feat(carwash): review outbox, booth side — plate-blurred vehicle crop + the operator's choice, queued for a trusted remote reviewer

The operator's category choice is a hypothesis, not truth (user, 2026-09-06): each wash
order with a vehicle read queues a package for a trusted reviewer over the private overlay
(Netbird); the verdict becomes the phase-B training label and the per-operator error rate.
wiki/concepts/vision-review-outbox.md.

- Boxes: the vision service returns the vehicle bbox; snapshot.ts stores the vehicle and
  plate boxes on the read as FRACTIONS of the analysed frame (the stored snapshot is a
  downscaled copy); vehicleForIdentity() returns them.
- carwash_review_outbox (migration 0031) + review-outbox.ts: crop = detector box + 8 %
  margin, ≤ 640 px, plate blurred in place from the plate box; payload carries a
  pseudonymous booth id and a keyed operator hash — no site name, no plate, no OSD, no
  bystanders; multipart POST with a per-booth bearer; 2xx → sent (image dropped);
  400/404/413/415/422 → abandoned; anything else → backoff 1 min·2^n capped 6 h; voided
  orders and items older than 14 days abandoned unsent. Nothing queued while unconfigured.
- Enqueue is fire-and-forget off the intake path in createOrder; the loop runs every
  CARWASH_REVIEW_INTERVAL_SEC (60) and stops on close.
- GET /api/carwash/review/status (site:read) + a "Remote review" line in Setup → Car wash.
- Env CARWASH_REVIEW_URL / _TOKEN / _BOOTH_ID (all three or off) documented in
  .env.example and forwarded by compose.
- Tests: review-outbox.test.ts (crop + blur on a synthetic frame, config/pseudonyms,
  queue/drain/backoff/abandon, through the app). Wiki: new concept page, index,
  venue-modules As built, log. The collector is not built.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

packages/db/drizzle/0031_carwash_review_outbox.sql

@@ -0,0 +1,17 @@
+-- Car Wash review outbox (wiki/concepts/vision-review-outbox.md): plate-blurred vehicle
+-- crops + the operator's category choice, queued for a trusted remote reviewer and drained
+-- one-way over the private overlay. The image is cleared once delivered.
+CREATE TABLE `carwash_review_outbox` (
+	`id` text PRIMARY KEY NOT NULL,
+	`order_id` text NOT NULL,
+	`created_at` text NOT NULL,
+	`status` text DEFAULT 'queued' NOT NULL,
+	`attempts` integer DEFAULT 0 NOT NULL,
+	`next_attempt_at` text,
+	`last_error` text,
+	`sent_at` text,
+	`image` blob,
+	`payload` text NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `carwash_review_outbox_status_idx` ON `carwash_review_outbox` (`status`,`next_attempt_at`);

packages/db/drizzle/meta/_journal.json

@@ -218,6 +218,13 @@
       "when": 1788700000000,
       "tag": "0030_carwash_vision",
       "breakpoints": true
+    },
+    {
+      "idx": 31,
+      "version": "6",
+      "when": 1788710000000,
+      "tag": "0031_carwash_review_outbox",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema.ts

@@ -746,6 +746,26 @@ export const carwashConfig = sqliteTable("carwash_config", {
   updatedBy: text("updated_by"),
 });
 
+/** Car Wash REVIEW OUTBOX (wiki/concepts/vision-review-outbox.md): the operator's category
+ *  choice is a hypothesis, not truth — each wash order with a vehicle read queues a
+ *  plate-blurred vehicle CROP + the choice for a trusted remote reviewer, drained one-way
+ *  over the private overlay when it is up. Never blocks the wash; nothing that names the
+ *  site leaves the booth. The image is dropped once delivered. */
+export const carwashReviewOutbox = sqliteTable("carwash_review_outbox", {
+  id: text("id").primaryKey(),
+  orderId: text("order_id").notNull(),
+  createdAt: text("created_at").notNull(),
+  status: text("status", { enum: ["queued", "sent", "failed"] }).notNull().default("queued"),
+  attempts: integer("attempts").notNull().default(0),
+  nextAttemptAt: text("next_attempt_at"),
+  lastError: text("last_error"),
+  sentAt: text("sent_at"),
+  /** The JPEG crop (plate blurred). Null once sent. */
+  image: blob("image").$type<Buffer>(),
+  /** What the collector receives beside the image (no site name, no plate, no operator name). */
+  payload: text("payload", { mode: "json" }).$type<Record<string, unknown>>().notNull(),
+});
+
 export type CarwashCategoryRow = typeof carwashCategories.$inferSelect;
 export type CarwashServiceRow = typeof carwashServices.$inferSelect;
 export type CarwashPriceRow = typeof carwashPrices.$inferSelect;

packages/shared/src/index.ts

@@ -2050,6 +2050,23 @@ export interface VehicleRead {
   readonly bodyType: VehicleClass;
   readonly confidence: number;
   readonly snapshotId: string | null;
+  /** The vehicle's box and the plate's box as FRACTIONS of the frame (0–1), so they fit
+   *  any resized copy of the snapshot. Absent on reads made before boxes were kept. */
+  readonly box?: NormBox | null;
+  readonly plateBox?: NormBox | null;
+}
+
+/** A box as fractions of the frame it was found in (x1,y1 top-left; 0–1). */
+export interface NormBox {
+  readonly x1: number;
+  readonly y1: number;
+  readonly x2: number;
+  readonly y2: number;
+}
+export function isNormBox(v: unknown): v is NormBox {
+  if (!v || typeof v !== "object") return false;
+  const b = v as Record<string, unknown>;
+  return ["x1", "y1", "x2", "y2"].every((k) => typeof b[k] === "number" && (b[k] as number) >= 0 && (b[k] as number) <= 1);
 }
 
 export interface CarwashSettingsView {