Wireless programming (OTA) fail retry

[nzfarmer]

After a bit of fun (confusing XXX.hex with XXX.bin) I have OTA working on my Mote Mega using Mr Light's version of DualOptiBoot.  (We're running with XBees so had to write our own client/server processes to write to the SPI)

An improvement I'd like to make is to have some sort of failover.  Here's the approach I'm considering:

- on OTA upload, before copying data to the SPI's first 10..64k, make a copy of the first 64k from program memory and write this to the SPI (say from address 64k+) and of course prepending the FMX signature.

- on boot, if a signature exists, do the OTA and set a flag (in eeprom or SPI) which needs to be cleared by the uploaded program within a timeout.

- on boot if no signature exists (cleared in above process) but flag still set (after suitable timeout) AND FLX signature exists at SPI(64k) - copy SPI (64k) to SPI (0) and restart - moving to boot above.

Welcome thoughts.  I need a bit of a hand with the timeout/restart code in the boot loader.