fix(vocab): correct the "latent re-vendor bug" false premise; exports/ is a staging tier

Verifying the queued "migrate 11 Accounting files" task caught that its
founding premise was factually wrong.

The PR #107 claim: 11 OGAR-produced TTLs in
vocab/imports/ogit/NTO/Accounting/ are "at re-vendor-overwrite risk"
and should migrate to exports/.

What verification found: those 11 files are COMMITTED TO THE
AdaWorldAPI/OGIT FORK — commit c5dc1b8 "shrink 3-hop Odoo lookups —
promoted attrs + shortcut verbs + FiscalJurisdiction codebook", on the
fork's master, pushed. imports/ faithfully mirrors the fork; the
re-vendor recipe copies FROM the fork, so it PRESERVES them. There was
never a data-loss risk. No migration.

Operator resolved the genuine question (what is exports/ FOR) to the
STAGING-TIER model:

  producer → exports/ (review, CI) → promote to OGIT fork
           → re-vendor → imports/ → consumers read imports/

- exports/ = produced-but-not-yet-promoted; transient workbench.
- AdaWorldAPI/OGIT fork = enriched canonical store (upstream + promoted).
- imports/ = faithful mirror of the enriched fork.
- consumers read ONLY imports/.

The 11 Accounting files are a COMPLETED promotion (the worked example
of the model run to its end), correctly mirrored — not stranded.

Changes:

* vocab/exports/PROVENANCE.md — rewritten STAGING TIER v1: the model
  diagram, why-stage-not-commit-direct, and a correction block
  replacing the false "migration note".
* vocab/exports/ogit/README.md — staging-tier framing.
* docs/ODOO-DIGEST-TO-OGIT.md — pipeline diagram shows
  exports → promote → imports; §2 rewritten to the staging-tier model
  with the c5dc1b8 correction; the two stale correction-note + blocker
  rows fixed.
* docs/OGIT-DOMAIN-LIFT-CATALOGUE.md — Accounting row notes the 11 are
  promoted-to-fork (completed), not stranded; upstream author count
  corrected to 25 (Viktor Voss / Gibson Xavier / Moritz Vannahme).
* .claude/board/EPIPHANIES.md — new FINDING (the false premise + the
  staging-tier resolution + two lessons: verify-the-target-before-
  claiming-a-bug, and a-correction-can-itself-need-correcting); prior
  "Three corrections" entry regraded PARTIALLY SUPERSEDED (corrections
  1 & 2 stand; correction 3's bug-claim superseded).

No code changes; tests still 16/16 default, 20/20 with --features xsd.

