# Reuse and provenance

Current checkpoint: **v0.20.2**, the owner recurrence/calendar rehearsal and a small removed-holiday display correction. The actual v0.20.1 browser journey covered definition/preview/generation, conflict and stale review, overrides/cancellations, overlapping holidays, future rules, protected history, pause/retire/restore, month ends, spring clocks and second-business isolation. The display repair has passed client/render/build checks. Its final browser retest is pending: automatic approval review rejected signing into the fictional demo without fresh explicit permission. See [the recurrence walkthrough](RECURRENCE-WORKFLOW-WALKTHROUGH.md) and [checks](recurrence-milestone-checks.json). **60 targeted backend tests, 167 client tests, 88 structural renders and the build passed**, with the backend unchanged and its 694-case full run remaining historical. The saved browser dataset passed stopped backup/fresh restore and a second backup. All 45 capabilities remain tracked and all 14 original findings remain OPEN. Phone/PWA, staff/customer, photo-picker/format/licensing and full-product/live approval remain open.

Preserved historical checkpoint: **v0.18**. The [website walkthrough](WEBSITE-WORKFLOW-WALKTHROUGH.md) and [checks](website-journey-milestone-checks.json) record independent local website/enquiry repairs and actual fictional-data browser evidence. 612 backend tests, 113 client tests, 81 structural render checks and the build pass. No schema, dependency or original-source change. All 14 original SHS findings remain OPEN; older stage-specific evidence below remains historical.

27 October 2026. Product name and commercial reuse rights remain undecided.

## Reviewed input preserved

Source: /Users/sandyrestall/Documents/Emergent/SHS-code-review.zip.

SHA-256: d6155e3a2968e6880a99b626be9528a4671a03e34209df480022d0231087fa04.

The supplied archive contains 275 files, totalling 4,114,049 uncompressed bytes. The reviewed extraction remains at work/SHS-code-review in the technical chat workspace. A separate, byte-matching reference copy was created at work/shs-product-source-baseline before implementation. Neither copy is imported, executed or bundled as the new app. The file-by-file hash inventory is source-manifest.json in this directory. This is an inventory of the supplied ZIP, not proof that it represents the complete live repository.

## What was adapted from SHS

The prototype adapts the **workflow and data relationships**, rather than copying the application wholesale:

| SHS source reviewed | Idea retained | Implementation in this prototype |
| --- | --- | --- |
| backend/models.py, Enquiry/EnquiryCreate/EnquiryUpdate | One master enquiry/job linked explicitly to a customer; service, message, staff notes, scheduling and stages | New strict contracts in backend/models.py and new relational storage/routes |
| backend/models.py and quote/invoice handlers in backend/server.py | Itemised quote, customer acceptance, linked invoice and recorded payments | New integer-pence calculations, immutable document snapshots, transaction and retry controls |
| backend/metrics_service.py | Dashboard figures should have consistent definitions and distinguish payments from estimated/quoted value | New small SQL-backed totals and explicit UI labels; original float-based functions were not copied |
| Original public pages/site editor | Branded services, about, work/gallery and enquiry pages; deliberate local draft/publication separation added independently | New React website template, editor and publish/restore API |
| Manual time-entry version checks and soft-edit principles identified in the review | Reject stale writes rather than overwriting another edit | New version checks for job and website updates |

**Version 0.1** had no copied original executable function or UI component. **Version 0.2** now deliberately reuses the following small, isolated pieces from the supplied ZIP. No original module is imported or executed.

| Source / lines | Local destination | Reuse and modifications |
| --- | --- | --- |
| backend/routers/materials_catalogue.py:70–86, _to_pence | backend/material_rules.py | Function copied verbatim; source/function hashes recorded in reuse-manifest.json. New surrounding models bound input length and decimal notation before calling it. Original MongoDB/auth/index code excluded. |
| frontend/src/components/admin/MaterialsCsvImport.jsx:22–50, parseCsv | frontend/src/material-csv.js | Parser adapted with a 250 KB bound, rejection of misplaced/unterminated quotes, named export and formatting changes. Original component, axios and toast dependencies excluded. |
| Same file:53–68, GUESS_MAP and guessColumn | frontend/src/material-csv.js | Header names and matching logic retained; exported and reformatted. |
| frontend/src/components/admin/MaterialsCataloguePanel.jsx:17, isValidMoney | frontend/src/material-csv.js | Exact money-check helper retained. Server validation remains authoritative. |

MaterialsTab.jsx, JobMaterialsPanel.jsx, MaterialsCataloguePanel.jsx, MaterialsCsvImport.jsx, ExtractMaterialsDialog.jsx and the three materials routers informed the feature map and manual workflows. Dedicated source tests were read as evidence only; the original fixtures were never run. The new Materials React screens, relational schema, staff-scoped API and tests are newly implemented around the retained behaviours. The feature comparison explicitly lists deferred functions and semantic changes.

