chore(komodo): park-lab posts review crops as booth-lab; collector lists its token

Own pseudonymous id and own secret (wash_review_token_booth_lab), never a real
booth's, so bench crops stay separable per booth on the collector and can be
labelled unusable. Fleet page row updated.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

apps/collector/src/app.test.ts

@@ -151,3 +151,46 @@ describe("config", () => {
     expect(() => parseBoothTokens("nocolon")).toThrow(/bad pair/);
   });
 });
+
+describe("schema migration", () => {
+  it("opens a database created before the `kind` column and adds the missing columns, so ingest and stats work", async () => {
+    // art-docker-station, 2026-09-16: the volume's DB predated `kind`; CREATE TABLE IF NOT
+    // EXISTS left it alone, and /health, every ingest and the trainer's readiness failed
+    // with "no such column: kind". Replay: a file with the ORIGINAL column set.
+    const { default: Database } = await import("better-sqlite3");
+    const file = path.join(dir, "old.sqlite");
+    const old = new Database(file);
+    old.exec(`CREATE TABLE items (
+      id TEXT PRIMARY KEY, booth TEXT NOT NULL, order_ref TEXT NOT NULL, at TEXT NOT NULL,
+      service TEXT NOT NULL, vision_class TEXT NOT NULL, vision_confidence REAL NOT NULL,
+      image_width INTEGER NOT NULL, image_height INTEGER NOT NULL, plate_blurred INTEGER NOT NULL,
+      image_path TEXT NOT NULL, received_at TEXT NOT NULL, review_label TEXT, reviewed_at TEXT, reviewer TEXT)`);
+    old.prepare(
+      "INSERT INTO items (id, booth, order_ref, at, service, vision_class, vision_confidence, image_width, image_height, plate_blurred, image_path, received_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)",
+    ).run("legacy-1", "booth-7", "o-0", "2026-09-01T00:00:00.000Z", "Standard", "suv", 0.8, 100, 100, 1, "crops/legacy-1.jpg", "2026-09-01T00:00:00.000Z");
+    old.close();
+
+    const legacy = await buildCollector({ host: "127.0.0.1", port: 0, dataDir: dir, boothTokens: TOKENS, reviewer: REVIEWER, trainerUrl: null }, { dbFile: file });
+    await legacy.ready();
+    try {
+      const health = await legacy.inject({ method: "GET", url: "/health" });
+      expect(health.statusCode).toBe(200);
+      expect(health.json()).toMatchObject({ ok: true, booths: 1, pending: 1 });
+
+      const { body, type } = multipart({ meta: JSON.stringify(meta({ item: "item-new" })) }, JPEG);
+      const r = await legacy.inject({ method: "POST", url: "/ingest", headers: { authorization: `Bearer ${TOKENS.get("booth-7")!}`, "content-type": type }, payload: body });
+      expect(r.statusCode).toBe(201);
+
+      const stats = await legacy.inject({ method: "GET", url: "/api/stats", headers: { authorization: basic } });
+      expect(stats.statusCode).toBe(200);
+
+      // The legacy row reads back with the defaults the new columns carry.
+      const cols = new Database(file, { readonly: true }).prepare("PRAGMA table_info(items)").all() as { name: string }[];
+      expect(cols.map((c) => c.name)).toEqual(expect.arrayContaining(["kind", "operator_ref", "operator_classes", "vision_category_id", "downgraded"]));
+      const legacyRow = new Database(file, { readonly: true }).prepare("SELECT kind, operator_classes, downgraded FROM items WHERE id = 'legacy-1'").get() as Record<string, unknown>;
+      expect(legacyRow).toEqual({ kind: "wash", operator_classes: "[]", downgraded: 0 });
+    } finally {
+      await legacy.close();
+    }
+  });
+});

apps/collector/src/app.ts

@@ -253,7 +253,18 @@ export async function buildCollector(cfg: CollectorConfig, opts: { dbFile?: stri
     try {
       const get = async (p: string) => {
         const r = await fetch(trainer + p, { signal: AbortSignal.timeout(15_000) });
-        if (!r.ok) throw new Error(`${p} → HTTP ${r.status}`);
+        if (!r.ok) {
+          // Surface the trainer's own error text (its handlers answer 500 JSON), so the
+          // reviewer reads "no such column: kind", not just a status code.
+          const detail = await r.text().then((t) => {
+            try {
+              return String((JSON.parse(t) as { error?: unknown }).error ?? t);
+            } catch {
+              return t;
+            }
+          }, () => "");
+          throw new Error(`${p} → HTTP ${r.status}${detail ? `: ${detail.slice(0, 300)}` : ""}`);
+        }
         return r.json() as Promise<Record<string, unknown>>;
       };
       const [health, readiness, versions, jobs] = await Promise.all([get("/health"), get("/readiness"), get("/versions"), get("/jobs")]);

apps/collector/src/db.ts

@@ -71,6 +71,39 @@ export class CollectorDb {
       CREATE INDEX IF NOT EXISTS items_pending ON items (reviewed_at, received_at);
       CREATE INDEX IF NOT EXISTS items_booth ON items (booth, received_at);
     `);
+    this.#migrate();
+  }
+
+  /** Columns added after the first deploy, with the DDL that adds them to an EXISTING
+   *  table. `CREATE TABLE IF NOT EXISTS` above only shapes a NEW database; a volume that
+   *  was created by an earlier build keeps its old columns, and every query naming a new
+   *  one then fails ("no such column: kind" — art-docker-station, 2026-09-16: the
+   *  collector's /health, every ingest, and the trainer's readiness all broke on a DB
+   *  from before `kind`). Each entry must be addable to a populated table, i.e. nullable
+   *  or carrying a DEFAULT. Append here whenever a column joins the CREATE above. */
+  static readonly #ADDED_COLUMNS: ReadonlyArray<readonly [name: string, ddl: string]> = [
+    ["kind", "TEXT NOT NULL DEFAULT 'wash'"],
+    ["operator_ref", "TEXT NOT NULL DEFAULT ''"],
+    ["operator_category_id", "TEXT NOT NULL DEFAULT ''"],
+    ["operator_category_name", "TEXT NOT NULL DEFAULT ''"],
+    ["operator_classes", "TEXT NOT NULL DEFAULT '[]'"],
+    ["vision_category_id", "TEXT"],
+    ["downgraded", "INTEGER NOT NULL DEFAULT 0"],
+  ];
+
+  /** Bring an existing `items` table up to the current column set (idempotent). */
+  #migrate(): void {
+    const present = new Set(
+      (this.#db.prepare("PRAGMA table_info(items)").all() as { name: string }[]).map((c) => c.name),
+    );
+    for (const [name, ddl] of CollectorDb.#ADDED_COLUMNS) {
+      if (!present.has(name)) this.#db.exec(`ALTER TABLE items ADD COLUMN ${name} ${ddl}`);
+    }
+  }
+
+  /** The current column names of `items` (for tests and diagnostics). */
+  columns(): string[] {
+    return (this.#db.prepare("PRAGMA table_info(items)").all() as { name: string }[]).map((c) => c.name);
   }
 
   close(): void {

apps/trainer/tests/test_server.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import sqlite3
 import threading
 import urllib.error
 import urllib.request
@@ -109,3 +110,38 @@ def test_train_job_then_versions_and_report(api) -> None:  # type: ignore[no-unt
     code, job2 = call("POST", "/jobs", {"kind": "evaluate", "version": "vapi"})
     wait_idle(Handler.jobs)
     assert call("GET", f"/jobs/{job2['id']}")[1]["status"] == "done"
+
+
+def test_a_handler_error_is_a_500_json_reply_not_a_dropped_connection(tmp_path: Path) -> None:
+    """A collector DB from before the `kind` column (art-docker-station, 2026-09-16): readiness
+    raised sqlite3.OperationalError, the stdlib server printed the traceback and closed the
+    socket, and the collector could only say "trainer not reachable: fetch failed". The
+    handler must answer 500 JSON naming the error instead."""
+    old = tmp_path / "old"
+    old.mkdir()
+    con = sqlite3.connect(old / "collector.sqlite")
+    con.executescript(
+        "CREATE TABLE items (id TEXT PRIMARY KEY, booth TEXT NOT NULL, order_ref TEXT NOT NULL,"
+        " at TEXT NOT NULL, service TEXT NOT NULL, vision_class TEXT NOT NULL,"
+        " vision_confidence REAL NOT NULL, image_width INTEGER NOT NULL, image_height INTEGER NOT NULL,"
+        " plate_blurred INTEGER NOT NULL, image_path TEXT NOT NULL, received_at TEXT NOT NULL,"
+        " review_label TEXT, reviewed_at TEXT, reviewer TEXT)"
+    )
+    con.commit()
+    con.close()
+    Handler.jobs = Jobs(old, tmp_path / "out", "https://example.invalid/pkg", "tok")
+    httpd = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+    threading.Thread(target=httpd.serve_forever, daemon=True).start()
+    try:
+        req = urllib.request.Request(f"http://127.0.0.1:{httpd.server_address[1]}/readiness")
+        with pytest.raises(urllib.error.HTTPError) as ei:
+            urllib.request.urlopen(req, timeout=10)
+        assert ei.value.code == 500
+        body = json.loads(ei.value.read())
+        assert "no such column: kind" in body["error"]
+        # /health does not touch the DB and still answers.
+        with urllib.request.urlopen(f"http://127.0.0.1:{httpd.server_address[1]}/health", timeout=10) as r:
+            assert r.status == 200
+    finally:
+        httpd.shutdown()
+        httpd.server_close()

apps/trainer/trainer/server.py

@@ -309,6 +309,26 @@ class Handler(BaseHTTPRequestHandler):
         self.wfile.write(raw)
 
     def do_GET(self) -> None:  # noqa: N802
+        self._guarded(self._get)
+
+    def do_POST(self) -> None:  # noqa: N802
+        self._guarded(self._post)
+
+    def _guarded(self, handler: Any) -> None:
+        """Run a handler; an unexpected exception becomes a 500 JSON reply instead of a
+        dropped connection (the stdlib server would print the traceback and close the
+        socket, which the collector could only report as "fetch failed" — 2026-09-16,
+        a collector DB from before the `kind` column)."""
+        try:
+            handler()
+        except Exception as exc:  # noqa: BLE001 — anything: the reply must be a reply
+            sys.stderr.write(f"[trainer.serve] {self.command} {self.path}: {type(exc).__name__}: {exc}\n")
+            try:
+                self._json(500, {"error": f"{type(exc).__name__}: {exc}"})
+            except Exception:  # noqa: BLE001 — headers already sent; nothing left to do
+                pass
+
+    def _get(self) -> None:
         path = self.path.split("?", 1)[0]
         j = self.jobs
         if path == "/health":
@@ -336,7 +356,7 @@ class Handler(BaseHTTPRequestHandler):
         else:
             self._json(404, {"error": "not found"})
 
