fix(webui): make long conversations usable — stop the full-transcript ratchet and the virtualized render loop

[alanjds]

Four commits against two independent causes of "long conversations are unusable".

1–2 remove the cliff on the default path (virtualize_transcript off).
3–4 make the virtualize_transcript checkbox actually usable.

Problem A — the full-transcript ratchet (default path)

renderMessages() rebuilds the whole transcript, and runs on every send, every SSE batch and every refresh. Measured on a synthetic 2000-message session (desktop Chromium — a phone is several times slower):

loaded rows	render	DOM nodes
37	46 ms	960
537	546 ms	13,460
2000	2,883 ms	50,007

Cost tracks S.messages.length exactly. The server is not involved: Session.load() is 4.6 ms, GET /api/session ~330 ms flat at both 200 and 2000 messages.

1. The bare full-transcript refetch

_messageReloadLimitForSession() returned null — "send no msg_limit" — when the previous load wasn't truncated, or when the reload hint exceeded the server ceiling. The hint grows to the loaded row count, so paging back crossed the 500-row ceiling and from then on every same-session refresh (tab focus, SSE catch-up, visibility change) refetched and re-rendered all 2000 rows.

That null was deliberate — a clamped window would silently drop loaded older rows (nesquena#6152/nesquena#6154). The window is now always bounded, and the invariant is upheld differently: rows older than the returned window that we already hold are retained and re-prepended. The re-join is skipped, letting the server window win, when the prior rows can't be trusted to line up (session shrank server-side via fork/undo/truncate, or we don't hold enough rows to cover the gap) — losing older rows to a re-fetch is recoverable via "load earlier", splicing a stale prefix onto a rewritten transcript is not.

loadSession() clears S.messages and _oldestIdx before the reload fetch, so the pre-clear offset is stashed alongside the existing carry-forward snapshot and consumed with it.

2. The render-window ratchet

nesquena#6999 capped the auto-expanding render window at 4× the default, but the two stream-completion sites in messages.js still expanded it to every loaded row — one completed turn undid the cap. All three sites now share one bounded helper.

This restores the nesquena#6999 invariant; it does not by itself bound render cost (with virtualization off the DOM is built for every loaded row regardless). Fix 1 is what removes the cliff.

Problem B — the virtualized transcript never stopped re-rendering

With virtualize_transcript on, an idle 2000-message session ran 47–50 full renders during 5 seconds of no input, forever. Each re-ran the scroll-restore path, so scrolling felt like fighting the page.

4. The loop

renderMessages()
  -> _compensateScrollForMeasurementDelta() writes container.scrollTop
    -> scroll event
      -> scroll listener calls _scheduleMessageVirtualizedRender()
        -> renderMessages()   ... round again

_scheduleMessageVirtualizedRender() exists to break exactly this, deduping on _messageVirtualWindowKey. But renderMessages() only assigned that key inside its cached-HTML early return — gated on sid !== _sessionHtmlCacheSid, so it runs only when switching to a session. Every steady-state re-render left the key at '', the guard could never match, and the compensation's own scroll write scheduled another render. Nothing converged because nothing was recorded as painted.

The key is now assigned on the normal path too, after the DOM is built and before the measurement pass.

virtualization ON, 2000 msgs	before	after
renders during 5 s idle	47–50	0
renders to settle after load	11–13	2–3
a 600 px wheel-up actually moves	67–186 px	600 px
viewport movement after settle	~800 px	0 px

The last two rows are the user-visible symptom, and now match the non-virtualized path exactly.

3. Row-height calibration (independent, kept)

rowHeightFor() gives unmeasured rows a height for the scroll geometry, and always took the flat per-role constant — roleForIdx is always supplied, so the measurement-derived value _currentMessageVirtualWindow passed as defaultHeight was dead code. Only ~45 of 2000 rows are ever measured, and the constants are wrong in both directions (measured median 214 vs user:120/assistant:160/tool_call:400), leaving total scroll height 34% short.

Now a running mean is kept per role and used for unmeasured rows, at all three unmeasured-row sites. Roles fall back to their static seed until they have samples (first paint unchanged); a session switch drops the samples with the height cache.

This was not the oscillation fix — worth stating plainly, since it looks like one. It closes the geometry gap from 34% to 6.6% and changed the drift by zero pixels; commit 4 is what the drift actually was. It's kept because the geometry it feeds is what makes a scrolled-up position meaningful at all.

virtualize_transcript is left default-off in this PR — flipping it is a product call, and worth a round of real-device testing on top of these numbers first.

Deliberately out of scope

Per "fix the class, not the instance", naming the siblings left alone. The render window is also expanded to the full transcript by jump-to-session-start, jump-to-message when the target is outside the window, and the outline jump; and outline.js still issues a bare no-msg_limit fetch. Those are explicit user requests to reveal the whole transcript, addressed by absolute index; windowing them needs a jump-to-index-with-context fetch.

Verification

• Reload requests always carry msg_limit (verified by intercepting the page's real /api/session traffic).
• Render window stays at the 200 cap across repeated turn completions.
• Idle render count, wheel travel and post-settle drift measured with real wheel events in headless Chromium; numbers above.
• 2486 tests pass across the 155 files reading the changed JS plus the virtualization suite. The 13 test_update_banner_fixes.py failures are pre-existing test-ordering pollution — identical on a clean tree (13 failed / 2453 passed) and the file passes standalone. Ruff clean.

On test quality: several changed behaviours were pinned by exact source strings, and those assertions are updated rather than deleted. Two of the new tests were explicitly checked to fail when their fix is reverted (test_unmeasured_rows_use_measured_role_mean_once_samples_exist → 120 != 300; test_render_messages_records_window_key_on_the_normal_path), because the pre-existing virtualization tests all still pass against a reverted calibration and would have proven nothing.