on_crumbs_message clears the watchdog trip on any command frame (same shape as Slice_DCMT#14)

[CameronBrooks11]

firmware/src/main.cpp:188-193:

static void on_crumbs_message(crumbs_context_t *c, const crumbs_message_t *msg)
{
    (void)c;
    (void)msg;
    wdLastRxMs = millis();
    wdTripped  = false;      // any CRC-valid command frame releases the trip
}

This is character-for-character the pattern being fixed in feastorg/Slice_DCMT#14, where it caused anolishq/anolis#261: the controller's e-stop ladder drives its safe state as ordinary command frames, so pressing e-stop on a tripped board cleared the trip and the safe-state hold went with it.

Exposure here is lower, but not zero

relayControlLogic already guards slice.eStop || wdTripped correctly — that was noted in Slice_DCMT#11 as the reference implementation DCMT was missing. So a held trip does hold the relays off.

What differs from DCMT:

• The shipped bioreactor-v1 safe-state ladder does not cover bread0/rlht0 at all (its only actuating function, set_open_duty_pct, takes uint64 args that were unexpressible in a hook until fix(control): resolve hook argument types against the target ArgSpec anolishq/anolis#257). So the e-stop sends this board nothing, and the DCMT-addressed frames do not reach it.
• Routine polling is reads (GET_STATE), which go through reply builders. Those stamp wdLastRxMs only and never touch the trip, so polling alone does not clear it.

So the specific #261 sequence is not currently reachable on this board. What is reachable: any deliberate heater command — from an operator, from automation, or from a future safe-state hook once #257 makes one expressible — clears a trip that a real bus failure set, and relayControlLogic then resumes acting on the commanded duty.

On this rig bread0/rlht0 has already recorded 3 watchdog trips, so this is not a hypothetical path.

Suggested fix

The same one-line change as Slice_DCMT#14: keep stamping wdLastRxMs so liveness still tracks real traffic and the watchdog cannot re-trip spuriously, but stop clearing the trip latch. Leave it to the explicit SET_WATCHDOG handler and the local serial path, both deliberate acts. anolis-provider-bread arms on startup and again on address-recovery, so normal recovery is unaffected.

Worth doing for consistency regardless of current reachability: two boards on the same bus with opposite trip semantics is the kind of difference that gets reasoned about wrongly later, and the heater is an actuator.

Not urgent — but if the board is being flashed for another reason, it is a free ride.