Architecture & Multi-State Reconnaissance

10-State Public Data Coverage Matrix (10 states)

County-Level Fallback Architecture

Each state may have a statewide adapter OR fall back to per-county adapters. Different jurisdictions can use different sources. All adapters normalize into the same internal model — no screen consumes state-specific schemas.

Normalized Multi-State Data Model

National-Ready Provider Registry

Only CT is LIVE. All others NOT_CONNECTED until explicitly approved + endpoint-verified. No faked nationwide coverage.

Phase 1P — Live Provider Verification (NY / NJ / OH / FL)

Coverage symbols: ✓ Available · — Not provided by this source (does NOT mean the real-world fact is absent) · ✗ Confirmed absent. OH owner/mailing/CAMA are blank in the public layer — marked source_unavailable, never false.

Multi-Tenant SaaS Architecture (Design Only)

Commercial Cost Model by User Count

All costs at 25+ users are UNKNOWN until vendor quotes obtained. No invented prices. At 1 user (current), verified cost = $0.

$97/Month Feasibility (Pricing Hypothesis)

$97/month is a PRICING HYPOTHESIS only — not hard-coded anywhere.

• • Cost-per-active-user must stay well below $97 to leave margin
• • Maps: free Esri/OSM tiles must cover Pro usage, OR a paid tier (Mapbox) must fit budget — UNKNOWN until usage measured
• • Geocoding: Census free tier covers low volume; paid geocoding needed at scale — cost UNKNOWN
• • Property data: $0 public GIS keeps cost near zero; paid enrichment (ATTOM/Regrid) would erode margin
• • Database + hosting: must stay on free/low tiers (D1/Supabase free → paid only at threshold)
• • Background jobs: platform cron at $0; scale cost UNKNOWN

Do NOT launch billing until cost-per-user is verified below the price point with margin.

Deal Tools & Documents Architecture

Workflow: Property → Deal Workspace → Calculators → Documents → Checklist → Offers → Closing → Outcomes

No third-party/proprietary templates redistributed until ownership/license confirmed. Spreadsheet formulas require independent golden-number regression before replacing spreadsheets. acquisition-calc.ts remains the authoritative financial engine — no competing engine.

Commercial Rights / IP Register

State-by-State Source Register (Verified Sources)

Phase 1Q — Commercial Rights Gate (3 Independent Dimensions)

A technically LIVE endpoint does NOT automatically become SaaS-approved. Three independent dimensions: technical (reachable?), commercial use (may we use it in a commercial product?), redistribution (may we cache/transform/redistribute inside a paid SaaS?). Silence in a license is NEVER permission.

Phase 1Q — Provider / Data Categories (8 Tracks)

Parcel/CAMA data is separated from investment intelligence. Public GIS gives geometry + assessment — it does NOT give equity, mortgage, foreclosure, listing, DOM, or vacancy. 1 of 8 categories operational (LIVE). The rest are RESEARCH_ONLY or NOT_CONNECTED.

Phase 1Q — Property Data Freshness Architecture

Phase 1Q — Property Watch Architecture (DESIGN ONLY)

Detection target: Detection within 24 hours of the event becoming available from the authorized source — TARGET, not current guarantee.

Current capability: Manual snapshot diff exists for CT CAMA fields (watch-snapshots.ts). User must manually trigger REFRESH. No automated monitoring, no notifications.

Phase 1Q — Paid Provider Research (DOCUMENTATION ONLY — NOT PURCHASED)

Phase 1Q — Property Data Freshness Target Register

For each signal track: the authoritative source, verified source update frequency, our engineering target detection time, and what we actually achieve today. Target ≠ guarantee. SOURCE FRESHNESS ≠ PLATFORM POLLING FREQUENCY.

Phase 1Q — Sources Required for ≤24h / Near-Real-Time Detection

What would need to be licensed + connected to hit the 24-hour detection target for the two highest-value event tracks. NONE purchased. NONE connected. All BLOCKED or conditional.

Phase 1Q — Property Watch Notification Architecture (DESIGN ONLY)

Target: Detect material property changes within 24 hours of the event becoming available from the authorized source — preferably much faster where legitimate near-real-time feeds permit.

Phase 1R — Durable Persistence + Property Event Ledger

Phase 1R — Durable Persistence Proof

NOT durable. localStorage is browser-only and does not survive server restart, rebuild, or redeploy. A durable binding (Cloudflare D1 or Supabase) is AVAILABLE but NOT configured. The Property Event Ledger uses the LocalStorageAdapter today so functionality works in-browser, but this is NOT production-durable persistence.

