Over-the-Air Firmware Updates

Fix devices without opening them.

A device downloads a new image, stores it in spare flash, checks its integrity, and only then asks the bootloader to switch to it. Two image slots let the device fall back if the new one fails.

Verify the image with a checksum, and ideally a digital signature, before running it. Never lose power halfway through an overwrite without a recovery plan.

Version numbers help servers decide which devices need updating.