreadSetFixedDuaInterfaceIdentifier(GetInstancePtr(), nullptr);
+        }
+        else
+        {
+            otIp6InterfaceIdentifier iid;
+
+            SuccessOrExit(error = aArgs[1].ParseAsHexString(iid.mFields.m8));
+            error = otThreadSetFixedDuaInterfaceIdentifier(GetInstancePtr(), &iid);
+        }
+    }
+    else
+    {
+        error = OT_ERROR_INVALID_COMMAND;
+    }
+
+exit:
+    return error;
+}
+#endif // OPENTHREAD_CONFIG_DUA_ENABLE
+
 #endif // (OPENTHREAD_CONFIG_THREAD_VERSION >= OT_THREAD_VERSION_1_2)

 /**
@@ -2874,53 +2918,35 @@ void Interpreter::OutputEidCacheEntry(const otCacheEntryInfo &aEntry)
    OutputNewLine();
 }

+/**
+ * @cli eidcache
+ * @code
+ * eidcache
+ * fd49:caf4:a29f:dc0e:97fc:69dd:3c16:df7d 2000 cache canEvict=1 transTime=0 eid=fd49:caf4:a29f:dc0e:97fc:69dd:3c16:df7d
+ * fd49:caf4:a29f:dc0e:97fc:69dd:3c16:df7f fffe retry canEvict=1 timeout=10 retryDelay=30
+ * Done
+ * @endcode
+ * @par
+ * Returns the EID-to-RLOC cache entries.
+ * @sa otThreadGetNextCacheEntry
+ */
 template <> otError Interpreter::Process<Cmd("eidcache")>(Arg aArgs[])
 {
-    otError error = OT_ERROR_NONE;
+    OT_UNUSED_VARIABLE(aArgs);

-    /**
-     * @cli eidcache
-     * @code
-     * eidcache
-     * fd49:caf4:a29f:dc0e:97fc:69dd:3c16:df7d 2000 cache canEvict=1 transTime=0
-     * eid=fd49:caf4:a29f:dc0e:97fc:69dd:3c16:df7d fd49:caf4:a29f:dc0e:97fc:69dd:3c16:df7f fffe retry
-     * canEvict=1 timeout=10 retryDelay=30 Done
-     * @endcode
-     * @par
-     * Returns the EID-to-RLOC cache entries.
-     * @sa otThreadGetNextCacheEntry
-     */
-    if (aArgs[0].IsEmpty())
-    {
-        otCacheEntryIterator iterator;
-        otCacheEntryInfo     entry;
+    otCacheEntryIterator iterator;
+    otCacheEntryInfo     entry;

-        ClearAllBytes(iterator);
-        while (true)
-        {
-            SuccessOrExit(otThreadGetNextCacheEntry(GetInstancePtr(), &entry, &iterator));
-            OutputEidCacheEntry(entry);
-        }
-    }
-    /**
-     * @cli eidcache clear
-     * @code
-     * eidcache clear
-     * Done
-     * @endcode
-     * @par api_copy
-     * #otThreadClearEidCache
-     */
-    else if (aArgs[0] == "clear")
+    ClearAllBytes(iterator);
+
+    while (true)
    {
-        otThreadClearEidCache(GetInstancePtr());
-    }
-    else
-    {
-        error = OT_ERROR_INVALID_ARGS;
+        SuccessOrExit(otThreadGetNextCacheEntry(GetInstancePtr(), &entry, &iterator));
+        OutputEidCacheEntry(entry);
    }
+
 exit:
-    return error;
+    return OT_ERROR_NONE;
 }
 #endif

@@ -3004,13 +3030,13 @@ template <> otError Interpreter::Process<Cmd("log")>(Arg aArgs[])
     * @endcode
     * @par
     * Get the log level.
-     * @sa otGetLogLevel
+     * @sa otLoggingGetLevel
     */
    if (aArgs[0] == "level")
    {
        if (aArgs[1].IsEmpty())
        {
-            OutputLine("%u", otGetLogLevel(GetInstancePtr()));
+            OutputLine("%d", otLoggingGetLevel());
        }
        else
        {
@@ -3024,12 +3050,12 @@ template <> otError Interpreter::Process<Cmd("log")>(Arg aArgs[])
             * Done
             * @endcode
             * @par api_copy
-             * #otSetLogLevel
+             * #otLoggingSetLevel
             * @cparam log level @ca{level}
             */
            VerifyOrExit(aArgs[2].IsEmpty(), error = OT_ERROR_INVALID_ARGS);
            SuccessOrExit(error = aArgs[1].ParseAsUint8(level));
-            error = otSetLogLevel(GetInstancePtr(), static_cast<otLogLevel>(level));
+            error = otLoggingSetLevel(static_cast<otLogLevel>(level));
 #else
            error = OT_ERROR_INVALID_ARGS;
 #endif
@@ -3151,6 +3177,20 @@ template <> otError Interpreter::Process<Cmd("fake")>(Arg aArgs[])
        SuccessOrExit(error = aArgs[3].ParseAsHexString(mlIid.mFields.m8));
        otThreadSendAddressNotification(GetInstancePtr(), &destination, &target, &mlIid);
    }
+#if OPENTHREAD_CONFIG_BACKBONE_ROUTER_DUA_NDPROXYING_ENABLE
+    else if (aArgs[0] == "/b/ba")
+    {
+        otIp6Address             target;
+        otIp6InterfaceIdentifier mlIid;
+        uint32_t                 timeSinceLastTransaction;
+
+        SuccessOrExit(error = aArgs[1].ParseAsIp6Address(target));
+        SuccessOrExit(error = aArgs[2].ParseAsHexString(mlIid.mFields.m8));
+        SuccessOrExit(error = aArgs[3].ParseAsUint32(timeSinceLastTransaction));
+
+        error = otThreadSendProactiveBackboneNotification(GetInstancePtr(), &target, &mlIid, timeSinceLastTransaction);
+    }
+#endif

 exit:
    return error;
@@ -3276,12 +3316,6 @@ template <> otError Interpreter::Process<Cmd("ifconfig")>(Arg aArgs[])
    {
        SuccessOrExit(error = otIp6SetEnabled(GetInstancePtr(), false));
    }
-#if OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE && OPENTHREAD_CONFIG_CLI_IFCONFIG_INIT_ENABLE
-    else if (aArgs[0] == "init")
-    {
-        error = ProcessIfconfigInit(aArgs + 1);
-    }
-#endif
    else
    {
        ExitNow(error = OT_ERROR_INVALID_ARGS);
@@ -3291,60 +3325,6 @@ exit:
    return error;
 }

