So we had (have) an issue with vpn /router stability on 2866s that ended up resetting configs on device possibly due to firmware recovery. So the device can keep a backup of a good firmware after X amount of hours.

Can someone confirm that this firmware backup on the device also contains the current router config at that time? I suspect and hope that it does and we can ensure that after deploying a new router that our process is to ensure that we manually do an on device firmware backup so it has that to revert to.

I've no idea, but couldn't you check it for yourself by doing a config backup and a firmware backup, then restore the firmware and see if you have retained the config? If not, you have a config backup to restore and have answered your question.

the on device backup only seems to get triggered when the machine reboots due to stability and then its logic is that there may be a FW issue so use the fall back firmware.

But you may have given me a clue. If I make a config change and then try a manual backup "to the device" then it will allow the backup whereas the manual backup would say the one that is there is already up to date or the same or something like that.