feat(entry): operator-issued entry + exit plate-swap reconciliation

Two halves of one anti-fraud design.

(A) Operator-issued entry — when the physical entry button is broken, an
operator can issue an entry ticket so a real car isn't blocked out of the lot.
This hands the operator-adversary a mint, so it is:
  - PRESENCE-GATED like the physical button: a real car must be present (radar/
    loop AND camera busy). Enforced BOTH sides — the server re-checks current
    presence so a direct POST can't bypass a disabled button; no presence loop
    => feature unavailable; a no-presence attempt signs an anomaly.
  - FLAGGED: vehicle_entry source=manual + operatorInitiated + operator, PLUS a
    companion entry.operatorIssued anomaly (the adversary path always leaves a
    red-flag row).
  - capacity-OVERRIDE allowed but stamped lotFull (a broken button mustn't trap
    a legit car).
  New session:create permission (migration 0019 -> operator role, admin-
  revocable), POST /api/entry/issue (open-shift gated), EntryFlow.
  issueForOperator; the fraud-critical print->sign->open->snapshot sequence is
  factored into one shared #issueTicket (button + operator). UI: the entry
  BarrierLight becomes a clickable issue-control when presence+permission+shift
  meet (confirm -> issue).

(B) Exit plate-swap reconciliation — defends the ticket-swap fraud the mint
enables (paid car let out on a fresh $0 ticket, original ticket lingers
"inside", occupancy drifts up by phantom cars). The plate is the invariant:
ExitFlow.#reconcilePlateAtExit compares the exiting plate against all OPEN
sessions' entry plates, EXACT + HIGH-CONFIDENCE only (>=0.85; a fuzzy read never
gates — ANPR is advisory). On a match under a DIFFERENT ticket:
  - BOOTH path: returns swap_suspected + signs exit.plateSwapSuspected; the
    pay/exit modal shows a red warning + "Override & release" (override signs an
    attributed exit.plateSwapOverride). Flag+override, never a silent hard block
    (exit fails-open; a plate is never the sole gate).
  - READER path (no operator): log-only anomaly + fail-open.
  Extended BoothExitResult + /api/exit (override); boothExit client returns a
  structured swap result.

Verified: full monorepo build/lint/test green (229 server tests incl. 4 new:
hold-on-swap, override-releases-with-attribution, low-confidence-no-warning,
own-plate-no-warning). New wiki: operator-issued-entry.md +
plate-reconciliation.md; cross-linked from entry-exit-points, capacity-
occupancy, index. Preserves "a plate never OPENS a barrier alone — and now never
TRAPS a car alone either."

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/capacity-occupancy.md

@@ -32,6 +32,9 @@ editable and drifts; the chain is the truth). Spaces-free = `capacity − occupa
   diverge from physical reality. The count is the *system's* occupancy; periodic ground-truth (a
   loop count, or the [[opencv-anpr-service|vision]] count) reconciles it — surfaced as an anomaly,
   not silently corrected.
+- **A DELIBERATE drift attack — the ticket swap:** a paid car let out on a fresh $0 ticket leaves its
+  original ticket "inside" forever, inflating occupancy by phantom cars. Defended by
+  [[plate-reconciliation]] (the exiting plate is already open under the original ticket → flag/hold).
 
 ## Reserved subscriber spots (admin toggle, built 2026-06-20)
 

wiki/concepts/entry-exit-points.md

@@ -157,4 +157,5 @@ as "⚠ camera unreachable" tiles (see [[booth-console]]).
 
 [[entry-exit-readers]] · [[device-events]] · [[parking-session]] · [[anti-passback]] ·
 [[append-only-event-chain]] · [[barrier-not-a-door]] · [[opencv-anpr-service]] ·
-[[dingtian-relay]] · [[first-run-setup]]
+[[dingtian-relay]] · [[first-run-setup]] · [[operator-issued-entry]] (mint when the button
+is broken) · [[plate-reconciliation]] (the entry snapshot's plate defends the exit)

