Make the power profile measurable
A device is only low-power once someone has measured it. We profile sleep and active current on real hardware with the radio running, then compare the result against the energy budget set during hardware design. Datasheet figures are a starting point for estimation, not evidence of behaviour.
Measuring early also tends to relocate the problem. The current spike that ruins a battery estimate is usually somewhere unglamorous, such as a peripheral left enabled through sleep or a reconnect loop that never backs off.
Assume the connection will drop
Wireless links fail routinely and unremarkably. Firmware that treats disconnection as an error state rather than a normal condition produces devices that need a power cycle to recover, which users experience as an unreliable product.
We design for buffering while offline, bounded reconnect backoff, and commands that can be safely repeated, so that a dropped link costs a delay rather than a data gap or a duplicated action.
Ship an update path before you ship the product
Devices without a working update mechanism become a permanent support liability, because every defect found after launch is unfixable without physical access. We implement over-the-air update with signed images and a rollback path, and test it on real hardware before the product ships rather than after the first field defect.
Write the factory firmware too
Production needs its own build: a test mode that exercises the sensors and radio, a way to write serial numbers and calibration constants, and a clear pass or fail signal an operator can act on. Treating this as part of the firmware scope avoids a scramble in the weeks before a build.