diff --git a/README.md b/README.md
index 35a385e..273909d 100644
--- a/README.md
+++ b/README.md
@@ -119,9 +119,10 @@ aura sweep crossover.bp.json --list-axes
 ```
 
 The op kinds are `source`, `input`, `add`, `feed`, `connect`, `expose`, `tap`,
-`gang`, and `doc` (`tap` declares a recorded measurement point on an interior
-wire; `doc` declares the composite's one-line meaning, required at register —
-C29; see the authoring guide). See
+`gang`, `doc`, and `use` (`tap` declares a recorded measurement point on an
+interior wire; `doc` declares the composite's one-line meaning, required at
+register — C29; `use` splices a registered blueprint in as a nested composite,
+by content id or label; see the authoring guide). See
 `aura graph introspect --node <T>` for a type's exact ports and the op-script
 grammar in the design ledger for the full semantics.
 
diff --git a/docs/authoring-guide.md b/docs/authoring-guide.md
index d1d58a5..384f262 100644
--- a/docs/authoring-guide.md
+++ b/docs/authoring-guide.md
@@ -227,7 +227,7 @@ are dotted `<identifier>.<port>` on both sides of a wire.
 |---|---|---|
 | `doc` | `{"op":"doc","text":<str>}` | declare the composite's one-line meaning (C29) — the op-script twin of the Rust builder's `.doc(...)`. Required before `aura graph register` accepts the product (the store refuses a doc-less composite); at most one per script (a second refuses: `a doc op may appear at most once`). The text is gated: empty or merely restating the composite's name refuses at register. |
 | `source` | `{"op":"source","role":<str>,"kind":<ScalarKind>}` | reserve a bound root **source** role of `kind` — a real input the harness feeds (e.g. `"price"`). |
-| `input` | `{"op":"input","role":<str>}` | reserve an open root **input** role (kind inferred from the slots it feeds) — the formal parameter of an **open pattern**, a fragment meant to be wired by an *enclosing* graph. An open pattern builds and registers like any blueprint; only *running* it standalone refuses (bootstrap's unbound-root-role gate — there is no enclosing graph to wire it). |
+| `input` | `{"op":"input","role":<str>}` | reserve an open root **input** role (kind inferred from the slots it feeds) — the formal parameter of an **open pattern**, a fragment meant to be wired by an *enclosing* graph. An open pattern builds and registers like any blueprint. Running it standalone is governed by the ordinary run gates: the harness binds input roles to archive columns **by name** (C26), so a pattern whose roles match the data runs as-is; what refuses, by name, is a role the harness cannot bind — or the run surface's other gates (a signal without a bias output or tap; free knobs). |
 | `add` | `{"op":"add","type":<TypeId>,"name":<str>?,"bind":{<param>:<Scalar>}?}` | instantiate a node of a type in the closed vocabulary (`aura graph introspect --vocabulary`) — see §0 below for how a type gets into that vocabulary in the first place. `name` becomes the node's identifier for later ops (default: the type's own lowercase label — two unnamed nodes of the same type then collide). `bind` sets zero or more of its params. |
 | `use` | `{"op":"use","ref":{"content_id":<id-or-prefix>}\|{"name":<label>},"name":<str>?,"bind":{<path>:<Scalar>}?}` | splice a **registered blueprint** into the graph as a nested composite under an instance identifier (`name`; default: the stored composite's own name). The ref resolves by content id (full or unique prefix) or by a register-time label; `graph build` echoes every resolution (`aura: note: use "…": … -> <id>`) so the exact id can be pinned. The instance's open input roles wire as `<instance>.<role>`, its outputs as `<instance>.<field>`; its open params surface path-qualified (`<instance>.<node>.<param>`), sweepable (ganging an instance's params is not yet supported — the `gang` op refuses a composite instance's member path). A doc-less stored source refuses at the op (C29). The emitted blueprint contains the subgraph *inline* — no reference survives into the artifact. |
 | `feed` | `{"op":"feed","role":<str>,"into":[<port>, …]}` | fan a previously-declared role into one or more interior input slots, all-or-nothing (a failing target leaves none of the batch wired). |
diff --git a/docs/design/contracts/c24-blueprint-data.md b/docs/design/contracts/c24-blueprint-data.md
index 170b129..17608e0 100644
--- a/docs/design/contracts/c24-blueprint-data.md
+++ b/docs/design/contracts/c24-blueprint-data.md
@@ -171,7 +171,9 @@ permission §"Enforcement shift" above already grants the node vocabulary, exten
 to registered-blueprint references. All store I/O — label/prefix resolution, the
 `get_blueprint` fetch, the C29 doc-gate re-walk over the fetched composite (before
 it ever reaches the session, so a doc-less fetched entry cannot enter a NEW
-composition), and the resolution echo — happens CLI-side, at DTO conversion, before
+composition — a **backstop**: the register verb already gates both input forms, so
+this fires only for store content written before C29 or through the raw in-crate
+path), and the resolution echo — happens CLI-side, at DTO conversion, before
 replay; build-free introspection paths pass `&|_| None`. The echo
 (`aura: note: use "<instance>": <label-or-prefix> -> <full id>`) is the existing
 `aura: note:` benign-diagnostic marker (C14) — a new instance of the existing