Twelve rules the software is not allowed to break

Every figure in a rendered deliverable comes from a valuation line computed by the deterministic engine. The drafting layer writes prose about figures; it does not originate them.

A number appearing in drafted prose with no line behind it is a blocking error rather than a paragraph to proofread, and it is demonstrated against a case deliberately prompted to produce one. A rule that depends on somebody catching it in review is not a rule, because the week it matters is the week nobody has time to read carefully.

Ownership, tenure, encumbrance status, approvals held, area and age must each resolve to a registered instrument, a title chain entry, an encumbrance row or an approval on file.

An unsupported assertion stops the job before anything is drafted, naming the document that would satisfy it. There is no bypass — no force parameter, no permissive mode, no senior override — and a test asserts that by inspecting the function’s own signature. An unevidenced title assertion inside a signed valuation is the claim that ends a registration.

The conclusion comes from a grid in which every comparable carries its adjustments and a written reason for each factor. A raw average survives only as a pre-adjustment sanity statistic.

That statistic is labelled as one everywhere it appears, and nothing in the software returns it under a name a caller could mistake for a conclusion. An adjustment cannot be stored without its rationale, so the grid cannot quietly degrade into a column of percentages somebody once had a reason for.

Minimum comparable count, maximum age, maximum radius, and a ceiling on how far the adjusted rates may still disagree. All four are blocking checks.

A refusal names the condition and the outliers rather than reporting that the input was invalid. A warning would be clicked past on the day it mattered most, and a spread that stays wide after adjustment is the strongest available evidence that these were not comparables — averaging them is precisely how that evidence gets destroyed.

Sales comparison, income and cost each produce an indicated value. Weights must sum to one, each weight carries a written rationale, and the mandate’s purpose and basis decide which methods are mandatory.

Weights that do not sum to one are refused rather than normalised silently, a weight without a reason cannot be saved, and approaches diverging beyond the threshold are refused rather than split down the middle. Two methods far apart is a finding somebody should read, not a number to average away.

The valuation module is pure arithmetic. No model call belongs in it, now or later, and the drafting layer cannot reach into it.

The same inputs produce the same figures on every run. A regression set replays a fixed job per document type against a recorded provider response and compares every figure exactly — a paisa of drift fails the build, which is what makes a change to the arithmetic a reviewed decision rather than a discovery in a signed report.

Every monetary figure is an exact decimal, parsed from text rather than from a float, and rounded once at the boundary rather than at each step.

A two-hundred-property portfolio totals identically whether summed per property or in aggregate, to the rupee. A figure that cannot be read raises rather than being coerced to zero, because a silent zero flows into a total and reconciles perfectly with nothing.

Area conversion comes from a single shared source that both the engine and the console read. Units whose factors vary by state are held as unverified against notified schedules.

An unverified factor refuses to convert unless somebody explicitly instructs it to. An area wrong by a state’s factor is a valuation wrong by a multiple rather than by a percentage, and a blocked conversion is recoverable in a way that a silently wrong one is not.

Every imported row is accounted for. Parsed plus rejected plus duplicate must equal the number of rows submitted, and the rejected rows are visible with their reasons.

An unrecognised format is an error naming the row and the field, not an empty result that looks like a clean import. A parser that returns nothing on a malformed sheet produces a valuation built on four comparables when eight were supplied, and nobody finds out.

The firm sits on every row and is applied where the query is built, so scoping has one place it can be forgotten rather than one per endpoint.

A cross-firm read, list, search or download answers as though the record does not exist, and a build in which any data-access function can be called without a scope fails. The firm comes from a signed token; no endpoint accepts a firm identifier as an argument.

Exact coordinates, owner names and survey numbers are treated as sensitive rather than as ordinary fields.

They are redacted out of logs, so an operational log is not an ownership dataset, and they are absent from what a client-role response carries — absent from the payload, not hidden in the interface. Documents and photographs are encrypted with per-firm keys.

Preparation and signature are different acts. A partner or a registered valuer whose registration covers the asset class signs, and only with no review note left open.

An unsigned export carries a "Draft — not for reliance" watermark, and the watermark fails closed: an export arriving without a status is treated as unsigned rather than assumed final. An analyst reaching the signing endpoint is refused on role before anything else is checked, because that attempt is the failure worth refusing earliest.