## Newly written

Apart from the bounded reuse above, the new app includes the React screens and CSS, neutral SVG illustration/icon, API contracts and FastAPI routes, SQLite schemas and repository helpers, password/session/CSRF controls, portal access, image re-encoding, private document views, retry/transaction handling, domain simulator, launch scripts and dedicated tests. The two business identities and website copy are fictional placeholders. No customer data, SHS logo, photographs, testimonials, secret values or integration credentials were imported.

React/FastAPI were retained as familiar technologies. Vite replaces CRA/CRACO for this focused build. SQLite per business replaces MongoDB **for the local demo only**. This is an explicit architectural experiment, not an approved production database migration. All public package versions used are recorded in the new lockfiles; no original dependency environment was installed.

## Excluded original areas

The original server entry point, executable router modules, storage clients, Google/OAuth helpers, scheduler, migrations, security feature-flag system, offline replay queue and test suite are not reachable from this runtime. AI, procurement, tax, OCR, notifications, real subscriptions and other specialist modules were not ported. Original code-review findings are not marked fixed as a result.

The ZIP's presence does not prove rights to commercially reuse or assign its code/assets. No new open-source licence, IP assignment or ownership agreement is asserted for this product. Legal/licensing review and dependency licence notices are required before distribution outside the founders' local development work.

## Core expansion: customer milestone

The customer directory, history routes, explicit reuse and guarded linking are new code informed by CustomersTab.jsx, CustomerTimeline.jsx, backend/routers/customers.py, customer_duplicates.py and project.py. The original auto-resolution, broad merge/backfill, portal and MongoDB code was not copied. Existing document snapshots and exact-customer access remain authoritative. See MILESTONES.md for checkpoint evidence.

### Manual time and costing expansion

`frontend/src/workforce.jsx:formatDuration` adapts the seven-line formatting body from original `frontend/src/components/admin/JobTimePanel.jsx:12-18` (renamed/exported). `backend/routers/time_entries.py` and its UI informed manual-only records, dated durations, correction versions and soft deletion. New code validates London work dates, exact pence, per-person daily limits and rate snapshots. Original `backend/routers/project.py:17-54` profitability was inspected but not reused because it omits manual labour and accounting bases. No original runtime imports or integrations.

### Calendar expansion

Inspected original `frontend/src/components/admin/CalendarSection.jsx` and `backend/routers/calendar.py` for day/week, blocked-period, assigned-person and multi-day workflows. New `backend/scheduling.py`, `frontend/src/scheduling.jsx` and `calendar-dates.js` do not copy source runtime code. They replace source time-slot overlap semantics with exact UTC intervals and explicit Europe/London gap/fold rules. No source background tasks, customer auto-creation, notification or Google-sync code is imported. Frontend input-event fixes are new code.

### Local recovery expansion (0.4)

The recovery module, shared POSIX data lock, explicit CLI, additive dataset/business identity metadata and 26 recovery tests are newly written for this isolated prototype. They reuse only the prototype's own schemas and helpers plus Python's standard-library SQLite backup/ZIP/hash/filesystem APIs and the already-installed Pillow image validator. No additional SHS code, credentials, startup code, external storage client or original backup routine was imported. The previous source-helper manifest remains unchanged.


### Document lifecycle and full parity inventory (0.5)

Inspected the preserved `QuotesInvoicesTab.jsx`, `DashboardDialogs.jsx`, `PaymentScheduleEditor.jsx`, `backend/routers/payment_schedule.py`, the quote/invoice/payment handlers in `backend/server.py`, portal ownership paths and review findings R02/R05/R07/R09/R12/R13/R14 before implementation. The source's single-invoice stage-payment purpose is preserved. New `documents.py`, document UI, line/stage arithmetic and tests are independently written; no original MongoDB handler, PDF generator, email/storage client or startup code is imported. The prototype's existing transaction/authentication/helpers are reused. Source destructive edits/deletes and mutable paid flags are replaced by explicit retained history and one receipt ledger.

