audit: harvest 2026-07-26 cycle close — intake enumeration completed, ledger notes, stale comments

Architect drift review (scope 77ad046..HEAD): What holds — the #343
reference-semantics hash is code-backed on both output surfaces
(record line + trace index), the RiskRegime::Fixed stamp/re-derive
lockstep is complete both ways, and both new guide examples build
against the binary. Drift resolved in this commit: C24's
root-name-gated intake enumeration gains the introspect --taps FILE
branch plus its missing per-site pin (byte-identical refusal to the
register sibling — the #331 class-enumeration lesson applied); C27
gains the #337 realization note (positive discovery view closes the
recovery-only gap); C12's inline-hash sentence updated to the topo
parameter; five stale dispatch_run comments reworded to name
exec_blueprint_leg as the surviving owner.

Remaining drift routed: the unpinned guide op-scripts are a durable
debt class, filed as #344 (idea) rather than swept here.

Regression gate: aura-bench all five fingerprints OK (report-only
deltas within noise on a loaded box; no baseline move, nothing to
ratify).

refs #337
refs #343

crates/aura-cli/src/graph_construct.rs

@@ -966,9 +966,11 @@ pub(crate) fn composite_from_any(text: &str, env: &aura_runner::project::Env) ->
 ///   `run_signal_r`/`run_measurement` -> `bind_tap_plan` ->
 ///   `TraceStore::begin_run`.
 ///
-/// (The quintet's other direct callers — `dispatch_run`,
+/// (The quintet's other direct callers — the now-retired `dispatch_run`,
 /// `validate_and_register_axes`, `run_blueprint_sweep`/`_walkforward`/`_mc`,
-/// `list_blueprint_axes` — retired with the quintet, #319 Task 8.)
+/// `list_blueprint_axes` — none of these functions survives in the tree
+/// today; all were retired together with the quintet, #319 Task 8.
+/// `exec_blueprint_leg` above is the only direct caller left.)
 ///
 /// This shares the identical `name_gate` + `name_gate_fault_prose`
 /// primitives this wrapper uses, so the refusal wording is byte-identical

