audit: harvest 2026-07-26 cycle close — intake enumeration completed, ledger notes, stale comments

Architect drift review (scope 77ad046..HEAD): What holds — the #343
reference-semantics hash is code-backed on both output surfaces
(record line + trace index), the RiskRegime::Fixed stamp/re-derive
lockstep is complete both ways, and both new guide examples build
against the binary. Drift resolved in this commit: C24's
root-name-gated intake enumeration gains the introspect --taps FILE
branch plus its missing per-site pin (byte-identical refusal to the
register sibling — the #331 class-enumeration lesson applied); C27
gains the #337 realization note (positive discovery view closes the
recovery-only gap); C12's inline-hash sentence updated to the topo
parameter; five stale dispatch_run comments reworded to name
exec_blueprint_leg as the surviving owner.

Remaining drift routed: the unpinned guide op-scripts are a durable
debt class, filed as #344 (idea) rather than swept here.

Regression gate: aura-bench all five fingerprints OK (report-only
deltas within noise on a loaded box; no baseline move, nothing to
ratify).

refs #337
refs #343

docs/design/contracts/c12-atomic-sim-unit.md

@@ -16,9 +16,14 @@ semantics, not the reopened topology's (#343, revised; full clause in
 [C24](c24-blueprint-data.md)'s "Reproduction identity"). Identity is untouched: `content_id_of` (`crates/aura-research/src/lib.rs`) is
 the one hashing primitive, read directly off the authored document by
 `aura_runner::member`'s `run_signal_r`/`run_blueprint_member` — where the
-manifest's `topology_hash` is computed inline (#319 Task 9 retired the
-CLI-side wrapper that used to duplicate this one call) — never a re-opened
-probe, and each member manifest records its per-cell bindings (#246, ratified
+manifest's `topology_hash` is computed inline by default (`run_signal_r`'s
+`topo: Option<&str>` parameter's `None` arm, every caller but one; #319 Task 9
+retired the CLI-side wrapper that used to duplicate this one call), or
+supplied by the caller as a ready reference-semantics hash (`Some`, #343
+revised — `exec`'s override branch passes the loaded base document's own id,
+computed before `reopen_all`, so the SAME value reaches both the record line
+and the trace-store persistence) — never a re-opened probe either way, and
+each member manifest records its per-cell bindings (#246, ratified
 2026-07-12; the restriction this amends — axes bind only open knobs — was an
 implementation consequence of `bind()` shrinking the param surface, not a recorded
 decision). Raw data is shared read-only across sims via `Arc<[T]>` (the

docs/design/contracts/c24-blueprint-data.md

@@ -227,9 +227,11 @@ replayed in order; nodes are referenced **by identifier**, ports as dotted
   `..`) applied at this op intake **plus every CLI intake that reads an
   authored blueprint envelope from a file** — `graph register`, `introspect
   --content-id <FILE>`, the bare graph-file viewer, `introspect --params
-  <FILE>`'s file branch, and `exec`'s blueprint leg (#319; its narrower,
-  envelope-only grammar shares the same `gate_authored_root_name` call
-  directly rather than through the shape-discriminating wrapper) — one
+  <FILE>`'s file branch, `introspect --taps <FILE>`'s file branch (#337,
+  same `composite_from_authored_text` route), and `exec`'s blueprint leg
+  (#319; its narrower, envelope-only grammar shares the same
+  `gate_authored_root_name` call directly rather than through the
+  shape-discriminating wrapper) — one
   class of intake, one gate. The refusal's core sentence
   (`name_gate_fault_prose`) is byte-uniform across every one of these
   sites; only the leading context prefix varies — `exec` and the bare

docs/design/contracts/c27-declared-taps.md

@@ -96,6 +96,19 @@ The chain-pruning benefit — a sweep paying zero for the study wires behind an
 unbound tap — is **deferred to the future DCE cycle** ([C23](c23-graph-compilation.md));
 the mechanism ships now, verified sound.
 
+**#337 (2026-07-26 harvest) ships the positive discovery view**:
+`Composite::declared_taps()` (`crates/aura-engine/src/blueprint.rs`) walks the
+blueprint depth-first collecting `(tap name, source wire, column kind)`, bare
+at every depth, bounds-total over an invalid wire; `graph introspect --taps
+<FILE|ID>` renders one row per declared tap (a tap-less blueprint is a
+stderr-noted listing, exit 0). This closes the **recovery-only** discovery
+gap: before #337, the only way to learn a blueprint's declared tap names was
+provoking `bind_tap_plan`'s `UnknownTap` refusal roster (#333) — a real name
+surfaced only as the side effect of naming a wrong one first. The refusal
+roster itself is unchanged and remains the **recovery** half (what to do once
+a tap name is already wrong); `--taps` is the **discovery** half (learning the
+right names up front).
+
 ## See also
 - [C26](c26-input-binding.md) — the input-side twin (`input_roles`); `check_root_roles_bound`, the mandatory-input counterpart
 - [C23](c23-graph-compilation.md) — compilation/lowering and the deferred DCE cycle the tap design anticipates