Record what the package sweep landed and what it turned up

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H7LwYgJfpkbLCTeiAf8U4A

NOTEPAD.md

@@ -6,86 +6,62 @@ Where TYPE could be BUG, FEAT, PERF, CHORE and SCOPE could be UX, UI, FLOW, NODE
 Don't write temporary reasons for deferring a task in the task description (only strategical reasons should be noted).
 Deferring because out of scope is fine, but don't mention deferring than.
 
-Open work is grouped into packages, each one session's worth of work with its
-own file territory so two can run at once. Packages are ordered by priority;
-so are the items inside them. `Deferred` holds what stays open on purpose,
-each with the condition that should reopen it.
+`Deferred` holds what stays open on purpose, each with the condition that
+should reopen it.
 
 ## Open
 
-### A — Dashboard rework
+### Connector write paths
 
-Closes the M4 "visualization flows" remainder. Depends on B: it adopts the
-flow canvas' toolbar, side panel and title chrome, so those move first.
-
-- FEAT/UX: unify the layout between dashboard and flows: 1) In the flows: adapt the "overview" from the dashboard; clicking flows in the sidebar leads to a searchable overview of flows like in the dashboard. Then the "flowbar" get's merged into the bottom toolbar (status and edit button; add flow button goes in the overview) with the name of the current flow still being displayed at the top for reference. 2) adopt the floating bottom toolbar from the flow viewport and the click widget to edit behavior (make sure inputs like sliders and buttons stay interactable). Also adapt the new flow-title (sync UI) and the new edit button in the toolbar to trigger a panel for renaming the flow (and more later). The same floating right panel as in the flows should also be the way to go to edit a widget.
-- FEAT/UI/MOBILE: a "View" button in the toolbar opens the dashboard in a new tab on a full-bleed route — no sidebar, no edit affordances, the link a wall panel is pointed at. Dashboards render in the padded admin shell today, so a panel gets the sidebar, footer and a `max-w-7xl` column.
-- FEAT/UI: allow resizing of dashboard widgets by dragging edges and add the same dotted background we see in the flows viewport (again, sync UI (see above)). Widgets are sized with a wider/narrower control today; the document already stores layout per breakpoint, so only the editor changes.
-- FEAT/UX: allow setting a grid size for the dashboard to adjust to different wallpanel sizes (goes into the new dashboard panel setting; see above)
-- FEAT/UI: add a graph widget to the dashboard. The chart widget type is stored, validated and backed by message history already, but nothing draws it and the editor's add row filters it out. Needs a charting library and `--chart-*` tokens: one designed sequential scale, reintroduced when this lands. The node sparkline draws one series in `--primary` and needs none.
-- BUG/UI: strictly type a dashboard widget; i.e. wiring a boolean switch to a float message (or wiring no publish/consume at all) should flag the node as error -> reuse error indicator from the flows
-
-### B — Flow canvas and editor UX
-
-- FEAT/UX: allow copy-pasting of nodes (also between flows)
-- FEAT/UX: introduce general keyboard shortcut system. As a first test: when hitting ctrl-s we should catch this keyboard shortcut to a) publish a flow b) save (and apply) code changes when in the code editor
-- BUG/UI: there are two places to rename a flow; we should only go for the one in the top of the panel name (so that the UX is identical to the ones from the nodes). The actual rename should happen with dedicated "confirm" button (same for the nodes)
-- FEAT/UI: publishing and discarding are only reachable while no side panel is open, since the floating chrome hides for the panel. Editing a node's code and publishing it is therefore close-panel-then-publish.
-- BUG/UI: when the edges pulse on message, they change their color (go from slightly darker back to normal) at the end again. Double check that after the animation they end up with the same color as before to not have this double-pulse effect
-- BUG/UI: clicking outside the panel does not discard the flow edit panel
-- BUG/UI: the graph showed in the node edit panel should also be shown for a specific edge inside the pop-up panel when clicking the edge
-- BUG/UI: the enlarged panel (for code editing) should still maintain its floating style
-- FEAT/UI: a "Bug" icon on the node error bubble opening the logs panel at that node's traceback. The panel has the traceback; wiring the bubble to open and filter it needs the panel's open state lifted into `FlowEditor`.
