feat(aura-engine, aura-cli): the blueprint name op — name_gate on every authored intake

An eleventh op-script op {"op":"name","name":"<n>"} sets the composite
render name (engine Op::Name + CLI OpDoc mirror); omitting it keeps the
default "graph" byte-identically. The default leaked everywhere one
research project has more than one strategy: every store entry named
graph, every default tap recording sharing traces/graph/, and two
use-splices of unnamed blueprints colliding on the default instance
identifier — the authored name dissolves all three through existing
mechanics (no downstream site edited).

Mechanics: at-most-once per script (doc-op precedent), position-free
(read only at finish). A shared deterministic name_gate (aura-engine:
non-empty, no path separators, not . or ..) guards every seam where a
name is born from authored data, because the name keys a trace
directory unsanitized: the op intake (GraphSession::set_name) and all
four CLI fresh-file envelope intakes (register, introspect
--content-id FILE, the bare graph FILE viewer, aura run FILE — the run
route reached begin_run(signal.name()) ungated, and introspect
--params FILE rode the same parse). Store read-back (reproduce, use
resolution, introspect/params by content id) stays deliberately
ungated — C29: registered artifacts are never retroactively
invalidated — pinned by a test that plants a bad-root-name blueprint
via the registry API and asserts introspect --params still answers.
Refusal prose is single-sourced (name_gate_fault_prose) so every seam
reads identically, op-indexed on the op route.

Identity semantics: the authored name hashes into the content id (a
named document is a different document) and never into the identity id
(names are stripped as debug symbols, C23) — pinned by a twin test.
The previously untested use-splice instance-name default
(construction.rs) got its ratifying pin before the collision claim
leans on it. The registry label (register --name) stays orthogonal.

Review rounds caught and fixed: the envelope gate initially fired on
store read-back (C29 violation at the introspect surface), and the
run/params fresh-file routes were unenumerated intake seams — closed
with the call-site classification now recorded in the wrapper docs.

Verification: cargo build/test/clippy -D warnings all green (99 test
targets, 0 failures, independently re-run); the new run-route test was
RED-verified by hand-removing the gate.

closes #331
refs #328, #311

Spec: blueprint-name-op (fork minutes on #331)

crates/aura-cli/tests/graph_construct.rs

@@ -88,6 +88,43 @@ const SIGNAL_DOC_NAME_RESTATED: &str = r#"[
     {"op":"expose","from":"bias.bias","as":"bias"}
 ]"#;
 
+/// SIGNAL_DOC with a leading `{"op":"name",...}` (#331) — authors a render
+/// name distinct from the CLI's own default seed ("graph"), otherwise
+/// structurally identical to SIGNAL_DOC.
+const SIGNAL_DOC_NAMED: &str = r#"[
+    {"op":"name","name":"ny_momentum"},
+    {"op":"source","role":"price","kind":"F64"},
+    {"op":"add","type":"SMA","name":"fast","bind":{"length":{"I64":2}}},
+    {"op":"add","type":"SMA","name":"slow","bind":{"length":{"I64":4}}},
+    {"op":"add","type":"Sub"},
+    {"op":"add","type":"Bias"},
+    {"op":"feed","role":"price","into":["fast.series","slow.series"]},
+    {"op":"connect","from":"fast.value","to":"sub.lhs"},
+    {"op":"connect","from":"slow.value","to":"sub.rhs"},
+    {"op":"connect","from":"sub.value","to":"bias.signal"},
+    {"op":"expose","from":"bias.bias","as":"bias"}
+]"#;
+
+/// SIGNAL_DOC_NAME_RESTATED with an authored name (#331 spec test 7) instead
+/// of the CLI's default seed: the `doc` op's text restates the *authored*
+/// name ("ny_momentum") rather than the literal "graph" — the same
+/// RestatesName arm of the C29 shape gate must fire against whichever name
+/// the composite actually carries, not a hardcoded "graph" comparison.
+const SIGNAL_DOC_NAMED_NAME_RESTATED: &str = r#"[
+    {"op":"name","name":"ny_momentum"},
+    {"op":"doc","text":"Ny Momentum"},
+    {"op":"source","role":"price","kind":"F64"},
+    {"op":"add","type":"SMA","name":"fast","bind":{"length":{"I64":2}}},
+    {"op":"add","type":"SMA","name":"slow","bind":{"length":{"I64":4}}},
+    {"op":"add","type":"Sub"},
+    {"op":"add","type":"Bias"},
+    {"op":"feed","role":"price","into":["fast.series","slow.series"]},
+    {"op":"connect","from":"fast.value","to":"sub.lhs"},
+    {"op":"connect","from":"slow.value","to":"sub.rhs"},
+    {"op":"connect","from":"sub.value","to":"bias.signal"},
+    {"op":"expose","from":"bias.bias","as":"bias"}
+]"#;
+
 /// Every op below applies cleanly (all eager checks pass), but `sub.rhs` is
 /// never wired — a 0-cover input slot only the holistic finalize gate can
 /// reject. The smallest document that is op-valid yet whole-document-invalid.
@@ -929,6 +966,120 @@ fn graph_register_refuses_an_op_script_doc_that_restates_the_composite_name() {
     assert!(err.contains("C29"), "stderr cites the contract: {err}");
 }
 