The full parity inventory statically indexes all 275 supplied files, 283 backend route declarations, 19 frontend routes and 217 named nested UI actions. Original files were parsed/read only, never run. File/line evidence is not a claim of full semantic parity or deployed behaviour; every route still requires its individual comparison. The full register retains integration-dependent and SHS-specific functions and all 14 original findings. No additional assets, real testimonials, customer records or secrets were copied. The pinned v0.4 recovery schema is from our own saved prototype, not from the SHS runtime. Its generated legacy test records are invented.


### Structured website and branding expansion (0.6)

Read the supplied LandingPage.jsx, AboutPage.jsx, ServicePage.jsx, EnquiryPage.jsx, SiteEditorTab.jsx, PublicFooter.jsx, publicSite.js, useSeoHeadTags.js and backend/routers/site_editor.py, settings.py and seo.py. Source behaviour includes editable text blocks, ordered/published services with individual slugs, public business-info projection, gallery visibility and page/social/sitemap metadata. These purposes inform new independently written site_models.py, websites.py, website/editor components and tests. Arbitrary source HTML is replaced by safe plain-text/typed sections. Existing local illustration and system fonts are retained.

No SHS contact/bank fallback, company/VAT identifier, private photo, testimonial, remote image URL, analytics/maps, live origin, raw HTML renderer or original router/runtime was imported. Missing original media remains a source completeness gap; local neutral placeholders remain clearly labelled. v0.5 recovery schema evidence comes from the independently saved local checkpoint. The source ZIP/reference copies remain read-only. Source helper reuse documented earlier is unchanged.


### Business and identity expansion (0.7)

Read preserved backend/auth.py, backend/routers/auth.py, frontend/src/components/admin/SettingsTab.jsx and frontend/src/pages/PortalSetup.jsx. Their purposes informed member management and password recovery. New identity/schema/policy modules, forms, provisioning journal, setup state and tests are independently written. Broad admin access, calendar-resource/account conflation, URL tokens, weak password rules, source router/runtime and real delivery are not ported.

The local implementation uses exact owner/staff memberships, explicit scheduling-resource links, a complete default-deny route manifest, hashed expiring single-use invitation/reset tokens, local-only capture, transactional last-owner protection and session revocation. Existing customer portal codes remain a separate exact-customer system. One global private account may have memberships in several businesses without exposing its other memberships to business owners.

The pinned format-3 schema was exported from the unchanged v0.6 checkpoint before editing. Recovery format 4 adds a sanitized identity registry and dynamic complete business inventory while retaining exact formats 1–3. No additional dependencies, original SHS helpers, runtime files, customer records, photographs or credentials were imported. The original 14 findings stay open.


### Private job photos and reviewed public projects (0.8)

Read preserved backend/routers/files.py, portfolio.py and site_editor.py; DashboardDialogs.jsx job photo controls; PortfolioTab.jsx; GalleryIndexPage.jsx; GalleryDetailPage.jsx; ServicePage.jsx; ServiceGalleryDialog.jsx; and portal source for photo exposure. These establish caption/category/stage/order, job selection, project slug/title/body, public project pages and service associations. No original runtime or tests were executed. Source paths that copy customer names into public captions or auto-publish job photos informed the explicit review boundary, rather than being imported.

New photo_models.py, photos.py, photo_recovery.py, photo/gallery components and tests are independently written. Existing source helper reuse is unchanged. There are no new dependencies or copied SHS images, location data, testimonials, contacts, HTML, AI-generated descriptions or credentials. Tests use synthetic coloured pixels only. Exact-customer photo sharing is an explicit local improvement, not a claim of source portal photo parity. Arbitrary URL/file serving, auto-promotion, destructive deletion, bulk cross-job moves, raw HTML and external providers remain replaced or deferred with reasons in the photo guide and gap register.

Pinned recovery schema 4 was exported from our v0.7 prototype before changes. Formats 1–4 remain accepted exactly; format 5 adds validated private media and immutable review/publication history. Original ZIP and both source copies are hash-checked at packaging; all original findings remain OPEN.


