fix(modules): Car Wash depends on parking only — the discount engine is core, not the validation module

A site entitled to parking,carwash had the wash silently dropped as dependency-broken.
The validation program routes (compose/read) leave the validation module gate; the
merchant scan routes (mine/lookup/apply/void) stay behind it.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

wiki/decisions/venue-modules.md

@@ -230,9 +230,13 @@ vehicle. The Hikvision push's `detectionTarget` only says `vehicle`/`human` on t
    `programMode` for audit. The
    site admin configures, for the car wash, the same program shape a merchant validation has
    (comp / first N minutes free / amount / percent, max per day); a completed wash applies it
-   to the customer's session automatically, attributed to the wash operator. So the module
-   `dependsOn` **validation** (the sponsorship engine) as well as parking, and the earlier
-   "own event, validation absorbed later" idea is superseded: validation IS the engine. With
+   to the customer's session automatically, attributed to the wash operator. ~~So the module
+   `dependsOn` **validation** (the sponsorship engine) as well as parking~~ — **corrected
+   2026-09-06:** the discount ENGINE (program rows + `applyValidation()`) is CORE; the
+   `validation` module is only the merchant's scan screen. Car Wash depends on parking alone
+   (a site set to `MODULES_ENTITLED=parking,carwash` had the wash silently dropped as
+   "dependency broken" — the user's first field test). The earlier "own event, validation
+   absorbed later" idea stays superseded: the engine IS the shared piece. With
    program = comp, an in-bay-paid wash lets the car out at the reader; with a partial program
    the remainder is still paid at the booth (the reader refuses, as for any unpaid session).
 
@@ -346,8 +350,9 @@ at the two seams the design names, and the registry earned its keep: **one manif
   for a quote and, if the sponsorship made it zero-due, signs the $0 parking payment via
   `PayStation.pay()`. A partial sponsorship leaves the remainder for the booth (verified).
 - **Modules reach the core only via `ServerModuleDeps`** (db, eventLog, payStation,
-  shiftService) — no module imports another; `dependsOn: ["parking", "validation"]` is enforced
-  by the activation rules (verified: carwash cannot be on with validation off).
+  shiftService) — no module imports another; `dependsOn: ["parking"]` (validation dropped
+  2026-09-06; the program routes moved out from behind the validation gate — the merchant
+  scan routes stay gated).
 - **Deploy gotcha (2026-09-06):** `MODULES_ENTITLED` reaches the container ONLY through
   `docker-compose.yml`'s `environment:` block — a value in the Komodo stack env alone is just
   compose interpolation input. It was missing there, so every booth on `55d6242` had Car Wash