-#if OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE && OPENTHREAD_CONFIG_CLI_IFCONFIG_INIT_ENABLE
-
-otError Interpreter::ProcessIfconfigInit(Arg aArgs[])
-{
-    /**
-     * @cli ifconfig init
-     * @code
-     * ifconfig init 5 6
-     * Done
-     * @endcode
-     * @cparam ifconfig @ca{unicast-addr-pool-size} @ca{multicast-addr-pool-size}
-     * @par
-     * This command is intended for testing purposes only and requires `OPENTHREAD_CONFIG_CLI_IFCONFIG_INIT_ENABLE`
-     * and `OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE`.
-     * @par api_copy
-     * #otIp6Init
-     */
-
-    otError                  error;
-    uint16_t                 unicastPoolSize;
-    uint16_t                 multicastPoolSize;
-    otNetifAddress          *unicastPool   = nullptr;
-    otNetifMulticastAddress *multicastPool = nullptr;
-
-    SuccessOrExit(error = aArgs[0].ParseAsUint16(unicastPoolSize));
-    SuccessOrExit(error = aArgs[1].ParseAsUint16(multicastPoolSize));
-    VerifyOrExit(aArgs[2].IsEmpty(), error = OT_ERROR_INVALID_ARGS);
-
-    if (unicastPoolSize > 0)
-    {
-        unicastPool = static_cast<otNetifAddress *>(otHeapCAlloc(unicastPoolSize, sizeof(otNetifAddress)));
-        VerifyOrExit(unicastPool != nullptr, error = OT_ERROR_NO_BUFS);
-    }
-
-    if (multicastPoolSize > 0)
-    {
-        multicastPool =
-            static_cast<otNetifMulticastAddress *>(otHeapCAlloc(multicastPoolSize, sizeof(otNetifMulticastAddress)));
-        VerifyOrExit(multicastPool != nullptr, error = OT_ERROR_NO_BUFS);
-    }
-
-    SuccessOrExit(error = otIp6Init(GetInstancePtr(), unicastPool, unicastPoolSize, multicastPool, multicastPoolSize));
-    unicastPool   = nullptr;
-    multicastPool = nullptr;
-
-exit:
-    otHeapFree(unicastPool);
-    otHeapFree(multicastPool);
-
-    return error;
-}
-
-#endif // OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE && OPENTHREAD_CONFIG_CLI_IFCONFIG_INIT_ENABLE
-
 template <> otError Interpreter::Process<Cmd("instanceid")>(Arg aArgs[])
 {
    /**
@@ -5450,6 +5430,9 @@ template <> otError Interpreter::Process<Cmd("prefix")>(Arg aArgs[])
     * @endcode
     * @par
     * Get the prefix list in the local Network Data.
+     * @note For the Thread 1.2 border router with backbone capability, the local Domain Prefix
+     * is listed as well and includes the `D` flag. If backbone functionality is disabled, a dash
+     * `-` is printed before the local Domain Prefix.
     * @par
     * For more information about #otBorderRouterConfig flags, refer to @overview.
     * @sa otBorderRouterGetNextOnMeshPrefix
@@ -5463,6 +5446,15 @@ template <> otError Interpreter::Process<Cmd("prefix")>(Arg aArgs[])
        {
            mNetworkData.OutputPrefix(config);
        }
+
+#if OPENTHREAD_FTD && OPENTHREAD_CONFIG_BACKBONE_ROUTER_ENABLE
+        if (otBackboneRouterGetState(GetInstancePtr()) == OT_BACKBONE_ROUTER_STATE_DISABLED)
+        {
+            SuccessOrExit(otBackboneRouterGetDomainPrefix(GetInstancePtr(), &config));
+            OutputFormat("- ");
+            mNetworkData.OutputPrefix(config);
+        }
+#endif
    }
    /**
     * @cli prefix add
@@ -5550,7 +5542,7 @@ exit:
 * Specifies the preferred router ID that the leader should provide when solicited.
 * @sa otThreadSetPreferredRouterId
 */
-#if OPENTHREAD_FTD && OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE
+#if OPENTHREAD_FTD
 template <> otError Interpreter::Process<Cmd("preferrouterid")>(Arg aArgs[])
 {
    return ProcessSet(aArgs, otThreadSetPreferredRouterId);
@@ -6294,10 +6286,10 @@ template <> otError Interpreter::Process<Cmd("singleton")>(Arg aArgs[])
 #if OPENTHREAD_CONFIG_SNTP_CLIENT_ENABLE
 template <> otError Interpreter::Process<Cmd("sntp")>(Arg aArgs[])
 {
-    otError       error = OT_ERROR_NONE;
-    uint16_t      port  = OT_SNTP_DEFAULT_SERVER_PORT;
-    otMessageInfo messageInfo;
-    otSntpQuery   query;
+    otError          error = OT_ERROR_NONE;
+    uint16_t         port  = OT_SNTP_DEFAULT_SERVER_PORT;
+    Ip6::MessageInfo messageInfo;
+    otSntpQuery      query;