### Field capture and reviewed suggestions (0.9)

Read the preserved backend/routers/site_mode.py and frontend/src/components/admin/SiteModeTab.jsx, with existing JobTimePanel and project/material/document purposes. Source evidence includes accepted/scheduled/in-progress eligibility without a date filter, private note/material/photo/time logs, start/stop capture, one/two-person choice and an editable invoice preview. The current source UI creates its reviewed invoice through the admin invoice flow; a separate legacy generate helper also exists. Neither runtime nor source tests were executed.

New field_models.py, fieldwork.py, billing_sources.py, field_recovery.py, client forms/helpers and tests are independently written. Broad shared-admin access becomes exact staff assignment. Raw time is kept separately from owner-reviewed labour and private draft creation. One/two-person attribution uses actual resource identities and saved rates instead of SHS's hard-coded rates. Drive uploads/public permissions, raw URLs, automatic time-to-invoice side effects, source offline replay and automatic invoice generation are not imported. Existing explicitly documented helper reuse is unchanged; no new dependency, provider call, real record or SHS content is added.

Pinned recovery schema 5 comes from the unchanged v0.8 local checkpoint. Formats 1–5 remain strictly accepted, with new format 6 validating the additional records and interrupting restored open clocks. The pre-upgrade data snapshot and Git bundle remain outside the distribution. All fourteen original review findings stay OPEN against the unchanged original.

## Recurrence/calendar source comparison (0.10; 28 October 2026)

Read-only evidence: original routers/calendar.py:198–449 (weekly contracts, rolling windows, generation, conflict handling, pause/delete, cancellation blocks); models.py:337–390; CalendarSection.jsx; DashboardDialogs.jsx:2100–2315; AdminDashboard.jsx:1435–1577 and the new-job recurrence labels. Original weekly generation uses date/start/contract identity, reports partial conflicts and does not consult cancellation_blocks. Source delete/pause retains bookings. Monthly/quarterly/yearly are declared in the new-job UI; a functioning non-weekly generator was not established. Fortnightly and explicit month/leap/missing-day arithmetic are deliberate local extensions.

Independent six-table storage, reviewed rules/exceptions, stable original-date identity, atomic previews, version fences, audit/recovery and React forms preserve the purpose while changing those unsafe mechanisms. Whole-team unavailability and exact named job resources replace shared-admin assumptions. Hardcoded customer-specific rates and batch invoices remain a separate configurable specialist gap. Google tasks, notifications, source code/runtime/tests and real customer values were not imported or executed. The original ZIP and both 275-file reference copies are verified unchanged at packaging. No new dependency is required.

## v0.11 portal and document output comparison

Read-only source evidence: backend/routers/portal.py:161–228 (password setup/login), 239–290 (document lookup), 327–385 (owner invite/disable); frontend/src/pages/PortalSetup.jsx and CustomerPortal.jsx; backend/server.py:1043–1084 and 2459–2485 (year-based invoice/quote references), 1682 and 3167 (public PDF serving); backend/routers/payment_schedule.py:130–158, 396–430 and 488–515 (staged request content/generation); settings.py and SettingsTab.jsx (owner business/payment wording). Original bank/customer defaults were not copied.

The local equivalent uses exact customer IDs and an explicit Portal ID, rather than name/email document joins, hashed expiring single-use captures rather than reusable/raw setup grants, and authenticated in-memory downloads rather than public files or Drive links. Configurable prefixes with a monotonic year option are an explicit extension of the source's fixed yearly pattern. No customer accept/decline/signature implementation was found in the supplied portal source: versioned customer response evidence and optional typed acknowledgement are documented local enhancements, not claimed original signature parity or certified signatures.

New pinned dependencies: ReportLab 4.4.9 for generation, pypdf 6.10.0 for independent checks, and charset-normalizer 3.5.2 as the ReportLab dependency; existing Pillow remains pinned. Official references: [ReportLab release](https://pypi.org/project/reportlab/4.4.9/), [ReportLab table documentation](https://docs.reportlab.com/reportlab/userguide/ch7_tables/), [pypdf release](https://pypi.org/project/pypdf/6.10.0/). These are fixed versions matching the available runtime, not a claim to use the newest release or to have completed an advisory audit.

