wiki: split signed business ledger from device telemetry

Correction before schema work: the events table conflated the anti-fraud
business ledger with device telemetry. Decision: ledger_events (signed,
chained, reconciled) holds only business facts; device_events (unsigned,
prunable) holds relay/printer/camera/reader/input telemetry. A raw button
press is telemetry; the entry flow mints a signed vehicle_entry. Drops
input_received-as-signed-event.

New: decisions/event-streams-split, concepts/device-events; updated
append-only-event-chain, index, log.

wiki/log.md

@@ -469,3 +469,20 @@ guarantee. Recorded in [[dingtian-relay]] (new Hardening section).
   procurement (may change what the `payment` event stores → flagged before schema).
 - Still open & load-bearing: **lane topology** (#1) — not resolved; scopes sessions/occupancy/shifts.
 - Updated [[open-questions]] (#9), [[index]].
+
+## [2026-06-15] decision | Split signed business ledger from device telemetry
+- User correction before schema: the `events` table conflated TWO things — the anti-fraud business
+  ledger AND device telemetry (button pushes as `input_received`). Split them.
+- `ledger_events` (rename of `events`): signed, hash-chained, ATECC608-signed business facts only
+  (vehicle_entry/exit, payment, void, shift_z_report + witness barrier_open_command/observed,
+  anomaly). Reconciliation + session/tariff/occupancy projections run on this.
+- `device_events` (new, [[device-events]]): UNSIGNED hardware telemetry (relay fired, paper-out,
+  camera offline, reader read, raw input edges); high-volume, may rotate/prune; never reconciled.
+- A raw button press is telemetry → device_events; the entry flow then mints a SIGNED vehicle_entry.
+  So `input_received`-as-signed-event is dropped (was transitional). No prod chain data exists, so
+  the rename/restructure is safe now (no signatures to invalidate).
+- New: decision [[event-streams-split]], concept [[device-events]]; updated [[append-only-event-chain]]
+  (two streams + as-built-vs-pending), [[index]].
+- NEXT (schema): rename events→ledger_events; add device_events; split ParkingEventType in shared;
+  then tariffs/versions, permits, blocklist, sessions projection. EventLog/canonicalize/verifyChain
+  + /api/events follow the rename (code refactor, separate from this wiki commit).