ota: implement auto-update with canary strategy and quiet window

Implements Component 6 from the plan - automatic OTA updates with canary
deployment strategy and configurable quiet window scheduling.

Features:
- Canary strategy: updates one node first, monitors detection quality
  for 10 minutes (configurable), then rolls out fleet-wide if quality
  degradation is below threshold (default 5%)
- Quiet window: configurable time range (default 02:00-05:00) when
  auto-updates are allowed. Supports overnight windows (e.g., 22:00-06:00)
- Zone vacancy check: only updates when all zones have been vacant
  for >10 minutes
- Auto-update mode toggle: enable/disable via settings
- REST API endpoints for status, config, trigger, cancel, and history
- Dashboard integration for real-time progress updates

Settings keys:
- auto_update_enabled: bool (default false)
- quiet_window_start: HH:MM format (default "02:00")
- quiet_window_end: HH:MM format (default "05:00")
- canary_duration_min: 5-60 minutes (default 10)
- auto_update_quality_threshold: 0.01-0.5 (default 0.05)

Implementation:
- internal/ota/autoupdate.go: AutoUpdateManager with canary selection,
  monitoring, and fleet rollout
- internal/ota/autoapi.go: REST API handlers
- internal/autoupdate/adapters.go: integration with quality provider,
  node provider, event notifier, zone vacancy checker
- internal/api/settings.go: auto-update settings with validation
- dashboard/js/ota.js: auto-update state tracking