-- FEAT/UI: flow-level edits (title, inputs) go through `FlowPanel.onChange` and stay outside the undo stack.
-- BUG/UI: `SidePanel`'s mobile branch does not set `data-testid` on the `SheetContent`, so `[data-testid=node-panel]` does not exist on a phone. Mobile specs cannot address the panel.
-
-### C — Node settings UX
-
-Node panel only, so it can run alongside A once B has landed.
-
-- FEAT/UX: for the same type of node show suggestions in the setting fields based on other nodes; I.e. if I create an mqtt node and I already configured one in another flow, allow selecting the values of the exiting mqtt node as a drop-down option (identical to consumables) when clicking inside the corresponding field in the new node (same for all other nodes)
-- FEAT/UX: in delay and schedule nodes: help creating cron schedules by providing a legend; Also: if interval is entered, this should automatically create a cron according to the interval set
-- FEAT/UX: python function should automatically update according to what the node consumes or produces
-
-### D — Admin screens
-
-Three backends without a face. API-first holds — the OAuth one needs its
-endpoints written before the screen.
-
-- FEAT/UI: there is no screen for managing the secrets store itself. A node parameter marked `x-secret` offers the stored secrets, but they can only be created through the API. We should introduce a dedicated page (in the sidebar) to handle secrets in a centralized way. The engine's own "secret not found" error already points the user at such a screen.
-- FEAT/UI: no screen for alerting. Channels and rules are API-only (`/alerts/config`), so setting up a phone notification means calling the endpoint by hand.
-- FEAT/UI: no screen for the OAuth clients an agent registers. They can only be listed or removed in the database, so withdrawing one agent's access means deleting its rows or rotating `OAUTH_PRIVATE_KEY_FILE`, which cuts off all of them.
-
-### E — Engine
-
-- FEAT/FLOW: single-stepping a paused flow. The work queue it needed now exists: pausing parks claimed items per flow and resuming drains them, so a step button is a matter of popping one parked item instead of all of them.
-- BUG/FLOW: `Pipeline.resume()` re-executes a flow's nodes but does not appear to unpark what pausing parked, so parked items may only drain on the next trigger. Confirm against `queue.unpark` callers before building the step button on top.
-- FEAT/FLOW: input discretization drops the trailing edge — if a producer goes quiet inside the window, the consumer never sees the last value. Delivering it at the end of the window needs a timer per (node, port).
-- CHORE/FLOW: a node function returning something other than a dict raises `AttributeError` in `Node._to_messages` rather than a named error. Outputs are keyed by port, so a non-dict cannot be one — say so where the return value is mapped, which is the one place every caller routes through.
-
-### F — Infrastructure and dev hygiene
-
-- CHORE/UI: the Playwright specs run against the development stack and leave their users and flows behind, which is why the flowbar filled with `test_flow_*`. Give them their own data or clean up after themselves, as `pytest` now does.
-- CHORE/UI: `make test-backend` cannot reach Postgres while the integrated stack is up — `compose.local.yml` does `db: ports: !reset []`. Run it against the container's address, or move the suite inside the compose network.
-- CHORE/UI: the standalone Vite origin (`make dev-frontend` on :5173) is still not in `BACKEND_CORS_ORIGINS`. `scripts/setup.sh` regenerates the list on every `make init` and `compose.local.yml` re-declares it as a container variable that wins, so the origin has to be added in both places to work.
-- CHORE/INFRA: `test-backend.yml` runs pytest on the runner host, so it keeps the fixed container name and port 5432 that `compose.ci.yml` resets everywhere else. Two concurrent runs of that one job collide.
-- FEAT/INFRA: MQTT broker and InfluxDB compose services for local development. The node types exist; a local broker would make them testable without external hardware.
-- CHORE/FLOW: four modules of `app/flow/nodes/` are still excluded from strict mypy (`[[tool.mypy.overrides]]` in `pyproject.toml`): `mqtt`, `http`, `influx` and `delay`. They carry prototype typing, `croniter` ships no stubs and `influxdb_client` does not re-export its names. `base` and `mlp` are checked; shrink the rest as each integration is revisited.
-
-### G — Connector write paths
-
-Needs someone watching the real hardware, so it is not a background task.
+Needs someone watching the real hardware, so it is not a background task. This
+is what M4 still waits on, together with porting the flows.
 
