Jetkvm

Operate a JetKVM from swamp: health checks and Tailscale updates. The JetKVM web UI does almost everything over a WebRTC data channel, so video, USB, version and settings are not on HTTP and there is no snapshot endpoint; this model reads the unauthenticated /metrics page for the app version and NTP state, and everything else over SSH as root (developer mode, key auth, host key pinned or already known; never trust-on-first-use). health flags app and system firmware updates (via JetKVM's release API), USB gadget not enumerated, low disk, clock skew, and Tailscale down, offline, out of date or missing its boot script; with the optional tailnetIp it also fetches /metrics over the tailnet, which catches a node deleted from the tailnet that tailscaled still reports as Running. Reads and writes are separate methods: tailscale reports status or plans an update and never changes the device; tailscaleUpdate always acts, behind labeled live pre-flight checks (installed, boot script, free space, tailnet path, no swap already running). The device has no CA store, so tailscale update cannot run on it: tailscaleUpdate downloads the official arm tarball on the swamp host, checks its sha256, streams it over SSH, backs up the running binaries, swaps them in the layout tailscale configure jetkvm expects, restarts tailscaled without a reboot, and rolls back by itself unless the node rejoins Running and online with the same tailnet IP (when the old one was readable) and, with tailnetIp, answers over the tailnet from the swamp host. Every update outcome is recorded as its own update instance, so a later status run never hides a failed update.