if anything goes wrong during init.lua, the device might sit stuck with no ability to reset without physical access. one possible solution is a long tmr.alarm set early during boot, which would call node.restart to reboot the device. The last init action would have to clear the timer.
node.softwd seems perfect. set a high value at boot, and keep a smaller value (minutes) during normal operation. init and timer-based activities are responsible for extending the watchdog timer
if anything goes wrong during init.lua, the device might sit stuck with no ability to reset without physical access. one possible solution is a long tmr.alarm set early during boot, which would call node.restart to reboot the device. The last init action would have to clear the timer.