wiki/concepts/operator-issued-entry.md

@@ -0,0 +1,70 @@
+---
+type: concept
+tags: [parking, booth, entry, threat-model, anpr, presence]
+sources: []
+updated: 2026-07-01
+status: settled
+---
+
+# Operator-issued entry (broken entry button)
+
+When the physical entry button is broken, an operator can **issue an entry ticket** from the booth so
+a real car isn't blocked out of the lot. This hands the [[threat-model|operator (the adversary)]] a way
+to mint entries — so it is **flagged, presence-gated, and paired with an exit defense**
+([[plate-reconciliation]]). Built 2026-07-01. Companion to [[entry-exit-points]] (the entry flow it
+reuses) and [[capacity-occupancy]].
+
+## Why give the operator this at all
+An operator *could* mint tickets to defraud — but a broken entry button otherwise **blocks the whole
+lot**, which is worse and more common. So the feature exists, and the fraud it enables is defended
+downstream (see the "ticket-swap" scenario in [[plate-reconciliation]]) rather than by withholding the
+capability.
+
+## The three controls that make it safe
+
+### 1. PRESENCE-GATED — a real car must be there (radar AND camera)
+The operator button obeys the **same rule as the physical button**: it is only active when **BOTH**
+presence conditions meet —
+- **radar/loop present** (a presence input is shorted at the entry barrier), AND
+- **camera confirms** a vehicle in the zone (the entry lane is "busy").
+
+This ties every mint to a **real vehicle physically at the entry** — the operator can't pad occupancy
+with phantom tickets, and (crucially) it guarantees the entry snapshot captures a **plate**, which is
+what [[plate-reconciliation]] reads at exit. **No presence loop configured → the feature is
+unavailable** at that site (we require both; no weaker camera-only fallback).
+
+**Enforced on BOTH sides.** The UI only enables the entry [[booth-console|BarrierLight]] as a clickable
+issue-control when `radar.entry && lanes.entry` (both true) and the operator holds `session:create`.
+The **server re-checks** current presence (`LaneStatus.snapshot().entry === true` AND the entry relay's
+guard `present === true`) and **refuses** otherwise — so a direct `POST /api/entry/issue` by the
+operator-adversary can't bypass a disabled button. A refused (no-presence) attempt signs an
+`anomaly` (`entry.issue.noPresence`) so probing the endpoint is itself in the tamper-evident record.
+
+### 2. FLAGGED — every operator mint leaves a red-flag row
+The issued entry is a **real** `vehicle_entry` (so occupancy/tariff/exit all work), but:
+- `source: "manual"` + `operatorInitiated: true` + `operator` on the signed payload, AND
+- a **companion `anomaly`** (`entry.operatorIssued`) — mirroring the [[booth-exit-flow|barrier
+  re-open]]: the operator-adversary path always leaves an explicit anomaly for [[reconciliation]].
+
+### 3. Capacity OVERRIDE is allowed but recorded
+Unlike the physical button (which refuses transient entry when the lot is [[capacity-occupancy|full]]),
+the operator **can** issue over capacity — a broken button mustn't trap a legit car when the count is
+near/at the cap (and the count may itself be inflated by the very fraud this defends). But an over-cap
+mint stamps `lotFull: true` + the occupancy on the events, so the override is visible.
+
+## Wiring
+- **Permission:** `session:create` (new; migration 0019 grants it to the default `operator` role;
+  admin-revocable per role, so an admin can turn off an operator's ability to mint). Admin has it in code.
+- **Route:** `POST /api/entry/issue` — `session:create` + an **open shift** (a minted entry belongs to
+  an accountable operator, like the money path).
+- **Server:** `EntryFlow.issueForOperator(operator, cameraBusy)`. The fraud-critical
+  print → sign(vehicle_entry) → pulseOpen → snapshot → cache sequence is a **single shared
+  `#issueTicket`** used by both the physical button and this path (no divergent copy).
+- **UI:** the entry `BarrierLight` becomes clickable (confirm → issue) only when presence + permission +
+  shift are satisfied; the exit light stays a pure indicator.
+
+## Relates
+- [[plate-reconciliation]] — the exit-side defense against the ticket-swap this capability enables.
+- [[entry-exit-points]] — the entry flow + snapshot/ANPR path reused here.
+- [[capacity-occupancy]] — why occupancy integrity matters (the swap fraud drifts it upward).
+- [[threat-model]] — the operator-adversary framing all three controls serve.

