fix eight dashboard defects found by driving the live dashboard

[samiujan]

Description

Eight independent fixes found by auditing the shipping dashboard against a live rgctl serve indexing a
TypeScript repo (5,345 nodes / 11,801 edges / 1,479 functions), driving each tab over the Chrome DevTools
Protocol and capturing DOM evidence. Each fix is its own commit so any of them can be dropped or
cherry-picked independently.

Fixes #112

dashboard/dist is rebuilt in this branch, not left stale. These fixes change dashboard/src, but
the built bundle is a separate committed artifact that the binary embeds at compile time — several
upstream dashboard commits update both together. Rebuilding needed a real wasm-pack build (the build
script substitutes a throwing stub engine when it is missing), so the last commit here carries the
rebuilt assets. Details in Additional Notes.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Performance improvement
• Documentation update
• Language support (new language plugin)
• Refactoring (no functional changes)

Changes Made

One commit each, in the order they appear on the branch:

1. Taint empty state named a flag that cannot enable taint. It advised
   discover . --languages java --cfg; --cfg does not produce a taint index (--with-taint does, and
   it already implies the CFG pass — src/cli/discover_impl.rs:116), and it hardcoded a language on a
   TypeScript repo. dashboard/src/TaintView.tsx:96-104
2. Mutation filter defaulted to a CoolStore demo value. useState("ShoppingCart") meant the Field
   mutations panel rendered "0 shown" on every other repo — a working feature that looked broken. An
   empty filter already matches everything (MutationsPanel.tsx:19), so it now starts empty and derives
   its placeholder from index.types. dashboard/src/MutationsPanel.tsx:48,115
3. Leaked developer stub text. ViewLegend renders its hint prop as visible body copy
   (ViewLegend.tsx:24), and the blast view passed it "Sidebar meta: impact score · direct callers ·
   impact zone". Of nine hint= call sites, only this one was a note-to-self; the rest are legitimate
   legend headings. The view has no colour or shape encoding, so the legend was removed rather than
   given a fake one. dashboard/src/BlastView.tsx:182-185
4. 0 and undefined rendered as the same glyph. — for BC/Harm/Blast on nearly every row, with
   nothing explaining why. The plumbing is fine — three separate data causes: betweenness is genuinely
   sparse (12 of 5,345 rows nonzero), harmonic is opt-in and hard-zeroed
   (crates/rgctl-analysis/src/centrality.rs:788), and blast is never bulk-filled on a flat call graph
   (src/cli/discover_impl.rs:884; 0 of 5,345). — now means unavailable, a computed zero renders as
   0, and the column tooltips state the gating, which was previously undocumented in the UI.
   dashboard/src/functionListUtils.ts:31-70
5. The stat row showed the node count twice. "Filtered Nodes" read the same expression as "Total
   Nodes" (App.tsx:98 and :104), and there is no filter state in the shell for it to reflect.
   dashboard/src/App.tsx:104
6. Footer leaked internal dev metadata — a repo-internal doc path and the payload-format codename, in
   Bootstrap's pink <code> styling, on every page. Replaced with the graph receipt: index time,
   truncated graph digest (full value on hover), dashboard version. dashboard/src/App.tsx:168-171
7. Two distinct functions rendered as identical sidebar rows. The CFG sidebar listed App twice with
   byte-identical meta for two different function_ids. shortPath kept only the last two path
   segments, so any two files sharing a final directory collapsed (src/routes/orders.ts and
   src/coolstore/routes/orders.ts both became …/routes/orders.ts). The index is not at fault —
   cfg_index.json is keyed by stable_key (storage.rs:196-207); an instrumented run produced 155
   entries / 155 unique ids / 0 duplicate pairs. Now keeps three segments, returns short paths verbatim
   instead of prefixing … needlessly, and exposes the full path via title.
   dashboard/src/functionListUtils.ts:160-169, FunctionListSidebar.tsx:193
8. Communities were labelled "Louvain". Neither Louvain nor Leiden is implemented — it is label
   propagation with Newman modularity, as docs/design/graph-metrics-design.md:87 already states
   outright. Fixed two user-visible strings; the serialized field name louvain_community_id is
   deliberately left alone, since renaming it would break the migration JSON contract.
   dashboard/src/GraphView.tsx:366, MigrationView.tsx:550

New tests: functionListUtils.metrics.test.ts (6) and functionListUtils.paths.test.ts (4), split so
each commit's tests pass independently.

Testing

• Unit tests added/updated

• Integration tests added/updated — cargo test --test dashboard_bundle (project gate)

• Tested with cargo test — the dashboard bundle gate; full suite not run, no Rust changes

• Manual testing performed

• npx vitest run — 21 passed / 21 across 5 files (10 of them new).

