docs(wiki): close the session's loose threads — bay printer question, vocabulary-in-code decision, training note, guard family, OQ #16 settled

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

wiki/decisions/open-questions.md

@@ -144,5 +144,7 @@ procurement. (See [[parking-system-architecture]] §10.)
     meanings (`session:read` as "works the booth till", `report:read` as "may open the socket")
     and a composer at the wrong altitude. Decision + three moves (per-desk till guards, jobs on
     top of the grid, a permission-scoped live feed) on [[venue-modules]] §"Permissions matrix";
-    moves built 2026-09-05. Open: default supervisor bundle, re-applying jobs after a module
-    update, signing role edits.
+    moves built 2026-09-05. The three loose ends closed 2026-09-06: the supervisor bundle
+    already carried `subscription:*` (stale note); roles now remember the jobs they follow and
+    a grown job is re-applied with one click, never silently; every role edit is signed as a
+    `config_change`. **Settled** — details on [[venue-modules]] §"Permissions matrix" Status.

wiki/decisions/venue-modules.md

@@ -173,9 +173,15 @@ vehicle. The Hikvision push's `detectionTarget` only says `vehicle`/`human` on t
 **As built (2026-09-06) — the app plumbing; the model is the open half.** Decisions from the user:
 a flagged downgrade is *recorded only* (no reason prompt), and Setup maps the vision vocabulary
 onto the site's own categories ("car, sedan, hatchback → Vetura").
-- **Vocabulary.** `VEHICLE_CLASSES` in `@parking/shared` (car, sedan, hatchback, suv, minivan,
-  pickup, van, truck, bus, motorcycle). The service's `/analyze` `vehicle.body_type` +
-  `confidence` carry it; the Node client normalises and drops anything outside the list.
+- **Vocabulary — lives in code, on purpose (user, 2026-09-06).** `VEHICLE_CLASSES` in
+  `@parking/shared` (car, sedan, hatchback, suv, minivan, pickup, van, truck, bus, motorcycle) is
+  the model's contract, not site data: a site cannot invent a class the camera never emits, so
+  the list is a constant, a new class ships as a release with the model that produces it, and
+  sites only MAP it (Veture, Makine, Fuoristrade — whatever they call their categories). Stored
+  mappings hold the ids, so labels can be renamed freely and a retired id is filtered out
+  silently. The Setup chips show the canonical ids (lowercase monospace), never a translation,
+  so they read as what they are. The service's `/analyze` `vehicle.body_type` + `confidence`
+  carry it; the Node client normalises and drops anything outside the list.
 - **Record.** `snapshot.ts` writes the read into the same unsigned `device_events` row as the plate
   (or a row of its own when the plate was unreadable); `vehicleForIdentity()` resolves it like the
   plate (entry over exit, newest first). Never on the ledger by itself.