wiki/concepts/plate-reconciliation.md

@@ -0,0 +1,75 @@
+---
+type: concept
+tags: [parking, anpr, exit, threat-model, reconciliation, fraud]
+sources: []
+updated: 2026-07-01
+status: settled
+---
+
+# Plate reconciliation at exit (ticket-swap defense)
+
+Uses the ANPR **plate as an invariant** to catch a **ticket-swap fraud**: the car's plate is the same
+regardless of which ticket it holds, so if a car tries to exit on a ticket whose plate is **already
+inside under a different ticket**, something is wrong. Built 2026-07-01 alongside
+[[operator-issued-entry]] (the capability that makes the fraud easy). The [[threat-model|adversary is
+the operator]], but the same swap happens innocently (two people mix up tickets).
+
+## The fraud (worked scenario)
+A lot with 1000 spots:
+1. Real car enters on ticket **1234** → ANPR records plate **AA123BB** at entry.
+2. Car comes to exit owing 10,000 ALL. Operator scans 1234, **pockets the cash, does NOT record the
+   payment**.
+3. Operator **mints a fresh ticket 1237** (age ≈ 0 → owes ~0) and lets the car out on 1237.
+4. **1234 lingers "inside" forever** — a phantom car. Repeat → +100, +200 phantom cars; occupancy
+   becomes meaningless and the operator skims cash while the books look internally consistent (a ticket
+   was "paid" — 1237 for 0; a ticket is "inside" — 1234).
+
+The plate is what the swap can't hide: entry-1234 = AA123BB, and the car exiting on 1237 **is** AA123BB.
+
+## The check
+`ExitFlow.#reconcilePlateAtExit(exitingId)`:
+1. Resolve the **exiting** ticket's plate (its own exit read, else its entry read).
+2. Enumerate all **currently-open** sessions (projection cache) and their **entry** plates
+   (`platesForIdentities`).
+3. If the exiting plate **exactly** matches an open session under a **DIFFERENT** identity → **swap
+   suspected**, returning `{ plate, otherIdentity, otherEnteredAt }`.
+
+**EXACT, HIGH-CONFIDENCE only.** Both the exiting read AND the matched session's entry read must be
+≥ `PLATE_MATCH_MIN_CONFIDENCE` (0.85), normalized exact string match. No fuzzy/edit-distance matching.
+Rationale: ANPR is **advisory and misses** (G3H snapshot 503s, camera-side push failures, no-plate
+reads — see the ANPR memory notes). A fuzzy/low-confidence read must **never** be the reason a car is
+held — so a shaky read simply doesn't trigger the warning (fails toward not-annoying).
+
+## What happens on a suspected swap
+
+### Booth path (operator-mediated) — FLAG LOUDLY + require an override
+Exit fails-OPEN for safety and a plate is **never the sole gate**, so we do **not** silently hard-block
+(that would trap a legit car on a bad read). Instead:
+- `exitForBooth` returns status **`swap_suspected`** with the detail; the barrier does **not** open.
+- A **`anomaly` (`exit.plateSwapSuspected`)** is signed immediately — so even if the operator walks
+  away, the suspicion is in the tamper-evident record.
+- The pay/exit modal shows a **prominent red warning** ("Plate AA123BB is already inside under ticket
+  1234, entered 3h ago") with an explicit **"Override & release"** action.
+- On override, `exitForBooth(id, { override, operator })` proceeds AND signs an attributed
+  **`anomaly` (`exit.plateSwapOverride`)** — the override is itself a signed, named decision.
+
+### Reader path (automated, no operator) — LOG-ONLY, fail-open
+At an unmanned exit lane there's no one to make the override decision, and exit fails-open, so the
+reader path **signs the `exit.plateSwapSuspected` anomaly and still lets the car out**. The anomaly is
+the control there (a manager reconciles it later). This is a smaller surface — the fraud scenario is
+booth-mediated.
+
+## Why this is the right shape
+- **Occupancy stops drifting.** A swap can no longer silently strand ticket 1234 "inside" — the exit
+  attempt on 1237 surfaces it. Directly serves [[capacity-occupancy]] integrity.
+- **The signed anomaly is the audit signal** a manager reconciles ([[reconciliation]]) — consistent
+  with "the fraud control lives in the signed chain + human review, not a real-time hard gate".
+- **Advisory-not-a-gate is preserved both ways:** a plate never *opens* a barrier by itself, and now a
+  plate never *traps* a car by itself either (flag + override, never a silent hard block).
+
+## Relates
+- [[operator-issued-entry]] — the capability whose fraud this defends.
+- [[capacity-occupancy]] — occupancy integrity the swap attacks.
+- [[reconciliation]] — where the signed anomalies are ultimately settled.
+- [[entry-exit-points]] — the ANPR-on-snapshot path that records the plates compared here.
+- [[threat-model]] — operator-as-adversary.

