docs(ledger): #188 amendment package — C25 role model, C20/C22 refinements, invariant-10 clarification

C25 (new): the nine authoring roles cut by artifact + surface + iteration
cost, the recognizability test, the 6a/6b split on invariant 12's tier
boundary with the id machinery as interface, the text-first/headless-first
invariant (visual surfaces = stateless projections, viewers over editors),
and the Blockly litmus test as every vocabulary's acceptance criterion.

C20: the 'plain Rust loops, not a config schema' clause and the mini-DSL
forbid are scoped — they forbid an open logic-bearing language, not the
closed-vocabulary campaign document that now carries experiment intent
under the P1 construct tier; generators may stay Rust, what they yield is
data.

C22: stateless-projection refinement generalized to all artifact classes;
the shipped face recorded as the web-from-disk front. Glossary playground
entry aligned (the egui-native wording was stale against the 2026-06
revision).

CLAUDE.md invariant 10: clarified that closed-vocabulary data artifacts
(op-scripts, blueprints, process/campaign documents) are not the forbidden
DSL — RustAst failed as an open logic-bearing language; new logic
escalates to a Rust block, never a freetext hole.

All content ratified on #188 (body + addenda + resolution comments); this
commit is production of the durable record, no new design.

closes #192

docs/design/INDEX.md

@@ -1584,6 +1584,18 @@ structural variation **first-class and searchable** rather than a hand-enumerate
 menu — `HarnessKind` and the per-strategy `*_sweep_family` functions in `aura-cli`
 are the pre-C24 scaffolding (topology-as-engine-source, a C16 tension), retired as
 C24 + the project-as-crate layer land.
+**Refinement (2026-07-03, #188/#189 — experiment INTENT is campaign-document data).**
+The "ordinary Rust control flow, not a config schema" clause and the forbids-clause
+"declarative experiment mini-DSL" are scoped by the #188 role-model pass: they forbid an
+open, logic-bearing experiment language (the RustAst trap), **not** the closed-vocabulary
+**campaign document** (C25/C18) that now carries persisted experiment intent — data
+windows × strategy ids × param axes × process ref under the total, declarative P1
+construct tier (bounded axes, gates, ladders; no variables, no general recursion, no
+unbounded iteration — invariant 5's no-free-feedback move applied one level up). A
+*generator* that enumerates structural variants may still be plain Rust (role 2/6a
+technique); what it yields, and what a campaign declares, is data. Genuinely new logic
+(metrics, analysis blocks) escalates to a new Rust block (role 2), never to a freetext
+hole in the artifact.
 
 ### C21 — The World: the meta-level is the product
 **Guarantee.** Above the harness sits the **World** — the project's program /
@@ -1778,6 +1790,17 @@ scene-at-rest** (a World is a *program*, C21) — which does **not** forbid a fu
 blueprint *editor* over the World-owned topology-data (C24); should the playground
 ever become one, the data format is already the substrate it round-trips, not a new
 mechanism.
+**Refinement (2026-07-03, #188 — visual surfaces are stateless projections; C25).**
+The role-model pass generalizes the point beyond the playground: for **every**
+artifact class (blueprints, op-scripts, process/campaign documents), the canonical,
+complete form is **text**, every operation is executable headless, and any visual
+surface — viewer or editor — is a *stateless projection* that reads/writes that same
+canonical form and adds no semantics. Read-only projections (viewers, this
+contract's trace explorer) rank far above write editors in value; whether an editor
+is ever built is secondary, because the Blockly litmus test (C25) already
+disciplines each vocabulary to be palette-generatable without one. The shipped face
+is the **web-from-disk** front (revised 2026-06, #101 — not egui): disk-persisted
+traces rendered as self-contained HTML chart pages.
 
