feat(aura-cli, aura-runner): JSON data namespace — info verb, NDJSON list, coverage retired

Reshape the aura data namespace around one principle: every verb emits
JSON, no format flag (the headless-agent posture #264 named).

- aura data info <symbol> (new): one flat JSON object — symbol plus the
  six neutral geometry fields (digits, pipSize, tickSize, lotSize,
  baseAsset, quoteAsset) from DataServer::symbol_meta when the
  <SYMBOL>.meta.json sidecar yields geometry; a symbol is known via bar
  files OR sidecar (a sidecar-only symbol still reports its geometry);
  an unknown symbol refuses with prose, exit 1. description stays out
  until the neutral reader exposes it (data-server#4).
- aura data list: NDJSON — one JSON string per line; an empty archive
  emits zero stdout lines, with the human affordance moved to a stderr
  note in the #278 class vocabulary.
- aura data coverage: retired — #272's per-cell fault isolation subsumed
  the prophylactic pre-run check; aura-runner's data_coverage_report and
  its presentation helpers go with it, while interior_gap_months stays
  as the campaign path's single gap walk (#295).

The three derived design decisions (description omitted, broader
refusal prose, empty-archive stderr notice) are minuted on the issue.

closes #273

crates/aura-bench/baselines/cli_fixed_cost.json

@@ -1,16 +1,16 @@
 {
   "surface": "cli_fixed_cost",
   "metrics": {
-    "help_ms": 1.5046899999999999,
-    "run_ms": 3.63305
+    "help_ms": 1.487171,
+    "run_ms": 3.376192
   },
-  "fingerprint": "run_line_fnv=6bb0d796f760d140",
+  "fingerprint": "run_line_fnv=9bdbc3acf7b2926a",
   "reps": 3,
   "host": {
     "hostname": "Raki",
     "nproc": 24
   },
   "profile": "release",
-  "commit": "9c7f60b",
-  "date": "2026-07-23"
+  "commit": "10570b7",
+  "date": "2026-07-25"
 }

crates/aura-cli/src/graph_construct.rs

@@ -8,9 +8,9 @@ use std::collections::BTreeMap;
 use std::path::Path;
 
 use aura_engine::{
-    blueprint_from_json, blueprint_identity_json, blueprint_to_json, replay, ArgOpError,
-    BindOpError, BlueprintDoc, CompileError, Composite, GraphSession, LoadError, Op, OpError,
-    Scalar, ScalarKind,
+    blueprint_from_json, blueprint_identity_json, blueprint_to_json, name_gate, replay, ArgOpError,
+    BindOpError, BlueprintDoc, CompileError, Composite, GraphSession, LoadError, NameGateFault, Op,
+    OpError, Scalar, ScalarKind,
 };
 use aura_runner::runner::render_value;
 use serde::Deserialize;
@@ -22,9 +22,10 @@ use crate::research_docs::resolve_id_prefix;
 #[cfg(test)]
 use aura_vocabulary::std_vocabulary;
 
-/// The op-list reference `aura graph build --help` appends (#323): the ten
-/// op kinds with their fields and one worked element each. Lives beside
-/// [`OpDoc`] so a new op variant is one screen away from its help line.
+/// The op-list reference `aura graph build --help` appends (#323): the eleven
+/// op kinds with their fields and one worked element each (#331: `name` joins
+/// the roster, ten -> eleven). Lives beside [`OpDoc`] so a new op variant is
+/// one screen away from its help line.
 pub const OP_REFERENCE: &str = r#"Op-list reference (stdin: a JSON array of op objects, applied in order):
   {"op":"source","role":"price","kind":"F64"}
       declare a bound root input role of a scalar kind
@@ -50,6 +51,9 @@ pub const OP_REFERENCE: &str = r#"Op-list reference (stdin: a JSON array of op o
   {"op":"use","ref":{"name":"agree"},"name":"gate","bind":{"sma.length":{"I64":9}}}
       splice a registered blueprint (by "content_id" or "name") under an
       instance name ("bind" path-qualifies the spliced instance's params)
+  {"op":"name","name":"ny_momentum"}
+      set the composite's render name, at most once per script (default
+      "graph" if omitted)
 
 Node types and their ports: aura graph introspect --vocabulary | --node <T>"#;
 
@@ -111,6 +115,9 @@ enum OpDoc {
         #[serde(default)]
         bind: BTreeMap<String, Scalar>,
     },
+    /// Set the composite's render name (#331) — script-level, at most once;
+    /// the op-script twin of `replay`'s seeded default name (`"graph"`).
+    Name { name: String },
 }
 
 /// A `use` op's reference (#317) — exactly one of a store content id (full
@@ -143,6 +150,7 @@ impl OpDoc {
             OpDoc::Doc { .. } => "doc".to_string(),
             OpDoc::Use { name: Some(n), .. } => format!("use {n:?}"),
             OpDoc::Use { name: None, .. } => "use".to_string(),
+            OpDoc::Name { .. } => "name".to_string(),
         }
     }
 }
@@ -182,6 +190,7 @@ impl From<OpDoc> for Op {
                 name,
                 bind: bind.into_iter().collect(),
             },
+            OpDoc::Name { name } => Op::Name { name },
         }
     }
 }
@@ -257,9 +266,25 @@ fn format_op_error(e: &OpError) -> String {
         OpError::UnknownSubgraph { ref_id } => {
             format!("use: no subgraph for content id {ref_id:?}")
         }
+        OpError::DuplicateName => "a script names its blueprint at most once".to_string(),
+        OpError::BadName { name, fault } => name_gate_fault_prose(name, fault),
     }
 }
 
+/// Phrase a `name_gate` shape violation as prose (#331): shared by this
+/// module's op-intake `format_op_error` `BadName` arm and the
+/// blueprint-envelope intake's root-name gate (`composite_from_authored_text`
+/// below) — the shape rule has exactly one seam-independent cause per fault,
+/// so both data-borne birth routes for a name read identically.
+fn name_gate_fault_prose(name: &str, fault: &NameGateFault) -> String {
+    let cause = match fault {
+        NameGateFault::Empty => "must be non-empty",
+        NameGateFault::ContainsSeparator => "must not contain '/' or '\\'",
+        NameGateFault::DotSegment => "must not be \".\" or \"..\"",
+    };
+    format!("blueprint name {name:?} is invalid: {cause} (a single path segment)")
+}
+
 /// Resolve one `use` op's [`UseRef`] to the full store content id (#317):
 /// verbatim if it already IS a 64-hex content id, else a unique content-id
 /// prefix (#302 semantics, reusing [`resolve_id_prefix`]) or a registry name
@@ -649,7 +674,7 @@ pub fn introspect_cmd(cmd: crate::GraphIntrospectCmd, env: &aura_runner::project
                         std::process::exit(1);
                     }
                 };
-                match composite_from_any(&text, env) {
+                match composite_from_authored_text(&text, env) {
                     Ok(c) => c,
                     Err(m) => {
                         eprintln!("aura: {m}");
@@ -819,6 +844,18 @@ pub(crate) fn blueprint_slot_prose(doc: &str, env: &aura_runner::project::Env) -
 /// envelope (a JSON object: `format_version` + `blueprint`) OR a construction
 /// op-list (a JSON array) — shape-discriminated on the top-level JSON type,
 /// each canonicalized by its own rules.
+///
+/// **Ungated by design (#331 review finding).** This is the STORE READ-BACK
+/// shape: `params_lines`'s content-id fetch (`resolve_blueprint_text`'s
+/// non-file branch) — `introspect --params <ID>` and, by the same
+/// convention, `validate_campaign_refs`'s already-ungated `blueprint_from_json`
+/// call — reads whatever is already sitting in the store, and C29 says a
+/// registered artifact is never retroactively invalidated. Freshly authored
+/// FILE text (a hand-edited document that has not yet passed through a gated
+/// intake) goes through [`composite_from_authored_text`] instead, never here
+/// — `params_lines`'s OWN file branch is such a case (#331 delta re-review:
+/// it used to call straight through to this fn, missing the gate; fixed by
+/// branching on `resolve_blueprint_text`'s file-vs-store flag).
 pub(crate) fn composite_from_any(text: &str, env: &aura_runner::project::Env) -> Result<Composite, String> {
     let value: serde_json::Value =
         serde_json::from_str(text).map_err(|e| format!("invalid document: {e}"))?;
@@ -836,12 +873,86 @@ pub(crate) fn composite_from_any(text: &str, env: &aura_runner::project::Env) ->
     }
 }
 
+/// The FILE-intake counterpart of [`composite_from_any`] (#331 review
+/// finding): identical parse, plus the blueprint-envelope root-name shape
+/// gate. Every call site that builds a `Composite` from text freshly read
+/// off disk (`graph register`, `graph introspect --content-id <FILE>`, the
+/// bare `aura graph <FILE>` viewer, and `graph introspect --params <FILE>`'s
+/// file branch) goes through this wrapper — never the ungated
+/// `composite_from_any` — because a hand-edited envelope with
+/// `"name":"../x"` would otherwise register/build cleanly and write
+/// `traces/../x/` at run time (`trace_store.rs` joins the name unsanitized).
+/// Gating the composite's name unconditionally (not just on the Object
+/// branch) is harmless: an op-script-built composite's name already passed
+/// the op-intake gate (`GraphSession::set_name`), so re-checking it here is
+/// redundant, not restrictive — it keeps this wrapper a single shared choke
+/// point rather than one that has to re-discriminate the JSON shape. Only
+/// the ROOT name is checked: the filesystem seam consumes exclusively the
+/// root name. Store read-back (reproduce, `use`-splice resolution from the
+/// registry, and `params_lines`'s content-id branch) never reaches this
+/// function — C29's "registered artifacts are never retroactively
+/// invalidated" stays intact.
+///
+/// **Deliberate exceptions — direct `gate_authored_root_name` callers
+/// (main.rs).** A handful of fresh-FILE intakes reach the same unsanitized
+/// `traces/<name>/` seam (or `put_blueprint` the loaded envelope straight
+/// into the registry) without going through this wrapper, because each
+/// already parses the document its own way and only needs the shared root-
+/// name gate bolted on, not the shape-discrimination `composite_from_any`
+/// does:
+/// - `aura run <blueprint.json>` (`dispatch_run`): envelope-only grammar (no
+///   op-script fallback), feeds `signal.name()` into
+///   `run_signal_r`/`run_measurement` -> `bind_tap_plan` ->
+///   `TraceStore::begin_run`.
+/// - `validate_and_register_axes` (shared by `generalize`,
+///   `sweep --real`, `walkforward --real`, `mc --real`): `put_blueprint`s
+///   the loaded envelope by topology hash before any of those four verbs
+///   touches an archive.
+/// - `run_blueprint_sweep` / `run_blueprint_walkforward` / `run_blueprint_mc`
+///   (the synthetic, no-`--real` family builders): same `put_blueprint`
+///   reason, on the routes that bypass `validate_and_register_axes`
+///   entirely (#331 cycle-close — these used to plant an ungated envelope
+///   in the store; see each fn's own comment).
+/// - `list_blueprint_axes` (`aura sweep <FILE> --list-axes`, main.rs): no
+///   registry write and no trace directory here, but a shape-violating root
+///   name otherwise mangles through `wrapped_to_raw_axis` into a printed,
+///   non-bindable axis name instead of refusing (#331 fieldtest finding
+///   c331_2e) — the class rule is every CLI intake reading an authored
+///   envelope from a file gates the root name, not only the writing ones.
+///
+/// All of these share the identical `name_gate` + `name_gate_fault_prose`
+/// primitives this wrapper uses, so the refusal wording is byte-identical
+/// across every authored-file-intake route even though the shape-
+/// discrimination step is not shared by them.
+pub(crate) fn composite_from_authored_text(
+    text: &str,
+    env: &aura_runner::project::Env,
+) -> Result<Composite, String> {
+    let composite = composite_from_any(text, env)?;
+    gate_authored_root_name(composite.name())?;
+    Ok(composite)
+}
+
+/// The root-name shape gate itself (#331 delta re-review), factored out of
+/// [`composite_from_authored_text`] so `dispatch_run`'s narrower-grammar file
+/// intake (see that fn's doc comment) can share the exact `name_gate` call and
+/// `name_gate_fault_prose` wording without going through the shape-discriminating
+/// wrapper.
+pub(crate) fn gate_authored_root_name(name: &str) -> Result<(), String> {
+    name_gate(name).map_err(|fault| name_gate_fault_prose(name, &fault))
+}
+
 /// Resolve a blueprint document's bytes from a file path or a 64-hex content
 /// id in the project store (the campaign-run target-addressing convention).
 /// The id shape is `aura_runner::axes::is_content_id` — the same predicate
 /// `campaign run`'s target resolution uses, so the two FILE-or-id surfaces
-/// cannot drift apart on what counts as a store address.
-fn resolve_blueprint_text(target: &str, env: &aura_runner::project::Env) -> Result<String, String> {
+/// cannot drift apart on what counts as a store address. The `bool` names
+/// which branch fired: `true` for a FRESH FILE read, `false` for a STORE
+/// (content-id) fetch — `params_lines` (#331 delta re-review) uses it to
+/// decide whether the root-name gate applies (a fresh file must gate; a
+/// store read-back must not, C29) without re-deriving the FILE-vs-id
+/// distinction a second time.
+fn resolve_blueprint_text(target: &str, env: &aura_runner::project::Env) -> Result<(String, bool), String> {
     // A CLI arg tolerates the `content:` display prefix (#194); doc ref
     // fields stay bare-only.
     let target = target
@@ -851,11 +962,12 @@ fn resolve_blueprint_text(target: &str, env: &aura_runner::project::Env) -> Resu
     let path = Path::new(target);
     if path.is_file() {
         return std::fs::read_to_string(path)
+            .map(|text| (text, true))
             .map_err(|e| format!("cannot read {}: {e}", path.display()));
     }
     if aura_runner::axes::is_content_id(target) {
         return match env.registry().get_blueprint(target) {
-            Ok(Some(json)) => Ok(json),
+            Ok(Some(json)) => Ok((json, false)),
             Ok(None) => Err(format!("no blueprint {target} in the project store")),
             Err(e) => Err(e.to_string()),
         };
@@ -872,12 +984,16 @@ fn resolve_blueprint_text(target: &str, env: &aura_runner::project::Env) -> Resu
 /// `bound_param_space()`'s names are already RAW (#203), so no blueprint-name
 /// concatenation is needed — line-identical to the reconciled `--list-axes`
 /// bound pass (`list_blueprint_axes`, main.rs), same `render_value` lexicon.
+/// #331 delta re-review: the FILE target is a FOURTH freshly-authored-file
+/// intake this fn's own `composite_from_any` call had missed gating — a FILE
+/// routes through [`composite_from_authored_text`] instead; a content id
+/// (STORE read-back) keeps the ungated `composite_from_any` (C29).
 fn params_lines(target: &str, env: &aura_runner::project::Env) -> Result<String, String> {
     use std::fmt::Write as _;
-    let text = resolve_blueprint_text(target, env)?;
+    let (text, is_file) = resolve_blueprint_text(target, env)?;
     // Shape-discriminated like file-mode --content-id: an op-script (array)
     // builds through the one-build tail, an envelope (object) loads (#202).
-    let composite = composite_from_any(&text, env)?;
+    let composite = if is_file { composite_from_authored_text(&text, env)? } else { composite_from_any(&text, env)? };
     let mut out = String::new();
     for p in composite.param_space() {
         let _ = writeln!(out, "{}:{:?}", p.name, p.kind);
@@ -918,7 +1034,9 @@ fn register_blueprint(
         .map_err(|e| format!("cannot read {}: {e}", file.display()))?;
     // Shape-discriminated like file-mode --content-id (#202): either shape
     // canonicalizes to the envelope form, so the stored id is shape-invariant.
-    let composite = composite_from_any(&text, env)?;
+    // Gated (#331 review finding): this text is freshly authored FILE bytes,
+    // not a store read-back, so `composite_from_authored_text` applies.
+    let composite = composite_from_authored_text(&text, env)?;
     let canonical = blueprint_to_json(&composite).map_err(|e| format!("serialize error: {e:?}"))?;
     let id = crate::content_id(&canonical);
     let registry = env.registry();