wiki/index.md

@@ -88,6 +88,8 @@ Counts: 4 sources · 19 entities · 46 concepts · 7 decision records.
 - [[tariff]] — fee model; pure, data-driven, offline; pay-on-foot adds a walk-back grace window.
 - [[tariff-time-tiers]] — BUILT (V2 tariff): happy-hour/off-peak/weekend/seasonal + vehicle category + flat rate via wall-clock windowed cards; tz frozen per version.
 - [[booth-exit-flow]] — manned booth: pay → voucher (self-exit later) or immediate exit; active sessions; audited barrier re-open.
+- [[operator-issued-entry]] — operator mints an entry ticket when the physical button is broken; presence-gated (radar AND camera, both sides), flagged (source=manual + operatorInitiated + anomaly), capacity-override allowed; needs `session:create` (2026-07-01).
+- [[plate-reconciliation]] — ANPR plate-as-invariant catches the ticket-swap fraud (paid car let out on a fresh $0 ticket, original lingers "inside"); exact/high-conf match vs open sessions; booth = flag + operator override, reader = log-only fail-open (2026-07-01).
 - [[shift]] — manned-only accountability period; explicit Start/End; End → signed + printed Z-report; drawer float carries across shifts. Drawer cash movements (operator records, admin reviews via signed cash_review — a flag, not a reversal) live at the /drawer route (2026-07-01).
 - [[card-payments]] — card tender DISABLED (no P2PE POS on-site yet, 2026-07-01); cash-only UI gate (`CARD_PAYMENTS_ENABLED`); future POS keeps PCI scope out of the app; how to re-enable.
 - [[capacity-occupancy]] — live count = open sessions; refuse entry + FULL sign when full (soft policy); exit never blocked.

wiki/log.md

@@ -2108,3 +2108,34 @@ DrawerManager.tsx, drawer.* i18n (sq+en). Verified: full monorepo build/lint/tes
 tests incl. the op1-denied → op2-drawer-unchanged regression); Playwright end-to-end on /drawer
 (record disbursement → pending → authorize → status flips, ledger shows cash_out + cash_review with no
 authorizedBy). Recorded in shift.md "Drawer review".
+
+## [2026-07-01] feat | Operator-issued entry + exit plate-swap reconciliation (one anti-fraud design)
+
+Two halves of one design. (A) When the physical entry button is broken, an operator can ISSUE an entry
+ticket so a real car isn't blocked out of the lot — but this hands the operator-adversary a mint, so
+it's (1) PRESENCE-GATED exactly like the physical button (radar/loop present AND camera busy = a real
+car; enforced BOTH sides, server re-checks so a direct POST can't bypass a disabled button; no presence
+loop → feature unavailable; a no-presence attempt signs an entry.issue.noPresence anomaly), (2) FLAGGED
+(vehicle_entry source=manual + operatorInitiated + operator, PLUS a companion entry.operatorIssued
+anomaly), (3) capacity-OVERRIDE allowed but stamped lotFull (a broken button mustn't trap a legit car).
+New session:create permission (migration 0019 → operator role; admin-revocable), POST /api/entry/issue
+(open-shift gated), EntryFlow.issueForOperator; the fraud-critical print→sign→open→snapshot sequence
+factored into one shared #issueTicket (button + operator). UI: the entry BarrierLight becomes a
+clickable issue-control when presence+permission+shift meet (confirm → issue).
+
+(B) Plate-swap fraud (user's scenario): operator scans exiting ticket 1234 (owes 10000), pockets cash
+WITHOUT recording payment, mints fresh 1237 (owes ~0), lets the car out on 1237 → 1234 lingers "inside"
+forever, occupancy drifts up by phantom cars. Defense = ANPR plate as invariant: the car's plate is the
+same either way. ExitFlow.#reconcilePlateAtExit compares the exiting plate against all OPEN sessions'
+entry plates — EXACT, HIGH-CONFIDENCE only (≥0.85; a fuzzy/low read never gates, ANPR is advisory). On
+a match under a DIFFERENT ticket: BOOTH path returns swap_suspected + signs exit.plateSwapSuspected
+anomaly + the pay/exit modal shows a red warning with "Override & release" (override signs an attributed
+exit.plateSwapOverride) — flag+override, never a silent hard block (exit fails-open, plate never the
+sole gate). READER path (no operator) = log-only anomaly + fail-open (user's call). Extended
+BoothExitResult + /api/exit (override param), boothExit client returns a structured swap result.
+
+Verified: full monorepo build/lint/test green (229 server tests incl. 4 new: hold-on-swap,
+override-releases-with-attribution, low-confidence-no-warning, own-plate-no-warning). New wiki pages
+operator-issued-entry.md + plate-reconciliation.md; cross-linked from entry-exit-points,
+capacity-occupancy, index. Preserves "a plate never OPENS a barrier alone — and now never TRAPS a car
+alone either."