Heat-pump quotes with the compliance gates written into the code

A job's stage changes through one function that checks a frozen map of allowed transitions, runs the guards for the target stage and writes the change and an audit event in a single transaction, using an optimistic check so two concurrent callers cannot both advance it. There is no exit from the terminal states, and a job cannot be cancelled after installation, because the design treats the refrigerant and certification duties as outliving a cancelled order.

The noise assessment must be a pass for the design currently approved: a later fail overrides an earlier pass, and a pass on a rejected or superseded design does not count. The design must be approved, and the approval is recomputed against its stored hash on retrieval. The cooling-off period is computed on the UK calendar day of signing, so a signature at 23:30 in summer counts as that day, with the earliest install at midnight UK time after the fourteenth day. Each gate has a test for the path where it blocks.

Approving a design hashes a canonical form of its identity, version, key figures, approver, timestamp and the hash of the stored design-pack bytes, so swapping the file in storage fails verification. A database trigger then refuses edits to an approved design, permits only the move to superseded once a successor exists, blocks deletes and takes an advisory lock so two simultaneous approvals cannot both win.

The audit table refuses update, delete and truncate for every role including its own owner. A plain revoke does not bind a table's owner in Postgres, so the protection is statement-level triggers, proved by a test that tries and fails. The migration lists what it cannot stop rather than implying it is airtight.

Grant rules, price bands, the kit list, VAT, savings assumptions and every line of customer copy live in settings rows, forty-two registered keys, each validated on read. A missing or malformed setting stops the quote rather than producing a plausible wrong number, and where a fact is unknown at enquiry the assumption is made in the customer's favour and shown on screen. Cost price is kept from the browser three ways: margin is applied server-side, a strict allow-list defines the public fields, and a test plants sentinel values and fails if one appears anywhere in the output.

A native module captures the room with the phone's LiDAR and uploads the model; it does no interpretation. The server works out the dominant wall angle, the smallest wall-aligned rectangle and a rectangularity score that flags L-shapes and bays, and it caps confidence below the threshold for standard routing, so a designer reads every scanned survey until the scans have been checked against a tape measure. Survey links carry only a hash in the database and travel in a header, never a URL, and the server recomputes every distance the phone shows.

Every call out (property registers, address lookup, mapping, SMS, email, smart-meter consent) goes through one wrapper that gives it a deterministic idempotency key, retries with jittered backoff and, on final failure, raises a task for the office instead of throwing. Failures are therefore visible to staff and typed for callers, and credentials are optional at build time so an environment can deploy before every vendor account exists.