+/// (#331 spec test 7) The C29 restates-name gate checks against the
+/// *authored* name, not a hardcoded default: a `doc` op restating the name
+/// set by a `name` op ("ny_momentum") refuses at register exactly like the
+/// default-name case above (`graph_register_refuses_an_op_script_doc_that_
+/// restates_the_composite_name`, which must stay green byte-identical).
+#[test]
+fn graph_register_refuses_a_doc_that_restates_an_authored_name() {
+    let dir = temp_cwd("register-op-script-restated-authored-name-doc");
+    let restated_script = dir.join("restated-authored-name-doc-script.json");
+    std::fs::write(&restated_script, SIGNAL_DOC_NAMED_NAME_RESTATED)
+        .expect("write op-script fixture");
+    let (out, err, code) = run_in(&dir, &["graph", "register", restated_script.to_str().unwrap()]);
+    assert_eq!(code, Some(1), "authored-name-restating doc refuses: {out} {err}");
+    assert!(err.contains("merely restates"), "stderr names the rule: {err}");
+    assert!(err.contains("C29"), "stderr cites the contract: {err}");
+}
+
+/// (#331 spec test 6) `graph build` on an ops doc with a `name` op emits
+/// blueprint JSON carrying the authored name, not the CLI's own seeded
+/// default (`"graph"`, `replay("graph", ...)` in `composite_from_str`).
+#[test]
+fn graph_build_emits_the_authored_name_from_a_name_op() {
+    let (stdout, stderr, ok) = run(&["graph", "build"], SIGNAL_DOC_NAMED);
+    assert!(ok, "build succeeds: {stderr}");
+    assert!(stdout.contains("\"name\":\"ny_momentum\""), "authored name carries into the blueprint: {stdout}");
+    assert!(!stdout.contains("\"name\":\"graph\""), "the default seed name must not leak in: {stdout}");
+}
+
+/// (#331 spec test 8) Refusal prose for a duplicate `name` op and a
+/// shape-violating name is op-indexed (`op N (name): ...`) — the same
+/// by-identifier labeling every other op fault gets.
+#[test]
+fn graph_build_name_op_refusals_are_op_indexed() {
+    let twice_named = r#"[
+        {"op":"source","role":"price","kind":"F64"},
+        {"op":"add","type":"SMA","name":"fast","bind":{"length":{"I64":2}}},
+        {"op":"name","name":"a"},
+        {"op":"name","name":"b"},
+        {"op":"feed","role":"price","into":["fast.series"]},
+        {"op":"expose","from":"fast.value","as":"out"}
+    ]"#;
+    let (_out, stderr, ok) = run(&["graph", "build"], twice_named);
+    assert!(!ok, "a second name op refuses");
+    assert!(stderr.contains("op 3 (name):"), "op-indexed at the second name op: {stderr}");
+
+    let slash_named = r#"[{"op":"name","name":"a/b"}]"#;
+    let (_out2, stderr2, ok2) = run(&["graph", "build"], slash_named);
+    assert!(!ok2, "a shape-violating name refuses");
+    assert!(stderr2.contains("op 0 (name):"), "op-indexed at the offending op: {stderr2}");
+}
+
+/// (#331 spec test 9, at the binary seam — mirrors
+/// `graph_introspect_identity_id_bridges_renamed_op_scripts`'s pattern for
+/// the debug-name field): a named and an unnamed build of the SAME
+/// structural script share the identity id (the name is stripped as a
+/// debug symbol before identity hashing, C23) and differ in the content id
+/// (the name is part of the serialized bytes).
+#[test]
+fn graph_named_and_unnamed_twins_share_identity_id_and_differ_content_id() {
+    let (ia, _e, ok) = run(&["graph", "introspect", "--identity-id"], SIGNAL_DOC);
+    assert!(ok, "exit success");
+    let (ib, _e2, ok2) = run(&["graph", "introspect", "--identity-id"], SIGNAL_DOC_NAMED);
+    assert!(ok2, "exit success");
+    assert_eq!(ia.trim(), ib.trim(), "the name is stripped before identity hashing (C23)");
+
+    let (ca, _e3, ok3) = run(&["graph", "introspect", "--content-id"], SIGNAL_DOC);
+    let (cb, _e4, ok4) = run(&["graph", "introspect", "--content-id"], SIGNAL_DOC_NAMED);
+    assert!(ok3 && ok4, "exit success");
+    assert_ne!(ca.trim(), cb.trim(), "the name is part of the serialized bytes -> different content id");
+}
+
+/// (#331 spec test 10, the skeptic's bypass route): the op intake
+/// (`GraphSession::set_name`) is not the name's only data-borne birth
+/// route — a hand-edited blueprint ENVELOPE (not an op-script) can carry a
+/// shape-violating root name directly. `aura graph register` on such a file
+/// is refused naming the offending name (exit 1, the refusal convention
+/// every sibling test in this module asserts), not silently stored under a
+/// name that would write `traces/../x/` at run time. Shipped envelope
+/// fixtures with plain root names (`doc_blueprint.json`'s "sig",
+/// `nested_doc_blueprint.json`'s "root", every op-script's default "graph")
+/// stay accepted — the surrounding suite is that regression gate.
+///
+/// Spec test 10 also names `build` as a gated envelope-intake route
+/// alongside `register`. The `graph build` SUBCOMMAND takes only a stdin
+/// op-script (`Vec<OpDoc>`, never a JSON object) — it cannot ingest this
+/// envelope fixture at all (a shape mismatch fires before any name is ever
+/// read). The file-consuming envelope-intake sibling `build` route is
+/// `graph introspect --content-id <FILE>` (its own doc comment: "one
+/// build, then each requested id…") — the other call site this iteration
+/// moved onto the same `composite_from_authored_text` choke point as
+/// `register`, so it is the leg exercised here, sharing the identical
+/// `name_gate_fault_prose` text.
+#[test]
+fn graph_build_and_register_refuse_a_hand_crafted_envelope_with_a_bad_root_name() {
+    let dir = temp_cwd("register-bad-root-name");
+    let (envelope_bytes, _e, built) = run(&["graph", "build"], SIGNAL_DOC_DESCRIBED);
+    assert!(built, "graph build produces the envelope");
+    let bad = envelope_bytes.replacen("\"name\":\"graph\"", "\"name\":\"../x\"", 1);
+    assert!(bad.contains("\"name\":\"../x\""), "the root-name replace landed: {bad}");
+    let file = dir.join("bad-root-name.json");
+    std::fs::write(&file, &bad).expect("write envelope fixture");
+
+    let (out, err, code) = run_in(&dir, &["graph", "register", file.to_str().unwrap()]);
+    assert_eq!(code, Some(1), "a shape-violating root name refuses (not a panic): {out} {err}");
+    assert!(err.contains("../x"), "names the offending root name: {err}");
+
+    // The other file-consuming envelope intake (same fixture, same choke
+    // point) refuses identically.
+    let (out2, err2, code2) =
+        run_in(&dir, &["graph", "introspect", "--content-id", file.to_str().unwrap()]);
+    assert_eq!(code2, Some(1), "the sibling envelope intake refuses too: {out2} {err2}");
+    assert_eq!(err2, err, "both file-consuming envelope intakes share the identical fault prose");
+}
+
 /// Property (#202, the same on-ramp seam at the sibling verb): `aura graph
 /// introspect --params` accepts an op-script exactly as it accepts a blueprint
 /// envelope — the raw axis namespace it prints for the op-script equals the one it
@@ -954,6 +1105,35 @@ fn graph_params_accepts_an_op_script_matching_its_envelope() {
     assert_eq!(op_out, env_out, "op-script and envelope agree on the raw axis namespace");
 }
 