crates/aura-cli/src/main.rs

@@ -815,15 +815,29 @@ impl IcReport {
 /// alongside it, so the discovery surface must list it regardless too. Names
 /// are RAW `<node>.<param>` paths (#328: the wrapped `<blueprint>.<node>.<param>`
 /// form is retired from the surface) — exactly what `--axis` binds.
+///
+/// **Gated (#331 fieldtest finding).** This is a FRESH-FILE intake exactly like
+/// `register` / `introspect --content-id <FILE>` / `introspect --params <FILE>`
+/// (`composite_from_authored_text`'s doc comment lists the class): a hand-edited
+/// envelope with a shape-violating root name (`"../x"`) must be refused before
+/// any axis line prints, not mangled through `wrapped_to_raw_axis` into a
+/// non-bindable name. Gated immediately after load, before any axis derivation
+/// — same placement discipline as the other sites — at exit 1, matching the
+/// register-route convention (this route never `put_blueprint`s anything,
+/// unlike the exit-2 sweep-EXECUTION route `run_blueprint_sweep` gates).
 fn list_blueprint_axes(doc: &str, env: &aura_runner::project::Env) {
+    let signal = blueprint_from_json(doc, &|t| env.resolve(t))
+        .expect("doc parse-validated at the dispatch boundary");
+    if let Err(msg) = graph_construct::gate_authored_root_name(signal.name()) {
+        eprintln!("aura: {msg}");
+        std::process::exit(1);
+    }
     let space = blueprint_axis_probe(doc, env).param_space();
     for p in &space {
         // Strip the wrapper's one leading node segment (#328): open names print
         // RAW, matching `--axis`'s own accepted namespace.
         println!("{}:{:?}", aura_runner::axes::wrapped_to_raw_axis(&p.name), p.kind); // ScalarKind Debug -> I64/F64/Bool/Timestamp
     }
-    let signal = blueprint_from_json(doc, &|t| env.resolve(t))
-        .expect("doc parse-validated at the dispatch boundary");
     for b in signal.bound_param_space() {
         // `bound_param_space()`'s `.name` is already RAW (#203) — no blueprint-name
         // concatenation (#328: the blueprint name stays out of axis paths, C23).
@@ -901,6 +915,18 @@ fn run_blueprint_sweep(
     env: &aura_runner::project::Env,
 ) {
     let _ = persist; // reserved for the deferred per-member trace path; the family record below is unconditional
+    // #331 cycle-close: this fn `put_blueprint`s the loaded fresh-FILE
+    // envelope into the registry below — gate the root name up front,
+    // before the family ever builds (a shape-violating name can otherwise
+    // confuse the wrapped/raw axis resolution the family build performs,
+    // producing a misleading unrelated error instead of this refusal; see
+    // `gate_authored_root_name`'s doc comment for the full route list).
+    let blueprint = blueprint_from_json(doc, &|t| env.resolve(t))
+        .expect("doc parse-validated at the dispatch boundary");
+    if let Err(msg) = graph_construct::gate_authored_root_name(blueprint.name()) {
+        eprintln!("aura: {msg}");
+        std::process::exit(2);
+    }
     let family = blueprint_sweep_family(doc, axes, &data, env).unwrap_or_else(|e| {
         eprintln!("aura: {e}");
         std::process::exit(2);
@@ -915,11 +941,7 @@ fn run_blueprint_sweep(
         .topology_hash
         .clone()
         .expect("a blueprint sweep stamps every member's topology_hash");
-    let canonical = blueprint_to_json(
-        &blueprint_from_json(doc, &|t| env.resolve(t))
-            .expect("doc parse-validated at the dispatch boundary"),
-    )
-    .expect("a loaded blueprint re-serializes");
+    let canonical = blueprint_to_json(&blueprint).expect("a loaded blueprint re-serializes");
     reg.put_blueprint(&topo, &canonical).unwrap_or_else(|e| {
         eprintln!("aura: {e}");
         std::process::exit(1);
@@ -947,6 +969,16 @@ fn run_blueprint_walkforward(
     doc: &str, axes: &[(String, Vec<Scalar>)], name: &str, data: DataSource, select: Selection,
     env: &aura_runner::project::Env,
 ) {
+    // #331 cycle-close: this fn `put_blueprint`s the loaded fresh-FILE
+    // envelope into the registry below — gate the root name up front,
+    // before the family ever builds (see `run_blueprint_sweep`'s identical
+    // comment on why this must precede the family build, not just the
+    // registry write).
+    let blueprint = blueprint_from_json(doc, &|t| env.resolve(t)).expect("doc parse-validated at the dispatch boundary");
+    if let Err(msg) = graph_construct::gate_authored_root_name(blueprint.name()) {
+        eprintln!("aura: {msg}");
+        std::process::exit(2);
+    }
     let result = blueprint_walkforward_family(doc, axes, &data, select, env);
     let reg = env.registry();
     let topo = result.windows[0]
@@ -956,10 +988,7 @@ fn run_blueprint_walkforward(
         .topology_hash
         .clone()
         .expect("a blueprint walk-forward stamps every member's topology_hash");
-    let canonical = blueprint_to_json(
-        &blueprint_from_json(doc, &|t| env.resolve(t)).expect("doc parse-validated at the dispatch boundary"),
-    )
-    .expect("a loaded blueprint re-serializes");
+    let canonical = blueprint_to_json(&blueprint).expect("a loaded blueprint re-serializes");
     reg.put_blueprint(&topo, &canonical).unwrap_or_else(|e| { eprintln!("aura: {e}"); std::process::exit(1); });
     let id = match reg.append_family(name, FamilyKind::WalkForward, &walkforward_member_reports(&result)) {
         Ok(id) => id,
@@ -983,6 +1012,17 @@ fn run_blueprint_walkforward(
 /// `FamilyKind::MonteCarlo` family (C18/C21 lineage), and print each draw's member line
 /// (carrying the seed) plus the aggregate — mirroring `run_blueprint_sweep`.
 fn run_blueprint_mc(doc: &str, n_seeds: u64, name: &str, data: DataSource, env: &aura_runner::project::Env) {
+    // #331 cycle-close: this fn `put_blueprint`s the loaded fresh-FILE
+    // envelope into the registry below — gate the root name up front,
+    // before the family ever builds (see `run_blueprint_sweep`'s identical
+    // comment on why this must precede the family build, not just the
+    // registry write).
+    let blueprint = blueprint_from_json(doc, &|t| env.resolve(t))
+        .expect("doc parse-validated at the dispatch boundary");
+    if let Err(msg) = graph_construct::gate_authored_root_name(blueprint.name()) {
+        eprintln!("aura: {msg}");
+        std::process::exit(2);
+    }
     let family = blueprint_mc_family(doc, n_seeds, &data, env).unwrap_or_else(|e| {
         eprintln!("aura: {e}");
         std::process::exit(2);
@@ -995,11 +1035,7 @@ fn run_blueprint_mc(doc: &str, n_seeds: u64, name: &str, data: DataSource, env:
         .topology_hash
         .clone()
         .expect("a blueprint mc stamps every member's topology_hash");
-    let canonical = blueprint_to_json(
-        &blueprint_from_json(doc, &|t| env.resolve(t))
-            .expect("doc parse-validated at the dispatch boundary"),
-    )
-    .expect("a loaded blueprint re-serializes");
+    let canonical = blueprint_to_json(&blueprint).expect("a loaded blueprint re-serializes");
     reg.put_blueprint(&topo, &canonical).unwrap_or_else(|e| {
         eprintln!("aura: {e}");
         std::process::exit(1);
@@ -1222,15 +1258,15 @@ struct DataCmd {
 
 #[derive(Subcommand)]
 enum DataCommand {
-    /// Report a symbol's monthly file-index coverage (span + interior gaps).
-    Coverage(DataCoverageCmd),
-    /// List the archive's known symbols, sorted, one per line.
+    /// Print a symbol's recorded geometry as one flat JSON object.
+    Info(DataInfoCmd),
+    /// List the archive's known symbols as NDJSON, sorted, one per line.
     List,
 }
 
 #[derive(Args)]
-struct DataCoverageCmd {
-    /// The symbol to inventory (e.g. `GER40`).
+struct DataInfoCmd {
+    /// The symbol to inspect (e.g. `GER40`).
     symbol: String,
 }
 
@@ -1699,13 +1735,19 @@ fn parse_axes(
     Ok(axes)
 }
 
-/// The three distinguishable ways `validate_and_register_axes` can fail: an
-/// unknown axis name is a usage error (exit 2, echoed before the archive is
-/// touched); a registry write failure is a runtime error (exit 1); running
-/// outside a project (no `Aura.toml` found up from cwd, #218's gate) is also
-/// a runtime error (exit 1) — the strategy document cannot resolve against a
-/// project store/vocabulary that doesn't exist.
+/// The four distinguishable ways `validate_and_register_axes` can fail: a
+/// shape-violating root name is a usage error (exit 2, echoed before the
+/// blueprint ever reaches the registry — #331 cycle-close: this fn
+/// `put_blueprint`s a fresh-FILE envelope and so must gate it exactly like
+/// `register`/`run`/the other authored-file intakes, see
+/// `gate_authored_root_name`'s doc comment); an unknown axis name is a usage
+/// error (exit 2, echoed before the archive is touched); a registry write
+/// failure is a runtime error (exit 1); running outside a project (no
+/// `Aura.toml` found up from cwd, #218's gate) is also a runtime error —
+/// exit 1, since the strategy document cannot resolve against a project
+/// store/vocabulary that doesn't exist.
 enum AxisRegisterError {
+    BadName(String),
     UnknownAxis(String),
     Registry(String),
     NoProject(String),
@@ -1738,6 +1780,10 @@ fn validate_and_register_axes(
     let wrapped_open = blueprint_axis_probe(doc, env).param_space();
     let blueprint = blueprint_from_json(doc, &|t| env.resolve(t))
         .expect("doc parse-validated at the dispatch boundary");
+    // #331 cycle-close: this fn `put_blueprint`s a fresh-FILE envelope below —
+    // gate the root name before it lands in the registry (shared choke point
+    // with every other authored-file intake).
+    graph_construct::gate_authored_root_name(blueprint.name()).map_err(AxisRegisterError::BadName)?;
     let raw_bound: HashSet<String> =
         blueprint.bound_param_space().into_iter().map(|b| b.name).collect();
     for (n, _) in axes {
@@ -1774,11 +1820,16 @@ fn validate_and_register_axes(
 
 /// Exit-map for a `validate_and_register_axes` failure — the stderr line and
 /// exit code every campaign dispatcher (sweep/generalize/walkforward/mc)
-/// preserves: an unknown axis is a usage error (exit 2, echoed before the
-/// archive is touched); a registry write failure or a missing project (no
-/// `Aura.toml` found up from cwd, #218's gate) is a runtime error (exit 1).
+/// preserves: a shape-violating root name (#331) or an unknown axis is a
+/// usage error (exit 2, echoed before the archive is touched); a registry
+/// write failure or a missing project (no `Aura.toml` found up from cwd,
+/// #218's gate) is a runtime error (exit 1).
 fn exit_axis_register_error(e: AxisRegisterError) -> ! {
     match e {
+        AxisRegisterError::BadName(m) => {
+            eprintln!("aura: {m}");
+            std::process::exit(2)
+        }
         AxisRegisterError::UnknownAxis(m) => {
             eprintln!("aura: {m}");
             std::process::exit(2)
@@ -1884,6 +1935,19 @@ fn dispatch_run(a: RunCmd, env: &aura_runner::project::Env) {
                 eprintln!("aura: {path}: {msg}");
                 std::process::exit(2);
             });
+            // #331 delta re-review: this is the third freshly-authored-FILE
+            // intake (`register`, `introspect --content-id <FILE>`, and this
+            // one) that must gate the root name before it ever reaches the
+            // filesystem — both run arms below feed `signal.name()` straight
+            // into `bind_tap_plan`'s `TraceStore::begin_run`, which joins it
+            // unsanitized (`trace_store.rs`). Not routed through
+            // `composite_from_authored_text` itself (see that fn's doc
+            // comment on why); same `name_gate`/`name_gate_fault_prose`
+            // primitives, this arm's own load-error exit/prose convention.
+            if let Err(msg) = graph_construct::gate_authored_root_name(signal.name()) {
+                eprintln!("aura: {path}: {msg}");
+                std::process::exit(2);
+            }
             // Shape dispatch (C28 phase 3): a `bias` output → the strategy path
             // (wrap_r + R evaluation), byte-identical; else ≥1 declared tap → a
             // bare measurement run (no wrap_r); else an inert blueprint → refuse.
@@ -1981,7 +2045,7 @@ fn dispatch_graph(a: GraphCmd, env: &aura_runner::project::Env) {
                     eprintln!("aura: {path}: {e}");
                     std::process::exit(2);
                 });
-                let bp = graph_construct::composite_from_any(&doc, env).unwrap_or_else(|msg| {
+                let bp = graph_construct::composite_from_authored_text(&doc, env).unwrap_or_else(|msg| {
                     eprintln!("aura: {path}: {msg}");
                     std::process::exit(2);
                 });
@@ -2216,7 +2280,7 @@ fn dispatch_nodes_new(a: NodesNewCmd) {
 
 fn dispatch_data(cmd: DataCmd, env: &aura_runner::project::Env) {
     match cmd.command {
-        DataCommand::Coverage(a) => dispatch_data_coverage(a, env),
+        DataCommand::Info(a) => dispatch_data_info(a, env),
         DataCommand::List => dispatch_data_list(env),
     }
 }
@@ -2261,57 +2325,116 @@ fn dispatch_measure_ic(a: MeasureIcCmd, env: &aura_runner::project::Env) {
     println!("{}", report.to_json());
 }
 
-/// `aura data list` (#264 cut 2): print the archive's known symbols, sorted
-/// ascending, one per line — the discovery step before `aura data coverage`
-/// or scoping a campaign's instrument matrix. Resolves the archive root
-/// through the normal project path ([`dispatch_data_coverage`]'s
-/// `Env::data_path`), then reuses `DataServer`'s own symbol index
-/// (`DataServer::symbols()`, already sorted) rather than re-deriving a
-/// directory scan. An empty or absent archive is informational absence, not a
-/// fault: a `no symbols` prose line, exit 0 (the verb corpus's established
-/// empty-result register — cf. `runs family`'s unknown-id empty exit 0).
+/// `aura data list` (#273: the namespace-wide NDJSON reshape): print the
+/// archive's known symbols as NDJSON, sorted ascending, one JSON string per
+/// line — the discovery step before `aura data info <symbol>` or scoping a
+/// campaign's instrument matrix. Resolves the archive root through the normal
+/// project path (`Env::data_path`), then reuses `DataServer`'s own symbol
+/// index (`DataServer::symbols()`, already sorted) rather than re-deriving a
+/// directory scan. An empty or absent archive prints zero stdout lines — the
+/// honest NDJSON of an empty set, since a placeholder prose line would break
+/// `| jq`-style consumption; the human affordance moves to a
+/// `crate::diag::note!` stderr notice instead (#273 design minutes,
+/// 2026-07-25).
 fn dispatch_data_list(env: &aura_runner::project::Env) {
     let data_path = std::path::PathBuf::from(env.data_path());
     let server = aura_ingest::DataServer::new(&data_path);
-    for line in data_list_report(&server.symbols()) {
+    let report = data_list_report(&server.symbols());
+    if report.is_empty() {
+        crate::diag::note!("no symbols in the archive");
+        return;
+    }
+    for line in report {
         println!("{line}");
     }
 }
 
 /// Pure: render `symbols` (already sorted by `DataServer::symbols()`) as one
-/// line per symbol, or a single `no symbols` line when the archive is empty
-/// or absent — informational absence, never a fault (#264).
+/// JSON-string line per symbol (`serde_json::to_string`, so `SYMA` becomes the
+/// quoted `"SYMA"` NDJSON line) — an empty archive yields an empty `Vec`,
+/// never a placeholder line, so stdout stays pure NDJSON either way (#273).
 fn data_list_report(symbols: &[std::sync::Arc<str>]) -> Vec<String> {
-    if symbols.is_empty() {
-        return vec!["no symbols".to_string()];
-    }
-    symbols.iter().map(|s| s.to_string()).collect()
+    symbols
+        .iter()
+        .map(|s| serde_json::to_string(s.as_ref()).expect("a symbol string always serializes"))
+        .collect()
 }
 
-/// `aura data coverage <SYMBOL>` (#264 cut 1): print the archive's month
-/// coverage for `SYMBOL` — the Copper failure mode (files present at both
-/// ends of a window while an interior month is missing, so a first/last-bounds
-/// check passes but a campaign run aborts mid-window) made visible up front.
-/// Resolves the archive root through the normal project path (`Env::data_path`
-/// — a project-local `[paths] data` override when set, the data-server default
-/// otherwise), so a project-scoped archive is inventoried, not the host one.
-fn dispatch_data_coverage(a: DataCoverageCmd, env: &aura_runner::project::Env) {
+/// `aura data info <SYMBOL>` (#273): print a symbol's recorded geometry as one
+/// flat JSON object — the machine-readable follow-up to `aura data list`'s
+/// discovery pass, surfacing `DataServer::symbol_meta`'s neutral,
+/// broker-agnostic geometry (digits / pip / tick / lot sizing, base / quote
+/// asset) without a human ever opening the `<SYMBOL>.meta.json` sidecar by
+/// hand. Resolves the archive root through the normal project path
+/// (`Env::data_path`, same as every other `data` verb). A symbol is KNOWN
+/// when the archive holds bar files for it (`DataServer::has_symbol`) OR it
+/// carries a usable geometry sidecar (`DataServer::symbol_meta`) — a
+/// sidecar-only symbol (bars not yet ingested) still reports its geometry. An
+/// unknown symbol (neither) refuses on stderr, exit 1. Nothing else about the
+/// archive (span, gaps, provider metadata) surfaces here — that was `aura
+/// data coverage`'s job; #272's per-cell fault isolation made it redundant,
+/// so this issue retires it rather than folding it in (#273 design minutes).
+fn dispatch_data_info(a: DataInfoCmd, env: &aura_runner::project::Env) {
     let data_path = std::path::PathBuf::from(env.data_path());
-    let months = aura_ingest::list_m1_months(&data_path, &a.symbol);
-    // The report body is single-sourced with a campaign cell's own coverage
-    // annotation (#295 Task 7: `aura_runner::coverage::interior_gap_months`
-    // is the one gap walk both consumers call).
-    match aura_runner::coverage::data_coverage_report(&a.symbol, &months) {
-        Ok(lines) => {
-            for line in lines {
-                println!("{line}");
-            }
-        }
-        Err(e) => {
-            eprintln!("aura: {e} at {}", env.data_path());
-            std::process::exit(1);
-        }
+    let server = aura_ingest::DataServer::new(&data_path);
+    let geo = server.symbol_meta(&a.symbol);
+    if geo.is_none() && !server.has_symbol(&a.symbol) {
+        eprintln!(
+            "aura: no recorded data for symbol \"{}\" (no archive files, no geometry sidecar)",
+            a.symbol
+        );
+        std::process::exit(1);
     }
+    println!("{}", data_info_report(&a.symbol, geo.as_ref()));
+}
+
+/// One `aura data info` object's shape: `symbol` plus, when a geometry
+/// sidecar was found, its six neutral price-geometry fields — never a
+/// provider-specific field (`generator`, `schemaVersion`, `generatedAtUtc`,
+/// #273 acceptance), since `InstrumentGeometry` never carries one to begin
+/// with. `InstrumentGeometry` itself has no `Serialize` impl, so
+/// [`data_info_report`] copies its fields in here. `rename_all = "camelCase"`
+/// turns `pip_size`/`tick_size`/`lot_size`/`base_asset`/`quote_asset` into the
+/// sidecar's own `pipSize`/`tickSize`/`lotSize`/`baseAsset`/`quoteAsset`
+/// spelling; `#[serde(skip_serializing_if)]` drops the whole geometry tail
+/// when absent rather than emitting `null`s, so a sidecar-less known symbol
+/// reports as bare `{"symbol":"…"}` (#273 design minutes, 2026-07-25:
+/// `description` stays out of this report until the reader exposes it).
+#[derive(serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+struct DataInfoReport {
+    symbol: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    digits: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pip_size: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    tick_size: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    lot_size: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    base_asset: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    quote_asset: Option<String>,
+}
+
+/// Pure: `aura data info <SYMBOL>`'s report body (#273) — one flat JSON
+/// object, field order `symbol`, `digits`, `pipSize`, `tickSize`, `lotSize`,
+/// `baseAsset`, `quoteAsset` (serde's field-declaration order is stable,
+/// unlike `serde_json::Map`'s alphabetical iteration). `geo` is `None` for a
+/// known-but-sidecar-less symbol, in which case every geometry field is
+/// omitted (see [`DataInfoReport`]).
+fn data_info_report(symbol: &str, geo: Option<&aura_ingest::InstrumentGeometry>) -> String {
+    let report = DataInfoReport {
+        symbol: symbol.to_string(),
+        digits: geo.map(|g| g.digits),
+        pip_size: geo.map(|g| g.pip_size),
+        tick_size: geo.map(|g| g.tick_size),
+        lot_size: geo.map(|g| g.lot_size),
+        base_asset: geo.map(|g| g.base.clone()),
+        quote_asset: geo.map(|g| g.quote.clone()),
+    };
+    serde_json::to_string(&report).expect("a finite DataInfoReport always serializes")
 }
 
