feat(factory): two-level navigation and first-party chart parity

[castrojo]

Implements adr/0003-factory-two-level-navigation.md.

What changed

/factory was one 5,364-line component with two tabs behind ?tab=. It is now eight code-split routes under a two-level tab bar:

Live	/factory · /factory/community
Factory	/factory/images · /builds · /tests · /applications · /metrics · /userspace

?tab=live and ?tab=health are rewritten to their routes, guarded to /factory so a stale query string cannot hijack navigation from another view.

The tabs were measurably hidden. They were 0.78rem uppercase #8b949e with no background fill, a 2px underline, a sub-44px target, ~400px down a 1080p viewport — readers reached content before navigation. They are now 1rem/700, filled when active, sticky, with a roving tabindex so passing the nav costs two Tab presses instead of nine.

Seven new pipelines, zero lab resources

Every dataset is regenerated from its original public source. Nothing reads the lab site or the lab cluster.

Fedora countme · Homebrew analytics · Flathub · OpenSSF Scorecard · GitHub Releases, Actions and Packages APIs.

The countme CSV is 618 MB, so fetch-countme.js range-reads a bounded 12 MB tail of a file sorted ascending by week and merges into a tracked seed — history accrues without the size ever being paid. Scorecard has no history endpoint, so its seed accumulates the same way.

What is deliberately absent

• Container pull counts. GHCR publishes no download counter and Bluefin publishes to GHCR only. Countme, Flathub and Homebrew are the adoption signals instead.
• Homebrew third-party tap installs. Not tracked by Homebrew. Its os-version analytics is substituted — and it is a better metric: Bluefin ranks chore(ci): turn on merge queue, workflow dispatch, PR checks #11 worldwide out of 9,734 operating systems, at 0.48% of all Homebrew installs.
• Per-image CVE counts. Refused with reasons in adr/research/cve-feasibility.md: the SBOM seed carries 11 curated package versions, not an inventory. Scanning 0.5% of a 2,000-package surface and calling it a CVE count would be a confident-looking false claim next to true ones.
• Everything measuring the lab cluster — BuildStream caches, the Thunderbolt link, contributor hardware, KubeVirt, ArgoCD. Dropped, not approximated.

Defects fixed along the way

Found by a design audit of the shipped page:

• An all-zero sparkline series vanished instead of drawing a flat line.
• Six small multiples in HistoryTrends autoscaled independently, so every cell looked identical regardless of value.
• Severity was encoded by hue, including a red/green pair, in advisories, CI badges and the formation bar.
• Three colour pairs failed WCAG AA — the worst at 2.7:1. Every text grey now clears AA on all three surfaces.
• Two infinite animations had no prefers-reduced-motion guard.
• 136 KB of static JSON was fetched client-side in four effects on every tab; routes now declare what they need and navigation does not refetch.
• Panels returned null while loading, so they disappeared. scripts/panel-unavailability.test.js now fails on a component-level return null in any panel, present or future.

Assumptions ratified by ADR 0003

Applications means the applications Bluefin ships, not lab's ArgoCD state. Userspace means Bluefin's userspace stack. Tests is reconstructed from GitHub Actions at repo × workflow granularity rather than lab's suite × variant.

Verification

• Clean build with a token and without one: both exit 0. Also builds green with every dataset forced to unavailable.
• All eight routes emitted; no lab hostname and no IP address anywhere in build/factory/.
• ECharts is isolated in lazy chunks, out of the initial route bundle.
• npm test 318 pass / 0 fail · npm run typecheck clean · npm run lint 0 errors.

[castrojo]

Closing — this was opened from a personal fork by mistake. Reopening from a branch on projectbluefin/documentation for pure upstream development.