Spatial-program signatures and source/derived research ledgers

Status: Bounded spatial-program gate and generic ledger implementation complete; further exact-composition, authenticated ledger population and office-branch integration remain pending. Parent accepted the bounded planning review's actionable ladder. Base is clean stage-two commit c1facb99bc4b4093b4b8f0ebea99b5b6c0c44b16; its branch and evidence remain unchanged.

Scope and boundaries

Strengthen opt-in floor research eligibility with per-source spatial program/gain signatures and configured hourly heat-partition preservation. Reject heterogeneous redistribution with explicit reasons/departures; do not silently change legacy production validation, EquivalentPropertyAggregator, simplifiers, example presets or numeric tolerances. No inferred energy-error thresholds, annual runs, source-file overwrite, whole-branch merge, push/publication or security/search-path changes.

The existing control/mapping checks and production report remain distinct. Normalize extensive load bases with actual source/target measures so compatible splitting is valid and equal-area spatial swaps/different core occupancy are detected. Compare meaningful component identity, values over all8760hours, activity/people settings and configured heat fractions with existing central tolerances. Known component sensible/latent/radiant partitions require hourly preservation; automatic people thermal response is runtime-dependent, so preserve its input settings and explicitly leave runtime heat partition unverified rather than invent watt values.

Add explicit source/derived volume ledgers for occupied air, plenum/attic air, excluded basement and boundary roles. Caller supplies role/provenance; names do not imply conditioning or occupancy. Retain unavailable roles/quantities distinctly from zero and make absorption/omission/coupling departures inspectable. This is not a vertical or whole-building equivalence certificate.

Ownership and test-first execution

1. Bounded Sol signature worker in BEMGen_ref_signature3: existing FloorResearchEligibility.cs, narrowly scoped new signature helper(s) and their Core tests only. Send concrete signature/report design before edits. RED tests cover homogeneous identity/compatible split, equal-area gain swap with identical controls, heterogeneous source densities/heat fractions, complementary schedules that conserve total watts but change hourly heat partitions, and explicit unsupported people-runtime limits. Keep legacy production behavior unchanged.
2. Bounded Sol ledger worker in BEMGen_ref_ledger3: new Core ledger file(s) and isolated Core tests only, no existing validator/signature edits. Explicit finite quantities/units/source-versus-derived categories/boundaries; absence is unavailable, not inventedzero. Include plenum absorption and basement/boundary departure fixtures with clear source versus conceptual-data provenance. Send API before edits.
3. Root integrator in BEMGen_ref_contract3: docs/decision/ADR, real caller/export gate tests, exact courtyard identity and negative topology/window/orientation mutations where current public records support them, combined verification and one independent bounded review. Named office configurations reuse existing records; source-program allocation and hybrid/dependency gates precede selective adoption. No new generator/composer architecture without a concrete reviewed checkpoint.

Acceptance ladder

Freeze authenticated source/departure ledgers → verify source program signatures and hourly configured partitions → exact identity/composition invariants including realized windows and reciprocal contacts → selected office-record/dependency reconciliation → explicitly allowed simplification with retained rejected evidence → separate vertical-boundary/multiplier/shading contract. Exact composition and simplification remain separate operations. Occupied DOE core never defaults to the illustrative service-core program.

All logs/RED-GREEN/native statuses/data remain in a new external stage-three evidence record. Existing stage-two data handoff is handled mechanically by the root; no worker creates the morning narrative, figures or uploads. No recursive delegates; preserve original main/5R1C/planning backups and originalRhino24864.

Bounded implementation checkpoint

The two additional floor checks and generic ledger APIs are implemented with test-first worker evidence and four real writer caller tests observed RED then GREEN. Independent bounded source/test review found no important or critical findings; it preceded the final documentation. Combined Release verification reports 7,961 passed, 18 explicit real-engine/weather skips, zero failures and zero build warnings/errors. Native outcomes, retained failures and final fixture verdicts are separate external records.

The broader acceptance ladder above is not marked complete: populated authenticated source/derived DOE ledgers, exact courtyard contact/window/orientation mutation fixtures, office room allocation and dependency adoption, vertical coupling and manual viewport checks remain pending. No annual runs or measured accuracy claims follow from this checkpoint.