 /// `aura sweep`: loaded-blueprint by-name axis sweep (or `--list-axes` probe) when the
@@ -2755,23 +2878,55 @@ mod tests {
     }
 
     /// An empty (or absent) archive is informational absence, not a fault
-    /// (#264): `data_list_report` returns the single `no symbols` prose line
-    /// rather than an empty `Vec`, so the caller's exit-0 println always has
-    /// something to say.
+    /// (#264), but under the all-JSON namespace reshape (#273) stdout must
+    /// stay pure NDJSON: `data_list_report` returns an empty `Vec` rather
+    /// than a placeholder prose line, so the caller has nothing to print and
+    /// moves the human affordance to stderr instead.
     #[test]
-    fn data_list_report_of_an_empty_archive_is_a_no_symbols_line() {
+    fn data_list_report_of_an_empty_archive_is_empty() {
         let symbols: Vec<std::sync::Arc<str>> = vec![];
-        assert_eq!(data_list_report(&symbols), vec!["no symbols".to_string()]);
+        assert_eq!(data_list_report(&symbols), Vec::<String>::new());
     }
 
-    /// A non-empty archive renders one line per symbol, in the order handed
-    /// in (`DataServer::symbols()` already sorts) — no `no symbols` line
-    /// mixed in (#264).
+    /// A non-empty archive renders one NDJSON line per symbol, in the order
+    /// handed in (`DataServer::symbols()` already sorts) — each symbol as a
+    /// quoted JSON string, not a bare name (#273: the NDJSON reshape).
     #[test]
-    fn data_list_report_of_a_populated_archive_is_one_line_per_symbol() {
+    fn data_list_report_of_a_populated_archive_is_one_json_string_per_line() {
         let symbols: Vec<std::sync::Arc<str>> =
             vec![std::sync::Arc::from("SYMA"), std::sync::Arc::from("SYMB")];
-        assert_eq!(data_list_report(&symbols), vec!["SYMA".to_string(), "SYMB".to_string()]);
+        assert_eq!(
+            data_list_report(&symbols),
+            vec!["\"SYMA\"".to_string(), "\"SYMB\"".to_string()]
+        );
+    }
+
+    /// `aura data info`'s report body with a full geometry sidecar present:
+    /// the exact output string, pinning both the field order (`symbol` then
+    /// the six geometry fields, camelCased) and serde_json's own float
+    /// rendering (#273).
+    #[test]
+    fn data_info_report_with_geometry_is_symbol_plus_six_camelcase_fields() {
+        let geo = aura_ingest::InstrumentGeometry {
+            digits: 5,
+            pip_size: 0.0001,
+            tick_size: 1e-05,
+            lot_size: 100_000.0,
+            base: "EUR".to_string(),
+            quote: "USD".to_string(),
+        };
+        assert_eq!(
+            data_info_report("EURUSD", Some(&geo)),
+            r#"{"symbol":"EURUSD","digits":5,"pipSize":0.0001,"tickSize":0.00001,"lotSize":100000.0,"baseAsset":"EUR","quoteAsset":"USD"}"#
+        );
+    }
+
+    /// A known symbol with no geometry sidecar reports bare identity — no
+    /// `null` geometry fields, no provider metadata, just `symbol` (#273:
+    /// "a sidecar-less known symbol yields just `{"symbol":"…"}`").
+    #[test]
+    fn data_info_report_without_geometry_is_bare_symbol() {
+        assert_eq!(data_info_report("SYMX", None), r#"{"symbol":"SYMX"}"#);
     }
 
     /// #234: `campaign_run::persist_campaign_traces`'s C1 drift alarm re-runs a

crates/aura-cli/tests/cli_run.rs

@@ -5,7 +5,7 @@ use std::path::Path;
 use std::process::Command;
 
 mod common;
-use common::{fresh_project, fresh_project_with_data, fresh_project_with_gapped_data};
+use common::{fresh_project, fresh_project_with_data};
 
 /// Path to the freshly-built `aura` binary (Cargo sets this env var for the test
 /// crate; the binary is named `aura` in `Cargo.toml`).
@@ -2449,6 +2449,53 @@ fn aura_walkforward_synthetic_blueprint_refuses_a_wrapped_form_axis_name() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+/// Property (#331 cycle-close, high finding): the SYNTHETIC (no `--real`)
+/// blueprint sweep reads a fresh-FILE envelope and `put_blueprint`s it into
+/// the registry unconditionally (`run_blueprint_sweep`, keyed by the
+/// family's shared topology hash) — before this fix that write was UNGATED,
+/// so `aura sweep bad.json` could plant a shape-violating root name
+/// (`"../x"`) in the store, breaking the C29 exemption's premise that "the
+/// store is populated through the gated intakes" (`composite_from_any`'s
+/// doc comment). A hand-edited envelope whose root name violates
+/// `name_gate` must now refuse with the shared `name_gate_fault_prose`
+/// wording (byte-identical to `register`/`run`/etc.) at the site's usual
+/// exit code (2, matching every other blueprint-load refusal in this
+/// function), and nothing must land in `runs/blueprints`.
+#[test]
+fn aura_sweep_synthetic_blueprint_refuses_a_hand_crafted_envelope_with_a_bad_root_name() {
+    let dir = temp_cwd("sweep_synthetic_bad_root_name_refusal");
+    let fixture_text = std::fs::read_to_string(format!("{}/examples/r_sma.json", env!("CARGO_MANIFEST_DIR")))
+        .expect("read r_sma.json fixture");
+    let bad = fixture_text.replacen("\"name\":\"sma_signal\"", "\"name\":\"../x\"", 1);
+    assert!(bad.contains("\"name\":\"../x\""), "the root-name replace landed: {bad}");
+    let file = dir.join("bad-root-name.json");
+    std::fs::write(&file, &bad).expect("write envelope fixture");
+
+    let out = Command::new(BIN)
+        .args(["sweep", file.to_str().unwrap(), "--axis", "fast.length=2,4"])
+        .current_dir(&dir)
+        .output()
+        .expect("spawn aura sweep (synthetic, bad root name)");
+    assert_eq!(
+        out.status.code(),
+        Some(2),
+        "a shape-violating root name must be refused, not registered: status={:?} stderr={}",
+        out.status,
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let stderr = String::from_utf8_lossy(&out.stderr).into_owned();
+    assert!(
+        stderr.contains("blueprint name \"../x\" is invalid") && stderr.contains("must not contain '/' or '\\'"),
+        "names the offending root name with the shared gate prose: {stderr}"
+    );
+    assert!(out.stdout.is_empty(), "a refused root name must not print a member line: {out:?}");
+    assert!(
+        !dir.join("runs").exists(),
+        "a refused root name must leave no store — nothing may land in runs/blueprints"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// Property (#247, #328 render-seam echo): every sweep-verb boundary
 /// `BindError` renders as prose in the same register as its unknown-axis
 /// sibling (`aura: axis <name>: names no param of this blueprint … — see
@@ -5463,6 +5510,48 @@ fn aura_sweep_list_axes_rejects_malformed_blueprint() {
     assert!(!stderr.contains("panicked"), "must reject cleanly, not panic: {stderr}");
 }
 
+/// Property (#331 fieldtest finding, cycle-331-blueprint-name c331_2e): `--list-axes`
+/// is a FRESH-FILE intake exactly like `register` / `introspect --content-id` /
+/// `introspect --params`, but its own root-name gate was missing — a hand-edited
+/// envelope with a shape-violating root name (`"../x"`) printed mangled,
+/// non-bindable axis names instead of being refused. The route now shares
+/// `gate_authored_root_name` + `name_gate_fault_prose` and exits 1 — the
+/// register-route convention (this route never `put_blueprint`s anything, unlike
+/// the exit-2 sweep-EXECUTION route pinned by
+/// `aura_sweep_synthetic_blueprint_refuses_a_hand_crafted_envelope_with_a_bad_root_name`)
+/// — printing no axis line at all.
+#[test]
+fn aura_sweep_list_axes_refuses_a_hand_crafted_envelope_with_a_bad_root_name() {
+    let dir = temp_cwd("sweep_list_axes_bad_root_name_refusal");
+    let fixture_text =
+        std::fs::read_to_string(format!("{}/tests/fixtures/r_sma_open.json", env!("CARGO_MANIFEST_DIR")))
+            .expect("read r_sma_open.json fixture");
+    let bad = fixture_text.replacen("\"name\":\"sma_signal\"", "\"name\":\"../x\"", 1);
+    assert!(bad.contains("\"name\":\"../x\""), "the root-name replace landed: {bad}");
+    let file = dir.join("bad-root-name.json");
+    std::fs::write(&file, &bad).expect("write envelope fixture");
+
+    let out = Command::new(BIN)
+        .args(["sweep", file.to_str().unwrap(), "--list-axes"])
+        .current_dir(&dir)
+        .output()
+        .expect("spawn aura sweep --list-axes (bad root name)");
+    assert_eq!(
+        out.status.code(),
+        Some(1),
+        "a shape-violating root name must be refused (register-route convention), not listed: status={:?} stderr={}",
+        out.status,
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let stderr = String::from_utf8_lossy(&out.stderr).into_owned();
+    assert!(
+        stderr.contains("blueprint name \"../x\" is invalid") && stderr.contains("must not contain '/' or '\\'"),
+        "names the offending root name with the shared gate prose: {stderr}"
+    );
+    assert!(out.stdout.is_empty(), "a refused root name must print no axis line: {out:?}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// E2E (#210 c0110 fieldtest, "aura sweep <op-script> rejects the op-script
 /// array with a raw serde error"): `aura sweep`'s blueprint slot accepts only
 /// the built blueprint envelope; an un-built op-script (a JSON array) is
@@ -6649,61 +6738,18 @@ fn shipped_r_meanrev_example_runs_end_to_end_via_aura_run() {
     assert!(stdout.contains("\"total_pips\":0.0"), "{stdout}");
 }
 
