display.flip lives in /mqtt.json, so it survives a reflash and is invisible while someone is chasing a wrong orientation - a node still carrying flip=1 from testing looks exactly like a firmware that was never fixed. Boot now reports "Display: flip off" or "flip on (rotated 180)".