# Full white-label parity and gap register

Current bounded stage: **v0.25 guarded correction of an exact mistaken whole-customer merge**. See [guide](MERGE-CORRECTION.md), [source map](merge-correction-source-map.json) and [checks](merge-correction-checks.json). Only CUS02's implementation/automated/gap/next-stage axes advance; its native authenticated UI evidence remains historical. The other44 capability objects and all14 original findings are preserved. The separately completed v0.23 owner-note walkthrough is an external supplement, not v0.25 browser proof. Phone, full offline, second-machine recovery and live approval remain open.

Preserved checkpoint: **v0.21.0**, the first local PWA installation/offline-fallback/update slice. Public desktop browser checks passed, including failed installs, two-tab draft/uncertain-save protection, no reconnect replay, deliberate update, old/new asset coexistence and neutral fallback. **181 client tests, 89 structural renders, 22 selected backend tests and build passed.** See [the PWA guide](PWA-INSTALL-OFFLINE-AND-UPDATES.md) and [checks](pwa-milestone-checks.json). Recovery format 12, backup metadata 0.20.0 and dependencies are unchanged. PWA01 remains partial; phone/authenticated/offline-queue/push/production work and all 14 original findings remain open. The previously pending v0.20.2 holiday-label browser check passed after Sandy’s explicit permission; its original ZIP and report are preserved, with a separate supplement.

Preserved historical checkpoint: v0.18. The [website browser journey](WEBSITE-WORKFLOW-WALKTHROUGH.md) verifies editing, draft/publication separation, service enquiries, history restoration and four repairs, with bounded browser/recovery evidence. Earlier checkpoints remain preserved. All 45 capabilities remain in scope and all 14 original findings remain OPEN.

The end target is one maintained white-label version matching or improving the useful journeys and functions of the original SHS public website, customer portal and staff/admin PWA. A small runnable demo is a checkpoint, not the final scope. “Better” means a documented safety, reliability or usability improvement that preserves the original purpose. No feature is silently removed because it is SHS-specific.

This register uses the downloaded filtered source only. It indexes all 275 supplied files, 283 declared backend routes, 19 frontend routes and 217 named nested UI actions. The machine-readable [inventory](PARITY-INVENTORY.json) retains file/line pointers for each. Counts are source declarations, not proof that a deployed route works. Route-level entries deliberately remain unapproved until individually compared; a module-level partial implementation never certifies all its routes. 0 backend declarations have no capability mapping yet and remain explicitly listed for follow-up.

Status axes are separate: **source-evidenced**, **implemented/partial/missing**, **automated-tested**, **UI-verified**, **integration-dependent** and **needs a decision**. The table states implementation/UI/gaps; per-capability automated evidence is recorded in JSON and VERIFICATION.md. Existing browser evidence applies only to the versions and flows actually checked. Only explicitly listed browser journeys are verified; broader website, field, recurrence, customer and device checks remain. The v0.19.1 final-package closeout passed eleven further workflow groups; selected-file controls and old QA-tab cleanup remain blocked by browser control. No unlock or setting question is pending. See the updated v0.19.1 guide.

