docs(wiki): capture cloud-service SaaS requirements (postponed)

Multi-tenant SaaS layered on the offline model: link-up monitoring of the
signed ledger, device status, financials; one admin → many sites; per-site
secret custody; recurring fee. Records the four tensions, the confirmed
secrets boundary (sync creds + device-password escrow + app identity, NOT
the signing key), and the two in-discussion corrections that stand (NetBird
already solves booth isolation; remote barrier-open is pulseOpen-and-signed,
driven by the unmanned future). status: open, postponed.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -2540,3 +2540,23 @@ to no reset-db category, silently surviving even `--all`. Added `--diagnostics`
 tariff_drafts under `--config`, and a drift guard that refuses to run when any table is
 uncategorized ([[local-dev-workflow]], [[appliance-provisioning]] §7d). 8 new tests
 (3 button-light backoff, 5 coalescing); guard + both new wipes verified on a scratch DB.
+
+## [2026-07-13] decision | Cloud service — multi-tenant SaaS (postponed, context captured)
+From a design conversation, not a source. The user floated an online, multi-tenant SaaS (the
+"cloud service") on TOP of the offline backup model (which stays, as the offline-site tradeoff):
+subscribing park sites get real-time (link-up) monitoring of the signed ledger, device status,
+and financial reports; one admin owns many sites; the cloud custodies per-site secrets; recurring
+per-site fee = a revenue line. Recorded as [[cloud-service-saas]] (status: open, POSTPONED per the
+user) so it isn't re-derived later. It productises the off-site control plane already stood up in
+[[fleet-deployment-komodo]] (Komodo Core + NetBird). Captured: the four hard tensions (offline-first
+vs real-time; the ledger must be VERIFIABLE not just displayed in the cloud; central secret custody;
+two-level tenancy under operator-as-adversary), the secrets boundary the user confirmed (sync creds
++ device-password ESCROW + app identity — but NOT the signing/ATECC608 key, which stays on the
+booth), and TWO in-discussion corrections that stand: (1) NetBird already solves the "cloud reaches
+booth" isolation objection — park-buzi is monitored that way today, booth-dialed, nothing exposed;
+(2) remote barrier-open is COMPATIBLE with [[barrier-not-a-door]] (it's `pulseOpen`/intent, never
+timed-close) and is DRIVEN by the [[autonomous-direction]] unmanned future — gated as a distinct
+privilege + a signed ledger event with actor+reason, with the booth as enforcer and a local
+fail-open that can't depend on the cloud. Four open questions parked (real-time definition, where
+reports are computed, hosting/licensing, custodianship-as-liability). Cross-linked; index count
+7→8 decisions.