vocab+mint: classid canon:custom half-order flip — canon HIGH / APP-render prefix LOW

Lockstep flip with lance-graph-contract CLASSID_ORDER=CanonHigh
(lance-graph #628; operator trigger 2026-07-02, the 0x07:01::1000 ruling):

- ogar_vocab::app: render_classid now composes ((concept as u32) << 16) |
  prefix; app_of reads the low half, concept_of the high half. APP_PREFIX
  values unchanged (position moved to the LOW/custom half).
- ogar-from-ruff mint + codegen emit: literal-pinned tests flipped
  (account.move -> 0x0202_0002, WorkPackage -> 0x0102_0001); decompose
  assertions route through app_of/concept_of instead of local masks.
- ruff_spo_address::Facet needs NO companion change: facet_classid is an
  opaque LE u32 pass-through; the composition lives entirely here.
- Doc sweep: APP-CLASS-CODEBOOK-LAYOUT (full layout spec), consumer best
  practices, migration plan, READMEs (en/de), PHILOSOPHY (en/de), transpile
  substrate, IR framing, RBAC keystone auth literals (0x0B01_0000-form),
  mailbox-integration mint guidance, CLAUDE.md non-negotiables.
- Ledgers (append-only honored): DISCOVERY-MAP D-CLASSID-CANON-HIGH-FLIP +
  board EPIPHANIES E-CLASSID-CANON-HIGH-FLIP appended; D-APPCLASS and
  D-OSINT-APPID-NOT-CONCEPT entries preserved, superseded by citation.

Legacy stored forms (0x0000_DDCC / 0xAAAA_DDCC / 0x1000_DDCC) persist in
baked data and resolve via read-only legacy registry aliases upstream
(mint-forward; retirement gated on corpus proof).

Gates: workspace 35 test suites green (vart-gated crate tested via a local
path override, reverted before commit — the git dep is canonical); fmt
clean on touched crates.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

.claude/board/EPIPHANIES.md

@@ -7,6 +7,22 @@
 
 ---
 
+## 2026-07-02 — E-CLASSID-CANON-HIGH-FLIP — the composed classid half-order flips: canon concept HIGH, APP/render prefix LOW
+
+**Status:** FINDING (`[G]`, operator-triggered). Doc-sweep companion to `docs/DISCOVERY-MAP.md` D-CLASSID-CANON-HIGH-FLIP — read that entry for the full ledger; this entry records the same correction in the session-findings log.
+
+**The trigger:** the operator's `0x07:01::1000` mnemonic — read as `domain:appid::marker` — exposed that the working composed classid stored the APP/render prefix in the **high** u16 and the canonical concept in the **low** u16, backwards from the mnemonic's own read order (domain/concept first, appid second).
+
+**The ruling:** flip the composed order to `classid : u32 = [hi u16: canon concept][lo u16: APP/render prefix]`. `ogar_vocab::app::{render_classid, app_of, concept_of}` flip in lockstep with lance-graph-contract's `CLASSID_ORDER = CanonHigh` (PR #628 there) — `app_of` now reads `classid as u16`, `concept_of` now reads `classid >> 16`. **APP_PREFIX values are unchanged** (`0x0000` Core … `0x0007` Redmine) — only their bit position moves. V3 marker forms move in lockstep (`0x1000_0700` → `0x0701_1000`; FMA `0x1000_0A01` → `0x0A01_1000`; CPIC `0x1000_0E00` → `0x0E01_1000`, appid normalized `:00`→`:01`). Auth RBAC literals: `0x0000_0B0N` → `0x0B0N_0000` for N∈{1,2,3,4}.
+
+**Legacy is aliased, never rewritten.** Already-baked/persisted classids in the old order resolve via a read-only legacy registry alias (mint-forward doctrine; RESERVE-DON'T-RECLAIM held throughout). Retirement of the alias path is gated on a corpus proof, never assumed.
+
+**Supersedes, without editing:** D-APPCLASS (`docs/DISCOVERY-MAP.md`, 2026-06-22 — `classid = APP(hi u16) ‖ class(lo u16)`) and the `0x1000_0701` literal in D-OSINT-APPID-NOT-CONCEPT (same-day predecessor, 2026-07-02). Both entries stand as written per the append-only rule; this entry and its DISCOVERY-MAP twin are the correction of record for the half-order going forward.
+
+**Cross-ref:** `docs/DISCOVERY-MAP.md` D-CLASSID-CANON-HIGH-FLIP (canonical ledger entry); the doc-wide sweep landed the same session across `APP-CLASS-CODEBOOK-LAYOUT.md`, `APP-CODEBOOK-MIGRATION-PLAN.md`, `OGAR-CONSUMER-BEST-PRACTICES.md`, `OGAR-TRANSPILE-SUBSTRATE.md`, `OGAR-AS-IR.md`, `SURREAL-AST-TRAP-PREFLIGHT.md`, `NODEGUID-CANON-AUDIT.md`, `FOUNDRY-ODOO-MARS-LENS.md`, `CLASSID-RBAC-KEYSTONE-SPEC.md`, `ODOO-REDMINE-OPENPROJECT-LANDING.md`, `PHILOSOPHY.md`/`PHILOSOPHIE.md`, `README.md`/`README.de.md`, `integration/AR-OGAR-MAILBOX-INTEGRATION-PLAN.md` §7, and this repo's `CLAUDE.md`.
+
+---
+
 ## 2026-07-01 — E-OSINT-SUBSTRATE-CONVERGES-PER-SOA — the massive cognitive stack converges into the V3 2+14 tenant SoA; the dedup IS the convergence
 