| ID / capability | Current implementation | UI evidence | Remaining scope / decision |
| --- | --- | --- | --- |
| WEB01 — Public home, about, service pages and enquiry journey | Implemented local core | v0.19 anonymous optional-date and zero/five-photo enquiries saved, validation retained inputs, and owner/fresh-tab reopening showed original facts and five private decoded images. Matching contacts stayed separate. A later external v0.19 Browser-Closeout record completed second-business sign-in and tab cleanup; API denials passed. The v0.19.1 final bundle passed eleven additional workflow groups; selected-file controls and old QA-tab cleanup remain unverified. | v0.20 private PNG/JPEG/WebP/HEVC-HEIF still intake uses five files at 10 MiB each / 50 MiB total; browser picker and real-phone proof pending. Explicit 12 MP/12000-side, sequence/multi-main-image/AVIF/other-codec gaps remain. Full route/content parity, gallery journey, devices and production remain open. |
| WEB02 — Website content editing, rich text, branding, navigation and publication | Implemented local core | v0.18 branding/logo/colours, page/service/menu edits, save/reopen, private preview, publish, hide, history-to-draft, explicit republish, stale save and bounded leave modal verified. Preview and other owner window clear after same-origin sign-out. | One structured maintained layout with distinct saved draft/publication, private images and version history. Safe typed sections replace executable HTML. Rich formatting, themes, redirects, wider section/order/gallery cases and general owner expiry/device behaviour remain. |
| WEB03 — Gallery collections, service galleries, captions and public media | Implemented local core | v0.20.1 actual Chrome: owner private photo edit/validation/review, separate customer share/unshare, exact-job public draft, validation/permission, index/detail/service/lightbox, stale save retention, draft/public split, withdrawal, archive/restore, history-to-draft, re-review and republication. Private preview sign-out text/viewer leak repaired and retested; foreign-business preview denied. API-seeded source photos are not browser upload proof. Staff/customer portal browser branches remain unverified. | Separately authored project drafts, reviewed photos/library selections, page URLs, categories/order, before-after pairs, public index/detail/related projects/service associations, escaped metadata, publish/withdraw/history-to-draft are implemented. Current-publication-only image routes stop new reads after withdrawal; historical images remain private. All local pages stay noindex. No raw HTML, automatic copy or generated copy; visual/accessibility/phone/crawler verification and production publishing remain. Actual new-format picker and selected-file controls, staff/customer browser journeys, related/multiple-project and website-library browser cases, GIF/TIFF/BMP and other format/device/offline/source parity gaps remain open, not agreed exclusions. Withdrawal returns a plain JSON 404; branded handling remains a usability improvement. |
| WEB04 — Feedback requests, ratings, moderation and approved public reviews | Implemented local core | v0.17 exact matching-contact requests, private answers/default-off permission, customer preview/replacement, deliberate owner publication, withdrawal/stale rejection, harmless metadata preservation, material contact suspension, renewed access, history/reload and 689px keyboard panel verified. Revoked-view clearing and owner-list refresh repaired and retested. | Local feedback core is browser-verified within the bounded three-response journey; original answers and exact permission lineage survive recovery, with old access invalidated and publications hidden. Customer code view intentionally omits job/contact details; owner/saved/API binding checked. Broader expiry/archive/portal feedback/theme/history/device cases remain. Real delivery/identity, external/manual review imports, retention/legal policy and production wording/hosting remain open. Original R06 remains OPEN. |
| WEB05 — SEO, social previews, sitemap, legal/privacy/cookie pages and consent | Partial | v0.18 draft/private metadata separation, published canonical/robots/sitemap and real 404 verified by HTTP/API; branded missing page also observed in browser. | Published-only metadata/sitemaps and local noindex remain. Private draft metadata is excluded. Owner legal placeholders remain unpublished; real reviewed policies/consent, structured data, production origins/domains and actual crawler/device validation remain. No tracking or embeds installed. |