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.beads/issues.jsonl

@@ -1,7 +1,7 @@
 {"id":"bf-13gwk","title":"Spatial quick actions (Component 32)","description":"## Goal\nRight-click (desktop) or long-press (mobile) anywhere in 3D view to get context-sensitive actions based on what's under cursor.\n\n## Scope\nActions per target:\n- On blob: 'Who is this?' (BLE assignment), 'Why is this here?' (explainability), 'Follow' (camera tracks), 'Create automation here', 'Mark incorrect' (thumbs-down), 'Track history'\n- On node: 'Diagnostics' (CSI plot), 'Blink LED', 'Reposition', 'Update firmware', 'Show links', 'Disable/Enable'\n- On empty floor space: 'What happened here?' (filter timeline), 'Add trigger zone', 'Add virtual node', 'Coverage quality'\n- On zone label: 'Zone history', 'Edit zone', 'Create automation', 'Crowd flow'\n- On portal: 'Crossing log', 'Edit portal', 'Reverse direction'\n- On trigger volume: 'Edit trigger', 'Test', 'View log', 'Disable/Enable'\n\n## Implementation\nThree.js Raycaster determines what's under cursor\nSingle context menu component renders appropriate options\nEach action dispatches to existing dashboard functions (no new backend endpoints needed)\n\n## Acceptance\n- Right-click/long-press on blob shows blob-specific actions\n- Right-click/long-press on node shows node-specific actions\n- Right-click/long-press on empty space shows space-specific actions\n- Actions execute correctly\n- Works on both desktop (right-click) and mobile (long-press)","design":"","acceptance_criteria":"","notes":"","status":"open","priority":2,"issue_type":"task","created_at":"2026-05-05T04:06:11.548191949Z","updated_at":"2026-05-05T04:06:11.548191949Z","source_repo":".","compaction_level":0}
 {"id":"bf-1ih7k","title":"TX slot collision detection and adaptive re-stagger","description":"Plan (Component 5 / Fleet Manager) specifies collision monitoring: if CSI frames from two TX nodes arrive within 3ms of each other, log a 'possible slot collision' metric. If collision rate > 5% over a 60-second window, re-randomize stagger assignments (shift one node's slot by half a slot width) and push updated config messages. The fleet manager computes stagger slots but has no collision detection, no re-stagger logic, and no collision rate metric. Needs: (1) per-link-pair collision counter in ingestion/signal processing path, (2) collision rate aggregation in fleet manager, (3) adaptive re-stagger trigger.","design":"","acceptance_criteria":"","notes":"","status":"open","priority":3,"issue_type":"task","created_at":"2026-05-02T18:25:13.899248435Z","updated_at":"2026-05-02T18:25:13.899248435Z","source_repo":".","compaction_level":0}
 {"id":"bf-1k3zg","title":"API: GET /api/doctor — pre-flight configuration diagnostic","description":"## Goal\nAdd a GET /api/doctor endpoint that diagnoses common misconfiguration before the user concludes the system is broken. Complements /healthz (runtime state) with pre-flight checks (configuration correctness).\n\n## Endpoint\n\nGET /api/doctor\n- Requires session cookie (same as all /api/* endpoints)\n- Returns 200 with a JSON report regardless of check results (HTTP status reflects reachability, not check results)\n\n## Checks to run\n\n| Check | Pass condition | Fail message |\n|---|---|---|\n| data_dir_writable | /data is writable and has >100 MB free | 'Data directory not writable' or 'Disk space low: Nf MB free' |\n| db_integrity | PRAGMA integrity_check returns 'ok' | 'SQLite integrity check failed' |\n| firmware_dir | /firmware contains at least one *.bin file | 'No firmware binaries found — OTA updates unavailable' |\n| mdns_binding | mDNS service is registered (or SPAXEL_MDNS_ENABLED=false) | 'mDNS not advertising — nodes cannot auto-discover mothership' |\n| mqtt_reachable | If SPAXEL_MQTT_BROKER is set: TCP connect to broker succeeds within 3s | 'MQTT broker unreachable: <broker_url>' |\n| ntp_reachable | UDP ping to SPAXEL_NTP_SERVER:123 resolves within 3s | 'NTP server unreachable — node clock sync may fail' |\n| install_secret | install_secret row exists in auth table | 'Installation secret missing — re-run container to regenerate' |\n| pin_configured | pin_bcrypt is non-null in auth table | 'Dashboard PIN not configured — run first-time setup' |\n| node_token_consistency | All nodes in registry have non-null node_token | 'N nodes missing auth tokens — re-provision via Web Serial' |\n\n## Response format\n\n{\n  'checks': [\n    {'name': 'db_integrity', 'status': 'ok', 'message': null},\n    {'name': 'mqtt_reachable', 'status': 'warn', 'message': 'MQTT broker unreachable: mqtt://ha.local:1883'},\n    {'name': 'firmware_dir', 'status': 'error', 'message': 'No firmware binaries found'}\n  ],\n  'overall': 'warn',   // 'ok' | 'warn' | 'error' (worst of all checks)\n  'checked_at': '2024-03-15T07:00:00Z'\n}\n\nStatus levels: 'ok' (pass), 'warn' (degraded but functional), 'error' (action required).\n\n## Dashboard integration\n- Command palette: 'doctor' → calls /api/doctor, shows results inline\n- Guided troubleshooting (Component 36): 'Node offline' flow links to 'Run diagnostics' which calls /api/doctor\n- /healthz already covers runtime health; /api/doctor covers configuration health — keep them separate\n\n## Acceptance\n- GET /api/doctor returns 200 with all checks when fully configured\n- Reports 'firmware_dir: error' when /firmware is empty\n- Reports 'mqtt_reachable: warn' when MQTT broker env is set but broker is unreachable\n- Unit tests cover each check in isolation with mocked dependencies","design":"","acceptance_criteria":"","notes":"","status":"closed","priority":2,"issue_type":"task","assignee":"claude-code-glm-4.7-golf","created_at":"2026-05-02T12:22:51.188946318Z","updated_at":"2026-05-05T12:39:28.566216915Z","closed_at":"2026-05-05T12:39:28.566216915Z","close_reason":"Completed","source_repo":".","compaction_level":0}
-{"id":"bf-1t0kn","title":"OTA auto-update with canary strategy and quiet window","description":"Plan specifies a canary OTA strategy (Component 6): update one node first, monitor quality for 10 min, then roll out fleet-wide. Also needs a configurable quiet window (default 02:00–05:00 local) and auto-update mode toggle. Currently the fleet manager only does manual rolling OTA — no canary logic, no scheduled quiet window, no auto-update-on-firmware-detect. Implementation needed in internal/ota and/or fleet manager with a settings key for auto_update_enabled, quiet_window, canary_duration_min.","design":"","acceptance_criteria":"","notes":"","status":"in_progress","priority":2,"issue_type":"task","assignee":"claude-code-glm-4.7-foxtrot","created_at":"2026-05-02T18:24:59.888109951Z","updated_at":"2026-05-05T16:06:36.077112801Z","source_repo":".","compaction_level":0}
