Removing ^vignettes$ was right; removing ^doc$ and ^Meta$ with it was not. Those are devtools::build_vignettes() artefacts, not sources -- R CMD build regenerates inst/doc/ from vignettes/ by itself, and shipping the local copies earned a 'non-standard file/directory found at top level' NOTE. R CMD check --as-cran is now 0 errors, 0 warnings, 0 notes.