feat: prepare ARR for controlled public deployment

.project-docs/40-domain/business-rules.md

@@ -0,0 +1,20 @@
+# Business Rules
+
+## Durable Rules
+
+- The user uploads XML; the user does not submit a report year, report month, cutoff date, or separate monthly-generation request in the primary workflow.
+- The Agent returns structured data, which must be validated and successfully committed to the database before downstream monthly processing starts.
+- A successful database commit automatically triggers the monthly-report processing program through the business system.
+- Year, month, cutoff/as-of date, and similar fields are internal derived execution/audit values. Their presence in code or metadata does not make them user inputs.
+- The monthly output contains the exact business dimension/field `TOTAL PRICE`.
+- Each monthly XLSX data-row `TOTAL PRICE` cell is a formula whose business meaning is `REAL PRICE × NIGHTS × NO_OF_ROOMS` (current layout example: `=R2*C2*G2`).
+- A stored database `total_price` may be used for integrity checking, but it does not replace the required formula in the exported workbook.
+
+## Open Questions
+
+- The internal event/outbox/worker mechanism for automatic dispatch is not yet selected.
+- The exact business-time and cutoff derivation policy is not yet specified; the system must derive it without user input.
+
+## Last Reviewed
+
+2026-07-29