-    def do_POST(self) -> None:  # noqa: N802
+    def _post(self) -> None:
         if self.path.split("?", 1)[0] != "/jobs":
             self._json(404, {"error": "not found"})
             return

komodo/resources.toml

@@ -49,11 +49,20 @@ REGISTRY=git.infra.msai.al/mca/parking_solution
 # Staging booth: pinned immutable stage-<sha>. After each promotion (merge dev → stage, CI builds
 # :stage-<sha>), bump this to the new sha and re-sync/deploy from Core. The moving `:stage` tag
 # exists as the pointer; we deploy the sha, not the mover.
-TAG=stage-8fa66c9
+TAG=stage-88f9c53
 COOKIE_SECURE=0
 # Venue modules this site is ENTITLED to (vendor decision; the site admin activates within
 # this set in Setup → Site). Unset = every registered module. See wiki/decisions/venue-modules.md.
 MODULES_ENTITLED=parking,validation
+# Car Wash review outbox (wiki/concepts/vision-review-outbox.md): the collector's ingest URL
+# on the Netbird overlay, this booth's PSEUDONYMOUS id (never the site name — the crops leave
+# the site), and its token — the SAME secret the wash-collector stack lists under that id.
+CARWASH_REVIEW_URL=http://docker-station.nb.infra:8090/ingest
+CARWASH_REVIEW_BOOTH_ID=booth-1
+CARWASH_REVIEW_TOKEN=[[wash_review_token_booth_buzi]]
+# Also send ENTRY reads as training material (gate view, no wash): 1 = every entry (storage
+# and bandwidth are not the limit; review what you have time for). N = one in N. 0 = off.
+CARWASH_REVIEW_ENTRY_SAMPLE=1
 VISION_ENABLED=1
 # Desktop app WS handshake: Origin is tauri://localhost (set explicitly by
 # platform-ws.ts, since the native WS plugin has no page context to auto-attach
@@ -85,7 +94,7 @@ REGISTRY=git.infra.msai.al/mca/parking_solution
 # Staging booth: pinned immutable stage-<sha>. After each promotion (merge dev → stage, CI builds
 # :stage-<sha>), bump this to the new sha and re-sync/deploy from Core. The moving `:stage` tag
 # exists as the pointer; we deploy the sha, not the mover.
-TAG=stage-2d9bb15
+TAG=stage-88f9c53
 COOKIE_SECURE=0
 # Venue modules this site is ENTITLED to (vendor decision; the site admin activates within
 # this set in Setup → Site). Unset = every registered module. See wiki/decisions/venue-modules.md.
@@ -114,8 +123,8 @@ BACKUP_KEY=[[park_2_backup_key]]
 # Stack — the LAB BENCH (not a booth): a spare Linux box with the field printer and
 # whatever device is under investigation, so a booth bug can be reproduced on the booth's
 # exact image before touching a real site. Same compose files + pinned TAG as the staging
-# booths. No review outbox (the lab is not a site — it must never feed the training pool
-# under a booth's identity). Its own secrets. See wiki/decisions/fleet-deployment-komodo.md.
+# booths. Review outbox under its OWN id (booth-lab) — never a
+# booth's identity, so bench crops stay separable on the collector. Its own secrets. See wiki/decisions/fleet-deployment-komodo.md.
 ##############################################################################
 
 [[stack]]
@@ -136,12 +145,17 @@ environment = """
 REGISTRY=git.infra.msai.al/mca/parking_solution
 # Lab: pinned to the SAME stage-<sha> as the booth whose bug is being reproduced (bump
 # alongside it). A lab may float, but a reproduction must run the booth's exact image.
-TAG=stage-2d9bb15
+TAG=stage-88f9c53
 COOKIE_SECURE=0
 # Entitled to Car Wash too, so the wash-desk printer role and till can be exercised on the bench.
 MODULES_ENTITLED=parking,carwash
-# NO review outbox on the lab (CARWASH_REVIEW_URL/BOOTH_ID/TOKEN deliberately unset): the
-# collector's training pool is per-booth, and the bench is not a booth.
+# Review outbox ON for the bench too, under its OWN pseudonymous id (booth-lab) and its own
+# secret — never a real booth's — so lab crops are separable on the collector (per-booth stats,
+# the export's booth column) and the reviewer can label bench junk "unusable".
+CARWASH_REVIEW_URL=http://docker-station.nb.infra:8090/ingest
+CARWASH_REVIEW_BOOTH_ID=booth-lab
+CARWASH_REVIEW_TOKEN=[[wash_review_token_booth_lab]]
+CARWASH_REVIEW_ENTRY_SAMPLE=1
 VISION_ENABLED=1
 # Desktop app WS handshake: Origin is tauri://localhost (set explicitly by
 # platform-ws.ts, since the native WS plugin has no page context to auto-attach
@@ -176,7 +190,7 @@ registry_account = "komodo"
 environment = """
 REGISTRY=git.infra.msai.al/mca/parking_solution
 # Pinned like the booths: bump to the stage-<sha> that carries the collector.
-TAG=stage-2d9bb15
+TAG=stage-73bfc1d
 # The host's NETBIRD address (an IP: Docker port bindings take no hostname) — the ingest port
 # is published on the overlay only. Booths reach it by its Netbird DNS name.
 COLLECTOR_BIND=100.75.184.156
@@ -184,7 +198,7 @@ COLLECTOR_BIND=100.75.184.156
 # that booth's own stack as its CARWASH_REVIEW_TOKEN — one value, two consumers, nothing
 # to keep in sync, and rotating a booth touches one secret. The booth id is the booth's
 # pseudonymous CARWASH_REVIEW_BOOTH_ID, never a site name. Add a pair per booth.
-COLLECTOR_BOOTH_TOKENS=booth-2:[[wash_review_token_booth_2]]
+COLLECTOR_BOOTH_TOKENS=booth-2:[[wash_review_token_booth_2]],booth-1:[[wash_review_token_booth_buzi]],booth-lab:[[wash_review_token_booth_lab]]
 # Phase-B trainer (the `trainer` service beside the collector; the Training section of /review
 # is its UI). Only `publish` needs this: a Gitea token with package:write for the model's generic
 # package. Uncomment when the first model is to be published.

packages/devices/src/drivers/index.ts

@@ -6,6 +6,7 @@ import { dingtianDriver } from "./access-dingtian.js";
 import { stubAccessDriver } from "./access-stub.js";
 import { dahuaDriver, hikvisionDriver } from "./camera.js";
 import { escposDriver } from "./printer-generic.js";
+import { k200lDriver } from "./printer-k200l.js";
 import { rongtaDriver } from "./printer-rongta.js";
 import { dingtianQrReaderDriver, tcpipReaderDriver, wiegandReaderDriver } from "./reader.js";
 
@@ -23,6 +24,7 @@ export function registerBuiltinDrivers(): void {
   registry.register(hikvisionDriver);
   registry.register(dahuaDriver);
   registry.register(rongtaDriver);
+  registry.register(k200lDriver);
   registry.register(escposDriver);
 }
 
@@ -35,5 +37,6 @@ export {
   hikvisionDriver,
   dahuaDriver,
   rongtaDriver,
+  k200lDriver,
   escposDriver,
 };

packages/devices/src/drivers/printer-generic.ts

@@ -37,6 +37,8 @@ import {
 // local usblp char device (/dev/usb/lp0); TCP writes to the raw print socket. This
 // clone family is the natural USB candidate — reachability-only, no page to lose.
 //
+// (The K200L / XP-K200L is the exception: its LAN board DOES serve a status page,
+// /prt_status.htm — use the `k200l` driver for it over TCP; see printer-k200l.ts.)
 // Therefore this driver deliberately does NOT implement MonitorableDevice
 // (no readStatus). The device monitor then falls back to the generic
 // `healthCheck()` — a plain TCP reachability PING of the print socket. So the

