julian
8a8e74561d
Pivot from the hardware/integrity layer to the parking operation. All wiki-only; no code yet. Core principle throughout: business entities are projections over the signed append-only event log, never mutable tables. New concepts: parking-session, tariff (composable/versioned, FX-ready), shift (manned-only Z-report), capacity-occupancy, validation-discounts, reporting-analytics, clock-integrity, ticket-encoding, anti-passback. New entities: permit, opencv-anpr-service, blocklist. Decisions: session-model, vision-service (host-side ANPR + vehicle verification; scoped AGPL exception for the isolated service). Updates: append-only-event-chain (new event types + vision witness), local-jwt-auth (drop 8h expiry -> until logout; code change pending), lpr-camera (host-side recognition supersedes edge-AI), standing-decisions (AGPL exception), open-questions (+FX, +pay-station money corners, backup). Deferred + flagged: intercom/help-call, receipts/refunds/change, FX engine, lane topology (#1).
2.3 KiB
2.3 KiB
type, tags, sources, updated, status
| type | tags | sources | updated | status | |||||
|---|---|---|---|---|---|---|---|---|---|
| concept |
|
2026-06-15 | open |
Anti-Passback
Stop one credential/ticket from getting two cars in without an exit between — the classic "pass the card/ticket back over the fence" abuse. A control on the entry validation, leaning on the session projection.
The rule
An identity (ticket id, permit credential, or plate) must not enter while it already has an OPEN parking-session. At entry:
identify vehicle → is there already an OPEN session for this id?
no → proceed (mint vehicle_entry, open)
yes → passback violation → refuse or flag (see policy)
This is a fold over the signed append-only-event-chain ("does an entry for this id exist
with no matching exit?") — not a mutable in/out flag that could be edited. Same projection that
powers capacity-occupancy and permit maxConcurrent.
Interaction with the limits already designed
- Transient ticket — a single ticket id is inherently one session; a second entry on the same id is always a violation (or a re-print/duplication attempt).
- Permit — passback is the per-car case of the permit's
maxConcurrent(permit): a multi-car permit legitimately has several open sessions, but the same car/credential entering twice is still a violation. So enforce per-identity, under the permit's concurrency allowance.
Policy (operator choice)
- Hard — refuse the second entry (strict; risks stranding a legitimate car after a missed exit, which is common — tailgated out, sensor missed).
- Soft — allow but flag an
anomaly(the type exists) for review. Safer against false-positives from missed exits, consistent with the append-only "record + flag, don't block" ethos elsewhere. - Likely soft by default, hard as an opt-in for high-control sites.
Honest limits
- Depends on reliable exit detection — if exits are routinely missed (no exit loop/plate read), passback produces false positives; tune to the site's exit fidelity.
- A spoofed/duplicated ticket QR is caught here (same id already open) — complements ticket-encoding's opaque-id requirement.
Open
- Default policy (soft/hard) and per-site override.
- Grace for legitimate quick re-entry vs. the missed-exit false-positive.