audit: #319 cycle close — architect drift resolved, bench green

Architect review over 9cfe296..dc5f174 (drift_found -> all five items
fixed in this close): C24's family-machinery sentence re-amended to
current truth (synthetic walks are reproduce-only inputs since the
builder retirement; superseded text to the sidecar); the ported
generalize test's doc no longer promises the retired CrossInstrument
family handle and its stale section header is gone;
FamilyKind::CrossInstrument carries its C18 dead-machinery/read-back
note in code; live comments in campaign_run, bench surfaces, and
graph_construct name exec instead of the retired verbs; the five
inlined topology_hash copies in the bin test module consolidated into
one test helper. What holds, per the architect: C24<->code gated-intake
lockstep exact, C12's single-hash claim true in code, exec dispatch
matches C14's amended text.

Bench (regression gate) exit 0, all five fingerprints OK:
engine_throughput bars_per_s 14014049 (+0.1%), ingest_throughput
12935441 (-0.5%), campaign_sweep wall 1.407s (+0.9%), campaign_heavy
wall 5.688s (+2.1%), cli_fixed_cost run_ms 3.6 (+6.6%, spawn-floor
jitter under parallel-agent load, report-only). No baseline moved.
Also rides: the reviewer re-check's two comment nits (classify-once
wording, SIGPIPE example verb).

refs #319

crates/aura-bench/src/surfaces/mod.rs

@@ -105,7 +105,7 @@ mod tests {
 
     /// `run_reps` composed with the real campaign sweep surface — a fresh
     /// scratch project, a freshly seeded blueprint, and a genuine
-    /// `aura campaign run` child process spawned per repetition (not an
+    /// `aura exec` child process spawned per repetition (not an
     /// in-process shortcut). Protects that two independently built-and-run
     /// scratch campaigns agree on the winner-ordinal fingerprint extracted
     /// from the child's stdout — C1's determinism carried through the
@@ -136,7 +136,7 @@ mod tests {
 
     /// `run_reps` composed with the real CLI fixed-cost surface — a genuine
     /// `aura --help` spawn-floor wall plus a fresh scratch project and a real
-    /// `aura run` child process per repetition (not an in-process shortcut).
+    /// `aura exec` child process per repetition (not an in-process shortcut).
     /// Protects that two independent scratch runs agree on the run-line FNV
     /// fingerprint extracted from the child's stdout, and that the metrics
     /// map carries the wall-clock keys the fixed_cost `BaselineDoc` needs.

crates/aura-cli/src/campaign_run.rs

@@ -1,4 +1,5 @@
-//! `aura campaign run` — the driver that turns a stored campaign document into
+//! `aura exec`'s campaign legs (#319; formerly `aura campaign run`) — the
+//! driver that turns a stored campaign document into
 //! a realized run-set (#198). The execution *semantics* (preflight, cell loop,
 //! stage sequencing, selection, registry writes) live in `aura-campaign`; the
 //! [`MemberRunner`](aura_campaign::MemberRunner) implementation over the shipped loaded-blueprint machinery
@@ -108,7 +109,7 @@ struct CampaignRunLine<'a> {
     campaign_run: &'a CampaignRunRecord,
 }
 
-/// `aura campaign run <target>`: resolve, gate, execute, emit. Every `Err`
+/// `aura exec <target>` (campaign legs): resolve, gate, execute, emit. Every `Err`
 /// is a refusal `campaign_cmd` renders as `aura: {msg}` + exit 1; an `Ok`
 /// carries the failed-cell count (#272) so the caller can exit 3 on a
 /// completed-with-failures run via `exit_on_campaign_result`. `overrides`