Unmodified DejaVu Sans regular/bold fonts are bundled with their complete Bitstream/Arev/DejaVu notices in backend/pdf_fonts/LICENSE.txt and file hashes in PROVENANCE.json. They were copied from the bundled LibreOffice resource distribution, not proprietary system fonts. [DejaVu licence](https://dejavu-fonts.github.io/License.html). The invented example logo is a newly drawn rectangle/triangle test fixture; no SHS logo, photograph, testimonial or real bank detail is used.

## v0.12 feedback and reviews comparison

Read-only source evidence: backend/routers/feedback.py:12–45 (submission and whole-row public feeds), 47–98 (private statistics/moderation), 100–149 (owner rewriting/deletion/manual entries), 154–221 (request preparation and reassignment); backend/models.py:192–231 (four ratings, recommendation, private comments/improvements and testimonial flag); frontend/src/pages/FeedbackPage.jsx:115–162 and 305–350; ReviewsPage.jsx:44–47 and 73–143; components/admin/FeedbackTab.jsx:60–175; backend/routers/opportunities.py:239–260 (completed/invoiced/paid job candidates). No source runtime, tests, scheduler or provider was executed.

The local implementation retains the purpose with new strict models, exact relational links and a separate customer-authored public statement. It deliberately replaces editable/fabricated manual reviews, automatic rating-based recommendation inference and whole-record public projection. It supports four bounded ratings and an explicit recommendation answer, owner-only all-response statistics, protected fictional .example captures, feedback-only bearer codes, a separate selected-testimonial page and opt-in rating display. Completed is the local eligibility stage; invoice/payment status does not automatically prove job completion. The static testimonial route is nested at /reviews/selected to preserve editable /reviews pages.

No dependency or source-code copy was added in this stage. The source opportunity module remains broader than the implemented review eligibility list. Consent wording is an operational local choice with version/time evidence, not a claim of legal compliance or email verification. Captures and all QA records are fictional; normal feedback/publication tables remain empty. Original R06 and all thirteen other SHS findings remain open.

## Version 0.13: owner pipeline, opportunities and operational definitions

Reviewed JobsTab.jsx, CustomersTab.jsx, DashboardDialogs.jsx, GrowthOpportunitiesPanel.jsx, backend/models.py, backend/routers/opportunities.py and backend/metrics_service.py as source evidence only. The [source map](workflow-source-map.json) records their preserved hashes and changed semantics. New workflow models/routes, review queue, metrics, recovery and React views were written for the isolated product. No executable source helper was newly copied; the existing reuse-manifest.json is unchanged. Exact IDs replace name/email joins; real recorded completion/contact dates replace paid-status inference and historic cutoffs; optional explicit postcode groups replace approximate coordinates/default locations; local prepared wording replaces AI and delivery. Sources, schedulers, tests and integrations were never executed.

## Reporting expansion (0.15)

The reporting source map records the exact original analytics UI/routes, opportunities service/customer breakdown, tag route, funnel backfill and metric-definition files inspected. No original reporting runtime or tests were run and no new verbatim code was reused. The independent implementation reuses this prototype's integer pence, exact IDs, saved time/material costs, quote/document links, receipt ledger and CSV escaping. It replaces inferred staff hours, contact/name grouping, synthetic funnel history and mismatched populations with explicit read-only definitions. Missing traffic/category data and tax/contract/forecast policy are retained as gaps. Original ZIP and both 275-file references remain byte-matching; existing bounded reuse records and all 14 original findings remain unchanged.

## Connected workflow verification and definition alignment (0.16)

Rechecked original `backend/routers/site_mode.py:135–245` and `frontend/src/components/admin/SiteModeTab.jsx:337–396` as read-only evidence for capture/review and direct invoice intent. No original runtime/tests or new verbatim helper were executed or copied. The new shared `current_positions.py` rule and existing-workspace refresh, labour-origin and empty-state repairs are independent local code. The real 21.641-second timer capture and explicit fictional half-hour correction remain separate evidence. The owner created all work records through the UI; test APIs were used separately for regression and recovery access checks. No dependency or schema change, customer acceptance, real credentials, external transmission or live SHS change is included. Existing bounded reuse notices and all 14 original findings remain unchanged.

