Firmware updates are where camera fleets go to die. One bad image, pushed to every device at once, and you're driving to sites with a laptop. A fleet runtime earns its keep by making that impossible.
Update in waves, verify between them
Our rollout engine updates in stages — 10%, then 50%, then all — with automatic health verification between each. A device that fails its post-update checks rolls back to the previous image on its own; the stage halts and the dashboard flags the diff, so a bad build stops at ten devices instead of a thousand.
No unbootable state, by construction
An A/B partition scheme means the new image is written to the inactive slot and only becomes the boot target once it verifies. There is no window in which a device can be left unbootable — the worst case is that it keeps running the old image. The fleet CLI makes the whole process one command:
visionlibra ota rollout v2.4.2 --stage 10%
The result across our pilot fleets: 3,000+ device-updates, zero truck rolls. For a system whose whole promise is "no frame leaves the building," the fleet has to be maintainable without anyone entering the building either — the Spatial Hub is the on-site node that makes that work.
The Spatial Hub runs the fleet runtime on-site for up to 32 camera streams — see the specs.