When should firmware automatic rollback trigger?

Automatic rollback should trigger on repeated boot failures, watchdog resets, or critical self-test failures within a defined window after the image swap. Do not roll back for one transient sensor read that would strand users on old security fixes. A cloud dashboard should show which gateways reverted so operations can separate firmware defects from weak power or radio conditions.