fix(aura-runner, aura-cli): milestone-fieldtest bugs — library exposes-neither guard, override class, doc truth

RED-first fixes for the two code bugs the safe-to-embed milestone
fieldtest caught: (1) run_signal_r panicked (exit 101) on a blueprint
exposing neither bias nor a declared tap — the CLI pre-validated but the
library seam, the very surface the milestone promises is kill-free, did
not; the guard now refuses class 2 with the CLI's prose family before
wrap_r (run_measurement has no wrap seam and no hole). (2) The override
unknown-param refusal exited 1 through the one inline site the #297
adjudication missed; it and its wrapped-retired sibling are class 2 now,
three existing pins re-pinned with the adjudication comment.

Doc truth from the same fieldtest: the guide's campaign no-data class
corrected (contained cell faults exit 3, not 1), TapPlanError's rustdoc
no longer advertises the retired exit-1 register, and C30 records that
rev + the embedding's committed lockfile are the reproducible-build
contract (branch-referenced engine deps resolve at lock time).

refs #296

crates/aura-cli/src/main.rs

@@ -1277,13 +1277,15 @@ fn exec_blueprint_leg(path: &str, overrides: &[String], tap: &[String], env: &au
                      raw node.param namespace — did you mean \"{raw}\"? see \
                      `aura graph introspect --params <bp>`"
                 );
-                std::process::exit(1);
+                // C14 class 2: fault in argv-named content (#297 adjudication, fieldtest follow-up)
+                std::process::exit(2);
             }
         }
         let axes: Vec<(String, Vec<Scalar>)> = ov.iter().map(|(p, v)| (p.clone(), vec![*v])).collect();
         let paths = override_paths(&axes, &raw_space, &signal).unwrap_or_else(|e| {
             eprintln!("aura: {e}");
-            std::process::exit(1);
+            // C14 class 2: fault in argv-named content (#297 adjudication, fieldtest follow-up)
+            std::process::exit(2);
         });
         // Refuse an open (free-knob) blueprint at the dispatch boundary — this
         // leg's own closed-blueprint guard now (#176; inherited from the

crates/aura-cli/tests/exec.rs

@@ -690,10 +690,11 @@ fn exec_override_non_literal_value_names_the_value_not_a_grammar_fault() {
 /// with `override_paths`' own prose (`member.rs:768-771`), pointing at the
 /// live axis-discovery verb (`aura graph introspect --params`) — the retired
 /// `aura sweep --list-axes` no longer exists.
+// C14 class 2: fault in argv-named content (#297 adjudication, fieldtest follow-up)
 #[test]
 fn exec_override_unknown_path_refuses_with_the_override_prose() {
     let (out, code) = run_code(&["exec", "examples/r_sma.json", "--override", "nope.knob=1"]);
-    assert_eq!(code, Some(1), "stdout/stderr: {out}");
+    assert_eq!(code, Some(2), "stdout/stderr: {out}");
     assert!(
         out.contains("names no param of this blueprint (open or bound)"),
         "stdout/stderr: {out}"
@@ -704,6 +705,34 @@ fn exec_override_unknown_path_refuses_with_the_override_prose() {
     );
 }
 
+/// C14's FORM-vs-VALUE boundary, the unknown-param corner (fieldtest
+/// milestone-safe-to-embed, finding B2): "a form fault the surface detects
+/// before the node ever runs (kind mismatch, unknown param, compile error)
+/// stays class 2 argv-content" (`c14-headless-two-faces.md`, and the guide
+/// verbatim). An `--override` path naming no param of the blueprint (open or
+/// bound) is exactly that form fault, so it must exit 2 like its
+/// malformed-token, non-literal-value and kind-mismatch siblings — never 1,
+/// which a CI wrapper branching on the class reads as "the environment is
+/// missing something". The refusal prose itself is pinned as the bytes that
+/// exist today (`override_paths`, member.rs).
+#[test]
+fn exec_override_unknown_param_refuses_as_argv_content_class_2() {
+    let (out, code) = run_code(&["exec", "examples/r_sma.json", "--override", "nope.length=3"]);
+    assert_eq!(
+        code,
+        Some(2),
+        "C14: unknown param is a form fault → argv-content class 2; stdout/stderr: {out}"
+    );
+    assert!(
+        out.contains("names no param of this blueprint (open or bound)"),
+        "the existing refusal prose must survive the re-class: {out}"
+    );
+    assert!(
+        out.contains("aura graph introspect --params"),
+        "the discovery pointer must survive the re-class: {out}"
+    );
+}
+
 /// A repeated `--override` path (the same NODE.PARAM named twice) refuses as
 /// a usage error naming the duplicated path — it must NOT fall through to
 /// `reopen_all`'s `NoSuchBoundParam` panic (the second reopen of an
@@ -813,12 +842,13 @@ fn exec_override_kind_mismatch_refuses_with_prose_not_the_debug_struct() {
 /// missing it. Refuse before the zip, mirroring the campaign leg's own
 /// did-you-mean refusal for the same retired form
 /// (`RefFault::AxisNotInParamSpace`).
+// C14 class 2: fault in argv-named content (#297 adjudication, fieldtest follow-up)
 #[test]
 fn exec_override_wrapped_form_path_refuses_not_panics() {
     let (out, code) =
         run_code(&["exec", "examples/r_sma.json", "--override", "sma_signal.fast.length=1"]);
     assert_ne!(code, Some(101), "must not panic: {out}");
-    assert_eq!(code, Some(1), "stdout/stderr: {out}");
+    assert_eq!(code, Some(2), "stdout/stderr: {out}");
     assert!(!out.contains("panicked at"), "no raw panic report reaches the consumer: {out}");
     assert!(
         out.contains("did you mean") && out.contains("fast.length"),
@@ -1688,11 +1718,14 @@ fn exec_well_formed_but_unregistered_content_id_refuses_at_runtime() {
 fn exec_exit_codes_partition_usage_two_from_runtime_one() {
     let (usage_out, usage_code) = run_code(&["exec", "examples/r_sma.json", "--bogus"]);
     assert_eq!(usage_code, Some(2), "unknown flag is a usage error -> 2: {usage_out}");
+    // C14 class 2: fault in argv-named content (#297 adjudication, fieldtest
+    // follow-up) — an unresolvable `--override` path is a form fault the
+    // surface detects before the node ever runs, not a runtime failure.
     let (runtime_out, runtime_code) =
         run_code(&["exec", "examples/r_sma.json", "--override", "nope.knob=1"]);
     assert_eq!(
-        runtime_code, Some(1),
-        "a well-formed command with an unresolvable override is a runtime failure -> 1: {runtime_out}"
+        runtime_code, Some(2),
+        "a well-formed command with an unresolvable override is argv-content class 2: {runtime_out}"
     );
 }