NVR Fleet OTA

The union of three sources: mirror-poll (boards whose OTA agent polls /deploy/region), mesh (device-mesh peers, exported by the host timer), and clickhouse (devices with a recent ingest heartbeat). A device in the mesh that never adopted the agent says so on its row; a dead source degrades to a chip below the table, never this table.

Version is the board's OWN reported version (board-confirmed > board-reported > heartbeat) — never a version the board did not report; a DRIFT chip beside it means the board's installed config disagrees with git (hover it for which of deps / env / unit / funnel). Temp / load is the board's own telemetry — it greys out past ~5 min and shows an em-dash on an agent that predates it, never zeros. Admin Update still GPG-verifies, health-gates and auto-reverts on the board.

Per board, the motion-gate's own counters (cumulative since board start): seen motion frames, static skipped (gated as no-motion), processed on-board, backfilled to the VPS and dropped — dropped > 0 means the bounded backfill budget was exhausted and real motion frames were LOST (alarm-worthy; includes disk-lost staged frames, also shown separately).

Plus the thermal shed state (a board shedding drops detector frames while otherwise looking healthy), per-detector health, and the Alert FIFO — the analytics engine's bounded alert queue, where dropped > 0 means alert folds were LOST on-board (evidence loss, not lag; hover for offered count and fold-lag p50).

Storage is the flash-media probe's read of the SD card the whole board runs from. A board whose agent predates these counters shows not reported by this board version — never zeros.

Checks run on the VPS against data the boards already ship — heartbeats, detections, disk, TLS certs. Thresholds are hysteretic, so alerts do not flap, and each detector clears on its own asymmetric threshold.

A check whose source is down shows as a blind source below, never as a false alert. Critical alerts sort first. Read-only: the boards' hot path is untouched.

Every signed release commit on release-canary and fleet, newest first across both. A release is cut from main — the two channels are signed siblings, not a fast-forward line, which is why Cut fleet exists beside Promote.

An UNSIGNED row is the exception worth seeing: every board GPG-verifies against its pinned key before applying, so an unsigned tip is a release no board will take.

Every model blob on the mirror cross-checked against the board manifests. MISSING = a manifest names it and the mirror does not have it (boards cannot fetch it). size mismatch = the blob is there but not the size the manifest declares. orphan = on the mirror, in no manifest. declared — unbuilt = an all-zero sentinel sha: the build has not been cut yet, so nothing is expected on the mirror.

Precision is the manifest's own 5th column, shown as a suffix on the model name — never guessed for a row that has no manifest entry.

Frames already on the VPS (collector + night-trickle ingest) — nothing is pulled off a board.

Boxes = class + confidence, from ingest hard-example frames. Collector frames carry no detector output.

Zones / crop come from each board's CAM_N_EXCLUDE_ZONES / CAM_N_CROP.

Box placement is best-effort — ingest frames are downscaled on the VPS.

Images load only while this tab is open.

Every board's agent is gated: a new signed release is recorded as pending and applied only when the approved sha names it exactly. Approve & apply writes that approval for the board's current channel tip; the board picks it up over the mesh on its next tick (≤60s + fetch), verifies the GPG signature against its pinned key, health-dwells, and auto-reverts on failure.

Once the board reports back, this table shows the board-confirmed status — never a console guess. It says up to date only when the board's own deployed_healthy_sha equals the approved sha.

Update all outdated approves every polling board that is behind its channel tip; per-board gates are unchanged and non-polling / off-channel boards are skipped. Clear approval (behind ⋯) stops future fetches but cannot recall an approval a board already pulled — it is not a kill-switch.

Lifecycle (behind ⋯) drives deploy/fork-unify/migrate-rock3b.sh and deploy/mesh/mesh-acl.sh grant over the mesh, exactly as run from the VPS shell. swap and rollback are the only disruptive stages and get an extra confirm; swap is health-gated with automatic rollback to the fork. One job runs at a time; PASS/FAIL is the job's exit code in the drawer.

Four steps, top to bottom, in the numbered panels on this tab:

1. Collect — the A0 collector grabs one live frame per camera every ~10 min, per site/camera and sun phase.
2. Label frames — a big YOLO teacher draws boxes on every collected frame into a new run. (The first real run downloads the teacher weights once.)
3. Review each frame — look at the drawn boxes and Keep or Reject each, fix a wrong class from the box's dropdown, drag in a box the teacher missed (misses are the highest-value signal), then Save review.
4. Apply review → curate — assembles the curated ground-truth set from the frames you kept. Rejected and un-reviewed frames are left out.