 **Status:** FRAMING (`[G]` for the shipped crates + the tenant carve + the sole-writer canon E-CE64-MB-4; `[H]` for the convergence *program* — the deltas + baby-step probes P0–P8 are unrun). Operator-framed 2026-07-01 (*"massive codebase massive entropy … the V3 2+14 tenants converge the awareness massively per SoA"*).

CLAUDE.md

@@ -211,14 +211,17 @@ alignment costs. Until measured: 3×4 stands.
 10. `docs/OGAR-TRANSPILE-SUBSTRATE.md` — **the power, in one doc.** OGAR
     as the bidirectional per-class transpiler: pull-in (`source →
     ogar-from-<lang> → ModelGraph → lift + mint → CompiledClass`),
-    rail-facet addressing (`classid = (APP_PREFIX<<16)|concept`, the 16-byte
-    `FacetCascade`, cross-app convergence), pull-back (runtime wrapper
-    contract like `lance-graph-contract`, or codegen emit like
+    rail-facet addressing (`classid = (concept<<16)|APP_PREFIX`, the
+    16-byte `FacetCascade`, cross-app convergence), pull-back (runtime
+    wrapper contract like `lance-graph-contract`, or codegen emit like
     `ogar-adapter-surrealql`), and the **85/15 split** (mechanical logic
     minted into OGAR; the "impossible" 15% = a per-language adapter +
     ClassView + ontological grounding). READ to understand why a consumer
     collapses to "a compiler-store caller + adapters, at the cost of an
-    import." Worked example: `account.move → 0x0002_0202`.
+    import." Worked example: `account.move → 0x0202_0002`. (Order
+    flipped 2026-07-02 — canon HIGH / custom LOW; pre-flip docs and
+    baked data use the legacy order — see `docs/DISCOVERY-MAP.md`
+    D-CLASSID-CANON-HIGH-FLIP.)
 8. `docs/ARCHITECTURAL-DECISIONS-2026-06-04.md` — ADR-001..025
    (ADR-026 pending).
 9. `.claude/agents/` — the 5+3 hardening pattern (5 research savants +
@@ -241,11 +244,13 @@ alignment costs. Until measured: 3×4 stands.
   resolution target:** before authoring consumer code that pulls a
   classid, composes a render address, authorizes, or migrates off a
   bridge, read `docs/OGAR-CONSUMER-BEST-PRACTICES.md` (the muscle-
-  memory guide). The hi u16 chooses **render** skin (per-app
-  ClassView/template), the lo u16 names the **shared concept** (RBAC +
+  memory guide). The lo u16 chooses **render** skin (per-app
+  ClassView/template), the hi u16 names the **shared concept** (RBAC +
   ontology); **neither half carries behavior** — class-magic
   (`ActionDef`+`KausalSpec`) is a property of the Core node the
-  address resolves to, never of the address.
+  address resolves to, never of the address. (Order flipped 2026-07-02
+  — canon HIGH / custom LOW; pre-flip docs and baked data use the
+  legacy order — see `docs/DISCOVERY-MAP.md` D-CLASSID-CANON-HIGH-FLIP.)
 - **PII:** never emit German PII labels (medcare-rs leaf-rename at the
   adapter is the guarantee). Word-boundary abort-guard before commit.
 - **No model identifier** in any committed artifact (chat only).

README.de.md

@@ -8,18 +8,24 @@ Das [Active-Record-Muster](https://martinfowler.com/eaaCatalog/activeRecord.html
 (Martin Fowler, 2003) als kanonische 32-Bit-`classid`. Ein Codebook;
 jeder Consumer zieht, prägt niemals neu.
 
