audit: net-r cycle close — ledger reconciled, drift items resolved

Architect review over dd23ea3..HEAD (the #234/#152 cycle, 6 commits).

What holds (architect-confirmed): CostSpec is a closed, deny-unknown-
fields vocabulary with typed slots mirroring RiskRegime, field names
conforming to the builders' ParamSpec names; cost-less docs hash
byte-identically (C18); cost threads through the single MemberRunner
seam so every campaign stage nets uniformly; costed families reproduce
bit-identically incl. Carry; the #221-deleted leg is rebuilt optional
(net = gross under the empty model); both cost_graph leaks replaced by
the interned single source (#152).

Resolved this close: [high] the C10 realization notes contradicted
shipped reality — the two 'wired on the run path via --cost-*' claims
carry superseded-annotations, the 0084 carried-debt note a discharged-
annotation, and a new cycle-net-r realization documents the campaign
cost block, the net-by-default decision, the manifest/reproduce
round-trip, and the returned net_r_equity tap; [medium] two dangling
persist_traces_r docstring references reworded to what exists;
[medium] the one-knob-per-cost-node invariant behind the manifest
round-trip is now unit-pinned (exactly one distinctly-named knob per
shipped builder).

Cycle spec and plan (git-ignored working files) discarded per
convention.

refs #234

crates/aura-cli/src/campaign_run.rs

@@ -633,7 +633,7 @@ fn present_campaign(
 }
 
 /// Which drained wrap-convention channel a requested tap persists from on a
-/// campaign trace re-run. The routing mirrors `persist_traces_r` (main.rs):
+/// campaign trace re-run. The routing follows the wrap-convention channels:
 /// equity <- the SimBroker equity recorder (tx_eq), exposure <- the Bias
 /// recorder (tx_ex), r_equity <- the cum_realized_r + unrealized_r recorder
 /// (tx_req), net_r_equity <- the cost leg's LinComb(4) net-curve recorder
@@ -747,9 +747,8 @@ fn cell_member_fanout(cell_out: &CellOutcome) -> Vec<(Option<String>, &RunReport
 /// drift alarm — manifest fields are fresh-context and not compared), and
 /// writes the requested-AND-producible taps through the sweep verbs'
 /// member-dir mechanism: a slash-joined `"{name}/{key}"` handed to
-/// `TraceStore::write` (the `persist_traces_r(&format!("{name}/{key}"), ..)`
-/// layout — the fn itself is not reused: it writes a fixed tap set and
-/// process-exits on error). The written index manifest is the RECORDED
+/// `TraceStore::write` (the slash-joined member-dir layout the sweep verbs
+/// established). The written index manifest is the RECORDED
 /// member's — the trace documents that run's provenance, not a re-derived
 /// fresh-context one. Loud stderr per no-candidate cell (neither a nominee
 /// nor a non-empty terminal family) and ONCE per unproducible requested tap
@@ -1309,4 +1308,29 @@ mod tests {
         );
         assert!(cost_nodes_for(&[]).is_empty(), "an empty model binds no nodes");
     }
+
+    #[test]
+    /// #234: the manifest-stamp/reproduce round-trip (`cost[k].<knob>` ->
+    /// `cost_specs_from_params`) reconstructs a component from its knob NAME —
+    /// sound only while every shipped cost node declares exactly one,
+    /// distinctly-named knob. A second knob (or a name collision) would break
+    /// variant reconstruction with no compiler error; this pin makes it loud.
+    fn every_cost_builder_declares_exactly_one_distinct_knob() {
+        let knobs: Vec<String> = [
+            aura_std::ConstantCost::builder(),
+            aura_std::VolSlippageCost::builder(),
+            aura_std::CarryCost::builder(),
+        ]
+        .iter()
+        .map(|b| {
+            let params = b.params();
+            assert_eq!(params.len(), 1, "one knob per cost node: {}", b.label());
+            params[0].name.clone()
+        })
+        .collect();
+        let mut dedup = knobs.clone();
+        dedup.sort();
+        dedup.dedup();
+        assert_eq!(dedup.len(), knobs.len(), "knob names must be pairwise distinct: {knobs:?}");
+    }
 }