docs: establish integrated project memory

.project-docs/40-domain/business-rules.md

@@ -0,0 +1,28 @@
+# Business Rules
+
+## Durable Rules
+
+- A queue ticket belongs to one project and one queue session and binds a fixed party size chosen at creation.
+- Ticket-number calling selects up to the first contiguous N waiting tickets in FIFO order.
+- People-count calling selects the longest contiguous FIFO prefix whose total party size does not exceed the target; tickets are never split or skipped, and the request fails if the first waiting ticket alone exceeds the target.
+- Same-phone duplicate protection in a project/session applies only while an existing ticket is `WAITING`. Once it has been called, that phone may take another ticket in the same session. A still-waiting duplicate requires explicit confirmation.
+- Login attempts remain allowed through the ninth failure in a ten-minute window. The tenth failure locks that limiter key for ten minutes; successful login clears the attempt state.
+- A project's current queue session is selected for the project's local business date and must be in `RUNNING` or `PAUSED` where read flows allow both; write operations apply their stricter project/session status rules.
+- Public phone lookup is an operational-test path only and is disabled with a 404 response in production; internal phone lookup is private-network-only.
+- Terminal ticket personal fields are scheduled for purge after 30 days; records older than 90 days are anonymized as a backstop. Maintenance runs in bounded transactions under a PostgreSQL advisory lock, and audit/session/idempotency retention is enforced from stored expiry fields.
+- Public display responses are read-only allowlisted projections and must not expose phone, name ciphertext/nonces, HMACs, private status tokens, or other personal fields.
+- `/admin/display` is an overview surface and never announces. Only `/display/{project-code-or-token}` may announce a new call.
+- Android establishes the first project snapshot as a silent baseline; only a subsequently changed call batch is announced.
+- Android announcements speak the called ticket number or first-to-last range, never the project name, and repeat the complete announcement three times in FIFO batch order.
+- A multi-ticket current batch displays its first and last number as a complete range such as `00010 至 00011`; it must not ellipsize or silently clip the endpoint.
+- Leaving a project screen or pausing the Android activity stops project polling and clears/stops current and queued announcements.
+- Ticket transition and missed-ticket reissue logic exists in the service source, including one-time tail reissue with revision/idempotency checks, but is not currently registered as an HTTP route or wired into the web UI; do not treat it as an active user-facing capability until that integration is implemented and tested.
+
+## Open Questions
+
+- Confirm whether the legacy Mandarin WAV assets are cleared for redistribution outside the current project's authorized deployment.
+- Confirm whether a future production APK will remain fixed to one service origin or needs managed environment configuration.
+
+## Last Reviewed
+
+2026-08-12

.project-docs/40-domain/glossary.md

@@ -0,0 +1,15 @@
+# Glossary
+
+| Term | Meaning | Notes |
+|---|---|---|
+| Project | A queueable scenic-area service/attraction with its own code, configuration, status, and sessions | Public display URLs normally use the project code |
+| Queue session | A project's operational queue for one business date | Owns next number and revision |
+| Queue ticket | One numbered party waiting for or receiving service | Party size is immutable after creation |
+| Call batch | One staff call action containing a contiguous set of tickets | Android announces first-to-last for a multi-ticket batch |
+| Overview display | Multi-project public display corresponding to `/admin/display` | Read-only and never announces |
+| Project display | One project's public display at `/display/{identifier}` | The only Android state allowed to announce |
+| Snapshot | Authoritative privacy-safe project display response | Drives both Android UI and announcement detection |
+| Display identifier | Project code or compatible public display token accepted by the snapshot endpoint | Overview navigation requires a non-empty project code |
+| Revision | Monotonic queue-session change marker | Supports event/poll recovery and freshness |
+| Experienced people | Displayed as the greater of the configured starting value and cumulative issued party size in the current project-local business-day session | Distinct from issued ticket count |
+| Announcement baseline | First snapshot accepted after entering/resuming a project screen | Stored silently to prevent replaying an old call |