+> Reihenfolge geflippt 2026-07-02 — Kanon HOCH / App-eigen NIEDRIG: das
+> kanonische Konzept sitzt im hohen u16, der App-Render-Präfix im
+> niedrigen u16. Material von vor dem Flip und bereits gebackene Daten
+> nutzen die alte Reihenfolge; siehe `docs/DISCOVERY-MAP.md`
+> D-CLASSID-CANON-HIGH-FLIP.
+
 ```rust
 let cid: u16  = HealthcarePort::class_id("Patient");        // 0x0901
-let render    = HealthcarePort::APP_PREFIX | (cid as u32);  // 0x0005_0901
-authorize(actor, cid, Op::Read);                            // geteilter Grant auf lo u16
+let render    = ((cid as u32) << 16) | HealthcarePort::APP_PREFIX;  // 0x0901_0005
+authorize(actor, cid, Op::Read);                            // geteilter Grant auf hi u16
 //                                                          // lokal anreichern — deins
 ```
 
 ```
-classid : u32  =  0xAAAA ‖ 0xDDCC                  beide Hälften sind ADRESSE
+classid : u32  =  0xDDCC ‖ 0xAAAA                  beide Hälften sind ADRESSE
                     │         │
-                    │         └─ lo u16 — WELCHES KONZEPT  (geteilte Identität)
-                    └─────────── hi u16 — WESSEN RENDER     (App-eigene Haut)
+                    │         └─ lo u16 — WESSEN RENDER     (App-eigene Haut)
+                    └─────────── hi u16 — WELCHES KONZEPT  (geteilte Identität)
 
          ──────►  löst auf zu  ──────►
             ├─ ClassView                die HAUT      (pro App)
@@ -49,16 +55,16 @@ Prisma — gleiches Vokabular, ein IR.
 
 ## Render-Linse — ein Konzept, viele Apps
 
-| classid       | Konzept (lo u16)            | Render (hi u16)          | App                  |
+| classid       | Konzept (hi u16)            | Render (lo u16)          | App                  |
 |---------------|-----------------------------|--------------------------|----------------------|
-| `0x0001_0102` | `0x0102` project_work_item  | `0x0001` OpenProject     | openproject-nexgen-rs |
-| `0x0007_0102` | `0x0102` project_work_item  | `0x0007` Redmine         | (Consumer TBD)        |
-| `0x0005_0901` | `0x0901` patient            | `0x0005` Medcare         | medcare-rs            |
-| `0x0003_0103` | `0x0103` billable_work_entry | `0x0003` WoA            | woa-rs                |
-| `0x0004_0103` | `0x0103` billable_work_entry | `0x0004` SMB            | smb-office-rs         |
-| `0x0001_0103` | `0x0103` billable_work_entry | `0x0001` OpenProject    | openproject-nexgen-rs |
-| `0x0007_0103` | `0x0103` billable_work_entry | `0x0007` Redmine        | (Consumer TBD)        |
-| `0x0002_0103` | `0x0103` billable_work_entry | `0x0002` Odoo           | odoo-rs               |
+| `0x0102_0001` | `0x0102` project_work_item  | `0x0001` OpenProject     | openproject-nexgen-rs |
+| `0x0102_0007` | `0x0102` project_work_item  | `0x0007` Redmine         | (Consumer TBD)        |
+| `0x0901_0005` | `0x0901` patient            | `0x0005` Medcare         | medcare-rs            |
+| `0x0103_0003` | `0x0103` billable_work_entry | `0x0003` WoA            | woa-rs                |
+| `0x0103_0004` | `0x0103` billable_work_entry | `0x0004` SMB            | smb-office-rs         |
+| `0x0103_0001` | `0x0103` billable_work_entry | `0x0001` OpenProject    | openproject-nexgen-rs |
+| `0x0103_0007` | `0x0103` billable_work_entry | `0x0007` Redmine        | (Consumer TBD)        |
+| `0x0103_0002` | `0x0103` billable_work_entry | `0x0002` Odoo           | odoo-rs               |
 
 Gleiche `0x0103` → gleicher RBAC-Grant, gleiche Ontologie, gleiche
 Cross-Fork-Identität. Fünf Apps rendern *abrechenbare Zeit* auf fünf
@@ -70,7 +76,7 @@ Arten; Planer-Stunden stimmen mit der Abrechnung per Codebook-Lookup
 | Zug       | Aufruf                                     | Deiner?   |
 |-----------|--------------------------------------------|-----------|
 | pull      | `Port::class_id(name) -> Option<u16>`      | nein — reine Funktion |
-| render    | `Port::APP_PREFIX \| (cid as u32)`         | nein — typisierter Helfer |
+| render    | `((cid as u32) << 16) \| Port::APP_PREFIX` | nein — typisierter Helfer |
 | authorize | `authorize(actor, cid, op)` ²              | nein — geteiltes Grant-Gitter |
 | enrich    | deine Domänen-Logik, an `cid` verschlüsselt | **ja**   |
 

README.md

@@ -8,18 +8,23 @@ The [Active Record pattern](https://martinfowler.com/eaaCatalog/activeRecord.htm
 (Martin Fowler, 2003) as a canonical 32-bit `classid`. One codebook;
 every consumer pulls, never re-mints.
 
+> Order flipped 2026-07-02 — canon HIGH / custom LOW: the canonical
+> concept sits in the high u16, the per-app render prefix sits in the
+> low u16. Pre-flip material and already-baked data use the legacy
+> order; see `docs/DISCOVERY-MAP.md` D-CLASSID-CANON-HIGH-FLIP.
+
 ```rust
 let cid: u16  = HealthcarePort::class_id("Patient");        // 0x0901
-let render    = HealthcarePort::APP_PREFIX | (cid as u32);  // 0x0005_0901
-authorize(actor, cid, Op::Read);                            // shared grant on lo u16
+let render    = ((cid as u32) << 16) | HealthcarePort::APP_PREFIX;  // 0x0901_0005
+authorize(actor, cid, Op::Read);                            // shared grant on hi u16
 //                                                          // enrich locally — yours
 ```
 