crates/aura-cli/src/main.rs

@@ -1178,12 +1178,13 @@ fn panic_refusal_prose(msg: &str) -> String {
 }
 
 /// The `exec` blueprint leg (#319): a synthetic single run of a fully-bound
-/// blueprint envelope, composed 1:1 from `dispatch_run`'s `.json`-branch
-/// building blocks — same intake gate, same shape dispatch (a `bias` output
-/// → the strategy path; else ≥1 declared tap → a bare measurement run; else
-/// refuse), same tap plan, same `run_signal_r`/`run_measurement` calls and
-/// record-line serializer, so the record line stays byte-identical to
-/// `run`'s. `--override` (Task 3, the #246 reopen residue) rides the
+/// blueprint envelope — the sole surviving heir of the retired `dispatch_run`'s
+/// `.json`-branch (and of the retired `run` verb it served, both gone with the
+/// #319 sugar retirement): same intake gate, same shape dispatch (a `bias`
+/// output → the strategy path; else ≥1 declared tap → a bare measurement run;
+/// else refuse), same tap plan, same `run_signal_r`/`run_measurement` calls
+/// and record-line serializer, so the record line stays byte-identical to
+/// what `run` used to emit. `--override` (Task 3, the #246 reopen residue) rides the
 /// strategy path only — a measurement blueprint refuses it with one prose
 /// line (its `param_space()` is not wrap_r-wrapped, so the strategy path's
 /// probe/reopen recipe below does not apply to it materially). `run`'s
@@ -1209,8 +1210,10 @@ fn exec_blueprint_leg(path: &str, overrides: &[String], tap: &[String], env: &au
         eprintln!("aura: {path}: {msg}");
         std::process::exit(2);
     });
-    // Same root-name gate as `dispatch_run`'s FILE intake (#331 delta
-    // re-review): `signal.name()` feeds `bind_tap_plan` -> `TraceStore::begin_run`
+    // This leg's own root-name gate at its FILE intake (#331 delta re-review;
+    // inherited from the retired `dispatch_run`'s identical gate before #319
+    // retired it — `exec_blueprint_leg` is the sole surviving caller now):
+    // `signal.name()` feeds `bind_tap_plan` -> `TraceStore::begin_run`
     // unsanitized (`trace_store.rs`).
     if let Err(msg) = graph_construct::gate_authored_root_name(signal.name()) {
         eprintln!("aura: {path}: {msg}");
@@ -1261,9 +1264,10 @@ fn exec_blueprint_leg(path: &str, overrides: &[String], tap: &[String], env: &au
             eprintln!("aura: {e}");
             std::process::exit(1);
         });
-        // Refuse an open (free-knob) blueprint at the dispatch boundary,
-        // mirroring `dispatch_run`'s own closed-blueprint guard (#176): exec
-        // bootstraps over the EMPTY point, so a free knob would panic in
+        // Refuse an open (free-knob) blueprint at the dispatch boundary — this
+        // leg's own closed-blueprint guard now (#176; inherited from the
+        // retired `dispatch_run`'s identical guard before #319 retired it):
+        // exec bootstraps over the EMPTY point, so a free knob would panic in
         // `compile_with_params` — reject it clean instead. The guard now
         // runs on the REOPENED probe (#319 Task 3): its space must equal
         // exactly the override set (empty when there is none), never leave
@@ -1342,8 +1346,9 @@ fn exec_blueprint_leg(path: &str, overrides: &[String], tap: &[String], env: &au
         }
         // Measurement path (#319 Task 2b): wrap_r-free closed guard via the
         // signal's own open knobs (`blueprint_axis_probe` would weld wrap_r
-        // and panic on a no-`bias` signal) — verbatim from `dispatch_run`'s
-        // measurement arm.
+        // and panic on a no-`bias` signal) — this leg's own guard now,
+        // carried forward verbatim from the retired `dispatch_run`'s
+        // measurement arm before #319 retired it.
         if !signal.param_space().is_empty() {
             eprintln!(
                 "aura: run requires a closed blueprint (no free parameters); {} free knob(s) — \

crates/aura-cli/tests/graph_construct.rs

@@ -1201,6 +1201,32 @@ fn graph_build_and_register_refuse_a_hand_crafted_envelope_with_a_bad_root_name(
     assert_eq!(err2, err, "both file-consuming envelope intakes share the identical fault prose");
 }
 
+/// (#331 spec test 10's missing sibling, harvest audit item 1): `introspect
+/// --taps <FILE>` (#337) reads its FILE branch through the same
+/// `composite_from_authored_text` choke point as `register` and `introspect
+/// --content-id <FILE>` (C24's name-op clause), so a hand-crafted envelope
+/// with a shape-violating root name refuses there too, with the identical
+/// `name_gate_fault_prose` text — the per-site pin the C24 enumeration's
+/// addition of `--taps` to its gated-intake list otherwise leaves unpinned.
+#[test]
+fn graph_introspect_taps_refuses_a_hand_crafted_envelope_with_a_bad_root_name() {
+    let dir = temp_cwd("taps-bad-root-name");
+    let (envelope_bytes, _e, built) = run(&["graph", "build"], SIGNAL_DOC_DESCRIBED);
+    assert!(built, "graph build produces the envelope");
+    let bad = envelope_bytes.replacen("\"name\":\"graph\"", "\"name\":\"../x\"", 1);
+    assert!(bad.contains("\"name\":\"../x\""), "the root-name replace landed: {bad}");
+    let file = dir.join("bad-root-name.json");
+    std::fs::write(&file, &bad).expect("write envelope fixture");
+
+    let (out, err, code) = run_in(&dir, &["graph", "register", file.to_str().unwrap()]);
+    assert_eq!(code, Some(1), "a shape-violating root name refuses (not a panic): {out} {err}");
+
+    let (out2, err2, code2) =
+        run_in(&dir, &["graph", "introspect", "--taps", file.to_str().unwrap()]);
+    assert_eq!(code2, Some(1), "--taps <FILE> refuses too: {out2} {err2}");
+    assert_eq!(err2, err, "--taps shares the identical fault prose with register/--content-id");
+}
+
 /// Property (#202, the same on-ramp seam at the sibling verb): `aura graph
 /// introspect --params` accepts an op-script exactly as it accepts a blueprint
 /// envelope — the raw axis namespace it prints for the op-script equals the one it