crates/aura-cli/src/graph_construct.rs

@@ -726,7 +726,7 @@ pub fn introspect_cmd(cmd: crate::GraphIntrospectCmd, env: &aura_runner::project
 /// Phrase a blueprint-document `LoadError` as prose (Debug-leak-free; the
 /// engine error types are `Display`-free by convention — this is the CLI's
 /// presentation layer, like `format_op_error`). `pub(crate)`: shared by the
-/// `graph build` path (below) and `aura run`'s loaded-blueprint branch
+/// `graph build` path (below) and `aura exec`'s blueprint leg
 /// (main.rs) — env-agnostic on purpose, so both callers get identical wording
 /// (#184).
 pub(crate) fn blueprint_load_prose(e: &LoadError) -> String {
@@ -902,7 +902,7 @@ pub(crate) fn gate_authored_root_name(name: &str) -> Result<(), String> {
 /// Resolve a blueprint document's bytes from a file path or a 64-hex content
 /// id in the project store (the campaign-run target-addressing convention).
 /// The id shape is `aura_runner::axes::is_content_id` — the same predicate
-/// `campaign run`'s target resolution uses, so the two FILE-or-id surfaces
+/// `exec`'s campaign-target resolution uses, so the two FILE-or-id surfaces
 /// cannot drift apart on what counts as a store address. The `bool` names
 /// which branch fired: `true` for a FRESH FILE read, `false` for a STORE
 /// (content-id) fetch — `params_lines` (#331 delta re-review) uses it to

crates/aura-cli/src/main.rs

@@ -1031,7 +1031,7 @@ fn tap_plan_from_args(args: &[String]) -> Result<TapPlan, String> {
 
 /// The one executor verb (#319): a campaign document (file or content id)
 /// or a signal blueprint (single run). Flag discipline is per-leg. A
-/// `.json` file target is read and classified ONCE (review Minor-3): a file
+/// `.json` file target is CLASSIFIED once, up front (review Minor-3): a file
 /// that does not parse as JSON at all refuses neutrally here, before either
 /// leg's own document-shape validation ever runs — so a malformed campaign
 /// document is never misattributed to the blueprint leg's "blueprint
@@ -1514,7 +1514,7 @@ fn data_info_report(symbol: &str, geo: Option<&aura_ingest::InstrumentGeometry>)
 
 fn main() {
     // Restore the default SIGPIPE disposition. Rust's runtime sets SIGPIPE to SIG_IGN
-    // at startup, so a write to a closed stdout pipe (`aura sweep | head`, a closed UI
+    // at startup, so a write to a closed stdout pipe (`aura exec | head`, a closed UI
     // pane) returns EPIPE and panics in `println!` instead of terminating quietly on
     // SIGPIPE — the conventional Unix CLI behaviour. One reset covers every
     // family-emitting subcommand at once.
@@ -1561,6 +1561,15 @@ fn main() {
 mod tests {
     use super::*;
 