    /**
     * @cli sntp query
@@ -6323,16 +6315,14 @@ template <> otError Interpreter::Process<Cmd("sntp")>(Arg aArgs[])
    {
        VerifyOrExit(!mSntpQueryingInProgress, error = OT_ERROR_BUSY);

-        ClearAllBytes(messageInfo);
-
        if (!aArgs[1].IsEmpty())
        {
-            SuccessOrExit(error = aArgs[1].ParseAsIp6Address(messageInfo.mPeerAddr));
+            SuccessOrExit(error = aArgs[1].ParseAsIp6Address(messageInfo.GetPeerAddr()));
        }
        else
        {
            // Use IPv6 address of default SNTP server.
-            SuccessOrExit(error = otIp6AddressFromString(OT_SNTP_DEFAULT_SERVER_IP, &messageInfo.mPeerAddr));
+            SuccessOrExit(error = messageInfo.GetPeerAddr().FromString(OT_SNTP_DEFAULT_SERVER_IP));
        }

        if (!aArgs[2].IsEmpty())
@@ -6340,8 +6330,9 @@ template <> otError Interpreter::Process<Cmd("sntp")>(Arg aArgs[])
            SuccessOrExit(error = aArgs[2].ParseAsUint16(port));
        }

-        messageInfo.mPeerPort = port;
-        query.mMessageInfo    = &messageInfo;
+        messageInfo.SetPeerPort(port);
+
+        query.mMessageInfo = static_cast<const otMessageInfo *>(&messageInfo);

        SuccessOrExit(error = otSntpClientQuery(GetInstancePtr(), &query, &Interpreter::HandleSntpResponse, this));

@@ -6803,11 +6794,14 @@ template <> otError Interpreter::Process<Cmd("debug")>(Arg aArgs[])
        "uptime",
 #endif
        "attachtime",
-        "dataset active -ns",
+        "channel",
+        "panid",
+        "extpanid",
        "ipaddr -v",
        "ipmaddr",
        "netdata show",
        "netdata show -x",
+        "partitionid",
        "leaderdata",
        "bufferinfo",
        "netstat",
@@ -7010,32 +7004,6 @@ template <> otError Interpreter::Process<Cmd("unsecureport")>(Arg aArgs[])

        OutputNewLine();
    }
-#if OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE
-    /**
-     * @cli unsecureport allwhendisabled
-     * @code
-     * unsecureport allwhendisabled
-     * Disabled
-     * Done
-     * @endcode
-     * @par api_copy
-     * #otIp6IsUnsecureAllowedWhenDisabled
-     */
-    else if (aArgs[0] == "allwhendisabled")
-    {
-        /**
-         * @cli unsecureport allwhendisabled (enable, disable)
-         * @code
-         * unsecureport allwhendisabled enable
-         * Done
-         * @endcode
-         * @cparam unsecureport allwhendisabled @ca{enable|disable}
-         * @par api_copy
-         * #otIp6SetAllowUnsecureWhenDisabled
-         */
-        error = ProcessEnableDisable(aArgs + 1, otIp6IsUnsecureAllowedWhenDisabled, otIp6SetAllowUnsecureWhenDisabled);
-    }
-#endif // OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE
    else
    {
        error = OT_ERROR_INVALID_COMMAND;
@@ -7585,53 +7553,6 @@ template <> otError Interpreter::Process<Cmd("vendor")>(Arg aArgs[])
        error = ProcessGetSet(aArgs, otThreadGetVendorAppUrl, otThreadSetVendorAppUrl);
 #endif
    }
-    /**
-     * @cli vendor oui
-     * @code
-     * vendor oui
-     * B4-A6-61
-     * Done
-     * @endcode
-     * @par api_copy
-     * #otThreadGetVendorOui
-     */
-    else if (aArgs[0] == "oui")
-    {
-        if (aArgs[1].IsEmpty())
-        {
-            uint32_t oui = otThreadGetVendorOui(GetInstancePtr());
-
-            if (oui == OT_THREAD_UNSPECIFIED_VENDOR_OUI)
-            {
-                OutputLine("unspecified");
-            }
-            else
-            {
-                OutputLine("%02X-%02X-%02X", static_cast<uint8_t>((oui >> 16) & 0xff),
-                           static_cast<uint8_t>((oui >> 8) & 0xff), static_cast<uint8_t>(oui & 0xff));
-            }
-
-            error = OT_ERROR_NONE;
-        }
-        else
-        {
-#if OPENTHREAD_CONFIG_NET_DIAG_VENDOR_INFO_SET_API_ENABLE
-            /**
-             * @cli vendor oui (set)
-             * @code
-             * vendor oui 0xb4a661
-             * Done
-             * @endcode
-             * @par api_copy
-             * #otThreadSetVendorOui
-             * @cparam vendor oui @ca{oui}
-             */
-            error = ProcessSet(aArgs + 1, otThreadSetVendorOui);
-#else
-            error = OT_ERROR_INVALID_ARGS;
-#endif
-        }
-    }

    return error;
 }
@@ -7803,12 +7724,13 @@ void Interpreter::HandleDiagnosticGetResponse(otError              aError,
                                              const otMessageInfo *aMessageInfo,
                                              void                *aContext)
 {
-    static_cast<Interpreter *>(aContext)->HandleDiagnosticGetResponse(aError, aMessage, aMessageInfo);
+    static_cast<Interpreter *>(aContext)->HandleDiagnosticGetResponse(
+        aError, aMessage, static_cast<const Ip6::MessageInfo *>(aMessageInfo));
 }