+/// (#331 review finding, the C29 exemption's ratifying pin): the root-name
+/// shape gate lives at the CLI's file-consuming envelope intakes (`register`,
+/// `introspect --content-id <FILE>`) — never at STORE read-back. A blueprint
+/// with a shape-violating root name registered DIRECTLY through the
+/// `aura-registry` store API (bypassing the CLI's gate entirely, the way a
+/// pre-#331 artifact would already sit in a project's store) must still be
+/// introspectable: `introspect --params <ID>` reads the store, not a file, so
+/// it must never re-punish an artifact the store already accepted — C29,
+/// "registered artifacts are never retroactively invalidated".
+#[test]
+fn graph_introspect_params_accepts_a_pre_331_store_artifact_with_a_bad_root_name() {
+    let dir = temp_cwd("introspect-store-readback-bad-root-name");
+    let (envelope_bytes, _e, built) = run(&["graph", "build"], SIGNAL_DOC_DESCRIBED);
+    assert!(built, "graph build produces the envelope");
+    let bad = envelope_bytes.replacen("\"name\":\"graph\"", "\"name\":\"../x\"", 1);
+    assert!(bad.contains("\"name\":\"../x\""), "the root-name replace landed: {bad}");
+
+    // Bypass the CLI's gate entirely: the registry's own store API is the
+    // simulated pre-#331 write path.
+    let id = aura_research::content_id_of(&bad);
+    let registry = aura_registry::Registry::open(dir.join("runs/runs.jsonl"));
+    registry
+        .put_blueprint(&id, &bad)
+        .expect("the registry's own store API has no root-name gate to bypass");
+
+    let (out, err, code) = run_in(&dir, &["graph", "introspect", "--params", &id]);
+    assert_eq!(code, Some(0), "store read-back stays ungated (C29): {out} {err}");
+}
+
 /// Property (#226, the render positional closes the #202 on-ramp family):
 /// `aura graph <op-script.json>` (the render positional) accepts an op-script
 /// document (a JSON array) exactly as it accepts a #155 blueprint envelope (a