Two halves of the connection-cost lever (first on-device pull: 9.7s
fetch to learn 'up to date'; a rejected-push :sync runs three full
handshakes):
- esp_mbedtls_stream.c caches the mbedTLS session at stream close and
offers it on the next connect to the same host — the server then
skips the certificate exchange and most of the key exchange. Second
vendor delta, single git thread, best-effort (any refusal falls back
to a full handshake).
- pull_once now ls-refs first: the ref advertisement alone answers
'anything new?', so up-to-date and local-ahead return without ever
entering pack negotiation, and a needed download rides the SAME open
connection instead of a second handshake. Tracking-ref updates share
one update_tracking helper with the reconcile fetch.
44c65e9ea5