| JOB01 — Enquiries, pipeline, stages, priorities/tags, dates, private notes and next actions | Implemented local core | v0.13 save/reload, combined filters/counts, private metadata, exact IDs, stale-save draft retention and 689px keyboard navigation verified. Wider job/staff/mobile flows remain. v0.16 direct-invoice-only linked-document empty state repaired and verified. v0.19.1 clean open/history/sign-out, reversion/equivalent tags, 422/409 retention, corrected save/reopen, one explicit discard logout and quote Keep editing passed in private QA. Final-bundle quote, Materials, time, photo-text, customer-review and enquiry draft/save-lock checks passed. Selected-file controls and old QA-tab cleanup remain unverified. | Adds versioned priority/tags, next action/dates, contact/completion dates, private notes, guarded archive and retained workflow history. Search/filter counts describe exact matches. Job stage stays separate from documents/payments; old unknown completion dates stay unknown. Wider bulk pipeline controls and full field/staff/device parity remain. Final-bundle nested draft and save locks have browser evidence except selected-file retention/Clear/discard; QA-tab cleanup remains pending. |
| CUS01 — Customer search/create/edit/reuse, exact-ID history and job links | Implemented local core; broader verification remains | v0.14 note save, Keep editing, exact history, filtered export button, reopened original/retained documents and unchanged balances verified. Download file bytes and broader customer UI remain. | Adds state/search views, owner-private notes, consolidated exact history and bounded formula-safe CSV. Archive/restore guards preserve evidence and revoke permissions. No generic customer import, deletion or accounting reconciliation; larger datasets and broader UI remain. |
| CUS02 — Duplicate detection, review, merge, reassignment and backfill | Guarded exact-merge separation and repeated selected-job corrections implemented locally; wider duplicate/import parity remains partial | v0.14 keep-separate decision, exact merge and evidenced completion-date review saved; retained alias and date reopened. Selected-job, stale/conflict and re-invitation UI remain. | Exact saved-merge review can reactivate its original unchanged alias and append explicitly selected eligible return moves. All original jobs, later owners, excluded and unrelated retained work remain visible. Contact restoration is explicit per field and blocked by a later different value. Both accounts/sharing are revoked; old recurrence, follow-up and device-note scopes do not return. Format14 retains original merge evidence and migrates genuine format13 with pinned old validators. Mixed invalid batches and stale access/work are atomic rejections. Transitive whole-customer separation, arbitrary unmerge/import/generic backfill/deletion, larger datasets and wider browser/device/live approval remain open. |
| DOC01 — Draft quotes, line items, fractional quantities, notes and validity dates | Implemented local core | v0.12.1 simple owner private draft save/reload verified; wider document editor states pending. | Versioned draft editing, fractional quantities (3 decimals), per-line half-up pence and subtotal VAT arithmetic; dates and notes. Source pricing assistance and all formatting/options remain to compare. |
| DOC02 — Quote share/accept, revisions, supersession, cancellation and history | Implemented local core | v0.12.1 owner share, customer accept/decline, reload/history, owner revision and stale-response rejection verified; expiry/cancellation/wider controls pending. | Exact current shared quote accept/decline records snapshot, version, actor, time, saved wording and optional acknowledgement. Expired, stale, superseded and concurrent responses are guarded. Source reservations survive decline until owner revision/cancellation. Typed names are a local extension, not certified signatures. Real legal wording, delivery and browser checks remain. |
| DOC03 — Invoice drafts, direct job invoices, accepted-quote conversion, issue and due dates | Implemented local core | v0.16 source-reviewed direct invoice draft, reopen, explicit issue and restart verified. Accepted-quote/stage alternatives retain earlier evidence and wider gaps. | Private drafts require explicit local issue. Issued content is sealed. Existing v0.4 invoices migrate as issued with portal access and receipts retained. Real invoice/VAT settings remain a release gate. |