Author: claude

.claude/board/EPIPHANIES.md

@@ -15,8 +15,66 @@
 
 ## Entries (newest first)
 
-## 2026-06-22 — Three corrections to the Odoo digest framing: producer name, storage location, latent re-vendor bug
+## 2026-06-22 — The "latent re-vendor bug" was a false premise; exports/ is a STAGING tier, not a permanent home (operator-decided)
 **Status:** FINDING
+**Scope:** vocab/ tree model × verify-before-acting × correcting a prior session's claim
+
+Investigating the "migrate the 11 stranded Accounting files" task
+(queued by the prior PR #107 entry below) caught that its founding
+premise was **factually wrong** — a clean case of the
+verify-before-destructive-action discipline paying off.
+
+The claim (PR #107, exports/PROVENANCE.md, the entry below): "11
+OGAR-produced TTLs sit in `vocab/imports/ogit/NTO/Accounting/` at
+re-vendor-overwrite risk; they should migrate to `exports/`."
+
+What verification found: those 11 files are **committed to the
+AdaWorldAPI/OGIT fork** — commit `c5dc1b8` "shrink 3-hop Odoo lookups
+— promoted attrs + shortcut verbs + FiscalJurisdiction codebook", on
+the fork's `master`, pushed. They were not added directly to OGAR's
+`imports/`; they were promoted to the fork by a prior session, and
+`imports/` faithfully mirrors the fork. The re-vendor recipe copies
+*from* the fork (`cp -r /OGIT/NTO/. vocab/imports/ogit/NTO/`), so it
+**preserves** them. There was never a data-loss risk. NO migration.
+
+The operator resolved the resulting genuine question — what is
+`exports/` actually FOR — to the **staging-tier model**:
+
+```
+producer ──► exports/  (review, CI) ──promote──► OGIT fork ──re-vendor──► imports/ ──► consumers
+```
+
+- `exports/` = produced-but-not-yet-promoted content; transient;
+  the pre-promotion workbench. CI (round-trip + bijection + drift)
+  runs here before anything touches the shared fork.
+- The AdaWorldAPI/OGIT fork = the enriched canonical store (upstream
+  arago/almato + OGAR-promoted additions like `c5dc1b8`).
+- `imports/` = faithful SHA-pinned mirror of the enriched fork.
+- Consumers read ONLY `imports/`. Never `exports/`.
+
+Under this model the 11 Accounting files are a *completed* promotion,
+correctly mirrored in `imports/` — the worked example of the pipeline
+run to its end, not stranded content. `exports/` stays empty until a
+producer stages something that hasn't been promoted yet.
+
+Two lessons:
+1. **Verify the target before claiming a bug about it.** "These files
+   are at risk" is a claim about the fork's state; one `git log` on the
+   OGIT clone falsified it. The CLAUDE.md discipline ("look at the
+   target; if what you find contradicts how it was described, surface
+   that instead of proceeding") caught a migration that would have
+   broken the imports↔fork bijection AND duplicated the 11 files.
+2. **A correction can itself need correcting.** The entry below
+   ("Three corrections…") fixed two real things (producer name,
+   arm-crate role) and introduced one wrong thing (the re-vendor-bug
+   claim). Corrections 1 & 2 stand; correction 3 is superseded here.
+
+Evidence: OGIT fork commit `c5dc1b8` (11 files, `master`, pushed);
+`vocab/exports/PROVENANCE.md` (rewritten to STAGING TIER v1);
+`docs/ODOO-DIGEST-TO-OGIT.md §2` (staging-tier model + the correction).
+
+## 2026-06-22 — Three corrections to the Odoo digest framing: producer name, storage location, latent re-vendor bug
+**Status:** PARTIALLY SUPERSEDED — corrections 1 & 2 stand; correction 3's "latent re-vendor bug" claim was itself wrong, see the 2026-06-22 staging-tier entry above (the 11 Accounting files are committed to the OGIT fork, NOT at risk).
 **Scope:** producer architecture × vocab/ tree layout × re-vendor safety × digest-to-OGIT
 
 Three corrections to the framing in `docs/ODOO-DIGEST-TO-OGIT.md`

docs/ODOO-DIGEST-TO-OGIT.md

@@ -30,11 +30,14 @@ or workflow action by rendering against the TTL via
 > projection that's already shipping.
 >
 > **Storage location correction (2026-06-22):** earlier drafts said
-> digests land in `vocab/imports/ogit/NTO/<Domain>/`. That was wrong
-> — it would put OGAR-produced content at re-vendor risk (the
-> `imports/` re-vendor recipe is a destructive `cp -r`). Correct
-> location: **`vocab/exports/ogit/NTO/<Domain>/`** — see
-> `vocab/exports/PROVENANCE.md` for the split rationale.
+> digests land in `vocab/imports/ogit/NTO/<Domain>/`. They actually
+> STAGE in **`vocab/exports/ogit/NTO/<Domain>/`** — produced-but-not-
+> yet-promoted content — and only land in `imports/` after being
+> promoted to the AdaWorldAPI/OGIT fork and re-vendored. See §2 for the
+> staging-tier model and `vocab/exports/PROVENANCE.md` for the full
+> rationale. (The same draft also wrongly claimed 11 existing
+> Accounting files were "at re-vendor risk"; they are committed to the
+> OGIT fork and correctly mirrored — see §2.)
 
