feat(vision): vehicle stage, phase A — YOLOX-S (Apache-2.0 ONNX) beside the plate recognizer

Fills /analyze vehicle.body_type + confidence (car / motorcycle / bus / truck from COCO,
mapped to the shared vocabulary) for the Car Wash desk's category suggestion
(venue-modules.md §Vehicle category from vision). Advisory: the operator decides, a
confident downgrade is flagged, nothing is gated on it.

- vision_service/vehicle.py: pure numpy/cv2 letterbox (pad 114, raw BGR), stride-grid
  decode, class-agnostic NMS, one vehicle per frame (the box holding the plate's centre,
  else the largest); YoloxVehicleDetector on onnxruntime CPU, 2 intra-op threads.
- recognizer.py: WithVehicle composes the stage over any plate recognizer (stub included);
  a failing stage yields vehicle=null + a "vehicle: …" note in /health.detail — never
  costs the plate read. model_version reads "<plate>+yolox:yolox_s.onnx@640".
- settings: VISION_VEHICLE_MODEL_PATH (unset = off), _INPUT_SIZE (640), _MIN_CONFIDENCE
  (0.4, the detector's floor; the flag threshold is site config).
- Dockerfile bakes yolox_s.onnx (best-effort curl at build; no network → stage off) and
  sets the path; compose forwards it (empty = off); .env.example documents it.
- Measured on four real dev entry frames (DS-2CD1047G3H, 2560×1440): car at 0.83–0.88 in
  ~240–330 ms; empty lane with a person → none.
- tests/test_vehicle.py: decode/NMS/pick/letterbox on synthetic tensors, the composition,
  and a missing-model /health. Wiki: opencv-anpr-service, venue-modules, log.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

wiki/decisions/venue-modules.md

@@ -188,11 +188,13 @@ onto the site's own categories ("car, sedan, hatchback → Vetura").
   and the read is at or above the threshold → one `anomaly` (`carwash.categoryDowngrade`, both
   categories, both prices, operator, snapshotId) and `downgrade_event_id` on the order. Equal,
   upgrade, unsure or unmapped reads flag nothing. The order is always created.
-- **Model — NOT built.** No bundled recognizer produces `body_type` yet, so today the desk shows
-  nothing and nothing is flagged. Phase A = a COCO detector on Apache-2.0 ONNX weights (car /
-  truck / bus / motorcycle, plus the vehicle crop); Phase B = the body-type classifier trained on
-  the pilot's own frames — every wash order is a labelled frame (entry snapshot + the category a
-  person chose), so the dataset builds itself on park-2. Reports (discrepancies per operator per
+- **Model — phase A built (same day).** YOLOX-S (Apache-2.0 ONNX) as a vehicle stage beside the
+  plate recognizer: car / truck / bus / motorcycle + the vehicle crop, ~250 ms per entry frame on
+  CPU, weights baked into the vision image. Details and measurements on [[opencv-anpr-service]]
+  §Vehicle body type. Phase B = the body-type classifier trained on the pilot's own frames —
+  every wash order is a labelled frame (entry snapshot + the category a person chose), so the
+  dataset builds itself on park-2. Until then a Vetura/SUV list sees every car as Vetura and no
+  downgrade fires; van/truck/bus/motorcycle do separate. Reports (discrepancies per operator per
   shift) wait for the first real reads.
 
 ## Car Wash — the pilot module (settled 2026-09-05)

wiki/entities/opencv-anpr-service.md

@@ -249,11 +249,36 @@ service's `/health` each tick and shows a **"Vision" chip** in the booth footer
 - Per-camera **opt-in** — ✅ **built**: `config.anpr === true` enables ANPR on a camera (set via the
   SetupWizard checkbox); ANPR then runs on that camera's entry/exit snapshot.
 
