chore(komodo): park-lab stack for the printer bench; wiki: cover-open bug bench result

park-lab re-added to resources.toml for the reproduction box: copied from park-2 then
corrected — the copy carried park-2's review outbox (collector URL, booth-2 id, booth-2's
token), which would have fed the training pool under a booth's identity; removed, the
outbox is off on the bench. Pinned to the booth's stage-2d9bb15, comments say what the
lab is for.

Wiki, printer-usb-transport: the failing printer identified (USB 1fc9:2016 "POS-80", NXP
controller, no brand in the descriptor); attached to WSL via usbipd and cover-cycled — no
disconnect, no re-enumeration, so the stale /dev/usb bind-mount hypothesis is falsified
for this unit; the next discriminator is the monitor's offline detail text on park-buzi
(EBUSY / open timeout / EIO). WSL caveat: Microsoft's kernel lacks CONFIG_USB_PRINTER.
fleet-deployment-komodo: park-lab row updated. Log: both entries of the day.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

komodo/resources.toml

@@ -110,6 +110,48 @@ EVENT_SIGNING_KEY=[[park_2_event_signing_key]]
 BACKUP_KEY=[[park_2_backup_key]]
 """
 
+##############################################################################
+# Stack — the LAB BENCH (not a booth): a spare Linux box with the field printer and
+# whatever device is under investigation, so a booth bug can be reproduced on the booth's
+# exact image before touching a real site. Same compose files + pinned TAG as the staging
+# booths. No review outbox (the lab is not a site — it must never feed the training pool
+# under a booth's identity). Its own secrets. See wiki/decisions/fleet-deployment-komodo.md.
+##############################################################################
+
+[[stack]]
+name = "park-lab"
+[stack.config]
+server = "park-lab"
+git_provider = "git.infra.msai.al"
+git_account = "komodo"
+repo = "mca/parking_solution"
+branch = "stage"
+file_paths = [
+  "docker-compose.yml",
+  "docker-compose.prod.yml"
+]
+registry_provider = "git.infra.msai.al"
+registry_account = "komodo"
+environment = """
+REGISTRY=git.infra.msai.al/mca/parking_solution
+# Lab: pinned to the SAME stage-<sha> as the booth whose bug is being reproduced (bump
+# alongside it). A lab may float, but a reproduction must run the booth's exact image.
+TAG=stage-2d9bb15
+COOKIE_SECURE=0
+# Entitled to Car Wash too, so the wash-desk printer role and till can be exercised on the bench.
+MODULES_ENTITLED=parking,carwash
+# NO review outbox on the lab (CARWASH_REVIEW_URL/BOOTH_ID/TOKEN deliberately unset): the
+# collector's training pool is per-booth, and the bench is not a booth.
+VISION_ENABLED=1
+# Desktop app WS handshake: Origin is tauri://localhost (set explicitly by
+# platform-ws.ts, since the native WS plugin has no page context to auto-attach
+# one). Linux may also send http://tauri.localhost. See routes/ws.ts anti-CSWSH check.
+WS_ALLOWED_ORIGINS=tauri://localhost,http://tauri.localhost
+JWT_SECRET=[[park_lab_jwt_secret]]
+EVENT_SIGNING_KEY=[[park_lab_event_signing_key]]
+BACKUP_KEY=[[park_lab_backup_key]]
+"""
+
 ##############################################################################
 # Stack — the Car Wash REVIEW COLLECTOR on the reviewer's host (art-docker-station),
 # NOT a booth. Same repo/branch/TAG promotion as the booths, but its file_paths name

wiki/concepts/printer-usb-transport.md

@@ -174,7 +174,22 @@ itself is redone.
   target on a policy-driven restart, the container can come back up still bound to the pre-incident
   view. This matches the exact reported asymmetry (reboot doesn't fix it; explicit restart does).
 
