ERPNext runs the whole plant; every tool we build integrates with it

Decided by the user (October 2026): the whole plant runs ERPNext, and
all tooling we develop has to interact with it.

digital-factory.md: standing decision in the summary; decision 10
(ERPNext owns the business documents, the factory application owns the
floor; ERPNext names are the shared keys); new section 'ERPNext: the
plant's ERP' with the ownership table (customers, prices, sales orders,
items and BOMs, work orders and job cards per station, batches and
quality inspections per compound lot, serial numbers for metal parts,
downtime entries, delivery notes, assets, accounting, payroll vs. cycles,
per-record inspection, genealogy and the hash-chained log staying in the
factory application), the integration rules (one typed Frappe REST
client in cnx-factory, an integration user per tool, webhooks in,
transactional outbox with idempotent postings so the floor never waits
on the ERP, business-sized postings, customisation as a Frappe app in
Gitea, nightly reconciliation, no public ERPNext endpoint, new tools use
the same client), hosting on NixOS (no nixpkgs module, NixOS/nixpkgs
#241921; Avunu frappe-nix as the start, frappe_docker as
oci-containers fallback; MariaDB + Redis; vinyl-erp on site behind the
gateway proxy; OIDC sign-on; upgrades on a restored copy), Thai
localisation (Ecosoft erpnext_thailand: VAT, WHT, PND, billing notes;
Ecosoft as partner to quote; payroll and BOI reporting to check),
phasing (dev ERPNext now; accounting and assets from the first capex
invoice; manufacturing at commissioning) and estimates. ERPNext added
to the architecture diagram, services, machines (vinyl-erp), module
list, backup, cost, build order and open decisions; the old 'ERP out of
scope, decide after launch' line replaced.

artist-platform.md: price list, customers, sales orders, campaign
pledges as payment entries, through the plant's outbox. traceability.md:
one ERP, one set of keys. README summary. total-investment.md added
scope: ERPNext (to quote, not in the sum, no licence fee).

docs/artist-platform.md

@@ -421,6 +421,23 @@ No SaaS beyond the payment provider (Opn/Omise, 2C2P or a bank gateway,
 to be chosen), in line with the plan's standing rule that every plant
 service runs on the NixOS fleet.
 
+**ERPNext** (decided October 2026: the plant runs ERPNext, and every tool
+we build interacts with it; [digital factory](digital-factory.md#erpnext-the-plants-erp)).
+For the platform that means:
+
+- the **price list** behind the calculator is an ERPNext price list
+  (the demos' `R` list is its prototype), synced out to the public
+  process, so the calculator and the invoice never disagree;
+- an artist or label account is linked to one ERPNext **customer**; a
+  direct order becomes a **sales order** when it is confirmed;
+- a **campaign** stays in the public process while it runs; when it
+  succeeds it becomes a sales order, the pledges become **payment
+  entries** against it in the ring-fenced account, and fan shipments
+  become delivery notes; the refunds of a missed campaign are posted the
+  same way;
+- every posting goes through the plant's integration layer and its
+  outbox over the mesh; the public side never talks to ERPNext directly.
+
 **Personal data.** Fans' names and addresses are personal data under
 PDPA, with CNX as controller as the seller of record. An artist gets
 fan contact details only where the fan ticked a consent box; that list