Files

T

julian 1efa77bf56 devices: pool-of-spaces model — drop lane, per-relay direction

A parking lot is one pool of spaces with a flexible set of entry/exit
points — no "lane". Direction is a property of each RELAY inside an access
controller; readers/cameras bind to a controller relay and inherit it.

Schema:
- drop `lane` from ledger_events, device_events, sessions
- rename lane_devices -> devices (no lane/direction columns)
- access config.relays=[{relay,direction,button?}]; reader/camera
  config.controllerId+relay binding
- fresh 0000_baseline migration (history reset; dev data was throwaway)

Signed ledger:
- remove `lane` from canonicalize(); bump signer keyId sw-hmac-v1 -> v2
  (v1 events won't verify under v2 — intentional, gated per-event by keyId)

Server:
- new device-resolve.ts (replaces lane-map.ts): relayForButton,
  relayForDevice, firstRelayByDirection, devicesByDirection
- entry-flow: button terminal -> its relay; exit/permit: reader's bound
  relay; dispatcher resolves the bound relay + inherited direction
- camera snapshots fire by direction site-wide, async, never block open
- DeviceConfig widened to nested JSON for relays[]

Web:
- wizard: no lane selector; add controllers (relay map + entry-button
  terminal) first, then bind readers/cameras/printers to a controller relay

Wiki: new entry-exit-points.md (replaces lane-direction); reworked
entry-exit-readers, parking-session, first-run-setup, device-registry,
append-only-event-chain, device-events; removed stale lane/LaneMap mentions.

2026-06-16 20:29:38 +02:00

1.9 KiB

Raw Blame History

type, tags, sources, updated, status

type

Device Events (telemetry)

The unsigned operational record of what the hardware did and reported — distinct from the signed business append-only-event-chain (see event-streams-split). For monitoring, diagnostics, and live booth status — not anti-fraud.

What lands here

Relays/barriers: relay fired/released, pulseOpen issued (the device-side echo; the authoritative barrier_open_command is a signed ledger event).
Printers: paper-out / near-end / cover-open / cutter / offline (already polled — printer-status-monitoring).
Cameras: reachable/offline, snapshot success/failure (lpr-camera).
Readers / inputs: a raw read, raw input edges (Dingtian button input N on/off — device-input-flow).

Properties

Unsigned, not chained — no prevHash/signature. It's telemetry, so it carries none of the ledger's integrity machinery.
Disposable — high-volume and churny; may rotate/prune on a retention policy (the ledger never does).
Device-keyed — references the devices instance (raw device provenance). No lane (pool-of-spaces model — see entry-exit-points).

The boundary that matters

A device event is evidence the host saw something happen; it does not by itself authorize or record a business fact. A button press here becomes a signed vehicle_entry in the ledger only after the entry flow runs (ticket + barrier command). This keeps device chatter on the device side of the device-adapter-pattern and the signed ledger focused on money/access.

Open

Retention/rotation policy (size- or age-based).
Whether any witness-grade device fact (e.g. a loop-sensor barrier_open_observed) should also write a signed ledger entry for reconciliation — see append-only-event-chain.

1.9 KiB Raw Blame History