-**Not yet confirmed on hardware** — this is the leading theory, not a verified root cause. To
+> **Bench result 2026-09-09 — the re-enumeration hypothesis is FALSIFIED for this unit.** The
+> failing printer (`1fc9:2016` "POS-80", now on the dev bench, attached to WSL via usbipd) was
+> cover-cycled while `dmesg -w` and `lsusb` were watched: **nothing** — no disconnect, no
+> re-enumeration, same bus/device number (a real drop would have shown as a vhci detach, since
+> Windows sees the bus first). So the device node does NOT change when the cover opens, and the
+> container `/dev/usb` bind-mount cannot be going stale for that reason. The failure is in how
+> `usblp` / the app's open-probe reacts to the printer's **error state** (cover-open status),
+> not in the device node. Next discriminator is the **exact `detail` text** the monitor logged
+> on park-buzi at the offline transition (`docker logs <stack>-server-1 | grep
+> 'device-monitor:.*-> offline'`): `EBUSY` = a handle is held inside the server process (usblp
+> allows ONE opener — candidate: the `withTimeout` open-leak or a close that never returned;
+> fits "docker restart fixes"), `usb open timeout` = `open()` itself blocks in the kernel, `EIO`
+> = `usblp_open`'s bidirectional read submit failed (printer endpoint state). The theory below
+> is kept for the record.
+
+**Not confirmed on hardware — and now contradicted by the bench (above).** The original plan to
 confirm at the next occurrence, BEFORE restarting anything:
 ```bash
 # host:
@@ -197,8 +212,18 @@ whether the Bus/Device number changes.
    passthrough + a udev rule pinning a stable symlink name — reintroduces the renumbering fragility
    the directory bind-mount was chosen to avoid, so only worth doing alongside (1)/(2), not instead.
 
-**Open sub-question — printer identity.** The park-buzi unit shows as "Generic (unknown)" in the
-app; not yet identified by vendor/product ID. Lab reproduction uses a **RONGTA** unit instead (not
+**Printer identity — IDENTIFIED 2026-09-09.** The failing unit is on the dev bench: USB
+`1fc9:2016`, product string **"Printer POS-80"** (0x1fc9 = NXP, the printer's USB controller chip;
+"POS-80" is the generic 80 mm ESC/POS designation — no brand in the descriptor, which is why the app
+shows "Generic"). Seen via `usbipd list` on the Windows host (busid 8-1). **Dev-bench caveat:** the
+stock Microsoft WSL2 kernel (6.6.87.2) has `CONFIG_USB_PRINTER` **not set** — usbip/vhci is there,
+so the printer can be attached and seen by `lsusb`, but no `usblp` → no `/dev/usb/lpN` → the app's
+USB transport and the container's `/dev/usb` bind-mount cannot be exercised without a custom WSL
+kernel (`.wslconfig` `kernel=`) built with `CONFIG_USB_PRINTER=y`. Also, through usbip the
+cover-open disconnect is seen by *Windows* first (usbipd detaches; `--auto-attach` re-exports), so
+the bench only shows *whether* the device drops off the bus, not the host-kernel/container
+staleness itself. Previously: the park-buzi unit showed as "Generic (unknown)" in the app; not
+identified by vendor/product ID. Lab reproduction uses a **RONGTA** unit instead (not
 the same hardware), so the lab cannot currently reproduce the park-buzi symptom directly — only
 validate the general re-enumeration mechanism. Commands to identify the real park-buzi printer next
 time it's reachable via SSH: `lsusb`, `udevadm info -q property -n /dev/usb/lp1`, `udevadm info -a

wiki/decisions/fleet-deployment-komodo.md

@@ -198,7 +198,7 @@ Second `[[stack]]` in `komodo/resources.toml`: **`park-lab`** (server = the lab
 
 | Stack | compose branch | image tag | secrets |
 | --- | --- | --- | --- |
-| park-lab | `dev` | **moving `dev`** (a lab may float) | `park_lab_*` |
