A stack list is a commodity. The reasoning is not.

The obvious way to encode this problem produces 691.2 million boolean variables and does not solve. Modelling it as one integer variable per lesson for slot, teacher and room — with channelling variables where the constraints need them — brings it to roughly 108,000 booleans. That is a 6,400-fold reduction, and it is the entire reason a ten-minute budget is plausible rather than fantasy.

The grid is sized at six working days by eight periods, not five by eight, because the default weekend here is Friday and Saturday and an institution that teaches on Saturday sets it differently. Sizing on the five-day case and discovering the six-day case in production is a specific failure this decision exists to prevent.

When a routine is impossible, the solver says which constraints make it impossible. Every relaxable constraint sits behind an assumption literal, so an infeasible model yields a minimal core that can be translated into a sentence: this class needs five periods a week, the only competent teacher is unavailable on two days, and here are the three things that would change it. A solver that says no without saying why is worse than the spreadsheet it replaced.

After a single change — one teacher’s availability, one room withdrawn — at least 90% of unchanged lessons must keep their slot, teacher and room. That is a hard requirement, checked in the build. A re-solve that moves four hundred lessons and reprints seventy teachers’ cards to accommodate one absence is technically correct and commercially fatal.

The same input with the same seed produces the same routine, every time. Parallel search is only deterministic when the worker count is fixed and interleaved search is on, so both are pinned — and so is the solver version, because upgrading it rewrites routines that nobody asked to change.

No screen in a capture flow makes a network call — including validation. Every piece of reference data the flow needs, from cause codes to medication catalogues to species standards, lives on the device.

There are two mechanisms, deliberately, because there are two jobs. The attendance app carries a hand-rolled append-only queue over browser storage with exactly one write shape, because it must not drag a sync SDK into a 250 KB budget. A unit test asserts that the queue’s type union has exactly one member, so adding a second write shape is a reviewed decision rather than a drift.

The field app carries a full sync engine with nine write shapes, a local database and deterministic conflict rules, because it holds a full route, batch state and historic visits and has to survive three days.

Sync conflicts resolve by rule, not by last-writer-wins. Last-writer-wins silently discards a record somebody drove to a farm to collect.

Reconciliation is three-way: the invoice, the gateway’s record of the attempt, and the settlement line the bank actually paid. Anything that does not match lands in an exceptions queue under one of nine codes, in one of four work queues, with an age on it.

Matching is exact, never probabilistic. A fuzzy match that silently attaches a payment to the wrong student is worse than a queue somebody has to work, because the first one is discovered by a parent and the second by a clerk.

Payment gateways sit behind an adapter with at least two implementations plus a manual method, because the commercial terms of any one gateway are not a thing to build an architecture around.

The institution is merchant of record and Nimikh is never in the flow of funds. That is not a design preference — aggregating payments in Bangladesh is a licensed activity with a capital requirement and personal liability attached.

Every send is priced before it is sent. A fee-due message is three parts in Bangla and two in English — the composer states that difference rather than quietly choosing the cheaper language on the reader’s behalf.

Messaging is prepaid into a per-institution wallet with a hard cap. Without the cap, one result day can consume an institution’s entire margin, and the institution would find out afterwards.

Consent is a ledger, not a checkbox. Who agreed to what, on which channel, when, and what they were told at the time.

Every tenant-scoped table carries a tenant id with a row-level security policy. Application-layer checks are a convenience; the database is the control.

The whole API test suite runs a second time as a foreign tenant, and must return zero rows and zero successful responses on every single resource. A failure there blocks the release, unconditionally.

Roles are assigned per user per scope, not globally. A coordinator for the morning shift cannot dispatch for the day shift.

Support access into a customer’s data requires an open ticket, a consent flag, a reason code, a time box — and the customer is notified before the access happens, not after.

In-country hosting here means colocation and a self-managed database, not a managed-service purchase. That is a real cost, and it is a cost a foreign vendor cannot avoid either.

Every record you gave us and every record we created for you, in open formats, self-serve, within fifteen minutes. Not a support ticket, not a data-liberation fee, not a quarterly export window.

One exception, stated here rather than in a footnote: biometric templates are not exported as templates, because they are non-portable by design and export-restricted. The export carries a signed inventory of what is held, and a purge certificate on request.

Every state change is attributed, timestamped and hash-chained. Nothing is silently changed, and the account owner can see all of it.

Detection runs on a box at the site. Only events, metadata and short clips leave. The whole ingest and restream layer is permissively licensed, and so is the detector — embedding a model on a customer’s hardware is distribution, and a copyleft licence there would oblige publishing the product.

A detection is validated over time and filtered by class before anyone is told about it. An operator interrupted for nothing stops responding to the alerts that matter, which turns a detection system into an expensive way of doing nothing.

No accuracy figure, no false-alarm-reduction percentage and no camera-per-box count is published before it is measured on the customer’s own cameras. There is no audited figure for this class of system, and a number that comes from somebody else’s site is a number about somebody else’s site.

Key screens are interactive within three seconds on a four-gigabyte Android over five megabits with 200 ms of latency, with the JavaScript on teacher and guardian paths capped at 250 KB compressed. Exceeding it fails the build.

Blur filters, backdrop filters and multi-layer shadows are banned outright. They force a composite layer and measure roughly four times slower on the GPUs that dominate the low-cost phone segment — so the visual language is built from type, rule and space instead.

Only transform and opacity ever animate, at most two elements at once, and lists over twenty items do not animate at all. Motion explains a spatial relationship or points at a change the reader did not cause. It never signals success, quality or brand.

Availability is committed at 99.5% in the first year — which is the honest number for a single in-country primary — but the promise that matters is different: no change is deployed inside a peak window, and the daily dispatch window between 07:00 and 08:15 is named in the contract alongside fee deadlines and result days.