• npx tsc -b — passes, after the wasm build below produced dashboard/wasm/rgctl_wasm.js. On a clean
  checkout this fails with src/worker.ts(3,53): Cannot find module '../wasm/rgctl_wasm.js', which is a
  genuine build prerequisite rather than test noise.

• cargo test --test dashboard_bundle — 2 passed, confirming the rebuilt dist is structurally valid
  for the include_dir! embed and that discover writes the bundle correctly on the tiny fixture.

• wasm-pack build crates/rgctl-wasm --target web --release --no-opt — the engine is real, not the build
  script's stub fallback: new module 197,295 bytes, old 190,188-byte module deleted.

• cargo test was not run in full — no Rust code changed. Note that two lib tests fail on a clean tree
  (cli::agent_pack::tests::embedded_pack_lists_cursor_skills,
  languages::registry::tests::test_registry_creation); verified identical before and after these
  changes.

Test environment:

• OS: macOS (darwin 25.x)
• Rust version: n/a — no Rust changes

Checklist

• My code follows the style guidelines (ran cargo fmt) — n/a, no Rust changes
• I have performed a self-review of my code
• I have commented my code where necessary
• I have added tests that prove my fix/feature works
• All new and existing tests pass (cargo test) — not run; no Rust code changed
• No clippy warnings (cargo clippy --all-targets -- -D warnings) — not run; no Rust code changed
• Documentation updated (if applicable) — column tooltips now document the metric gating; no
  docs/ changes needed
• CONTRIBUTING.md guidelines followed
• All commits include DCO sign-off (Signed-off-by: Sami Jan <sami.jan@gmail.com>)

Performance Impact

• No measurable performance regression

All changes are presentational. The only extra work is index.types[0] for a placeholder and
digest.slice(0, 12) for the footer.

Breaking Changes

None. No API, schema, or serialized field changed.

Screenshots (if applicable)

Not attached — these were diagnosed from CDP screenshots and DOM dumps; happy to attach
before/after captures if useful.

Additional Notes

dashboard/dist is rebuilt in the final commit of this branch. dashboard/dist is tracked
(.gitignore:34 only ignores the root /dist) and compile-time embedded via
include_dir!("…/dashboard/dist") (crates/rgctl-dashboard/src/bundle.rs:7), so source changes under
dashboard/src/ have no effect on the shipped dashboard until dist is rebuilt and committed. Upstream
usually does both together — three of the last four dashboard commits updated src and dist
(9038146, e331284, d9b0f15).

Built with the real toolchain:

rustup target add wasm32-unknown-unknown
brew install wasm-pack
wasm-pack build crates/rgctl-wasm --target web --out-dir dashboard/wasm --release --no-opt
cd dashboard && npm run build

Verified rather than assumed: the new rgctl_wasm_bg-*.wasm is a genuine 197,295-byte WebAssembly
module and the old 190,188-byte one is gone; the fixes appear in the built chunks (the
--with-harmonic tooltip, the footer graph-digest receipt, three-segment path shortening) and the
leaked "Sidebar meta" string does not; tsc -b passes; 21/21 dashboard tests pass; and
cargo test --test dashboard_bundle passes. Rebuilt dist assets change hashed filenames, so the
commit is mostly renames plus index.html — normal for a bundle rebuild in this repo.

Separately worth fixing, not folded in here: scripts/build-dashboard.sh:13-19 silently writes a
throwing stub rgctl_wasm.js when wasm-pack is absent, and npm run build then bundles it happily —
so a contributor without wasm-pack can replace the real ~190 KB engine with a stub that throws at
runtime, and commit the result. It should fail loudly, or refuse to overwrite an existing real engine.
Happy to open that separately.

Two defects found in the same audit are not fixed here, deliberately:

• 11 top-level tabs wrap to two rows at 1440px, orphaning "Migration Rules". Not a CSS bug — the tab
  bar treats lenses (CFG, Dataflow, Slice, Blast) as destinations, which is an information-architecture
  problem. Patching the wrap would entrench it.
• Missing favicon → a 404 per page load (no <link rel="icon"> and no icon in dist/).

[samiujan]

Two force-pushes on this branch after opening it — apologies for the noise, both were fixes to my own
mistakes and the net diff is what the description now says.

1. DCO. The final commit (the dist rebuild) went in without a Signed-off-by trailer, so the DCO
   check flagged it. Amended and re-pushed; DCO is green now. All nine commits are signed off.
2. dashboard/dist. The branch originally changed only dashboard/src, which left the fixes inert —
   the built bundle is a tracked artifact that the binary embeds at compile time, so users would have kept
   seeing the old dashboard. It is now rebuilt with a real wasm-pack build, which is why the commit
   count went from 8 to 9 and why the diff is mostly renamed hashed assets.

I also replaced the original description, which still claimed dist was not regenerated. That was true
when I opened the PR and wrong a few minutes later; the current description matches the branch.

No review has happened yet, so nothing was invalidated — but I would rather flag it than leave you
guessing at two push events.