fix(aura-cli, ledger): review fixes — override stamps the base hash (#343 revised), prose corrections

Harvest sweep, whole-diff review fix block.

The review refuted the #343 ratification's factual premise: the
campaign leg does NOT mint a reopened member's hash — runner.rs passes
the stored strategy_id as topo even for reopened members (reference
semantics). Decision revised on the issue (fix, not ratify): exec's
override run now stamps the LOADED base document's content id
(computed before reopen_all; RED-first — the inverted pin failed on
the old reopened-hash behaviour), keeping topology_hash
store-resolvable and identical in meaning across both legs; the
variation lives in manifest.params. C24/C12/C18 rewritten to the
corrected reading.

Also per review: C24's retired build-free-introspection sentence
updated (old wording archived in the history sidecar, #339 item 4);
C14's partition key precisely scoped to the routing seam, naming the
legs' differing content-validation exits honestly; measure.rs's false
unreachability comment corrected; --taps added to the guide's
introspect cheat-sheet and pinned on the content-id path; the
zero-trade-cell note routed through the diag macro; doc-comment,
issue-ref, and gate-name corrections; the Fixed-regime NaN branch
pinned.

refs #339
refs #342
refs #343

crates/aura-cli/tests/exec.rs

@@ -553,19 +553,24 @@ fn exec_blueprint_without_override_runs_bound_values_untouched() {
     );
 }
 
-/// Ratification pin (#343): an override IS a topology-parameter variation,
-/// even a "no-op" one that re-binds a param to its EXISTING bound value —
-/// `examples/r_sma.json` already binds `fast.length` to 2, so
-/// `--override fast.length=2` changes nothing observable about the run's
-/// *behaviour*, yet the reopened param moves from `manifest.defaults` to
-/// `manifest.params` (the #246 reopen mechanism, unconditionally applied),
-/// which changes the canonical bytes `topology_hash` covers: the two runs'
-/// `topology_hash`es must therefore DIFFER, and the overridden run's own
-/// hash must be stable across repeated runs (determinism, C1) — the
-/// reopened topology is its own honest, reproducible identity, not a
-/// dangling reference (see the ratification prose in C12/C24).
+/// Ratification pin (#343, revised): `topology_hash` carries REFERENCE
+/// semantics on every leg — it names the (stored/loaded) base document,
+/// never a transient reopened variant, mirroring the campaign leg's own
+/// precedent (`runner.rs` passes `&cell.strategy_id`, the stored base
+/// document's id, as `topo` even for reopened members). `examples/r_sma.json`
+/// already binds `fast.length` to 2, so `--override fast.length=2` is a
+/// no-op override value-wise; it still moves the param from
+/// `manifest.defaults` to `manifest.params` (the #246 reopen mechanism,
+/// unconditionally applied) — the manifest's `params` carry the variation,
+/// while `topology_hash` stamps the base document's own content id (computed
+/// before the reopen) on both legs, so the bare run's and the
+/// no-op-override run's `topology_hash` are EQUAL, and the overridden run's
+/// own hash stays stable across repeated runs (determinism, C1). The
+/// manifest's `params` plus the base document deterministically reconstruct
+/// the executed run (reproduction identity) — see the corrected ratification
+/// prose in C12/C24.
 #[test]
-fn exec_blueprint_noop_override_mints_a_distinct_but_stable_topology_hash() {
+fn exec_blueprint_override_keeps_the_base_documents_topology_hash() {
     let (base_out, base_code) = run_code(&["exec", "examples/r_sma.json"]);
     assert_eq!(base_code, Some(0), "stdout/stderr: {base_out}");
     let base_line = base_out.lines().find(|l| l.starts_with('{')).expect("record line");
@@ -581,10 +586,16 @@ fn exec_blueprint_noop_override_mints_a_distinct_but_stable_topology_hash() {
     let ov_hash =
         ov_v["manifest"]["topology_hash"].as_str().expect("overridden topology_hash").to_string();
 
