OTA and update UX: nightly installs, update now, banners, honest outcomes, clock trust, board report

[IbraTech04]

Summary

Nightly OTA updates. Release channel updates wait in /var/lib/musallahboard/updates/ and install as one batch in the install window: update_time (default 23:00, in the content's time zone) for 4 hours.

• A board with no app installed gets its first app straight away.
• /api/local/status has updates (now including autoUpdate, lastCheckAt and lastCheckError), and SSE sends an updates event, which drives the ticker line.

Install now. sudo musallahboard-agent update now and the update.install_now remote command check the channels and install at once. The command's deadline covers only the download. After a failed check the command no longer says "up to date".

Plain outcomes, screen or banner. Every batch ends in one notice (internal/notice): a tone, a headline, up to three plain lines, and an optional footer. File names never appear; technical reasons go in a result's new detail.

• The update screen appears only when something is about to be installed. Otherwise a person at the board sees a banner over the running board (the new notice SSE event).
• Older content, app or agent is outdated, not rejected.
• The update screen's result state takes a tone, lines that wrap, and a drawn ring with an exclamation mark for problems.

USB feedback.

• The helper unmounts the stick before handing its files over, so every USB outcome ends with "You can remove the USB stick".
• It also announces "Reading USB stick", "Can't read this USB stick" (with the reason), "No updates on this USB stick" and "USB updates are turned off".

Truthful agent updates (internal/agentupdate):

• The new agent shows the outcome when it starts.
• After a rollback, the previous agent explains what happened.
• A refusal by the root updater is detected and the inbox resumes (previously "Restarting" stayed on screen forever).
• Each outcome is shown once, and a batch queued behind an agent update shares its screen.

Upload page.

• An agent update is reported as "Restarting to finish the update", with the queued items listed. The page follows the restart until the new agent answers, or reports a rollback, a refusal, or a board that never came back.
• Uploads take up to 16 packages.

Clock trust, board report, fades.

• clock in the status gives the time's source and whether it can be trusted.
• Every heartbeat carries telemetry.board, including the offline routes and the update-check status.
• Switching to and from the update screen dips to black.

Pre-pilot audit fixes

• Crash loops:
  • The agent unit never gives up restarting; it backs off from 5 s to 2 minutes.
  • The kiosk opens a local starting.html that waits for the agent (/_mb/alive.gif) before moving to the board, so Chromium's "refused to connect" page no longer shows. Checked in real Chromium.
• Offline routes: the no-app page and the waiting screens offer only the routes the board accepts (the status has servicePort and usbImport).
• enroll: plain output, requires root, refuses to re-enroll without --force, and says what happens next.
• status: shows what the screen is showing, the LensBridge connection, the offline routes, update-check failures, and readable times.
• setup.sh:
  • Prompts read from /dev/tty, so curl | bash asks its questions.
  • No personal default for the admin user; the admin user and SSH key are validated.
  • The normal setup prepares the service port (left off), so service-port on works without a local copy of setup.sh.
  • The README matches all of this.
• Enrollment splash:
  • One embedded copy (musallahboard-agent splash install, refreshed after each self-update), in the board's navy and gold.
  • It shows the agent version and the enroll step.
• Readability: update screen text is sized for reading across a room.

Test plan

• go test ./..., go test -race on the new packages, and go vet ./... all pass.
• New tests cover updates, notice, agentupdate, the importer (banner vs screen, Summarize, USB notices and footer), usbimport (a notice per failure case), selfupdate (the outcome is written before the restart), clock (Info), localserver (BoardReport, no-app routes) and splash (version push).
• systemd-analyze verify passes on the new agent unit.
• The setup.sh prompt helper was tried both with and without a terminal.
• Rendered the update screen, the banners, the splash and the starting page in headless Chromium at 1920x1080.
• Not yet run on a Pi.

Companion PRs: LensBridge/MusallahBoard#3, LensBridge/LensBridgeBackend#20, LensBridge/LensBridgeFrontend#10.

Note: curl | bash installs fetch setup.sh from main, so the setup fixes reach new boards once develop is merged into main.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VUxfdFFUkL7SmAEUvUzspy

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.