ERPNext is the only system of record; we build tools on it

User (October 2026): we only build tools and interfaces that interact
with ERPNext; invoices, stock and the rest are kept there, except
telemetry and other machine data.

digital-factory.md: standing decision, decisions 2, 3, 6, 7 and 10
rewritten (ERPNext holds every record of the business and of production,
including artist gates, metal-part genealogy as serial numbers with
parents, and quality inspections; the machine-data store keeps only
cycle and record rows, the hash chain and time series, keyed to ERPNext
names; ERPNext first, then custom fields or document types in cnx_erp,
then a tool, never a second business database). Systems table,
architecture labels, factory application section (modules as a table:
records in ERPNext, what we build, machine data outside; our only tables
are the machine-data ones), ownership table, integration rules 4 and 8,
phasing and estimates (cnx_erp app 2 to 3 person-months; total 3.5 to 6).
artist-platform.md: campaigns are an ERPNext document from launch, pledges
post as advance payment entries; traceability, README, facility security
(archive location on the serial number), production timeline (sets per
mother on the mother's serial number), crane-workshop spares store,
total-investment.

Factory console: KPI row no longer touches the postings card (user
screenshot); ERPNext page, order card, sidenote and ledger say every
record lives in ERPNext and only machine data stays outside; new
postings for artist gates, stamper metrology inspections, stamper set
serial numbers (grown, retired with play count). Checked headless:
Edge dark and light, 1440/1024/390, no overflow or page errors, rows
aligned, pw_fc, pw_wo, pw_feed and pw_erp pass.

docs/artist-platform.md

@@ -348,8 +348,8 @@ approves the test pressing; a photo or short video of it to the fans is
 cheap marketing), the run, packaging, and **dropshipping one parcel per
 fan** with tracking, which is fulfillment step 9 as already planned.
 
-Fans follow it on the campaign page, fed from the factory application's
-event log: the progress is the plant's own record, not a status someone
+Fans follow it on the campaign page, fed from the order's records in
+ERPNext and the plant's event log: the progress is the plant's own record, not a status someone
 remembers to update. If a stage slips, the estimated ship month moves
 and every fan is told.
 
@@ -421,20 +421,24 @@ No SaaS beyond the payment provider (Opn/Omise, 2C2P or a bank gateway,
 to be chosen), in line with the plan's standing rule that every plant
 service runs on the NixOS fleet.
 
-**ERPNext** (decided October 2026: the plant runs ERPNext, and every tool
-we build interacts with it; [digital factory](digital-factory.md#erpnext-the-plants-erp)).
-For the platform that means:
+**ERPNext** (decided October 2026: the plant runs ERPNext as its only
+system of record, and what we build are tools and interfaces on it;
+[digital factory](digital-factory.md#erpnext-the-plants-erp)). The
+platform keeps no business records of its own. For the platform that
+means:
 
 - the **price list** behind the calculator is an ERPNext price list
   (the demos' `R` list is its prototype), synced out to the public
   process, so the calculator and the invoice never disagree;
 - an artist or label account is linked to one ERPNext **customer**; a
   direct order becomes a **sales order** when it is confirmed;
-- a **campaign** stays in the public process while it runs; when it
-  succeeds it becomes a sales order, the pledges become **payment
-  entries** against it in the ring-fenced account, and fan shipments
-  become delivery notes; the refunds of a missed campaign are posted the
-  same way;
+- a **campaign** is a custom Campaign document in ERPNext from launch;
+  each pledge is posted as an advance **payment entry** into the
+  ring-fenced account as it arrives, with the fan as a customer; when the
+  campaign succeeds it becomes a sales order the advances are allocated
+  to, and fan shipments become delivery notes; the refunds of a missed
+  campaign are posted as payment entries too. The public process holds
+  sessions and a cache of what it shows, nothing else;
 - every posting goes through the plant's integration layer and its
   outbox over the mesh; the public side never talks to ERPNext directly.