packages/devices/src/drivers/printer-k200l.test.ts

@@ -0,0 +1,230 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { createServer, type Server } from "node:net";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { parseRawReply, parseStatusPage, k200lDriver } from "./printer-k200l.js";
+import { renderTicket } from "./printer-escpos.js";
+import type { MonitorableDevice, PrinterDevice } from "../interfaces.js";
+
+// The K200L (Xprinter / ICS; J-Speed 'POS-80' LAN board) driver. Its status page was captured verbatim
+// from the unit on the lab bench, 2026-09-09: uppercase tags, values padded with
+// spaces, and — the part that matters — the board's reply has NO status line and NO
+// headers (the body starts at byte 0). The tests replay exactly that over a raw
+// socket, plus a proper-HTTP variant, so the driver is proven against both.
+
+/** The board's status table, as sent (CRLF, uppercase, padded values). */
+function boardPage(flags: Partial<Record<string, "Yes" | "No">> = {}): string {
+  const v = (k: string) => `${flags[k] ?? "No"}                             `;
+  return [
+    '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">',
+    "<HTML><HEAD><TITLE>Printer Status</TITLE>",
+    "<META http-equiv=refresh content=\"5;url='prt_status.htm'\"></HEAD>",
+    '<BODY><FORM id=Form1 action="prt_status.htm" method="get">',
+    "<TABLE id=Table3 cellPadding=3 border=0><TBODY>",
+    `<TR><TD>Cover Is Open</TD><TD style="width: 23px">${v("cover")}</TD></TR>`,
+    `<TR><TD>Cutter Error</TD><TD style="width: 23px">${v("cutter")}</TD></TR>`,
+    `<TR><TD>Paper End</TD><TD style="width: 23px">${v("paperEnd")}</TD></TR>`,
+    `<TR><TD>Paper Near End</TD><TD style="width: 23px">${v("nearEnd")}</TD></TR>`,
+    `<TR><TD>Printer Off-Line</TD><TD style="width: 23px">${v("offline")}</TD></TR></TBODY></TABLE>`,
+    '<INPUT type=submit value="Print Test Page" name=page_p2></FORM></BODY></HTML>',
+  ].join("\r\n");
+}
+
+const INDEX =
+  "<HTML><HEAD><TITLE>Ethernet port configuration</TITLE></HEAD><BODY><TABLE><TR><TD>Mac Address</TD><TD>00-D8-23-5C-58-8C</TD></TR></TABLE></BODY></HTML>";
+
+type Reply = { body: string; status?: number; raw?: boolean };
+
+describe("parseRawReply", () => {
+  it("treats a reply without a status line as HTTP/0.9: the whole reply is the body", () => {
+    const r = parseRawReply("<!DOCTYPE HTML><HTML>x</HTML>");
+    expect(r.status).toBe(200);
+    expect(r.body).toBe("<!DOCTYPE HTML><HTML>x</HTML>");
+  });
+  it("splits a real HTTP reply into status and body", () => {
+    const r = parseRawReply("HTTP/1.0 404 Not Found\r\nContent-Type: text/html\r\n\r\n<b>nope</b>");
+    expect(r.status).toBe(404);
+    expect(r.body).toBe("<b>nope</b>");
+  });
+});
+
+describe("parseStatusPage", () => {
+  it("reads the board's padded, uppercase table", () => {
+    const f = parseStatusPage(boardPage({ cover: "Yes", nearEnd: "Yes" }));
+    expect(f).toEqual({ coverOpen: true, cutterError: false, paperEnd: false, paperNearEnd: true, offline: false });
+  });
+  it("leaves unknown pages empty rather than guessing", () => {
+    expect(parseStatusPage(INDEX)).toEqual({});
+  });
+  it("reads a fault's Yes, which the board wraps in <FONT color=#ff0000> (captured live, cover open)", () => {
+    // Verbatim from the unit on 2026-09-09 with the cover open: the three fault cells carry
+    // markup the No cells don't — the first parser rejected them ("missing coverOpen,
+    // paperEnd, offline" on the booth) while the No cells parsed.
+    const page = boardPage()
+      .replace("Cover Is Open</TD><TD style=\"width: 23px\">No                             ", "Cover Is Open</TD><TD style=\"width: 23px\"><FONT color=#ff0000>Yes</FONT> ")
+      .replace("Paper End</TD><TD style=\"width: 23px\">No                             ", "Paper End</TD><TD style=\"width: 23px\"><FONT color=#ff0000>Yes</FONT> ")
+      .replace("Printer Off-Line</TD><TD style=\"width: 23px\">No                             ", "Printer Off-Line</TD><TD style=\"width: 23px\"><FONT color=#ff0000>Yes</FONT> ");
+    expect(parseStatusPage(page)).toEqual({ coverOpen: true, cutterError: false, paperEnd: true, paperNearEnd: false, offline: true });
+  });
+  it("tolerates other markup shapes around a value", () => {
+    const page = boardPage()
+      .replace("Paper End</TD><TD style=\"width: 23px\">No                             ", "Paper End</TD><TD style=\"width: 23px\"><B><FONT color=\"#ff0000\">Yes </FONT></B>")
+      .replace("Printer Off-Line</TD><TD style=\"width: 23px\">No                             ", "Printer Off-Line</TD>\r\n<TD style=\"width: 23px\">\r\n<font>Yes</font>\r\n");
+    expect(parseStatusPage(page)).toEqual({ coverOpen: false, cutterError: false, paperEnd: true, paperNearEnd: false, offline: true });
+  });
+  it("reads labels wrapped in markup too", () => {
+    const page = boardPage({ nearEnd: "Yes" }).replace("<TD>Paper Near End</TD>", "<TD><B>Paper&nbsp;Near End</B></TD>");
+    expect(parseStatusPage(page).paperNearEnd).toBe(true);
+  });
+});
+
+describe("k200lDriver.readStatus over TCP", () => {
+  let server: Server | undefined;
+  const sockets = new Set<import("node:net").Socket>();
+
+  /** A raw TCP server that answers like the board (no status line) unless the reply
+   *  says otherwise, and closes after the reply (HTTP/1.0). */
+  async function serve(reply: (path: string) => Reply): Promise<number> {
+    server = createServer((sock) => {
+      sockets.add(sock);
+      sock.on("close", () => sockets.delete(sock));
+      sock.once("data", (d) => {
+        const path = /^GET (\S+)/.exec(d.toString())?.[1] ?? "";
+        const r = reply(path);
+        if (r.raw === false) {
+          sock.end(`HTTP/1.0 ${r.status ?? 200} OK\r\nContent-Type: text/html\r\n\r\n${r.body}`);
+        } else {
+          sock.end(r.body);
+        }
+      });
+    });
+    await new Promise<void>((r) => server!.listen(0, "127.0.0.1", () => r()));
+    const addr = server.address();
+    if (!addr || typeof addr === "string") throw new Error("no port");
+    return addr.port;
+  }
+
+  afterEach(async () => {
+    for (const s of sockets) s.destroy();
+    sockets.clear();
+    if (server) await new Promise<void>((r) => server!.close(() => r()));
+    server = undefined;
+  });
+
+  function device(httpPort: number): MonitorableDevice & { driverId: string } {
+    return k200lDriver.create({ transport: "tcp-ip", host: "127.0.0.1", port: 9100, httpPort, timeoutMs: 1000 }) as unknown as MonitorableDevice & {
+      driverId: string;
+    };
+  }
+
+  it("reads the headerless reply: cover open + paper out + off-line → degraded, flags set", async () => {
+    const port = await serve((p) => (p === "/prt_status.htm" ? { body: boardPage({ cover: "Yes", paperEnd: "Yes", offline: "Yes" }) } : { body: INDEX }));
+    const dev = device(port);
+    expect(dev.driverId).toBe("k200l");
+    const s = await dev.readStatus();
+    expect(s.status).toBe("degraded");
+    expect(s.coverOpen).toBe(true);
+    expect(s.paperEnd).toBe(true);
+    expect(s.offline).toBe(true);
+    expect(s.cutterError).toBe(false);
+    expect(s.paperNearEnd).toBe(false);
+    expect(s.detail).toBe("cover open, paper out, printer off-line");
+  });
+
+  it("healthy printer → ready, every flag false", async () => {
+    const port = await serve(() => ({ body: boardPage() }));
+    const s = await device(port).readStatus();
+    expect(s.status).toBe("ready");
+    expect(s.coverOpen).toBe(false);
+    expect(s.detail).toBeUndefined();
+  });
+
+  it("paper near end alone → degraded 'paper low' (still prints, warn to reload)", async () => {
+    const port = await serve(() => ({ body: boardPage({ nearEnd: "Yes" }) }));
+    const s = await device(port).readStatus();
+    expect(s.status).toBe("degraded");
+    expect(s.paperNearEnd).toBe(true);
+    expect(s.detail).toBe("paper low");
+  });
+
+  it("also understands a proper HTTP reply (a board firmware that sends headers)", async () => {
+    const port = await serve(() => ({ body: boardPage({ cutter: "Yes" }), raw: false }));
+    const s = await device(port).readStatus();
+    expect(s.status).toBe("degraded");
+    expect(s.detail).toBe("cutter error");
+  });
+
+  it("a page without the status rows (the index) → degraded 'unexpected status page', never ready", async () => {
+    const port = await serve(() => ({ body: INDEX }));
+    const s = await device(port).readStatus();
+    expect(s.status).toBe("degraded");
+    expect(s.detail).toContain("unexpected status page");
+    expect(s.detail).toContain("missing");
+  });
+
+  it("a non-200 reply → degraded naming the code, never ready", async () => {
+    const port = await serve(() => ({ body: "", status: 404, raw: false }));
+    const s = await device(port).readStatus();
+    expect(s.status).toBe("degraded");
+    expect(s.detail).toContain("HTTP 404");
+  });
+
+  it("board unreachable (connection refused) → offline", async () => {
+    const port = await serve(() => ({ body: "" }));
+    await new Promise<void>((r) => server!.close(() => r()));
+    server = undefined;
+    const s = await device(port).readStatus();
+    expect(s.status).toBe("offline");
+    expect(s.detail).toMatch(/ECONNREFUSED/);
+  });
+
+  it("a board that accepts but never answers → offline 'status page timeout'", async () => {
+    server = createServer((sock) => {
+      sockets.add(sock); // hold the socket open, say nothing
+      sock.on("close", () => sockets.delete(sock));
+    });
+    await new Promise<void>((r) => server!.listen(0, "127.0.0.1", () => r()));
+    const addr = server.address();
+    if (!addr || typeof addr === "string") throw new Error("no port");
+    const dev = k200lDriver.create({ transport: "tcp-ip", host: "127.0.0.1", port: 9100, httpPort: addr.port, timeoutMs: 200 }) as unknown as MonitorableDevice;
+    const s = await dev.readStatus();
+    expect(s.status).toBe("offline");
+    expect(s.detail).toBe("status page timeout");
+  });
+});
+
+describe("k200lDriver — printing and USB are the generic ESC/POS path", () => {
+  let dir: string;
+  let devicePath: string;
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "k200l-usb-"));
+    devicePath = join(dir, "lp0");
+    writeFileSync(devicePath, "");
+  });
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("prints the same ticket bytes the generic driver would, to the USB node", async () => {
+    const printer = k200lDriver.create({ transport: "usb", devicePath, timeoutMs: 1000 }) as PrinterDevice;
+    const data = { ticketId: "12345678901", issuedAt: "2026-09-09T10:00:00.000Z" };
+    await printer.printTicket(data);
+    expect(readFileSync(devicePath).equals(renderTicket(data))).toBe(true);
+  });
+
+  it("over USB readStatus is the reachability floor: ready when the node opens, offline when absent", async () => {
+    const present = k200lDriver.create({ transport: "usb", devicePath, timeoutMs: 1000 }) as unknown as MonitorableDevice;
+    expect((await present.readStatus()).status).toBe("ready");
+    const absent = k200lDriver.create({ transport: "usb", devicePath: join(dir, "absent"), timeoutMs: 1000 }) as unknown as MonitorableDevice;
+    expect((await absent.readStatus()).status).toBe("offline");
+  });
+
+  it("advertises both transports and exposes the status-page port after the print port", () => {
+    expect(k200lDriver.transports).toEqual(["tcp-ip", "usb"]);
+    const keys = k200lDriver.configFields.map((f) => f.key);
+    expect(keys.indexOf("httpPort")).toBe(keys.indexOf("port") + 1);
+    expect(keys).toContain("role");
+  });
+});

