OTA probation never ran from v2.0.0 through v2.0.12 because the Arduino core's initArduino() finds PENDING_VERIFY, calls weak verifyOta() (default return true), and commits the image before setup() runs, so by the time the sketch's otaCheckProbationOnBoot looked, every image was already VALID; the fix defines verifyRollbackLater() so the core leaves the image pending for the sketch to judge.