diff --git a/crates/aura-cli/src/campaign_run.rs b/crates/aura-cli/src/campaign_run.rs
index fcc4332..c68010f 100644
--- a/crates/aura-cli/src/campaign_run.rs
+++ b/crates/aura-cli/src/campaign_run.rs
@@ -1564,6 +1564,24 @@ mod tests {
     /// bounds fall short of full coverage. GAPSYM-shaped input (files at
     /// 2024-01..02 and 2024-05..06, absent 03..04) over a Jan-through-June
     /// window must name exactly the two missing interior months.
+    /// #272: the summary label is a CHECKED mirror of the persisted serde form
+    /// — an aggregate over `campaign_runs.jsonl` counts by the serialized
+    /// `CellFaultKind` string, so the human-facing label must be exactly that
+    /// string (no second source of truth that could silently drift).
+    fn cell_fault_kind_label_matches_the_serialized_kind() {
+        use aura_registry::CellFaultKind as K;
+        for kind in [K::NoData, K::Bind, K::Run, K::Panic, K::Window] {
+            let serde_form = serde_json::to_string(&kind).expect("serialize kind");
+            let serde_form = serde_form.trim_matches('"');
+            assert_eq!(
+                cell_fault_kind_label(kind),
+                serde_form,
+                "the summary label must equal the persisted serde string"
+            );
+        }
+    }
+
+    #[test]
     fn interior_gap_months_names_a_whole_missing_month_spanned_by_the_window() {
         let months = [(2024u16, 1u8), (2024, 2), (2024, 5), (2024, 6)];
         // 2024-01-01T00:00:00Z .. 2024-07-01T00:00:00Z (Unix ms) — spans every
diff --git a/docs/design/INDEX.md b/docs/design/INDEX.md
index db8a4b1..b4582e4 100644
--- a/docs/design/INDEX.md
+++ b/docs/design/INDEX.md
@@ -1620,7 +1620,16 @@ notes + a completion summary) and a run with ≥1 failed cell exits **3**
 window carries a `CellCoverage` annotation (effective bounds + interior gap
 months, from the #264 archive primitives). Generalize already treats a
 no-nominee cell as `missing`, so a failed cell surfaces there unchanged.
-**Guarantee.** Construction is a distinct phase, recursive at every level. Each
+Member panics are caught with `catch_unwind`(`AssertUnwindSafe`) at the three
+member-run sites and recorded as `MemberFault::Panic`; a ref-counted
+`SilencedPanic` guard (a process-global panic-hook save/no-op/restore behind a
+`static Mutex`, held only around each `catch_unwind`) suppresses the default
+crash backtrace so "recorded, campaign continues" is observably true on stderr,
+not merely true in the record. The guard's mutex serialises only the
+ref-count/hook-swap (O(1)), never the member computation, so C1 disjoint-parallel
+execution and determinism are preserved; ref-counting (save on 0→1, restore on
+1→0) keeps concurrent sweep/walk-forward threads and any caller-installed hook
+correct. **Guarantee.** Construction is a distinct phase, recursive at every level. Each
 node type has a **factory** `params → sized concrete node` (e.g. `SMA(length)`
 sizes its ring buffer). A **blueprint** is the param-generic, input-role-generic
 graph-as-data produced by running a Rust builder (C9); it carries *free* numeric