packages/devices/src/drivers/printer-k200l.ts

@@ -0,0 +1,262 @@
+import { connect as netConnect } from "node:net";
+import type {
+  DeviceHealth,
+  MonitorableDevice,
+  PrinterDevice,
+  PrinterStatus,
+  PrintReport,
+  ReceiptData,
+  SubscriptionCardData,
+  TicketData,
+  WindowChargeNoticeData,
+} from "../interfaces.js";
+import type { ConfigField, DeviceConfig, PrinterDriver } from "../registry.js";
+import { stubLog } from "./common.js";
+import { transportFromConfig } from "./printer-escpos.js";
+import { escposDriver } from "./printer-generic.js";
+
+// K200L 80mm ESC/POS thermal printer (Xprinter / ICS "XP-K200L" family; label:
+// "THERMAL RECEIPT PRINTER Model:K200L, Interface: USB+LAN, Command Support: ESC/POS").
+// Its LAN board is the "J-Speed Ethernet Interface Module" (web UI "Ethernet WebConfig
+// 1.02") and calls the printer "POS-80" — over USB it enumerates as 1fc9:2016
+// "Printer POS-80". Identified on the lab bench 2026-09-09: it is the park-buzi unit.
+// See wiki/entities/k200l-printer.md.
+//
+// PRINTING is the shared ESC/POS path (delegated to the generic driver — same bytes,
+// same TCP-9100 / usblp transports). What this driver ADDS is live status: the board
+// serves a status page, /prt_status.htm, with the same five decoded Yes/No rows the
+// Rongta board serves under /prn_stat.htm (cover open, cutter error, paper end, paper
+// near end, off-line). So over TCP the operator gets a real paper/cover verdict —
+// the generic driver deliberately can't (reachability only), and the Rongta driver
+// can't read THIS board either: its reply carries NO status line and NO headers
+// (HTTP/0.9 style — the body starts at byte 0), which Node's http client rejects
+// ("Parse Error: Expected HTTP/"). Hence the raw-socket fetch below, tolerant of both
+// shapes. Over USB there is no page; status degrades to the reachability floor.
+//
+// Board facts worth knowing (all verified on the bench): factory address
+// 192.168.123.100, DHCP off; web configurator on port 80 (Information / Configuration
+// / Printer Status / Printer Test); the frameset reloads its frames every 1–3 s and
+// the status page every 5 s, and the embedded HTTP server is tiny — leave the browser
+// closed while the monitor polls, or connects will intermittently time out.
+
+/** The fault flags the status page reports (a subset of PrinterStatus). */
+type StatusFlag = "coverOpen" | "cutterError" | "paperEnd" | "paperNearEnd" | "offline";
+type StatusFlags = Partial<Record<StatusFlag, boolean>>;
+
+/** Label text on the status page (space-normalised, lowercased) → our key. */
+const STATUS_FIELDS: Record<string, StatusFlag> = {
+  "cover is open": "coverOpen",
+  "cutter error": "cutterError",
+  "paper end": "paperEnd",
+  "paper near end": "paperNearEnd",
+  "printer off-line": "offline",
+};
+const EXPECTED: readonly StatusFlag[] = ["coverOpen", "cutterError", "paperEnd", "paperNearEnd", "offline"];
+const LABELS: Record<StatusFlag, string> = {
+  paperEnd: "paper out",
+  coverOpen: "cover open",
+  cutterError: "cutter error",
+  offline: "printer off-line",
+  paperNearEnd: "paper low",
+};
+
+/** The board's status page. */
+export const K200L_STATUS_PATH = "/prt_status.htm";
+
+/**
+ * GET `path` over a raw TCP socket and return whatever the board sent, verbatim,
+ * once it closes the connection (HTTP/1.0 semantics — the board closes after the
+ * reply). No HTTP parsing here: this board answers without a status line, which
+ * node:http refuses to parse.
+ */
+export function fetchRaw(host: string, port: number, path: string, timeoutMs: number): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = [];
+    let settled = false;
+    const sock = netConnect({ host, port });
+    const timer = setTimeout(() => {
+      finish(() => reject(new Error("status page timeout")));
+      sock.destroy();
+    }, timeoutMs);
+    const finish = (fn: () => void) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      fn();
+    };
+    sock.setNoDelay(true);
+    sock.on("connect", () => {
+      sock.write(`GET ${path} HTTP/1.0\r\nHost: ${host}\r\nConnection: close\r\n\r\n`);
+    });
+    sock.on("data", (c: Buffer) => chunks.push(c));
+    sock.on("error", (err) => finish(() => reject(err)));
+    sock.on("close", () => finish(() => resolve(Buffer.concat(chunks).toString("latin1"))));
+  });
+}
+
+/**
+ * Split a raw reply into its HTTP status and body. A reply that starts with a status
+ * line is real HTTP (status + headers, body after the blank line); anything else is
+ * the HTTP/0.9-style reply this board sends — the whole thing IS the body, status 200.
+ */
+export function parseRawReply(raw: string): { status: number; body: string } {
+  const m = /^HTTP\/\d\.\d\s+(\d{3})[^\r\n]*\r?\n/.exec(raw);
+  if (!m) return { status: 200, body: raw };
+  const sep = raw.search(/\r?\n\r?\n/);
+  const body = sep === -1 ? "" : raw.slice(sep).replace(/^\r?\n\r?\n/, "");
+  return { status: Number(m[1]), body };
+}
+
+/** A cell's visible text: inner tags stripped (the board wraps a "Yes" in markup the
+ *  "No" cells don't carry), entities and padding normalised, lowercased. */
+function cellText(inner: string): string {
+  return inner
+    .replace(/<[^>]*>/g, "")
+    .replace(/&nbsp;/gi, " ")
+    .replace(/\s+/g, " ")
+    .trim()
+    .toLowerCase();
+}
+
+/**
+ * Parse the status table into boolean flags. Each fault is a `<TD>label</TD>
+ * <TD>Yes|No</TD>` pair (the board pads the value with spaces, and may wrap a fault's
+ * "Yes" in its own tags — 2026-09-09, seen live as "missing coverOpen, paperEnd,
+ * offline" with the cover open, i.e. exactly the Yes cells). Returns only the
+ * recognised fields; a missing field stays undefined so the caller can detect an
+ * unexpected page (fail safe, not a false "ok").
+ */
+export function parseStatusPage(html: string): StatusFlags {
+  const out: StatusFlags = {};
+  const rowRe = /<TR[^>]*>\s*<TD[^>]*>([\s\S]*?)<\/TD>\s*<TD[^>]*>([\s\S]*?)<\/TD>/gi;
+  let m: RegExpExecArray | null;
+  while ((m = rowRe.exec(html))) {
+    if (m[1] === undefined || m[2] === undefined) continue;
+    const key = STATUS_FIELDS[cellText(m[1])];
+    const value = cellText(m[2]);
+    if (key && (value === "yes" || value === "no")) out[key] = value === "yes";
+  }
+  return out;
+}
+
+class K200lPrinter implements PrinterDevice, MonitorableDevice {
+  readonly driverId = "k200l";
+  /** The print path — the generic ESC/POS device built from the SAME config. */
+  readonly #print: PrinterDevice;
+  readonly #tcp: boolean;
+  readonly #host: string;
+  readonly #httpPort: number;
+  readonly #timeout: number;
+
+  constructor(config: DeviceConfig) {
+    this.#print = escposDriver.create(config) as PrinterDevice;
+    this.#tcp = transportFromConfig(config).kind === "tcp";
+    this.#host = config.host ? String(config.host) : "";
+    this.#httpPort = config.httpPort ? Number(config.httpPort) : 80;
+    this.#timeout = config.timeoutMs ? Number(config.timeoutMs) : 3000;
+  }
+
+  async connect(): Promise<void> {
+    await this.#print.connect();
+  }
+
+  async disconnect(): Promise<void> {
+    await this.#print.disconnect();
+    stubLog(this.driverId, "disconnect");
+  }
+
+  healthCheck(): Promise<DeviceHealth> {
+    return this.#print.healthCheck();
+  }
+
+  printTicket(data: TicketData): Promise<void> {
+    return this.#print.printTicket(data);
+  }
+
+  printReport(report: PrintReport): Promise<void> {
+    return this.#print.printReport(report);
+  }
+
+  printSubscriptionCard(data: SubscriptionCardData): Promise<void> {
+    return this.#print.printSubscriptionCard(data);
+  }
+
+  printReceipt(data: ReceiptData): Promise<void> {
+    return this.#print.printReceipt(data);
+  }
+
+  printWindowChargeNotice(data: WindowChargeNoticeData): Promise<void> {
+    return this.#print.printWindowChargeNotice(data);
+  }
+
+  /**
+   * Live operator-actionable status from the board's own page.
+   * - USB: no page — reachability floor only (ready/offline, never a guessed state);
+   * - board unreachable / timeout → offline (the same signal as a dead printer);
+   * - page reachable but not the status table (wrong path, index served, non-200) →
+   *   degraded ("unexpected status page") — never "ready" off a page we didn't read;
+   * - any fault flag true → degraded, with the faults named; otherwise → ready.
+   */
+  async readStatus(): Promise<PrinterStatus> {
+    const checkedAt = new Date().toISOString();
+    if (!this.#tcp) {
+      const h = await this.#print.healthCheck();
+      return { status: h.status === "ready" ? "ready" : "offline", detail: h.detail, checkedAt };
+    }
+    let raw: string;
+    try {
+      raw = await fetchRaw(this.#host, this.#httpPort, K200L_STATUS_PATH, this.#timeout);
+    } catch (err) {
+      return { status: "offline", detail: (err as Error).message, checkedAt };
+    }
+    const { status, body } = parseRawReply(raw);
+    if (status !== 200) {
+      return { status: "degraded", detail: `unexpected status page (${K200L_STATUS_PATH}: HTTP ${status})`, checkedAt };
+    }
+    const flags = parseStatusPage(body);
+    const missing = EXPECTED.filter((k) => flags[k] === undefined);
+    if (missing.length > 0) {
+      return {
+        status: "degraded",
+        detail: `unexpected status page (${K200L_STATUS_PATH}: missing ${missing.join(", ")})`,
+        checkedAt,
+      };
+    }
+    const faults = EXPECTED.filter((k) => flags[k] === true);
+    return {
+      status: faults.length > 0 ? "degraded" : "ready",
+      ...flags,
+      detail: faults.length > 0 ? faults.map((f) => LABELS[f]).join(", ") : undefined,
+      checkedAt,
+    };
+  }
+}
+
+const httpPortField: ConfigField = {
+  key: "httpPort",
+  label: "Status web port",
+  type: "port",
+  required: false,
+  default: 80,
+  help: "The board's web configurator port; the status page /prt_status.htm is read from it for live monitoring (default 80). TCP only.",
+};
+
+/** The generic driver's fields (transport, device path, host, port, role, rank,
+ *  timeout) plus the status-page port, placed right after the print port. */
+function k200lFields(): ConfigField[] {
+  const out = [...escposDriver.configFields];
+  const i = out.findIndex((f) => f.key === "port");
+  out.splice(i === -1 ? out.length : i + 1, 0, httpPortField);
+  return out;
+}
+
+export const k200lDriver: PrinterDriver = {
+  id: "k200l",
+  category: "printer",
+  label: "K200L 80mm thermal printer (Xprinter / ICS, USB+LAN)",
+  description:
+    "Xprinter / ICS K200L (XP-K200L) 80mm ESC/POS printer; its LAN board reports itself as 'POS-80' (web configurator at 192.168.123.100:80 from the factory, DHCP off). Prints over raw TCP (port 9100) OR local USB /dev/usb/lp0 — the same bytes as the generic ESC/POS driver. Over TCP the board's /prt_status.htm page gives live paper / cover / cutter / off-line status; over USB there is no page, so it is monitored by reachability only. No auth on the print socket or the web UI — isolate the VLAN.",
+  transports: ["tcp-ip", "usb"],
+  configFields: k200lFields(),
+  create: (c) => new K200lPrinter(c),
+};

packages/devices/src/index.ts

@@ -18,6 +18,7 @@ export {
   hikvisionDriver,
   dahuaDriver,
   rongtaDriver,
+  k200lDriver,
   escposDriver,
 } from "./drivers/index.js";
 export { isPrinter, type PrinterRole } from "./drivers/printer-rongta.js";

wiki/concepts/printer-status-monitoring.md

@@ -2,7 +2,7 @@
 type: concept
 tags: [parking, printer, device, monitoring, reliability]
 sources: []
-updated: 2026-06-14
+updated: 2026-09-09
 ---
 
 # Printer status monitoring
@@ -90,3 +90,17 @@ reads. Full repo typechecks.
   Yes/No and degrade on anything unexpected, so this is a confidence check, not a blocker.
 - Tying a `degraded`/`offline` entry-dispenser into [[printer-roles-failover]] failover and the
   (not-yet-built) entry flow's all-printers-down policy ([[device-input-flow]]).
+
+## K200L — a second status-page board, and a fetch that node:http can't do (2026-09-09)
+
+The park-buzi printer turned out to be a **K200L** (Xprinter/ICS XP-K200L; LAN board "J-Speed
+Ethernet WebConfig 1.02", self-named "POS-80"). Its board serves the **same five decoded Yes/No
+rows** as the Rongta page — under **`/prt_status.htm`**. Two things kept it invisible until now:
+the Rongta driver only knew `/prn_stat.htm` (so in July the unit was filed as "no status page →
+generic driver"), and the board's reply carries **no HTTP status line or headers** (HTTP/0.9
+style), which `node:http` rejects outright and `curl` shows as an empty `000`. The new **`k200l`**
+driver (`printer-k200l.ts`) prints through the generic ESC/POS path and reads the page over a raw
+TCP socket, tolerant of both reply shapes; mapping is the Rongta one (unreachable → offline; page
+not understood → degraded, never ready; any fault → degraded naming it; else ready; USB →
+reachability floor). Bench-verified: cover open → amber "cover open, paper out, printer off-line".
+Tests replay the captured headerless reply. Full device notes: [[k200l-printer]].

wiki/concepts/printer-usb-transport.md

@@ -2,7 +2,7 @@
 type: concept
 tags: [parking, device, printer, transport, usb, escpos, provisioning]
 sources: []
-updated: 2026-08-30
+updated: 2026-09-09
 status: settled
 ---
 
@@ -134,6 +134,11 @@ preselecting the first present device; a saved-but-unplugged path stays selectab
 "saved — not present now"; zero devices found falls back to the free-text path + a check-the-cable
 hint. The transport option label no longer hardcodes lp0.
 
