docs(wiki): DT-008 phantom-scan diagnosis + backfill bypass/relay-test concept pages

Two independent wiki updates bundled (all docs):

1. dingtian-dt008-reader.md: phantom optical decodes on the park-buzi EXIT
   reader (empty pre-opening site, low-sun afternoons). Chain of evidence:
   READ log lines carry the reader's own serial (H05MA5B0) → physical device,
   not a network source; snapshot shows nobody present; code shapes are the
   giveaway (6-digit numerics = checksum-less Interleaved 2-of-5, lone "C" =
   Code39/Codabar artifact) → 1D engine decoding sun-made stripe patterns
   (striped arm, fence shadows, glare). No fraud exposure (11-digit Luhn ids
   can't match); noise only. Fix on the entity page: vendor-tool symbology cut
   to QR+Code128 + min decode length, BOTH readers; config lives ON the device
   → re-apply after any factory reset/swap. Deliberately NOT filtering
   impossible codes server-side — probe recording is the anomaly path's job.

2. Backfilled two shipped-but-undocumented features (six code files already
   linked the first page as if it existed):
   - concepts/entry-presence-bypass.md — admin drops a FAULTY presence signal
     (granular radar/camera by decision, not a master switch); every flip is a
     signed config_change; persists till off; tickets stamped presenceBypassed;
     radar-bypass cooldown tradeoff; "the admin is not the adversary, but
     trusted never means invisible".
   - concepts/setup-relay-test.md — admin-only commissioning pulse, signed
     barrier_open_command BEFORE the fire so a test open never reads as the
     out-of-band-open fraud signal; saved controllers/declared relays only;
     radarAlert lamps excluded; pulseOpen only.
   Cross-linked from operator-issued-entry.md, cataloged in index.md, logged.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -2223,3 +2223,27 @@ along the way: camera-vetoed re-arm (defer re-arm until the lane flips free) —
 silence-timeout "free" never fires inside a queue, so it would suppress every queued car after the
 first. Proper preventive fix noted open: a pass-through sensor (`passedInput`). 13 new tests
 (`entry-press-gate.test.ts`, `entry-duplicate-plate.test.ts`); suite 258 green.
+
+## [2026-07-04] update | Exit reader phantom scans traced to optical 1D decodes (sun patterns)
+
+Pre-opening park-buzi, empty site: the exit [[dingtian-dt008-reader]] pushed spontaneous 6-digit
+numeric scans (+ one lone "C") at low-sun afternoon hours; all refused fail-closed as
+exit.refused.noSession. Server READ logs confirmed the reader's own serial (H05MA5B0) → the
+physical device decoding, not a network source; a live snapshot confirmed nobody present.
+Diagnosis: default-enabled weak-checksum 1D symbologies (I2of5 6-digit signature; "C" =
+Code39/Codabar artifact) decoding sun-made stripe patterns (striped barrier arm, fence shadows,
+glare). No fraud exposure (11-digit Luhn ids can't match a 6-digit read). Fix recorded on the
+entity page: vendor-tool symbology cut to QR+Code128 + min length, BOTH readers, re-apply after
+any factory reset (config lives on the device). Deliberately NOT filtering impossible codes
+server-side — probe recording is the anomaly path's job.
+
+## [2026-07-04] update | Backfilled missing concept pages: entry-presence-bypass + setup-relay-test
+
+Two shipped features (2026-07-01/02) had no wiki pages — worse, six code files and
+[[entry-double-press]] already linked [[entry-presence-bypass]] as if it existed. Written now:
+[[entry-presence-bypass]] (admin drops a faulty radar/camera signal, granular by decision, every
+flip a signed config_change, tickets stamped presenceBypassed, radar-bypass cooldown tradeoff,
+"the admin is not the adversary" threat-model nuance) and [[setup-relay-test]] (admin-only
+commissioning pulse, signed barrier_open_command BEFORE the fire so a test open never reads as the
+out-of-band-open fraud signal, saved-controllers-only, radarAlert lamps excluded). Cross-linked
+from [[operator-issued-entry]] (bypass note) and cataloged in index.md.