Datamart contract v0.1

Where every number in the app comes from. One master table for the tech team, and the answer to the first question any trustee's diligence will ask. Verify flags live here and never render in the member interface.

Laws already locked

The deterministic engine does all arithmetic. No figure is ever generated.
Grounded outputs carry citations. No retrievable source means "check first" language, never a confident claim.
A verify flag never renders member-facing.
On-device by default. Every server-enclave row activates only on a signed contract requiring protected-health-information features.
No invented sources. A missing source is a finding, not a failure.

Residency values follow the three-tier privacy architecture: on-device by default, then aggregate-only reporting with small-cell suppression, then member-consented receipts. Provenance columns mirror the source-reference shape already shipped in the codebase.