docs/design/contracts/c12-atomic-sim-unit.md

@@ -16,9 +16,14 @@ semantics, not the reopened topology's (#343, revised; full clause in
 [C24](c24-blueprint-data.md)'s "Reproduction identity"). Identity is untouched: `content_id_of` (`crates/aura-research/src/lib.rs`) is
 the one hashing primitive, read directly off the authored document by
 `aura_runner::member`'s `run_signal_r`/`run_blueprint_member` — where the
-manifest's `topology_hash` is computed inline (#319 Task 9 retired the
-CLI-side wrapper that used to duplicate this one call) — never a re-opened
-probe, and each member manifest records its per-cell bindings (#246, ratified
+manifest's `topology_hash` is computed inline by default (`run_signal_r`'s
+`topo: Option<&str>` parameter's `None` arm, every caller but one; #319 Task 9
+retired the CLI-side wrapper that used to duplicate this one call), or
+supplied by the caller as a ready reference-semantics hash (`Some`, #343
+revised — `exec`'s override branch passes the loaded base document's own id,
+computed before `reopen_all`, so the SAME value reaches both the record line
+and the trace-store persistence) — never a re-opened probe either way, and
+each member manifest records its per-cell bindings (#246, ratified
 2026-07-12; the restriction this amends — axes bind only open knobs — was an
 implementation consequence of `bind()` shrinking the param surface, not a recorded
 decision). Raw data is shared read-only across sims via `Arc<[T]>` (the

docs/design/contracts/c24-blueprint-data.md

@@ -227,9 +227,11 @@ replayed in order; nodes are referenced **by identifier**, ports as dotted
   `..`) applied at this op intake **plus every CLI intake that reads an
   authored blueprint envelope from a file** — `graph register`, `introspect
   --content-id <FILE>`, the bare graph-file viewer, `introspect --params
-  <FILE>`'s file branch, and `exec`'s blueprint leg (#319; its narrower,
-  envelope-only grammar shares the same `gate_authored_root_name` call
-  directly rather than through the shape-discriminating wrapper) — one
+  <FILE>`'s file branch, `introspect --taps <FILE>`'s file branch (#337,
+  same `composite_from_authored_text` route), and `exec`'s blueprint leg
+  (#319; its narrower, envelope-only grammar shares the same
+  `gate_authored_root_name` call directly rather than through the
+  shape-discriminating wrapper) — one
   class of intake, one gate. The refusal's core sentence
   (`name_gate_fault_prose`) is byte-uniform across every one of these
   sites; only the leading context prefix varies — `exec` and the bare

docs/design/contracts/c27-declared-taps.md

@@ -96,6 +96,19 @@ The chain-pruning benefit — a sweep paying zero for the study wires behind an
 unbound tap — is **deferred to the future DCE cycle** ([C23](c23-graph-compilation.md));
 the mechanism ships now, verified sound.
 
+**#337 (2026-07-26 harvest) ships the positive discovery view**:
+`Composite::declared_taps()` (`crates/aura-engine/src/blueprint.rs`) walks the
+blueprint depth-first collecting `(tap name, source wire, column kind)`, bare
+at every depth, bounds-total over an invalid wire; `graph introspect --taps
+<FILE|ID>` renders one row per declared tap (a tap-less blueprint is a
+stderr-noted listing, exit 0). This closes the **recovery-only** discovery
+gap: before #337, the only way to learn a blueprint's declared tap names was
+provoking `bind_tap_plan`'s `UnknownTap` refusal roster (#333) — a real name
+surfaced only as the side effect of naming a wrong one first. The refusal
+roster itself is unchanged and remains the **recovery** half (what to do once
+a tap name is already wrong); `--taps` is the **discovery** half (learning the
+right names up front).
+
 ## See also
 - [C26](c26-input-binding.md) — the input-side twin (`input_roles`); `check_root_roles_bound`, the mandatory-input counterpart
 - [C23](c23-graph-compilation.md) — compilation/lowering and the deferred DCE cycle the tap design anticipates