- Rollback: override verifyRollbackLater() so a new OTA image stays
pending until it ran 60 s with WiFi; any earlier restart rolls back
(the Arduino core marked every image valid at boot before)
- Task watchdog (30 s) on loop(), paused during OTA uploads
- Crash counter in RTC memory: OTA-only window after a crash, 10 min
safe mode (WiFi + OTA only) after 3 crashes in a row
- Restart when WiFi stays down for 10 min
- Home Assistant sensor 'FlipDot Display Firmware' with version/state
- logic/boot_policy with tests (60 tests total)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
