diff --git a/CLAUDE.md b/CLAUDE.md
index 244b8a2..f71c7a9 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -121,11 +121,18 @@ design decision, not a refactor, and belongs in the ledger.
    a Rust crate** (a cdylib library of node / strategy / experiment blueprints +
    a static `Aura.toml`), hosted by `aura` during research and frozen to a
    standalone binary for deploy.
-10. **Authoring surface — all logic is Rust.** Nodes, strategies, *and*
-    experiments/harnesses are authored in native Rust via Claude Code + the
-    skills pipeline, using builder APIs. Declarative config (`Aura.toml`) carries
-    only static project context, never logic — no experiment/strategy DSL (the
-    RustAst trap). aura ships no embedded coding-LLM; IONOS LLMs are used only as
+10. **Authoring surface — all logic is Rust.** Node, strategy, and harness
+    *logic* is authored in native Rust via Claude Code + the skills pipeline,
+    using builder APIs. Declarative config (`Aura.toml`) carries only static
+    project context, never logic — no experiment/strategy DSL (the RustAst
+    trap). **Clarification (2026-07-03, #188/C25):** a *closed-vocabulary data
+    artifact* — an op-script, a blueprint, a process or campaign document — is
+    NOT the forbidden DSL: what failed historically (RustAst) was an *open,
+    logic-bearing* language; closed, typed vocabularies as serialized data
+    (Blockly-litmus-clean, at most the total P1 construct tier) are the proven
+    pattern, and experiment *intent* lives in them (C20/C25). Genuinely new
+    logic escalates to a new Rust block (role 2), never to a freetext hole in
+    an artifact. aura ships no embedded coding-LLM; IONOS LLMs are used only as
     a runtime data source (news bias), with per-session consent, never in the
     code path.
 11. **Construction is a bootstrap phase.** Blueprints (param-generic graph-as-
diff --git a/docs/design/INDEX.md b/docs/design/INDEX.md
index f1ce499..0c544d4 100644
--- a/docs/design/INDEX.md
+++ b/docs/design/INDEX.md
@@ -1584,6 +1584,18 @@ structural variation **first-class and searchable** rather than a hand-enumerate
 menu — `HarnessKind` and the per-strategy `*_sweep_family` functions in `aura-cli`
 are the pre-C24 scaffolding (topology-as-engine-source, a C16 tension), retired as
 C24 + the project-as-crate layer land.
+**Refinement (2026-07-03, #188/#189 — experiment INTENT is campaign-document data).**
+The "ordinary Rust control flow, not a config schema" clause and the forbids-clause
+"declarative experiment mini-DSL" are scoped by the #188 role-model pass: they forbid an
+open, logic-bearing experiment language (the RustAst trap), **not** the closed-vocabulary
+**campaign document** (C25/C18) that now carries persisted experiment intent — data
+windows × strategy ids × param axes × process ref under the total, declarative P1
+construct tier (bounded axes, gates, ladders; no variables, no general recursion, no
+unbounded iteration — invariant 5's no-free-feedback move applied one level up). A
+*generator* that enumerates structural variants may still be plain Rust (role 2/6a
+technique); what it yields, and what a campaign declares, is data. Genuinely new logic
+(metrics, analysis blocks) escalates to a new Rust block (role 2), never to a freetext
+hole in the artifact.
 
 ### C21 — The World: the meta-level is the product
 **Guarantee.** Above the harness sits the **World** — the project's program /
@@ -1778,6 +1790,17 @@ scene-at-rest** (a World is a *program*, C21) — which does **not** forbid a fu
 blueprint *editor* over the World-owned topology-data (C24); should the playground
 ever become one, the data format is already the substrate it round-trips, not a new
 mechanism.
+**Refinement (2026-07-03, #188 — visual surfaces are stateless projections; C25).**
+The role-model pass generalizes the point beyond the playground: for **every**
+artifact class (blueprints, op-scripts, process/campaign documents), the canonical,
+complete form is **text**, every operation is executable headless, and any visual
+surface — viewer or editor — is a *stateless projection* that reads/writes that same
+canonical form and adds no semantics. Read-only projections (viewers, this
+contract's trace explorer) rank far above write editors in value; whether an editor
+is ever built is secondary, because the Blockly litmus test (C25) already
+disciplines each vocabulary to be palette-generatable without one. The shipped face
+is the **web-from-disk** front (revised 2026-06, #101 — not egui): disk-persisted
+traces rendered as self-contained HTML chart pages.
 
 ### C23 — Graph compilation and behaviour-preserving optimisation
 **Guarantee.** The bootstrap (C19) is a **compilation**: it lowers a param-generic,
@@ -2095,6 +2118,57 @@ reframed by C24/C21: from "topology baked at build time" to "the World may *gene
 topology at runtime (research plane), the chosen blueprint is frozen into the deploy
 artifact, and any run is deterministic once instantiated" (C1).
 
