wiki: design the business layer (session, tariff, permit, vision, shift, ops)

Pivot from the hardware/integrity layer to the parking operation. All
wiki-only; no code yet. Core principle throughout: business entities are
projections over the signed append-only event log, never mutable tables.

New concepts: parking-session, tariff (composable/versioned, FX-ready),
shift (manned-only Z-report), capacity-occupancy, validation-discounts,
reporting-analytics, clock-integrity, ticket-encoding, anti-passback.
New entities: permit, opencv-anpr-service, blocklist.
Decisions: session-model, vision-service (host-side ANPR + vehicle
verification; scoped AGPL exception for the isolated service).

Updates: append-only-event-chain (new event types + vision witness),
local-jwt-auth (drop 8h expiry -> until logout; code change pending),
lpr-camera (host-side recognition supersedes edge-AI), standing-decisions
(AGPL exception), open-questions (+FX, +pay-station money corners, backup).

Deferred + flagged: intercom/help-call, receipts/refunds/change, FX engine,
lane topology (#1).

wiki/entities/blocklist.md

@@ -0,0 +1,35 @@
+---
+type: entity
+tags: [parking, domain, business, access-control]
+sources: []
+updated: 2026-06-15
+status: open
+---
+
+# Blocklist (Banlist)
+
+Plates or credentials the lot **refuses** — barred vehicles (non-payers, abusers, court orders) and
+revoked/stolen cards. Checked in the entry flow.
+
+## Model
+
+- A `blocklist` table of `{ kind: 'plate' | 'card' | 'qr', value, reason, addedBy, addedAt }` —
+  admin-managed master data (mutable: add/lift a ban).
+- **Entry check:** after identifying the vehicle ([[parking-session]] identity — plate via
+  [[opencv-anpr-service|vision]]/LPR, or card/QR), if it matches an active blocklist entry, **refuse
+  entry** and append a signed event (`anomaly` / a refused-entry record) so the attempt is logged.
+- **Exit is never blocked** — a barred car already inside must still leave ([[fail-state-safety]]:
+  never trap a vehicle). A blocklist hit at exit is logged for follow-up, not used to detain.
+
+## Notes
+
+- Plate matching depends on capture quality — a blocklist-by-plate is only as good as the
+  [[opencv-anpr-service|vision]] read; treat a near-miss as a flag for a human, not an automatic
+  refusal that could strand a misread innocent car.
+- Bans are attributed (`addedBy`) and their enforcement is logged, so the control is auditable
+  ([[reconciliation]]) rather than an invisible operator lever.
+
+## Open
+
+- Plate-match tolerance (exact vs. fuzzy) and the false-positive handling.
+- Expiry / review of bans.