## Feedback browser verification and access clearing (0.17)

Rechecked downloaded backend/routers/feedback.py and frontend FeedbackPage.jsx/ReviewsPage.jsx as read-only behavior evidence. Original source/runtime/tests remain unmodified and unexecuted. This stage independently extends the existing local client access-check mechanism to feedback-only bearer codes and refreshes the owner feedback list. No third-party code, dependency, new backend route or schema was added. Actual UI created two matching-contact customers, two jobs, three responses and their permission/publication histories in separate fictional data. Protocol/recovery checks remain explicitly separate from browser actions. No production credential, external transmission, live SHS change or original-finding closure is included.

## Website browser journey and independent repairs (0.18)

The downloaded App.js, LandingPage.jsx, ServicePage.jsx, EnquiryPage.jsx, SiteEditorTab.jsx and site_editor.py/enquiries.py/settings.py were reviewed as source evidence only. The original site editor saves public content directly, and the service enquiry link carries service context. The independent prototype uses a separate saved draft and explicit publication; its repaired service link resolves only a visible published slug. Original visitor preferred-date and up-to-five-photo fields remain a recorded gap. Original outbound email, push and analytics code was not executed or integrated.

The new preview/session checks, owner-context clearing and HTML missing-page response are independent local code. Two neutral test assets were generated from simple Pillow geometry under work/v18-synthetic-assets; the local manifest records their hashes and dimensions. They depict a fictional Willow logo and empty shelves, contain no real customer/site images, and are stored only in the QA dataset. Neither the original media nor original customer data is in the code archive. All website edits and enquiry records in this journey came through the browser; separate HTTP/API probes and same-Mac recovery checks are identified explicitly. Source completeness, asset rights and commercial licensing remain unresolved.

### Public enquiry date and private photo intake (0.19)

Read the original public enquiry form, EnquiryCreate model, enquiry creation router, public-file upload router and owner dialogs as reference evidence. The supplied files were not instructions to execute or deploy them. New `public_enquiries.py`, `enquiry_recovery.py`, `enquiry.jsx` and `enquiry-rules.js` implement bounded single-request intake with immutable facts, metadata-free private images, exact-job access and safe retry. No original public-media upload route, background notifications, integrations or customer merge was imported. Existing prototype photo normalization, authorization, transaction and recovery helpers are reused. Dependencies remain exactly locked. [Source map](enquiry-source-map.json) records the source paths and intentional format/size/scheduling differences. The original ZIP was rehashed unchanged; cloud-only files prevented complete final rehashing of the two source copies, which were not written.

## Public enquiry format and size expansion (0.20; 30 October 2026)

The eight original file hashes and bounded line evidence in `enquiry-format-source-map.json` informed independently written decoder supervision, HEIF handling and format/size tests. Original runtime modules and tests were not imported or run. No original image, secret or customer record was copied. Small fixture pixels and all EXIF/GPS/XMP values are invented; the fixture is actually HEVC encoded. The new dependencies and their native notices are recorded in `enquiry-format-dependencies.json` and `licenses/v0.20/`. No wheel or installed dependency is included in the code ZIP.

Before editing, 326 available maintained files matched the v0.19.1 archive/index. Seventeen cloud-only maintained files were restored from that exact archive and matching Git index, with their original placeholders retained outside the package. No protected reference, original ZIP, review runtime, review data or Git metadata was reconstructed. The original ZIP, v0.19 ZIP and v0.19.1 ZIP were rehashed unchanged. Existing gaps for other cloud-only protected files remain explicit in `enquiry-format-preservation-check.json`.

## Gallery verification and preview repair (0.20.1)

Read-only source mapping additionally reviewed `backend/routers/site_editor.py:193–437`, `seo.py:69–113`, the legacy portfolio router/UI and gallery viewers. No original code or tests were run or copied for this patch. The independent frontend reuses its existing exact-owner website-preview watcher for gallery previews. Synthetic fixture setup, actual owner/public browser observations, selected API regression proof and saved-data recovery are explicitly separated in GALLERY-WORKFLOW-WALKTHROUGH.md. The SHA-256 source record, old/new bundle identity, cloud-placeholder restoration provenance and all raw fictional-data observations are included under gallery-evidence. All 14 original findings remain OPEN.