docs: fix three drifts found in the session audit

C8: a node is producer/consumer/both — at most one output, pure consumers (sinks: chart/equity/logger) have none; records the node-role taxonomy the substrate requires (was wrongly 'exactly one output', contradicting pure consumers and C14). C3: merge by timestamp, normalizing source-native units (data-server Unix-ms) to the canonical epoch-ns of C7. aura-engine lib doc: broker is a downstream plugin over the position table (sim-optimal pip / realistic currency), not an in-strategy 'broker/portfolio node'. Plus a provenance line-wrap nit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/design/INDEX.md

@@ -8,8 +8,8 @@ its new rationale), never a silent refactor.
 Provenance: contracts C1–C18 were settled in the initial rough-sketch design
 interview (2026-06-03), walking the design tree root-to-leaf (C16–C18 and the
 C10 refinement to a broker-independent position table came in follow-up turns).
-The `CLAUDE.md`
-**Domain invariants** section is the compressed, always-loaded summary of the
+The `CLAUDE.md` **Domain invariants** section is the compressed, always-loaded
+summary of the
 subset that agents must never violate; this file is the fuller form with
 rationale.
 
@@ -61,8 +61,10 @@ leaks the future is worse than none. Making the future *physically absent* from
 what a node receives beats merely discouraging it.
 
 ### C3 — One merge, at ingestion only
-**Guarantee.** Heterogeneous timestamped sources are k-way-merged by `time_ms`
-into one chronological cycle stream at the ingestion boundary.
+**Guarantee.** Heterogeneous timestamped sources are k-way-merged by timestamp
+into one chronological cycle stream at the ingestion boundary; source-native
+time units (e.g. data-server's Unix-`time_ms`) are normalized there to the
+canonical epoch-ns `timestamp` of C7.
 **Forbids.** Any merge / as-of join *inside* the graph.
 **Why.** A single ordered timeline is the mechanism that makes heterogeneous-rate
 sources (news daily-bias + M5 + ticks) causally combinable without leaking the
@@ -117,9 +119,12 @@ required lookback depth, and firing group) + `eval(ctx) -> Option<Scalar>`. The
 engine provides read-only, zero-copy windows into each input's SoA ring buffer
 (`ctx.f64_in(x)[k]`, sized at wiring); a node may *additionally* keep its own
 mutable series for derived/intermediate state. `None`/Void return = filter /
-not-yet-warmed-up. A node has exactly one output (one series per node).
-**Forbids.** A node sizing/growing its input lookback at runtime; multiple named
-outputs per node (model as multiple nodes); copy-on-read of input history.
+not-yet-warmed-up. A node is a **producer, a consumer, or both**: a
+producer/transformer exposes **at most one** output (one series per node); a
+**pure consumer (sink)** — chart, equity, logger — has **no** output. Sources
+are pure producers; sinks are pure consumers.
+**Forbids.** A node sizing/growing its input lookback at runtime; more than one
+output per node (model as multiple nodes); copy-on-read of input history.
 **Why.** Engine-provided windows mean LLM-authored code cannot mis-manage
 lookback bookkeeping, and history passes through zero-copy. Fixed, pre-sized
 buffers suit deterministic, pre-dimensioned sims (no realloc in the hot loop).