Add unit tests for critical UI-layer pure functions

[zntznt]

Problem

The entire UI layer (app.js, renderer.js, editor.js, charts.js, app-*.js) has zero unit tests. All UI testing relies on a single Playwright smoke test (test/smoke.js) — a 1000-line monolithic script tightly coupled to DOM structure. A typo in an element ID, a broken undo restore, or a corrupted clipboard paste can go undetected.

Plan

Add unit tests for UI functions that are testable without a browser. These run under Node alongside the existing engine tests.

Test targets

1. Undo/redo stack integrity — after N edits, undo returns to exact prior state; redo restores; committing after undo clears redo stack; stack capped at 100 entries.

2. Copy/paste ID remapping — copied nodes get new IDs; connection endpoints remapped; clipboard offset advances on repeated paste; only internal connections between selected nodes are preserved.

3. Share URL encode/decode round-trip — encodeURIComponent + btoa / atob + decodeURIComponent pair correctly for diagrams with Unicode labels, special characters, and edge cases (empty diagram, single node).

4. Assertion parsing edge cases — parseAssertion handles: missing expression, whitespace-only, unclosed quotes, multiple colons, step zero, negative step, non-integer step.

What's NOT included

• DOM-dependent tests (renderer, editor interaction, charts) — these remain in the Playwright smoke test
• CSS/layout regression tests

Effort

~4 hours. 1 file (test/run.js additions or a new test/ui-tests.js). ~150 lines.

[zntznt]

Implementation Order

This is Phase 3 · Step 3.3 — implement after Phase 2.

Priority: HIGH
Phase: 3 (Structural / Developer-Facing)
Order: 9 of 10
Depends on: Phase 2 complete (engine changes may affect what tests capture)
Effort: ~4 hours

[zntznt]

Adding evidence from a recent review, since this is exactly the right tracking issue:

• js/app-props.js is 2,209 lines and js/renderer.js 1,939, with monster methods (_updateConnEl ~216 lines, _updateChartEl ~204, _roundRect ~215).
• 46 innerHTML call sites in js/ — a potential XSS surface for the #d= share URLs (unverified).
• Everything outside model/engine is guarded only by the smoke suite; the interactive tour smoke is the only DOM-level net.

The pure-function test approach used for model/engine (sandboxed via new Function) would extend naturally to the pure parts of the UI layer (e.g. template/state-shaping helpers), which is where the highest regression risk lives.