audit: M4 cycle close — drift fixes, bench ratified clean

Architect review over 024e865..HEAD (issues #296/#348/#297/#299). Holds
confirmed: zero process::exit in the assembly crate with the milestone
promise pinned in-process; C1/C18 record shapes untouched with guard and
stamp sharing one label constructor; the C30/#348 re-arm transition-safe
with no stale references. Drift resolved in this commit: the C14 contract
now records the context-borne reproduce guard classes (#299), C30 carries
the source-level-identity limit in the contract itself (not only in
build.rs), the guide's exit-class prose no longer names the retired run
verb, C28 durably enumerates the deliberate print residuum, and the
pip_or_refuse doc names reproduce (not 'the CLI shell') as the from_choice
home.

Bench: all 5 fingerprints OK (engine/ingest/campaign_sweep/campaign_heavy/
cli_fixed_cost); metric deltas within load noise on a busy box (loadavg
12 warning), report-only, no baseline moved.

crates/aura-runner/src/member.rs

@@ -159,8 +159,8 @@ fn no_data_in_window(symbol: &str, from_ms: Option<i64>, to_ms: Option<i64>, env
 
 /// Resolve the per-instrument pip from the recorded geometry sidecar, or refuse
 /// (#297: returned, not printed) when the symbol has no recorded geometry — the
-/// single home of the guessed-pip refusal, shared by `open_real_source` and the
-/// CLI shell's `DataSource::from_choice`. Reads the symbol's geometry metadata
+/// single home of the guessed-pip refusal, shared by `open_real_source` and
+/// reproduce's `DataSource::from_choice` chain (`family.rs`). Reads the symbol's geometry metadata
 /// (not bar data) before the run source opens, so an instrument with no
 /// recorded geometry refuses without a guessed pip; the pip is the provider's
 /// recorded value, honest by construction.

docs/authoring-guide.md

@@ -855,9 +855,9 @@ mismatch, a compile error, a tap-bind content fault (unknown fold/tap,
 duplicate) — are the content of the argv-named file and exit 2 like a usage
 error; only its environment refusals (a tap-trace store write failure)
 exit 1. The no-data family (no local data, no data in the requested window,
-no recorded geometry) belongs to the real-data verbs — `aura run`,
-`reproduce`, the campaign legs — where it likewise exits 1 (#297; the full
-partition lives in [C14](design/contracts/c14-headless-two-faces.md)). `aura
+no recorded geometry) belongs to the real-data paths — `reproduce` and the
+campaign legs — where it likewise exits 1 (#297; the full partition lives
+in [C14](design/contracts/c14-headless-two-faces.md)). `aura
 reproduce`'s identity/pip guard (a stored member's recorded instrument or
 broker/pip label contradicting the source it re-derives against) is
 likewise class 1 on the plain verb — its source is derived from the

docs/design/contracts/c14-headless-two-faces.md

@@ -95,6 +95,17 @@ mismatch, unknown param, compile error) is class 2 argv-content; a
 well-formed value the node itself refuses in its own domain is class 1,
 regardless of which leg hit it.
 
+**The reproduce guard's classes are context-borne (#299, 2026-07-26).**
+Reproducing a stored family refuses up front when the effective data
+source's identity or pip/broker geometry contradicts the member manifests
+(divergence would be mechanical — refusing beats reporting a false
+`DIVERGED`). The refusal prose is one; the class is carried by who named
+the source: the explicit-source library seam (`reproduce_family_in`)
+refuses class 2 (the caller named it), while the plain verb's derived
+path — the source is reconstructed from the manifest — refuses the same
+drift as class 1 (environment/data: a re-ingested sidecar, a stored label
+outside the known shapes; nobody named the faulting input).
+
 **Single document grammar (#319, 2026-07-25).** The five dual-grammar
 subcommands (run/sweep/walkforward/mc/generalize) that used to keep two
 grammars under one token are retired; one verb, `exec <target>`, dispatches

docs/design/contracts/c28-stratification.md

@@ -185,6 +185,11 @@ reports it through its existing string-error channel into the campaign
 summary's exit. Refusal prose is byte-identical everywhere;
 only who prints it changed, plus — per the adjudicated C14 partition — the
 exit class of refusals whose fault is in the content of what argv named.
+What remains printing in the assembly crate is the deliberate note/info
+residuum — the fold/trace notes and the traces-persisted line
+(`runner.rs`) and the stale-dylib warning (`project.rs`) — benign
+diagnostics that print and never exit; migrating them needs a note-channel
+design of its own.
 
 ## See also
 - [C1](c01-determinism.md) — determinism / bit-identity, the correctness invariant the layer cuts preserve

docs/design/contracts/c30-stability-discipline.md

@@ -34,7 +34,10 @@ hand-maintained version.
    by build.rs). The aura-core stamp must be equally honest: a
    build-identity fingerprint derived mechanically from aura-core's
    sources, so a node dylib loads only against the aura-core it was
-   built from. A hand-maintained version that never moves disarms the
+   built from — *source-level* identity, an accepted limit: the
+   consuming build's lockfile and feature selection stay outside the
+   stamp, so the seam refuses staleness of aura-core itself, never the
+   full link graph. A hand-maintained version that never moves disarms the
    refusal (the pre-C30 state: `CORE_VERSION` frozen at 0.1.0 matched
    every stale dylib); a hand-bumped one re-arms it only between bumps —
    an implicit ABI promise this contract refuses to make. *(Re-armed by