follow-up(web-ui): memory profiling and runtime coverage gaps after #134

[lidge-jun]

Context

#134 shipped the Web UI runtime hardening slice and final CI passed on master at 09478e9.

Final CI:
https://github.com/lidge-jun/cli-jaw/actions/runs/25044388746

This issue tracks the remaining follow-ups that were intentionally left out of #134.

Follow-up scope

1. Browser memory / serve-path profiling

Record and compare:

• jaw serve fresh tab memory
• /Users/jun/Developer/new/jaw_launchd.sh fresh tab memory
• /Users/jun/Developer/new/jaw_launchd.sh reload memory
• loaded asset hashes
• service worker / cache state
• tool block counts

Manual criterion inherited from the memory/chunk work:

fresh long-history tab baseline <= 400 MB

2. Lazy raw sidecar decision

Do not implement the sidecar store by default.

Only proceed if heap/profile evidence shows retained memory from:

• data-raw
• data-tool-log

If confirmed, design a sidecar store so virtual history shells do not keep large raw strings in DOM attributes.

3. Runtime coverage gaps from #134 verification

Add focused tests for:

• ProcessBlock: stepRef-bearing completion does not close the wrong running row.
• ProcessBlock: legacy no-stepRef fallback is used only when exactly one safe running row exists.
• Build-output guard: __vite__mapDeps([... vendor-mermaid/vendor-utils ...]) failure fixture.
• Build-output guard: eager entry byte budget overflow fixture.
• Mermaid: rerenderMermaidDiagrams() remains serialized through the shared queue.
• Sanitizer: Mermaid SVG foreignObject and external CSS url(...) stripping, if testable without test-only hooks.

4. Optional CI cleanup

The final CI is green, but GitHub Actions emitted a Node.js 20 deprecation annotation for actions/upload-artifact@v5.

This is not blocking now, but before the GitHub runner default changes to Node 24, check whether any workflow pin or action version update is needed.

Non-goals

• Do not reopen hardening(web-ui): runtime tests and cleanup follow-ups after memory fix #134.
• Do not change backend/API/DB behavior unless profiling proves a backend issue.
• Do not implement lazy raw sidecar without heap evidence.

Links

• Completed issue: hardening(web-ui): runtime tests and cleanup follow-ups after memory fix #134
• Final CI for hardening(web-ui): runtime tests and cleanup follow-ups after memory fix #134: https://github.com/lidge-jun/cli-jaw/actions/runs/25044388746
• Final shipped commit: 09478e9