audit: cycle metric-vocabulary tidy — ledger records the retired #147 deferral

Cycle-close audit (architect: drift_found, design core clean). What holds,
architect-confirmed: C18 bit-identity for RunMetrics (prose derived
byte-identically, rng order preserved, registry suite unchanged); the C10
wall (monomorphic R-gates, r_based in the R vocabulary, cross-vocabulary
refusal tested both ways — no leak); C28 direction (trait in aura-analysis,
vocabulary supplied from the outer rungs, zero Cargo edge changes); C1
determinism pinned through the generic path.

Drift items, all resolved as fixes in this commit:
- design ledger: the C28 #147 disposition now records item 2 SHIPPED (the
  A1 cut) with A2 still deliberately deferred; the #136 one-implementor
  clause carries a supersession note (the IC is the second implementor).
- seven stale doc comments describing the pre-#147 or mid-cycle state
  (analysis trait + estimator docs, registry check_r_metric C9 claim,
  engine re-export note, campaign PER_MEMBER_METRICS roster note,
  member-seam guard comment, research vocabulary note) updated to the
  shipped state.
- R_BASED_METRICS is now oracle-pinned against RunMetricKey::r_based()
  in the vocabulary test (it feeds the NonRMetric refusal prose; a
  divergence would have misreported the R-gate silently).

Noted, not amended (history stays): commit 6744f67's body says 'three
syntax-only edits' where the test module actually took five.

No regression scripts are configured (the bench is report-only); the
architect review is the gate. Verification: extended vocabulary test,
campaign suites, analysis/research suites green; clippy --workspace
-D warnings clean.

refs #147

crates/aura-campaign/src/lib.rs

@@ -133,10 +133,11 @@ pub enum ExecFault {
 /// `RunMetrics` scalars plus the 11 `RMetrics` scalars. The three
 /// selection-annotation names (`deflated_score` / `overfit_probability` /
 /// `neighbourhood_score`) are deliberately NOT here — they describe a
-/// selection, not a member. Hand-copied roster (the third metric-roster site
-/// beside aura-research's 17-name vocabulary and aura-registry's rankable
-/// set, #190); drift fails safe: an unknown name is a preflight refusal,
-/// never a wrong number.
+/// selection, not a member. Hand-copied roster beside aura-research's 17-name
+/// vocabulary (#190); the rankable set is single-sourced from the backtest
+/// vocabulary since #147, and this roster's nesting is oracle-pinned by the
+/// extended #190 guard. Drift fails safe: an unknown name is a preflight
+/// refusal, never a wrong number.
 pub const PER_MEMBER_METRICS: &[&str] = &[
     "total_pips", "max_drawdown", "bias_sign_flips",
     "expectancy_r", "n_trades", "win_rate", "avg_win_r", "avg_loss_r",

crates/aura-campaign/tests/member_seam_e2e.rs

@@ -89,8 +89,9 @@ fn member_runner_seam_dispatches_through_dyn_trait_object_and_carries_the_window
 /// Property: every metric name in `RANKABLE_METRICS` (the roster `preflight`
 /// permits a `std::sweep`/`std::walk_forward` stage to SELECT on) is also a
 /// member of `PER_MEMBER_METRICS` and resolves to `Some` via `member_metric`.
-/// The two rosters are independently hand-copied (documented drift risk,
-/// #190); were they to diverge, `preflight` would accept a selection metric
+/// Since #147 the rankable roster is a single-source re-export and the
+/// nesting is guard-pinned; were the rosters still to diverge, `preflight`
+/// would accept a selection metric
 /// that `member_metric` silently reads back as `None` for every member — a
 /// sweep/walk_forward stage that always empties, not a compile error or an
 /// early refusal.