# Browser Data Rescue — free two-lab proof 0.1.0

Original code, synthetic notes and chapter by Shruti. A learning app for intermediate frontend developers, not a production repair utility. The eight-case EPUB/PDF casebook is not included or finished.

## Run

Extract the ZIP into a new folder. Use a local static server over localhost or HTTPS; opening index.html with file:// is unsupported because ES modules, origin storage and Web Crypto need a suitable browser context.

If Python is installed: from the extracted folder run `python -m http.server 8772 --bind 127.0.0.1`, then open http://127.0.0.1:8772/. A different available port is fine, but both exercise tabs must use the SAME origin and session. There are no runtime packages, paid APIs, build steps, signups or telemetry. Alternatively serve these files with an existing static host.

Read chapter.html in the browser for the complete walkthrough. Start a synthetic lab by checking its consent box and pressing Start. The first created database receives three original notes. Reopening an existing empty session does not reseed it.

## Two labs and bonus save-boundary experiment

1. Start a new version-1 session. Follow Open the old tab. Hold v1 there, request schema v2 in the main tab, observe BLOCKED, close the old connection and verify v2 with unchanged records.
2. Create and save a JSON backup. Validate it. Restore into a fresh staging database and compare record count/content SHA-256. For a reversible loss drill, retain a current backup, confirm and empty only this lab notes store; undo is available while the page remains open. For external-file proof, reload the emptied session, select the saved file, validate and restore to staging. Source remains empty; staging should contain exact original records.
3. Try an aborted save. A put succeeds but the transaction rolls back; the UI remains unsaved. Compare with Commit synthetic edit, acknowledged only on transaction complete.

Original sample: n01 Garden plan rev1; n02 Workshop notes rev2; n03 Reading list rev1. SHA-256 canonical notes: e009e31b16d81bddb631a946b011b833062571a7f6b00e667adb16e0d94d51c4. A committed edit changes this digest.

## Boundaries

The app uses only `shruti-bdr-proof-<validated-session>-source` and `shruti-bdr-proof-<validated-session>-restore-<random>` database names. It never enumerates/deletes unrelated databases, clears browser cache, registers service workers, reads browser profiles or uploads records. New sessions and staging databases remain stored; no automatic cleanup. Database names and records may appear in your own developer tools. Use synthetic data only.

This drill clears records reversibly; it is NOT database deletion, eviction, private browsing, real quota exhaustion or a power-loss test. If you close/reload the page, its in-memory undo backup is lost; keep the downloaded file. Restore always creates a new staging database rather than replacing source. A failed staging write can leave an empty named staging database.

Maximum backup: 128 KiB UTF-8, 100 notes, 120-character nonempty titles, 4000-character bodies, unique bounded IDs and positive safe integer revisions. Format/schema/fields/count/checksum required. Hashes are not authentication. Edited inputs require revalidation. File selections use strict UTF-8. Text is rendered literally. No arbitrary production archive import, cloud sync, conflict resolver or forensic recovery.

Transaction complete is the commit observation used by this lab; it does not promise indefinite retention or strict power-loss durability. A pending open request cannot be cancelled by the app: close the holder or its tab to unblock it. Starting version 1 on a version-2 session yields VersionError; use New isolated session for another upgrade exercise.

## Source and checks

index.html/app.mjs/db.mjs/core.mjs/style.css: original complete app.
chapter.html: complete original free teaching chapter.
sample-backup.json: original three-note backup.
test-core.mjs: bounded schema/content tests. With Node installed, run `node test-core.mjs` from this folder. This creates/updates sample-backup.json and evidence/core-tests.json. It does not test IndexedDB without a browser.

TEST-RESULTS.md describes actual named-environment observations and untested environments. LICENSE applies to the free proof. MDN and Dexie are linked as free alternatives; no third-party runtime is bundled. No sales, reader reviews or time-saving measurements established. No payment required for these labs.