diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c
index 77216a0..2ae079e 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c
@@ -47,10 +47,14 @@ static uint32_t _iot_connect_start = 0;   // TCP connect 开始时刻
 /*===========================================================================
  * Buffers
  *===========================================================================*/
+#if 0  // dead: only used by iot_process_recv/iot_mqtt_handle_sock_int
 static uint8_t  _iot_recv_buf[IOT_MQTT_RECV_BUF_LEN];
+#endif
 static uint16_t _iot_recv_len = 0;
-static uint8_t  _iot_send_buf[IOT_MQTT_SEND_BUF_LEN];
-static uint8_t  _iot_wchnet_buf[RECE_BUF_LEN];  // WCHNET internal recv buffer
+/* _iot_send_buf removed -- never referenced */
+#if 0  // dead: only used by iot_mqtt_handle_sock_int
+static uint8_t  _iot_wchnet_buf[RECE_BUF_LEN];
+#endif
 
 /*===========================================================================
  * Topic 构建
@@ -85,6 +89,7 @@ static int iot_mqtt_send(const uint8_t *buf, uint16_t len) {
 }
 
 /* 发送 MQTT CONNECT — 参考 net_srv.c mqtt_connect 实现 */
+#if 0  // === Dead: iot_mqtt_send_connect + subscribe ===
 static int iot_mqtt_send_connect(void) {
     static MQTTPacket_connectData opts;  // static: 避免栈开销
     static uint8_t buf[256];
@@ -145,6 +150,8 @@ static int iot_mqtt_send_subscribe(void) {
 }
 
 /* 发送 MQTT PUBLISH */
+#endif
+
 static int iot_mqtt_publish(const char *topic, const char *payload,
                              uint16_t payload_len, uint8_t qos) {
     /* Using extern mqttBuf from net_srv.c (1280 bytes) */
@@ -167,6 +174,7 @@ static int iot_mqtt_publish(const char *topic, const char *payload,
  *===========================================================================*/
 
 /* 处理一条收到的 MQTT PUBLISH 消息 */
+#if 0  // === Dead: iot_handle_publish + suback + process_recv ===
 static void iot_handle_publish(const char *topic, uint8_t *payload, int payload_len) {
     static char json[IOT_MQTT_RECV_BUF_LEN];  // static: 避免 1KB 栈开销
     int copy_len = payload_len < (int)sizeof(json) - 1 ? payload_len : (int)sizeof(json) - 1;
@@ -373,11 +381,13 @@ static void iot_process_recv(void) {
 /*===========================================================================
  * 传感器数据上报
  *===========================================================================*/
+#endif
+
 void iot_mqtt_publish_sensor(void) {
     if (g_iot_state != IOT_STATE_READY) return;
     if (!g_report_cfg.enable) return;
 
-    /* 复用 g_pkg_uart_2 中的传感器帧 */
+    /* Reuse g_pkg_uart_2 sensor frame from Loop MCU */
     if (g_pkg_uart_2.flag == 0) return;
     if (g_pkg_uart_2.pkg[0] != 0x7F) return;
     if (g_pkg_uart_2.pkg[3] != 0xC0) return;
@@ -391,18 +401,21 @@ void iot_mqtt_publish_sensor(void) {
         return;
     }
 
-    /* 构建 loop_data JSON */
-    static char data_json[IOT_MQTT_SEND_BUF_LEN];   // static: 避免栈溢出
-    char *p = data_json;
-    int remaining = sizeof(data_json);
+    /* Build full loop_data message incrementally into ONE buffer */
+    static char g_sensor_buf[1400];  // enough for 4-channel loop_data JSON
+    char *p = g_sensor_buf;
+    int remaining = sizeof(g_sensor_buf);
     int written;
     uint8_t i;
 
+    /* 1. Message header + channels open */
     written = snprintf(p, remaining,
-        "{\"channels\":[");
+        "{\"msg_id\":%d,\"cmd\":\"loop_data\",\"ts\":%lu,\"data\":{\"channels\":[",
+        ++g_iot_msg_id, mstick() / 1000);
     if (written < 0 || written >= remaining) goto done;
     p += written; remaining -= written;
 
+    /* 2. Per-channel data */
     for (i = 0; i < sr.coil_count; i++) {
         const LUP_CoilSensor *cs = &sr.coils[i];
         const char *misc_type_str = "time";
@@ -432,25 +445,21 @@ void iot_mqtt_publish_sensor(void) {
         p += written; remaining -= written;
     }
 
-    snprintf(p, remaining, "]}");
+    /* 3. Close channels + data + message */
+    written = snprintf(p, remaining, "]}}");
+    if (written < 0 || written >= remaining) goto done;
 
-    /* 包装为通用消息格式 */
-    static char payload[IOT_MQTT_SEND_BUF_LEN];  // static: 避免 2KB 栈溢出
-    snprintf(payload, sizeof(payload),
-        "{\"msg_id\":%d,\"cmd\":\"loop_data\",\"ts\":%lu,\"data\":%s}",
-        ++g_iot_msg_id, mstick() / 1000, data_json);
-
-    char topic[IOT_MQTT_TOPIC_MAX_LEN];
-    iot_make_topic(topic, sizeof(topic), "dev", "data", "loop");
-    iot_mqtt_publish(topic, payload, strlen(payload), 0);
+    /* Publish */
+    {
+        char topic[IOT_MQTT_TOPIC_MAX_LEN];
+        iot_make_topic(topic, sizeof(topic), "dev", "data", "loop");
+        iot_mqtt_publish(topic, g_sensor_buf, (uint16_t)(p - g_sensor_buf + written), 0);
+    }
 
 done:
     InitPkgUart(&g_pkg_uart_2);
 }
-
-/*===========================================================================
- * 心跳上报
- *===========================================================================*/
+#if 0  // === Dead: iot_send_heartbeat + connect + handle_sock_int + poll ===
 static void iot_send_heartbeat(void) {
     if (g_iot_state != IOT_STATE_READY) return;
 
@@ -588,6 +597,8 @@ void iot_mqtt_poll(void) {
 /*===========================================================================
  * 初始化
  *===========================================================================*/
+#endif
+
 void iot_mqtt_init(void) {
     /* 复用 net_srv.c 创建的 MQTT socket (SocketId_TCP) */
     g_iot_socket = SocketId_TCP;