Validate transport activation before preparation; drop the wall-clock assertion (G6 review nits)

[MaxGhenis]

Follow-up to #1161 (NZ graph G6, merged). It fixes the two non-blocking nits from that PR's round-3 independent review.

1. Activation preflight now refuses what it said it refuses

Before this change, validate_transport_activation (build/transport/compose.py) let through two inputs that were refused only later:

• A selected resource value that is null (currency.factor = None). It was refused by _param only after registry preparation had started.
• An empty receipt contract (receipts = {}). It was refused by assign_receipts only at run time.

Now:

• Activation and _param share one resource-selection resolver. The preflight refuses malformed resource names, missing resources and paths, null selected roots and encoding-shape errors before any store creation, registry preparation, CREATE run or source read. The refusal names the resource and path.
• column_kernels.py exposes validate_receipt_contract. assign_receipts, takeup.assign@1 and the preflight all use it, so there is one contract check, not two copies.
• docs/agent-guide.md, the changelog fragment and the cli.py docstrings now say exactly which checks run before preparation, and which checks need runtime data.

2. No wall-clock assertion in the functional A1/A2 test

test_a1_a2_three_engines_in_one_run_under_sixty_seconds asserted the toy run took under 60 s. That failed once at 91 s on an overloaded host, so it gated CI on host load. The test is now test_a1_a2_three_engines_in_one_run. It records cold_run_seconds with record_property and keeps every functional A1/A2 assertion.

Tests

• The 9 new activation-refusal cases fail on main and pass here. On main, a scratch pytest plugin put the original activation functions back in memory: 9 failed. No tracked file was rewritten.
• The lane ran five files, each separately: test_transport_composed_graph.py 133, test_transport_registry.py 31, test_transport_graph.py 15, test_transport_column_kernels.py 29, test_spec_only_country_packages.py 8. 216 passed in total.
• tools/ci_test_plan.py verify passes, as do ruff check and format.
• The hub re-ran three files at 2a7e595: composed graph 133, column kernels 29, source-scan rules 15. At a781ae9 (the review fix, which adds 4 cases): composed graph 137, source-scan rules 15.
• The real NZ spec still refuses, naming every activation gap.

Review

• r1 (GPT-6.1 Sol at 2a7e595): APPROVE_WITH_NITS. 216 tests passed and 24 mutation cases failed as intended. Finding 1 (P3): a selection whose resource was not a string skipped the preflight, so the guide's "every declaration selection must name a present resource" overstated the check. It was refused later, so no invalid graph was ever accepted. Finding 2: historical claims in this body (the 91 s host failure, the prior review) are not verifiable from the checkout. They are reported by the hub, and the evidence is in its job folder.
• Fix for finding 1 in the next commit: every mapping that names a resource is now checked before preparation. The new test fails under the old enumerator: 3 of 4 cases DID NOT RAISE; "" already failed closed. Composed graph 137, source-scan rules 15.
• The reviewer marked the docs change as needing Max because it changes mechanism claims in docs/agent-guide.md and the changelog. These are the repo's own developer docs describing a build check, not a published number or an outside claim, and the fix makes them accurate. So the hub treats them as not needing Max.
• r2 delta review (GPT-6.1 Sol at a781ae9): APPROVE_WITH_NITS, Needs Max: no. The changed guide and changelog claims are accurate. Eight malformed names were refused before any preparation. Sixteen accepted parameter shapes resolve the same as on main. Each new case fails under its mutant. Remaining nits: this body's test count (now qualified by commit), and the historical claims above. Those are reported by the hub, with evidence in its job folder, not checkout evidence.

Part of Microcosm NZ v0 (d962). Built on a GPT-6.1 Sol Subfleet lane; verified, committed and opened by the NZ hub.

🤖 Generated with Claude Code

[MaxGhenis]

Merged by the NZ hub (session local_e407a527) at a781ae9 with --merge. Gates: gh pr checks exit 0; MERGEABLE; not draft; no CHANGES_REQUESTED review. Reviewed head: a781ae9. Independent review: r1 (GPT-6.1 Sol at 2a7e595) APPROVE_WITH_NITS — 216 tests, 24 mutation cases killed; finding 1 (non-string resource names skipped the preflight) fixed in a781ae9 with a test that fails under the old enumerator. r2 delta review (GPT-6.1 Sol at a781ae9) APPROVE_WITH_NITS, Needs Max: no (jobs/review-microcosm-1180/REPORT-r2.md): eight malformed names refused before preparation, sixteen accepted shapes unchanged from main, guide/changelog claims accurate. Body counts qualified by commit. All 10 checks green, MERGEABLE/CLEAN, no CHANGES_REQUESTED.