feat(reader): channel tagging (clone defense) + structural filter for phantom scans

Two reader-hardening changes born from the park-buzi phantom-scan investigation
(empty pre-opening site, exit reader pushing sun-decoded garbage codes).

1. CHANNEL TAGGING — closes the printed-card-clone hole. The DT-008 push is
   channel-blind (one opaque cardid from either engine) and SubscriptionFlow
   matched by value only, so printing an RF card's UID (often written on the
   card face, e.g. 86A158) as a barcode cloned the card. Now:
   - Vendor tool sets output prefixes (QRCode "Q:", Card "K:"; server env
     overrides READER_QR_PREFIX / READER_CARD_PREFIX).
   - routes/qr-reader.ts strips the prefix and tags the read's confirmed
     channel (DeviceReadEvent.channel optical|rf; kind qr|card). Enrollment
     capture stores the BARE value. READ log lines carry ch=… (permanent
     phantom attribution).
   - SubscriptionFlow.match requires channel agreement: an optical decode may
     not claim an rf credential (and vice versa) — refused + signed
     sub.refused.channelMismatch anomaly (a clone attempt is a fraud signal).
   - Unprefixed reads keep the legacy untagged shape and match as before, so
     enforcement only bites where prefixes are deployed. Deploy server FIRST,
     then set prefixes in the vendor tool.

2. STRUCTURAL FILTER — phantom decodes out of the signed feed (operator-
   requested, reverses the earlier "record every probe" position — red
   "who is exiting?" rows for NOBODY train the operator to ignore the feed).
   read-dispatch.ts drops a no-match reader value that cannot possibly be a
   credential we issue (no ticket Luhn shape, no SUB-/SUBSESS- prefix, not
   confirmed-RF, not a plate) to UNSIGNED device_events telemetry
   (unrecognizedRead:true). Deliberately WIDE plausibility: forged ticket
   shapes, unknown physical cards, unknown SUB- codes all still sign the
   normal refusal anomaly; enrolled credentials match before the filter and
   can never be hidden. Works for legacy unprefixed reads too — the feed
   cleans up on deploy, before any vendor-tool change.

Wiki: dingtian-dt008-reader.md records the clone hole + fix, the filter (as a
recorded position reversal), and the two device-side settings now part of the
credential contract (output prefixes + Card Input format, moving 6H→8H at the
next vendor-tool session; both live ON the device — re-apply after any
factory reset/swap).

Tests: qr-reader-channel.test.ts (prefix split, route tagging, bare-value
capture), subscription-channel.test.ts (channel agreement matrix + anomaly),
read-dispatch-filter.test.ts (filter boundary: phantoms dropped, probes kept,
enrolled never hidden). Suite 278 green.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -2247,3 +2247,28 @@ flip a signed config_change, tickets stamped presenceBypassed, radar-bypass cool
 commissioning pulse, signed barrier_open_command BEFORE the fire so a test open never reads as the
 out-of-band-open fraud signal, saved-controllers-only, radarAlert lamps excluded). Cross-linked
 from [[operator-issued-entry]] (bypass note) and cataloged in index.md.
+
+## [2026-07-04] update | Reader channel tagging: printed-card-clone hole closed
+
+Investigating the phantom scans surfaced a real vulnerability: the DT-008 push is channel-blind
+and SubscriptionFlow.match matched by value only, so printing an RF card's UID (written on the
+card face) as a barcode cloned the card. Fixed with channel tagging: vendor-tool output prefixes
+(Q:/K:) → routes/qr-reader.ts strips + tags DeviceReadEvent.channel (optical|rf) → match requires
+channel agreement, refusing a mismatch + signing a sub.refused.channelMismatch anomaly (a clone
+attempt is a fraud signal). Untagged (unprefixed) reads keep legacy behavior — enforcement only
+bites where prefixes are deployed. Enrollment capture stores bare values. Recorded on
+[[dingtian-dt008-reader]] incl. the two device-side settings now part of the credential contract
+(prefixes + Card Input format 6H — re-apply after factory reset). 14 new tests; suite 272 green.
+
+## [2026-07-04] update | Structural read filter: phantom scans out of the signed feed
+
+Operator-requested reversal of the earlier "do not filter" position (recorded as superseded on
+[[dingtian-dt008-reader]]): phantom decodes were signing exit.refused.noSession anomalies — red
+rows for nobody, training the operator to ignore the feed. read-dispatch.ts now drops a no-match
+reader value that cannot possibly be ours (no ticket Luhn shape, no SUB-/SUBSESS- prefix, not
+confirmed-RF, not a plate) to unsigned device_events telemetry (unrecognizedRead:true). The
+plausibility rule is deliberately wide so every real probe (forged ticket shape, unknown physical
+card, unknown SUB- code) still signs the normal anomaly; enrolled credentials match before the
+filter and can never be hidden by it. Works for legacy unprefixed reads too, so the feed cleans up
+before the vendor-tool visit. 6 new tests; suite 278 green. Also this session: reader channel
+tagging (clone defense) — see the prior entry.