-/// Property (#264, coverage cut 1): `aura data coverage <SYMBOL>` surfaces the
-/// archive's month COVERAGE from the monthly file index — the first and last
-/// present month AND every interior missing-month range (a gap) — so the Copper
-/// failure mode is visible up front. Copper had files from 2016-08 but was
-/// missing 2018-01..2018-10, so a first/last-bounds check passed while a
-/// window opening in the hole had no data, aborting a multi-hour campaign
-/// mid-run; a per-symbol gap report would have caught it before the run. Over a
-/// hermetic synthetic archive whose `GAPSYM` has 2024-01..02 and 2024-05..06
-/// present and 2024-03..04 absent, the verb exits 0, frames the span by its
-/// first (2024-01) and last (2024-06) present month, and reports the interior
-/// hole as a single collapsed month-range line `missing: 2024-03..2024-04`
-/// (one line for the whole contiguous gap, as Copper's ten-month hole would be
-/// one line — not one line per missing month).
+/// Property (#273, list reshape): `aura data list` enumerates the archive's
+/// symbols as NDJSON, sorted — the discovery step a campaign author (or an
+/// agent operating through the CLI alone, the deployment posture) needs
+/// before `aura data info <symbol>`. The archive root resolves through the
+/// same project path as `info` (`Env::data_path` — a project-local `[paths]
+/// data` override when set). Over a hermetic synthetic archive holding two
+/// symbols (`SYMA` 2024-01..08 and `SYMB` 2024-03..06), the verb exits 0 and
+/// prints EXACTLY two lines, each a JSON string parseable via
+/// `serde_json::from_str::<String>`, in ascending order — `"SYMA"` before
+/// `"SYMB"`, nothing else.
 #[test]
-fn data_coverage_reports_month_span_and_interior_gap_range() {
-    let (cwd, _g) = fresh_project_with_gapped_data();
-    let out = std::process::Command::new(env!("CARGO_BIN_EXE_aura"))
-        .args(["data", "coverage", "GAPSYM"])
-        .current_dir(&cwd)
-        .output()
-        .expect("spawn aura data coverage");
-    assert_eq!(
-        out.status.code(),
-        Some(0),
-        "exit: {:?}, stderr: {}",
-        out.status,
-        String::from_utf8_lossy(&out.stderr)
-    );
-    let stdout = String::from_utf8(out.stdout).expect("utf-8 stdout");
-    // The interior gap is the headline — the Copper failure the verb exists to
-    // surface — reported as one collapsed range for the whole contiguous hole.
-    assert!(
-        stdout.contains("missing: 2024-03..2024-04"),
-        "interior gap month-range reported as one line: {stdout}"
-    );
-    // The span bounds frame the gap: first and last present month.
-    assert!(
-        stdout.contains("2024-01") && stdout.contains("2024-06"),
-        "first (2024-01) and last (2024-06) present month reported: {stdout}"
-    );
-}
-
-/// Property (#264, list cut 2): `aura data list` enumerates the symbols the
-/// archive contains, one per line, sorted — the discovery step a campaign
-/// author (or an agent operating through the CLI alone, the deployment
-/// posture) needs before `aura data coverage <symbol>`, since without it the
-/// inventory is obtainable only by listing the archive directory outside
-/// aura. The archive root resolves through the same project path as `coverage`
-/// (`Env::data_path` — a project-local `[paths] data` override when set). Over
-/// a hermetic synthetic archive holding two symbols (`SYMA` 2024-01..08 and
-/// `SYMB` 2024-03..06), the verb exits 0 and prints EXACTLY the two symbol
-/// names in ascending order, one per line — `SYMA` before `SYMB`, nothing
-/// else.
-#[test]
-fn data_list_enumerates_archive_symbols_one_per_line_sorted() {
+fn data_list_on_a_populated_archive_is_ndjson_one_symbol_per_line() {
     let (cwd, _g) = fresh_project_with_data();
     let out = std::process::Command::new(env!("CARGO_BIN_EXE_aura"))
         .args(["data", "list"])
@@ -6718,10 +6764,161 @@ fn data_list_enumerates_archive_symbols_one_per_line_sorted() {
         String::from_utf8_lossy(&out.stderr)
     );
     let stdout = String::from_utf8(out.stdout).expect("utf-8 stdout");
-    // The whole contract: the two archive symbols, sorted, one per line, and
-    // nothing else — this is the inventory a campaign author reads before
-    // scoping an instrument matrix.
-    assert_eq!(stdout, "SYMA\nSYMB\n", "sorted symbol enumeration: {stdout:?}");
+    let lines: Vec<&str> = stdout.lines().collect();
+    assert_eq!(lines.len(), 2, "exactly the two archive symbols: {stdout:?}");
+    let parsed: Vec<String> = lines
+        .iter()
+        .map(|l| serde_json::from_str::<String>(l).unwrap_or_else(|e| panic!("line {l:?} is a JSON string: {e}")))
+        .collect();
+    assert_eq!(parsed, vec!["SYMA".to_string(), "SYMB".to_string()], "sorted NDJSON enumeration: {stdout:?}");
+}
+
+/// Property (#273 design minutes, 2026-07-25): an empty archive under the
+/// all-JSON namespace prints ZERO stdout lines — the honest NDJSON of an
+/// empty set, since a placeholder prose line would break `| jq`-style
+/// consumption — with the human affordance carried on stderr instead (the
+/// `aura: note:` class, #278).
+#[test]
+fn data_list_on_an_empty_archive_is_empty_stdout_with_a_stderr_notice() {
+    let (cwd, _g) = fresh_project_with_data();
+    let data_dir = cwd.join("data");
+    std::fs::remove_dir_all(&data_dir).expect("clear the synthetic archive");
+    std::fs::create_dir_all(&data_dir).expect("recreate an empty synthetic archive dir");
+    let out = std::process::Command::new(env!("CARGO_BIN_EXE_aura"))
+        .args(["data", "list"])
+        .current_dir(&cwd)
+        .output()
+        .expect("spawn aura data list");
+    assert_eq!(
+        out.status.code(),
+        Some(0),
+        "exit: {:?}, stderr: {}",
+        out.status,
+        String::from_utf8_lossy(&out.stderr)
+    );
+    assert_eq!(out.stdout, b"", "empty archive: zero stdout lines");
+    let stderr = String::from_utf8(out.stderr).expect("utf-8 stderr");
+    assert!(stderr.contains("aura: note:") && stderr.contains("no symbols"), "stderr carries the notice: {stderr}");
+}
+
+/// Property (#273): `aura data info <SYMBOL>` on a symbol the archive holds
+/// bar files for but no `<SYMBOL>.meta.json` sidecar reports bare identity —
+/// exit 0, stdout is exactly `{"symbol":"…"}`, no `null` geometry fields.
+#[test]
+fn data_info_on_a_symbol_without_sidecar_is_bare_symbol_json() {
+    let (cwd, _g) = fresh_project_with_data();
+    std::fs::remove_file(cwd.join("data/SYMB.meta.json")).expect("drop SYMB's sidecar");
+    let out = std::process::Command::new(env!("CARGO_BIN_EXE_aura"))
+        .args(["data", "info", "SYMB"])
+        .current_dir(&cwd)
+        .output()
+        .expect("spawn aura data info");
+    assert_eq!(
+        out.status.code(),
+        Some(0),
+        "exit: {:?}, stderr: {}",
+        out.status,
+        String::from_utf8_lossy(&out.stderr)
+    );
+    assert_eq!(String::from_utf8(out.stdout).expect("utf-8 stdout"), "{\"symbol\":\"SYMB\"}\n");
+}
+
+/// Property (#273): `aura data info <SYMBOL>` on a symbol carrying a usable
+/// geometry sidecar surfaces exactly the six neutral geometry fields
+/// (`digits`, `pipSize`, `tickSize`, `lotSize`, `baseAsset`, `quoteAsset`)
+/// alongside `symbol` — and NOTHING provider-specific (`description`,
+/// `generator`, `schemaVersion`) leaks through, even though the sidecar
+/// itself carries those fields: `InstrumentGeometry`'s reader never parses
+/// them out of the sidecar JSON in the first place (#273 acceptance).
+#[test]
+fn data_info_on_a_symbol_with_a_sidecar_carries_the_six_geometry_fields() {
+    let (cwd, _g) = fresh_project_with_data();
+    std::fs::write(
+        cwd.join("data/SYMA.meta.json"),
+        r#"{"schemaVersion":2,"generator":"MS_SimpleExport (cTrader.Automate)","description":"Euro vs US Dollar","digits":5,"pipSize":0.0001,"tickSize":1e-05,"lotSize":100000,"baseAsset":"EUR","quoteAsset":"USD"}"#,
+    )
+    .expect("overwrite SYMA's sidecar with the EURUSD-shaped fixture");
+    let out = std::process::Command::new(env!("CARGO_BIN_EXE_aura"))
+        .args(["data", "info", "SYMA"])
+        .current_dir(&cwd)
+        .output()
+        .expect("spawn aura data info");
+    assert_eq!(
+        out.status.code(),
+        Some(0),
+        "exit: {:?}, stderr: {}",
+        out.status,
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let stdout = String::from_utf8(out.stdout).expect("utf-8 stdout");
+    let obj: serde_json::Value = serde_json::from_str(stdout.trim()).expect("one JSON object");
+    let map = obj.as_object().expect("a flat object");
+    let mut keys: Vec<&str> = map.keys().map(String::as_str).collect();
+    keys.sort_unstable();
+    assert_eq!(
+        keys,
+        vec!["baseAsset", "digits", "lotSize", "pipSize", "quoteAsset", "symbol", "tickSize"],
+        "exactly symbol + the six geometry fields, no provider metadata: {stdout}"
+    );
+    assert_eq!(map["symbol"], "SYMA");
+    assert_eq!(map["digits"], 5);
+    assert_eq!(map["baseAsset"], "EUR");
+    assert_eq!(map["quoteAsset"], "USD");
+}
+
+/// Property (#273): a symbol carrying a usable geometry sidecar but NO
+/// archive bar files is still KNOWN to `aura data info` — the `symbol_meta`
+/// arm of the known-check's OR, independent of `has_symbol` — and its
+/// geometry reports normally, exit 0. This is the real-world case of a
+/// sidecar exported ahead of the bars themselves being ingested.
+#[test]
+fn data_info_on_a_sidecar_only_symbol_reports_geometry() {
+    let (cwd, _g) = fresh_project_with_data();
+    std::fs::write(
+        cwd.join("data/METAONLY.meta.json"),
+        r#"{"schemaVersion":2,"generator":"MS_SimpleExport (cTrader.Automate)","description":"Euro vs US Dollar","digits":5,"pipSize":0.0001,"tickSize":1e-05,"lotSize":100000,"baseAsset":"EUR","quoteAsset":"USD"}"#,
+    )
+    .expect("write METAONLY's sidecar-only fixture (no archive bar files)");
+    let out = std::process::Command::new(env!("CARGO_BIN_EXE_aura"))
+        .args(["data", "info", "METAONLY"])
+        .current_dir(&cwd)
+        .output()
+        .expect("spawn aura data info");
+    assert_eq!(
+        out.status.code(),
+        Some(0),
+        "exit: {:?}, stderr: {}",
+        out.status,
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let stdout = String::from_utf8(out.stdout).expect("utf-8 stdout");
+    let obj: serde_json::Value = serde_json::from_str(stdout.trim()).expect("one JSON object");
+    let map = obj.as_object().expect("a flat object");
+    let mut keys: Vec<&str> = map.keys().map(String::as_str).collect();
+    keys.sort_unstable();
+    assert_eq!(
+        keys,
+        vec!["baseAsset", "digits", "lotSize", "pipSize", "quoteAsset", "symbol", "tickSize"],
+        "exactly symbol + the six geometry fields, no provider metadata: {stdout}"
+    );
+    assert_eq!(map["symbol"], "METAONLY");
+}
+
+/// Property (#273): a symbol with neither archive bar files nor a geometry
+/// sidecar is unknown to `aura data info` — refuses on stderr, exit 1, no
+/// panic, no bare Debug struct.
+#[test]
+fn data_info_on_an_unknown_symbol_refuses() {
+    let (cwd, _g) = fresh_project_with_data();
+    let out = std::process::Command::new(env!("CARGO_BIN_EXE_aura"))
+        .args(["data", "info", "GHOST"])
+        .current_dir(&cwd)
+        .output()
+        .expect("spawn aura data info");
+    assert_eq!(out.status.code(), Some(1), "stdout: {}", String::from_utf8_lossy(&out.stdout));
+    let stderr = String::from_utf8(out.stderr).expect("utf-8 stderr");
+    assert!(stderr.contains("no recorded data for symbol"), "{stderr}");
+    assert!(stderr.contains("GHOST"), "names the unknown symbol: {stderr}");
 }
 
 /// Property (#300): `aura campaign show <CID>` prints the registered

crates/aura-cli/tests/graph_construct.rs

@@ -88,6 +88,43 @@ const SIGNAL_DOC_NAME_RESTATED: &str = r#"[
     {"op":"expose","from":"bias.bias","as":"bias"}
 ]"#;
 
+/// SIGNAL_DOC with a leading `{"op":"name",...}` (#331) — authors a render
+/// name distinct from the CLI's own default seed ("graph"), otherwise
+/// structurally identical to SIGNAL_DOC.
+const SIGNAL_DOC_NAMED: &str = r#"[
+    {"op":"name","name":"ny_momentum"},
+    {"op":"source","role":"price","kind":"F64"},
+    {"op":"add","type":"SMA","name":"fast","bind":{"length":{"I64":2}}},
+    {"op":"add","type":"SMA","name":"slow","bind":{"length":{"I64":4}}},
+    {"op":"add","type":"Sub"},
+    {"op":"add","type":"Bias"},
+    {"op":"feed","role":"price","into":["fast.series","slow.series"]},
+    {"op":"connect","from":"fast.value","to":"sub.lhs"},
+    {"op":"connect","from":"slow.value","to":"sub.rhs"},
+    {"op":"connect","from":"sub.value","to":"bias.signal"},
+    {"op":"expose","from":"bias.bias","as":"bias"}
+]"#;
+
+/// SIGNAL_DOC_NAME_RESTATED with an authored name (#331 spec test 7) instead
+/// of the CLI's default seed: the `doc` op's text restates the *authored*
+/// name ("ny_momentum") rather than the literal "graph" — the same
+/// RestatesName arm of the C29 shape gate must fire against whichever name
+/// the composite actually carries, not a hardcoded "graph" comparison.
+const SIGNAL_DOC_NAMED_NAME_RESTATED: &str = r#"[
+    {"op":"name","name":"ny_momentum"},
+    {"op":"doc","text":"Ny Momentum"},
+    {"op":"source","role":"price","kind":"F64"},
+    {"op":"add","type":"SMA","name":"fast","bind":{"length":{"I64":2}}},
+    {"op":"add","type":"SMA","name":"slow","bind":{"length":{"I64":4}}},
+    {"op":"add","type":"Sub"},
+    {"op":"add","type":"Bias"},
+    {"op":"feed","role":"price","into":["fast.series","slow.series"]},
+    {"op":"connect","from":"fast.value","to":"sub.lhs"},
+    {"op":"connect","from":"slow.value","to":"sub.rhs"},
+    {"op":"connect","from":"sub.value","to":"bias.signal"},
+    {"op":"expose","from":"bias.bias","as":"bias"}
+]"#;
+
 /// Every op below applies cleanly (all eager checks pass), but `sub.rhs` is
 /// never wired — a 0-cover input slot only the holistic finalize gate can
 /// reject. The smallest document that is op-valid yet whole-document-invalid.
@@ -929,6 +966,120 @@ fn graph_register_refuses_an_op_script_doc_that_restates_the_composite_name() {
     assert!(err.contains("C29"), "stderr cites the contract: {err}");
 }
 
+/// (#331 spec test 7) The C29 restates-name gate checks against the
+/// *authored* name, not a hardcoded default: a `doc` op restating the name
+/// set by a `name` op ("ny_momentum") refuses at register exactly like the
+/// default-name case above (`graph_register_refuses_an_op_script_doc_that_
+/// restates_the_composite_name`, which must stay green byte-identical).
+#[test]
+fn graph_register_refuses_a_doc_that_restates_an_authored_name() {
+    let dir = temp_cwd("register-op-script-restated-authored-name-doc");
+    let restated_script = dir.join("restated-authored-name-doc-script.json");
+    std::fs::write(&restated_script, SIGNAL_DOC_NAMED_NAME_RESTATED)
+        .expect("write op-script fixture");
+    let (out, err, code) = run_in(&dir, &["graph", "register", restated_script.to_str().unwrap()]);
+    assert_eq!(code, Some(1), "authored-name-restating doc refuses: {out} {err}");
+    assert!(err.contains("merely restates"), "stderr names the rule: {err}");
+    assert!(err.contains("C29"), "stderr cites the contract: {err}");
+}
+
+/// (#331 spec test 6) `graph build` on an ops doc with a `name` op emits
+/// blueprint JSON carrying the authored name, not the CLI's own seeded
+/// default (`"graph"`, `replay("graph", ...)` in `composite_from_str`).
+#[test]
+fn graph_build_emits_the_authored_name_from_a_name_op() {
+    let (stdout, stderr, ok) = run(&["graph", "build"], SIGNAL_DOC_NAMED);
+    assert!(ok, "build succeeds: {stderr}");
+    assert!(stdout.contains("\"name\":\"ny_momentum\""), "authored name carries into the blueprint: {stdout}");
+    assert!(!stdout.contains("\"name\":\"graph\""), "the default seed name must not leak in: {stdout}");
+}
+
+/// (#331 spec test 8) Refusal prose for a duplicate `name` op and a
+/// shape-violating name is op-indexed (`op N (name): ...`) — the same
+/// by-identifier labeling every other op fault gets.
+#[test]
+fn graph_build_name_op_refusals_are_op_indexed() {
+    let twice_named = r#"[
+        {"op":"source","role":"price","kind":"F64"},
+        {"op":"add","type":"SMA","name":"fast","bind":{"length":{"I64":2}}},
+        {"op":"name","name":"a"},
+        {"op":"name","name":"b"},
+        {"op":"feed","role":"price","into":["fast.series"]},
+        {"op":"expose","from":"fast.value","as":"out"}
+    ]"#;
+    let (_out, stderr, ok) = run(&["graph", "build"], twice_named);
+    assert!(!ok, "a second name op refuses");
+    assert!(stderr.contains("op 3 (name):"), "op-indexed at the second name op: {stderr}");
+
+    let slash_named = r#"[{"op":"name","name":"a/b"}]"#;
+    let (_out2, stderr2, ok2) = run(&["graph", "build"], slash_named);
+    assert!(!ok2, "a shape-violating name refuses");
+    assert!(stderr2.contains("op 0 (name):"), "op-indexed at the offending op: {stderr2}");
+}
+
+/// (#331 spec test 9, at the binary seam — mirrors
+/// `graph_introspect_identity_id_bridges_renamed_op_scripts`'s pattern for
+/// the debug-name field): a named and an unnamed build of the SAME
+/// structural script share the identity id (the name is stripped as a
+/// debug symbol before identity hashing, C23) and differ in the content id
+/// (the name is part of the serialized bytes).
+#[test]
+fn graph_named_and_unnamed_twins_share_identity_id_and_differ_content_id() {
+    let (ia, _e, ok) = run(&["graph", "introspect", "--identity-id"], SIGNAL_DOC);
+    assert!(ok, "exit success");
+    let (ib, _e2, ok2) = run(&["graph", "introspect", "--identity-id"], SIGNAL_DOC_NAMED);
+    assert!(ok2, "exit success");
+    assert_eq!(ia.trim(), ib.trim(), "the name is stripped before identity hashing (C23)");
+
+    let (ca, _e3, ok3) = run(&["graph", "introspect", "--content-id"], SIGNAL_DOC);
+    let (cb, _e4, ok4) = run(&["graph", "introspect", "--content-id"], SIGNAL_DOC_NAMED);
+    assert!(ok3 && ok4, "exit success");
+    assert_ne!(ca.trim(), cb.trim(), "the name is part of the serialized bytes -> different content id");
+}
+
+/// (#331 spec test 10, the skeptic's bypass route): the op intake
+/// (`GraphSession::set_name`) is not the name's only data-borne birth
+/// route — a hand-edited blueprint ENVELOPE (not an op-script) can carry a
+/// shape-violating root name directly. `aura graph register` on such a file
+/// is refused naming the offending name (exit 1, the refusal convention
+/// every sibling test in this module asserts), not silently stored under a
+/// name that would write `traces/../x/` at run time. Shipped envelope
+/// fixtures with plain root names (`doc_blueprint.json`'s "sig",
+/// `nested_doc_blueprint.json`'s "root", every op-script's default "graph")
+/// stay accepted — the surrounding suite is that regression gate.
+///
+/// Spec test 10 also names `build` as a gated envelope-intake route
+/// alongside `register`. The `graph build` SUBCOMMAND takes only a stdin
+/// op-script (`Vec<OpDoc>`, never a JSON object) — it cannot ingest this
+/// envelope fixture at all (a shape mismatch fires before any name is ever
+/// read). The file-consuming envelope-intake sibling `build` route is
+/// `graph introspect --content-id <FILE>` (its own doc comment: "one
+/// build, then each requested id…") — the other call site this iteration
+/// moved onto the same `composite_from_authored_text` choke point as
+/// `register`, so it is the leg exercised here, sharing the identical
+/// `name_gate_fault_prose` text.
+#[test]
+fn graph_build_and_register_refuse_a_hand_crafted_envelope_with_a_bad_root_name() {
+    let dir = temp_cwd("register-bad-root-name");
+    let (envelope_bytes, _e, built) = run(&["graph", "build"], SIGNAL_DOC_DESCRIBED);
+    assert!(built, "graph build produces the envelope");
+    let bad = envelope_bytes.replacen("\"name\":\"graph\"", "\"name\":\"../x\"", 1);
+    assert!(bad.contains("\"name\":\"../x\""), "the root-name replace landed: {bad}");
+    let file = dir.join("bad-root-name.json");
+    std::fs::write(&file, &bad).expect("write envelope fixture");
+
+    let (out, err, code) = run_in(&dir, &["graph", "register", file.to_str().unwrap()]);
+    assert_eq!(code, Some(1), "a shape-violating root name refuses (not a panic): {out} {err}");
+    assert!(err.contains("../x"), "names the offending root name: {err}");
+
+    // The other file-consuming envelope intake (same fixture, same choke
+    // point) refuses identically.
+    let (out2, err2, code2) =
+        run_in(&dir, &["graph", "introspect", "--content-id", file.to_str().unwrap()]);
+    assert_eq!(code2, Some(1), "the sibling envelope intake refuses too: {out2} {err2}");
+    assert_eq!(err2, err, "both file-consuming envelope intakes share the identical fault prose");
+}
+
 /// Property (#202, the same on-ramp seam at the sibling verb): `aura graph
 /// introspect --params` accepts an op-script exactly as it accepts a blueprint
 /// envelope — the raw axis namespace it prints for the op-script equals the one it
@@ -954,6 +1105,35 @@ fn graph_params_accepts_an_op_script_matching_its_envelope() {
     assert_eq!(op_out, env_out, "op-script and envelope agree on the raw axis namespace");
 }
 
