Nice input as always, thanks. A downlink with ACK to reboot a device is indeed a nice never ending loop - disaster. So, if we save the ACK demand to EEPROM and after reboot the device sends the ACK you are fine for this edge case? One more byte to EEPROM, but more to program flash.
I think we discussed this. I think it’s worse to not support ACK for downlinks. In that case downlink queue will be full EVERY time a user asks for ACK. Not only after a re-boot command.
I am feeling strange now. I try to conform with LoRaWAN spec and now you don’t want me to conform. TinyLoRa vibes in reverse 
To make things better I will not implement confirmed uplinks. We are fine with that?