-void Interpreter::HandleDiagnosticGetResponse(otError              aError,
-                                              const otMessage     *aMessage,
-                                              const otMessageInfo *aMessageInfo)
+void Interpreter::HandleDiagnosticGetResponse(otError                 aError,
+                                              const otMessage        *aMessage,
+                                              const Ip6::MessageInfo *aMessageInfo)
 {
    uint8_t               buf[16];
    uint16_t              bytesToPrint;
@@ -8429,57 +8351,17 @@ void Interpreter::HandleWakeupResult(otError aError) { OutputResult(aError); }

 #endif // OPENTHREAD_FTD || OPENTHREAD_MTD

-size_t Interpreter::GetSize(void) { return sizeof(Interpreter); }
-
-Interpreter *Interpreter::Init(void               *aBuffer,
-                               size_t              aSize,
-                               otInstance         *aInstance,
-                               otCliOutputCallback aCallback,
-                               void               *aContext)
+void Interpreter::Initialize(otInstance *aInstance, otCliOutputCallback aCallback, void *aContext)
 {
-    Interpreter *interpreter = nullptr;
-    Instance    *instance    = static_cast<Instance *>(aInstance);
+    Instance *instance = static_cast<Instance *>(aInstance);

-    VerifyOrExit(aSize >= sizeof(Interpreter));
-    interpreter = new (aBuffer) Interpreter(instance, aCallback, aContext);
-
-exit:
-    return interpreter;
-}
-
-#if OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE
-
-Interpreter *Interpreter::sInterpreter = nullptr;
-
-static OT_DEFINE_ALIGNED_VAR(sInterpreterRaw, sizeof(Interpreter), uint64_t);
-
-void Interpreter::Init(otInstance *aInstance, otCliOutputCallback aCallback, void *aContext)
-{
-    sInterpreter = Init(&sInterpreterRaw, sizeof(sInterpreterRaw), aInstance, aCallback, aContext);
-}
-
-#endif
-
-void Interpreter::Finalize(void)
-{
-    mTimer.Stop();
-
-#if (OPENTHREAD_FTD || OPENTHREAD_MTD) && OPENTHREAD_CONFIG_CLI_REGISTER_IP6_RECV_CALLBACK
-    otIp6SetReceiveCallback(GetInstancePtr(), nullptr, nullptr);
-#endif
-#if OPENTHREAD_CONFIG_DIAG_ENABLE
-    otDiagSetOutputCallback(GetInstancePtr(), nullptr, nullptr);
-#endif
-
-    this->~Interpreter();
+    Interpreter::sInterpreter = new (&sInterpreterRaw) Interpreter(instance, aCallback, aContext);
 }

 void Interpreter::OutputPrompt(void)
 {
 #if OPENTHREAD_CONFIG_CLI_PROMPT_ENABLE
-    static const char kPrompt[] = "> ";
-
-    VerifyOrExit(mPromptEnabled);
+    static const char sPrompt[] = "> ";

    // The `OutputFormat()` below is adding the prompt which is not
    // part of any command output, so we set the `EmittingCommandOutput`
@@ -8487,12 +8369,9 @@ void Interpreter::OutputPrompt(void)
    // log (under `OPENTHREAD_CONFIG_CLI_LOG_INPUT_OUTPUT_ENABLE`).

    SetEmittingCommandOutput(false);
-    OutputFormat("%s", kPrompt);
+    OutputFormat("%s", sPrompt);
    SetEmittingCommandOutput(true);
-
-exit:
-    return;
-#endif
+#endif // OPENTHREAD_CONFIG_CLI_PROMPT_ENABLE
 }

 void Interpreter::HandleTimer(Timer &aTimer)
@@ -8595,6 +8474,9 @@ otError Interpreter::ProcessCommand(Arg aArgs[])
 #if (OPENTHREAD_CONFIG_THREAD_VERSION >= OT_THREAD_VERSION_1_2)
        CmdEntry("domainname"),
 #endif
+#if OPENTHREAD_CONFIG_DUA_ENABLE
+        CmdEntry("dua"),
+#endif
 #if OPENTHREAD_FTD
        CmdEntry("eidcache"),
 #endif
@@ -8696,7 +8578,7 @@ otError Interpreter::ProcessCommand(Arg aArgs[])
 #endif
        CmdEntry("platform"),
        CmdEntry("pollperiod"),
-#if OPENTHREAD_FTD && OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE
+#if OPENTHREAD_FTD
        CmdEntry("preferrouterid"),
 #endif
 #if OPENTHREAD_CONFIG_BORDER_ROUTER_ENABLE
@@ -8819,5 +8701,54 @@ otError Interpreter::ProcessCommand(Arg aArgs[])
    return error;
 }

+extern "C" void otCliInit(otInstance *aInstance, otCliOutputCallback aCallback, void *aContext)
+{
+    Interpreter::Initialize(aInstance, aCallback, aContext);
+
+#if OPENTHREAD_CONFIG_CLI_VENDOR_COMMANDS_ENABLE && OPENTHREAD_CONFIG_CLI_MAX_USER_CMD_ENTRIES > 1
+    otCliVendorSetUserCommands();
+#endif
+}
+
+extern "C" void otCliInputLine(char *aBuf) { Interpreter::GetInterpreter().ProcessLine(aBuf); }
+
+extern "C" otError otCliSetUserCommands(const otCliCommand *aUserCommands, uint8_t aLength, void *aContext)
+{
+    return Interpreter::GetInterpreter().SetUserCommands(aUserCommands, aLength, aContext);
+}
+
+extern "C" void otCliOutputBytes(const uint8_t *aBytes, uint8_t aLength)
+{
+    Interpreter::GetInterpreter().OutputBytes(aBytes, aLength);
+}
+
+extern "C" void otCliOutputFormat(const char *aFmt, ...)
+{
+    va_list aAp;
+    va_start(aAp, aFmt);
+    Interpreter::GetInterpreter().OutputFormatV(aFmt, aAp);
+    va_end(aAp);
+}
+
+extern "C" void otCliAppendResult(otError aError) { Interpreter::GetInterpreter().OutputResult(aError); }
+
+extern "C" void otCliPlatLogv(otLogLevel aLogLevel, otLogRegion aLogRegion, const char *aFormat, va_list aArgs)
+{
+    OT_UNUSED_VARIABLE(aLogLevel);
+    OT_UNUSED_VARIABLE(aLogRegion);
+
+    VerifyOrExit(Interpreter::IsInitialized());
+
+    // CLI output is being used for logging, so we set the flag
+    // `EmittingCommandOutput` to false indicate this.
+    Interpreter::GetInterpreter().SetEmittingCommandOutput(false);
+    Interpreter::GetInterpreter().OutputFormatV(aFormat, aArgs);
+    Interpreter::GetInterpreter().OutputNewLine();
+    Interpreter::GetInterpreter().SetEmittingCommandOutput(true);
+
+exit:
+    return;
+}
+
 } // namespace Cli
 } // namespace ot
@@ -86,13 +86,10 @@
 #include "common/type_traits.hpp"
 #include "instance/instance.hpp"