| DOC04 — Payments, methods/dates, allocation, partial balances and status | Implemented local core | v0.16 invented GBP 20 manual receipt against GBP 46 invoice gives GBP 26 balance after reload/restart/restore. No bank or payment integration. | One integer-pence receipt ledger; retries/concurrency and allocations are tested. No charges, bank reconciliation or money movement. Job operational stage remains separate. |
| DOC05 — Deposit and multi-stage payment plans, requests, printing and stage status | Partial | v0.5 UI pending | Percentage deposit helper, fixed stages, due dates, local requests and ledger-derived status work. Requests add no invoice/revenue. Plans lock after request/receipt; negotiated replanning and automated reminders are missing. |
| DOC06 — Cancellation, void, invoice replacement, payment-record correction, credits/refunds | Partial | v0.5 UI pending | Reasoned cancellation/void and unpaid replacement preserve originals. Mistaken receipt reversal/replacement is atomic and audited. Real credit notes, refunds, chargebacks and settlement policy remain unresolved; paid invoices cannot simply be voided. |
| DOC07 — Unique numbering, private document views, PDF/print, delivery and reference rules | Partial | Prior owner/accepted-quote downloads retained. v0.16 actual owner download of customer-facing invoice PDF retrieved, rendered and privacy checked. Customer invoice/stage downloads and browser print remain. | Private authenticated in-memory PDFs retain exact-pence snapshots and historical logos with a separate current status/balance summary. Sealed stage requests are not additional invoices. Configurable prefixes/year and non-resetting counters preserve references. Real delivery, certified signatures, browser/mobile layouts and wider localisation remain. |
| DOC08 — Invoice bulk upload, OCR, bulk dates, historical rename and material extraction | Integration-dependent / missing | Not verified | No OCR/AI/storage calls. Preserve review, rollback and provenance requirements; SHS historical cut-offs must become configuration or an explicit product decision. |
| DOC09 — Suggested lines and invoice generation from jobs, time, materials or field logs | Implemented local core | v0.16 explicit blank-to-priced field/material sources, private draft, save refresh, duplicate reservation denial and issued source history verified. | Exact-job field/manual-time/received-material suggestions; explicit customer prices; whole-source reservations; private drafts with sourced/manual lines; stale-source review; revision, invoice/replacement transfers and cancel/void release are implemented and tested. No automatic issue/send. Partial-source billing, equivalent manual-charge detection, paid credits/refunds and full interactive checks remain. |
| MAT01 — Job materials tracker, fractional quantities, stages/dates, archive and bulk actions | Implemented local core | Historical v0.2 desktop; v0.12.1 saved job snapshot, reload/reopen and unchanged close verified. Other tracker controls not repeated. v0.16 received material saved through UI and included once in reviewed invoice sources. | Manual tracker, job panel, historical scope and stage summaries tested. External extraction/backfill remains missing. |
| MAT02 — Reusable catalogue, supplier/SKU/default prices and saved job snapshots | Implemented local core | v0.12.1 visible create/edit, real dirty warning, Keep editing, rejected-save retention, saved prices/reload and add-to-job verified. | Versioned catalogue, archive/history and snapshots tested. Charge reference never silently feeds billing. |
| MAT03 — Supplier references, prices/dates, reviewed CSV import and supplier order export | Partial | v0.2 paste/preview and private order view | Manual links and cost-free printable order view work. File chooser, real print/PDF and direct PDF generation remain unverified/missing. |
| TIME01 — Manual time, internal rate snapshots, correction/history and job cost views | Partial | Prior manual checks retained. v0.16 real short capture, reasoned fictional correction, one saved-rate conversion, accurate labour-origin controls and GBP 22.50 work-cost view verified. | Manual time plus owner-reviewed field conversions use saved resources/rates, London-date half-up minutes, active-generation links, capacity checks and correction history. Internal costs remain separate from customer prices; field source cannot also be billed as its generated time entries. Payroll, overhead/VAT/accounting profit, semantic duplicate manual time and broader UI rehearsal remain. |