+/// (#331 review finding, the C29 exemption's ratifying pin): the root-name
+/// shape gate lives at the CLI's file-consuming envelope intakes (`register`,
+/// `introspect --content-id <FILE>`) — never at STORE read-back. A blueprint
+/// with a shape-violating root name registered DIRECTLY through the
+/// `aura-registry` store API (bypassing the CLI's gate entirely, the way a
+/// pre-#331 artifact would already sit in a project's store) must still be
+/// introspectable: `introspect --params <ID>` reads the store, not a file, so
+/// it must never re-punish an artifact the store already accepted — C29,
+/// "registered artifacts are never retroactively invalidated".
+#[test]
+fn graph_introspect_params_accepts_a_pre_331_store_artifact_with_a_bad_root_name() {
+    let dir = temp_cwd("introspect-store-readback-bad-root-name");
+    let (envelope_bytes, _e, built) = run(&["graph", "build"], SIGNAL_DOC_DESCRIBED);
+    assert!(built, "graph build produces the envelope");
+    let bad = envelope_bytes.replacen("\"name\":\"graph\"", "\"name\":\"../x\"", 1);
+    assert!(bad.contains("\"name\":\"../x\""), "the root-name replace landed: {bad}");
+
+    // Bypass the CLI's gate entirely: the registry's own store API is the
+    // simulated pre-#331 write path.
+    let id = aura_research::content_id_of(&bad);
+    let registry = aura_registry::Registry::open(dir.join("runs/runs.jsonl"));
+    registry
+        .put_blueprint(&id, &bad)
+        .expect("the registry's own store API has no root-name gate to bypass");
+
+    let (out, err, code) = run_in(&dir, &["graph", "introspect", "--params", &id]);
+    assert_eq!(code, Some(0), "store read-back stays ungated (C29): {out} {err}");
+}
+
 /// Property (#226, the render positional closes the #202 on-ramp family):
 /// `aura graph <op-script.json>` (the render positional) accepts an op-script
 /// document (a JSON array) exactly as it accepts a #155 blueprint envelope (a

crates/aura-cli/tests/help_self_description.rs

@@ -58,7 +58,8 @@ fn sugar_verbs_name_their_document_shape() {
 
 /// #323: `graph build --help` carries the op-list reference — the op kinds
 /// and fields are learnable from the binary, not only from serde refusals.
-/// #317: the `use` op joins the roster (nine -> ten).
+/// #317: the `use` op joins the roster (nine -> ten). #331: the `name` op
+/// joins the roster (ten -> eleven).
 #[test]
 fn graph_build_help_carries_the_op_reference() {
     let (out, err, ok) = run(&["graph", "build", "--help"]);
@@ -74,6 +75,7 @@ fn graph_build_help_carries_the_op_reference() {
         r#"{"op":"gang""#,
         r#"{"op":"doc""#,
         r#"{"op":"use""#,
+        r#"{"op":"name""#,
     ] {
         assert!(out.contains(op), "op reference carries {op}: {out}");
     }

crates/aura-cli/tests/run_measurement.rs

@@ -81,3 +81,60 @@ fn measurement_run_honours_the_tap_selector() {
     let expected = (1.0097_f64 + 1.0092) / 2.0;
     assert!((got - expected).abs() < 1e-9, "last row: got {got}, expected {expected}");
 }
+
+/// #331 delta re-review, the third authored-file intake route: `dispatch_run`
+/// loads a FRESH FILE via `blueprint_from_json` and, on this measurement arm,
+/// feeds `signal.name()` straight into `bind_tap_plan` -> `TraceStore::begin_run`
+/// (`trace_store.rs` joins the name unsanitized) — a hand-crafted envelope with
+/// `"name":"../x"` used to reach `--tap fast_tap=record` and escape
+/// `runs/traces/<name>/` for `runs/x/` (one level up, since `traces/../x`
+/// normalizes there) instead of refusing at the same root-name choke point
+/// `register`/`introspect --content-id <FILE>` already gate through. This pins
+/// the closed route: exit nonzero (dispatch_run's own bad-input-file
+/// convention, exit 2), the shared `name_gate_fault_prose` wording, and — the
+/// property that actually matters — the escaped directory is never created.
+#[test]
+fn run_refuses_a_hand_crafted_envelope_with_a_bad_root_name_before_any_trace_write() {
+    let cwd = temp_cwd("bad-root-name");
+    let mut v: serde_json::Value =
+        serde_json::from_str(&measurement_blueprint_json()).expect("parse measurement blueprint");
+    v["blueprint"]["name"] = serde_json::json!("../x");
+    let bad = serde_json::to_string(&v).expect("re-serialize with a shape-violating root name");
+    let bp_path = cwd.join("bad-root-name.json");
+    std::fs::write(&bp_path, &bad).expect("write bad-root-name blueprint");
+
+    let out = Command::new(BIN)
+        .args(["run", bp_path.to_str().expect("utf-8 path"), "--tap", "fast_tap=record"])
+        .current_dir(&cwd)
+        .output()
+        .expect("spawn aura run");
+    assert_eq!(
+        out.status.code(),
+        Some(2),
+        "a shape-violating root name refuses at dispatch_run's own bad-file exit code: {:?} stderr={}",
+        out.status,
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    assert!(
+        stderr.contains(r#"blueprint name "../x" is invalid"#),
+        "the shared name_gate_fault_prose wording names the offending root name: {stderr}"
+    );
+    assert!(
+        out.stdout.is_empty(),
+        "a refused run must not print a report: {:?}",
+        String::from_utf8_lossy(&out.stdout)
+    );
+
+    // The property that actually matters: the escaped write target (one level
+    // up from `traces/`, since `trace_store.rs` joins the name unsanitized)
+    // was never created — the gate fires before `begin_run` ever touches disk.
+    assert!(
+        !cwd.join("runs/x").exists(),
+        "the escaped trace directory must never be created"
+    );
+    assert!(
+        !cwd.join("runs/traces").exists(),
+        "no trace directory of any shape is written on a refused run"
+    );
+}

crates/aura-engine/src/blueprint.rs

@@ -195,6 +195,38 @@ pub struct GangMember {
     pub name: String,
 }
 
+/// Deterministic shape gate for authored composite render names (#331) —
+/// shape only, never content judgement (C29 discipline): non-empty, no path
+/// separator (`/` or `\`), and not the special segments `.` or `..`. The rule
+/// exists because the name keys a trace directory on disk unsanitized
+/// (`traces/<name>/`, `crates/aura-registry/src/trace_store.rs`). Applied at
+/// both data-borne birth routes for a name (the skeptic's two-seam finding):
+/// the `Op::Name` op intake (`construction.rs`) and the CLI's
+/// blueprint-envelope root-name intake — never at store read-back (C29:
+/// registered artifacts are never retroactively invalidated), and never on
+/// the Rust builder API (`GraphBuilder::new`, role-2 native authoring).
+pub fn name_gate(name: &str) -> Result<(), NameGateFault> {
+    if name.is_empty() {
+        return Err(NameGateFault::Empty);
+    }
+    if name.contains('/') || name.contains('\\') {
+        return Err(NameGateFault::ContainsSeparator);
+    }
+    if name == "." || name == ".." {
+        return Err(NameGateFault::DotSegment);
+    }
+    Ok(())
+}
+
+/// The [`name_gate`] shape violation — WHY the name was refused; the caller
+/// already holds the offending name (WHAT) to build a message from.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum NameGateFault {
+    Empty,
+    ContainsSeparator,
+    DotSegment,
+}
+
 /// A reusable sub-graph fragment compiled away by inlining (C9/C23). It is **not**
 /// a [`Node`]: it is never `eval`'d. It holds interior items (local indices),
 /// interior edges (local indices), input roles (role `r` fans into the interior
@@ -1519,6 +1551,19 @@ mod tests {
     use aura_strategy::Bias;
     use std::sync::mpsc;
 
+    /// `name_gate` (#331) unit table: an ordinary name passes; an empty
+    /// name, one containing either path separator, and the two dot segments
+    /// each fault with their own fault variant.
+    #[test]
+    fn name_gate_accepts_ordinary_names_and_refuses_shape_violations() {
+        assert_eq!(name_gate("ny_momentum"), Ok(()));
+        assert_eq!(name_gate(""), Err(NameGateFault::Empty));
+        assert_eq!(name_gate("a/b"), Err(NameGateFault::ContainsSeparator));
+        assert_eq!(name_gate("a\\b"), Err(NameGateFault::ContainsSeparator));
+        assert_eq!(name_gate("."), Err(NameGateFault::DotSegment));
+        assert_eq!(name_gate(".."), Err(NameGateFault::DotSegment));
+    }
+
     /// One knob fanning into two sibling open params passes the gate; the
     /// value carries the gang table.
     #[test]

crates/aura-engine/src/construction.rs

@@ -16,8 +16,8 @@ use std::collections::{HashMap, HashSet};
 use aura_core::{ArgOpError, BindOpError, NodeSchema, PrimitiveBuilder, Scalar, ScalarKind};
 
 use crate::blueprint::{
-    check_param_namespace_injective, edge_kind_check, validate_wiring, BlueprintNode, Composite,
-    Gang, GangMember, OutField, Role, Tap, TapWire,
+    check_param_namespace_injective, edge_kind_check, name_gate, validate_wiring, BlueprintNode,
+    Composite, Gang, GangMember, NameGateFault, OutField, Role, Tap, TapWire,
 };
 use crate::builder::{resolve_input_slot, resolve_output_field, PortResolveError};
 use crate::harness::{Edge, Target};
@@ -64,6 +64,8 @@ pub enum Op {
     /// `bind` is applied path-qualified (e.g. `"sma.length"`), after the
     /// splice.
     Use { ref_id: String, name: Option<String>, bind: Vec<(String, Scalar)> },
+    /// Set the composite's render name (#331). At most once per script.
+    Name { name: String },
 }
 
 /// A per-op construction fault, by-identifier so the cause names the op.
@@ -124,6 +126,13 @@ pub enum OpError {
     /// resolves and fetches before replay, refusing there on a miss), but
     /// total: a bare `replay`/`GraphSession` caller can still hit it.
     UnknownSubgraph { ref_id: String },
+    /// A second `name` op — the render name is declared at most once (mirrors
+    /// `DuplicateDoc`).
+    DuplicateName,
+    /// A `name` op's `name` (or, at the CLI's blueprint-envelope intake, an
+    /// envelope's root name) failed the deterministic `name_gate` shape check
+    /// (#331). Carries the offending name and the shape fault detail.
+    BadName { name: String, fault: NameGateFault },
 }
 
 /// A per-op-fallible blueprint accumulator. Holds the same interior data a
@@ -153,6 +162,11 @@ pub struct GraphSession<'v> {
     coverage: HashMap<(usize, usize), usize>,
     gangs: Vec<Gang>,
     doc: Option<String>,
+    /// At-most-once guard for `Op::Name` (#331), mirroring `doc`'s own
+    /// uniqueness posture but tracked separately (`name` itself is always
+    /// populated, seeded from `::new`'s `name` argument, so it cannot double
+    /// as its own "was it authored" flag).
+    name_authored: bool,
 }
 
 impl<'v> GraphSession<'v> {
@@ -182,6 +196,7 @@ impl<'v> GraphSession<'v> {
             coverage: HashMap::new(),
             gangs: Vec::new(),
             doc: None,
+            name_authored: false,
         }
     }
 
@@ -205,9 +220,29 @@ impl<'v> GraphSession<'v> {
                 Ok(())
             }
             Op::Use { ref_id, name, bind } => self.use_subgraph(ref_id, name, bind),
+            Op::Name { name } => self.set_name(name),
         }
     }
 
+    /// `Op::Name` (#331): set the composite's render name — the op-script's
+    /// data-borne twin of `replay`'s seeded default name. Guarded by (a)
+    /// at-most-once (mirrors the `doc` op's uniqueness guard just above) and
+    /// (b) the shared deterministic shape gate (`name_gate`) — the SAME gate
+    /// the CLI's blueprint-envelope intake applies to a hand-edited
+    /// envelope's root name (the other data-borne birth route, skeptic
+    /// finding minuted on #331).
+    fn set_name(&mut self, name: String) -> Result<(), OpError> {
+        if self.name_authored {
+            return Err(OpError::DuplicateName);
+        }
+        if let Err(fault) = name_gate(&name) {
+            return Err(OpError::BadName { name, fault });
+        }
+        self.name = name;
+        self.name_authored = true;
+        Ok(())
+    }
+
     /// `Op::Use` (#317): fetch a registered blueprint through the injected
     /// `subgraph` resolver, rename it to the instance identifier, apply its
     /// path-qualified `bind` entries, and push it as an ordinary
@@ -1002,6 +1037,72 @@ mod tests {
         );
     }
 
+    // ---- Op::Name (#331) -----------------------------------------------
+
+    /// A `name` op sets the finished composite's render name — the property
+    /// the whole op exists for.
+    #[test]
+    fn name_op_sets_the_finished_composite_name() {
+        let mut s = scaffold();
+        s.apply(Op::Name { name: "x".into() }).unwrap();
+        s.apply(Op::Feed { role: "price".into(), into: vec!["fast.series".into(), "slow.series".into()] })
+            .unwrap();
+        s.apply(Op::Connect { from: "fast.value".into(), to: "sub.lhs".into() }).unwrap();
+        s.apply(Op::Connect { from: "slow.value".into(), to: "sub.rhs".into() }).unwrap();
+        s.apply(Op::Expose { from: "sub.value".into(), as_name: "out".into() }).unwrap();
+        let c = s.finish().expect("finishes");
+        assert_eq!(c.name(), "x");
+    }
+
+    /// Byte-compat (#331 AC1): a script that never authors a `name` op keeps
+    /// the seed name `replay`/`GraphSession::new` was given — the CLI's own
+    /// seed stays `"graph"`, unchanged by this op's addition.
+    #[test]
+    fn no_name_op_keeps_the_seeded_replay_name() {
+        let ops = vec![
+            Op::Source { role: "price".into(), kind: ScalarKind::F64 },
+            Op::Add { type_id: "SMA".into(), as_name: Some("a".into()), args: vec![], bind: vec![] },
+            Op::Feed { role: "price".into(), into: vec!["a.series".into()] },
+            Op::Expose { from: "a.value".into(), as_name: "out".into() },
+        ];
+        let c = super::replay("graph", ops, &std_vocabulary, &|_: &str| None).expect("replays");
+        assert_eq!(c.name(), "graph");
+    }
+
+    /// A second `name` op is a fault, not a silent last-wins overwrite —
+    /// mirrors the `doc` op's own at-most-once guard.
+    #[test]
+    fn duplicate_name_op_is_refused() {
+        let mut s = session("g");
+        s.apply(Op::Name { name: "x".into() }).unwrap();
+        assert_eq!(
+            s.apply(Op::Name { name: "y".into() }),
+            Err(OpError::DuplicateName)
+        );
+    }
+
+    /// Shape violations (#331): empty, containing a path separator, and the
+    /// dot segments all fault at the op via the shared `name_gate`.
+    #[test]
+    fn name_op_shape_violations_are_refused() {
+        use crate::blueprint::NameGateFault;
+        let mut s = session("g");
+        assert_eq!(
+            s.apply(Op::Name { name: "".into() }),
+            Err(OpError::BadName { name: "".into(), fault: NameGateFault::Empty })
+        );
+        let mut s = session("g");
+        assert_eq!(
+            s.apply(Op::Name { name: "a/b".into() }),
+            Err(OpError::BadName { name: "a/b".into(), fault: NameGateFault::ContainsSeparator })
+        );
+        let mut s = session("g");
+        assert_eq!(
+            s.apply(Op::Name { name: "..".into() }),
+            Err(OpError::BadName { name: "..".into(), fault: NameGateFault::DotSegment })
+        );
+    }
+
     #[test]
     fn finish_reports_incomplete_on_unwired_slot() {
         // a fully-named scaffold missing the sub.rhs connection -> holistic 0-arm
@@ -1501,6 +1602,30 @@ mod tests {
         );
     }
 
+    /// #331 ratifying pin (spec test 5): `use_subgraph`'s instance-identifier
+    /// default (`name: None` -> the fetched composite's own `name()`,
+    /// `construction.rs:221-230` — code-inspected, previously untested since
+    /// every other test in this section passes an explicit instance name)
+    /// actually reaches the session's identifier namespace: `use_fixture()`'s
+    /// own name is "fixture", so with no instance name the spliced ports
+    /// resolve under "fixture.*", not some other placeholder.
+    #[test]
+    fn use_op_with_no_name_defaults_instance_identifier_to_the_fetched_composites_name() {
+        let subgraph = |_: &str| Some(use_fixture());
+        let mut s = GraphSession::new("g", &std_vocabulary, &subgraph);
+        s.apply(Op::Source { role: "price".into(), kind: ScalarKind::F64 }).unwrap();
+        assert_eq!(
+            s.apply(Op::Use { ref_id: "fixture-id".into(), name: None, bind: vec![] }),
+            Ok(())
+        );
+        s.apply(Op::Feed { role: "price".into(), into: vec!["fixture.price".into()] }).unwrap();
+        assert_eq!(
+            s.apply(Op::Expose { from: "fixture.out".into(), as_name: "bias".into() }),
+            Ok(()),
+            "the spliced instance resolves under \"fixture\" — the fetched composite's own name"
+        );
+    }
+
     /// A post-splice `bind` path with no matching open param anywhere in the
     /// instance faults through the existing bind-fault shape (`BadParam`),
     /// naming the instance and the qualified within-instance path (#317).

crates/aura-engine/src/lib.rs

@@ -52,8 +52,9 @@ mod sweep;
 mod walkforward;
 
 pub use blueprint::{
-    BindError, Binder, BlueprintNode, BoundSpec, CompileError, Composite, Gang, GangFault,
-    GangMember, OutField, RandomBinder, ReopenError, Role, SweepBinder, Tap, TapWire,
+    name_gate, BindError, Binder, BlueprintNode, BoundSpec, CompileError, Composite, Gang,
+    GangFault, GangMember, NameGateFault, OutField, RandomBinder, ReopenError, Role, SweepBinder,
+    Tap, TapWire,
 };
 pub use blueprint_serde::{
     blueprint_from_json, blueprint_identity_json, blueprint_to_json, ArgData, BlueprintDoc,

crates/aura-runner/src/coverage.rs

@@ -1,8 +1,8 @@
-//! Coverage reporting: the single interior-gap-month walk, shared by a
-//! campaign cell's coverage annotation
-//! (`DefaultMemberRunner::window_coverage`) and `aura data coverage`'s
-//! archive-wide report — two independent walk implementations before this
-//! module existed (#295 dedup).
+//! The interior-gap-month walk behind a campaign cell's coverage annotation
+//! (`DefaultMemberRunner::window_coverage`) — originally shared with `aura
+//! data coverage`'s archive-wide report (#295 dedup: two independent walk
+//! implementations before this module existed) before that verb retired in
+//! favor of per-cell fault isolation (#272, #273).
 
