feat(carwash): advisory vehicle category from the entry camera — mapping, pre-select, downgrade flag

The app plumbing for venue-modules.md §"Vehicle category from vision"; the model is the
open half (no bundled recognizer emits body_type yet, so the desk shows nothing until
phase A lands in the vision service).

- Shared: VEHICLE_CLASSES vocabulary, VehicleRead, CARWASH_VISION_THRESHOLD_DEFAULT,
  reason code carwash.categoryDowngrade; settings/order/lookup views carry the read.
- Vision contract: /analyze vehicle.body_type + confidence (service schema); the Node
  client normalises to the vocabulary and drops the rest.
- Record: snapshot.ts stores the read in the plate's device_events row (or its own when
  the plate was unreadable); vehicleForIdentity() resolves it like the plate.
- Car wash: carwash_categories.vision_classes (site mapping "car, sedan → Vetura"),
  carwash_config.vision_threshold (signed config_change when it moves), four vision
  columns on orders — migration 0030. Lookup returns vision + suggestedCategoryId.
- Desk pre-selects the mapped category and shows the read + snapshot thumbnail; Setup
  offers class chips per category and the threshold. Operator decides.
- Flag: a read at/above the threshold whose mapped category prices HIGHER than the chosen
  one signs one `anomaly` (both categories/prices, operator, snapshot) and stores its id on
  the order. Equal/upgrade/unsure/unmapped → nothing. Recorded only, never blocks, no
  reason prompt (user, 2026-09-06).

Tests in carwash.test.ts; wiki venue-modules (As built), opencv-anpr-service, log.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

wiki/decisions/venue-modules.md

@@ -170,6 +170,31 @@ vehicle. The Hikvision push's `detectionTarget` only says `vehicle`/`human` on t
     and the flagged-category set are **site config** (a minivan-heavy site tunes the noise down).
   - CPU: a second model per frame on the i5-8500 — analyse one frame per vehicle, not every push.
 
+**As built (2026-09-06) — the app plumbing; the model is the open half.** Decisions from the user:
+a flagged downgrade is *recorded only* (no reason prompt), and Setup maps the vision vocabulary
+onto the site's own categories ("car, sedan, hatchback → Vetura").
+- **Vocabulary.** `VEHICLE_CLASSES` in `@parking/shared` (car, sedan, hatchback, suv, minivan,
+  pickup, van, truck, bus, motorcycle). The service's `/analyze` `vehicle.body_type` +
+  `confidence` carry it; the Node client normalises and drops anything outside the list.
+- **Record.** `snapshot.ts` writes the read into the same unsigned `device_events` row as the plate
+  (or a row of its own when the plate was unreadable); `vehicleForIdentity()` resolves it like the
+  plate (entry over exit, newest first). Never on the ledger by itself.
+- **Mapping + threshold.** `carwash_categories.vision_classes` (JSON list) and
+  `carwash_config.vision_threshold` (default 0.8; signed `config_change carwash.visionThreshold`
+  when it moves). Migration 0030.
+- **Desk.** The ticket lookup returns `vision` + `suggestedCategoryId`; the intake pre-selects it
+  and shows "Camera saw SUV 91% → SUV" with the snapshot thumbnail; the operator may change it.
+- **Flag.** On intake, if the mapped category prices HIGHER than the chosen one for that service
+  and the read is at or above the threshold → one `anomaly` (`carwash.categoryDowngrade`, both
+  categories, both prices, operator, snapshotId) and `downgrade_event_id` on the order. Equal,
+  upgrade, unsure or unmapped reads flag nothing. The order is always created.
+- **Model — NOT built.** No bundled recognizer produces `body_type` yet, so today the desk shows
+  nothing and nothing is flagged. Phase A = a COCO detector on Apache-2.0 ONNX weights (car /
+  truck / bus / motorcycle, plus the vehicle crop); Phase B = the body-type classifier trained on
+  the pilot's own frames — every wash order is a labelled frame (entry snapshot + the category a
+  person chose), so the dataset builds itself on park-2. Reports (discrepancies per operator per
+  shift) wait for the first real reads.
+
 ## Car Wash — the pilot module (settled 2026-09-05)
 
 - **Car Wash is the pilot for the registry (settled).** It is built *as* the first module, and

wiki/entities/opencv-anpr-service.md

@@ -248,3 +248,12 @@ service's `/health` each tick and shows a **"Vision" chip** in the booth footer
   ([[bom]], [[open-questions]]).
 - Per-camera **opt-in** — ✅ **built**: `config.anpr === true` enables ANPR on a camera (set via the
   SetupWizard checkbox); ANPR then runs on that camera's entry/exit snapshot.
+
+## Vehicle body type (advisory) — contract only, 2026-09-06
+
+`/analyze` may now populate `vehicle.body_type` + `vehicle.confidence` from the shared vocabulary
+(car, sedan, hatchback, suv, minivan, pickup, van, truck, bus, motorcycle). Node records it beside
+the plate and the Car Wash desk pre-selects the category the site maps it to; the operator
+decides, a confident downgrade is flagged, nothing is gated on it. No bundled recognizer emits
+it yet — see [[venue-modules]] §Vehicle category from vision for the model plan (COCO detector
+first, body-type classifier on own frames second).

wiki/log.md

@@ -3080,3 +3080,14 @@ click). Every role create/update/delete appends a `config_change` (`role.<id>`,
 name + permissions + jobs, operator); a no-op resave signs nothing. The stale "should
 booth-supervisor carry subscription:*" note is closed — it already does. Tests: routes/roles.test.ts.
 Updated [[venue-modules]] §Permissions matrix status, [[local-jwt-auth]].
+
+## [2026-09-06] ingest | Vision vehicle category — app plumbing built, model pending
+Decisions (user): a flagged downgrade is recorded only; Setup maps vision classes onto the site's
+categories. Built: `VEHICLE_CLASSES` vocabulary + `VehicleRead` (shared); `/analyze`
+`vehicle.body_type`/`confidence` in the service schema and the Node client; the read stored in the
+plate's `device_events` row (`vehicleForIdentity`); `carwash_categories.vision_classes`,
+`carwash_config.vision_threshold`, four vision columns on orders (migration 0030); Setup chips per
+category + threshold; the desk pre-selects the mapped category and shows the read + thumbnail;
+a confident, pricier-mapped read with a cheaper choice signs `anomaly carwash.categoryDowngrade`
+(both categories/prices, operator, snapshot) — never blocks. No recognizer emits body_type yet.
+Tests in carwash.test.ts. Updated [[venue-modules]] (As built), [[opencv-anpr-service]].