+### C25 — The role model: nine authoring roles, cut by artifact + surface + iteration cost
+**Guarantee.** aura's user-facing design is organized by **roles**, cut by the
+artifact a role owns, the surface/language it works in, and the iteration cost it
+tolerates — never by org chart. One trader — or an LLM actor, which is the point of
+the whole authoring design — must be able to fill *every* role; the separation
+separates *surfaces with different iteration costs and failure modes*, not people,
+and switching roles is a visible act. The nine roles (ratified 2026-07-03, #188):
+**1 system programmer** (the engine; Rust, this repo; all invariants),
+**2 extension dev** (native nodes + analysis blocks; Rust in project/shared crates;
+C7/C8, determinism in `eval`), **3 toolchain dev** (playground/viewer/skills
+pipeline; vendor-side; authoring ergonomics), **4 data curator** (recorded streams,
+sidecars, derived/news recordings; CLI + recording edge; C2/C3/C6),
+**5 methodology designer** (validation/eval **process documents** — "the game
+rules"; closed data vocabulary; anti-false-discovery), **6a strategy designer**
+(blueprint topologies; data — op-script/blueprint JSON, the graph idiom; C5/C7),
+**6b campaign designer** (**campaign documents** — persisted experiment intent;
+data, the pipeline/block idiom; C1), **7 player** (owns nothing — explores traces,
+tunes runtime params; the playground, C22/C12; read-only by design), and
+**8 operator/auditor** (frozen bots, reconciliation, money management; deploy-edge
+CLI, manifests, reproduce; C13). The 6a/6b split follows invariant 12's tier
+boundary (node/harness vs World); the interface between them is the id machinery
+(content id = byte-exact, identity id = topological). Param gradient: 6a defines
+topology + open params, 6b spans spaces over them, 7 moves inside those spaces
+live. A role is **recognizable** when four things exist: a named artifact type it
+owns, a surface addressed to it, an entry path, and its invariants enforced at its
+boundary. **Text-first / headless-first is an invariant, not a taste** (user,
+2026-07-03: editors must never be the only way; LLM operability demands it): every
+artifact class has a canonical, complete, text-serialized form; every operation is
+executable headless via CLI/API; visual surfaces are *stateless projections* that
+read/write the same canonical form and add no semantics — read-only projections
+(viewers) rank far above write editors. The **Blockly litmus test** is the
+acceptance criterion for every artifact vocabulary, editor or no editor: a block
+palette must be *generatable* from the vocabulary — every block with typed slots,
+every valid composition snappable, every invalid one not.
+**Forbids.** An artifact class whose only authoring path is a visual editor or a
+Rust compile cycle when the role's iteration cost demands data (the role-6b
+lesson: a tiny campaign change must never cost a compile); stringly-typed fields,
+implicit inter-block coupling, or "arbitrary JSON here" holes in a role's
+vocabulary (they fail the litmus test); collapsing the 6a/6b idioms into one
+surface (dataflow boxes-and-wires vs sequential pipeline blocks are different
+languages).
+**Why.** The game-engine analogy that seeded aura (C16) extends to its people:
+engines separate system programmers, toolchain devs, asset creators, level
+designers, and players because their artifacts, tools, and iteration loops
+differ — a design that forces one role's technique on another (Rust for campaign
+tweaks, an editor as the only entry) mis-prices iteration exactly where research
+throughput lives. Realization: cycle 0106 (#189) shipped roles 5/6b their
+artifacts (process/campaign documents, C18 realization note); roles 4/7/8 remain
+technically present but faceless (no addressed verb families yet); role homes in
+the project layout and docs-by-role are open (#192 context).
+
 ---
 
 ## Open architectural threads not yet resolved
diff --git a/docs/glossary.md b/docs/glossary.md
index 18ffc92..5a705b4 100644
--- a/docs/glossary.md
+++ b/docs/glossary.md
@@ -173,7 +173,7 @@ A selection objective that argmaxes the neighbourhood-smoothed metric surface (m
 
 ### playground
 **Avoid:** —
-The egui-native visual face (`aura play`) that plays any harness — program structure before a run, live sink streams during, recorded traces and meta-views after. A trace explorer / execution viewer, never a scene editor.
+The visual face that plays any harness — program structure before a run, live sink streams during, recorded traces and meta-views after. A trace explorer / execution viewer, never a scene editor; per C25 a *stateless projection* of disk-persisted canonical data. The shipped form is the web-from-disk front (self-contained HTML chart pages over persisted taps, revised 2026-06/#101 — not the earlier egui-native plan).
 
 ### position table
 **Avoid:** transactions, trade blotter