+| park-lab | `dev` → **`stage` (2026-09-09)** | ~~moving `dev`~~ → **pinned to the booth's `stage-<sha>` under reproduction** (2026-09-09: the lab re-joined the fleet to reproduce the park-buzi printer cover-open bug, so it must run the booth's exact image; **no review outbox** — the bench is not a booth and must never feed the collector under a booth id) | `park_lab_*` |
 | park-buzi | `stage` | pinned `stage-<sha>` | `park_buzi_*` |
 
 The three knobs are independent per stack — the ResourceSync's own branch only governs where the

wiki/log.md

@@ -3213,3 +3213,39 @@ variable, deploy the collector before a booth that sends a new package kind, the
 neutralisation (security review finding), and why every entry is sent. On
 [[vision-service-packaging]]: CI syncs without the alpr extra — numpy in the dev group, cv2 tests
 importorskip (three red runs on 2026-09-07).
+
+## [2026-09-08] decision | Subscription recurring billing + the party ledger (design only)
+User: "an subscriber should prepay or postpay every month, at the 1st or the day it began; fixed
+by a daily tariff (300 ALL/day); notify when about to expire … we need a more flexible way." Then:
+"the financial aspect is too simple" — postpaid agreements, hotels given daily access for guests,
+Car Wash fleet deals paid per period, the wash's supplier/utility bills; the admin needs to see
+uncollected dues. Assessed against the code: a subscription is ONE coverage window sold once;
+**renewal is off-book** (a `PUT` that never re-sells and appends no `payment` — the same hole
+closed for the first sale on 2026-06-20). Designed, not built: (a) [[subscription]] §Recurring
+billing — plan billing rule {mode, cycle, anchor, graceDays, noticeDays}, recurring plans priced
+per day so calendar and anniversary anchoring share one formula, open-ended agreement, a
+`subscription_periods` table where each period is a ledger charge and a renewal = paying the next
+period (signed `payment`), one `subscriptionAccess()` gate function (answers lapsed-mid-stay via
+grace), expiry notice derived not stored (console counter, list badge, feed line at scan-in);
+(b) new [[party-ledger]] decision page — parties + signed `charge` / settlement (`payment` /
+`cash_out` / bank) / `write_off`, balance derived never stored (threat model), aging + statements
++ CSV, the four cases (subscriptions, hotels, fleet washes as `payAt: "account"`, supplier bills
+as payables), the line drawn (sub-ledger, not bookkeeping; a statement is not a fiscal invoice;
+parties per appliance), build order. [[validation-sponsorship]]'s sponsor table marked
+superseded; [[open-questions]] #17 added, #3 on the subscription page reopened for renewals;
+index updated. Nothing in code changed.
+
+## [2026-09-09] ingest | Printer cover-open bug — bench result falsifies re-enumeration; park-lab rejoins the fleet
+The failing park-buzi printer is on the dev bench: identified as USB `1fc9:2016` "Printer POS-80"
+(NXP controller, no brand in the descriptor — hence "Generic" in the app). Attached to WSL via
+usbipd-win 5.3 (busid 8-1). Cover cycled under `dmesg -w` + `lsusb`: NO disconnect, NO
+re-enumeration — the leading hypothesis (cover cuts the USB board → stale container `/dev/usb`
+bind-mount) is falsified for this unit; the fault is in how usblp / the open-probe reacts to the
+printer's error state. Next discriminator = the monitor's offline `detail` text on park-buzi
+(EBUSY vs open-timeout vs EIO). WSL caveat recorded: Microsoft's 6.6.87 kernel has
+CONFIG_USB_PRINTER unset — no `/dev/usb/lpN` without a custom kernel, so the user will reproduce
+on a Linux box instead. `komodo/resources.toml`: `park-lab` stack re-added for that box — copied
+from park-2 then corrected (the copy carried park-2's review outbox + booth-2 token; removed — the
+bench must never feed the collector under a booth id); pinned to the booth's stage-<sha>. Pages:
+[[printer-usb-transport]] (identity, bench result, WSL caveat), [[fleet-deployment-komodo]]
+(park-lab row).