 - FEAT/NODE: the connectors only read. Enable the write paths with someone watching: WF-RAC `setAirconStat` (needs an operatorId registered with the unit first, which is itself a write) and Art-Net `transmit`.
 - FEAT/NODE: the second WF-RAC unit (the one Node-RED addresses with operatorId "0") closes the connection on an anonymous read. It likely wants an account registered; the first unit answers without one.
 - CHORE/NODE: `wfrac` reports `mode` as "unknown" while the unit is off, because the mode bits hold a value outside the known set. Faithful to the reference decoder, but "off" would read better.
 
+### Bugs found while building the screens
+
+- BUG/API: `POST /alerts/test/{channel}` always answers 200. `AlertManager.send()` catches and logs every delivery failure, so the alerts screen's Test button cannot tell a working channel from a broken one — the one thing it exists for. Let `send()` raise or return a result on the test path.
+- BUG/API: `RedisWorkQueue.stats()` hard-codes `"parked": 0`, so held or stranded work never shows on the health endpoint. This is why a rebuild stranding parked items went unnoticed until it was looked for.
+- BUG/FLOW: deleting a flow leaves its `pipeline:{flow}.*` Redis keys behind, and renaming one does not migrate them — the live instance carries `pipeline:__history__:dashboar.test` beside the correct `dashboard.test`. One cleanup on the delete/rename path covers both.
+- CHORE/API: revoking an OAuth client does not invalidate access tokens already issued; they are stateless JWTs valid up to `MCP_TOKEN_EXPIRE_MINUTES`. Immediate revocation means `app/mcp/http.py` checking the client row still exists.
+- CHORE/FLOW: `Pipeline.trigger`'s docstring says a paused flow still publishes so the value shows on the canvas. True only without a queue; with one the item parks before `apply_outputs` and nothing shows. Docstring and behaviour disagree.
+- CHORE/FLOW: `_to_messages` keeps its `if not retval: return None` guard ahead of the new type check, so a falsy non-dict return (`0`, `""`, `[]`) is still silently "no output" rather than the named error. Deliberate for now; worth a decision.
+- CHORE/FLOW: `WorkItem.kind == "node"` ("executes exactly one node") was documented but never implemented. If a run-one-node item is wanted, it still needs writing.
+
+### Dashboard follow-ups
+
+- FEAT/UI: multi-page and multi-section dashboards have no UI. The backend has `PageDef`/`SectionDef` and rename; the editor only ever edits `sectionsOf(page)[0]`, so nothing can create a second page.
+- FEAT/UI: only `layout.lg` is ever written. Below `lg` the view stacks widgets full width in CSS, so `md`/`sm` stay unused until a per-breakpoint editor exists.
+- PERF/UI: `ChartWidget` re-joins the whole table on every live value. Fine at IoT rates; at `HISTORY_CAP` × 5 series it should append into a ring buffer.
+- CHORE/UI: opening edit mode on a dashboard whose widgets predate placement writes the migrated positions immediately, bumping the version once.
+- CHORE/API: no backend test for the `WidgetDef` dtype validator or `columns`.
+
+### Flow editor follow-ups
+
+- CHORE/API: `POST /flows/{name}/rename` is no longer reachable from the UI. A flow's title is what the panel edits, matching how nodes work; the canonical name is fixed at creation, so either the endpoint goes or renaming comes back deliberately.
+- BUG/UI: `renderedNodes` overwrites xyflow's own `selected` flag with `id === selectedId`, so a box-selection of several nodes is invisible even though delete and copy act on all of them.
+- CHORE/UI: ⌘C/⌘V `preventDefault` on the canvas blocks the native clipboard there (fields are guarded). The node clipboard is `localStorage`, so it does not cross browsers or profiles.
+- PERF/UI: `useParamSuggestions` fetches every flow's detail to build the suggestion list. An aggregate endpoint if an installation ever has many flows.
+- CHORE/UX: the derived-cron chip also appears on the delay node, where `interval` is a rate limit rather than a schedule. May want it inject-only.
+- CHORE/UX: free-form params (python nodes) get no suggestions, since there is no schema to key them off.
+
+### Infrastructure
+
+- CHORE/INFRA: Playwright cannot run on this host — the browsers are downloaded but the system libraries are not installed, so `make verify` and `make test-frontend` only work through a container. `make verify-docker` covers the screenshots; the spec suite has no equivalent yet, and the `playwright` compose service cannot reach `api.localhost`.
+- CHORE/DOCS: `app/development.md` still presents `docker compose watch` as the dev flow; it and the Makefile targets disagree about how the stack is started.
+- CHORE/UI: `make lint-frontend` is `biome check --write --unsafe ./` — a lint target that rewrites the whole tree rather than checking it. A checking target plus a separate `format` would be safer.
+- CHORE/UI: `routeTree.gen.ts` was generated by an older router version than the installed one; the next build reorders ~130 lines regardless of who touched it.
+- CHORE/UI: the alerts screen duplicates the backend's `ALERTING_EVENTS`; the chooser drifts if the backend set grows. A rule with nothing ticked covers everything, so it fails soft.
+- CHORE/UI: `tests/runtime.spec.ts` still calls the home page "the dashboard" (`dashboard-flow-row`), which now collides with the dashboards feature.
+
 ## Deferred
 
