wiki: design the business layer (session, tariff, permit, vision, shift, ops)

Pivot from the hardware/integrity layer to the parking operation. All
wiki-only; no code yet. Core principle throughout: business entities are
projections over the signed append-only event log, never mutable tables.

New concepts: parking-session, tariff (composable/versioned, FX-ready),
shift (manned-only Z-report), capacity-occupancy, validation-discounts,
reporting-analytics, clock-integrity, ticket-encoding, anti-passback.
New entities: permit, opencv-anpr-service, blocklist.
Decisions: session-model, vision-service (host-side ANPR + vehicle
verification; scoped AGPL exception for the isolated service).

Updates: append-only-event-chain (new event types + vision witness),
local-jwt-auth (drop 8h expiry -> until logout; code change pending),
lpr-camera (host-side recognition supersedes edge-AI), standing-decisions
(AGPL exception), open-questions (+FX, +pay-station money corners, backup).

Deferred + flagged: intercom/help-call, receipts/refunds/change, FX engine,
lane topology (#1).

wiki/concepts/validation-discounts.md

@@ -0,0 +1,46 @@
+---
+type: concept
+tags: [parking, domain, business, pricing, revenue]
+sources: []
+updated: 2026-06-15
+status: open
+---
+
+# Validation & Discounts
+
+A merchant (shop, hotel, clinic) **validates** a customer's parking so they pay less or nothing —
+a common revenue/retention feature that modifies what a [[parking-session]] owes.
+
+## Model: a discount is a signed event, applied at fee time
+
+A validation is **not** an edit to the session or a mutable "discount applied" flag — same reason
+as everything else ([[threat-model]]: an operator/merchant could otherwise fake free parking). It's
+recorded so the fee computation and the audit both see it:
+
+- A **discount/validation event** references the session: `{ sessionRef, kind, value, issuedBy,
+  ts }` — e.g. *2 hours free*, *€5 off*, *flat €1*, *100% off*. Appended + signed
+  ([[append-only-event-chain]]).
+- The [[tariff]] fee function applies eligible validations when computing what's due at the pay
+  station: `due = max(0, tariff_fee − discounts)` (or time-based: subtract validated minutes before
+  pricing). Pure + reproducible, like the base fee.
+- The `payment` event then records gross fee, discount total, and net paid — so revenue reporting
+  ([[reporting-analytics]]) can show **discount leakage** (how much was given away, by whom).
+
+## How a validation is presented
+
+- **Merchant terminal / portal** stamps the customer's ticket id (or plate) — issues the validation
+  event for that session.
+- Or a **validation code** the customer enters at the pay station.
+- Either way it ties to the session by **ticket id or plate** ([[parking-session]] identity).
+
+## Anti-abuse
+
+Because each validation is signed and attributed (`issuedBy`), over-validation by a colluding
+merchant is **visible to [[reconciliation]]** (a merchant validating far more than their footfall is
+an anomaly), rather than invisible free parking.
+
+## Open
+
+- Validation types the site needs (free hours / fixed amount / percentage / flat rate).
+- Whether merchants self-serve (portal/terminal) or the operator applies it.
+- Caps (max discount, max per merchant/day).