 ---
 
@@ -60,10 +63,15 @@ or workflow action by rendering against the TTL via
             │  — entity-as-class for models
             │  — verb-as-class for workflow action signatures
             ▼
-   OGIT-shaped TTL templates
-   (vocab/EXPORTS/ogit/NTO/<Domain>/<DigestedClass>.ttl)
+   OGIT-shaped TTL templates  (STAGED — not yet promoted)
+   (vocab/exports/ogit/NTO/<Domain>/<DigestedClass>.ttl)
    — dcterms:creator = bus-compiler  (digester provenance)
-   — distinct tree from imports/ ogit/ (re-vendor safety)
+   — review here (round-trip + bijection tests, drift check)
+            │
+            │  PROMOTE: commit to the AdaWorldAPI/OGIT fork, then
+            │           re-vendor (cp -r /OGIT/NTO/. vocab/imports/ogit/NTO/)
+            ▼
+   vocab/imports/ogit/NTO/<Domain>/  (faithful mirror of the enriched fork)
             │
             │  ogar-render-askama  (entity render → views; verb render → actions)
             ▼
@@ -76,37 +84,44 @@ or workflow action by rendering against the TTL via
 
 The Python runtime is **only** touched at digest time. Consumers
 (`woa-rs`, `smb-office-rs`, `medcare-rs`, `q2`, any future renderer)
-never depend on Odoo Python, only on TTL + the askama renderer.
-
-## §2. Why digests live in `vocab/exports/ogit/`, not `vocab/imports/ogit/`
-
-`imports/` is a READ-ONLY mirror of upstream OGIT (the re-vendor
-recipe is a destructive `cp -r /upstream/. vocab/imports/ogit/`).
-Putting OGAR-produced content in `imports/` would silently nuke
-those files on the next re-vendor. **The split exists for re-vendor
-safety, license/governance, and upstream-contribution path** — see
-`vocab/exports/PROVENANCE.md` for the full rationale.
-
-The digest **mirrors the upstream layout** so consumers see one shape:
-
-| Concept | Upstream OGIT path (READ-only mirror) | Digest target (OGAR-produced) |
-|---|---|---|
-| `Accounting` | `vocab/imports/ogit/NTO/Accounting/` (23 files, Viktor Voss) | `vocab/exports/ogit/NTO/Accounting/` (Odoo-digested) |
-| `SalesDistribution` | `vocab/imports/ogit/NTO/SalesDistribution/` (23 files, Marek Meyer) | `vocab/exports/ogit/NTO/SalesDistribution/` (Odoo sale.* digest) |
-| `Transport` | `vocab/imports/ogit/NTO/Transport/` (27 files, chris.boos@almato.com) | `vocab/exports/ogit/NTO/Transport/` (Odoo stock.* digest) |
-| … | upstream-mirrored | OGAR-produced, OGIT-shape-compatible |
-
-`dcterms:creator` provenance is now a SECONDARY check (the directory
-split is the primary). The `OGIT-DOMAIN-LIFT-CATALOGUE.md §
-Verifying domain authorship` scan still runs and still discriminates
-authors, but the destructive-overwrite risk is structurally gone.
-
-**Migration note for the existing 11 stranded files.** A prior
-session's `Claude (AdaWorldAPI/lance-graph 3-hop optim)` digest left
-11 OGAR-produced files in `vocab/imports/ogit/NTO/Accounting/`
-alongside Viktor Voss's 23 originals. Those 11 belong in
-`vocab/exports/ogit/NTO/Accounting/`. The migration is a separate
-PR; `vocab/exports/PROVENANCE.md § Migration note` carries the
+never depend on Odoo Python, only on TTL + the askama renderer — and
+they read `imports/`, never the `exports/` staging tier.
+
+## §2. The staging-tier model — `exports/` → OGIT fork → `imports/`
+
+(Operator-decided 2026-06-22.) `exports/` is a **staging area** for
+produced-but-not-yet-promoted content; the AdaWorldAPI/OGIT fork is
+the **enriched canonical store**; `imports/` faithfully mirrors the
+fork; consumers read only `imports/`. See `vocab/exports/PROVENANCE.md`
+for the full model.
+
+```
+producer ──► vocab/exports/ogit/NTO/<Domain>/   (review/iterate, CI runs here)
+                  │  promote (commit to OGIT fork on a branch, PR there)
+                  ▼
+             AdaWorldAPI/OGIT fork  (enriched: upstream + OGAR-promoted)
+                  │  re-vendor
+                  ▼
+             vocab/imports/ogit/   (SHA-pinned mirror — consumers read this)
+```
+
+Why a staging tier and not "commit straight to the fork": a digest run
+produces N TTLs at once; staging lets the round-trip + bijection tests
+run, the drift-vs-prior-digest diff fire, and a human review the lift —
+all inside OGAR + CI — **before** anything touches the shared fork. The
+promote step is the single auditable gate between OGAR-produced and
+OGIT-canonical.
+
+**The 11 Accounting files are NOT a migration target.** An earlier
+draft (commit `7d68042`) claimed 11 OGAR-produced TTLs in
+`vocab/imports/ogit/NTO/Accounting/` were "at re-vendor risk" and
+"belong in `exports/`." **That was wrong.** Those files are committed
+to the **AdaWorldAPI/OGIT fork** (commit `c5dc1b8` "shrink 3-hop Odoo
+lookups…", on `master`, pushed) — i.e. they are a *completed*
+promotion. `imports/` correctly mirrors them; re-vendor preserves
+them. They are the worked example of the staging-tier model run to
+completion, not stranded content. `exports/` is for content that has
+**not yet** made that trip.
 list.
 