Phase 1R — Local Data Inventory & Migration Safety

Phase 1R — Property Event Ledger (Canonical)

A single provenance-preserving ledger for material property events. Both MANUAL verified events (today) and future AUTOMATED authorized feeds enter through the same ingestion contract — the manual workflow is simply one producer.

Phase 1R — Derived Opportunity Signals (Evidence-Based)

Events contribute to derived intelligence labels (PRE_FORECLOSURE, TAX_DISTRESS, etc.). Every signal carries its supporting events — never an opaque score. No AI scoring in Phase 1R. MULTIPLE_DISTRESS_SIGNALS activates when ≥2 distress categories are present.

Phase 1R — Provider Performance Benchmark (Architecture Only)

Intended use: Compare connected providers on the same signal track by source lag, platform detection lag, accuracy, duplicate rate, missing rate, and cost-per-useful-event — so Joseph can make evidence-based decisions BEFORE paying for data (e.g. 'Provider A costs $X but gets foreclosure events 18 hours earlier than B').

Phase 1R — Property Watch Prerequisite Update

The Property Event Ledger + ingestion contract are the foundation Property Watch will use when its prerequisites are met. Manual event capture is operational today; automated monitoring is not.

Phase 1S — Runtime Verification (Cloudflare Workers)

• • D1 is runtime-compatible (Workers binding) but NOT configured in this deployment.
• • No wrangler.toml, no d1_databases, no env var, no secret — confirmed by inspection.
• • A D1Adapter is implemented behind binding detection; it activates ONLY when detectD1Binding() finds a real bound D1Database.
• • Until a binding exists + a genuine restart/redeploy survival test passes, all lifecycle tests are UNVERIFIED_NOT_TESTABLE — never PASS.
• • Browser never receives DB credentials; all durable access goes through server functions (trust boundary).

Phase 1S — D1 Durable Adapter

Activation rule: Activates ONLY when detectD1Binding() finds a real bound D1Database. Never simulated. Never fake.

Phase 1S — Real Persistence Lifecycle Test

• • No durable backend configured in this deployment (no Postgres/Supabase secrets, no D1 binding). The lifecycle harness is implemented as server functions (writeLifecycleTest / readLifecycleTest) and will produce VERIFIED_PASS only after a real backend is configured + a genuine restart/redeploy is performed and readLifecycleTest is re-run.
• • Mocks, unit tests, in-memory DBs, localStorage, and simulated adapters do NOT count.

Phase 1S — Reversible Migration Harness

Safe path: BACKUP → INVENTORY → VALIDATE → DRY RUN → MIGRATE → VERIFY → RECONCILE. localStorage is never deleted after migration; rollback remains available. Production read path does not switch until verification succeeds.

Dry-run requires no binding; real migration is BLOCKED until a D1 binding is configured.

Phase 1S — Property Watch Prerequisite Update

• • Durable persistence NOT proven — D1Adapter implemented but no D1 binding configured (Phase 1S)
• • No scheduler
• • No notification infrastructure
• • No connected distress/event providers (all RESEARCH_ONLY or NOT_CONNECTED)
• • Commercial redistribution rights UNVERIFIED for all sources

Phase 1T — D1 Activation Status (BLOCKED: infrastructure action required)

Phase 1T — Server-Controlled Single-Tenant Context

The server determines Joseph's tenant context. Client-supplied tenantId is ignored for writes and cannot be used to read another tenant's data. This is NOT full multi-tenant authentication — it is a server-controlled single-tenant trust boundary appropriate to the current single-user MVP.

Enforcement: enforceTenant() coerces any client-supplied tenantId to the server-controlled tenant before every durable read/write. A client cannot read/write another tenant by changing tenantId. Tests prove substitution is rejected.

Phase 1T — Infrastructure Action Joseph Must Perform

1. In the Cloudflare dashboard, create a D1 database (free tier — $0). Name it e.g. ctres-acquisition.
2. Add a D1 binding to the deployed Worker. Binding name expected by the app: DB (also checks D1, DATABASE, CTRES_DB). The binding must be present in the Worker's environment.
3. Redeploy the Worker so the binding is injected into the runtime.
4. Tell Mak the binding is live. Mak will run writeLifecycleTest (writes a canary to real D1), then trigger a redeploy, then run readLifecycleTest to prove the same record survived.
5. Only after survival is VERIFIED_PASS will Mak run the safe migration (BACKUP → VALIDATE → DRY RUN → MIGRATE → VERIFY → RECONCILE) and switch the authoritative read path to D1. localStorage is retained as rollback.

No payment, no paid upgrade, no recurring charge required — D1 free tier covers the MVP. Do not enter billing information for a paid plan without explicit approval.