···8888 * - Key material must be cleared with @c mbedtls_platform_zeroize() —
8989 * never @c memset() which may be elided.
9090 * - BLE must be **fully de-initialized** before OTA starts or before deep sleep.
9191- * - Vault wipe triggers after 10 failed PIN attempts; lockout after 3.
9191+ * - Escalating lockout: short lock from 4 failed PIN attempts, longer lock from
9292+ * 7; vault wipe at 10.
9293 *
9394 * ---
9495 *