 ## §3. The four shapes the digester produces
@@ -194,7 +209,7 @@ license fee.
 | `ruff_rust_spo` (Rust AST frontend, for digesting medcare-rs / woa-rs / etc.) | **does not exist** — needs `syn` walker; symmetric with the other ruff frontends |
 | `ogar-render-askama::actions` (verb-as-class render path) | **does not exist** — ~200 LOC mirroring the existing `views/` path |
 | Concept mints for non-Accounting Odoo models | needs the 5+3 codebook pass per `APP-CLASS-CODEBOOK-LAYOUT.md` |
-| Migration of the 11 stranded Accounting files (`imports/` → `exports/`) | **queued** — separate PR (see `vocab/exports/PROVENANCE.md § Migration note`) |
+| The 11 Accounting files in `imports/` | **not a migration target** — already promoted to the OGIT fork (`c5dc1b8`); correctly mirrored. See §2. |
 
 `ruff_python_spo` and `ogar-render-askama::actions` are independent
 and can ship in parallel PRs. Concept mints are the slow path

docs/OGIT-DOMAIN-LIFT-CATALOGUE.md

@@ -78,7 +78,7 @@ arago/almato coordination."
 
 | Domain | Entities | Attributes | Verbs | Status | Notes |
 |---|--:|--:|--:|---|---|
-| `Accounting` | 9 | 20 | 7 | Lift-tested | Mixed-authorship: `Viktor Voss` (23 files, original arago/almato) + a prior session's extension (`Claude (AdaWorldAPI/lance-graph 3-hop optim)`, 11 files). Covered conceptually via `0x02XX` commerce/ERP via Odoo lift. Structural changes to the original 23 need upstream coordination; the 11 extensions are ours. |
+| `Accounting` | 9 | 20 | 7 | Lift-tested | Mixed-authorship: `Viktor Voss` / `Gibson Xavier` / `Moritz Vannahme` (25 files, original arago/almato) + a prior session's extension (`Claude (AdaWorldAPI/lance-graph 3-hop optim)`, 11 files **promoted to the OGIT fork** via commit `c5dc1b8`). The 11 are a completed promotion (fork → mirrored here), the worked example of the staging-tier model (`vocab/exports/PROVENANCE.md`), NOT stranded content. Covered conceptually via `0x02XX` commerce/ERP via Odoo lift. Structural changes to the upstream files need arago coordination; the 11 OGAR-promoted ones are ours. |
 | `Advertising` | 16 | 0 | 0 | Imported | |
 | `Audit` | 3 | 0 | 0 | Lift-tested | `Marek Meyer` (sole author) — pure upstream. Audit-as-Lance-version (ADR-013) covers the semantics. |
 | `Auth` | 13 | 24 | 6 | Imported | Cross-walk to `0x0BXX` auth domain (Zitadel/Zanzibar) queued |