+> **Superseded 2026-09-09:** the XP-K200L DOES serve a status page — the same table as the Rongta,
+> at **`/prt_status.htm`**, without HTTP headers. It now has its own **`k200l`** driver (raw-socket
+> fetch; LAN = live cover/paper status, USB = reachability floor). See [[k200l-printer]]. The note
+> below is kept for the record.
+>
 > Driver-choice note for this clone: the ICS XP-K200L does NOT serve the Rongta `/prn_stat.htm`
 > status page (checked on hardware at 10.0.10.11 — print socket 9100 open, status page absent),
 > so on NETWORK the honest driver is **cashino** (reachability-only monitoring); under `rongta`
@@ -189,6 +194,44 @@ itself is redone.
 > = `usblp_open`'s bidirectional read submit failed (printer endpoint state). The theory below
 > is kept for the record.
 
+> **Lab reproduction FAILED to reproduce (2026-09-09, later the same day).** The same printer
+> unit on the `park-lab` box (a real Linux host, the booth's exact image `stage-2d9bb15`, the
+> prod compose with the `/dev/usb` bind-mount, the dev DB snapshot with the USB printer added as
+> `booth-receipt`, cards printed via the subscription "Reprint card" path): paper out → open
+> cover → load roll → close cover → reprint — **no error, status never stuck offline.** So the
+> printer, the app's USB transport and the compose wiring are cleared in isolation. What is left
+> is park-buzi's own environment (kernel/USB stack, the physical USB port/hub/cable/power at the
+> booth) and/or that container's *history* (weeks of uptime before the first failure — a leaked
+> handle needs a prior timeout to exist; a fresh container has none).
+>
+> **Status: park-buzi closed (staff shortage), everything shut down — evidence pending.** The
+> evidence is on the booth's DISK and survives shutdown/reboot: Docker keeps the container log
+> under `/var/lib/docker/containers/<id>/`, the kernel journal is persistent. **The day the box
+> powers on again (or lands on the bench), pull these FIRST, before deploying anything:**
+>
+> ```bash
+> # 1. the app's own record: the exact error text at every offline/ready transition
+> docker logs park-buzi-server-1 2>&1 | grep -E "device-monitor:.*printer.*-> (offline|ready)"
+> # 2. what the HOST kernel saw around those times (usblp errors, resets, disconnects)
+> sudo journalctl -k --since "-30 days" | grep -i -E "usblp|usb 1-|usb 2-|disconnect|reset"
+> # 3. the physical path: hub or direct port? (and note which PSU feeds the printer)
+> lsusb -t
+> ```
+>
+> Reading (1): `EBUSY` = a handle stuck inside the server process (usblp allows ONE opener;
+> fits "container restart fixes it") → look at the `withTimeout` leak below; `usb open timeout`
+> = `open()` blocks in the kernel; `EIO` = `usblp_open`'s bidirectional read submit failed
+> (printer/link state). Reading (2): any `USB disconnect` / `reset` / `usblp1: removed` at the
+> transition times means the LINK dropped at the booth (cable/port/hub/power) even though the
+> unit never dropped on the bench.
+>
+> **Follow-ups that need no booth (proposed, not built):** (a) `withTimeout` in
+> `printer-escpos.ts` abandons the FileHandle when an open/write times out — close it when the
+> underlying promise eventually settles, so a timeout can never leave the node held; (b) make
+> the monitor self-document the next occurrence: after N consecutive offline polls on a USB
+> printer, log the errno, `ls -la /dev/usb`, and who holds the node, so the next failure anywhere
+> in the fleet carries its own diagnosis without a person at the booth.
+
 **Not confirmed on hardware — and now contradicted by the bench (above).** The original plan to
 confirm at the next occurrence, BEFORE restarting anything:
 ```bash
@@ -212,7 +255,8 @@ whether the Bus/Device number changes.
    passthrough + a udev rule pinning a stable symlink name — reintroduces the renumbering fragility
    the directory bind-mount was chosen to avoid, so only worth doing alongside (1)/(2), not instead.
 
-**Printer identity — IDENTIFIED 2026-09-09.** The failing unit is on the dev bench: USB
+**Printer identity — IDENTIFIED 2026-09-09.** The failing unit is on the dev bench: a **K200L**
+(Xprinter/ICS XP-K200L family — see [[k200l-printer]] for the LAN setup and its status page): USB
 `1fc9:2016`, product string **"Printer POS-80"** (0x1fc9 = NXP, the printer's USB controller chip;
 "POS-80" is the generic 80 mm ESC/POS designation — no brand in the descriptor, which is why the app
 shows "Generic"). Seen via `usbipd list` on the Windows host (busid 8-1). **Dev-bench caveat:** the

wiki/concepts/site-device-installation.md

@@ -0,0 +1,209 @@
+---
+type: reference
+tags: [parking, runbook, installation, devices, network, field]
+sources: []
+updated: 2026-09-09
+---
+
+# Site device installation — know it BEFORE you are standing in the booth
+
+A field runbook: for every device we deploy, its **factory address and credentials**, the **tool**
+you need, **what the app configures by itself** at assign time versus **what must be done by hand on
+the device**, and the **traps already paid for** on park-buzi and the lab. The [[appliance-provisioning]]
+runbook covers the booth PC (OS, disk, Docker, Periphery); this page covers everything plugged into
+it. Written 2026-09-09 after an evening lost to a printer whose factory address nobody had written
+down ([[k200l-printer]]).
+
+Rule of thumb that explains most of this page: **every field device ships on its own private
+subnet with DHCP off, and none of them announce themselves.** You bring a laptop that can take a
+second static address, you put it on the device's factory subnet, you move the device to the site
+plan, and only then does anything else see it.
+
+## Before leaving the office
+
+**Bring**
+
+- A laptop with an Ethernet port and the right to add a **second static IPv4 address** to it
+  (Windows: adapter → IPv4 → Advanced → add). Under WSL, remember the source-address bug
+  ([[wsl-dev-networking]]): after adding a temporary address, `ping` may work while HTTP times out.
+- The Dingtian reader tool **`QRCode_v1_6_5.exe`** (Windows) — the only way to set a DT-008's IP,
+  server target, prefixes and symbologies. A browser is enough for everything else.
+- Patch cables, a USB A–B cable (printers), the site's **address plan** (below) filled in, the
+  app **admin** password, and a fresh Komodo **onboarding key** if the booth PC is new
+  ([[appliance-provisioning]] §7a).
+- The **serials** if already known: DT-008 `cjihao` (on the reader's label / in the tool), camera
+  MAC/serial, printer model (label on the bottom — the K200L's own web UI calls it "POS-80").
+
+**Address plan** — the device VLAN ([[network-isolation]]) is `10.0.10.0/24` on both sites so far,
+**every device static, DHCP off everywhere**. The convention from park-buzi / park-lab:
+
+| Address | Device | Factory address it came from |
+| --- | --- | --- |
+| 10.0.10.1 | VLAN gateway (switch/router) | — |
+| 10.0.10.5 | [[dingtian-relay]] board (barriers + inputs) | `192.168.1.100` |
+| 10.0.10.7 / .8 | [[dingtian-dt008-reader]] entry / exit (**unique IP each**) | `192.168.1.99` |
+| 10.0.10.9 | entry-dispenser printer (park-buzi: Cashino KP-300H) | *not recorded — fill in* |
+| 10.0.10.10 | booth-receipt printer (park-buzi: [[rongta-printer]]) | *not recorded — fill in* |
+| 10.0.10.11 / .7 (lab) | [[k200l-printer]] | `192.168.123.100` |
+| 10.0.10.12 / .13 | [[lpr-camera]] entry / exit (Hikvision DS-2CD1047G3H-LIU) | `192.168.1.64` (Hikvision default; needs activation) |
+| 10.0.10.203 | the booth PC on the device VLAN (**the `backendIp` every device pushes to**) | — |
+
+Fill the real numbers into the site record before you drive; the wizard asks for the booth's push
+address once and writes it into the Dingtian and the cameras.
+
+## 1. Dingtian relay board (DT-R004 family) — barriers, button, radar
+
+**Factory:** IP `192.168.1.100`, web UI on port 80, login `admin` / `admin`, UDP `60000` (binary) /
+`60001` (string), multicast discovery `224.0.2.11:60000`. See [[dingtian-relay]].
+
+**By hand, on the device (browser at its factory address):** set the site IP / mask / gateway in
+the Network page and reboot. That is the only thing you *must* do by hand. Optional but recommended:
+in the web UI **disable the UDP2 "string" protocol** (a password-less relay-fire path); the app's
+harden step tries to disable it and **warns if the device refused** — then do it here.
+
+**Wiring:** button on **I1** (NO contact to GND, idles HIGH, pulls LOW on press); radar dry contact
+on **I2**; barrier operator's open input on **relay 1** (entry) and **relay 2** (exit); a spare relay
+for the entry button lamp ([[button-light-indicator]]). One board can carry both barriers; two
+distant barriers = two boards ([[entry-exit-points]]).
+
+**What the wizard does on assign** ([[first-run-setup]], [[device-input-flow]]): finds the board by
+multicast ("Scan for controllers" — laptop/booth must share the L2 segment), checks and clears
+`input_link_relay` (factory default auto-fires a relay from its input — the app must decide, not the
+board), sets a random **relay password** (UDP binary), disables every other control channel, rotates
+the web login, and writes the **input push** URL + per-device Digest credentials so button/radar
+edges reach the booth PC. You enter the relay map (which relay is entry/exit/both) and the inputs
+(button → its relay; radar → `presence`, `activeLow` if it idles opposite the button —
+[[hikvision-radar]]).
+
+**Traps**
+
+- The HTTP CGI API is **unauthenticated** on this firmware; `admin/admin` gates only the web page.
+  Never enable `session_en` — it bricks the config API and only a **factory reset** recovers. The
+  VLAN is the boundary, not the login ([[dingtian-relay]] §Hardening).
+- A relay password mismatch shows as **"offline despite ping"**: the status query is answered only
+  with the right password. Re-assign / re-enter the relay password in the device form.
+- "Relay test" in Setup pulses real hardware and signs a ledger event — use it to prove wiring,
+  once per relay.
+
+## 2. Dingtian DT-008 QR + RFID readers
+
+**Factory:** IP `192.168.1.99`; no web UI — everything is set with **`QRCode_v1_6_5.exe`** over the
+network. See [[dingtian-dt008-reader]].
+
+**By hand, in the tool, per reader:**
+
+1. **Unique device IP** (`.7` entry, `.8` exit). Two readers on one IP was the 2026-06-18
+   "wrong barrier" incident — scans land on the wrong device row.
+2. **Server IP** = the booth PC (`10.0.10.203`), **server port** = the booth's HTTP port (80 behind
+   the prod proxy); "server language" can stay whatever it is (php/jsp/asp/aspx/cgi are all