| CAL01 — Day/week/team bookings, multi-day work, unavailable time and conflicts | Partial | v0.3 selected manual flows; v0.10 UI pending v0.16 exact-job/person booking created through UI and retained after restore. | Day/week/month and bounded range, team/job/archive filters, actual-UTC conflicts, multi-day/unavailable bookings and generated-origin links are implemented. Recurring edits go through review. Drag/drop, calendar print/share, external sync/notifications and interactive phone checks remain. |
| CAL02 — Recurring contracts, generated bookings, conflict review, holiday blocks and restore | Implemented local core | Actual desktop Chrome v0.20.1: exact definition/people, 422 and leave retention, finite weekly generation, conflict/calendar correction, 409 stale retention, no duplicates, stable moved visit, cancellation without resurrection, overlapping blocks, future revision, pause/retire/restore/resume, protected past/completed history, monthly last-day/GMT/BST and spring gap skip, archived resource denial, history and empty second business. The final packaged v0.20.2 removed-holiday label passed after direct user permission; external supplement preserves the immutable historical package/report. | Five finite patterns and London policies implemented; weekly/monthly/spring-clock UI representative only, other date edges automated. Staff/portal, phone/accessibility/offline, specialist rates/batch billing, source-specific block types, visit-linked field stages, external calendars and production remain open. Legacy work not guessed onto occurrences. Raw saved-review JSON needs a more readable presentation. No automatic work/billing/messages. |
| FIELD01 — Site Mode active jobs, logs, timer, photos, team size and invoice preview/generation | Partial | Prior v0.16 journey retained; v0.22 API/state-machine/recovery plus actual anonymous IndexedDB/two-tab/reload tests pass. Signed-in new UI unverified. | Typed encrypted private text-note retention and deliberate duplicate-safe retry added. Materials/photos/team/timers/reconstructed time, invoices/payments, portal replies and generic replay remain OPEN; see DEVICE-NOTES.md.  v0.23 adds cancellation and ordinary saved-log correction; actual React DOM and Chrome storage evidence only; private UI pending. |
| PHOTO01 — Private job photos, captions, categorisation, before/after and gallery promotion | Implemented bounded local core; v0.20 public enquiry HEIF/size path added separately from unchanged authenticated uploads | v0.20.1 actual Chrome: owner private photo edit/validation/review, separate customer share/unshare, exact-job public draft, validation/permission, index/detail/service/lightbox, stale save retention, draft/public split, withdrawal, archive/restore, history-to-draft, re-review and republication. Private preview sign-out text/viewer leak repaired and retested; foreign-business preview denied. API-seeded source photos are not browser upload proof. Staff/customer portal browser branches remain unverified. | Exact-job private PNG/JPEG/WebP uploads, metadata stripping, captions/descriptions/category/stages/order/comparisons, assigned-staff submission, owner review/history, explicit customer sharing and reversible archive are implemented and API tested. No arbitrary URLs, destructive deletes, cross-job moves, source name-to-caption promotion or automatic publication. Wider field/offline/media formats remain. Actual new-format picker and selected-file controls, staff/customer browser journeys, related/multiple-project and website-library browser cases, GIF/TIFF/BMP and other format/device/offline/source parity gaps remain open, not agreed exclusions. Withdrawal returns a plain JSON 404; branded handling remains a usability improvement. |
| PORTAL01 — Customer dashboard, jobs, documents, acceptance, setup and account access | Implemented local core | v0.12.1 setup/sign-in, exact-customer projection and isolation verified; v0.12.2 reissued setup, automatic revocation clearing and valid-check draft preservation verified. Recovery/contact-change/expiry and wider switching remain. | Exact Portal ID/password setup and recovery, protected .example captures, expiring hashed one-use codes, revocation, own jobs/progress/shared photos and shared/issued document history are implemented. No name/email joins or email verification claim. Permanent old codes are invalidated; legacy temporary codes work once. Deliberate quote responses and private downloads work locally. Production identity/delivery, usability, accessibility and mobile checks remain. v0.12.2 adds access-change/focus/visibility/periodic revalidation and private-content clearing; valid checks preserve response drafts. Cross-device/background timing remains unverified. |