-    assert_ne!(
+    assert_eq!(
         base_hash, ov_hash,
-        "a no-op override still reopens the bound param, minting the reopened topology's own \
-hash: base {base_out} / overridden {ov_out}"
+        "an override stamps the base document's own content id — reference semantics (#343): \
+base {base_out} / overridden {ov_out}"
+    );
+
+    let ov_params = ov_v["manifest"]["params"].as_array().expect("params array");
+    assert!(
+        ov_params.iter().any(|e| e[0] == "fast.length"),
+        "the variation lives in the manifest's params, not in the hash: {ov_out}"
     );
 
     let (ov_out_2, ov_code_2) =

crates/aura-cli/tests/graph_construct.rs

@@ -876,6 +876,45 @@ fn graph_introspect_taps_lists_declared_taps_wire_and_kind() {
     );
 }
 
+/// Property (#337 follow-up, harvest audit item 8): `--taps <ID>` resolves
+/// through the project store exactly like `--params <ID>` already does
+/// (`graph_params_by_content_id_matches_params_by_file`'s sibling) — register
+/// a tap-bearing blueprint, then introspect its declared taps by content id;
+/// the store path carries no `FILE`'s root-name gate (C29).
+#[test]
+fn graph_introspect_taps_by_content_id_matches_by_file() {
+    let dir = temp_cwd("taps-by-id");
+    let ops = r#"[
+        {"op":"doc","text":"fast/slow spread, tapped, exposed as bias"},
+        {"op":"source","role":"price","kind":"F64"},
+        {"op":"add","type":"SMA","name":"fast","bind":{"length":{"I64":2}}},
+        {"op":"add","type":"SMA","name":"slow","bind":{"length":{"I64":4}}},
+        {"op":"add","type":"Sub"},
+        {"op":"feed","role":"price","into":["fast.series","slow.series"]},
+        {"op":"connect","from":"fast.value","to":"sub.lhs"},
+        {"op":"connect","from":"slow.value","to":"sub.rhs"},
+        {"op":"tap","from":"fast.value","as":"fast_ma"},
+        {"op":"tap","from":"sub.value","as":"spread"},
+        {"op":"expose","from":"sub.value","as":"bias"}
+    ]"#;
+    let (build_out, build_err, build_code) = run_in_stdin(&dir, &["graph", "build"], ops);
+    assert_eq!(build_code, Some(0), "graph build: {build_out} {build_err}");
+    let bp = dir.join("tapped.json");
+    std::fs::write(&bp, &build_out).expect("write built blueprint");
+
+    let (reg_out, reg_err, reg_code) = run_in(&dir, &["graph", "register", bp.to_str().unwrap()]);
+    assert_eq!(reg_code, Some(0), "register: {reg_out} {reg_err}");
+    let id = registered_id(&reg_out);
+
+    let (by_id_out, by_id_err, by_id_code) =
+        run_in(&dir, &["graph", "introspect", "--taps", &id]);
+    assert_eq!(by_id_code, Some(0), "stdout: {by_id_out} stderr: {by_id_err}");
+    assert_eq!(
+        by_id_out, "fast_ma  fast.value  F64\nspread  sub.value  F64\n",
+        "same declared-tap rows resolved through the store by content id"
+    );
+}
+
 /// Property (#337): a blueprint with no declared taps prints nothing to
 /// stdout (nothing was declared to list) plus a one-line stderr note — a
 /// listing, not a fault, exit 0.
@@ -2397,7 +2436,7 @@ fn graph_build_accepts_an_open_input_pattern() {
 /// this cycle), so a bare-tap (no-`bias`) pattern is used here: its
 /// `run_measurement` path compiles the signal directly, hitting
 /// `CompileError::UnboundRootRole` at bootstrap — rendered by role NAME
-/// (#342 item 3), not the raw flat index the earlier form left as a
+/// (#339 item 3), not the raw flat index the earlier form left as a
 /// follow-up.
 #[test]
 fn running_an_open_blueprint_refuses_at_bootstrap() {