wiki: design the business layer (session, tariff, permit, vision, shift, ops)

Pivot from the hardware/integrity layer to the parking operation. All
wiki-only; no code yet. Core principle throughout: business entities are
projections over the signed append-only event log, never mutable tables.

New concepts: parking-session, tariff (composable/versioned, FX-ready),
shift (manned-only Z-report), capacity-occupancy, validation-discounts,
reporting-analytics, clock-integrity, ticket-encoding, anti-passback.
New entities: permit, opencv-anpr-service, blocklist.
Decisions: session-model, vision-service (host-side ANPR + vehicle
verification; scoped AGPL exception for the isolated service).

Updates: append-only-event-chain (new event types + vision witness),
local-jwt-auth (drop 8h expiry -> until logout; code change pending),
lpr-camera (host-side recognition supersedes edge-AI), standing-decisions
(AGPL exception), open-questions (+FX, +pay-station money corners, backup).

Deferred + flagged: intercom/help-call, receipts/refunds/change, FX engine,
lane topology (#1).

wiki/decisions/open-questions.md

@@ -24,7 +24,12 @@ status: open
    manager visit) to reconcile the signed log against an external authority — the real anti-fraud
    control. See [[reconciliation]].
 5. **Durability / backup.** Backup strategy for the [[sqlite]] database + recovery plan; "sync
-   later" currently leaves a disk failure as **total revenue-history loss**.
+   later" currently leaves a disk failure as **total revenue-history loss**. _(Confirmed in-scope
+   to design, 2026-06-15.)_ Because the DB is the signed [[append-only-event-chain]], a backup must
+   preserve the chain intact (a restored copy must still `verifyChain`); options include SQLite
+   WAL/online-backup snapshots to a second disk/USB + the periodic external export that doubles as
+   the [[reconciliation]] channel (#4). Encryption at rest already applies ([[disk-os-hardening]]).
+   Design TBD.
 6. **Secure-element integration.** Confirm [[atecc608]] wiring/usage on the host (event
    signing). The [[esp32-custom-controller]] command-authentication use is **deferred — not
    being implemented for now** (access control is the [[dingtian-relay]] behind
@@ -39,3 +44,15 @@ status: open
    compromising a verifying host yields nothing that can forge a token. Decide before
    multi-host / multi-lane deployment (see #1 lane topology), since that's when shared-secret
    distribution becomes the liability.
+8. **Exchange-rate (FX) system.** _(Raised by the [[tariff]] design, 2026-06-15.)_ Currency is
+   selectable per tariff version and the money model is FX-ready (`payment` stores currency + a
+   reserved `fxRate`), but **no conversion is built**. If multi-currency pricing/charging is ever
+   needed, it requires an **offline** rate source (rates can't depend on the network —
+   [[offline-first]]), a base currency, and a rounding policy. Deferred; nothing blocks adding it
+   later without migrating stored amounts.
+9. **Pay-station money corners — receipts & refunds/change.** _(Raised by the scope sweep,
+   2026-06-15; deferred until pay-station hardware is chosen.)_ Not yet designed: **receipts / VAT
+   invoices** (fiscal receipt with tax number + sequential numbering may be legally required — could
+   change what the `payment` event must store) and **refunds / overpayment / change** (cash change,
+   "exact change only", a refund as a signed reversal event). Both depend on the unmanned-vs-manned
+   payment subsystem (#3) and the note/coin/card acceptor hardware. Revisit at procurement.