Stop the app from misrepresenting NCARB results (audit Phase 0)

[Vito-bc]

What & Why

An external audit flagged that the app asserts things about the ARE that are not true. I verified every claim against the code and against ncarb.org before touching anything — most held, one did not (see below).

These fixes are the highest trust/store risk at the lowest cost (strings + config), so they ship first, ahead of the Coach and purchases work.

The app was lying

Claim in app	Reality (verified: NCARB)
"265 passing score on a 200–400 scale"	Scale is 100–800, pass 550; each item = 1 point
Calculator cut scores	3 of 6 sat BELOW NCARB's real range — PcM 58 (real 59–71), PA 60 (real 65–71), PPD 63 (real 65–71). The app told candidates "Likely Pass" while they were under the true bar.
Mock Exam "matches real NCARB division weights"	Real ARE = six separate exams, not one 65q mix
"PASS" / "Passing score achieved" at 70%	NCARB publishes no universal raw threshold
Dashboard "42% readiness"	Fabricated when Firebase was down, incl. a nonexistent "Structural Systems" section

Fixed: calculator now shows NCARB's published per-division ranges and a band (below / inside / above) instead of predicting a result → renamed Practice Score Check. Mock Exam → Multi-Division Diagnostic. PASS/FAIL → explicit practice benchmark, labelled as ours. Dashboard reports no data when it has none.

Correctness

• 14 flashcards had mojibake math/arrows (a previous fix caught only em-dashes): CO₂ ≠ ≤ ≥ ≈ − span⁴ depth³. Repair is a strict cp1252→utf-8 round-trip — it only succeeds on genuine damage, so the legitimate × in "16×" was correctly left untouched.
• App version was hardcoded 1.0.0 while pubspec said 1.3.0+17 → now read from package metadata, so it can't drift again.
• README promised 1,100 questions (bank is 1,082), SM-2 flashcards (it's fresh/learning/mastered), and a light theme (app is dark-only).

Question-audit tool

The architect worklist told Maryana 692 questions was "~3–4 hours". It's ~23. That was my arithmetic bug and it set her up to fail. Fixed, and added a priority queue so she doesn't do all 692:

• 🔴 RED 127 — needs a licensed architect (answer/explanation/citation conflict, worst-scored, duplicates)
• 🟡 YELLOW 447 — AI proposes the fix, she only approves
• 🟢 GREEN 118 — spot-check 10–15%

Also documented: don't rewrite a question just for being factual — the real ARE tests facts too.

RAG corpus

The 2020 NYC Energy Code was superseded by the 2025 NYCECC (enforced since 2026-03-30) — we had ingested the dead edition. Swapped in 2025 NYCECC C3/C4/C5 plus NYC's adopted ASHRAE 90.1 (which also closes a gap we thought needed a paid textbook). Corpus: 26 PDFs / 3,441 chunks. Added an edition currency section to SOURCES.md so this gets checked before each generation run.

Where the audit was wrong

It claimed the worklist "must be regenerated after dedup". Verified: 0 stale IDs — it was already post-dedup. No action taken.

Checklist

• flutter analyze returns 0 issues
• flutter test passes (89/89)
• No secrets or API keys committed (.env / PDFs / backups gitignored, diff scanned)
• Firestore rules updated if schema changed — n/a
• README / docs updated

Not in this PR (next)

Coach (→ Claude + RAG), Android paywall (→ disable), premium-forever entitlement, npm vulns, lastActiveAt silent failure.

🤖 Generated with Claude Code