Fixed Pin

.claude-context/sessions/2026-09-23-visitor-kiosk-build.md

@@ -179,3 +179,24 @@ Whole project created this session. Principal files:
 - `brother_ql` 0.9.4 (PyPI) — `print --help` documents the `--red` requirement.
 - Brother QL-820NWB specification: 12–62 mm media, 60.96 mm max print width, 300×300 dpi.
 - RFC 6238 (TOTP) — test vectors used to verify `src/auth.js`.
+
+---
+
+## Addendum — 2026-09-23, PIN reset bug
+
+**Symptom:** after changing a recurring visitor's PIN, phone + PIN was rejected at the kiosk.
+
+**Cause:** the Edit form carried a "PIN" field whose value `PATCH /admin/api/frequent/:id`
+never read. The record saved, the field was silently discarded, and the admin handed out a PIN
+the system had never stored. (`POST /admin/api/frequent/:id/pin`, the "New PIN" button, was
+always correct — verified by reproduction.)
+
+**Fix:** `PATCH` now honours a supplied `pin`: 4 digits, checked for collisions via
+`allocatePin(pin, row.id)`, written to `pin_enc` and `pin_lookup`. Blank keeps the current PIN.
+A malformed or already-used PIN is rejected with a message instead of ignored. The response
+carries `pinChanged`, and the console shows the printable card when it is true. Saving a record
+also clears `pin_attempts` for both the old and new phone number, so a changed number cannot
+leave a stale lockout.
+
+**Files:** `src/routes/admin.js` (PATCH handler), `public/js/admin.js` (edit modal shows the
+current PIN, relabelled field, shows the card after a change), `public/css/admin.css`, `README.md`.