 /// `"YYYY-MM"` rendering of a `(year, month)` pair.
 pub fn fmt_year_month((y, m): (u16, u8)) -> String {
@@ -18,11 +18,11 @@ pub fn next_year_month((y, m): (u16, u8)) -> (u16, u8) {
 /// fall inside `window_ms` (Unix-ms) — one `"YYYY-MM"` entry per missing
 /// month, never a collapsed range: the registry's `CellCoverage::gap_months`
 /// is a flat list an aggregate counts directly. `months` is assumed sorted
-/// ([`aura_ingest::list_m1_months`]'s own contract). The single gap-walk
-/// implementation (#295): both `DefaultMemberRunner::window_coverage`
-/// (a swept cell's own window) and [`data_coverage_report`] (the full
-/// archive span, via [`FULL_ARCHIVE_WINDOW_MS`]) call this one walk instead
-/// of maintaining independent copies.
+/// ([`aura_ingest::list_m1_months`]'s own contract). `DefaultMemberRunner::
+/// window_coverage` (a swept cell's own window) is the sole caller since
+/// `aura data coverage`'s archive-wide report retired (#273); the walk stays
+/// its own function because it was single-sourced with that verb before then
+/// (#295).
 pub fn interior_gap_months(months: &[(u16, u8)], window_ms: (i64, i64)) -> Vec<String> {
     let from_ym = data_server::records::unix_ms_to_year_month(window_ms.0);
     let to_ym = data_server::records::unix_ms_to_year_month(window_ms.1);
@@ -40,68 +40,6 @@ pub fn interior_gap_months(months: &[(u16, u8)], window_ms: (i64, i64)) -> Vec<S
     out
 }
 
-/// A Unix-ms window that decodes (via `unix_ms_to_year_month`) to year/month
-/// bounds — 0001-01 and 9999-01, exact epoch-ms for those UTC instants, not
-/// an approximation — comfortably outside any realistic archive month, so an
-/// unbounded, archive-wide [`interior_gap_months`] walk never ms-filters out
-/// a real gap. Safely inside `chrono`'s valid calendar range, so the
-/// conversion inside `interior_gap_months` never panics.
-pub const FULL_ARCHIVE_WINDOW_MS: (i64, i64) = (-62_135_596_800_000, 253_370_764_800_000);
-
-/// `aura data coverage <SYMBOL>`'s pure report body (#264): render `symbol`'s
-/// coverage report from its sorted `(year, month)` file list — one `span:`
-/// line framing the first/last present month, then either a `no gaps` line
-/// or one `missing: YYYY-MM..YYYY-MM` line per interior contiguous gap (a
-/// ten-month hole is one line, not ten). `Err` exactly when `months` is
-/// empty — no archive file exists for `symbol` at all (the caller's "unknown
-/// symbol" refusal, stderr + exit 1). The gap detection itself is
-/// [`interior_gap_months`] over the full archive span
-/// ([`FULL_ARCHIVE_WINDOW_MS`]); collapsing its flat per-month list into
-/// contiguous ranges is presentation-only regrouping, done here since it
-/// stays byte-identical to the pre-dedup report.
-pub fn data_coverage_report(symbol: &str, months: &[(u16, u8)]) -> Result<Vec<String>, String> {
-    let Some(&first) = months.first() else {
-        return Err(format!("no archive files found for symbol \"{symbol}\""));
-    };
-    let last = *months.last().expect("non-empty checked above");
-    let mut lines =
-        vec![format!("{symbol} span: {}..{}", fmt_year_month(first), fmt_year_month(last))];
-    let gap_months = interior_gap_months(months, FULL_ARCHIVE_WINDOW_MS);
-    if gap_months.is_empty() {
-        lines.push(format!("{symbol} no gaps"));
-    } else {
-        for (from, to) in collapse_contiguous_year_months(&gap_months) {
-            lines.push(format!("{symbol} missing: {from}..{to}"));
-        }
-    }
-    Ok(lines)
-}
-
-/// Collapse [`interior_gap_months`]' flat, ascending `"YYYY-MM"` list into
-/// contiguous inclusive `(from, to)` ranges — a ten-month hole collapses to
-/// one pair, not ten. Presentation-only regrouping: the gap WALK itself
-/// already ran in `interior_gap_months`.
-fn collapse_contiguous_year_months(months: &[String]) -> Vec<(String, String)> {
-    let mut out: Vec<(String, String)> = Vec::new();
-    for m in months {
-        let ym = parse_year_month(m);
-        match out.last_mut() {
-            Some((_, to)) if next_year_month(parse_year_month(to)) == ym => {
-                *to = m.clone();
-            }
-            _ => out.push((m.clone(), m.clone())),
-        }
-    }
-    out
-}
-
-/// Inverse of [`fmt_year_month`] — parses back the `"YYYY-MM"` shape
-/// [`interior_gap_months`] always emits.
-fn parse_year_month(s: &str) -> (u16, u8) {
-    let (y, m) = s.split_once('-').expect("interior_gap_months emits YYYY-MM");
-    (y.parse().expect("YYYY digits"), m.parse().expect("MM digits"))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -125,37 +63,4 @@ mod tests {
             "both interior gap months must be named, in order"
         );
     }
-
-    /// An unknown symbol (no archive files at all — an empty month list)
-    /// refuses rather than reporting a bogus empty-span coverage (#264): the
-    /// caller eprintln's the message and exits 1.
-    #[test]
-    fn data_coverage_report_refuses_an_unknown_symbol() {
-        let err = data_coverage_report("GHOST", &[]).unwrap_err();
-        assert!(err.contains("GHOST"), "names the unknown symbol: {err}");
-    }
-
-    /// A symbol with a fully contiguous file index reports its span plus an
-    /// explicit `no gaps` line — never a bare span with no gap-status line at
-    /// all, which would leave "no gaps" indistinguishable from "gaps not yet
-    /// checked" (#264).
-    #[test]
-    fn data_coverage_report_of_a_gapless_symbol_is_span_plus_no_gaps() {
-        let months = [(2024, 1), (2024, 2), (2024, 3)];
-        let lines = data_coverage_report("SYMA", &months).expect("known symbol");
-        assert_eq!(lines, vec!["SYMA span: 2024-01..2024-03", "SYMA no gaps"]);
-    }
-
-    /// The Copper failure shape itself: one interior gap collapses to a single
-    /// `missing: YYYY-MM..YYYY-MM` line naming the whole contiguous hole, not
-    /// one line per missing month (#264).
-    #[test]
-    fn data_coverage_report_collapses_an_interior_gap_to_one_range_line() {
-        let months = [(2024, 1), (2024, 2), (2024, 5), (2024, 6)];
-        let lines = data_coverage_report("GAPSYM", &months).expect("known symbol");
-        assert_eq!(
-            lines,
-            vec!["GAPSYM span: 2024-01..2024-06", "GAPSYM missing: 2024-03..2024-04"]
-        );
-    }
 }

docs/authoring-guide.md

@@ -227,10 +227,11 @@ $ aura graph build < smacross.json > blueprint.json
 Nodes are referenced by an **identifier** (given by `add`, see below); ports
 are dotted `<identifier>.<port>` on both sides of a wire.
 
-### The ten ops
+### The eleven ops
 
 | op | JSON shape | does |
 |---|---|---|
+| `name` | `{"op":"name","name":<str>}` | set the composite's **render name**, script-level and at-most-once (a second `name` op refuses: `a script names its blueprint at most once`). The name must be a single path segment (non-empty, no `/`, `\`, `.` or `..`) since it keys a trace directory (`traces/<name>/`) at run time. Omitting the op keeps the CLI's own default, `"graph"`. |
 | `doc` | `{"op":"doc","text":<str>}` | declare the composite's one-line meaning (C29) — the op-script twin of the Rust builder's `.doc(...)`. Required before `aura graph register` accepts the product (the store refuses a doc-less composite); at most one per script (a second refuses: `a doc op may appear at most once`). The text is gated: empty or merely restating the composite's name refuses at register. |
 | `source` | `{"op":"source","role":<str>,"kind":<ScalarKind>}` | reserve a bound root **source** role of `kind` — a real input the harness feeds (e.g. `"price"`). |
 | `input` | `{"op":"input","role":<str>}` | reserve an open root **input** role (kind inferred from the slots it feeds) — the formal parameter of an **open pattern**, a fragment meant to be wired by an *enclosing* graph. An open pattern builds and registers like any blueprint. Running it standalone is governed by the ordinary run gates: the harness binds input roles to archive columns **by name** (C26), so a pattern whose roles match the data runs as-is; what refuses, by name, is a role the harness cannot bind — or the run surface's other gates (a signal without a bias output or tap; free knobs). |
@@ -242,6 +243,14 @@ are dotted `<identifier>.<port>` on both sides of a wire.
 | `tap` | `{"op":"tap","from":<port>,"as":<str>}` | declare a **measurement tap** on an interior output field under the name `as` — the output-side twin of `expose` (a recorded observation point, not a boundary output; a `Composite.taps` entry, C27). A single `aura run` constructs a recorder at each declared tap and persists its per-cycle series as a `ColumnarTrace`; a sweep leaves it inert. Tap names are their own namespace and must be unique (a second `tap` under one name refuses: `duplicate tap name`). |
 | `gang` | `{"op":"gang","as":"channel_length","into":["channel_hi.length","channel_lo.length"]}` | Fuse two or more sibling params into ONE public knob: the member addresses leave the sweepable param space and `as` replaces them; the bound or swept value fans out to every member at bootstrap. Members must share one scalar kind and stay open (un-bound). |
 
+Omitting `name` is fine for a single strategy, but it has three live
+consequences once a project has more than one: every unnamed store document
+is indistinguishable by name (`"graph"` again), every unnamed strategy's
+default tap recording lands in the same shared `traces/graph/` directory
+(later runs overwrite earlier ones), and two `use`-splices of unnamed
+blueprints collide on the same default instance identifier (`graph`) inside
+the same composing script. A one-line `name` op dissolves all three at once.
+
 Value forms are the typed-tag representations used everywhere in this
 family of artifacts:
 

docs/design/contracts/c23-graph-compilation.md

@@ -9,7 +9,12 @@ entirely (there is no composite in the flat graph). The blueprint's field /
 input-role *names* are **non-load-bearing** — the wiring resolves by index, and names
 survive at most as **informative debug symbols** (exactly as `FieldSpec.name` already
 is, C8), kept for tracing / rendering (C9 graph-as-data) but carrying no run
-semantics. The flat graph is then the target of **behaviour-preserving optimisation**
+semantics. (Reconciling with the root composite's own render name, #331: that
+claim stands unweakened — the name never influences compilation, identity, or
+execution semantics — but at *run* time, outside compilation, it keys the trace
+directory (`traces/<name>/`); that operational role, not any load-bearing
+weight inside the flat graph, is exactly why the authored-blueprint intakes
+shape-gate it.) The flat graph is then the target of **behaviour-preserving optimisation**
 — any transform that leaves every observable sink trace bit-identical (C1 is the
 correctness invariant) — on two levels:
 

docs/design/contracts/c24-blueprint-data.md

@@ -196,8 +196,25 @@ rejected at construction.
 
 The op-script is a JSON **array of ops**, each object internally tagged by `"op"`,
 replayed in order; nodes are referenced **by identifier**, ports as dotted
-`<identifier>.<port>`. The ten verbs:
+`<identifier>.<port>`. The eleven verbs:
 
+- `name` — `{"op":"name","name":<str>}` — set the composite's render name
+  (#331), script-level and at-most-once (a second refuses); omitted, the
+  built composite keeps the CLI's own seed default (`"graph"`). Gated by a
+  shared shape check (non-empty, single path segment, no `/`, `\`, `.` or
+  `..`) applied at this op intake **plus every CLI intake that reads an
+  authored blueprint envelope from a file** — `register`, `introspect
+  --content-id <FILE>`, the bare graph-file viewer, `run`, `introspect
+  --params <FILE>`, `sweep --list-axes`, and each of
+  `sweep`/`walkforward`/`mc`/`generalize`'s file-reading entry points
+  (synthetic and `--real` alike) — one class of intake, one gate. The
+  refusal's core sentence (`name_gate_fault_prose`) is byte-uniform across
+  every one of these sites; only the leading context prefix varies —
+  `run` and the bare graph-file viewer prepend `aura: <path>:`, while
+  `register`, the sweep-axis family (`validate_and_register_axes`), and
+  `introspect` prepend bare `aura: `. Store read-back (`reproduce`, `use`
+  resolution, `introspect`/`--params` by content id) stays deliberately
+  ungated — C29: a registered artifact is never retroactively invalidated.
 - `source` — `{"op":"source","role":<str>,"kind":<ScalarKind>}` — declare a root
   source role producing a base column of `kind`.
 - `input` — `{"op":"input","role":<str>}` — declare a root input role (kind inferred

docs/glossary.md

@@ -37,7 +37,7 @@ The param-generic, input-role-generic graph-as-data produced by running a Rust b
 
 ### blueprint label
 **Avoid:** —
-A registry-level name pointing at a registered blueprint's content id (`graph register --name <label>`, #317) — a mutable, latest-wins pointer over the immutable content-addressed store, not a second identity: re-registering under an existing label *repoints* it (the earlier content id stays reachable by its own id, never invalidated). `graph introspect --registered` lists every label with its content-id prefix and root `doc` line — the discovery surface a `use (op)` reference by name resolves against.
+A registry-level name pointing at a registered blueprint's content id (`graph register --name <label>`, #317) — a mutable, latest-wins pointer over the immutable content-addressed store, not a second identity: re-registering under an existing label *repoints* it (the earlier content id stays reachable by its own id, never invalidated). `graph introspect --registered` lists every label with its content-id prefix and root `doc` line — the discovery surface a `use (op)` reference by name resolves against. Orthogonal to the composite's own **render name** (the `name` field carried in the blueprint bytes, op-settable via `{"op":"name",...}`, #331; defaults to `"graph"` if omitted): the render name keys the run's trace directory (`traces/<name>/`) and a `use`-splice's default instance identifier, while the label is an explicit, separately-set store pointer.
 