+   served — the reader GETs `/qa/mcardsea.<ext>`).
+3. **Output prefixes:** `QRCode Output Prefix` = `Q:`, `Card Output Prefix` = `K:` (channel
+   tagging — a printed clone of a card cannot pass as the card).
+4. **Card Input format = `6H`** (defines the UID shape enrolled; changing it later orphans every
+   card).
+5. **Symbologies: QR + Code128 only**, minimum decode length ≥ 10, checksums on — otherwise low
+   sun through the striped arm produces phantom 6-digit reads (park-buzi, July).
+6. Note the **serial (`cjihao`)** — the wizard binds the reader by serial, not by IP.
+
+**In the wizard:** add the reader with its serial, bind it to the controller relay it sits at
+(direction is inherited from the relay). **Verify:** scan a card — the server log shows
+`READ serial=… → device=… verdict=… dir=…`; the reader beeps **twice** on accept, once on refuse,
+and only after the server's reply (no reply = no beep, the scan still happened).
+
+**Trap:** a factory reset or a swapped unit silently loses items 3–5. Re-apply all of them.
+
+## 3. Hikvision camera (DS-2CD1047G3H-LIU, AcuSense) — ANPR + snapshots
+
+**Factory:** `192.168.1.64`, **inactive** until a password is set on first boot (browser at that
+address or the SADP tool); after activation the login is `admin` / the password you chose. Site
+convention so far: `admin` / `admin123` on the first units (change per site and record it). See
+[[lpr-camera]].
+
+**By hand, on the camera:**
+
+1. Activate, set the site IP, disable DHCP. Time: NTP off-site is unavailable — the app re-syncs
+   the camera clock from the booth at every offline→ready edge ([[clock-integrity]]).
+2. **Streams:** the snapshot the app pulls MUST come from the **sub stream** (`102`) — the main
+   stream's ISAPI snapshot returns **503 instantly, always, on this model**. Set the sub stream to
+   the highest resolution the camera allows.
+3. **Event push:** Event → Motion Detection with the AcuSense **Detection Target = Vehicle** filter
+   ON, "Notify Surveillance Center" on, then Alarm Settings → **Alarm Server** →
+   `http://10.0.10.203/api/devices/hikvision/<deviceId>/event`. The `deviceId` exists only after
+   the wizard assign, so: **assign first, then come back to the camera**. Digest user/password if
+   the firmware allows it (the wizard shows them).
+4. "Enable Hikvision-CGI" is a different legacy surface — **not** needed for ISAPI.
+5. **Close the web UI / live view when done.** The camera has few connection slots; a browser left
+   open makes every snapshot pull 503 "Device Busy" ([[lpr-camera]] §503).
+
+**In the wizard:** driver `hikvision`, host, `admin` password, channel 1, **stream = Sub**, ANPR on,
+bind to the relay at that barrier, `alarmPushEnabled` on.
+
+**Verify, do not assume:** drive a car through and look at `GET /api/events` (or the log) for an
+alarm with `targetType=vehicle`. A camera configured for push that has sent **zero** alarms is
+broken on its side: pull its *Diagnose Information*; `Main Db is broken` means a corrupt config
+database → **factory reset**, then redo 1–3 (the Vehicle target filter defaults OFF after a reset).
+Point the Alarm Server at a dumb HTTP sink on the laptop if you need to see the verbatim body
+([[lpr-camera]] §"auto-enter but not auto-exit").
+
+## 4. Radar (vehicle presence at the entry barrier)
+
+A dry-contact sensor into a Dingtian input, nothing on the network. Check with the board's input
+status (`00` query → `relays:inputs`) whether it **idles HIGH or LOW**; if it idles opposite the
+button, set `activeLow` on that input in the wizard, or the gate inverts (tickets only when the
+lane is empty). It is advisory: it gates the button, it never opens anything ([[hikvision-radar]],
+[[entry-double-press]]).
+
+## 5. Printers — three models, one byte stream, different status
+
+All print the same ESC/POS bytes over **raw TCP 9100** or **USB (`/dev/usb/lpN`)**; what differs
+is whether the app can see paper/cover state ([[printer-status-monitoring]],
+[[printer-usb-transport]]). Roles: **entry-dispenser** outside at the lane, **booth-receipt**
+inside (receipts, subscription cards, Z-reports, and the backup for entry tickets), **wash-desk**
+if the site has a Car Wash ([[printer-roles-failover]]). Higher `failoverRank` = tried first.
+
+| Model | Factory network | Config UI | App driver | Live status |
+| --- | --- | --- | --- | --- |
+| [[k200l-printer]] (Xprinter/ICS K200L, "POS-80" board; **the park-buzi unit**) | `192.168.123.100/24`, DHCP off | browser, port 80, no login: Configuration → fixed IP → Save → Restart | **`k200l`** | over LAN: cover / paper / cutter / off-line from `/prt_status.htm`; over USB: reachability only |
+| [[rongta-printer]] (RP-series) | *not recorded — fill in* | status page `/prn_stat.htm` on port 80 | `rongta` | over LAN: full; USB: reachability |
+| Cashino KP-300H | *not recorded — fill in* | *not recorded* | `escpos` (generic) | reachability only, by design — no trustworthy status source |
+
+**Prefer LAN over USB** wherever a cable can reach: the booth sees a real amber "cover open, paper
+out" while a roll is changed, and the `usblp` path (udev rule, node renumbering, the park-buzi
+"offline after reload" mystery) drops out of the picture. USB needs the appliance's `usblp` +
+udev rule ([[printer-usb-transport]] §Provisioning) and the printer shows up as `/dev/usb/lpN`,
+numbered by plug order.
+
+**Verify:** the wizard's "Test" only *probes* (opens the port / the device node) — it prints
+nothing. Print something real: a subscription with a QR credential auto-prints its card and has a
+**Reprint card** button; a payment prints a receipt; a wash till prints slips. Check the Cashino's
+barcode with a real ticket (the KP-300H garbled overflowing barcodes until the geometry fix).
+
+## 6. Order of work on site
+
+1. Address plan on paper; VLAN ports patched; booth PC up with its device-VLAN address.
+2. Dingtian: factory address → site address (browser) → wire button, radar, barriers.
+3. Wizard: **controllers first** (the relay map + inputs); "Relay test" each barrier.
+4. Readers: tool (IP, server, prefixes, format, symbologies) → wizard (serial, bind) → scan test.
+5. Cameras: activate → IP → sub stream → wizard assign → Alarm Server + Vehicle target → drive-through
+   test → close the browser.
+6. Printers: site address → wizard (role, rank) → print a card.
+7. Walk-through: button + radar → ticket; QR entry then exit; RFID; a subscriber's plate at the
+   camera; pay at the booth → receipt → exit; paper reload on each printer while watching the
+   footer.
+8. Record in the site record: every IP, serial, camera password, printer model, which relay is
+   which, photos of the labels. Remove the temporary laptop addresses. Log out of every device UI.
+
+## Gaps to fill next time you hold the hardware
+
+- Factory address and configuration tool of the **Cashino KP-300H** and the **Rongta RP** units
+  (both still unknown here).
+- The exact screens in `QRCode_v1_6_5.exe` for the reader's IP and server target (a screenshot).
+- Whether the camera activation was done with SADP or the browser at park-buzi, and the per-site
+  camera password location.
+- Where the **site record** lives (a page per site under `wiki/entities/`? — park-buzi and park-2
+  have none yet; the Komodo stack env is the closest thing).
+
+Related: [[appliance-provisioning]] · [[first-run-setup]] · [[device-registry]] ·
+[[network-isolation]] · [[entry-exit-points]] · [[dingtian-relay]] · [[dingtian-dt008-reader]] ·
+[[lpr-camera]] · [[hikvision-radar]] · [[k200l-printer]] · [[rongta-printer]] ·
+[[printer-usb-transport]] · [[wsl-dev-networking]]

wiki/concepts/vision-review-outbox.md

@@ -154,6 +154,26 @@ its own repo the day it needs its own cadence. Deploy the collector BEFORE a boo
 package kind it does not know (a 422 is abandoned, not retried). The export neutralises cells
 that start like a spreadsheet formula (category/service names are booth-supplied text).
 
+> **Incident 2026-09-16 — the collector's DB predated the `kind` column; nothing worked for 9
+> days and nothing said so.** The reviewer opened /review: *Training — trainer not reachable:
+> fetch failed*. On the host: collector `stage-2d9bb15` **unhealthy** (`/health` → 500 *no such
+> column: kind*), trainer healthy but every `/readiness` a Python traceback; the volume's
+> `collector.sqlite` (created 2026-09-07 by the previous build, **0 items**) had the original
+> column set. `CREATE TABLE IF NOT EXISTS` shapes only a NEW database — an existing volume keeps
+> its old columns, so every query naming `kind` failed: the collector's health, **every ingest**
+> (booths would have got 500s and kept retrying — the log shows none ever arrived, a separate
+> question), and the trainer's readiness. The trainer's stdlib server printed the traceback and
+> dropped the socket, which the collector could only render as "fetch failed".
+>
+> Fixes (same day): `CollectorDb` now **migrates on open** — `PRAGMA table_info` vs a list of the
+> columns added since the first deploy, `ALTER TABLE … ADD COLUMN` for each missing one (all
+> nullable or defaulted; **append to that list whenever a column joins the CREATE**); the trainer's
+> handlers are guarded — an unexpected exception is a **500 JSON** naming the error, never a
+> dropped connection; the collector's status proxy surfaces the trainer's error text. Rule going
+> forward: the collector owns the schema; the trainer only reads; a deploy that changes the table
+> must be accompanied by a migration entry, and the Training section is the first place a
+> schema/DB mismatch shows — read its error text before suspecting the network.
+
 **Status (2026-09-07).** Live: the collector runs on `art-docker-station` and park-2 is wired to
 it (`stage-dbbb051` on both stacks, every entry sampled). The review screen at
 `http://docker-station.nb.infra:8090/review` is filling; no labels reviewed yet.

wiki/concepts/wsl-dev-networking.md

@@ -2,7 +2,7 @@
 type: reference
 tags: [parking, dev-environment, networking, wsl, troubleshooting]
 sources: []
-updated: 2026-06-15
+updated: 2026-09-09
 ---
 
 # WSL2 Dev Networking (for device testing)
@@ -110,6 +110,15 @@ trap:
 Verified on hardware (2026-06-15): after the hook, `10.0.10.121` pings and the real [[lpr-camera]]
 Hikvision driver pulls a snapshot with **no** source-forcing (`localAddress` becomes optional).
 
+> **It bit again, 2026-09-09 — and the fix was pinned to the wrong NIC.** Configuring the
+> [[k200l-printer]] meant adding `192.168.123.101` beside `10.0.10.203` on the mirrored LAN NIC;
+> WSL then sourced 10.0.10.x traffic from the 192.168.123 address: `ping` fine, every HTTP