+{"id":"bf-1t0kn","title":"OTA auto-update with canary strategy and quiet window","description":"Plan specifies a canary OTA strategy (Component 6): update one node first, monitor quality for 10 min, then roll out fleet-wide. Also needs a configurable quiet window (default 02:00–05:00 local) and auto-update mode toggle. Currently the fleet manager only does manual rolling OTA — no canary logic, no scheduled quiet window, no auto-update-on-firmware-detect. Implementation needed in internal/ota and/or fleet manager with a settings key for auto_update_enabled, quiet_window, canary_duration_min.","design":"","acceptance_criteria":"","notes":"","status":"in_progress","priority":2,"issue_type":"task","assignee":"claude-code-glm-4.7-foxtrot","created_at":"2026-05-02T18:24:59.888109951Z","updated_at":"2026-05-05T16:27:38.355301775Z","source_repo":".","compaction_level":0}
 {"id":"bf-232u3","title":"GET /api/notifications/preview — rendered test thumbnail endpoint","description":"Plan (Component 30, Renderer spec) specifies a test endpoint: GET /api/notifications/preview?type=fall&person=Alice returns a rendered test image for UI development and QA. The render package (internal/render/floorplan.go) implements thumbnail generation with fogleman/gg, but the preview HTTP endpoint is never registered in main.go. Needs: handler that accepts ?type and ?person query params, calls the appropriate Generate*Thumbnail function, returns the PNG bytes with Content-Type: image/png.","design":"","acceptance_criteria":"","notes":"","status":"open","priority":2,"issue_type":"task","created_at":"2026-05-02T18:25:20.897907993Z","updated_at":"2026-05-02T18:25:20.897907993Z","source_repo":".","compaction_level":0}
 {"id":"bf-25dmx","title":"Guided troubleshooting (Component 36)","description":"## Goal\nWhen system detects that user might be struggling or detection quality has degraded, proactively offer contextual help — but never when things are working well.\n\n## Trigger conditions and responses:\n\nDetection quality drops:\n- Condition: Zone-level detection quality below 60% for >24 hours\n- Banner in timeline and 3D view: 'Detection in the kitchen has been less reliable this week. Want me to help diagnose?'\n- Guided flow: Check node connectivity → show link health with explainability → suggest node repositioning → offer re-baseline → 'Still not right? Try adding a node here [highlighted position]'\n\nRepeated setting changes:\n- Condition: Same settings key modified 3+ times within 60-minute sliding window (qualifying keys: delta_rms_threshold, breathing_sensitivity, tau_s, fresnel_decay, n_subcarriers)\n- Tracking: per-key edit counter in memory, resets after 60 min inactivity\n- Trigger: when counter reaches 3, set hint_pending flag\n- Frontend: show non-intrusive banner: 'You've adjusted the detection threshold several times. Would you like me to show you what the system is seeing?' with [Show me] and [×] dismiss\n- [Show me]: opens time-travel to most recent detection event before first edit, with explainability overlay pre-activated\n- Cooldown: 24 hours after hint is shown\n\nNode offline:\n- Condition: Any node offline for >2 hours\n- Timeline event with expandable troubleshooting steps\n\nFirst-time feature discovery:\n- Condition: User opens feature panel for first time\n- Brief, non-intrusive tooltip (not modal): 'Draw a box around an area, then choose what happens when someone enters or leaves. [Got it]'\n- Shown once, never repeated\n\nAfter false positive feedback:\n- Inline response in timeline: 'Got it. I've slightly raised the detection threshold for the contributing links. If this keeps happening at this time of day, my hourly baseline will adapt within a few days.'\n\nAfter successful calibration:\n- Positive reinforcement: 'Re-baseline complete. Detection quality in the kitchen improved from 64% to 89%.'\n\n## Design principles\n- Reactive, not proactive: help appears only when something seems wrong or when user is clearly exploring\n- Dismissible in one tap: never blocks UI\n- Never repeats after dismissal (stored in localStorage)\n- Always explains what will happen next\n- Never condescending: assumes user is intelligent but may not know CSI physics\n\n## Acceptance\n- Detection quality drop triggers helpful banner\n- Repeated setting changes trigger hint\n- Node offline shows troubleshooting steps\n- First-time feature discovery shows tooltip once\n- Feedback responses are helpful\n- Calibration success shows positive reinforcement","design":"","acceptance_criteria":"","notes":"","status":"open","priority":2,"issue_type":"task","created_at":"2026-05-05T04:06:29.724435180Z","updated_at":"2026-05-05T04:06:29.724435180Z","source_repo":".","compaction_level":0}
 {"id":"bf-2lfti","title":"Activity timeline (Component 27)","description":"## Goal\nImplement universal event stream timeline that serves as primary navigation for time and space.\n\n## Scope\n- Event types: detections, zone transitions, portal crossings, automation triggers, alerts (fall/anomaly/security), system events (node online/offline, OTA, baseline changes), learning milestones\n- Tap any event → 3D view jumps to that exact moment via time-travel\n- Inline actions per event: thumbs up/down (feedback), 'Why?' (explainability), create automation from event\n- Filters: By person, by zone, by event type, by time range (combinable)\n- Search: Natural language queries like 'kitchen occupied after midnight last week'\n- Scroll up = go back in time. Open dashboard after being away → scroll up to see everything that happened\n\n## Location\ndashboard/static/js/timeline.js (new module)\ninternal/api/events.go (GET /api/events endpoint already exists)\n\n## Acceptance\n- Timeline sidebar in expert mode shows all events in scrollable stream\n- Simple mode: timeline IS the main view as activity feed, with room cards above it\n- Tap event → 3D scene shows state at that moment\n- Search filters events correctly\n- FTS5 index on events table for natural language search","design":"","acceptance_criteria":"","notes":"","status":"open","priority":2,"issue_type":"task","created_at":"2026-05-05T04:05:43.262510021Z","updated_at":"2026-05-05T04:05:43.262510021Z","source_repo":".","compaction_level":0}