 ```
-classid : u32  =  0xAAAA ‖ 0xDDCC                  both halves are ADDRESS
+classid : u32  =  0xDDCC ‖ 0xAAAA                  both halves are ADDRESS
                     │         │
-                    │         └─ lo u16 — WHICH CONCEPT  (shared identity)
-                    └─────────── hi u16 — WHOSE RENDER   (per-app skin)
+                    │         └─ lo u16 — WHOSE RENDER   (per-app skin)
+                    └─────────── hi u16 — WHICH CONCEPT  (shared identity)
 
          ──────►  resolves to  ──────►
             ├─ ClassView                the SKIN    (per-app)
@@ -49,16 +54,16 @@ Django, Prisma — same vocabulary, one IR.
 
 ## Render lens — one concept, many apps
 
-| classid       | concept (lo u16)            | render (hi u16)          | app                  |
+| classid       | concept (hi u16)            | render (lo u16)          | app                  |
 |---------------|-----------------------------|--------------------------|----------------------|
-| `0x0001_0102` | `0x0102` project_work_item  | `0x0001` OpenProject     | openproject-nexgen-rs |
-| `0x0007_0102` | `0x0102` project_work_item  | `0x0007` Redmine         | (consumer TBD)        |
-| `0x0005_0901` | `0x0901` patient            | `0x0005` Medcare         | medcare-rs            |
-| `0x0003_0103` | `0x0103` billable_work_entry | `0x0003` WoA            | woa-rs                |
-| `0x0004_0103` | `0x0103` billable_work_entry | `0x0004` SMB            | smb-office-rs         |
-| `0x0001_0103` | `0x0103` billable_work_entry | `0x0001` OpenProject    | openproject-nexgen-rs |
-| `0x0007_0103` | `0x0103` billable_work_entry | `0x0007` Redmine        | (consumer TBD)        |
-| `0x0002_0103` | `0x0103` billable_work_entry | `0x0002` Odoo           | odoo-rs               |
+| `0x0102_0001` | `0x0102` project_work_item  | `0x0001` OpenProject     | openproject-nexgen-rs |
+| `0x0102_0007` | `0x0102` project_work_item  | `0x0007` Redmine         | (consumer TBD)        |
+| `0x0901_0005` | `0x0901` patient            | `0x0005` Medcare         | medcare-rs            |
+| `0x0103_0003` | `0x0103` billable_work_entry | `0x0003` WoA            | woa-rs                |
+| `0x0103_0004` | `0x0103` billable_work_entry | `0x0004` SMB            | smb-office-rs         |
+| `0x0103_0001` | `0x0103` billable_work_entry | `0x0001` OpenProject    | openproject-nexgen-rs |
+| `0x0103_0007` | `0x0103` billable_work_entry | `0x0007` Redmine        | (consumer TBD)        |
+| `0x0103_0002` | `0x0103` billable_work_entry | `0x0002` Odoo           | odoo-rs               |
 
 Same `0x0103` → same RBAC grant, same ontology, same cross-fork
 identity. Five apps render *billable time* five ways; planner hours
@@ -69,7 +74,7 @@ align with billing by codebook lookup, not translation.
 | Move      | Call                                       | Yours?    |
 |-----------|--------------------------------------------|-----------|
 | pull      | `Port::class_id(name) -> Option<u16>`      | no — pure function |
-| render    | `Port::APP_PREFIX \| (cid as u32)`         | no — typed helper |
+| render    | `((cid as u32) << 16) \| Port::APP_PREFIX` | no — typed helper |
 | authorize | `authorize(actor, cid, op)` ²              | no — shared grant lattice |
 | enrich    | your domain logic keyed on `cid`           | **yes**   |