fix(console): switch ser2net accepter to telnet(rfc2217) for proper NVT

The original ser2net config used raw TCP accepters, but conman's
dev="host:port" speaks telnet protocol. This protocol mismatch caused
conman's telnet NVT state machine to strip bare CR characters from
device output — particularly from Dell switches that send \n\r (LF+CR)
line endings — producing stair-stepped and garbled terminal display.

Fix: change ser2net accepter from `tcp,IP,PORT` to
`telnet(rfc2217),tcp,IP,PORT`. With both sides speaking telnet, binary
mode is negotiated and CR/LF translation is handled correctly by the
telnet NVT layer. RFC2217 also enables baud rate negotiation for
future use.

Validated at the byte level: PTY capture confirms all prompts render
cleanly at column 0 with proper CRLF handling across 5+ Enter presses.
All 7 consoles connected, 7 log files actively capturing.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

STATUS.md

@@ -68,19 +68,21 @@ infrastructure, Proxmox cluster ops, and k8s control plane.
 - [x] Validated: outlet 10 cycled off → on (8/8 test checks passed)
 - [ ] Rename outlets to match physical devices (Friday onsite)
 
-### Console Management (conman direct-serial on pfv-tsys4 — LIVE)
+### Console Management (ser2net telnet(rfc2217) + conman on pfv-tsys4 — LIVE)
-- [x] 7 network switch/router consoles managed via conman
+- [x] 7 network switch/router consoles managed via ser2net + conman
 - [x] **USB enumeration problem SOLVED:** udev rules pin each adapter by
   ID_PATH (physical USB port topology) to stable `/dev/consoles/<name>`
   symlinks that survive reboot regardless of enumeration order
-- [x] conman owns serial devices directly (no ser2net/telnet in data path)
+- [x] ser2net exposes all 7 consoles on telnet(rfc2217) TCP ports (2001-2007)
-- [x] 7 log files active in `/var/log/conman/`
+  bound to **Tailscale IP only** (`100.70.77.93`)
-- [x] conmand enabled via systemd (survives reboot)
+- [x] conman connects to TCP ports for logging + multiplexing (7 log
+  files active in `/var/log/conman/`)
+- [x] Both ser2net + conmand enabled via systemd (survive reboot)
 - [x] conmand systemd unit created (Debian package doesn't ship one)
-- [x] ser2net installed but DISABLED (emergency TCP access only)
+- [x] conmand remote access enabled (loopback=off, port 7890)
 - [x] Old `/root/conmap` + manual `screen` workflow replaced
-- [x] **Stair-stepping fix:** switched from ser2net→telnet→conman to
+- [x] **Stair-stepping fix:** ser2net accepter changed from raw `tcp` to
-  conman direct-serial to eliminate telnet NVT CR stripping
+  `telnet(rfc2217)` so conman's telnet NVT negotiates binary mode properly
 
 ### Ansible AWX (tsys-awx — LIVE)
 - [x] AWX 24.6.1 deployed via AWX Operator 2.19.1 on k3s single-node
@@ -153,5 +155,5 @@ infrastructure, Proxmox cluster ops, and k8s control plane.
 | **k8s control plane** | **3-node k3s HA (cnode1/2/3), all traffic over Tailscale** |
 | **PDU** | **Cyclades PM10i via powerman on pfv-tsys1 (port 10101)** |
 | **AWX** | **tsys-awx: AWX 24.6.1 on k3s (http://tsys-awx.knel.net:80)** |
-| **Console** | **7 switch consoles via conman direct-serial on pfv-tsys4 (conmand:7890 on Tailscale)** |
+| **Console** | **7 switch consoles via ser2net telnet(rfc2217)+conman on pfv-tsys4 (conmand:7890 on Tailscale)** |
 | Production | Cloudron VPS, Reston VA (this cluster is R&D only) |

console/generate-config.sh

@@ -159,7 +159,9 @@ fi
 
   for entry in "${ENTRIES[@]}"; do
     IFS='|' read -r tcp_port name id_path baud comment <<< "$entry"
-    # ser2net connection block — telnet(rfc2217) accepter for proper NVT handling
+    # ser2net connection block — telnet(rfc2217) accepter so conman and
+    # telnet clients negotiate proper telnet binary mode. This prevents
+    # CR stripping that occurs with raw TCP + conman's telnet NVT.
     echo "connection: &con${tcp_port}"
     echo "    accepter: telnet(rfc2217),tcp,${TS_IP},${tcp_port}"
     echo "    enable: on"

docs/docmap.md

@@ -47,7 +47,7 @@ Server provisioning, security hardening, DNS/NTP configuration.
 | [`../netinfra/dhcp-migration.md`](../netinfra/dhcp-migration.md) | DHCP migration: pfv-netboot → netinfra-01/02 (ISC failover-peer, COMPLETE) | 2026-07-29 |
 | [`../awx/README.md`](../awx/README.md) | Ansible AWX deployment on tsys-awx (k3s + AWX Operator 2.19.1, v24.6.1) | 2026-07-29 |
 | [`../powerman/README.md`](../powerman/README.md) | Cyclades PM10i PDU management via powerman on pfv-tsys1 | 2026-07-28 |
-| [`../console/README.md`](../console/README.md) | Serial console management (conman direct-serial) for 7 network switches on pfv-tsys4 | 2026-07-29 |
+| [`../console/README.md`](../console/README.md) | Serial console management (ser2net telnet rfc2217 + conman) for 7 network switches on pfv-tsys4 | 2026-07-29 |
 | [`../k8s/README.md`](../k8s/README.md) | k3s cluster setup scripts: wipe, bootstrap, taint, verify (3-node HA over Tailscale) | 2026-07-28 |
 | [`../dns-cluster-setup/README.md`](../dns-cluster-setup/README.md) | Technitium DNS cluster setup: export, deploy, cluster, verify | 2026-07-28 |
 | [`../tests/README.md`](../tests/README.md) | Test suite documentation: unit, security, validation tests | 2026-07-28 |