 ### C23 — Graph compilation and behaviour-preserving optimisation
 **Guarantee.** The bootstrap (C19) is a **compilation**: it lowers a param-generic,
@@ -2095,6 +2118,57 @@ reframed by C24/C21: from "topology baked at build time" to "the World may *gene
 topology at runtime (research plane), the chosen blueprint is frozen into the deploy
 artifact, and any run is deterministic once instantiated" (C1).
 
+### C25 — The role model: nine authoring roles, cut by artifact + surface + iteration cost
+**Guarantee.** aura's user-facing design is organized by **roles**, cut by the
+artifact a role owns, the surface/language it works in, and the iteration cost it
+tolerates — never by org chart. One trader — or an LLM actor, which is the point of
+the whole authoring design — must be able to fill *every* role; the separation
+separates *surfaces with different iteration costs and failure modes*, not people,
+and switching roles is a visible act. The nine roles (ratified 2026-07-03, #188):
+**1 system programmer** (the engine; Rust, this repo; all invariants),
+**2 extension dev** (native nodes + analysis blocks; Rust in project/shared crates;
+C7/C8, determinism in `eval`), **3 toolchain dev** (playground/viewer/skills
+pipeline; vendor-side; authoring ergonomics), **4 data curator** (recorded streams,
+sidecars, derived/news recordings; CLI + recording edge; C2/C3/C6),
+**5 methodology designer** (validation/eval **process documents** — "the game
+rules"; closed data vocabulary; anti-false-discovery), **6a strategy designer**
+(blueprint topologies; data — op-script/blueprint JSON, the graph idiom; C5/C7),
+**6b campaign designer** (**campaign documents** — persisted experiment intent;
+data, the pipeline/block idiom; C1), **7 player** (owns nothing — explores traces,
+tunes runtime params; the playground, C22/C12; read-only by design), and
+**8 operator/auditor** (frozen bots, reconciliation, money management; deploy-edge
+CLI, manifests, reproduce; C13). The 6a/6b split follows invariant 12's tier
+boundary (node/harness vs World); the interface between them is the id machinery
+(content id = byte-exact, identity id = topological). Param gradient: 6a defines
+topology + open params, 6b spans spaces over them, 7 moves inside those spaces
+live. A role is **recognizable** when four things exist: a named artifact type it
+owns, a surface addressed to it, an entry path, and its invariants enforced at its
+boundary. **Text-first / headless-first is an invariant, not a taste** (user,
+2026-07-03: editors must never be the only way; LLM operability demands it): every
+artifact class has a canonical, complete, text-serialized form; every operation is
+executable headless via CLI/API; visual surfaces are *stateless projections* that
+read/write the same canonical form and add no semantics — read-only projections
+(viewers) rank far above write editors. The **Blockly litmus test** is the
+acceptance criterion for every artifact vocabulary, editor or no editor: a block
+palette must be *generatable* from the vocabulary — every block with typed slots,
+every valid composition snappable, every invalid one not.
+**Forbids.** An artifact class whose only authoring path is a visual editor or a
+Rust compile cycle when the role's iteration cost demands data (the role-6b
+lesson: a tiny campaign change must never cost a compile); stringly-typed fields,
+implicit inter-block coupling, or "arbitrary JSON here" holes in a role's
+vocabulary (they fail the litmus test); collapsing the 6a/6b idioms into one
+surface (dataflow boxes-and-wires vs sequential pipeline blocks are different
+languages).
+**Why.** The game-engine analogy that seeded aura (C16) extends to its people:
+engines separate system programmers, toolchain devs, asset creators, level
+designers, and players because their artifacts, tools, and iteration loops
+differ — a design that forces one role's technique on another (Rust for campaign
+tweaks, an editor as the only entry) mis-prices iteration exactly where research
+throughput lives. Realization: cycle 0106 (#189) shipped roles 5/6b their
+artifacts (process/campaign documents, C18 realization note); roles 4/7/8 remain
+technically present but faceless (no addressed verb families yet); role homes in
+the project layout and docs-by-role are open (#192 context).
+
 ---
 
 ## Open architectural threads not yet resolved