Function normalize_entry_timestamp 

pub fn normalize_entry_timestamp(ts: &str) -> String

Rewrite a log entry’s YYYY-MM-DD HH:MM:SS.ffffff timestamp into the stamp form, dropping the sub-second part so it compares against a filename stamp.

Input too short to hold a full timestamp is normalized as best it can be rather than rejected, so a partially parsed entry still windows sanely.