docs(wiki): collector live on park-2; secrets shape, DNS vs bind, token format, every-entry sampling, CI extra rule

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

wiki/log.md

@@ -3143,3 +3143,13 @@ run; the Quadro FX 3800 is unusable (cc 1.3), the HD P530 irrelevant, the Xeon E
 (feature-extraction head in minutes, full fine-tune ~1 h); trainer image = CPU-only torch, the
 compose seam drops the GPU reservation; cloud GPU rejected (crops stay on premises). Linked from
 [[opencv-anpr-service]], [[vision-review-outbox]], index. User: "No build just yet."
+
+## [2026-09-07] ingest | Collector live on park-2; secrets shape, DNS vs bind, token format, CI rule
+Deployed: collector on art-docker-station + park-2 at stage-dbbb051, every entry sampled; review
+screen filling. Recorded on [[vision-review-outbox]]: one secret per booth referenced by both stacks
+(the combined-list secret was replaced the same day), URL by Netbird DNS name vs bind by IP, token =
+`openssl rand -hex 32` (opaque, ≥16, no separators, never shared), the operator hash needs no
+variable, deploy the collector before a booth that sends a new package kind, the export's formula
+neutralisation (security review finding), and why every entry is sent. On
+[[vision-service-packaging]]: CI syncs without the alpr extra — numpy in the dev group, cv2 tests
+importorskip (three red runs on 2026-09-07).