Indeed. Would be nice to have a rock-solid “correct” example to critique and learn from. And a write-up from an expert which goes into detail about all the traps for new players, what failure states / eFuse settings could be truly unrecoverable even if you have remote control of the MCU’s PWR / COM / RST pins, etc.

Years ago I had to design some robust OTA systems for both ATmega’s and ESP32’s. I was very confident that my ATmega solution could recover from absolutely any failure state that wasn’t a true “not my fault” hardware failure. At the time though, I was never quite sure if I properly covered every last edge case of the ESP32, which has significantly higher complexity of things that can go wrong from a bad OTA firmware update.