docs(wiki): close the session's loose threads — bay printer question, vocabulary-in-code decision, training note, guard family, OQ #16 settled

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

wiki/decisions/venue-modules.md

@@ -173,9 +173,15 @@ vehicle. The Hikvision push's `detectionTarget` only says `vehicle`/`human` on t
 **As built (2026-09-06) — the app plumbing; the model is the open half.** Decisions from the user:
 a flagged downgrade is *recorded only* (no reason prompt), and Setup maps the vision vocabulary
 onto the site's own categories ("car, sedan, hatchback → Vetura").
-- **Vocabulary.** `VEHICLE_CLASSES` in `@parking/shared` (car, sedan, hatchback, suv, minivan,
-  pickup, van, truck, bus, motorcycle). The service's `/analyze` `vehicle.body_type` +
-  `confidence` carry it; the Node client normalises and drops anything outside the list.
+- **Vocabulary — lives in code, on purpose (user, 2026-09-06).** `VEHICLE_CLASSES` in
+  `@parking/shared` (car, sedan, hatchback, suv, minivan, pickup, van, truck, bus, motorcycle) is
+  the model's contract, not site data: a site cannot invent a class the camera never emits, so
+  the list is a constant, a new class ships as a release with the model that produces it, and
+  sites only MAP it (Veture, Makine, Fuoristrade — whatever they call their categories). Stored
+  mappings hold the ids, so labels can be renamed freely and a retired id is filtered out
+  silently. The Setup chips show the canonical ids (lowercase monospace), never a translation,
+  so they read as what they are. The service's `/analyze` `vehicle.body_type` + `confidence`
+  carry it; the Node client normalises and drops anything outside the list.
 - **Record.** `snapshot.ts` writes the read into the same unsigned `device_events` row as the plate
   (or a row of its own when the plate was unreadable); `vehicleForIdentity()` resolves it like the
   plate (entry over exit, newest first). Never on the ledger by itself.