Make the dashboard truthful: honest graph windows, real errors, and navigable exploration

[Phoenixrr2113]

What this fixes

Batch four of the pre-launch audit: the dashboard. Eight verified defects, eleven accessibility findings, and the three requested explorer features.

Graph integrity

• The full-graph window is now nodes-first with induced edges: every returned edge has both endpoints in the same response. Previously nodes and edges were fetched with uncorrelated limits, silently dropping edges to unfetched nodes.
• Knowledge Entity nodes appear on the canvas for the first time (the legend always promised them), scoped to their project through ABOUT targets with directory-boundary matching. Review caught the first attempt including every entity in every project, including a fixture entity named FOREIGN PROJECT SECRET.
• Embedding vectors are stripped from all dashboard payloads.
• A new file-relationships endpoint returns a File's contained symbols, imports, importers, and linked knowledge, with a frozen contract.

Reliability

• Search: 250ms debounce, AbortController, and a generation guard so only the latest request writes results; aborts are not errors, and real failures show an error state.
• Operations tab: per-card error states with retry instead of rendering zeros on API failure, plus a page banner when everything fails.
• Every dashboard route validates numeric parameters (52 hostile-value cases proved nothing invalid reaches the query layer).

Explorer features

• Selection history with Back/Forward buttons and Alt+Arrow shortcuts, plus a project / file / symbol breadcrumb.
• File side panel rebuilt on the new endpoint with four sections of clickable, focusable rows.
• Selecting an off-canvas search result or reference adds the node to the canvas and pans to it, using canonical line-suffixed node ids shared through one helper after review caught two construction sites omitting the line.
• The legend derives from the shared label taxonomy and throws on unknown labels instead of silently rendering unstyled.

Accessibility

All eleven findings fixed: accessible names on inputs and the canvas region, a keyboard-reachable node list, ARIA disclosure and pressed states, restored focus treatment, live regions for async results and errors, and small-text contrast measured above 7:1 in both themes.

Review process

Two adversarial rounds plus a final probe, run against ephemeral databases and live HTTP on the built API. Round one found the entity scope leak and the id mismatch plus three test-evidence gaps (including a test proving behavior for a payload the contract makes impossible, which turned out to guard dead code, now deleted). Every fix was re-verified against the reviewer's own attack scripts on fresh fixtures.

Verification

• pnpm turbo build 21/21, test 36/36 (dashboard now has its own suite: 30 tests), typecheck 20/20, release:check green.

Ledger

• The built API artifact does not start via node dist/index.js (emitted ESM import missing a file extension); pre-existing, needs fixing before any standalone deployment.
• The file-relationships contract is silent on nonexistent paths (200 with empty arrays today); worth a 404 distinction later.
• References API does not support File targets (IMPORTS edges not followed), so File navigation deliberately uses the dedicated endpoint.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
v0-landing-page-build	Skipped		Aug 21, 2026 9:11pm