wiki: split signed business ledger from device telemetry

Correction before schema work: the events table conflated the anti-fraud
business ledger with device telemetry. Decision: ledger_events (signed,
chained, reconciled) holds only business facts; device_events (unsigned,
prunable) holds relay/printer/camera/reader/input telemetry. A raw button
press is telemetry; the entry flow mints a signed vehicle_entry. Drops
input_received-as-signed-event.

New: decisions/event-streams-split, concepts/device-events; updated
append-only-event-chain, index, log.

wiki/concepts/device-events.md

@@ -0,0 +1,45 @@
+---
+type: concept
+tags: [parking, devices, monitoring, telemetry]
+sources: []
+updated: 2026-06-15
+status: open
+---
+
+# Device Events (telemetry)
+
+The **unsigned** operational record of what the hardware did and reported — distinct from the
+signed business [[append-only-event-chain|ledger]] (see [[event-streams-split]]). For monitoring,
+diagnostics, and live booth status — **not** anti-fraud.
+
+## What lands here
+
+- **Relays/barriers:** relay fired/released, pulseOpen issued (the *device-side* echo; the
+  authoritative `barrier_open_command` is a signed ledger event).
+- **Printers:** paper-out / near-end / cover-open / cutter / offline (already polled —
+  [[printer-status-monitoring]]).
+- **Cameras:** reachable/offline, snapshot success/failure ([[lpr-camera]]).
+- **Readers / inputs:** a raw read, raw input edges (Dingtian button `input N on/off` —
+  [[device-input-flow]]).
+
+## Properties
+
+- **Unsigned, not chained** — no `prevHash`/`signature`. It's telemetry, so it carries none of the
+  ledger's integrity machinery.
+- **Disposable** — high-volume and churny; **may rotate/prune** on a retention policy (the ledger
+  never does).
+- **Device-keyed** — references the `lane_devices` instance; `lane` resolved via the same `LaneMap`
+  as before. Stores raw device provenance.
+
+## The boundary that matters
+
+A device event is *evidence the host saw something happen*; it does **not** by itself authorize or
+record a business fact. A button press here becomes a **signed `vehicle_entry`** in the ledger only
+after the entry flow runs (ticket + barrier command). This keeps device chatter on the device side
+of the [[device-adapter-pattern|adapter boundary]] and the signed ledger focused on money/access.
+
+## Open
+
+- Retention/rotation policy (size- or age-based).
+- Whether any witness-grade device fact (e.g. a loop-sensor `barrier_open_observed`) should *also*
+  write a signed ledger entry for [[reconciliation]] — see [[append-only-event-chain]].