| AUTH01 — Owner/staff accounts, invitations, roles, password changes and recovery | Implemented local core | v0.7 UI pending | Exact owner/staff memberships, explicit scheduling-resource links, local single-use invitation/reset capture, existing-account password proof, last-owner protection and immediate subsequent-session revocation are implemented. Every endpoint has an explicit default-deny policy. Production identity/email verification, MFA, custom/support roles and broader staff tools remain. |
| REPORT01 — Revenue/service/customer/team analytics, funnels, tags and metric definitions | Implemented local reporting core; broader scope partial | v0.15 detailed reports/three CSVs retained. v0.16 Overview link, converted time once, direct-invoice cohort, receipt/balance and actual summary CSV verified. | Current open quote/job eligibility now shared by Overview, Operations and Reports; original GBP 160/120 fixture now agrees at GBP 120 with no record rewrites. All-date Overview receipts remain distinct from period receipts. Historical accounting, traffic, tax/payroll/forecasts, large-scale reporting and broader device/error UI remain. |
| GROWTH01 — Repeat customers, quote follow-ups, review opportunities and nearby jobs | Implemented local review core; broader scope partial | v0.13 local draft, snooze, dismissal persistence, reopening, manual completion, five-event history, settings reload and separate-business queue verified. Quote/repeat/postcode eligibility rules are API tested; wider UI paths remain. | Exact-ID repeat-customer, current quote, feedback-history and next-action rules feed a private owner review queue. Optional saved postcode-group matching is explicit, with no inferred distance/geocoder. Business thresholds/exclusions, stable source generations, stale/concurrent/retry guards and decision history exist. No AI, scheduler, delivery or automatic finance/job mutation. Real transport, genuine location/distance planning and broader growth analytics remain. |
| GILBERTS01 — Gilberts rates, shifts, weekly summaries, schedule and batch invoicing | Needs decision / missing | Not verified | Retain CNC/maintenance and contract-specific purpose. Prefer configurable contract rates/shifts/batch billing, or explicitly agree a private extension; no silent omission. |
| TAX01 — Tax reports, invoice/material classifications and historic rules | Needs decision / missing | Not verified | Inventory remains in scope. Separate SHS cut-offs/exclusions from configurable reporting; obtain appropriate professional policy review before real tax use. |
| AI01 — Business chat, writing, quote estimates/follow-ups and insights | Integration-dependent / missing | Not verified | External calls stay disabled. Retain purposes and specify provider, cost, business scoping and review-before-write. No live provider decision made. |
| GOOGLE01 — Google account linking, Drive storage, calendar/contact/email integration | Integration-dependent / missing | Not verified | No live accounts or fallback credentials. Rebuild explicit per-business grants, scoped files and revocation; source R01/R04 remain open. |
| CONNECT01 — ChatGPT connector, connection tokens, scoped data and revocation | Integration-dependent / missing | Not verified | Source connector is inventoried, not enabled. Separate approval/scoping and credential lifecycle are required. |
| EMAIL01 — Email delivery guards, test capture, diagnostics and controlled transport | Integration-dependent / partial mock | v0.7 capture API/CLI tested; UI pending | No real delivery. Invitations are one-time owner response captures; password recovery uses private local mock files excluded from packages/backups. Hashed, scoped, expiring single-use tokens and generic reset responses are tested. Verified addresses, actual transport, diagnostics and production recovery remain. |
| SETTINGS01 — Business identity, pricing, document wording, team and integration settings | Partial | v0.11 snapshot/config tests pass; UI pending | Private payment instructions, acknowledgement wording, reference prefixes/year/digits apply to new documents. Existing historical branding/terms remain sealed. Published identity/defaults and owner/staff memberships remain. General pricing, specialist rates, custom roles and integrations remain. |
