How do cloud backups avoid overwriting authoritative device state?

Treat cloud backup as a restore offer, not an automatic push to the device on login. Downgrades, calibration changes, and safety thresholds should require explicit confirmation. For example, a thermostat should reject an old backup that lacks the current overheating limit until the app guides the user through a safe restore.