fix(dashboard): findings-view polish — selection-safe poll, unique row ids, active-tab highlight, header/nav realign, collapse pod replicas

[thejefflarson]

Five Findings-view fixes (scope: Findings view only — finding_row.rs, nav.rs, findings.rs map/collapse/id, dashboard.css, dashboard.js, the preview + tests; behavior/evidence rendering and observe/graph/reason untouched).

1. Copy-paste / scroll-jump on the live poll (bug)

dashboard.js did live.innerHTML = html every 5s, destroying any in-progress text selection. The poll now checks window.getSelection() and defers the swap while a non-collapsed selection is anchored inside #live, swapping on the next tick once it clears. Scroll-restore preserved; zero-dependency, same-origin.

2. Rows open the wrong row (bug) — root cause

finding_id() slugified every non-alphanumeric to -, so distinct entry keys (e.g. secret/app/db and secret-app-db, or endpoint/a and endpoint-a) collapsed to the same id — duplicate data-finding / id / aria-controls="detail-<id>". expanded.has(id) and getElementById/.row.open + .row-detail then matched multiple rows, opening the wrong detail. Fixed by appending a short, stable FNV-1a hash of the full entry key (deterministic across renders so the JS open-state keying survives a poll), making every row + detail id unique. Test: two distinct entries that previously collided now get distinct ids.

3. Highlight the active tab

.tab-active gains a raised --surface-raised fill + a stronger 3px accent rail, keeping bold weight + the accent — clearly highlighted, meaning not by colour alone, tokens only (no raw hex).

4. Realign header + nav to the table's + (reverses the gutter decision)

New shared --brand-indent token = --page-gutter + --space-2 (.cell-expand pad) + --space-1 (.expander pad), reproducing the x of the first-column + glyph. Applied to .strip and .tabs left padding so the brand 'p', the active tab's first letter, and the + form one vertical line. Verified in the dev preview.

5. Collapse pod replicas into one workload row (feature)

New collapse_pod_replicas step in map_findings (mirrors collapse_fanout). Derives a workload-group key from a workload/<ns>/Pod/<name> entry by stripping the replica suffix:

• StatefulSet name-<ordinal> (trailing -<digits>)
• Deployment name-<rs-hash>-<pod-hash> (two trailing hash segments)
• DaemonSet / ReplicaSet name-<pod-hash> (one trailing 5-char hash)

Collapse heuristic (conservative): a hash segment must mix at least one letter and one digit, so a dictionary-word tail like debug-shell is treated as part of the name and left un-merged; and only groups with 2+ pods collapse. So unrelated pods and standalone pods are never merged. The representative row carries the worst/most-urgent posture (urgency_rank) and a ×N replica count, relabeled to the workload (analytics/murmurify-aggregator). Replicas run the same image, so a merged posture is sound. Tests: 3 StatefulSet replicas → one ×3 breach row; Deployment replicas collapse; unrelated + standalone + single-replica never merge.

Checks (from engine/)

• cargo fmt — clean
• cargo build — ok
• cargo build --example dashboard_preview — ok
• cargo clippy --all-targets — 0 warnings
• cargo test — 355 lib + 9 dashboard_guards + 1 file-size + 1 bin, all green
• Visual: dev preview at ?scenario=breach shows the single analytics/murmurify-aggregator ×3 row, no duplicate data-finding ids, brand/tab/+ aligned, raised active tab.

Closes JEF-... (findings-view polish)

🤖 Generated with Claude Code