| STORAGE01 — Owned files, storage diagnostics, orphan review and safe cleanup | Partial | Website images earlier checked | Owned website PNGs only. Storage usage/orphan reports and reviewed cleanup are missing; preserve dependencies and IDs before deleting. |
| PWA01 — Installable PWA, service worker updates, offline field queue and push | Partial | v0.21 public browser evidence retained. v0.22 exact store verified in Chrome with no account/session; private/device/phone journeys unverified. | Account/job/device-bound encrypted text notes, correction fences and explicit retry added. No automatic reconnect submission. Full offline workflows, push, device installation, production key/retention policy and external integration remain OPEN.  v0.23 adds cancellation and ordinary saved-log correction; actual React DOM and Chrome storage evidence only; private UI pending. |
| WHITE01 — Empty business provisioning, isolated data, branding and one maintained product | Partial | v0.7 UI pending; multi-business APIs tested | Signed-in owners can provision additional empty invented businesses and switch existing memberships. Safe slugs, concurrent/retried creation and partial-filesystem recovery are tested. Up to 25 local businesses are bounded; four-business recovery is verified. Real subscribers, module entitlements and production architecture remain. |
| WHITE02 — Subscriber-owned domains, ownership verification, routing, HTTPS and email preservation | Integration-dependent / missing | Simulator only | Only .test mapping is implemented. Real DNS, hosting, certificates, domain ownership and disconnect flows are not authorised or tested. |
| WHITE03 — Trial/subscription lifecycle, entitlement, cancellation and support operations | Needs decision / missing | Not verified | Pricing/trial policy, paid accounts, billing provider, limits and support commitments remain undecided. Invoice receipts are not subscription billing. |
| TRAIN01 — Assisted setup, checklists, concise help and task videos | Partial | v0.19 practical enquiry date/photo guide records actual input/error/save/reopen evidence, recovery, size/format differences, runtime cloud-file interruption and remaining leave-dialog/UI gaps; prior guides retained. v0.20.1 gallery walkthrough/evidence now records the completed bounded owner journey, preview repair and recovery; older selected-file and Incognito cleanup gaps remain. | Dialog dismissal and test-tab cleanup pending; broader assisted setup, accessibility/phone checks and captioned task videos remain. |
| RECOVERY01 — Backup, verification, fresh restore, migration, export and operational recovery | Partial | v0.19 stopped UI-created enquiries/photos restored and replayed without duplicates through terminal/test APIs. Four-business disappearance preserved original facts, photo bytes and older finance/field/document/feedback histories; permissions suspended. No restored-browser or second-machine claim. v0.20.1 exact gallery-browser dataset restored into a fresh folder; all media bytes/original facts/history retained, sharing/review suspended, gallery withdrawn, old sessions denied and second generation verified. Same-Mac terminal/API proof only. | Format 12 adds immutable intake facts and photo provenance; restored visitor-photo review/sharing is suspended and affected public projects withdrawn. Older finance/field/document/feedback evidence remains. Encrypted/off-device/production recovery, restored-browser and another-machine rehearsal remain. |
| SOURCE01 — Complete source/assets/deployment knowledge and rights/provenance | Needs evidence | Source-only; live unverified | Filtered source is not a complete original export. Missing static media/root configuration/runtime settings and rights evidence remain; source tests are never run. v0.20 native wheel/licence implications and exact hashes are recorded in enquiry-format-dependencies.json; commercial native distribution remains a decision. |
| SECURITY01 — All 14 original findings and independent trial/release security checks | Open against original | Only stated local regression tests | New equivalents have some tested controls; none fixes the deployed SHS system. Production auth, roles, storage, integrations, dependencies and independent review remain gates. |

