audit: run-tail close — ledger and glossary reconciled to the shipped state

The tail audit over d1e01ef..62f6592 found no code drift against the
contracts (C18 name-resolution read-only, C23 doc identity-blind and
inline-dissolved, C1 fit deterministic) but four lagging records, fixed
here: the #106 real-roller amendment gains the #239 fit-to-window note
(fixed sizes are a ceiling on the sugar path); a #125 realization note
records the composite doc as a C23 debug symbol with its serde/identity/
viewer treatment; the glossary identity-id and composite entries name
the doc; GraphSession::finish states the deliberate absence of a
doc-carrying op-script surface (refs #125) instead of leaving the
authoring asymmetry silent.

docs/design/INDEX.md

@@ -378,6 +378,21 @@ and params and across both graph levels. This does **not** close #21 (a swapped
 same-kind wiring is still only kind-checked) — it makes those slots
 self-documenting; a name-consuming validation is its own future cycle.
 
+**Realization (2026-07-11 — composite `doc`, #125).** `Composite` carries an
+optional authored rationale `doc: Option<String>` — the prose twin of its `name`
+and the same C23 category: a non-load-bearing debug symbol. Authored via
+`Composite::with_doc` / `GraphBuilder::doc`; persisted as a Tier-1
+additive-optional `CompositeData` field (no format-version bump; absent-field
+documents keep their exact bytes, so existing content ids are untouched);
+**blanked in the identity projection** (`strip_debug_symbols`) while staying
+canonical-byte-bearing; dissolved at inline like the name (never reaches
+`FlatGraph`). Surfaced read-only (C22): the graph model emits an optional
+trailing `"doc"` fragment per scope (`json_str` hardened for multi-line free
+text — `\n`/`\t`/`\r` named, other control chars as `\u00XX`), the viewer shows
+it in both composite view states (collapsed tooltip, expanded cluster frame) and
+the root's as a muted header line. The construction op-script vocabulary
+deliberately has no doc-carrying surface yet (scope cut recorded on #125).
+
 **Realization (cycle 0040 — wiring totality: every input slot connected exactly
 once, #65).** The node contract's "the engine provides a window into each input"
 presupposes each input is actually fed; until now an unwired interior input slot was
@@ -1888,7 +1903,13 @@ pip (resolved from the recorded geometry sidecar (`instrument_geometry`) — C10
 refuse-don't-guess; a symbol with no recorded geometry exits 2 before any data
 access), window, and — for walk-forward — its `WindowRoller` sizes
 (synthetic: bar-index 24/12/12; real: fixed calendar-time 90d/30d/30d in ns; CLI
-flags for these are deferred). The engine, ingest, and registry are untouched (C9 —
+flags for these are deferred). **[Amended 2026-07-11 (#239): on the dissolved
+`walkforward --real`/`mc --real` sugar path the fixed 90/30/30 sizes are a
+*ceiling*, not a constant — `fit_wf_ms_sizes` (aura-cli) passes them through
+byte-identically whenever they fit the resolved campaign window, and scales them
+down preserving the 3:1 IS:OOS ratio (step = OOS, one roll at the minimum) when
+the window is shorter; authored process documents still validate their declared
+sizes as-is.]** The engine, ingest, and registry are untouched (C9 —
 the whole change is in `aura-cli`); the synthetic path is byte-unchanged.
 **MC is excluded** (#106 Fork A): its seed varies a *synthetic* price-walk
 realization (C12 axis 4), which is undefined over real data's single realization —