+> connect timing out, `ip route get 10.0.10.7` showing `src 192.168.123.101`. `parking-net.service`
+> was active but pins **`eth1`**, and the mirrored LAN NIC is **`eth0`** on this box now — so the
+> boot fixer was a no-op. Run `deploy/wsl-fix-route-source.sh eth0` (and fix the unit's argument),
+> or `curl --interface 10.0.10.203 …` as a one-off. Interface names are not stable across WSL
+> reboots/NIC changes; the script accepts the NIC as an argument for exactly this reason.
+
 ## On the real appliance: multi-subnet is a deployment config, not a WSL hack
 
 Production is a **dedicated hardened Linux appliance** ([[disk-os-hardening]]), so the WSL story

wiki/decisions/appliance-provisioning.md

@@ -14,6 +14,8 @@ parking appliance. Written from the **first real provisioning, 2026-06-23** (har
 actual hardware, including the firmware-specific workaround. Companion to [[disk-os-hardening]] (the
 *why*), [[tpm]] (TPM analysis), [[container-deployment]] (the images), and
 [[fleet-deployment-komodo]] (the deploy control plane this runbook's §7 uses).
+**The devices plugged into the booth** (relay board, readers, cameras, radar, printers — factory
+addresses, tools, hand steps, traps) have their own field runbook: [[site-device-installation]].
 
 > ⚠ This box is the [[threat-model|outsider-with-the-box]] defence. The load-bearing anti-fraud
 > control is still [[reconciliation]] over the [[append-only-event-chain|signed chain]] — disk
@@ -312,6 +314,12 @@ sudo loginctl enable-linger admin     # so the user service starts at boot witho
 **Verify:** `systemctl --user status periphery` → active; the server **`park-buzi`** appears and
 goes **OK/green** in Core → Servers. Then **delete the onboarding key**.
 
+> **After a reboot: `Unit periphery.service not loaded` (park-lab, 2026-09-09).** The unit
+> existed but had never been **enabled**, so nothing started it at boot and `reset-failed` /
+> `restart` had nothing to act on. Fix: `systemctl --user daemon-reload && systemctl --user enable
+> --now periphery`. Add `enable --now` to the install sequence above whenever the installer's own
+> enable did not stick (check with `systemctl --user is-enabled periphery` before leaving).
+
 **➜ Next step is §7b below — the Stack itself is not deployed yet.** A green Server in Core just
 means the agent connected; it runs nothing until you add the Registry/Git accounts and deploy.
 

wiki/decisions/bodytype-classifier-training.md

@@ -173,6 +173,13 @@ The CLI is still there for debugging, inside the running container:
 - **Reviewing is the bottleneck**: the Training section shows labels per class against the
   minimum and keeps Train disabled until two classes clear it.
 
+**"Training — trainer not reachable: fetch failed" (2026-09-16).** Not a network problem: the
+trainer answered `/health` but its `/readiness` crashed on the collector's DB (a volume from before
+the `kind` column) and the stdlib server dropped the socket without a reply. Since the fix the
+trainer answers **500 JSON with the error** and the collector shows that text; a genuine network
+failure still reads "fetch failed" / ECONNREFUSED. See [[vision-review-outbox]] §Incident 2026-09-16.
+
+
 ## Packaging rule (same as the vision service)
 
 Core deps are light (numpy, opencv-headless, onnxruntime): `inspect`, `evaluate`, the data and

wiki/decisions/fleet-deployment-komodo.md

@@ -198,7 +198,7 @@ Second `[[stack]]` in `komodo/resources.toml`: **`park-lab`** (server = the lab
 
 | Stack | compose branch | image tag | secrets |
 | --- | --- | --- | --- |
-| park-lab | `dev` → **`stage` (2026-09-09)** | ~~moving `dev`~~ → **pinned to the booth's `stage-<sha>` under reproduction** (2026-09-09: the lab re-joined the fleet to reproduce the park-buzi printer cover-open bug, so it must run the booth's exact image; **no review outbox** — the bench is not a booth and must never feed the collector under a booth id) | `park_lab_*` |
+| park-lab | `dev` → **`stage` (2026-09-09)** | ~~moving `dev`~~ → **pinned to the booth's `stage-<sha>` under reproduction** (2026-09-09: the lab re-joined the fleet to reproduce the park-buzi printer cover-open bug, so it must run the booth's exact image; review outbox under its **own** id `booth-lab` since 2026-09-16 — never a booth's, so bench crops stay separable per booth on the collector) | `park_lab_*` |
 | park-buzi | `stage` | pinned `stage-<sha>` | `park_buzi_*` |
 
 The three knobs are independent per stack — the ResourceSync's own branch only governs where the

wiki/entities/k200l-printer.md

@@ -0,0 +1,107 @@
+---
+type: entity
+tags: [parking, hardware, printer, escpos, network, usb, status]
+sources: []
+updated: 2026-09-09
+---
+
+# K200L thermal printer (Xprinter / ICS "XP-K200L") — the park-buzi unit
+
+An 80 mm ESC/POS receipt printer, **USB + LAN**, sold under several names. Bottom label:
+*"THERMAL RECEIPT PRINTER — Model: K200L — Paper Width: 80mm — Print Speed: 200mm/s — Power
+Input: 24V 2.5A — Cash Drawer: 24V 1A — Interface: USB+LAN — Command Support: ESC/POS"*, serial
+`BLU2107080238`. Identified on the dev bench 2026-09-09; **it is the printer that "goes offline
+after a paper reload" at park-buzi** ([[printer-usb-transport]] §Field bug). The lab's older
+"ICS XP-K200L" (10.0.10.11, the 2026-07 USB truncation work) is the same family.
+
+Three names for one device, all seen on the bench:
+
+| Where | What it calls itself |
+| --- | --- |
+| bottom label | K200L |
+| USB descriptor (`lsusb`) | `1fc9:2016 NXP Semiconductors Printer-80` / "Printer POS-80" (0x1fc9 = the NXP controller chip; no brand) |
+| LAN board web UI | "J-Speed Ethernet Interface Module", "Ethernet WebConfig Version 1.02", copyright "POS" |
+
+The app driver is **`k200l`** ("K200L 80mm thermal printer (Xprinter / ICS, USB+LAN)",
+`packages/devices/src/drivers/printer-k200l.ts`). It prints through the shared generic ESC/POS
+path (identical bytes, TCP 9100 or `usblp`) and **adds live status from the LAN board** — see
+below. Before 2026-09-09 this unit ran on the generic `escpos` driver (reachability only), which is
+why the app could never show its cover/paper state.
+
+## Network setup (the evening that was never written down)
+
+- **Factory address `192.168.123.100/24`, DHCP OFF.** Nothing announces it; the printer just sits
+  there on a subnet nobody uses. To reach it, give the workstation a second address in
+  `192.168.123.0/24` (Windows: adapter → IPv4 → Advanced → add `192.168.123.101`), then open
+  `http://192.168.123.100/`.
+- The web configurator (port 80, **no authentication**) is a three-frame page: *Information*
+  (`ip_info.htm`: MAC, IP, mask, gateway, DHCP on/off, DHCP timeout), *Configuration*
+  (`ip_config.htm`: DHCP client on/off + timeout, fixed IP / mask / gateway as four octet fields,
+  **Save**, Restore Default, cancel), *Printer Status* (`prt_status.htm`), *Printer Test*
+  (`prt_test.htm`), and a **Restart** button in the menu.
+- **Set a fixed address on the device VLAN** (park-lab: `10.0.10.7/24`, gateway `10.0.10.1`) →
+  Save → Restart; then remove the temporary `192.168.123.x` address from the workstation. Keep
+  DHCP off — the app addresses printers by IP ([[rongta-printer]] §Deployment).
+- The self-test page (`prt_test.htm` / the "Print Test Page" button on the status page) prints
+  the current network settings, so a unit with a forgotten address can be read back that way.
+- The board's HTTP server is **tiny**: the frameset reloads its frames every 1–3 s and the status
+  page every 5 s, and it holds very few connections. **Close the browser tab while the app is
+  polling**, or connections intermittently time out (seen on the bench: `ping` fine, port open,
+  every second HTTP connect hanging while the page was open in a browser).
+
+> **WSL gotcha while doing this (2026-09-09):** the dev box then carried BOTH `192.168.123.101`
+> and `10.0.10.203` on `eth0`, and WSL sourced 10.0.10.x traffic from the 192.168.123 address —
+> the exact [[wsl-dev-networking]] source-address bug, except `parking-net.service` pins `eth1`
+> and the mirrored LAN NIC is `eth0` now. Symptom: `ping` works, `curl` times out. Run the fix for
+> `eth0`, or drop the temporary address once the printer is moved.
+
+## Live status — the `/prt_status.htm` page
+
+The LAN board serves a five-row table the printer has already decoded from its own sensors:
+
+```
+Cover Is Open      Yes/No
+Cutter Error       Yes/No
+Paper End          Yes/No
+Paper Near End     Yes/No
+Printer Off-Line   Yes/No
+```
+
+A fault is written as **`<FONT color=#ff0000>Yes</FONT>`** while a clear row is a bare, space-padded
+`No` — the first parser only accepted tag-free cells, so with the cover open the booth showed
+*"unexpected status page (missing coverOpen, paperEnd, offline)"*: exactly the Yes cells. Fixed
+the same day (cell text is read with inner tags stripped); the verbatim markup is pinned in the
+driver's tests.
+
+**Same rows, same `<TD>label</TD><TD>Yes|No</TD>` shape as the Rongta board's `/prn_stat.htm`**
+([[printer-status-monitoring]]) — only the path differs, which is why nobody found it in July
+(the Rongta driver looked for `/prn_stat.htm`, got nothing, and the unit was filed as "serves no
+status page → generic driver"). Verified on the bench: cover open → `Cover Is Open Yes`, `Paper End
+Yes`, `Printer Off-Line Yes` within a refresh; cover closed → all `No`.
+
+**Quirk that needs its own fetch code:** the board's HTTP reply has **no status line and no
+headers** — the body starts at byte 0 (HTTP/0.9 style). Browsers render it; `curl` reports
+`000` with an empty body; Node's `http` client rejects it with *"Parse Error: Expected HTTP/, RTSP/
+or ICE/"*. So the `k200l` driver reads the page over a **raw TCP socket** (`GET … HTTP/1.0`, read
+until the board closes) and accepts both the headerless reply and a proper one. This is the second
+reason the K200L has its own driver rather than a path option on the Rongta one.
+
+Status mapping (mirrors the Rongta driver, [[printer-status-monitoring]]): board unreachable /
+timeout → **offline**; page reachable but not the table (non-200, the index page) → **degraded
+"unexpected status page"**, never ready off a page we didn't read; any Yes → **degraded** naming
+the faults ("cover open, paper out, printer off-line"); all No → **ready**. Over **USB** there is
+no page: reachability floor only (ready/offline), same as a USB Rongta.
+
+## What this means for the park-buzi bug
+
+At park-buzi this unit ran **over USB** on the generic driver, i.e. monitored by "does
+`/dev/usb/lpN` open". A cover-open / paper-out condition **never showed in the app at all** — the