.beads/traces/bf-1t0kn/metadata.json

@@ -0,0 +1,16 @@
+{
+  "bead_id": "bf-1t0kn",
+  "agent": "claude-code-glm-4.7",
+  "provider": "zai",
+  "model": "glm-4.7",
+  "exit_code": 1,
+  "outcome": "failure",
+  "duration_ms": 500536,
+  "input_tokens": null,
+  "output_tokens": null,
+  "cost_usd": null,
+  "captured_at": "2026-05-05T16:35:59.094793837Z",
+  "trace_format": "claude_json",
+  "pruned": false,
+  "template_version": null
+}

.needle-predispatch-sha

@@ -1 +1 @@
-77a2fbc9c035d8c0247645713c5c5cd634347405
+564d62cf338dc8f6fc01f88c8932b1f6220cd500

dashboard/js/ota.js

@@ -3,6 +3,7 @@
  *
  * Provides UI for firmware updates: list available versions,
  * trigger rolling updates, display progress, and show rollback warnings.
+ * Also includes auto-update settings with canary strategy and quiet window.
  */
 
 (function() {
@@ -13,7 +14,19 @@
         firmwareList: [],
         progress: {},
         pollInterval: null,
-        otaInProgress: false
+        otaInProgress: false,
+        autoUpdate: {
+            enabled: false,
+            state: 'idle',
+            canaryNode: null,
+            baselineQuality: 0,
+            quietWindowStart: '02:00',
+            quietWindowEnd: '05:00',
+            canaryDurationMin: 10,
+            qualityThreshold: 0.05,
+            isInQuietWindow: false,
+            nextQuietWindowStart: null
+        }
     };
 
     // ============================================