Inspect several documents of one case and report inconsistencies between them

Accepts multipart/form-data with 2 to 10 file parts (name each one file). Each document is inspected exactly as POST /api/v1/inspect would, one at a time, and the reports are then compared with each other. The bytes are processed in memory. Retention works per document exactly as on /inspect: an account whose history is on keeps one derived record per analysed document (and, opt-in, its encrypted file), each report carries its own retention and tenantMatches, and a key or header set to none keeps nothing.

Response. { reports, crossDocument }. reports[i] is, in upload order, exactly the body /inspect would return for file i (with its own receipt when receipts are configured). A file that could not be analysed gets, in its slot, the error body /inspect would have answered plus status, the HTTP status it would have had (not_a_pdf 422, analysis_timeout 422, busy 503, case_budget_exhausted 503, internal_error 500); the other files still return.

crossDocument is { findings, documentsCompared, guidance }. Each finding is { code, documents, evidence }, where documents are indices into reports and evidence carries hashes, identifiers, counts and timestamps only, never page text. The codes:

• same-file: two uploads have the same document.sha256.
• same-base-file: different files share the permanent half of the trailer /ID (evidence.basis includes id-permanent), or the same whole set of two or more non-trivial font subset tags (font-subset-tags; numbered tags such as Chrome's BAAAAA are dropped, and TeX-family generators, which derive tags from content, are not compared). PDFs only.
• shared-creation-instant: different PDFs carry the same creation date to the second, in UTC. Midnight is not compared, because a date written without a time of day reads as midnight.

These are inconsistencies to review, never verdicts. Each has benign causes (one statement downloaded twice; a batch export written in one second; a generator that reuses an /ID or numbers its subset tags). fingerprint.issuerProfileHash is never a finding on its own: genuine documents of one issuer share it. No finding changes any report's score.

Limits. Each file obeys the /inspect cap; all files together may not exceed three times it (413 case_too_large). More than 10 files is 400 too_many_files; fewer than 2 is 400 not_enough_files. Documents run one at a time, each with the per-document deadline, inside a 90-second budget for the case: a document starts only while a whole deadline plus a 5-second margin is left, and one still queued when the budget runs out is abandoned; either way its slot is case_budget_exhausted. At most 2 cases run at once on a server; another is answered 503 busy with Retry-After, like a shed /inspect. One account, and one client network, runs one case at a time; a second is 429 busy with Retry-After. The whole body has 30 seconds to arrive, or the call is 408 body_timeout and the connection is closed. Neither is billed.

Cost. Requires an API key. Each analysed document is metered as one document against the monthly quota, so a case of N documents costs N; a slot that failed costs nothing. The account must have N documents available when the body has been read, or the call is 429 quota_exceeded. ?redact=payload and ?changes=values work per report exactly as on /inspect.