- provenance origin set is own-safe exact membership (Set.has); inherited
toString/constructor/__proto__ names can never become origins
- import/export symmetry restored with an explicit bounded policy:
MAX_IMPORT_BYTES raised 2 MiB -> 16 MiB UTF-8 bytes, above any export
this app can produce (photos capped at 4 MiB binary), so valid exports
always re-import without silent data loss while hostile files stay bounded
- byte limit is byte-exact now: utf8ByteLength() measures real UTF-8 bytes
(multibyte boundaries tested), and the browser rejects oversized files
by File.size BEFORE File.text() reads user data
- collision-safe deterministic mergeLedgers(): existing user-owned rows
win, incoming rows only ever added for new ids, intra-file duplicates
collapse deterministically, every collision reported explicitly in the
import toast (no duplicate/overwrite/shadow of user records)
- base-path Delete Everything is namespace-scoped: root still cleans/
migrates the legacy store to prevent resurrection, /timmy-staging no
longer erases another namespace's global legacy ledger (browser
regression covers deletion with root legacy data present)
- strict current-schema values: Bristol 1-7 / urgency 0-4 / discomfort
0-4 must be true integers (out-of-range falls back instead of silent
clamping), photos restricted to JPEG/PNG/WebP base64 raster data URLs
(SVG/GIF/non-base64 dropped), invalid dates never throw or persist
Invalid Date values
Verification: npm test 91/91, test:ui/test:photo/test:sleek/test:portability
PASS, staging-deploy 20/20 OK, check:syntax clean, npm audit 0 high,
check_diff clean, adversarial probe battery (exact-byte boundary at cap,
prototype pollution via JSON, lone surrogates, data-URL strictness) green.
