How should firmware handle unknown commands from newer apps?

Return explicit unsupported-command errors with firmware semver in the response payload so apps can gate UI. Never panic or reset on unknown opcodes. Maintain a deprecation table next to GATT specs so QA can test forward and backward pairs systematically. Example: a field sensor on firmware 1.4 rejects a calibration opcode from app 2.1, returns unsupported plus its semver, and keeps streaming telemetry.