docs: 计划追溯修正——TS2774 安全 uuid/降级分支测试/跨平台 checksize

Co-Authored-By: Claude Code <noreply@anthropic.com>

docs/superpowers/plans/2026-09-15-m1-data-collection-foundation.md

@@ -233,7 +233,8 @@ Expected: `System check identified no issues`。`pip freeze > requirements.lock.
   "scripts": {
     "build": "node build.mjs",
     "test": "vitest run",
-    "checksize": "node build.mjs && gzip -c dist/v1.js | wc -c"
+    "typecheck": "tsc --noEmit",
+    "checksize": "node build.mjs && node -e \"const z=require('zlib'),f=require('fs');console.log('gzip bytes:',z.gzipSync(f.readFileSync('dist/v1.js')).length)\""
   },
   "devDependencies": {
     "esbuild": "^0.24.0",
@@ -262,7 +263,8 @@ await build({
 `sdk/src/util.ts`:
 ```ts
 export function uuid(): string {
-  if (globalThis.crypto?.randomUUID) return crypto.randomUUID();
+  const c = globalThis.crypto as Crypto | undefined;   // as 断言防 TS2774（lib.dom 定义 randomUUID 非可选）
+  if (c?.randomUUID) return c.randomUUID();
   return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
     const r = (Math.random() * 16) | 0;
     return (c === "x" ? r : (r & 0x3) | 0x8).toString(16);
@@ -274,7 +276,7 @@ export function uuid(): string {
 
 `sdk/test/util.test.ts`:
 ```ts
-import { describe, it, expect } from "vitest";
+import { describe, it, expect, vi } from "vitest";
 import { uuid } from "../src/util";
 describe("uuid", () => {
   it("生成 36 位且不重复", () => {
@@ -282,6 +284,13 @@ describe("uuid", () => {
     expect(a).toMatch(/^[0-9a-f-]{36}$/);
     expect(a).not.toBe(b);
   });
+  it("Math.random 降级分支：格式正确且唯一（非 https 站点走此路径）", () => {
+    vi.stubGlobal("crypto", {});
+    const a = uuid(), b = uuid();
+    expect(a).toMatch(/^[0-9a-f-]{36}$/);
+    expect(a).not.toBe(b);
+    vi.unstubAllGlobals();
+  });
 });
 ```
 ```bash
@@ -1351,8 +1360,8 @@ ctk("init", { siteId: "site_x", endpoint: "http://127.0.0.1:8000/api/collect/bat
 ```
 - [ ] **Step 3: 构建 + 体积门禁**
 ```bash
-cd sdk && pnpm build && pnpm test
+cd sdk && pnpm build && pnpm test && pnpm typecheck
-gzip -c dist/v1.js | wc -c   # 必须 ≤ 15360（15KB），超标则精简（去 polyfill/减正则）
+pnpm checksize   # 输出 gzip 字节数，必须 ≤ 15360（15KB），超标则精简（去 polyfill/减正则）
 ```
 - [ ] **Step 4: Commit** `feat(sdk): 页面浏览/有效停留/事件入口，打包≤15KB`