# Preferred date and private enquiry photos

The original v0.19 journey was checked on 29 October 2026. Current v0.20 format/size rules and still-pending picker/phone proof are in [the photo-format guide](ENQUIRY-PHOTO-FORMATS.md). The bounded anonymous enquiry flow is ready for further local testing with invented data. It is not approval of live SHS or full product parity. The separate gallery publication journey remains open.

## Send a test enquiry

1. Open a fictional business’s public website. A published service’s **Ask about this service** link fills in that service; the visitor may change it.
2. Enter invented contact details and a message. **Preferred date** is optional; use today or a later calendar date in Europe/London. It is a request only. It does not set the job target date, reserve staff or create a booking.
3. Optionally choose up to five PNG, JPEG, WebP or HEIC/HEIF still images. Each file may be at most 10 MiB, with 50 MiB combined, 12 megapixels and 12,000 pixels per side. Sequences and multiple main images are rejected. HEIF files have a named selection card and are checked on submission; ordinary formats keep previews. Removal controls remain; only the listed files are submitted. A rejected sixth file does not replace the existing selection.
4. Click **Send test enquiry**. Files remain in the browser until this single submission. Validation errors retain the entered date, details and valid photos. Reloading or closing an unfinished form loses its browser selection; select the files again.
5. If a request times out or its result is uncertain, keep the page open and use **Retry same enquiry**. Editing is paused so the original body and submission ID can be retried safely. A successful retry does not create another customer, job or photo set. **Try another enquiry** starts a deliberately separate submission.

The success view confirms local saving and says that no email was sent. It provides no private-record or image link. Reusing a name, email or phone number does not merge customers, attach photos to an existing job or create portal access.

## Review the saved enquiry

Open the exact job in the owner workspace. **Website enquiry as submitted** shows the original preferred date, contact facts, service, message and filenames. Those facts stay unchanged if the current customer record is edited or the job is deliberately reassigned. A blank submitted date says **Not supplied**; an older/manual job says **not recorded**, without inferring a date from a target or booking.

The five images appear under **Job photos**, initially private and awaiting owner review. Assigned staff cannot access visitor photos until the owner reviews them. Customer sharing and gallery publication require their existing separate owner actions. Original intake facts are not evidence of permission to publish.

Use **Back to workspace** before normal sign-out. The existing workspace guard treats any open job view as leave-sensitive, even without edits. During this rehearsal its JavaScript sign-out confirmation stalled browser control. A fresh owner tab had already reopened the saved enquiry successfully; the second-business browser sign-in and final tab closure were not verified. API checks separately denied exact foreign-business and anonymous access. This existing leave-guard behaviour remains an open UI issue.

## What was checked

The actual public UI created two Oak & Vale enquiries with matching invented contacts: one with no date/photos and one with **20 May 2031** plus five labelled synthetic PNG/JPEG/WebP images. They remained two different customers and jobs. Invalid-file and sixth-file rejection, removal/reselection, whitespace-message validation, a double-click retry, owner reopening and a fresh owner tab were observed. All five saved images loaded at 640 × 400 pixels, with no target date or booking created.

Installed files becoming cloud-only on this Mac interrupted the first image decode. There was no partial saved enquiry/photo set. The retained form succeeded with the same locked dependencies in a fresh local runtime. A 30-second request timeout was subsequently added and client-tested, including safe retry of the identical payload. The final built bundle was loaded by the fresh owner tab; an actual delayed browser-response timeout was not separately rehearsed.

All **662 backend tests, 125 client tests, 84 structural render checks and the build pass**. The backend tests cover wrong types/counts/sizes/pixels, corrupt and animated images, embedded location metadata, foreign IDs, exact-job/customer binding, rate and storage limits, concurrent/replayed submissions, handled file/SQL failure and permission transitions. A structural render is not a browser test. See [milestone checks](enquiry-milestone-checks.json), [saved-data recovery](enquiry-saved-data-recovery-check.json) and [four-business recovery](enquiry-recovery-drill.json). Actual screenshots and UI evidence are retained separately in `SHS-Enquiry-Verification-v0.19` outside the code archive.

## Storage and recovery

There is no anonymous upload endpoint, staging token or public media capability. All selected images are decoded and validated before record creation; accepted images are oriented, resized to fit 1800 × 1800 and written as fresh RGBA PNGs without source metadata. The existing private-photo routes require the correct business, job and permission. Filenames are original labels, never filesystem paths.

One transaction records the customer, job, immutable intake and photo provenance. Handled failure rolls back the records and removes only files created by that attempt. A hard crash between file writing and database commit can leave unreferenced files that cannot be retrieved through the app; a crash-cleanup journal and power-loss certification are not provided. Total converted bytes and per-business photo count/storage are bounded. Rate limits and validation do not establish production abuse protection.

Recovery now writes **format 12**, with exact pinned schemas 1–11. The actual stopped browser dataset restored into a fresh folder on this Mac: all 80 tables per business were compared, with only documented access/identity/audit changes; the original facts, five image files and existing history remained exact. Retrying both original submissions after restore created no additional records. The separate four-business disappearance drill preserved 20 visitor photos and older finance, field, document and feedback records. Restored visitor-photo review/sharing is suspended and projects using those photos are withdrawn until fresh owner review. Historical evidence remains; permissions are not revived. Existing non-visitor photo behaviour is unchanged. Old staff/customer access is rejected; a second-generation backup verified.

These are terminal/test-API recovery checks, not restored-browser or second-machine evidence. Runtime datasets, recovery archives, login files and synthetic fixture inputs are outside the code ZIP. Normal data was not opened or migrated, and the frozen owner review was not reloaded or signed out. Some protected files are now cloud-only and could not be rehashed; the [preservation report](enquiry-preservation-check.json) distinguishes verified bytes from unavailable files.

## Original SHS reference and remaining differences

The supplied `EnquiryPage.jsx`, enquiry models/router, public-file router and owner dialogs provided the reference for an optional preferred date and up to five photos. This stage is independently implemented; the original runtime, public upload mechanism, notification tasks and customer-merging behaviour are not imported. See [source mapping](enquiry-source-map.json).

The original UI advertised images up to 10 MB and accepted HEIC/HEIF. This bounded local decoder supports PNG/JPEG/WebP at 2 MiB each; HEIC/HEIF conversion remains outside the app. Wider route/content parity, gallery publication UI, real consent/legal wording, phone/touch/accessibility, offline/PWA behaviour, production identity, hosting, domains, delivery and load testing remain open. All 45 capabilities remain tracked and all 14 original SHS findings remain OPEN.