docs(wiki): vision fitness assessment for entry/exit flows

Record the verdict: the ANPR service is worthy to consume NOW as an advisory plate
IDENTITY source (Job 1) — the flows already treat a kind:"plate" read as first-class
(exit signs source:"lpr"; subscription matches read plate vs bound plates), so it feeds
an existing input with no flow rewrite. It is NOT worthy as the sole authority to open a
transient barrier (a plate is not a payment; spoofing needs Job 2 vehicle verification,
unbuilt) — gated by the confidence floor with ticket/manual fallback. Lists the four
gaps before consumption (VisionClient adapter, opt-in trigger, field accuracy,
weight-provenance). Next step is the adapter, not more model work.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/entities/opencv-anpr-service.md

@@ -143,6 +143,38 @@ The ranking should hold; re-benchmark on real on-site captures once the cameras
   stake — confidence thresholds + fallback to ticket/manual; a low-confidence read must not strand a
   car ([[fail-state-safety]]).
 
+## Fitness for the entry/exit flows (assessment, 2026-06-19)
+
+Asked after the scaffold + AL benchmark: *is the service worthy to consume in the entry/exit flows?*
+The benchmark settles **accuracy** (0.99+ on clean AL plates); "worthy" then turns on **what authority
+the read is given** — and the answer splits by role:
+
+- **✅ Worthy NOW — as an ADVISORY identity source (Job 1).** The flows are **already built for a
+  plate**: a `kind:"plate"` [[device-events|read]] is a first-class identity today — `exit-flow.ts`
+  signs `source:"lpr"` for it, and `subscription-flow.ts` matches a read plate against
+  `subscriptionPlates` ([[subscription]] plate binding). So the service just **produces** the plate
+  string a snapshot → `/analyze` → (if confident) a `DeviceReadEvent{kind:"plate"}` on the existing
+  read bus. **No flow rewrite — it feeds an existing input.** Concretely worthy for: hands-free
+  **subscriber** barrier open (plate-bound), and **evidence enrichment** (plate + image on the signed
+  entry/exit for disputes).
+- **⚠️ NOT worthy as the SOLE AUTHORITY to open a TRANSIENT barrier.** Two threat-model reasons: (1) **a
+  plate is not a payment** — a transient still needs a ticket + `payment`; letting a plate open the
+  exit would be an unpaid-exit bypass. The `min_confidence` floor → `low_confidence` → ticket/manual
+  fallback is the guard (already in the scaffold). (2) **Plate-spoofing** (a printed plate on a
+  different car) — plate-only ANPR *cannot* catch it; that needs **Job 2 (vehicle verification), which
+  is NOT built**. So plate-as-identity is convenience + evidence, never the lone reason a paid barrier
+  opens. Consistent with "advisory, never sole authority" above.
+
+**Gaps before it's actually consumed (capable ≠ wired):** (1) the Node→service **`VisionClient`**
+adapter (localhost HTTP, behind the [[device-adapter-pattern]] interface) — the real integration work;
+(2) **trigger wiring** — snapshots today fire *after* a barrier opens (evidence); plate-as-identity
+needs a snapshot *before* the decision, on a **per-camera opt-in** lane (open item below); (3)
+**field-accuracy** unknown — re-benchmark/tune the threshold on real on-site captures
+(angle/night/dirt); (4) the **weight-provenance** check (open). **Bottom line: consume it as a
+gated advisory identity source feeding the existing `kind:"plate"` path — not as sole authority — and
+Job 2 is still required for the anti-spoofing value.** Next concrete step is the `VisionClient` adapter
++ the opt-in trigger, not more model work.
+
 ## Open
 
 - **Recognizer choice** — **fast-alpr (MIT, YOLOv9+CCT on ONNX) is the baseline, AL-benchmarked**: the

wiki/log.md

@@ -920,3 +920,7 @@ Scaffolded the [[opencv-anpr-service|vision service]] per [[vision-service-packa
 ## [2026-06-19] query | Albanian-plate OCR benchmark — keep the default (cct-xs-v2-global)
 
 Benchmarked fast-alpr's four candidate fast-plate-ocr models via the FULL pipeline (YOLOv9 detect → OCR) on real AL plate photos (Wikimedia: AA558EE, AA687KE), CPU, scaffolded apps/vision service. ALL FOUR read both plates correctly; the differentiator is confidence + speed: cct-xs-v2-global (default) 0.999/1.000 @ 33–39ms AND returns region=Albania; cct-s-v2-global same accuracy ~50% slower; global-mobile-vit ~0.955 fast; european-mobile-vit-v2 (the "40+ country EU" model) correct but MUCH lower confidence (~0.77) and misread a synthetic AB123FG→AB123FO. FINDING (overturns the "EU model → better for AL" assumption from the prior research turn): the global cct-xs default WINS for Albania — most accurate AND fastest. Decision: no config change, VISION_OCR_MODEL stays cct-xs-v2-global-model. Caveat: test photos were clean head-on shots; real booth captures (angle/night/dirt/blur) will lower confidence — the min_confidence=0.5 floor → low_confidence → ticket-path fallback covers it; re-benchmark on on-site captures once cameras installed. Resolves the AL-accuracy-benchmark open item in [[opencv-anpr-service]] (added a results table + the keep-default finding); the weight-provenance check remains the one open recognizer item.
+
+## [2026-06-19] query | Vision service fitness for entry/exit flows — advisory YES, sole-authority NO
+
+Q: is the scaffolded ANPR service worthy to consume in entry/exit flows? Assessment recorded in [[opencv-anpr-service]] ("Fitness for the entry/exit flows"). Benchmark settled ACCURACY (0.99+ clean AL plates); "worthy" turns on AUTHORITY. Split verdict: (✅) worthy NOW as an ADVISORY identity source (Job 1) — the flows are ALREADY built for a plate (kind:"plate" read is first-class: exit-flow signs source:"lpr"; subscription-flow matches read plate vs subscriptionPlates), so the service just produces the plate string → DeviceReadEvent{kind:"plate"} on the existing read bus; no flow rewrite. Worthy for hands-free subscriber open + evidence enrichment. (⚠️) NOT worthy as SOLE AUTHORITY to open a TRANSIENT barrier: a plate ≠ payment (would be an unpaid-exit bypass; min_confidence floor → ticket/manual fallback is the guard) and plate-spoofing (printed plate, different car) needs Job 2 vehicle-verification which is NOT built. Gaps before consuming: (1) the Node VisionClient adapter (real integration work), (2) trigger wiring — snapshots fire AFTER open today (evidence); plate-as-identity needs a snapshot BEFORE the decision on a per-camera opt-in lane, (3) field accuracy unknown (re-tune threshold on on-site captures), (4) weight-provenance check. Next step: VisionClient adapter + opt-in trigger, not more model work. (Scaffolding VisionClient next.)