- provenance origin set is own-safe exact membership (Set.has); inherited
toString/constructor/__proto__ names can never become origins
- import/export symmetry restored with an explicit bounded policy:
MAX_IMPORT_BYTES raised 2 MiB -> 16 MiB UTF-8 bytes, above any export
this app can produce (photos capped at 4 MiB binary), so valid exports
always re-import without silent data loss while hostile files stay bounded
- byte limit is byte-exact now: utf8ByteLength() measures real UTF-8 bytes
(multibyte boundaries tested), and the browser rejects oversized files
by File.size BEFORE File.text() reads user data
- collision-safe deterministic mergeLedgers(): existing user-owned rows
win, incoming rows only ever added for new ids, intra-file duplicates
collapse deterministically, every collision reported explicitly in the
import toast (no duplicate/overwrite/shadow of user records)
- base-path Delete Everything is namespace-scoped: root still cleans/
migrates the legacy store to prevent resurrection, /timmy-staging no
longer erases another namespace's global legacy ledger (browser
regression covers deletion with root legacy data present)
- strict current-schema values: Bristol 1-7 / urgency 0-4 / discomfort
0-4 must be true integers (out-of-range falls back instead of silent
clamping), photos restricted to JPEG/PNG/WebP base64 raster data URLs
(SVG/GIF/non-base64 dropped), invalid dates never throw or persist
Invalid Date values
Verification: npm test 91/91, test:ui/test:photo/test:sleek/test:portability
PASS, staging-deploy 20/20 OK, check:syntax clean, npm audit 0 high,
check_diff clean, adversarial probe battery (exact-byte boundary at cap,
prototype pollution via JSON, lone surrogates, data-URL strictness) green.
Implements #35.
- importLedger migrates prior schema versions (v0 bare-array legacy
exports and the v1 envelope) and fails safely on future versions,
malformed JSON, wrong-product envelopes, and oversized files with a
new 2 MiB MAX_IMPORT_BYTES guard applied before parsing.
- exportLedger normalizes entries through sanitizeEntry so confirmed
values and bounded provenance round-trip while smuggled secrets and
unknown fields never enter the portable file.
- Entries may carry a whitelisted provenance origin ('user' or
'ai-suggestion'); mergeVisualSuggestion records 'ai-suggestion' only
when a suggestion is actually applied, keeping nonvisual fields
user-owned.
- App import now merges into the existing ledger instead of replacing
it, so a failed or partial import can never silently drop
user-owned records.
- Service-worker shell cache bumped to v6 (per base-path namespace)
so installed PWAs receive the migration code; old v5 caches are
purged on activation.
- New tests/ledger-portability.acceptance.mjs browser gate covers
export round trip, merge import, safe-failure surfacing, root vs
/timmy-staging storage isolation, and Delete Everything for both
namespaces; wired into package.json test:portability and CI quality.yml.
Deterministic medical safety unchanged: urgent-flag detection, red-flag
copy, and chat escalation paths are untouched; all fixtures synthetic.