## Source sections and nested actions

Public routes include the landing page, enquiry, About, per-service page, feedback, reviews, customer portal/setup, admin login/sections, gallery index/detail, privacy, terms, cookies and not-found handling. The JSON lists every supplied page and component file as well as its declared routes/actions. Nested document dialogs, deposit configuration, PaymentScheduleEditor, bulk invoice dates/OCR, material extraction, duplicate review, Site Mode logs/timers/photos/invoicing, recurrence holiday blocks and specialist batch invoices are retained separately from sidebar navigation.

Two earlier inventory descriptions are corrected from source: `opportunities.py` implements repeat-customer, quote-follow-up, review and nearby-work suggestions; it is not a procurement service. `maintenance.py` handles orphaned-upload review/cleanup; recurring contracts are in `calendar.py`. These corrections do not remove either purpose.

## Original security findings — all remain open

These rows retain the original review mapping. Current independent-product browser evidence is recorded in the capability table and v0.18 walkthrough above; it does not close any original finding.

| Finding | Original SHS status | New local equivalent / remaining work |
| --- | --- | --- |
| R01 The Drive proxy can serve private files without authentication | Open; production unchanged | No Drive proxy; only explicitly published owned PNGs are public. Production storage/integrations still missing. |
| R02 Generated invoices and quotes have predictable public file URLs | Open; production unchanged | Private PDFs authorise exact business/customer/state per download, retaining saved content and separate current summaries. Artifact QA passes; browser download/print is unverified. |
| R03 Public uploads can become active content on the SHS origin | Open; production unchanged | Image decoding/re-encoding and bounds in the local website upload path; future job/files endpoints need the same controls. |
| R04 Google account linking trusts an unverified administrator ID | Open; production unchanged | Google linking absent/disabled; safe per-business OAuth still required. |
| R05 Portal document access is based on name or email patterns | Open; production unchanged | Exact immutable customer/job/business links, scoped portal reads and cross-customer tests; no name/email authorisation. |
| R06 Public review feeds return private feedback fields | Open; production unchanged | v0.12 uses fixed name/statement/optional-rating public projection, separate customer permission, deliberate owner publication and withdrawal/recovery guards; private answers never serialized publicly. API/HTML sentinel tests pass. New UI/delivery/policy remain unverified. Original R06 remains OPEN. |
| R07 Payment updates can lose entries or count retries twice | Open; production unchanged | One transactional payment ledger, idempotency, stale-version checks, derived stage balances, concurrency and reversal tests in v0.5. |
| R08 The dependency manifest pins a vulnerable Starlette version | Open; production unchanged | Pinned ReportLab 4.4.9, pypdf 6.10.0 and charset-normalizer 3.5.2 added; bundled DejaVu licences/hashes included. Comprehensive advisory/production dependency review remains. |
| R09 Access revocation does not cover existing sessions | Open; production unchanged | Local membership disable/role/resource changes revoke business sessions; password/reset changes revoke all account sessions. Last-owner and cross-business controls are tested. Production identity remains open. |
| R10 Forgot-password creates a token but never delivers it | Open; production unchanged | No real recovery email. Local scoped expiring single-use hashed invite/reset tokens, generic responses, private capture and restore invalidation are tested. Production delivery, verification and recovery policy remain open. |
| R11 The offline queue can lose work or replay it twice | Open; production unchanged | No offline queue implemented. Future queue must scope accounts/jobs, remove acknowledged IDs only and preserve new entries. |
| R12 Security controls are optional and do not cover every client path | Open; production unchanged | Same-origin/CSRF policy covers local writes and one client is used. Production policy and every future integration still require checks. |
| R13 The supplied tests are not safely isolated by default | Open; production unchanged | Tests use generated fictional data/disposable folders only; original tests/startup/credentials are not run. |
| R14 Automatic PWA updates can discard unsaved editing | Open; production unchanged | Independent v0.21 first slice has deliberate coordinated updates and tested public draft/save protection. Original deployed SHS remains unchanged; authenticated/device/production update branches remain. |

## Trial and release gates

A feature checkpoint can be runnable without being trial-ready. Before a real-user trial, verify complete source/asset provenance and missing configuration, subscriber provisioning with empty records, staff/owner/customer roles and recovery, every business boundary, real document/billing policies, full website/portal/field journeys, accessibility and phone/PWA use, storage/export/restore, dependency review and operational support. Test clean installation and recovery on another machine. Keep integrations mocked until separately authorised test environments and accounts are available.

Assisted onboarding must be rehearsed with a new fictional business: identity, business/document settings, logo/photos, pages/navigation, preview/publish, staff permissions, enquiry-to-payment, field work, help and recovery. Deliver concise instructions plus short captioned task videos. Paid trials, real-user onboarding, public domains/HTTPS, subscription billing and production deployment remain separate decisions/actions, not consequences of local completion.

Missing source/assets remain a recorded completeness gap: this 275-file export omits real media, runtime secrets/settings, installed/generated directories and some project/build/static assets. No real customer export is requested. New placeholder assets and invented records must be clearly labelled; SHS testimonials/photos are not seed data. Rights/licensing, venture structure/shares, grant eligibility and production operating budget remain undecided. Actual development began 27 October 2026.

## Next staged work

The v0.20.1 bounded photo-to-gallery owner journey and preview repair are saved with browser/API/recovery evidence. Continue the missing file-picker and selected-file controls only when browser capability works; no permission or setting question is pending. Staff/customer browser branches, multiple/related projects, website-library variants, device/accessibility, GIF/TIFF/BMP/other media parity, integrations, production identity/domains/subscriptions and PWA/offline remain tracked. Public-enquiry HEIF is implemented within v0.20 limits; authenticated photo upload limits are unchanged. Nothing in this checkpoint approves live use or full parity.