Task: Address the blueprint review

ir_curve_bootstrap_config carries a required name (text, searchable, sortable) with a unique index over (tenant_id, party_id, name) for the active rows. The entity was regenerated and every affected piece follows: the domain, the repository and its mappers, the service, the protocol, the shell commands, the SQL create, the refdata seed (USD-SOFR-FOMC), the BFF write schema and the web protocol. The model's list contract says the name replaces the sentence that said a blueprint has no name. The web draws the name in the list's first cell, in the record header and breadcrumb, and as Details' first fact; the output series stays a property on Details, drawn as its URI and linked; the Add and Copy dialogs ask for the name first and it is typed, never derived. No screen parses the URI for a name anywhere.

discount_curve_config_id is std::optional<boost::uuids::uuid> and nullable, with no default; the nil-sentinel shape check became an is null / is not null pair per role, and the trigger's two-tier guard compares no nil uuid. Every use follows: the republish service reads a projection's discount curve through the optional and refuses a projection that names none, the test fixture writes null, the refdata seed and the evidence seed leave it out, and the BFF write schema accepts null. On the web the field is optional wherever it is read, Details draws "—", and the Check tab reads a discount curve only when the record names one, so it no longer asks the server for the record a nil id names. The recipe's two discount checks still need a projection, and a funding curve passes them without a discount being read.

PersonCell is the shared pairing the history panel already uses – an Avatar with the picture beside a PersonRef – added to PersonRef.tsx because no shared component paired them. The published list's Publisher column, the blueprint's Published sets tab, and the Points and Compare tabs draw published_by through it, and the published record's Details does too. The request page keeps AccountPicture and PersonRef and now resolves them, because the reader holds iam::accounts:read. The subject-missing message on a request is two messages: the BFF passes publishedSubjectState refused or missing, and the screen says whether the read was refused or found nothing.

Environment: db recreate, the Acme provisioning recipe, the evidence seed applied as the DDL user, the three demo publish scripts replayed. The web and BFF were rebuilt by compass build and the services restarted; the served bundle carries the new copy.

The ores.marketdata.official service fails to start in this environment for a reason that predates this task: its NATS TLS client certificate is missing (build/keys/nats/ores.marketdata.official.crt). It serves the public fixings adapter and touches none of these screens.= | the BFF on port 21402, restarted after the build | HEAD of this task's branch |

name is a plain required column, not a natural key. The natural-key machinery emits one index per entity, and the entity already carries output_series_id as its natural key – exactly one active config, tenant-wide, may claim an output series. A second natural key would be emitted as one composite index over both columns, which would drop that rule and let two blueprints claim one series as long as their names differ. The model therefore states the name's uniqueness as a declared unique index over (tenant_id, party_id, name) for the active rows, which is what the model can express: tenant plus party, exactly as the review asked.

iam::accounts:read is now held by Trading and Viewer in iam_roles_populate.sql, beside the roles that already held it: Member, Operations, Support and the service accounts. The set and its reason:

• Trading raises a publish request and reads back the sets it published, and every one of those rows names the account that published it. The maker also reads the request page, where the decider's name and picture are drawn.
• Viewer is the read-only role that sees the published curves, the points, the comparison and the blueprint's Published sets tab. It sees the same people and could not resolve one.
• Operations already held it, and the seed has no Market Risk role: the demonstration's Head of Market Risk works as an Operations account, so the deciders already resolved a name before this task. The task's report of a decider that could not is about the maker's side of the same page, which the Trading grant answers.
• The read is the account read and not a tenant-wide one: row-level security still narrows it to the parties the reader works in, the same exception Member's own line states.

The seed is the source and the apply is per tenant, with the DDL user:

select ores_iam_role_permissions_assign_fn(
    '<tenant id>', 'Trading', 'iam::accounts:read');
select ores_iam_role_permissions_assign_fn(
    '<tenant id>', 'Viewer', 'iam::accounts:read');

Running it as postgres is refused (Invalid modified_by: postgres): the function validates its actor against the account table, so the DDL user is the one that works.

marketdata::curve_bootstrap:compute is now held by Trading as well. The Check that a curve blueprint builds journey names running the test as needing it, and only the tenant administrator's wildcard held it, so the Check tab refused the trader it exists for. Fix 4 read "the check runs"; the missing code is the other half of why it did not.

• The unique index over (tenant_id, party_id, name) is declared, so nothing was lost here. The model has no per-column unique flag; the SQL section's Indexes table is the only way to say it, and it says it.
• The generated shell recipe spells the absent discount curve as -, which from_token<std::optional<...>> maps to nullopt. Nothing else in the generated set needed a hand edit.
• The generated TypeScript filter type for a nullable filter column reads string | null | null, because the C++ filter is std::optional<std::optional<>> – the outer optional says "no filter", the inner null says "is null". The screen passes the outer one and the double null is the generator's spelling of it, not a second state.
• The evidence seed's config id carried variant nibble 7, which the strict uuid reader the compute route uses refuses as Invalid UUID. It is now an RFC 4122 id, and the seed says why. The seed also wrote series straight into the table with no identity row, so no picker offered them; it now writes the identity projection the pickers read, and its config insert is guarded rather than on conflict (the insert trigger refuses a second write at version zero before the conflict could resolve, so a re-apply failed).