Authenticated MediumOffice ledger caller

Status: Bounded authenticated evidence caller implemented and verified, with the first aggregate's unintended engine-test scope error preserved under D-180. Base 015c7a2825bfcb54c412bb26d593ffaf6ecf7166 remains preserved. Source-to-hybrid allocation and exact-composition contracts remain open.

Authenticate the actual DOE 1.4_7.2 new2004 Chicago/5A outer archive, nested archive and IDF bytes, plus the exact stored layout at DOE branch a527da5d0ffeb6de0d1c549dff2ab2568dde8738. Add a data-only extracted fixture and caller tests over existing Core ledger APIs; do not merge/build that branch or alter production aggregation. Archive/member identity and the contradictory internal Building label remain separate evidence.

Use explicit People/thermostat and ReturnPlenum references for source roles, with geometric prism measurements separately identified from blank engine volume fields. Derived geometric cell volumes are measurable, but physical occupied allocation, conditioning and boundary coupling are unavailable. The ledger may declare candidate occupied-role rows as a derived research convention, with null volume and an explicit disclaimer; measured hybrid-room enclosure volumes remain separate metadata. Do not infer classification from names or program keys. Retain explicit source-to-null and null-to-derived mapping gaps, G1 declared plenum absorption, source multipliers and derived record multipliers without applying them twice. Absence of a basement role means absent evidence, not measured zero.

RED tests precede extraction implementation: authentication including one-byte mutations, source role/count/volume and coupling evidence, hybrid unknowns, explicit mapping gaps, multiplier scope and retained departures. GREEN checks exercise both the extractor and real Core ledger comparison. One independent bounded review and affected aggregate verification precede the checkpoint. Exact courtyard fixtures are deferred to keep this increment and its file ownership bounded. No simulation, installation change, push, merge or publication.

Outcome: initial extractor RED 7/7 failed, then GREEN 7/7 passed; final actual-input suite 9/9 passed. Three real Core caller tests passed, and the corrected software-only aggregate passed 7,964 tests with 18 explicit engine/weather skips and no failures. Build had zero warnings/errors. Bounded independent source review found no important or critical findings. The initial aggregate accidentally inherited the engine opt-in and started annual test cases; its aborted log and outputs are retained separately, not adopted as scientific evidence. The task-owned testhost and active engine children were stopped; Rhino and persistent settings were preserved. Subsequent software verification cleared the opt-in process-locally. No courtyard worker was admitted because the existing gates explicitly lack the required exact-composition acceptance seam; a concrete contract checkpoint is retained externally.