 ### bootstrap
 **Avoid:** —

fieldtests/cycle-331-blueprint-name/TRANSCRIPT.md

@@ -0,0 +1,184 @@
+# Fieldtest transcript — cycle #331 (blueprint name op)
+
+Source-blind consumer field test of the eleventh op-script op
+`{"op":"name","name":"<name>"}` — the composite render name that flows to store
+documents, `traces/<name>/`, and `use`-splice instance defaults, gated by a
+deterministic shape check at every authored intake.
+
+Binary: `target/release/aura`, built from HEAD `4ff85b9` via
+`cargo build --release -p aura-cli` (Finished in 5.48s — HEAD builds clean).
+Scratch project `aura new nm_lab` in `/tmp/ftwork/nm_lab`; real data from the
+built-in archive (US500). Public interface only (README, authoring-guide,
+glossary, design ledger C23/C24/C29, `aura … --help`) — no crate source read.
+
+---
+
+## Example 1 — authoring loop end to end (`c331_1_named_crossover.ops.json`)
+
+A named SMA-crossover with a `spread` tap, all knobs bound (closed → runnable).
+
+```
+$ aura graph build < c331_1_named_crossover.ops.json > c331_1_named_crossover.bp.json   # exit 0
+# blueprint.name == "ny_momentum", taps == [{"name":"spread",...}]
+$ aura graph register c331_1_named_crossover.bp.json
+registered blueprint 347a361997e8a65d4122b5ab50367031f78df24a1ff6ad14477ed2c04ec3b603 (…)
+# store doc runs/blueprints/347a…json -> name: ny_momentum
+$ aura run c331_1_named_crossover.bp.json --real US500 --tap spread=mean          # exit 0
+$ find runs/traces
+runs/traces/ny_momentum
+runs/traces/ny_momentum/index.json
+runs/traces/ny_momentum/spread.json
+```
+
+The authored name `ny_momentum` shows up in all three documented places — the
+blueprint bytes, the store document's `name`, and the run's trace directory
+`traces/ny_momentum/`. (Finding W1.)
+
+### Default collision story (omitting the name)
+
+Two *different* unnamed crossovers (A: fast=3/slow=8, B: fast=5/slow=20), both
+build to `name: "graph"`, both `--tap spread=record` over US500:
+
+```
+$ aura run c331_1b_unnamed_A.bp.json --real US500 --tap spread=record   # exit 0
+  sha256(runs/traces/graph/spread.json) = 5bb5dcfc…
+$ aura run c331_1c_unnamed_B.bp.json --real US500 --tap spread=record   # exit 0
+  sha256(runs/traces/graph/spread.json) = 3be8025b…   ← overwritten, silently
+$ ls runs/traces/ → graph  ny_momentum
+```
+
+Both unnamed strategies share `traces/graph/`; B silently overwrote A's
+`spread.json` (differing sha). This is exactly the documented "later runs
+overwrite earlier ones" consequence — observable, no warning (as documented).
+(Finding W1.)
+
+---
+
+## Example 2 — refusal battery (`c331_2*`)
+
+### Op route (op-indexed prose)
+
+```
+$ aura graph build < c331_2a_dup_name.ops.json       # exit 1
+aura: op 1 (name): a script names its blueprint at most once
+$ aura graph build < c331_2b_slash_name.ops.json     # exit 1
+aura: op 0 (name): blueprint name "traces/evil" is invalid: must not contain '/' or '\' (a single path segment)
+$ aura graph build < c331_2c_empty_name.ops.json     # exit 1
+aura: op 0 (name): blueprint name "" is invalid: must be non-empty (a single path segment)
+$ aura graph build < c331_2d_dotdot_name.ops.json    # exit 1
+aura: op 0 (name): blueprint name ".." is invalid: must not be "." or ".." (a single path segment)
+```
+
+Each refusal is op-indexed, quotes the offending name, and states the exact
+rule. Copy-paste fixable. (Finding W2.)
+
+### Hand-edited envelope with a bad root name (`../escape`)
+
+`c331_2e_open_named.bp.json` (clean name `clean_name`, `fast.length` open),
+root `name` hand-edited to `../escape` → `c331_2e_badroot.bp.json`, fed to
+every file intake:
+
+```
+$ aura graph register       c331_2e_badroot.bp.json     # exit 1  GATED
+aura: blueprint name "../escape" is invalid: must not contain '/' or '\' (a single path segment)
+$ aura run                  c331_2e_badroot.bp.json --real US500   # exit 2  GATED
+aura: …/c331_2e_badroot.bp.json: blueprint name "../escape" is invalid: …
+$ aura sweep                c331_2e_badroot.bp.json --axis fast.length=2,4   # exit 2  GATED
+aura: blueprint name "../escape" is invalid: …
+$ aura graph introspect --content-id c331_2e_badroot.bp.json   # exit 1  GATED
+$ aura graph introspect --params     c331_2e_badroot.bp.json   # exit 1  GATED
+$ aura graph                c331_2e_badroot.bp.json     # exit 2  GATED
+aura: …/c331_2e_badroot.bp.json: blueprint name "../escape" is invalid: …
+
+$ aura sweep c331_2e_badroot.bp.json --list-axes         # exit 0  *** NOT GATED ***
+./escape.fast.length:I64
+slow.length:I64 default=8
+bias.scale:F64 default=0.5
+```
+
+Six of seven file intakes gate uniformly (Finding W2). **`sweep --list-axes`
+does not** — it exits 0 and prints a mangled, retired *wrapped* axis form
+`./escape.fast.length` for the open param only. The same on a `.` root:
+`sweep --list-axes` → `.fast.length:I64` (exit 0) while `register`/`--params`
+refuse. Pasting the leaked `./escape.fast.length` back as `--axis` refuses —
+so discovery emits a name the bind surface rejects. (Finding B1.)
+
+Prose note: `run` and `graph` prepend the full file path; `register`,
+`sweep --axis`, `introspect` do not — the core sentence is uniform, the prefix
+is not. (Finding SG1.)
+
+---
+
+## Example 3 — use-splice interplay (`c331_3*`)
+
+Registered patterns: `agree` (input `x`, SMA length open), `refute` (input `y`),
+`unnamedsm` (unnamed → `graph`, input `z`).
+
+```
+# A — splice agree, NO instance name:
+$ aura graph build < c331_3A_splice_named.ops.json    # exit 0
+aura: note: use "agree": agree -> 4f78a9f6e1f3…
+$ aura graph introspect --params c331_3A.bp.json
+agree.sma.length:I64                                   ← instance defaulted to authored name
+
+# B — splice unnamedsm TWICE, no instance names:
+$ aura graph build < c331_3B_two_unnamed.ops.json     # exit 1
+aura: note: use "graph": unnamedsm -> 25cdd4942f21…
+aura: note: use "graph": unnamedsm -> 25cdd4942f21…
+aura: op 3 (use): duplicate identifier "graph"          ← collide, op-indexed
+
+# C — splice agree + refute, no instance names:
+$ aura graph build < c331_3C_two_named.ops.json       # exit 0
+$ aura graph introspect --params c331_3C.bp.json
+agree.sma.length:I64
+refute.sma.length:I64                                   ← distinct names, no collision
+```
+
+Instance identifier defaults to the authored render name; two unnamed
+(`graph`) splices collide with an op-indexed `duplicate identifier "graph"`;
+distinct authored names dissolve the collision. Matches guide + glossary
+`blueprint label` entry exactly. (Finding W3.)
+
+---
+
+## Example 4 — discovery / docs parity (`c331_4_*`)
+
+`aura graph build --help` lists the name op last of the eleven:
+
+```
+{"op":"name","name":"ny_momentum"}
+    set the composite's render name, at most once per script (default
+    "graph" if omitted)
+```
+
+Consistent with the authoring guide's eleven-ops table (§1). Three distinct
+`--name`-ish concepts, each with distinct help phrasing:
+
+- op `name` → **render name** (keys `traces/<name>/`, use-splice instance default)
+- `aura graph register --name` → **registry label** ("Label the registered
+  content id for `use` by name (#317)")
+- `aura sweep --name` → **family name** ("Family name (records to the registry…)")
+
+The glossary `blueprint label` entry separates render name from registry label
+explicitly. Distinction is learnable from the public docs alone, though a
+consumer must consult the glossary to fully disambiguate the three. (Finding W4.)
+
+---
+
+## Findings summary
+
+- W1 (working, axis 1): authored name → blueprint bytes + store doc +
+  `traces/<name>/`; default `graph` collision observable (silent overwrite).
+- W2 (working, axis 2): op-route refusals op-indexed + specific; hand-edited
+  bad root name gated uniformly on 6 of 7 file intakes.
+- W3 (working, axis 3): use-splice instance defaults to authored name; unnamed
+  splices collide (op-indexed); named splices coexist.
+- W4 (working, axis 4): `graph build --help` lists the name op consistently
+  with the guide; render-name vs registry-label distinction learnable.
+- B1 (BUG, axis 2): `sweep --list-axes` does not gate a bad root name (exit 0)
+  and leaks a retired, non-bindable wrapped axis form (`./escape.fast.length`),
+  breaking #328's `--params`/`--list-axes` line-identity and the
+  every-discovered-name-is-verbatim-legal promise.
+- SG1 (spec_gap, axis 2): "uniform refusal prose" — `run`/`graph` prepend the
+  file path, other seams don't; unclear whether "uniform" means the core
+  sentence or byte-identical.

fieldtests/cycle-331-blueprint-name/c331_1_named_crossover.bp.json

@@ -0,0 +1 @@
+{"format_version":1,"blueprint":{"name":"ny_momentum","doc":"SMA crossover bias with a raw-spread measurement tap","nodes":[{"primitive":{"type":"SMA","name":"fast","bound":[{"pos":0,"name":"length","kind":"I64","value":{"I64":3}}]}},{"primitive":{"type":"SMA","name":"slow","bound":[{"pos":0,"name":"length","kind":"I64","value":{"I64":8}}]}},{"primitive":{"type":"Sub","name":"sub"}},{"primitive":{"type":"Bias","name":"bias","bound":[{"pos":0,"name":"scale","kind":"F64","value":{"F64":0.5}}]}}],"edges":[{"from":0,"to":2,"slot":0,"from_field":0},{"from":1,"to":2,"slot":1,"from_field":0},{"from":2,"to":3,"slot":0,"from_field":0}],"input_roles":[{"name":"price","targets":[{"node":0,"slot":0},{"node":1,"slot":0}],"source":"F64"}],"output":[{"node":3,"field":0,"name":"bias"}],"taps":[{"name":"spread","from":{"node":2,"field":0}}]}}

fieldtests/cycle-331-blueprint-name/c331_1_named_crossover.ops.json

@@ -0,0 +1,15 @@
+[
+  {"op": "name", "name": "ny_momentum"},
+  {"op": "doc", "text": "SMA crossover bias with a raw-spread measurement tap"},
+  {"op": "source", "role": "price", "kind": "F64"},
+  {"op": "add", "type": "SMA", "name": "fast", "bind": {"length": {"I64": 3}}},
+  {"op": "add", "type": "SMA", "name": "slow", "bind": {"length": {"I64": 8}}},
+  {"op": "feed", "role": "price", "into": ["fast.series", "slow.series"]},
+  {"op": "add", "type": "Sub", "name": "sub"},
+  {"op": "connect", "from": "fast.value", "to": "sub.lhs"},
+  {"op": "connect", "from": "slow.value", "to": "sub.rhs"},
+  {"op": "add", "type": "Bias", "name": "bias", "bind": {"scale": {"F64": 0.5}}},
+  {"op": "connect", "from": "sub.value", "to": "bias.signal"},
+  {"op": "tap", "from": "sub.value", "as": "spread"},
+  {"op": "expose", "from": "bias.bias", "as": "bias"}
+]

fieldtests/cycle-331-blueprint-name/c331_1_register.out

@@ -0,0 +1 @@
+registered blueprint 347a361997e8a65d4122b5ab50367031f78df24a1ff6ad14477ed2c04ec3b603 (/tmp/ftwork/nm_lab/runs/blueprints/347a361997e8a65d4122b5ab50367031f78df24a1ff6ad14477ed2c04ec3b603.json)

fieldtests/cycle-331-blueprint-name/c331_1_run.out

@@ -0,0 +1 @@
+{"manifest":{"commit":"4ff85b94e56c6946361ecbcd94a6f6f99d49268c","params":[],"defaults":[["fast.length",{"I64":3}],["slow.length",{"I64":8}],["bias.scale",{"F64":0.5}]],"window":[1407103199999000000,1784926380000000000],"seed":0,"broker":"sim-optimal+risk-executor(pip_size=1)","topology_hash":"347a361997e8a65d4122b5ab50367031f78df24a1ff6ad14477ed2c04ec3b603","project":{"commit":"f33b20e6d6cbfda4d9031cfc9c2361f5e751436b"}},"metrics":{"total_pips":-13655.020833332888,"max_drawdown":13733.579166666279,"bias_sign_flips":536589,"r":{"expectancy_r":-0.024114883486709465,"n_trades":581881,"win_rate":0.3205792937043829,"avg_win_r":1.62333970987585,"avg_loss_r":-0.8014533205646299,"profit_factor":0.9557138265296112,"max_r_drawdown":14084.435329973425,"n_open_at_end":1,"sqn":-8.965122280661042,"sqn_normalized":-0.11752740018906035,"net_expectancy_r":-0.024114883486709465,"conviction_terciles_r":[-0.024905829212096428,-0.022878394661105868,-0.024560424289849826]}}}

fieldtests/cycle-331-blueprint-name/c331_1_traces.txt

@@ -0,0 +1,11 @@
+# traces after example 1 (named) + collision runs (unnamed)
+runs/traces
+runs/traces/graph
+runs/traces/graph/index.json
+runs/traces/graph/spread.json
+runs/traces/ny_momentum
+runs/traces/ny_momentum/index.json
+runs/traces/ny_momentum/spread.json
+
+# trace index for ny_momentum:
+{"manifest":{"commit":"4ff85b94e56c6946361ecbcd94a6f6f99d49268c","params":[],"defaults":[["fast.length",{"I64":3}],["slow.length",{"I64":8}],["bias.scale",{"F64":0.5}]],"window":[1407103199999000000,1784926380000000000],"seed":0,"broker":"sim-optimal+risk-executor(pip_size=1)","topology_hash":"347a361997e8a65d4122b5ab50367031f78df24a1ff6ad14477ed2c04ec3b603","project":{"commit":"f33b20e6d6cbfda4d9031cfc9c2361f5e751436b"}},"taps":["spread"]}

fieldtests/cycle-331-blueprint-name/c331_1b_unnamed_A.bp.json

@@ -0,0 +1 @@
+{"format_version":1,"blueprint":{"name":"graph","doc":"unnamed crossover A (fast=3, slow=8) — no name op, defaults to graph","nodes":[{"primitive":{"type":"SMA","name":"fast","bound":[{"pos":0,"name":"length","kind":"I64","value":{"I64":3}}]}},{"primitive":{"type":"SMA","name":"slow","bound":[{"pos":0,"name":"length","kind":"I64","value":{"I64":8}}]}},{"primitive":{"type":"Sub","name":"sub"}},{"primitive":{"type":"Bias","name":"bias","bound":[{"pos":0,"name":"scale","kind":"F64","value":{"F64":0.5}}]}}],"edges":[{"from":0,"to":2,"slot":0,"from_field":0},{"from":1,"to":2,"slot":1,"from_field":0},{"from":2,"to":3,"slot":0,"from_field":0}],"input_roles":[{"name":"price","targets":[{"node":0,"slot":0},{"node":1,"slot":0}],"source":"F64"}],"output":[{"node":3,"field":0,"name":"bias"}],"taps":[{"name":"spread","from":{"node":2,"field":0}}]}}

fieldtests/cycle-331-blueprint-name/c331_1b_unnamed_A.ops.json

@@ -0,0 +1,14 @@
+[
+  {"op": "doc", "text": "unnamed crossover A (fast=3, slow=8) — no name op, defaults to graph"},
+  {"op": "source", "role": "price", "kind": "F64"},
+  {"op": "add", "type": "SMA", "name": "fast", "bind": {"length": {"I64": 3}}},
+  {"op": "add", "type": "SMA", "name": "slow", "bind": {"length": {"I64": 8}}},
+  {"op": "feed", "role": "price", "into": ["fast.series", "slow.series"]},
+  {"op": "add", "type": "Sub", "name": "sub"},
+  {"op": "connect", "from": "fast.value", "to": "sub.lhs"},
+  {"op": "connect", "from": "slow.value", "to": "sub.rhs"},
+  {"op": "add", "type": "Bias", "name": "bias", "bind": {"scale": {"F64": 0.5}}},
+  {"op": "connect", "from": "sub.value", "to": "bias.signal"},
+  {"op": "tap", "from": "sub.value", "as": "spread"},
+  {"op": "expose", "from": "bias.bias", "as": "bias"}
+]

fieldtests/cycle-331-blueprint-name/c331_1c_unnamed_B.bp.json

@@ -0,0 +1 @@
+{"format_version":1,"blueprint":{"name":"graph","doc":"unnamed crossover B (fast=5, slow=20) — no name op, defaults to graph","nodes":[{"primitive":{"type":"SMA","name":"fast","bound":[{"pos":0,"name":"length","kind":"I64","value":{"I64":5}}]}},{"primitive":{"type":"SMA","name":"slow","bound":[{"pos":0,"name":"length","kind":"I64","value":{"I64":20}}]}},{"primitive":{"type":"Sub","name":"sub"}},{"primitive":{"type":"Bias","name":"bias","bound":[{"pos":0,"name":"scale","kind":"F64","value":{"F64":0.5}}]}}],"edges":[{"from":0,"to":2,"slot":0,"from_field":0},{"from":1,"to":2,"slot":1,"from_field":0},{"from":2,"to":3,"slot":0,"from_field":0}],"input_roles":[{"name":"price","targets":[{"node":0,"slot":0},{"node":1,"slot":0}],"source":"F64"}],"output":[{"node":3,"field":0,"name":"bias"}],"taps":[{"name":"spread","from":{"node":2,"field":0}}]}}

fieldtests/cycle-331-blueprint-name/c331_1c_unnamed_B.ops.json

@@ -0,0 +1,14 @@
+[
+  {"op": "doc", "text": "unnamed crossover B (fast=5, slow=20) — no name op, defaults to graph"},
+  {"op": "source", "role": "price", "kind": "F64"},
+  {"op": "add", "type": "SMA", "name": "fast", "bind": {"length": {"I64": 5}}},
+  {"op": "add", "type": "SMA", "name": "slow", "bind": {"length": {"I64": 20}}},
+  {"op": "feed", "role": "price", "into": ["fast.series", "slow.series"]},
+  {"op": "add", "type": "Sub", "name": "sub"},
+  {"op": "connect", "from": "fast.value", "to": "sub.lhs"},
+  {"op": "connect", "from": "slow.value", "to": "sub.rhs"},
+  {"op": "add", "type": "Bias", "name": "bias", "bind": {"scale": {"F64": 0.5}}},
+  {"op": "connect", "from": "sub.value", "to": "bias.signal"},
+  {"op": "tap", "from": "sub.value", "as": "spread"},
+  {"op": "expose", "from": "bias.bias", "as": "bias"}
+]

fieldtests/cycle-331-blueprint-name/c331_2a_dup_name.err

@@ -0,0 +1 @@
+aura: op 1 (name): a script names its blueprint at most once

fieldtests/cycle-331-blueprint-name/c331_2a_dup_name.ops.json

@@ -0,0 +1,11 @@
+[
+  {"op": "name", "name": "first_name"},
+  {"op": "name", "name": "second_name"},
+  {"op": "doc", "text": "two name ops — should refuse at the second"},
+  {"op": "source", "role": "price", "kind": "F64"},
+  {"op": "add", "type": "SMA", "name": "fast", "bind": {"length": {"I64": 3}}},
+  {"op": "feed", "role": "price", "into": ["fast.series"]},
+  {"op": "add", "type": "Bias", "name": "bias", "bind": {"scale": {"F64": 0.5}}},
+  {"op": "connect", "from": "fast.value", "to": "bias.signal"},
+  {"op": "expose", "from": "bias.bias", "as": "bias"}
+]

fieldtests/cycle-331-blueprint-name/c331_2b_slash_name.err

@@ -0,0 +1 @@
+aura: op 0 (name): blueprint name "traces/evil" is invalid: must not contain '/' or '\' (a single path segment)

fieldtests/cycle-331-blueprint-name/c331_2b_slash_name.ops.json

@@ -0,0 +1,10 @@
+[
+  {"op": "name", "name": "traces/evil"},
+  {"op": "doc", "text": "name with a path separator — should refuse"},
+  {"op": "source", "role": "price", "kind": "F64"},
+  {"op": "add", "type": "SMA", "name": "fast", "bind": {"length": {"I64": 3}}},
+  {"op": "feed", "role": "price", "into": ["fast.series"]},
+  {"op": "add", "type": "Bias", "name": "bias", "bind": {"scale": {"F64": 0.5}}},
+  {"op": "connect", "from": "fast.value", "to": "bias.signal"},
+  {"op": "expose", "from": "bias.bias", "as": "bias"}
+]

fieldtests/cycle-331-blueprint-name/c331_2c_empty_name.err

@@ -0,0 +1 @@
+aura: op 0 (name): blueprint name "" is invalid: must be non-empty (a single path segment)

