fix(ingest): refuse an external id that cannot be a stable identity

An external id is half of every ingest dedup key — (userId, source,
externalId), (userId, externalSource, externalId), (userId, type,
source, externalId). Re-posting the same triple is idempotent and
returns the existing row, which holds only while the id is stable
across client launches. A client that serialised an opaque platform
object with its default object description sent a per-allocation
memory address instead, so no sweep ever matched its own earlier row
and each one minted a fresh record: a live instance grew 23 phantom
medications in a day, none of which could collect a dose, because the
dose side resolved through the same rotating string.

Add one shared classifier for identifiers that provably cannot be an
identity — an angle-bracketed object description carrying a hex
pointer, a bare 0x address, and a blank value — and wire it at every
surface that accepts a client-supplied externalId.

Single-entry creates refuse through the schema, so the client gets the
standard 422 multi-issue envelope with a message naming the shape it
sent and what to send instead. Batch and bulk surfaces classify per
entry and report the offending row as skipped with reason
unstable_external_id, leaving the rest of the payload to land: one bad
row must not stop a sync. Every refusal carries pinned wide-event meta
(count, shape, surface) and never the id itself.

A structural guard freezes both routes into the floor: a request-side
externalId declaration either applies the field check or carries a
marker naming the file that checks it per entry, and the guard verifies
that file really does. The backup-restore payload is the one exemption,
with its reason recorded — it replays ids the server itself wrote.

src/app/api/import/route.ts

@@ -23,6 +23,11 @@ import {
   isPlausibleEntryInstant,
   validateEntryInstant,
 } from "@/lib/validations/entry-instant";
+import {
+  classifyExternalId,
+  unstableExternalIdMeta,
+  type UnstableExternalIdShape,
+} from "@/lib/validations/external-id";
 import { encryptNote } from "@/lib/crypto/note-cipher";
 import { recomputeUserMoodRollups } from "@/lib/rollups/mood-rollups";
 import {
@@ -60,6 +65,10 @@ const measurementSchema = z
     // export is idempotent rather than minting a duplicate set — mirrors the
     // mood path. Absent → first-write-wins create with a NULL externalId
     // (distinct in the unique key), which DOES duplicate on re-import.
+    // Stability is enforced per entry in the import loop, not at the
+    // field: a schema-level refusal would fail the whole file on one bad
+    // row.
+    // @external-id-checked-per-entry: src/app/api/import/route.ts
     externalId: z.string().min(1).max(120).optional(),
   })
   .refine(
@@ -92,6 +101,10 @@ const moodEntrySchema = z
     // present, the import upserts on `(userId, source, externalId)` so a
     // re-import of the same export is idempotent rather than minting a
     // duplicate; absent → the legacy first-write-wins create path.
+    // Stability is enforced per entry in the import loop, not at the
+    // field: a schema-level refusal would fail the whole file on one bad
+    // row.
+    // @external-id-checked-per-entry: src/app/api/import/route.ts
     externalId: z.string().min(1).max(120).optional(),
   })
   .superRefine((entry, ctx) => {
@@ -170,6 +183,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
   const userId = user.id;
   const data = parsed.data;
   const stats = { measurements: 0, moodEntries: 0, skipped: 0 };
+  const unstableShapes: UnstableExternalIdShape[] = [];
   let writeFailed = false;
 
   // Import measurements
@@ -189,6 +203,17 @@ export const POST = apiHandler(async (request: NextRequest) => {
   }> = [];
   if (data.measurements?.length) {
     for (const m of data.measurements) {
+      // The `(userId, type, source, externalId)` upsert key is only
+      // idempotent while the id is STABLE; an id that rotates between
+      // exports re-imports as a fresh row every time. Skipped per entry,
+      // like every other rejected row in this importer.
+      const unstable =
+        m.externalId === undefined ? null : classifyExternalId(m.externalId);
+      if (unstable) {
+        unstableShapes.push(unstable);
+        stats.skipped++;
+        continue;
+      }
       try {
         // `measuredAt` is already a `Date` (validateEntryInstant transform).
         const measuredAt = m.measuredAt;
@@ -299,6 +324,15 @@ export const POST = apiHandler(async (request: NextRequest) => {
     const fallbackOccurrences = new Map<string, number>();
     const reservedFallbackInstants = new Set<number>();
     for (const e of data.moodEntries) {
+      // Same stability floor as the measurement loop above — the mood
+      // upsert keys on `(userId, source, externalId)`.
+      const unstableMood =
+        e.externalId === undefined ? null : classifyExternalId(e.externalId);
+      if (unstableMood) {
+        unstableShapes.push(unstableMood);
+        stats.skipped++;
+        continue;
+      }
       const identity = e.loggedAt ? null : fallbackMoodIdentity(e);
       const occurrence =
         identity === null ? 0 : (fallbackOccurrences.get(identity) ?? 0);
@@ -455,7 +489,14 @@ export const POST = apiHandler(async (request: NextRequest) => {
     }
   }
 
-  annotate({ meta: { import_stats: stats } });
+  annotate({
+    meta: {
+      import_stats: stats,
+      ...(unstableShapes.length > 0
+        ? unstableExternalIdMeta("import.json", unstableShapes)
+        : {}),
+    },
+  });
 
   try {
     await auditLog("import.upload", {