How we compute what we compute.

This is the rule the whole product is built around, and it is architectural rather than aspirational. The financial engine is pure TypeScript with no network access and no model in it. It takes assumptions and returns statements.

A language model is allowed to do two things: propose assumptions before the engine runs, and describe what the engine produced after it has run. The prose is written against a facts block assembled from engine output, and a test asserts mechanically that every currency figure appearing in generated prose traces back to a value the engine computed.

• Assumptions in, statements out — the same inputs always give the same outputs
• No figure in a statement originates from a model
• Generated prose is reconciled against the model before export is allowed

The profit and loss, the cash flow and the balance sheet are computed together across sixty months. The balance sheet is asserted to balance in each one, and the assertion is not decorative: a randomised property test runs the engine over generated assumptions and checks that assets equal liabilities plus equity in every month of every run.

That test has caught two real defects that review did not. Rounding inside the amortisation ledger made principal repayments differ from the amount drawn; and a clamp on the debt balance was silently absorbing the resulting inconsistency. Both are gone. The ledger now runs at full precision and rounds only where a figure is displayed, and no balance is clamped to hide a contradiction.

The annual view of a flow — revenue, interest, wages — is the sum of the year's months. The annual view of a stock — cash, debt, any balance-sheet line — is the closing month's value.

Summing a stock as though it were a flow overstates it roughly twelvefold and still balances, so nothing downstream catches it. The two cases are separate functions in the code precisely so the choice has to be made deliberately at every row.

Every benchmark band carries a source, a vintage and a source tier, and an out-of-band assumption is flagged with all three rather than replaced by the median. Substituting an industry median would destroy the specificity that makes a plan credible — the point is to make you justify the difference, not to erase it.

Each band also declares which cost base it is quoted on. A restaurant's gross margin is published on food cost alone; a cleaning contractor's is published after the cleaners' wages, because the wages are the cost of the service. Comparing one against the other is wrong in both directions, and the validator reads whichever figure the band actually means.

Market research runs a live web search and keeps only what comes back with a retrievable http source and an ISO date. Anything else is dropped, including when the model returns it confidently — a guarantee that depends on a model following an instruction is not a guarantee.

When research is unavailable the researcher returns nothing at all and says why. It never composes a plausible-looking citation from what it remembers. That asymmetry with the prose generator is deliberate: prose assembled from figures the engine already computed invents nothing, but a source cannot be assembled from nothing, and a fabricated citation in a product whose headline promise is zero uncited claims would be the worst defect in it.

Every figure in the written plan that carries an explicit marker — a currency symbol, a percent sign, a multiplication sign, an employment noun — is extracted and matched against a value the engine computed. Export is blocked until they agree.

Two rules keep it from crying wolf, which would be worse than not checking at all. Tolerance is derived from how precisely the figure was written, so a number rounded to the nearest hundred is matched within fifty. And bare numbers are never checked, because they are years and street numbers far more often than they are claims.

Every driver captured at intake is tagged as something you told us, something you estimated, or an industry default, and that tag is rendered in the finished plan.

A document that visibly distinguishes the owner's own figure from the sector median is more credible than one that flattens both into confident prose — and it makes the charge of AI filler structurally impossible to level.

Coverage thresholds, equity injection minimums, loan ceilings, payroll loading, depreciation limits and investment minimums all live in configuration with an effective-date range, a source, a retrieval date and a confidence level. They are read through a function that returns whichever entry is in force on a given date.

This is not hypothetical. SOP 50 10 8.1 takes effect on 2026-10-01 and changes how acquisitions are underwritten; the EB-5 thresholds adjust on 2027-01-01. A product that hardcoded either would ship a wrong answer within a quarter, and would do it silently.