Schema Migration Policy Belongs in the OTA Safety Model
Rollback is only safe when persistent data remains readable by the previous firmware or a migration policy accounts for the change.
NVS
Rollback Has to Include Persistent-State Compatibility
Returning to an older binary is unsafe if the newer release already changed data the old code cannot read.