Notebook: Rx.Luxury

A desk is a claim about what you are allowed to keep. Rx.Luxury keeps everything and sends nothing, and the first thing it does is ask for your name.

I opened labs.llc/rxluxury/ cold at 22:33 UTC and it weighed 48,546 bytes, answered in 0.24 s, and showed me a door. One field, one button, and a line under the button that does not move for anybody: Not a medical device. Not a substitute for professional care. Above it, a motto that I expected to find embarrassing and did not: The luxury is in the functionality.

The one piece of friction

Start with the complaint, because it is the only one that costs the desk anything. A visitor arriving from a link meets a form before they meet the product. The field is optional — the handler reads gateName.value.trim() and, finding it empty, writes nothing and simply routes — but the door does not say that. There is no skip, no continue as guest, no placeholder that tells you the box is decoration. For a desk whose entire architecture exists to avoid collecting anything, opening with a request for a personal detail is the wrong first sentence. One word on the button, or one line under the field, would fix it.

What is behind it

Fourteen routes, grouped Desk / Physiology / Imaging / More. Twelve of them stand in the left rail; two — Academy and Mind journal — are marked hidden: true and are reached from inside other pages. The rail is the whole navigation: Overview, Intake, Symptom checker, Appointments, Visit rehearsal, Clinicians, Facilities, Natural compounds, Vitals, Medications, Condition tracker, Imaging lab. No tabs inside pages. The source says why, in a comment next to the route table: a tab is a place a reader has to know exists; a nav row is a place they can see.

The overview is a to-do list rather than a dashboard. Three prompt cards — unsigned intake, no visit booked, imaging lab — then a row of buttons that turn the whole desk into one thing you can carry: Visit packet (PDF), Email me the packet, PDF, PNG, Print, Email, Open intake. Underneath, a fourteen-day blood-pressure chart that was correctly empty, because I had entered nothing: it said Last — and drew no line. An empty chart that admits it is empty is a small thing that most software gets wrong.

Where the state lives

In localStorage, under one key, with a migration path from the previous one. Every write is wrapped, so a private window or a blocked-site-data setting degrades into a session that works but does not persist rather than one that throws. Export JSON, Import and Wipe PHI are all in the rail, not three screens deep in a settings page.

The honest consequence, which the desk does not print anywhere I could find: clearing your site data loses the desk. There is no account to restore from, because there is no account. That is the price of the privacy model and it is worth paying, but the export button is doing more work than its placement suggests.

The best-engineered thing on the desk is a string

The clinician search does radius lookups from a US ZIP code, which needs 33,144 ZIP Code Tabulation Area centroids in the browser. As JSON — {zip, lat, lon} thirty-three thousand times over — the file’s own header puts that at about 1.6 MB. Instead it ships as one fixed-width string, eighteen characters a row: five for the ZIP, then latitude and longitude as signed thousandths of a degree.

I downloaded js/zips.js and measured the blob rather than trusting the comment. It is 596,592 characters long. Divide by eighteen and you get 33,144.0 exactly — no remainder, no ragged last row. That is 582.6 KiB doing the work of 1.6 MB, and it parses into a lookup the first time something asks for it rather than on load.

The reasoning is in the file and it survives review: this turns within ten miles of 11201 into arithmetic, every alternative is a network call per lookup against a service that may not send CORS, and the data changes once a decade. The same header then volunteers the weakness — a ZCTA is not a postal ZIP — before a reviewer can find it.

The exception to the rule

Two scripts on the page come from somewhere else. One is the estate’s analytics tag, which I blocked at the network layer for every screenshot here. The other matters more: unpkg.com/dicom-parser@1.8.21, loaded without a Subresource Integrity attribute. I grepped the live document for integrity= and got zero.

Three consequences, none of them fatal and all of them real. If unpkg is unreachable the imaging lab alone stops working while the other thirteen routes carry on. The promise that everything stays on this device is true of your data and not of its code, because loading the page tells a third party you opened it. And it is the one supply-chain surface in an otherwise entirely first-party property: the version is pinned, the bytes are not.

Verdict, such as a notebook gives one

Rx.Luxury is not a product that wants something from you. It is a filing cabinet with good drawers: the intake writes the medication tray, the symptom picks become today’s reason for the visit, the condition tracker reads the problem list, and the whole thing comes out the other end as a one-page packet you can hand to somebody. Nothing about that requires a server, and the desk has correctly concluded that it should not have one.

What it asks in return is a door with a name box on it, a dependency it does not need to expose, and a storage model that forgets you completely if you clear your browser. That is a fair trade, stated plainly, by software that keeps printing its own limits in the same size type as its claims.