+    /// The manifest `topology_hash` a test expects for a signal — the same
+    /// `content_id`-over-canonical-bytes computation
+    /// `aura_runner::member::run_signal_r`/`run_blueprint_member` inline on
+    /// the record-line path (#319: the retired CLI-side wrapper's five
+    /// per-test copies consolidated here at audit close).
+    fn test_topology_hash(signal: &Composite) -> String {
+        content_id(&blueprint_to_json(signal).expect("a buildable signal serializes"))
+    }
+
     /// An empty (or absent) archive is informational absence, not a fault
     /// (#264), but under the all-JSON namespace reshape (#273) stdout must
     /// stay pure NDJSON: `data_list_report` returns an empty `Vec` rather
@@ -2024,11 +2033,7 @@ mod tests {
         let doc = blueprint_to_json(&open).expect("serializes");
         let data = DataSource::Synthetic;
         let reload = || blueprint_from_json(&doc, &|t| std_vocabulary(t)).expect("loads");
-        // topology_hash's own two-line body, inlined (mirrors
-        // `aura_runner::member::run_signal_r`'s and `run_blueprint_member`'s
-        // own copy — the #319 Task 9 finding: the CLI-side `topology_hash`
-        // wrapper is retired, its only production/test callers gone).
-        let topo = content_id(&blueprint_to_json(&reload()).expect("a buildable signal serializes"));
+        let topo = test_topology_hash(&reload());
         let binding = aura_runner::binding::resolve_binding("everymember", reload().input_roles(), &BTreeMap::new())
             .expect("the price role resolves");
         let window = data.full_window(&env);
@@ -2097,11 +2102,7 @@ mod tests {
         let closed = load_closed_r_sma();
         let doc = blueprint_to_json(&closed).expect("serializes");
         let reload = || blueprint_from_json(&doc, &|t| std_vocabulary(t)).expect("loads");
-        // topology_hash's own two-line body, inlined (mirrors
-        // `aura_runner::member::run_signal_r`'s and `run_blueprint_member`'s
-        // own copy — the #319 Task 9 finding: the CLI-side `topology_hash`
-        // wrapper is retired, its only production/test callers gone).
-        let topo = content_id(&blueprint_to_json(&reload()).expect("a buildable signal serializes"));
+        let topo = test_topology_hash(&reload());
         let space = blueprint_axis_probe(&doc, &env).param_space();
         let pip = data.pip_size();
         let window = data.full_window(&env);
@@ -2167,11 +2168,7 @@ mod tests {
         let data = DataSource::Synthetic;
         let doc = blueprint_to_json(&load_closed_r_sma()).expect("serializes");
         let reload = || blueprint_from_json(&doc, &|t| std_vocabulary(t)).expect("loads");
-        // topology_hash's own two-line body, inlined (mirrors
-        // `aura_runner::member::run_signal_r`'s and `run_blueprint_member`'s
-        // own copy — the #319 Task 9 finding: the CLI-side `topology_hash`
-        // wrapper is retired, its only production/test callers gone).
-        let topo = content_id(&blueprint_to_json(&reload()).expect("a buildable signal serializes"));
+        let topo = test_topology_hash(&reload());
         let space = blueprint_axis_probe(&doc, &env).param_space();
         let pip = data.pip_size();
         let window = data.full_window(&env);
@@ -2244,11 +2241,7 @@ mod tests {
         let doc = blueprint_to_json(&closed).expect("serializes");
         let reload = || blueprint_from_json(&doc, &|t| std_vocabulary(t)).expect("loads");
         let data = DataSource::Synthetic;
-        // topology_hash's own two-line body, inlined (mirrors
-        // `aura_runner::member::run_signal_r`'s and `run_blueprint_member`'s
-        // own copy — the #319 Task 9 finding: the CLI-side `topology_hash`
-        // wrapper is retired, its only production/test callers gone).
-        let topo = content_id(&blueprint_to_json(&reload()).expect("a buildable signal serializes"));
+        let topo = test_topology_hash(&reload());
         let binding = aura_runner::binding::resolve_binding("everymc", reload().input_roles(), &BTreeMap::new())
             .expect("the price role resolves");
         let space = blueprint_axis_probe(&doc, &env).param_space();
@@ -2305,11 +2298,7 @@ mod tests {
         let doc = blueprint_to_json(&closed).expect("serializes");
         let reload = || blueprint_from_json(&doc, &|t| std_vocabulary(t)).expect("loads");
         let data = DataSource::Synthetic;
-        // topology_hash's own two-line body, inlined (mirrors
-        // `aura_runner::member::run_signal_r`'s and `run_blueprint_member`'s
-        // own copy — the #319 Task 9 finding: the CLI-side `topology_hash`
-        // wrapper is retired, its only production/test callers gone).
-        let topo = content_id(&blueprint_to_json(&reload()).expect("a buildable signal serializes"));
+        let topo = test_topology_hash(&reload());
         let binding = aura_runner::binding::resolve_binding("mcseedlabel", reload().input_roles(), &BTreeMap::new())
             .expect("the price role resolves");
         let space = blueprint_axis_probe(&doc, &env).param_space();

crates/aura-cli/tests/cli_run.rs

@@ -2169,13 +2169,14 @@ fn sweep_over_a_bound_override_matches_the_historical_open_bind() {
 // hand-built-fixture unit tests (`build_chart_data_threads_run_manifest_into_meta`
 // here, `render_chart_html_*` in render.rs), which never touch the CLI or disk.
 
