- collision-safe ID repair: duplicate ids inside stored data are repaired
deterministically (first keeps id, twins get id#2, id#3, ... scanning past
owned suffixes); every distinct local record survives, never dropped or
silently merged; hostile id types (Symbol/BigInt/objects) repair onto
fresh deterministic ids instead of throwing
- transactional import: parse+merge into a candidate ledger, persist first,
then commit memory; quota/error rolls back in-memory state and localStorage
together with explicit user feedback; total 16MiB portability budget
enforced before mutation on export, import (post-migration expansion), and
storage writes
- strict Timmy legacy contract for bare top-level arrays: nonempty array of
plain rows each carrying a nonempty string id and integer Bristol 1-7;
arbitrary unrelated arrays are rejected wholesale - no invented medical
defaults from foreign JSON
- canonical raster photo validation: strict JPEG/PNG/WebP grammar, canonical
base64 (linear scan, no regex on multi-MB strings), atob round-trip decode,
declared-format magic bytes, 32B-4MiB decoded bounds; mislabeled SVG/HTML
and noncanonical tiny junk are stripped while genuine photos survive
byte-for-byte
- migrateStoredLedger: localStorage is validated and migrated before render;
invalid dates become safe ISO timestamps, duplicate ids repaired, junk rows
dropped (never fabricated into default records); healthy storage is
byte-stable and never rewritten
- sanitizeEntry absorbs Symbol/BigInt/hostile dates/throwing toString,
valueOf, getTime, toJSON without throwing; results stay serializable
- browser regression suite: quota rollback, pre-render migration, array
rejection, photo contract, duplicate-ID preservation in the real app flow
- staging-health startup-rejection budget anchored to measured server
cold-start instead of a fixed 800ms (fixes load-sensitive flake)
