Hi Doug,
We've done some work with E1.37-4 for RDM-based bootloading, so I can share a few thoughts. Robustness and avoiding bricking really come down to your responder-side design: keep the bootloader itself in protected/immutable flash so a failed transfer can never overwrite it, and use an A/B (dual-bank) image scheme so the new firmware is only marked valid after it's fully received and its checksum/CRC verifies
. That way an interrupted or corrupted transfer just falls back to the last known-good image.
The file transfer PIDs give you the framing for chunked, acknowledged transfers, but you'll want solid handling of retries, timeouts, and out-of-order/dropped packets on top of that, since DMX/RDM lines can be noisy in the field.
On the console side, adoption is still fairly limited — most controllers don't yet expose full E1.37-4 file transfer as a built-in feature, so in practice a lot of people still drive it from a dedicated tool or updater rather than the lighting console itself. That may change as the standard matures.
Hope that helps — happy to compare notes.