-// --- `aura run --harness <name>` selector (iter-3 Task 3) --------------------
+// --- cross-instrument generalization (ported off the retired verbs, #319) ----
 
-/// Property: `aura generalize` grades a single r-sma candidate across two
-/// instruments — its stdout carries the per-instrument breakdown + the worst-case
-/// floor + the sign-agreement, then the persisted CrossInstrument family handle.
-/// Gated on local GER40/USDJPY data (the shared Sept-2024 window), skips cleanly
-/// when the archive is absent.
+/// Property: a generalize-stage campaign grades a single r-sma candidate across
+/// two instruments — the campaign-run record carries the per-instrument
+/// breakdown + the worst-case floor + the sign-agreement (no merged
+/// CrossInstrument family is persisted on the campaign path; the record's
+/// generalizations[] is the artifact). Gated on local GER40/USDJPY data (the
+/// shared Sept-2024 window), skips cleanly when the archive is absent.
 #[test]
 fn generalize_grades_a_candidate_across_two_instruments() {
     // Ported onto a `[std::sweep, std::generalize]` campaign document

crates/aura-registry/src/lineage.rs

@@ -31,6 +31,11 @@ pub enum FamilyKind {
     Sweep,
     MonteCarlo,
     WalkForward,
+    /// Dead machinery since the #319 sugar retirement (C18): no producer
+    /// mints a merged cross-instrument family anymore — the campaign-run
+    /// record's `generalizations[]` carries the data. The variant stays for
+    /// store read-back of historically minted families (never retroactively
+    /// invalidated, C29).
     CrossInstrument,
 }
 

docs/design/contracts/c24-blueprint-data.history.md

@@ -235,3 +235,14 @@ prepend bare `aura: `. Store read-back (`reproduce`, `use` resolution,
 registered artifact is never retroactively invalidated."
 
 **[C26, 2026-07-10 (#231): the single-price data weld inside the surviving `wrap_r` scaffolding is retired — input roles bind archive columns by name; the wrapper's remaining R-scaffolding retirement stays #159.]** (From the C24 Forbids clause as of that date; the single-price weld was retired at #231/C26, but `wrap_r` itself survives — its full R-scaffolding retirement stays deferred, #159.)
+
+---
+
+> The disjoint-parallel synthetic
+> price walks a sweep/MC family draws (`aura_runner::family`) are the family
+> machinery, not trader-grade statistics; a real-data block-bootstrap — and
+> retiring the `synthetic_walk_sources` `len:60`↔warm-up coupling — rides #172.
+
+(superseded by the #319 sugar retirement, 2026-07-25 — audit-close correction:
+no family-minting path draws synthetic walks after the family-builder
+retirement; only `reproduce` consumes them)

docs/design/contracts/c24-blueprint-data.md

@@ -98,10 +98,13 @@ a collision with a document-declared axis).
 Every member manifest carries the **shared** `topology_hash` (one signal
 topology, only params vary; `member_key` distinguishes members), and the
 executor stores its blueprint(s) content-addressed so `aura reproduce`
-re-derives every member bit-identically (C18). The disjoint-parallel synthetic
-price walks a sweep/MC family draws (`aura_runner::family`) are the family
-machinery, not trader-grade statistics; a real-data block-bootstrap — and
-retiring the `synthetic_walk_sources` `len:60`↔warm-up coupling — rides #172.
+re-derives every member bit-identically (C18). The synthetic price walks
+(`aura_runner::family::synthetic_walk_sources`) survive the #319 retirement
+only as `reproduce`'s re-derivation inputs for historically minted synthetic
+families — no family-minting path draws them anymore (the campaign executor
+is the one family builder, C20) — and they are not trader-grade statistics; a
+real-data block-bootstrap — and retiring the `len:60`↔warm-up coupling —
+rides #172.
 
 ### Reproduction identity