-typedef struct otCliInterpreter
-{
-} otCliInterpreter;
-
 namespace ot {

 /**
+ * @namespace ot::Cli
 *
 * @brief
 *   This namespace contains definitions for the CLI interpreter.
@@ -107,7 +104,7 @@ extern "C" void otCliOutputFormat(const char *aFmt, ...);
 /**
 * Implements the CLI interpreter.
 */
-class Interpreter : public otCliInterpreter, public OutputImplementer, public Utils
+class Interpreter : public OutputImplementer, public Utils
 {
 #if OPENTHREAD_FTD || OPENTHREAD_MTD
    friend class Ba;
@@ -125,8 +122,6 @@ class Interpreter : public otCliInterpreter, public OutputImplementer, public Ut
    friend class SrpClient;
    friend class SrpServer;
 #endif
-    friend class Utils;
-
    friend void otCliPlatLogv(otLogLevel, otLogRegion, const char *, va_list);
    friend void otCliAppendResult(otError aError);
    friend void otCliOutputBytes(const uint8_t *aBytes, uint8_t aLength);
@@ -142,65 +137,34 @@ public:
     */
    explicit Interpreter(Instance *aInstance, otCliOutputCallback aCallback, void *aContext);

-#if OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE
    /**
-     * Returns a reference to the static CLI interpreter.
+     * Returns a reference to the interpreter object.
     *
-     * @returns A reference to the static CLI interpreter.
+     * @returns A reference to the interpreter object.
     */
    static Interpreter &GetInterpreter(void)
    {
        OT_ASSERT(sInterpreter != nullptr);
+
        return *sInterpreter;
    }

    /**
-     * Initializes the static CLI interpreter.
+     * Initializes the Console interpreter.
     *
     * @param[in]  aInstance  The OpenThread instance structure.
     * @param[in]  aCallback  A pointer to a callback method.
     * @param[in]  aContext   A pointer to a user context.
     */
-    static void Init(otInstance *aInstance, otCliOutputCallback aCallback, void *aContext);
+    static void Initialize(otInstance *aInstance, otCliOutputCallback aCallback, void *aContext);

    /**
-     * Returns whether the static CLI interpreter is initialized.
+     * Returns whether the interpreter is initialized.
     *
     * @returns  Whether the interpreter is initialized.
     */
    static bool IsInitialized(void) { return sInterpreter != nullptr; }

-#endif // OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE
-
-    /**
-     * Gets the size of the CLI interpreter object.
-     *
-     * @returns The size of the CLI interpreter object in bytes.
-     */
-    static size_t GetSize(void);
-
-    /**
-     * Initializes a CLI interpreter.
-     *
-     * @param[in]  aBuffer    A pointer to a memory buffer for the CLI interpreter.
-     * @param[in]  aSize      The size of the memory buffer.
-     * @param[in]  aInstance  The OpenThread instance structure.
-     * @param[in]  aCallback  A callback method called to process CLI output.
-     * @param[in]  aContext   A user context pointer.
-     *
-     * @returns A pointer to the initialized CLI interpreter, or `nullptr` if @p aSize is too small.
-     */
-    static Interpreter *Init(void               *aBuffer,
-                             size_t              aSize,
-                             otInstance         *aInstance,
-                             otCliOutputCallback aCallback,
-                             void               *aContext);
-
-    /**
-     * Finalizes the CLI interpreter.
-     */
-    void Finalize(void);
-
    /**
     * Interprets a CLI command.
     *
@@ -213,28 +177,15 @@ public:
     *
     * @param[in]  aCommands  A pointer to an array with user commands.
     * @param[in]  aLength    @p aUserCommands length.
-     * @param[in]  aContext   Context to use when invoking the command handler.
+     * @param[in]  aContext   @p aUserCommands length.
     *
-     * @retval OT_ERROR_NONE     Successfully updated command table with commands from @p aCommands.
-     * @retval OT_ERROR_NO_BUFS  No available `UserCommandsEntry` to register the requested user commands.
+     * @retval OT_ERROR_NONE    Successfully updated command table with commands from @p aCommands.
+     * @retval OT_ERROR_FAILED  No available UserCommandsEntry to register requested user commands.
     */
    otError SetUserCommands(const otCliCommand *aCommands, uint8_t aLength, void *aContext);

