Hallo Rob,

you wrote:

That's close enough to "forever"....

Sorry, but I don't agree with you. But, may be that I didn't understand you correctly. My argumentation is the following:

Specification about 'data retention' and 'endurance' must be discussed in terms of statistics, and statistics gives only information about an extremely big number of devices. So, specification about data retention does only tell, that after 20 years a certain percentage has failed. But there is no information about your individual device. It can fail in 20 years, but also in 70 years or next week, or right now. There is no guarantee that your chip is working correctly for the next 20 years.
The same about 'endurance'. There's no guarantee, that your chip will become reprogrammed 100.000 times. May be that it cannot be reprogrammed, at all. Of course, that's very unprobable, but not impossible.
What you wrote is right in a statistical sense: When analyzing an extremely big number of devices, it's most probable that a device will work as you stated. But this does not tell anything about performance of your individual device.
And so, this methode is not the panacea for never (guaranteed!) having a wear out of code.

There's another trap in the methode of the both each other code repairing mcus. How to decide which code is right and which is damaged? One of both mcus must gain control over the other and reprogram it. But how to tell the bad one, that he is the bad one? How to understand for the bad one, that he is the bad one and that he must give away control?
Ok, when code error would result in a hang-up of the bad one, this could be used as criterium. But what, when code error would result in a code that does not fail, and worse, that would tell the bad one that he is the right one and has to reprogram the other mcu, without code error? Is this how evolution works?

What do you think?

Regards,
Kai