fieldtests/cycle-331-blueprint-name/c331_2c_empty_name.ops.json

@@ -0,0 +1,10 @@
+[
+  {"op": "name", "name": ""},
+  {"op": "doc", "text": "empty name — should refuse"},
+  {"op": "source", "role": "price", "kind": "F64"},
+  {"op": "add", "type": "SMA", "name": "fast", "bind": {"length": {"I64": 3}}},
+  {"op": "feed", "role": "price", "into": ["fast.series"]},
+  {"op": "add", "type": "Bias", "name": "bias", "bind": {"scale": {"F64": 0.5}}},
+  {"op": "connect", "from": "fast.value", "to": "bias.signal"},
+  {"op": "expose", "from": "bias.bias", "as": "bias"}
+]

fieldtests/cycle-331-blueprint-name/c331_2d_dotdot_name.err

@@ -0,0 +1 @@
+aura: op 0 (name): blueprint name ".." is invalid: must not be "." or ".." (a single path segment)

fieldtests/cycle-331-blueprint-name/c331_2d_dotdot_name.ops.json

@@ -0,0 +1,10 @@
+[
+  {"op": "name", "name": ".."},
+  {"op": "doc", "text": "parent-dir name — should refuse"},
+  {"op": "source", "role": "price", "kind": "F64"},
+  {"op": "add", "type": "SMA", "name": "fast", "bind": {"length": {"I64": 3}}},
+  {"op": "feed", "role": "price", "into": ["fast.series"]},
+  {"op": "add", "type": "Bias", "name": "bias", "bind": {"scale": {"F64": 0.5}}},
+  {"op": "connect", "from": "fast.value", "to": "bias.signal"},
+  {"op": "expose", "from": "bias.bias", "as": "bias"}
+]

fieldtests/cycle-331-blueprint-name/c331_2e_badroot.bp.json

@@ -0,0 +1 @@
+{"format_version":1,"blueprint":{"name":"../escape","doc":"open crossover (fast.length free) with a clean name, for hand-editing","nodes":[{"primitive":{"type":"SMA","name":"fast"}},{"primitive":{"type":"SMA","name":"slow","bound":[{"pos":0,"name":"length","kind":"I64","value":{"I64":8}}]}},{"primitive":{"type":"Sub","name":"sub"}},{"primitive":{"type":"Bias","name":"bias","bound":[{"pos":0,"name":"scale","kind":"F64","value":{"F64":0.5}}]}}],"edges":[{"from":0,"to":2,"slot":0,"from_field":0},{"from":1,"to":2,"slot":1,"from_field":0},{"from":2,"to":3,"slot":0,"from_field":0}],"input_roles":[{"name":"price","targets":[{"node":0,"slot":0},{"node":1,"slot":0}],"source":"F64"}],"output":[{"node":3,"field":0,"name":"bias"}]}}

fieldtests/cycle-331-blueprint-name/c331_2e_contentid.out

@@ -0,0 +1 @@
+aura: blueprint name "../escape" is invalid: must not contain '/' or '\' (a single path segment)

fieldtests/cycle-331-blueprint-name/c331_2e_open_named.bp.json

@@ -0,0 +1 @@
+{"format_version":1,"blueprint":{"name":"clean_name","doc":"open crossover (fast.length free) with a clean name, for hand-editing","nodes":[{"primitive":{"type":"SMA","name":"fast"}},{"primitive":{"type":"SMA","name":"slow","bound":[{"pos":0,"name":"length","kind":"I64","value":{"I64":8}}]}},{"primitive":{"type":"Sub","name":"sub"}},{"primitive":{"type":"Bias","name":"bias","bound":[{"pos":0,"name":"scale","kind":"F64","value":{"F64":0.5}}]}}],"edges":[{"from":0,"to":2,"slot":0,"from_field":0},{"from":1,"to":2,"slot":1,"from_field":0},{"from":2,"to":3,"slot":0,"from_field":0}],"input_roles":[{"name":"price","targets":[{"node":0,"slot":0},{"node":1,"slot":0}],"source":"F64"}],"output":[{"node":3,"field":0,"name":"bias"}]}}

fieldtests/cycle-331-blueprint-name/c331_2e_open_named.ops.json

@@ -0,0 +1,14 @@
+[
+  {"op": "name", "name": "clean_name"},
+  {"op": "doc", "text": "open crossover (fast.length free) with a clean name, for hand-editing"},
+  {"op": "source", "role": "price", "kind": "F64"},
+  {"op": "add", "type": "SMA", "name": "fast"},
+  {"op": "add", "type": "SMA", "name": "slow", "bind": {"length": {"I64": 8}}},
+  {"op": "feed", "role": "price", "into": ["fast.series", "slow.series"]},
+  {"op": "add", "type": "Sub", "name": "sub"},
+  {"op": "connect", "from": "fast.value", "to": "sub.lhs"},
+  {"op": "connect", "from": "slow.value", "to": "sub.rhs"},
+  {"op": "add", "type": "Bias", "name": "bias", "bind": {"scale": {"F64": 0.5}}},
+  {"op": "connect", "from": "sub.value", "to": "bias.signal"},
+  {"op": "expose", "from": "bias.bias", "as": "bias"}
+]

fieldtests/cycle-331-blueprint-name/c331_2e_params.out

@@ -0,0 +1 @@
+aura: blueprint name "../escape" is invalid: must not contain '/' or '\' (a single path segment)

fieldtests/cycle-331-blueprint-name/c331_2e_register.out

@@ -0,0 +1 @@
+aura: blueprint name "../escape" is invalid: must not contain '/' or '\' (a single path segment)

fieldtests/cycle-331-blueprint-name/c331_2e_render.out

@@ -0,0 +1 @@
+aura: /home/brummel/dev/aura/.claude/worktrees/issue-331-blueprint-name/fieldtests/cycle-331-blueprint-name/c331_2e_badroot.bp.json: blueprint name "../escape" is invalid: must not contain '/' or '\' (a single path segment)

fieldtests/cycle-331-blueprint-name/c331_2e_run.out

@@ -0,0 +1 @@
+aura: /home/brummel/dev/aura/.claude/worktrees/issue-331-blueprint-name/fieldtests/cycle-331-blueprint-name/c331_2e_badroot.bp.json: blueprint name "../escape" is invalid: must not contain '/' or '\' (a single path segment)

fieldtests/cycle-331-blueprint-name/c331_2e_sweep_axis.out

@@ -0,0 +1 @@
+aura: blueprint name "../escape" is invalid: must not contain '/' or '\' (a single path segment)

fieldtests/cycle-331-blueprint-name/c331_2e_sweep_list.out

@@ -0,0 +1,3 @@
+./escape.fast.length:I64
+slow.length:I64 default=8
+bias.scale:F64 default=0.5

fieldtests/cycle-331-blueprint-name/c331_2f_dotroot.bp.json

@@ -0,0 +1 @@
+{"format_version":1,"blueprint":{"name":".","doc":"open crossover (fast.length free) with a clean name, for hand-editing","nodes":[{"primitive":{"type":"SMA","name":"fast"}},{"primitive":{"type":"SMA","name":"slow","bound":[{"pos":0,"name":"length","kind":"I64","value":{"I64":8}}]}},{"primitive":{"type":"Sub","name":"sub"}},{"primitive":{"type":"Bias","name":"bias","bound":[{"pos":0,"name":"scale","kind":"F64","value":{"F64":0.5}}]}}],"edges":[{"from":0,"to":2,"slot":0,"from_field":0},{"from":1,"to":2,"slot":1,"from_field":0},{"from":2,"to":3,"slot":0,"from_field":0}],"input_roles":[{"name":"price","targets":[{"node":0,"slot":0},{"node":1,"slot":0}],"source":"F64"}],"output":[{"node":3,"field":0,"name":"bias"}]}}

fieldtests/cycle-331-blueprint-name/c331_3A.bp.json

@@ -0,0 +1 @@
+{"format_version":1,"blueprint":{"name":"graph","doc":"splice agree once, NO instance name — instance should default to authored name","nodes":[{"composite":{"name":"agree","doc":"reusable SMA smoother over an open input role x; length open","nodes":[{"primitive":{"type":"SMA","name":"sma"}}],"input_roles":[{"name":"x","targets":[{"node":0,"slot":0}]}],"output":[{"node":0,"field":0,"name":"smoothed"}]}}],"input_roles":[{"name":"price","targets":[{"node":0,"slot":0}],"source":"F64"}],"output":[{"node":0,"field":0,"name":"out"}]}}

fieldtests/cycle-331-blueprint-name/c331_3A.err

@@ -0,0 +1 @@
+aura: note: use "agree": agree -> 4f78a9f6e1f3e1c7671edaf1be29d1e339fd07f38fb2c65cb23637502f94d154

fieldtests/cycle-331-blueprint-name/c331_3A_splice_named.ops.json

@@ -0,0 +1,7 @@
+[
+  {"op": "doc", "text": "splice agree once, NO instance name — instance should default to authored name"},
+  {"op": "source", "role": "price", "kind": "F64"},
+  {"op": "use", "ref": {"name": "agree"}},
+  {"op": "feed", "role": "price", "into": ["agree.x"]},
+  {"op": "expose", "from": "agree.smoothed", "as": "out"}
+]

fieldtests/cycle-331-blueprint-name/c331_3B.err

@@ -0,0 +1,3 @@
+aura: note: use "graph": unnamedsm -> 25cdd4942f217381da0d799b0c5b22752a963a2bdc7df83e5d1377ae3b974e96
+aura: note: use "graph": unnamedsm -> 25cdd4942f217381da0d799b0c5b22752a963a2bdc7df83e5d1377ae3b974e96
+aura: op 3 (use): duplicate identifier "graph"

fieldtests/cycle-331-blueprint-name/c331_3B_two_unnamed.ops.json

@@ -0,0 +1,8 @@
+[
+  {"op": "doc", "text": "splice the unnamed (graph) smoother TWICE, no instance names — should collide"},
+  {"op": "source", "role": "price", "kind": "F64"},
+  {"op": "use", "ref": {"name": "unnamedsm"}},
+  {"op": "use", "ref": {"name": "unnamedsm"}},
+  {"op": "feed", "role": "price", "into": ["graph.z"]},
+  {"op": "expose", "from": "graph.smoothed", "as": "out"}
+]

fieldtests/cycle-331-blueprint-name/c331_3C.bp.json

@@ -0,0 +1 @@
+{"format_version":1,"blueprint":{"name":"graph","doc":"splice agree + refute, NO instance names — distinct authored names, no collision","nodes":[{"composite":{"name":"agree","doc":"reusable SMA smoother over an open input role x; length open","nodes":[{"primitive":{"type":"SMA","name":"sma"}}],"input_roles":[{"name":"x","targets":[{"node":0,"slot":0}]}],"output":[{"node":0,"field":0,"name":"smoothed"}]}},{"composite":{"name":"refute","doc":"a second reusable SMA smoother over open input role y; length open","nodes":[{"primitive":{"type":"SMA","name":"sma"}}],"input_roles":[{"name":"y","targets":[{"node":0,"slot":0}]}],"output":[{"node":0,"field":0,"name":"smoothed"}]}}],"input_roles":[{"name":"price","targets":[{"node":0,"slot":0},{"node":1,"slot":0}],"source":"F64"}],"output":[{"node":0,"field":0,"name":"agree_out"},{"node":1,"field":0,"name":"refute_out"}]}}

fieldtests/cycle-331-blueprint-name/c331_3C.err

@@ -0,0 +1,2 @@
+aura: note: use "agree": agree -> 4f78a9f6e1f3e1c7671edaf1be29d1e339fd07f38fb2c65cb23637502f94d154
+aura: note: use "refute": refute -> 9580a623d1faf83841482ae08874ffe2464aff30a2ac2e800a9b47a3bb56d1f2

fieldtests/cycle-331-blueprint-name/c331_3C_two_named.ops.json

@@ -0,0 +1,9 @@
+[
+  {"op": "doc", "text": "splice agree + refute, NO instance names — distinct authored names, no collision"},
+  {"op": "source", "role": "price", "kind": "F64"},
+  {"op": "use", "ref": {"name": "agree"}},
+  {"op": "use", "ref": {"name": "refute"}},
+  {"op": "feed", "role": "price", "into": ["agree.x", "refute.y"]},
+  {"op": "expose", "from": "agree.smoothed", "as": "agree_out"},
+  {"op": "expose", "from": "refute.smoothed", "as": "refute_out"}
+]

fieldtests/cycle-331-blueprint-name/c331_3_agree.ops.json

@@ -0,0 +1,8 @@
+[
+  {"op": "name", "name": "agree"},
+  {"op": "doc", "text": "reusable SMA smoother over an open input role x; length open"},
+  {"op": "input", "role": "x"},
+  {"op": "add", "type": "SMA", "name": "sma"},
+  {"op": "feed", "role": "x", "into": ["sma.series"]},
+  {"op": "expose", "from": "sma.value", "as": "smoothed"}
+]

fieldtests/cycle-331-blueprint-name/c331_3_refute.ops.json

@@ -0,0 +1,8 @@
+[
+  {"op": "name", "name": "refute"},
+  {"op": "doc", "text": "a second reusable SMA smoother over open input role y; length open"},
+  {"op": "input", "role": "y"},
+  {"op": "add", "type": "SMA", "name": "sma"},
+  {"op": "feed", "role": "y", "into": ["sma.series"]},
+  {"op": "expose", "from": "sma.value", "as": "smoothed"}
+]

fieldtests/cycle-331-blueprint-name/c331_3_reg_agree.out

@@ -0,0 +1,2 @@
+registered blueprint 4f78a9f6e1f3e1c7671edaf1be29d1e339fd07f38fb2c65cb23637502f94d154 (/tmp/ftwork/nm_lab/runs/blueprints/4f78a9f6e1f3e1c7671edaf1be29d1e339fd07f38fb2c65cb23637502f94d154.json)
+label "agree" -> 4f78a9f6e1f3e1c7671edaf1be29d1e339fd07f38fb2c65cb23637502f94d154

fieldtests/cycle-331-blueprint-name/c331_3_reg_refute.out

@@ -0,0 +1,2 @@
+registered blueprint 9580a623d1faf83841482ae08874ffe2464aff30a2ac2e800a9b47a3bb56d1f2 (/tmp/ftwork/nm_lab/runs/blueprints/9580a623d1faf83841482ae08874ffe2464aff30a2ac2e800a9b47a3bb56d1f2.json)
+label "refute" -> 9580a623d1faf83841482ae08874ffe2464aff30a2ac2e800a9b47a3bb56d1f2

fieldtests/cycle-331-blueprint-name/c331_3_reg_unnamed.out

@@ -0,0 +1,2 @@
+registered blueprint 25cdd4942f217381da0d799b0c5b22752a963a2bdc7df83e5d1377ae3b974e96 (/tmp/ftwork/nm_lab/runs/blueprints/25cdd4942f217381da0d799b0c5b22752a963a2bdc7df83e5d1377ae3b974e96.json)
+label "unnamedsm" -> 25cdd4942f217381da0d799b0c5b22752a963a2bdc7df83e5d1377ae3b974e96

fieldtests/cycle-331-blueprint-name/c331_3_unnamed_smoother.ops.json

@@ -0,0 +1,7 @@
+[
+  {"op": "doc", "text": "an UNNAMED reusable SMA smoother over open input role z; defaults to graph"},
+  {"op": "input", "role": "z"},
+  {"op": "add", "type": "SMA", "name": "sma"},
+  {"op": "feed", "role": "z", "into": ["sma.series"]},
+  {"op": "expose", "from": "sma.value", "as": "smoothed"}
+]

fieldtests/cycle-331-blueprint-name/c331_4_graph_build_help.txt

@@ -0,0 +1,38 @@
+Construct a graph from a stdin op-list
+
+Usage: aura graph build [OPTIONS]
+
+Options:
+      --release  Load the project dylib from target/release instead of target/debug
+  -h, --help     Print help
+
+Op-list reference (stdin: a JSON array of op objects, applied in order):
+  {"op":"source","role":"price","kind":"F64"}
+      declare a bound root input role of a scalar kind
+  {"op":"input","role":"price"}
+      declare an open input role (wired by an enclosing graph)
+  {"op":"add","type":"SMA","name":"fast","bind":{"length":{"I64":2}}}
+      instantiate a node ("name" optional; "bind" maps param -> typed scalar)
+  {"op":"add","type":"Session","name":"ny","args":{"tz":"America/New_York","open":"09:30"},"bind":{"period_minutes":{"I64":15}}}
+      an arg-bearing type applies "args" (closed, per-type-declared string
+      pairs) BEFORE "bind" — see graph introspect --node <T> for its args
+  {"op":"feed","role":"price","into":["fast.series","slow.series"]}
+      wire a role into one or more input slots
+  {"op":"connect","from":"fast.value","to":"sub.lhs"}
+      wire a node output into an input slot
+  {"op":"expose","from":"sub.value","as":"bias"}
+      name a graph output field
+  {"op":"tap","from":"sub.value","as":"spread"}
+      declare a recordable tap on a wire (expose's output-side twin)
+  {"op":"gang","as":"length","into":["fast.length","slow.length"]}
+      fuse two or more sibling params into one public knob
+  {"op":"doc","text":"..."}
+      declare the composite's one-line meaning (C29)
+  {"op":"use","ref":{"name":"agree"},"name":"gate","bind":{"sma.length":{"I64":9}}}
+      splice a registered blueprint (by "content_id" or "name") under an
+      instance name ("bind" path-qualifies the spliced instance's params)
+  {"op":"name","name":"ny_momentum"}
+      set the composite's render name, at most once per script (default
+      "graph" if omitted)
+
+Node types and their ports: aura graph introspect --vocabulary | --node <T>

fieldtests/cycle-331-blueprint-name/c331_4_register_help.txt

@@ -0,0 +1,11 @@
+Register a blueprint document into the content-addressed store (#196)
+
+Usage: aura graph register [OPTIONS] <FILE>
+
+Arguments:
+  <FILE>  The blueprint .json file to register
+
+Options:
+      --name <NAME>  Label the registered content id for `use` by name (#317); a re-registered label repoints (latest-wins on resolve)
+      --release      Load the project dylib from target/release instead of target/debug
+  -h, --help         Print help