-#if OPENTHREAD_CONFIG_CLI_PROMPT_ENABLE
-    /**
-     * Configures whether or not the CLI interpreter outputs prompt string.
-     *
-     * It is enabled by default.
-     *
-     * @param[in] aEnabled  TRUE to enable outputting prompt, FALSE to disable.
-     */
-    void SetPromptConfig(bool aEnabled);
-#endif
-
 protected:
-#if OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE
    static Interpreter *sInterpreter;
-#endif

 private:
    static constexpr uint8_t  kIndentSize            = 4;
@@ -277,11 +228,6 @@ private:
 #if OPENTHREAD_FTD
    void OutputEidCacheEntry(const otCacheEntryInfo &aEntry);
 #endif
-
-#if OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE && OPENTHREAD_CONFIG_CLI_IFCONFIG_INIT_ENABLE
-    otError ProcessIfconfigInit(Arg aArgs[]);
-#endif
-
 #if OPENTHREAD_CONFIG_TMF_ANYCAST_LOCATOR_ENABLE
    static void HandleLocateResult(void               *aContext,
                                   otError             aError,
@@ -309,7 +255,7 @@ private:
    static void HandleLinkPcapReceive(const otRadioFrame *aFrame, bool aIsTx, void *aContext);

 #if OPENTHREAD_CONFIG_TMF_NETDIAG_CLIENT_ENABLE
-    void HandleDiagnosticGetResponse(otError aError, const otMessage *aMessage, const otMessageInfo *aMessageInfo);
+    void HandleDiagnosticGetResponse(otError aError, const otMessage *aMessage, const Ip6::MessageInfo *aMessageInfo);
    static void HandleDiagnosticGetResponse(otError              aError,
                                            otMessage           *aMessage,
                                            const otMessageInfo *aMessageInfo,
@@ -402,9 +348,6 @@ private:
    UserCommandsEntry mUserCommands[kMaxUserCommandEntries];
    bool              mCommandIsPending;
    bool              mInternalDebugCommand;
-#if OPENTHREAD_CONFIG_CLI_PROMPT_ENABLE
-    bool mPromptEnabled;
-#endif

    TimerMilliContext mTimer;

@@ -1,128 +0,0 @@
-/*
- *  Copyright (c) 2016-2026, The OpenThread Authors.
- *  All rights reserved.
- *
- *  Redistribution and use in source and binary forms, with or without
- *  modification, are permitted provided that the following conditions are met:
- *  1. Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *  2. Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *  3. Neither the name of the copyright holder nor the
- *     names of its contributors may be used to endorse or promote products
- *     derived from this software without specific prior written permission.
- *
- *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- *  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- *  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
- *  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- *  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- *  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- *  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- *  POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * @file
- *   This file implements the CLI public APIs.
- */
-
-#include <openthread/cli.h>
-
-#include "cli.hpp"
-
-namespace ot {
-namespace Cli {
-
-extern "C" size_t otCliInterpreterGetSize(void) { return Interpreter::GetSize(); }
-
-extern "C" otCliInterpreter *otCliInterpreterInit(void               *aBuffer,
-                                                  size_t              aSize,
-                                                  otInstance         *aInstance,
-                                                  otCliOutputCallback aCallback,
-                                                  void               *aContext)
-{
-    return Interpreter::Init(aBuffer, aSize, aInstance, aCallback, aContext);
-}
-
-#if OPENTHREAD_CONFIG_CLI_PROMPT_ENABLE
-extern "C" void otCliInterpreterSetPromptConfig(otCliInterpreter *aInterpreter, bool aEnable)
-{
-    static_cast<Interpreter *>(aInterpreter)->SetPromptConfig(aEnable);
-}
-#endif
-
-extern "C" void otCliInterpreterInputLine(otCliInterpreter *aInterpreter, char *aLine)
-{
-    static_cast<Interpreter *>(aInterpreter)->ProcessLine(aLine);
-}
-
-extern "C" void otCliInterpreterFinalize(otCliInterpreter *aInterpreter)
-{
-    static_cast<Interpreter *>(aInterpreter)->Finalize();
-}
-
-//---------------------------------------------------------------------------------------------------------------------
-
-#if OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE
-
-extern "C" void otCliInit(otInstance *aInstance, otCliOutputCallback aCallback, void *aContext)
-{
-    Interpreter::Init(aInstance, aCallback, aContext);
-
-#if OPENTHREAD_CONFIG_CLI_VENDOR_COMMANDS_ENABLE && OPENTHREAD_CONFIG_CLI_MAX_USER_CMD_ENTRIES > 1
-    otCliVendorSetUserCommands();
-#endif
-}
-
-extern "C" otCliInterpreter *otCliGetStaticInterpreter(void) { return &Interpreter::GetInterpreter(); }
-
-extern "C" void otCliInputLine(char *aLine) { Interpreter::GetInterpreter().ProcessLine(aLine); }
-
-extern "C" otError otCliSetUserCommands(const otCliCommand *aUserCommands, uint8_t aLength, void *aContext)
-{
-    return Interpreter::GetInterpreter().SetUserCommands(aUserCommands, aLength, aContext);
-}
-
-extern "C" void otCliOutputBytes(const uint8_t *aBytes, uint8_t aLength)
-{
-    Interpreter::GetInterpreter().OutputBytes(aBytes, aLength);
-}
-
-extern "C" void otCliOutputFormat(const char *aFmt, ...)
-{
-    va_list args;
-
-    va_start(args, aFmt);
-    Interpreter::GetInterpreter().OutputFormatV(aFmt, args);
-    va_end(args);
-}
-
-extern "C" void otCliAppendResult(otError aError) { Interpreter::GetInterpreter().OutputResult(aError); }
-
-extern "C" void otCliPlatLogv(otLogLevel aLogLevel, otLogRegion aLogRegion, const char *aFormat, va_list aArgs)
-{
-    OT_UNUSED_VARIABLE(aLogLevel);
-    OT_UNUSED_VARIABLE(aLogRegion);
-
-    VerifyOrExit(Interpreter::IsInitialized());
-
-    // CLI output is being used for logging, so we set the flag
-    // `EmittingCommandOutput` to false indicate this.
-    Interpreter::GetInterpreter().SetEmittingCommandOutput(false);
-    Interpreter::GetInterpreter().OutputFormatV(aFormat, aArgs);
-    Interpreter::GetInterpreter().OutputNewLine();
-    Interpreter::GetInterpreter().SetEmittingCommandOutput(true);
-
-exit:
-    return;
-}
-
-#endif // OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE
-
-} // namespace Cli
-} // namespace ot
@@ -174,6 +174,55 @@ template <> otError Bbr::Process<Cmd("mgmt")>(Arg aArgs[])
        ExitNow(error = OT_ERROR_INVALID_COMMAND);
    }

