[security] replace innerHTML usages in js/historyView.js — convert to safe DOM APIs

Co-authored-by: PR0M3TH3AN <[email protected]>

docs/agents/task-logs/daily/2026-02-17_00-44-39_innerhtml-migration-agent_completed.md

@@ -0,0 +1 @@
+Successfully migrated 4 innerHTML assignments in `js/historyView.js` to `replaceChildren()`. Updated baseline.

js/historyView.js

@@ -1782,7 +1782,7 @@ export function createWatchHistoryRenderer(config = {}) {
 
   function showEmptyState() {
     if (elements.grid) {
-      elements.grid.innerHTML = "";
+      elements.grid.replaceChildren();
       setHidden(elements.grid, true);
     }
     clearHistoryCardRegistry();
@@ -1806,7 +1806,7 @@ export function createWatchHistoryRenderer(config = {}) {
     }
     detachObserver();
     if (elements.grid) {
-      elements.grid.innerHTML = "";
+      elements.grid.replaceChildren();
       setHidden(elements.grid, true);
     }
     if (elements.empty) {
@@ -2304,7 +2304,7 @@ export function createWatchHistoryRenderer(config = {}) {
     }
     state.cursor = 0;
     state.hasMore = state.items.length > 0;
-    elements.grid.innerHTML = "";
+    elements.grid.replaceChildren();
     clearHistoryCardRegistry();
     removeEmptyDayContainers(elements.grid);
     if (!state.items.length) {
@@ -2427,7 +2427,7 @@ export function createWatchHistoryRenderer(config = {}) {
       }
       clearSubscriptions();
       if (elements.grid) {
-        elements.grid.innerHTML = "";
+        elements.grid.replaceChildren();
       }
       clearHistoryCardRegistry();
       state.initialized = false;

scripts/check-innerhtml.mjs

@@ -27,7 +27,6 @@ const BASELINE = {
   "js/docsView.js": 1,
   "js/exploreView.js": 1,
   "js/forYouView.js": 1,
-  "js/historyView.js": 4,
   "js/index.js": 1,
   "js/kidsView.js": 1,
   "js/ui/components/DeleteModal.js": 3,