feat(booth): refusal snapshots, subscriber access medium, one-car-one-ticket entry

Three booth-integrity improvements that share the entry/exit flows and activity log.

Refusal snapshots: previously only an accepted open captured a camera image; now
every refusal/hold anomaly fires the directional camera too (a turned-away car is
exactly the evidence wanted) — entry refused-full/held, exit refused
closed/no-session/unpaid/grace-expired (booth + reader paths), refused subscription.
A refused entry has no ticket id, so a synthetic REFUSED- ref keys the anomaly + photo
together. Same fire-and-forget contract; failed captures still show as tiles.

Subscriber access medium: the subscription flow already signed `via`
(qr|card|plate) into entry/exit payloads; surface it as a typed LedgerPayload.via, a
cyan chip in the ticker, and an "Entry medium" modal row (sq+en). Display-only.

One car = one ticket: the entry button could be mashed to mint many tickets per car
(corrupting occupancy + enabling ticket-shopping at exit) — the old #inFlight guard
only blocked overlapping presses. Add a per-relay guard configured on the relay spec:
PRESENCE mode (presenceInput ties ticketing to a vehicle loop on a Dingtian input —
one ticket per car, re-armed when the loop clears) or COOLDOWN fallback
(entryCooldownSec) when there's no barrier feedback. A suppressed press is unsigned
device_events telemetry, not a signed anomaly. SetupWizard exposes both fields.
Fail-closed entry and barrier-is-not-a-door invariants untouched; guard state is
in-memory/rebuildable, starts armed after restart.

Wiki: new entry-double-press; updated entry-exit-points, booth-console, index.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/booth-console.md

@@ -90,6 +90,18 @@ what happened." Now every event is **self-describing and clickable**:
   operator can tell "no camera" from "camera failed". (Surfaced a real incident: a subscriber's entry
   snapshot failed `EHOSTUNREACH` while the exit one succeeded — by design a snapshot is *evidence, not
   a gate*, so the open proceeded and only the image was missing.)
+- **Subscriber access medium (`via`).** A subscription entry/exit row now shows HOW the subscriber was
+  identified — **QR code / RFID card·chip / plate** — as a cyan chip in the ticker and a labelled
+  "Entry medium" row in the detail modal. The flow already signed `via` (`"qr"|"card"|"plate"`) into
+  the [[subscription]] entry/exit payload; this just surfaces it (a lost-card investigation can now see
+  which credential opened a barrier). Rides the existing localized-display pattern, not a new signed
+  field.
+- **Refused entry/exit now carry a snapshot too (2026-06-19).** Previously only an *accepted* open
+  captured an image. Now refusal/hold anomalies fire the directional camera as well (the photo of a
+  turned-away car is exactly the evidence an operator/auditor wants) — so the detail modal's snapshot
+  strip is populated for "lot full", unpaid-exit, no-session, and refused-subscription events. See
+  [[entry-exit-points]] for the coverage list and the synthetic `REFUSED-…` key used when a refused
+  entry has no ticket id.
 
