Data model

Choice:

• One chain: User → Identity → Document → Entry (user-identity-entry). One self identity per user holds PAN, DOB and name. Every identity sits in one of 12 buckets (identity-buckets).
• category (upload folder) and bucket (identity) are separate fields on purpose.
• Each confirmed document has a temporal anchor shaped by its category (ay | span | as_of | event | validity | none), not always an AY. A ledger entry's AY comes from its own transaction date.
• entry_type is a free string. Every type a mapper emits must be routed in ENTRY_TYPE_TO_BUCKET or listed as audit-only; the mapper-contract test fails otherwise.
• Dedup: byte hash of the upload, then a per-form instance key. A portfolio position id is ${holdingId}__${ay}.
• A review document that is fully recomputed is overwritten, never merge-written.

Why: each rule closed a silent-data bug: lost AYs, double counts, stale map keys.

Rejected: accounts/ with an account_type (replaced by identities) · one AY for every document · a strict entry_type enum (dead code) · unifying category and bucket · position ids per document (double NAV on re-upload) or per holding alone (lost history).