Recurring Visit Button

.claude-context/sessions/2026-09-23-visitor-kiosk-build.md

@@ -222,3 +222,22 @@ so the EKU and signature checks shell out to `openssl x509 -noout -text`.
 **Most likely causes, still unconfirmed on the device:** the *served* certificate was uploaded to
 Jamf instead of the *authority*; or the address the iPad uses is not in `HTTPS_HOSTNAMES` (the
 host `.env` was previously missing that line entirely).
+
+---
+
+## Addendum — promote a guest to a recurring visitor
+
+Added **Make regular** to the On site list for any visit with a mobile number that is not already
+a recurring visitor.
+
+`POST /admin/api/visits/:id/make-regular` copies name, company, phone, email, check type/number/
+expiry, host (as their default) and site from the visit, issues a random unique PIN via
+`allocatePin(null)`, and copies the visit photo into a separate profile photo with
+`copyStoredPhoto` so retention purging the visit cannot delete it. Returns the shaped record plus
+`pin` and `photoCarriedOver`; the console opens the printable card.
+
+Refusals: no mobile number on the visit (the number is the sign in name); phone or email already
+belongs to a recurring visitor (error names them and returns `existingId`). Site-scoped admins are
+checked with `assertSiteAllowed`. The visit row is deliberately not modified or relinked.
+
+**Files:** `src/routes/admin.js`, `public/js/admin.js`, `README.md`.