 ## The shift control (header) + the booth gate
 

wiki/concepts/entry-double-press.md

@@ -0,0 +1,90 @@
+---
+type: concept
+tags: [parking, entry, anti-fraud, safety, devices]
+sources: []
+updated: 2026-06-19
+status: open
+---
+
+# One car = one ticket (entry anti-double-press)
+
+A transient [[parking-session|entry]] is a button press → print a ticket → sign a `vehicle_entry`
+→ open the barrier. **Nothing stopped a driver pressing the button repeatedly** and minting a fresh
+ticket each time — a real flaw found 2026-06-19. The damage is threefold:
+
+- **Ticket spam.** One car walks away with a fistful of tickets.
+- **Occupancy corruption.** Each press signs a `vehicle_entry`, so [[capacity-occupancy|occupancy]]
+  (a fold over open sessions) counts one car as many — the lot reads "full" with empty spaces.
+- **Ticket-shopping at exit.** With several open sessions for the same car, the driver pays the
+  cheapest and exits on it; the rest linger. A direct [[threat-model|booth/customer]] abuse.
+
+The old `#inFlight` guard only blocked *overlapping* presses (it released in `finally`), so
+press → print → press again issued a second ticket immediately. That is not enough.
+
+## The fix is PER-RELAY CONFIG, chosen by available barrier feedback
+
+The guard lives on the entry relay's spec (`config.relays[]` — see [[entry-exit-points]]), because
+whether real one-car-one-ticket is *possible* depends on the hardware at that lane. Two modes:
+
+### PRESENCE mode (preferred — when a vehicle loop is wired)
+`relays[].presenceInput` = the 1-based input terminal of an **induction loop / barrier presence
+signal** on the same [[dingtian-relay|controller]] (the Dingtian's inputs are decoupled from its
+relays, and loops are already in the [[bom]]). The rule makes one-car-one-ticket **physical**:
+
+- A press prints **only while a car is present** on the loop.
+- After a ticket prints, the relay is **disarmed** — no second ticket — **until the loop CLEARS**
+  (the car drove through = it entered) **and a new car re-occupies** it.
+
+So mashing the button while sitting on the loop does nothing; a *new* car must physically arrive
+before another ticket can issue. The flow observes the loop's input edges (both directions) to track
+`present` + `armed` per relay. This is how real lanes behave.
+
+### COOLDOWN mode (fallback — no barrier feedback)
+When no loop is wired, `relays[].entryCooldownSec` suppresses repeat presses on that relay for N
+seconds after a ticket (default unset = no guard; a sensible value is ~10–12 s — long enough for the
+car to pull through, short enough not to block the next legitimate car). It is a **timer, a
+mitigation, not a guarantee** — a determined abuser can wait it out. Use it only where presence
+feedback isn't available; prefer wiring a loop.
+
+The two can coexist (presence first, cooldown as a backstop), but presence is authoritative when set.
+
+## A suppressed press is a NO-OP, not an anomaly
+
+A blocked/repeat press is recorded as **unsigned [[device-events|telemetry]]** (a `device_events`
+`kind:"input"` row with `entrySuppressed:true` + the reason), **not** a signed ledger anomaly. It
+isn't fraud — it's the system correctly refusing to double-issue — so it stays out of the immutable
+chain and off the red activity-log feed. (Operator's call, 2026-06-19.) The press is still auditable
+in telemetry if ever needed.
+
+## Invariants preserved
+
+- **Fail-closed entry is untouched.** A suppressed press simply does nothing; the printer-down HOLD
+  path ([[append-only-event-chain]]) and the [[fail-state-safety]] rules are unchanged.
+- **The barrier is still intent-only.** No timed close; presence is only a *gate on ticketing*, not
+  a barrier-close trigger ([[barrier-not-a-door]]).
+- **State is in-memory + rebuildable.** The per-relay `armed/present` map is runtime state on the
+  host (single-writer); it is derived from live input edges, never the source of truth. A restart
+  starts armed (the first press after a restart works), which is the safe default.
+
+## As-built (2026-06-19)
+
+- `RelaySpec` gains `presenceInput?` + `entryCooldownSec?` (`device-resolve.ts`); `relayForButton`
+  carries them onto the `ResolvedRelay`, and a new `relayForPresence()` resolves a loop-input edge to
+  the entry relay it gates.
+- `EntryFlow` (`entry-flow.ts`) keeps a `#guard` map keyed `controllerId:relay`: `#onPresenceEdge`
+  tracks the loop, `#suppressReason` decides presence/cooldown, `#recordSuppressedPress` writes the
+  telemetry. The guard disarms + stamps the cooldown on **print success** (not on open).
+- [[first-run-setup|SetupWizard]] relay editor: entry/both relays expose a **Presence loop
+  (terminal)** field and, when no loop is set, a **Cooldown after ticket (s)** field (localized
+  sq+en — see [[i18n]]).
+
+## Open
+
+- **No automated test yet** (the standing harness gap) — verify on hardware: with a loop, a held
+  button issues one ticket; after the car clears the loop a new car gets a fresh one. Without a loop,
+  a cooldown blocks the repeat and the suppressed press lands in telemetry.
+- **Exit side:** the symmetric concern (re-reading a ticket at exit) is already handled differently —
+  exit validates against an open session, so a second read finds the session closed (no double-exit).
+  No presence gate needed there today.
+- **Loop as a safety/anti-tailgate signal** is a larger future use of the same input (free-exit
+  detection is noted in [[bom]]); this change uses it only to gate ticketing.

wiki/concepts/entry-exit-points.md

@@ -30,6 +30,9 @@ config: {
 - `direction`: `entry` | `exit` | `both` (`both` = one barrier/relay serving in and out).
 - `button`: the **input terminal** the transient **entry button** is wired to. Only entry/both
   relays have one. Absent = no button at that barrier (subscriber/reader-driven only).
+- `presenceInput` / `entryCooldownSec`: the **one-car-one-ticket** guard for the entry button —
+  `presenceInput` is the input terminal of a vehicle-presence loop (physical guard), or
+  `entryCooldownSec` a fallback timer when there's no barrier feedback. See [[entry-double-press]].
 
 The four real layouts all fall out of this:
 
@@ -103,6 +106,18 @@ backed-up DB, nothing scattered on disk), in its own table so hot telemetry scan
 bytes and images prune independently. Linked to the signed `vehicle_entry/exit` by `identity`.
 Served read-only via `GET /api/snapshots/:id`. **Retention is unresolved** — see [[open-questions]].
 
+### Refused entry/exit ALSO snapshots (2026-06-19)
+A snapshot is evidence of **who was at the barrier** — which matters *most* when the barrier is
+**refused** (a turned-away car is a fraud/dispute signal: "lot full" denial, an unpaid exit attempt,
+a no-session ticket, an out-of-window subscription). Originally only the OPEN paths captured; now
+**every refusal/hold anomaly fires the directional camera too**, keyed to the same `identity` the
+anomaly carries so the [[booth-console|activity-log]] evidence strip finds it. Coverage: entry
+refused-full / held-no-ticket (a refused entry has no ticket id → mint a synthetic `REFUSED-…` ref
+to key the anomaly + photo together), exit refused closed/no-session/unpaid/grace-expired (booth
+*and* reader paths), and a refused [[subscription]] (the lane the reader sits at picks the camera).
+Same fire-and-forget contract — a refusal is never delayed by a camera. Failed captures still surface
+as "⚠ camera unreachable" tiles (see [[booth-console]]).
+
 ## Related
 
 [[entry-exit-readers]] · [[device-events]] · [[parking-session]] · [[anti-passback]] ·

wiki/index.md

@@ -75,6 +75,7 @@ Counts: 4 sources · 19 entities · 44 concepts · 5 decision records.
 - [[challenge-response-auth]] — asymmetric nonce scheme for the ESP32 (auth + anti-replay).
 - [[entry-exit-readers]] — two populations, two integration paths; both can share a relay.
 - [[entry-exit-points]] — pool-of-spaces model (no lane); per-relay direction, reader→relay binding, camera snapshots.
+- [[entry-double-press]] — one car = one ticket: per-relay presence-loop gate (preferred) or cooldown fallback; suppressed press = telemetry.
 - [[uhppote-vs-esp32]] — comparison: detection vs. prevention.
 
 ## Concepts — business domain