Treat physical card printers like any other piece of infrastructure: monitored, managed, replaceable.
Each issuance workstation runs a small native agent (we'd build it on Tauri/Rust) that talks to the printer over the vendor SDK — Entrust Sigma SDK for the DS4 family, HID Fargo SwiftColor SDK for the HDP6600. The agent pulls jobs from the DCJIS issuance queue over an mTLS-authenticated connection, prints, then writes back the printer serial, operator ID, timestamp, and any error codes. CJIS audit records cover every issue, print, reprint, and void.
For this demo, the print events are mocked client-side. Replacing that mock with the real SDK is ~2 weeks of work; the rest of the system doesn't change.