+#if OPENTHREAD_CONFIG_BACKBONE_ROUTER_DUA_NDPROXYING_ENABLE && OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE
+    /**
+     * @cli bbr mgmt dua
+     * @code
+     * bbr mgmt dua 1 2f7c235e5025a2fd
+     * Done
+     * @endcode
+     * @code
+     * bbr mgmt dua 160
+     * Done
+     * @endcode
+     * @cparam bbr mgmt dua @ca{status|coap-code} [@ca{meshLocalIid}]
+     * For `status` or `coap-code`, use:
+     * *    0: ST_DUA_SUCCESS
+     * *    1: ST_DUA_REREGISTER
+     * *    2: ST_DUA_INVALID
+     * *    3: ST_DUA_DUPLICATE
+     * *    4: ST_DUA_NO_RESOURCES
+     * *    5: ST_DUA_BBR_NOT_PRIMARY
+     * *    6: ST_DUA_GENERAL_FAILURE
+     * *    160: COAP code 5.00
+     * @par
+     * With the `meshLocalIid` included, this command configures the response status
+     * for the next DUA registration. Without `meshLocalIid`, respond to the next
+     * DUA.req with the specified `status` or `coap-code`.
+     * @par
+     * Available when `OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE` is enabled.
+     * @sa otBackboneRouterConfigNextDuaRegistrationResponse
+     */
+    if (aArgs[0] == "dua")
+    {
+        uint8_t                   status;
+        otIp6InterfaceIdentifier *mlIid = nullptr;
+        otIp6InterfaceIdentifier  iid;
+
+        SuccessOrExit(error = aArgs[1].ParseAsUint8(status));
+
+        if (!aArgs[2].IsEmpty())
+        {
+            SuccessOrExit(error = aArgs[2].ParseAsHexString(iid.mFields.m8));
+            mlIid = &iid;
+            VerifyOrExit(aArgs[3].IsEmpty(), error = OT_ERROR_INVALID_ARGS);
+        }
+
+        otBackboneRouterConfigNextDuaRegistrationResponse(GetInstancePtr(), mlIid, status);
+        ExitNow();
+    }
+#endif // OPENTHREAD_CONFIG_BACKBONE_ROUTER_DUA_NDPROXYING_ENABLE && OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE
+
 #if OPENTHREAD_CONFIG_BACKBONE_ROUTER_MULTICAST_ROUTING_ENABLE
    if (aArgs[0] == "mlr")
    {
@@ -670,6 +670,7 @@ template <> otError Br::Process<Cmd("peers")>(Arg aArgs[])
     * Data entries:
     * - It has added at least one external route entry.
     * - It has added at least one prefix entry with both the default-route and on-mesh flags set.
+     * - It has added at least one domain prefix (with both the domain and on-mesh flags set).
     * The list of peer BRs specifically excludes the current device, even if its is itself acting as a BR.
     * Info per BR entry:
     * - RLOC16 of the BR
@@ -1199,7 +1200,7 @@ template <> otError Br::Process<Cmd("counters")>(Arg aArgs[])
    otError error = OT_ERROR_NONE;

    VerifyOrExit(aArgs[0].IsEmpty(), error = OT_ERROR_INVALID_ARGS);
-    GetInterpreter().OutputBorderRouterCounters();
+    Interpreter::GetInterpreter().OutputBorderRouterCounters();

 exit:
    return error;
@@ -47,21 +47,6 @@
 #endif
 #endif

-/**
- * @def OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE
- *
- * Define as 1 to enable the static CLI interpreter.
- *
- * This configuration option enables the static CLI interpreter, allowing the CLI module to statically allocate and
- * provide a single interpreter instance.
- *
- * This is intended to provide backward compatibility with the original `otCli*` APIs. It can be disabled to save RAM
- * if the static CLI interpreter is not needed.
- */
-#ifndef OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE
-#define OPENTHREAD_CONFIG_CLI_STATIC_INTERPRETER_ENABLE 1
-#endif
-
 /**
 * @def OPENTHREAD_CONFIG_CLI_MAX_LINE_LENGTH
 *
@@ -84,19 +69,6 @@
 #define OPENTHREAD_CONFIG_CLI_BLE_SECURE_ENABLE 1
 #endif

-/**
- * @def OPENTHREAD_CONFIG_CLI_IFCONFIG_INIT_ENABLE
- *
- * Indicates whether or not the CLI `ifconfig init` command to be supported.
- *
- * This is applicable when `OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE` is used.
- *
- * The `ifconfig init` is intended for testing purposes only.
- */
-#ifndef OPENTHREAD_CONFIG_CLI_IFCONFIG_INIT_ENABLE
-#define OPENTHREAD_CONFIG_CLI_IFCONFIG_INIT_ENABLE 0
-#endif
-
 /**
 * @def OPENTHREAD_CONFIG_CLI_TCP_ENABLE
 *
@@ -215,4 +187,13 @@
 #define OPENTHREAD_CONFIG_CLI_REGISTER_IP6_RECV_CALLBACK 0
 #endif