Nothing auto-promotes. Curated sets are what the fine-tune → gate → promote pipeline scores against — a human always decides which boxes are true.

Auto-labels a new run with teacher_label.py on the VPS. Pick a site/cam subset or label ALL raw frames.

The dedicated teacher venv (/opt/nvr-teacher-venv) is wired in; the first REAL run downloads yolo11x.pt once. If ultralytics is still missing the tool falls back to its DRY-RUN stub and the job log says so.

Click Keep if the boxes are on the objects, Reject if they are wrong or misplaced.

If a box has the wrong class (an autorickshaw the COCO teacher called truck), fix it from that box's class dropdown. If the teacher missed an object, click + Add missed box, drag a box around it and pick its class — misses are the highest-value training signal. The × on a box removes a misdraw. Then Save review.

The standalone spot-check sheet is still available as a fallback from the runs table below.

Each labeled run and where it stands. Review frames opens it in the reviewer above; Apply review assembles the curated set from the frames you kept.

Open sheet and Upload review JSON (behind ⋯) are the standalone-sheet fallback path.

Runs whose reviewers rejected a large share of the teacher's boxes are archived — hidden from the reviewer dropdown and this list by default. Nothing is deleted; tick show archived to see them.

Status is a background health poll — this page never probes. up = whole recent window green · flaky = intermittent · down = whole window red · unknown = probeable, no sample yet · not probed = deliberately not polled.

The poller only GETs an unauthenticated /health on a live surface with a configured URL; it never sends a credential and never touches a design surface. Deployment (live running · opt-in operator-enabled · design specified-not-deployed) rides the name.

Spec: docs/design/api-funnel-standard-2026-07.md

Boards observe — during quiet hours each board OCRs wordmarks and night-trickles a tiny crop + the text it read for any confident brand match. Those land here as observations.

Review each observation — look at the crop, the OCR text and the brand it proposed. Accept (the match is right — the text it read is added as an alias), Correct (pick the real brand, or type a new one), or Reject (not a brand / wrong). Then Save review.

Curate the list — the brand-list editor is the source of truth: add/remove aliases, add a brand no board has seen yet, and assign boards to customers so a brand can be per-customer or general.

Publish — publish the curated list as ONE signed central artifact. Cut-canary → promote carries it to every board; a board that never saw a brand still gets it.

Nothing auto-publishes — a human always decides. Quality-first: prefer Reject over shipping a wrong brand. Stub-OCR observations are badged and never silently curated.

The central list, general + per-customer. Add or remove aliases on a brand, or add a brand no board has seen yet (covers brands you know about ahead of time). This is what gets published to the fleet.

An accepted observation from a board assigned to a customer goes under that customer's list; unassigned boards feed the general list.

Publishes the curated list as one signed central artifact (models/brandlist.json) and bumps the board manifests. It self-validates through the on-board consumer and refuses to ship a list the fleet couldn't load. Then use Releases → Cut canary → Promote to carry it to the boards.

The logo gallery is the VISUAL half of the loop (embeddings of accepted crops + reference logos). Rebuild is idempotent + data-gated; without real CLIP weights it honestly rebuilds a STUB (badged) — a real, publishable gallery needs weights provisioned on the VPS.

Class columns and Folds are raw detection-frame folds — one count per detected object per detector pass, so they show relative activity, not vehicle counts. Tracks counts unique vehicles and is the number Analytics sums. autorickshaw is a fleet-custom class; 0 means the board's model does not emit it.

The MAKE/model the analytics worker's symbol-gallery + rear-nameplate-OCR pass emits off the real-time hot path (backend/analytics/vehicle.py), read from analytics_vehicle_brand events in nvr_monitor.anomaly_events. Every make is a model estimate (provenance: symbol+ocr), never ground truth — a human curates makes on the Brand tab. Confidence is the fused symbol+OCR score (uncalibrated).

The pass is gated + inert until a vehicle-symbol gallery and OCR weights are provisioned: an empty table with a healthy source is the honest "detection running, nothing recognized yet" state, not an error.

Review flags for human triage; nothing here triggers an automated response. Known limitations + DPDP note: docs/design/safety-analytics-2026-07.md

Internal review flags, never an automated action. Computed on-board from the person/pose/face tracks the boards already produce. Gender is an estimate. Internal, mesh-only surface — customers see anonymized aggregates only.

Camera-minute rows shipped to ClickHouse (nvr_monitor.detections) in the window. People / Vehicles are summed average-concurrent counts — an activity proxy, not unique individuals.