Engineered to survive the real world
A sign on a shelf has to recover from trouble with nobody watching. 3.0’s reliability isn’t one feature. It’s layers, each catching a different failure:
A hardware watchdog for the frozen case
An opt-in hardware watchdog (default 8 second timeout) is fed from the display loop like a heartbeat. If the loop wedges (a hung synchronous fetch, say) the board resets itself and recovers instead of sitting frozen until someone pulls the plug. It even disables itself while a USB serial console is attached, so it won’t reboot mid-debug. Hardware-validated on CircuitPython 9.2.7 and 10.2.1.
A last-resort reboot for the “everything fails” case
The watchdog only catches a frozen loop. A separate mechanism tracks a streak of consecutive failed fetches and, after enough of them, reboots to clear a wedged radio or session. It was written for a real field failure: one box logged 637 failed fetches over ~2 days and never self-recovered. It does now.
A safe-mode breaker so you’re never locked out
If fault-reboots start stacking up with no healthy run in between, a reboot-loop breaker (backed by non-volatile memory) stops the fetching, shows “Safe mode: reconfigure,” and keeps the configuration page reachable. Paired with self-healing WiFi reconnection and a low-memory floor that refuses to serve stale data, the sign heals from a power blip on its own.