RQ1+RQ2 start-line: live per-cell condition assembler + guarded launcher + Holm ratification

Wire the live per-cell condition assembler (cmd_chat/sor/assembler.py): compose
the existing R1/R4/R5/R6 pieces into a condition-encoding CircuitSpec per frozen
§2 cell, so a cell_id maps to a genuinely distinct, ForwarderPlan-gated
(engine != local) isolated circuit rather than the plain 3-hop control:
  - RQ1 bridge-on / on+padding insert a live bridge hop (+ R1 PADDING stream);
  - RQ2 bridge-/directory-federated genuinely span >= 2 houses
    (federation.select_federated_path, split-knowledge).
Plans only: opens no socket, moves no traffic, stands up no engine.

battery.assembler_dry_check validates on FIXTURES (6/6 cells distinct
fingerprints, all isolation-gated, same (cell,seed) reproduces, RQ1 bridge +
padding arms live, RQ2 federation >= 2 houses); write-once, kept out of any
confirmatory data dir. confirmatory_run preflight now runs it; the --operator-go
path no longer refuses cells as "not wired" — triple-lock + green preflight HOLD
on grid completion, then surface the operator's immutable data-run gate. No
confirmatory cell is ever fabricated.

Start-line instrument-validation gate (cmd_chat/sor/gate.py), grid + containment
pin (grid.py), and the guarded launcher (confirmatory_run.py) land alongside.

Holm: hold family_size = 7, report the 4 RQ1/RQ2 tests -> multipliers 7,6,5,4.
This is the pre-registration, not a deviation (prereg §6 [APPROVAL] size-7 family
+ D6 disclosure in the lead paper); docs/stage-05-holm-clarification.md marked
RATIFIED. RQ3-fold and alpha-split declined.

Containment intact; prereg untouched (SHA f22331a72e...); worktree-only. output/
gitignored (runtime artifacts, never source). Full SOR suite 156 passed. No
confirmatory data collected — the live data run remains the human gate.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_sor_assembler.py

@@ -0,0 +1,108 @@
+"""Live per-cell condition assembler — each §2 cell is a genuinely distinct,
+isolation-gated circuit, not the plain 3-hop control.
+
+These are fixture-only checks: the assembler builds *plans* (ForwarderPlan targets),
+opens no socket, moves no traffic, and stands up no engine. We pin that each cell's
+structure encodes its condition, that determinism holds, that federated cells
+genuinely span >= 2 houses, and that a non-isolated engine is refused.
+"""
+
+import pytest
+
+from cmd_chat.sor import battery
+from cmd_chat.sor.assembler import assemble, assemble_all
+from cmd_chat.sor.forwarder import ContainmentError
+
+
+def _cells_by_suffix():
+    return {c.cell_id: c for c in battery.enumerate_cells()}
+
+
+def _assemble_cell(suffix, seed=7):
+    cell = next(c for c in battery.enumerate_cells() if c.cell_id.endswith(suffix))
+    return assemble(cell, seed)
+
+
+def test_all_cells_distinct_fingerprints():
+    cells = battery.enumerate_cells()
+    specs = assemble_all(cells, 0)
+    fps = {s.fingerprint() for s in specs.values()}
+    assert len(fps) == len(cells) == 6  # every cell is a distinct circuit
+
+
+def test_same_cell_seed_reproduces_fingerprint():
+    cells = battery.enumerate_cells()
+    a = assemble_all(cells, 0)
+    b = assemble_all(cells, 0)
+    assert {k: v.fingerprint() for k, v in a.items()} == {
+        k: v.fingerprint() for k, v in b.items()
+    }
+
+
+def test_different_run_index_changes_seed_and_circuit():
+    cells = battery.enumerate_cells()
+    a = assemble_all(cells, 0)
+    b = assemble_all(cells, 1)
+    for cid in a:
+        assert a[cid].seed != b[cid].seed
+        assert a[cid].fingerprint() != b[cid].fingerprint()
+
+
+def test_all_cells_isolation_gated():
+    specs = assemble_all(battery.enumerate_cells(), 0)
+    assert all(s.isolation_gated() for s in specs.values())
+
+
+def test_local_engine_is_refused():
+    cell = battery.enumerate_cells()[0]
+    with pytest.raises(ContainmentError):
+        assemble(cell, 7, engine="local").plans()
+
+
+def test_rq1_bridge_off_is_plain_single_house():
+    spec = _assemble_cell("bridge=off")
+    assert spec.bridge_present is False and spec.padding_applied is False
+    assert not any(h.is_bridge for h in spec.hops)
+    assert spec.span_houses() == 1
+
+
+def test_rq1_bridge_on_inserts_a_bridge_hop():
+    spec = _assemble_cell("bridge=on")
+    assert spec.bridge_present is True and spec.padding_applied is False
+    assert any(h.is_bridge for h in spec.hops)
+
+
+def test_rq1_bridge_on_padding_applies_padding():
+    spec = _assemble_cell("bridge=on+padding")
+    assert spec.bridge_present is True and spec.padding_applied is True
+    assert any(h.is_bridge for h in spec.hops)
+
+
+def test_rq2_bridge_federated_spans_two_houses():
+    spec = _assemble_cell("topo=bridge-federated")
+    assert spec.bridge_present is True
+    assert len({h.house for h in spec.hops if h.house != "bridge"}) >= 2
+
+
+def test_rq2_directory_federated_spans_two_houses():
+    spec = _assemble_cell("topo=directory-federated")
+    assert len({h.house for h in spec.hops}) >= 2
+
+
+def test_assembler_dry_check_all_green(tmp_path):
+    summary = battery.assembler_dry_check(tmp_path / "asm")
+    assert summary["all_green"] is True
+    assert summary["distinct_fingerprints"] is True
+    assert summary["all_isolation_gated"] is True
+    assert summary["rq1_bridge_arms_live"] is True
+    assert summary["rq1_padding_arm_live"] is True
+    assert summary["rq2_federation_spans_2plus"] is True
+
+
+def test_assembler_dry_report_is_write_once(tmp_path):
+    out = tmp_path / "asm"
+    first = battery.assembler_dry_check(out)
+    (out / "assembler-dry.json").read_text()  # exists
+    # A second call must not overwrite the immutable report.
+    second = battery.assembler_dry_check(out)
+    assert first["distinct_fingerprints"] == second["distinct_fingerprints"]