audit(0094): cycle close — content-addressed reproduction; ledger refreshed, coverage closed; rm ephemeral spec/plan

Architect drift review (4751d4b..HEAD): drift_found — ledger-currency only; the
code is clean.

What holds (architect, confirmed by diff + green tests):
- Inv 8 / C9: aura-engine byte-untouched; content_id + sha2 in aura-cli, the
  store in aura-registry.
- Inv 9: Registry::{put,get}_blueprint is a dumb bytes-by-key store (opaque
  String keyed by String hash; no sha2, no parse, no sha256==hash verify — the
  caller owns the hash). No domain knowledge crept into the engine or registry.
- C1: the run_blueprint_member extraction is behaviour-preserving (keystone
  blueprint_sweep_member_equals_single_run_and_shares_topology_hash unchanged +
  green); serde_json/float_roundtrip serves determinism (disk==recomputed), not a
  mask (1-ULP canary green).
- C11/C12: one blueprint stored per family, keyed by the shared topology_hash.

Resolutions:
- [ledger] Refreshed C18 + C24: added the cycle-0094 Realization (the
  content-addressed store runs/blueprints/<hash>.json + aura reproduce), and
  retired the now-false "content-addressed identity / full reproduction deferred"
  claims (INDEX.md:1261, C24 deferred block). Only the structural-axis /
  whole-harness content-id (and the debug-name-in-id question) genuinely remains,
  filed forward (#171, #170).
- [debt->closed] Added the two untested refuse-don't-guess E2E arms
  (aura_reproduce_rejects_a_non_generated_family — a hard-wired sweep member has
  no topology_hash; aura_reproduce_rejects_a_missing_stored_blueprint — the store
  was deleted), and a cross-surface unit pin
  (topology_hash_is_the_content_id_of_the_canonical_form) so the two acc-1 paths
  cannot silently drift.
- [scaling] MC/walk-forward-from-blueprint (#170) will need the same put_blueprint
  hook or reproduce won't cover them — noted on #170.

No regression scripts in this project (Test is the gate): full workspace suite
green (51 suites), clippy -D warnings clean, binary verified end-to-end.

Ephemeral spec/plan git-rm'd per the lifecycle convention; durable rationale is in
the ledger. The World/C21 milestone stays open (#170 remains).

closes #158

crates/aura-cli/src/main.rs

@@ -5550,6 +5550,16 @@ mod tests {
         );
     }
 
+    /// #158 acc 1 (cross-surface agreement): `topology_hash` (from a live `Composite`, the
+    /// run/sweep path) and the op-script `graph introspect --content-id` surface are the
+    /// SAME hash of the SAME canonical bytes — both go through the one `content_id`
+    /// primitive. Pins that the two command paths cannot silently drift apart.
+    #[test]
+    fn topology_hash_is_the_content_id_of_the_canonical_form() {
+        let sig = stage1_signal(Some(2), Some(4));
+        assert_eq!(topology_hash(&sig), content_id(&blueprint_to_json(&sig).expect("serializes")));
+    }
+
     #[test]
     fn parse_mc_args_bare_and_name_route_to_synthetic() {
         assert_eq!(parse_mc_args(&[]), Ok(McArgs::Synthetic { name: "mc".to_string(), persist: false }));

crates/aura-cli/tests/cli_run.rs

@@ -3506,3 +3506,66 @@ fn aura_reproduce_rejects_an_unknown_family() {
     );
     let _ = std::fs::remove_dir_all(&cwd);
 }
+
+/// E2E (refuse-don't-guess): `aura reproduce` on a HARD-WIRED sweep family — its members
+/// carry no `topology_hash` (not built from a blueprint) — exits non-zero, naming that the
+/// member is not a generated run. Content-addressed reproduction covers only generated runs.
+#[test]
+fn aura_reproduce_rejects_a_non_generated_family() {
+    let cwd = temp_cwd("reproduce_non_generated");
+    let sweep = std::process::Command::new(BIN)
+        .args(["sweep", "--name", "hw"])
+        .current_dir(&cwd)
+        .output()
+        .expect("run aura sweep");
+    assert!(sweep.status.success(), "hard-wired sweep ok: {}", String::from_utf8_lossy(&sweep.stderr));
+    let out = std::process::Command::new(BIN)
+        .args(["reproduce", "hw-0"])
+        .current_dir(&cwd)
+        .output()
+        .expect("run aura reproduce");
+    assert!(!out.status.success(), "a non-generated family exits non-zero");
+    assert!(
+        String::from_utf8_lossy(&out.stderr).contains("not a generated run"),
+        "names the cause: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let _ = std::fs::remove_dir_all(&cwd);
+}
+
+/// E2E (refuse-don't-guess): `aura reproduce` when the content-addressed blueprint was
+/// removed from the store exits non-zero, naming the missing blueprint — never re-runs
+/// against a guessed topology (C10/C18).
+#[test]
+fn aura_reproduce_rejects_a_missing_stored_blueprint() {
+    let cwd = temp_cwd("reproduce_missing_store");
+    let fixture = format!("{}/tests/fixtures/stage1_signal_open.json", env!("CARGO_MANIFEST_DIR"));
+    let sweep = std::process::Command::new(BIN)
+        .args([
+            "sweep",
+            &fixture,
+            "--axis",
+            "stage1_signal.fast.length=2",
+            "--axis",
+            "stage1_signal.slow.length=4",
+            "--name",
+            "bp",
+        ])
+        .current_dir(&cwd)
+        .output()
+        .expect("run aura sweep");
+    assert!(sweep.status.success(), "blueprint sweep ok: {}", String::from_utf8_lossy(&sweep.stderr));
+    std::fs::remove_dir_all(cwd.join("runs").join("blueprints")).expect("remove the blueprint store");
+    let out = std::process::Command::new(BIN)
+        .args(["reproduce", "bp-0"])
+        .current_dir(&cwd)
+        .output()
+        .expect("run aura reproduce");
+    assert!(!out.status.success(), "a missing stored blueprint exits non-zero");
+    assert!(
+        String::from_utf8_lossy(&out.stderr).contains("missing from store"),
+        "names the cause: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let _ = std::fs::remove_dir_all(&cwd);
+}