+/**
+ * @def OPENTHREAD_CONFIG_CLI_BLE_SECURE_ENABLE
+ *
+ * Define to 1 to enable BLE secure support.
+ */
+#ifndef OPENTHREAD_CONFIG_CLI_BLE_SECURE_ENABLE
+#define OPENTHREAD_CONFIG_CLI_BLE_SECURE_ENABLE 0
+#endif
+
 #endif // OT_CLI_CLI_CONFIG_H_
@@ -437,6 +437,8 @@ exit:

 //----------------------------------------------------------------------------------------------------------------------

+void Dns::OutputResult(otError aError) { Interpreter::GetInterpreter().OutputResult(aError); }
+
 otError Dns::GetDnsConfig(Arg aArgs[], otDnsQueryConfig *&aConfig)
 {
    // This method gets the optional DNS config from `aArgs[]`.
@@ -452,8 +454,7 @@ otError Dns::GetDnsConfig(Arg aArgs[], otDnsQueryConfig *&aConfig)

    VerifyOrExit(!aArgs[0].IsEmpty(), aConfig = nullptr);

-    SuccessOrExit(error = ParseOrSynthesizeIp6Address(aArgs[0], aConfig->mServerSockAddr.mAddress, nat64Synth));
-
+    SuccessOrExit(error = ParseToIp6Address(GetInstancePtr(), aArgs[0], aConfig->mServerSockAddr.mAddress, nat64Synth));
    if (nat64Synth)
    {
        OutputFormat("Synthesized IPv6 DNS server address: ");
@@ -101,6 +101,7 @@ private:
    template <CommandId kCommandId> otError Process(Arg aArgs[]);

 #if OPENTHREAD_CONFIG_DNS_CLIENT_ENABLE
+    void        OutputResult(otError aError);
    otError     GetDnsConfig(Arg aArgs[], otDnsQueryConfig *&aConfig);
    const char *DnsConfigServiceModeToString(otDnsServiceMode aMode) const;
    otError     ParseDnsServiceMode(const Arg &aArg, otDnsServiceMode &aMode) const;
@@ -1305,6 +1305,7 @@ void History::OutputRxTxEntryTableFormat(const otHistoryTrackerMessageInfo &aInf
 *     * `o`: On mesh flag.
 *     * `s`: Stable flag.
 *     * `n`: Nd Dns flag.
+ *     * `D`: Domain prefix flag.
 * * Pref: Preference. Values can be either `high`, `med`, or `low`.
 * * RLOC16
 * @sa otHistoryTrackerIterateOnMeshPrefixHistory
@@ -2025,6 +2026,8 @@ void History::HandleNetInfo(otError aError, const otHistoryTrackerNetworkInfo *a
    OutputResult(aError);
 }

+void History::OutputResult(otError aError) { Interpreter::GetInterpreter().OutputResult(aError); }
+
 #endif // #if OPENTHREAD_CONFIG_HISTORY_TRACKER_CLIENT_ENABLE

 otError History::Process(Arg aArgs[])
@@ -101,6 +101,7 @@ private:
    void OutputNetInfoEntry(bool aIsList, const otHistoryTrackerNetworkInfo &aInfo, uint32_t aEntryAge);

 #if OPENTHREAD_CONFIG_HISTORY_TRACKER_CLIENT_ENABLE
+    void    OutputResult(otError aError);
    otError ParseQueryArgs(Arg       aArgs[],
                           bool     &aIsList,
                           uint16_t &aRloc16,
@@ -594,6 +594,8 @@ const char *LinkMetrics::LinkMetricsStatusToStr(otLinkMetricsStatus aStatus)
    return str;
 }

+void LinkMetrics::OutputResult(otError aError) { Interpreter::GetInterpreter().OutputResult(aError); }
+
 } // namespace Cli
 } // namespace ot

@@ -115,6 +115,8 @@ private:

    const char *LinkMetricsStatusToStr(otLinkMetricsStatus aStatus);

+    void OutputResult(otError aError);
+
    bool mQuerySync : 1;
    bool mConfigForwardTrackingSeriesSync : 1;
    bool mConfigEnhAckProbingSync : 1;
@@ -41,14 +41,6 @@

 #if OPENTHREAD_CONFIG_LOG_OUTPUT == OPENTHREAD_CONFIG_LOG_OUTPUT_APP

-#if OPENTHREAD_CONFIG_LOG_INSTANCE_AWARE_API_ENABLE
-extern "C" OT_TOOL_WEAK void otPlatLogOutput(otInstance *aInstance, otLogLevel aLogLevel, const char *aLogLine)
-{
-    OT_UNUSED_VARIABLE(aInstance);
-    otPlatLog(aLogLevel, OT_LOG_REGION_CORE, "%s", aLogLine);
-}
-#endif
-
 extern "C" OT_TOOL_WEAK void otPlatLog(otLogLevel aLogLevel, otLogRegion aLogRegion, const char *aFormat, ...)
 {
    va_list ap;
@@ -456,7 +456,7 @@ void Mdns::HandleRegisterationDone(otMdnsRequestId aRequestId, otError aError)
    if (mWaitingForCallback && (aRequestId == mRequestId))
    {
        mWaitingForCallback = false;
-        GetInterpreter().OutputResult(aError);
+        Interpreter::GetInterpreter().OutputResult(aError);
    }
    else
    {
@@ -548,6 +548,8 @@ exit:
    OutputResult(aError);
 }

+void MeshDiag::OutputResult(otError aError) { Interpreter::GetInterpreter().OutputResult(aError); }
+
 } // namespace Cli
 } // namespace ot

@@ -104,6 +104,8 @@ private:
    void HandleMeshDiagQueryChildIp6Addrs(otError                    aError,
                                          uint16_t                   aChildRloc16,
                                          otMeshDiagIp6AddrIterator *aIp6AddrIterator);
+
+    void OutputResult(otError aError);
 };

 } // namespace Cli
--- a/Show More
+++ b/Show More