-## Vehicle body type (advisory) — contract only, 2026-09-06
+## Vehicle body type (advisory) — the vehicle stage, phase A (2026-09-06)
 
-`/analyze` may now populate `vehicle.body_type` + `vehicle.confidence` from the shared vocabulary
+`/analyze` populates `vehicle.body_type` + `vehicle.confidence` from the shared vocabulary
 (car, sedan, hatchback, suv, minivan, pickup, van, truck, bus, motorcycle). Node records it beside
 the plate and the Car Wash desk pre-selects the category the site maps it to; the operator
-decides, a confident downgrade is flagged, nothing is gated on it. No bundled recognizer emits
-it yet — see [[venue-modules]] §Vehicle category from vision for the model plan (COCO detector
-first, body-type classifier on own frames second).
+decides, a confident downgrade is flagged, nothing is gated on it ([[venue-modules]] §Vehicle
+category from vision).
+
+**Phase A = YOLOX-S (Megvii, Apache-2.0) as ONNX** on the same ONNX Runtime the plate stage uses
+— the licence rule that keeps Ultralytics (AGPL) out. `vision_service/vehicle.py`: pure numpy/cv2
+letterbox (pad 114, raw 0–255 BGR — YOLOX's exported graphs are not normalised), stride-grid
+decode, class-agnostic NMS, COCO `car/motorcycle/bus/truck` → the vocabulary, and ONE vehicle per
+frame: the box holding the plate's centre when a plate was read (the car that was read, not the
+one behind), else the largest box. `WithVehicle` in `recognizer.py` wraps whichever plate
+recognizer runs (stub included, so the stage is testable without fast-alpr); a failing stage
+yields `vehicle: null` and a `vehicle: …` note in `/health.detail` — it never costs the plate
+read. Composed `model_version` reads `<plate>+yolox:yolox_s.onnx@640`.
+
+- **Config:** `VISION_VEHICLE_MODEL_PATH` (unset = stage off), `VISION_VEHICLE_INPUT_SIZE` (640),
+  `VISION_VEHICLE_MIN_CONFIDENCE` (0.4 — the detector's floor; the SITE threshold that decides a
+  flag lives in Setup → Car wash). The Docker image bakes the weights at `/app/models/yolox_s.onnx`
+  (best-effort curl at build; no network → stage off) and sets the path, so the air-gapped
+  appliance never fetches at runtime and no operator-writable path holds a model
+  ([[vision-service-hardening]]). Compose forwards the var; set it EMPTY in the stack env to
+  switch the stage off. Locally: curl the release file into `apps/vision/models/` (gitignored).
+- **Measured on dev (2026-09-06), four real 2560×1440 entry frames from the DS-2CD1047G3H:** three
+  with a car → `car` at 0.83–0.88, ~240–330 ms each on the dev CPU with 2 intra-op threads; the
+  empty-lane frame with a person at the camera → no vehicle (correct: a person is not a class we
+  keep). One frame per entry, so the cost is invisible to the lane.
+- **What it cannot do:** SUV vs sedan — COCO has one `car`. For a Vetura/SUV price list every car
+  maps to Vetura and no downgrade fires; vans, trucks, buses and motorcycles do separate. Phase B
+  (a body-type classifier on the pilot's own frames — every wash order is a labelled frame) is
+  what closes that gap; the detector's box is the crop it will classify.

wiki/log.md

@@ -3091,3 +3091,12 @@ category + threshold; the desk pre-selects the mapped category and shows the rea
 a confident, pricier-mapped read with a cheaper choice signs `anomaly carwash.categoryDowngrade`
 (both categories/prices, operator, snapshot) — never blocks. No recognizer emits body_type yet.
 Tests in carwash.test.ts. Updated [[venue-modules]] (As built), [[opencv-anpr-service]].
+
+## [2026-09-06] ingest | Vision vehicle stage, phase A: YOLOX-S beside the plate recognizer
+`vision_service/vehicle.py` (YOLOX ONNX on onnxruntime: letterbox, grid decode, NMS, COCO
+car/motorcycle/bus/truck → vocabulary, one vehicle per frame — the box holding the plate, else the
+largest) + `WithVehicle` composition over any plate recognizer; `VISION_VEHICLE_MODEL_PATH` (unset =
+off), input size, detector floor; Dockerfile bakes yolox_s.onnx (best-effort curl) and sets the
+path; compose forwards it (empty = off). Measured on four real dev entry frames: car at 0.83–0.88,
+~240–330 ms, empty lane → none. Tests: tests/test_vehicle.py (pure post-processing + composition +
+missing-model health). Updated [[opencv-anpr-service]], [[venue-modules]].