+badge stayed green. So the operators' "printer goes offline after reloading paper" was not the
+cover state being reported; it was a genuine probe failure whose errno is still unread (site shut
+down — [[printer-usb-transport]] §Field bug has the commands to pull first). Running the unit on
+**LAN with the `k200l` driver** would give the booth a real amber "cover open / paper out" while
+the roll is changed, and removes the `usblp` path from the equation altogether — a strong reason to
+cable it to the device VLAN when the site reopens.
+
+Related: [[rongta-printer]] · [[printer-status-monitoring]] · [[printer-usb-transport]] ·
+[[printer-roles-failover]] · [[network-isolation]] · [[wsl-dev-networking]] · [[site-device-installation]]

wiki/entities/rongta-printer.md

@@ -2,7 +2,7 @@
 type: entity
 tags: [parking, hardware, printer, device]
 sources: []
-updated: 2026-06-19
+updated: 2026-09-09
 ---
 
 # Rongta 80mm thermal printer
@@ -55,6 +55,10 @@ many ESC/POS-compatible OEM clones that share its firmware). Driver `rongta` in
   - **booth-receipt** — `10.0.10.10`, inside the booth; receipts, AND the backup that prints
     the entry ticket if the outside dispenser is offline. This unit is a **Rongta** (`rongta`
     driver, full status-page monitoring).
+  - **Not a Rongta, its own driver since 2026-09-09:** the **K200L** (Xprinter/ICS XP-K200L family;
+    LAN board calls itself "POS-80") — the park-buzi unit and the lab's 10.0.10.11 unit. Same
+    five-row status table under **`/prt_status.htm`** (not `/prn_stat.htm`), served without HTTP
+    headers, so it has the `k200l` driver with a raw-socket fetch. See [[k200l-printer]].
 
 ## Ticket rendering
 

wiki/index.md

@@ -46,6 +46,7 @@ Counts: 4 sources · 19 entities · 47 concepts · 8 decision records.
 - [[dingtian-relay]] — ✅ CHOSEN access controller; decoupled inputs solve the button blocker (driver verified on hardware); spare relays drive aux outputs (`setAux`).
 - [[hikvision-radar]] — vehicle-presence radar on a Dingtian input; the entry presence gate (per-input active-level caveat).
 - [[rongta-printer]] — ✅ CHOSEN 80mm thermal printer; ESC/POS over raw TCP 9100 (or local USB, see [[printer-usb-transport]]); driver written, one unit reachable at 10.0.10.6.
+- [[k200l-printer]] — the park-buzi printer identified (2026-09-09): Xprinter/ICS K200L, USB id 1fc9:2016 "POS-80", J-Speed LAN board at 192.168.123.100 (DHCP off, web config on :80); status page `/prt_status.htm` (Rongta's rows, headerless HTTP) → own `k200l` driver with raw-socket fetch; over USB reachability only, so cover-open never showed at park-buzi.
 - [[bom]] — reference bill of materials (barrier, loops, controller, readers, payment, host, network).
 
 ## Concepts — foundational forces
@@ -65,6 +66,7 @@ Counts: 4 sources · 19 entities · 47 concepts · 8 decision records.
 - [[device-adapter-pattern]] — business logic talks to interfaces; swap hardware → new adapter.
 - [[device-registry]] — catalog of selectable drivers per category (admin-configurable).
 - [[first-run-setup]] — admin adds controllers + binds readers/cameras to relays from the catalog at install.
+- [[site-device-installation]] — FIELD RUNBOOK (2026-09-09): per device — factory address + credentials, the tool needed, what the wizard configures itself vs what is done by hand on the device, known traps; address plan, order of work on site, gaps to fill. Dingtian relay, DT-008 readers, Hikvision camera, radar, K200L / Rongta / Cashino printers.
 - [[device-input-flow]] — button → device push → backend decides → relay; backend is source of truth.
 - [[device-discovery]] — optional driver capability to scan the LAN (no current driver uses it; UHPPOTE was the example).
 - [[barrier-not-a-door]] — never timed-close a barrier; safety lives in barrier firmware.

wiki/log.md

@@ -3249,3 +3249,76 @@ from park-2 then corrected (the copy carried park-2's review outbox + booth-2 to
 bench must never feed the collector under a booth id); pinned to the booth's stage-<sha>. Pages:
 [[printer-usb-transport]] (identity, bench result, WSL caveat), [[fleet-deployment-komodo]]
 (park-lab row).
+
+## [2026-09-09] ingest | Printer cover-open bug — lab did NOT reproduce; park-buzi closed, evidence pending
+Same printer unit on `park-lab` (real Linux host, booth image stage-2d9bb15, prod compose, dev DB
+snapshot with the USB printer as booth-receipt, cards via subscription reprint): paper out → cover
+→ reload → reprint — no error. Printer, USB transport and compose wiring cleared in isolation;
+what remains is park-buzi's environment (kernel/USB path/power) or the container's history.
+park-buzi is shut down (staff shortage). Recorded on [[printer-usb-transport]]: the three
+commands to run FIRST when the box next powers on (container log transitions, kernel journal,
+`lsusb -t`), how to read each answer, and two proposed no-booth follow-ups (close the
+`withTimeout` handle leak; make the monitor self-document consecutive USB offline polls).
+Dev-DB snapshot procedure for a lab (online backup → reset-db --financial --diagnostics → clear
+backup fields → VACUUM → copy into the volume with chown) used today; not yet on a wiki page.
+
+## [2026-09-09] build | K200L printer identified + `k200l` driver with live status; network setup recorded
+The bottom label says **Model K200L** (Xprinter/ICS XP-K200L family, USB+LAN, ESC/POS); the LAN
+board ("J-Speed Ethernet WebConfig 1.02") calls it "POS-80", as does the USB descriptor. User
+configured it from factory 192.168.123.100 (DHCP off, web UI on :80, no auth) to 10.0.10.7 on the
+lab; added as booth printer on `park-lab` on the generic driver → badge stayed green with the cover
+open, because the generic driver is reachability-only by design. Found the board's status page:
+**`/prt_status.htm`**, the Rongta's five rows exactly, but the reply has NO status line/headers
+(node:http: "Parse Error: Expected HTTP/"; curl: 000/empty) — so a Rongta-path option would not
+have worked. Per the user ("this is not rongta", "create a new printer"): the Rongta driver is
+untouched; new **`printer-k200l.ts`** (`k200l`) delegates printing to the generic ESC/POS device
+and reads the page over a raw socket, tolerant of both reply shapes; mapping mirrors the Rongta
+(unreachable → offline, page not understood → degraded never ready, faults → degraded named, USB →
+floor). Tests replay the captured headerless page (10 new, devices suite 76 green); live probe
+against 10.0.10.7 → ready; bench with cover open showed "cover open, paper out, printer off-line".
+Consequence for park-buzi: over USB the app never saw cover/paper state at all — the reported
+"offline" is a probe failure (errno still to be pulled). Pages: new [[k200l-printer]] (names,
+network setup runbook, board quirks, status page, park-buzi implication), [[rongta-printer]],
+[[printer-status-monitoring]], [[printer-usb-transport]], [[wsl-dev-networking]] (parking-net
+pinned to eth1 while the LAN NIC is eth0 — the source-address bug bit again), index.
+
+## [2026-09-09] query | Field runbook: installing the devices at a site (what to know before the booth)
+User: "we need a section about installing these devices in the park sites … I didn't know this
+printer has initial IP 192.168.123.100 and a web interface … also dingtian relays and readers,
+cashino printers — know beforehand, not struggle on site." New reference page
+[[site-device-installation]], synthesised from the entity pages + memory notes: the bring list,
+the site address plan (10.0.10.x convention, every device static), then per device — Dingtian
+relay (factory 192.168.1.100, admin/admin, what harden() does vs the by-hand IP + UDP2 disable,
+wiring I1/I2, unauthenticated CGI, session_en brick), DT-008 readers (192.168.1.99, the
+QRCode_v1_6_5.exe tool: unique IP, server target, Q:/K: prefixes, 6H card format, QR+Code128
+only, serial binding, re-apply after a reset), Hikvision G3H (192.168.1.64 + activation, SUB
+stream mandatory, Alarm Server after assign, Vehicle target filter, close the web UI, corrupt-DB
+factory reset), radar (idle level → activeLow), printers (K200L / Rongta / Cashino table; LAN over
+USB; "Test" probes, print a card to verify), the on-site order of work, and the gaps still
+unrecorded (Cashino/Rongta factory addresses, the reader tool screens, camera activation, where
+the site record lives). Linked from [[appliance-provisioning]] and [[k200l-printer]]; indexed.
+
+## [2026-09-09] fix | K200L status parser — a fault's "Yes" is wrapped in <FONT color=#ff0000>
+First live run on park-lab (driver `k200l`, LAN, cover open) showed *degraded — unexpected status
+page (missing coverOpen, paperEnd, offline)*: precisely the three Yes cells. Captured the raw page
+with the cover open: the board writes `<FONT color=#ff0000>Yes</FONT>` for a fault and a bare
+padded `No` otherwise; the parser accepted only tag-free cells. Fix: cell text is read with inner
+tags stripped (row-anchored regex); tests pin the verbatim markup plus other shapes (devices 79).
+Live after the fix: degraded "cover open, paper out, printer off-line"; closed → ready. User:
+"we are good using the network with this printer." Also: park-lab Periphery was "not loaded"
+after a reboot — the unit had never been enabled; `systemctl --user enable --now periphery`
+recorded as a §7a gotcha on [[appliance-provisioning]]. Pages: [[k200l-printer]].
+
+## [2026-09-16] fix | Collector DB schema migration; trainer handlers answer 500 JSON; the "trainer not reachable" incident
+User: "Training — trainer not reachable: fetch failed". Read-only look at art-docker-station over
+SSH: collector stage-2d9bb15 unhealthy (`/health` 500 "no such column: kind"), trainer healthy
+but `/readiness` tracebacks on the same column; the volume's collector.sqlite (2026-09-07, 0
+items, original columns) predates `kind` — CREATE TABLE IF NOT EXISTS never migrates an existing
+table. No `/ingest` request in the container's 9-day log at all (park-2 either not sending or not
+reaching the host — to check on the booth). Built: `CollectorDb.#migrate()` (PRAGMA table_info vs
+the list of columns added since the first deploy → ALTER TABLE ADD COLUMN; test replays the old
+schema: health, ingest, stats, legacy row reads back with defaults); trainer `Handler._guarded`
+(any exception → 500 JSON naming it; test: readiness on an old-schema DB → 500 "no such column:
+kind", /health still 200); the collector's training proxy includes the trainer's error text. Pages:
+[[vision-review-outbox]] (incident + rule), [[bodytype-classifier-training]] (what the message
+means). Deploy: nothing manual — the new collector migrates on start.