{
  "version": "0.20.0",
  "reference_archive_sha256": "d6155e3a2968e6880a99b626be9528a4671a03e34209df480022d0231087fa04",
  "source_only": true,
  "original_modules_executed_or_imported": false,
  "source_evidence": [
    {
      "path": "frontend/src/pages/EnquiryPage.jsx",
      "line_ranges": [
        [
          99,
          135
        ],
        [
          152,
          155
        ],
        [
          344,
          372
        ]
      ],
      "sha256": "7d20bcb9ece65e10c3e56545ec0e8b6725abaf11a24d68b190ca6e25cdcc6042",
      "finding": "UI retains at most five uploaded URLs. Advertises 10MB each and image/* plus .heic/.heif. No byte validation in this handler; each file is pre-uploaded, with a broad legacy fallback on upload failure."
    },
    {
      "path": "backend/routers/files.py",
      "line_ranges": [
        [
          52,
          79
        ]
      ],
      "sha256": "2b2e2f04a95fdd36d1e23358bb2bc7a47b09e5f68752bae0ee9029b39c86f9bc",
      "finding": "Primary anonymous upload rejects len(data)>10*1024*1024, i.e. 10485760 bytes per file. Reads entire body first. No cumulative/count limit here."
    },
    {
      "path": "backend/storage.py",
      "line_ranges": [
        [
          79,
          119
        ],
        [
          122,
          129
        ]
      ],
      "sha256": "4bee13701c2883ce561f57f98e533af8aa8cda6810e6aa71a49b2dbcb1e471d6",
      "finding": "Extension or MIME selects normalization. Recognizes JPEG/PNG/GIF/WebP/HEIC/HEIF/TIFF/BMP. GIF passes through; HEIC/HEIF conversion uses pillow-heif. Loads, rotates and caps long edge to 2000 when converting/resizing; failure returns original unchanged. Small ordinary images and non-image files may pass through. No explicit source pixel/frame ceiling."
    },
    {
      "path": "backend/server.py",
      "line_ranges": [
        [
          920,
          972
        ]
      ],
      "sha256": "c3e83a2593fbccb41bf5cebcd7a1b3a6fe688e54afcd8db409213caf64e950d7",
      "finding": "Legacy fallback copies/uploads originals; no explicit per-file/count/total restriction or conversion inside this handler. Effective infrastructure and registration behavior cannot be certified from filtered source."
    },
    {
      "path": "backend/models.py",
      "line_ranges": [
        [
          9,
          20
        ]
      ],
      "sha256": "961ce026b4b7a17ffef8e8d5b35fdc69f4862e9cb81535b1069bb29b2687bbd2",
      "finding": "EnquiryCreate accepts a list of photo references without a count or aggregate byte validator."
    },
    {
      "path": "backend/routers/enquiries.py",
      "line_ranges": [
        [
          108,
          141
        ]
      ],
      "sha256": "dbd0e4b3c74eb5ed344d7d754962dfc7d45134f49318043b34a82d3d46b8878c",
      "finding": "Enquiry persistence then background notifications; no photo decoder/count/total enforcement in this route."
    },
    {
      "path": "backend/requirements.txt",
      "line_ranges": [
        [
          80,
          81
        ]
      ],
      "sha256": "97a4458035810fabaa0da85912fa199cba04eb93f9a472c9202901f42f79af38",
      "finding": "Original pins Pillow 12.1.0 and pillow_heif 1.2.0."
    },
    {
      "path": "backend/tests/test_iteration84_heic_upload.py",
      "line_ranges": [
        [
          45,
          52
        ],
        [
          67,
          80
        ],
        [
          148,
          152
        ]
      ],
      "sha256": "b72b0f52273910b2919fa130398802e78a17767984db960a1c3fa295a769f499",
      "finding": "Supplied test code generates a genuine HEIC and expects normalized JPEG and an oversize 413. Tests are source evidence only and were never executed or imported; their remote service settings and credentials were not reused."
    }
  ],
  "decisions": {
    "count": 5,
    "file_bytes": 10485760,
    "total_original_bytes": 52428800,
    "encoded_request_bytes": 73400320,
    "total_converted_bytes": 68157440,
    "input_pixel_limit": 12000000,
    "input_side_limit": 12000,
    "normalized_long_edge": 1800,
    "source_total_allowance": "Not explicitly enforced in these supplied handlers; five times the advertised per-file allowance implies a useful 50 MiB journey, now accepted in one private transaction. Legacy fallback can bypass the primary route size rejection.",
    "supported_useful_path": "HEVC-coded single still HEIC/HEIF plus PNG/JPEG/WebP, content validated; no original pass-through on decode failure.",
    "intentional_differences": [
      "Atomic exact-enquiry private intake, no public pre-upload media URL/token",
      "All saved images normalized to metadata-free RGBA PNG, maximum long edge 1800",
      "12 MP and 12000-pixel side limits remain; source lacks explicit equivalents",
      "Multi-main-image HEIF, sequence brands, animations and AVIF rejected; auxiliary/depth/thumbnail data are not exported",
      "Retain 1000 private photos and 128 MiB business storage quota; errors save no partial enquiry"
    ],
    "missing_evidence": [
      "Effective proxy/server request/body limits, deployed route wiring and complete configuration",
      "Original full runtime, native dependency build and image variants on real phones",
      "Picker/browser/device/HEIF variant, HDR colour-fidelity and production load proof"
    ]
  }
}