 Open on purpose. Each names what should bring it back.
 
 - PERF/FLOW: every save rebuilds the whole pipeline. Fine at the current flow count; rebuild only the touched flow when it starts to show.
-- PERF/UI: the app's entry chunk is 680 kB (210 kB gzipped) and exceeds the warning threshold. React Flow and Monaco are already lazy; a manualChunks split measured no better, so this needs route-level work on the shell rather than chunking config.
+- PERF/UI: the app's entry chunk exceeds the warning threshold. React Flow and Monaco are already lazy; a manualChunks split measured no better, so this needs route-level work on the shell rather than chunking config.
 - PERF/UI: the Monaco chunk is 2.6 MB. It only loads when a node panel opens, but the editor could be trimmed further or swapped for CodeMirror if that becomes a problem.
 - CHORE/API: node source saves carry no version precondition, so two clients editing the same node's code are last-writer-wins. The flow document is what the optimistic lock protects; code files would need their own, and an exact-match one produces false conflicts against a single client's own interleaved flow and source saves. Revisit with the M5 multi-user work.
 - CHORE/FLOW: shared node sources bypass the draft/publish split. Editing one writes the library copy and reloads immediately, since the code is not any single flow's to hold back. Deliberate, but it means a shared node is the one thing publish does not gate.

ROADMAP.md

@@ -158,9 +158,10 @@ React + Vite, primarily desktop but usable on mobile. See `docs/architecture/str
 - [ ] Device assignment per node, selectable from compatible devices
 - [ ] Test-node affordance on the canvas
 - [ ] User management screens
-- [ ] Screens for what the API already owns alone: the secrets store, alert
-      channels and rules, and the OAuth clients an agent registers — the last
-      needs its management endpoints written first
+- [x] Screens for what the API used to own alone: the secrets store and the alert
+      channels/rules each get a sidebar page, and the OAuth clients an agent
+      registers are listed and revocable under Admin — which needed its
+      management endpoints written first
 - [x] Mobile-friendly canvas: touch connect, full-screen node panel
 - [ ] Installable as a PWA (`vite-plugin-pwa`)
 
@@ -172,11 +173,12 @@ Shares components with the admin view. See `docs/architecture/structure.canvas`
 - [x] User-defined dashboard layout with edit and view modes: dashboards are their own
       documents, widgets bind to message names, and the input ones publish back. View
       mode is plain CSS grid, so a panel that only displays loads no editing code
-- [ ] Chart widget drawing a message's history, with the one sequential
-      `--chart-*` scale it needs. The type and its history are stored and served
-      already; nothing draws it
-- [ ] Layout by dragging rather than a width control, a grid size per dashboard,
-      and a full-bleed route so a wall panel loads no admin chrome
+- [x] Chart widget drawing a message's history through uPlot, with `--chart-1…5`
+      as one lightness ramp of the brand hue; a widget bound to the wrong dtype,
+      or to nothing, is flagged the way a failing node is
+- [x] Layout by dragging and resizing (react-grid-layout), a grid size per
+      dashboard, and `/view/{name}` — a full-bleed route that loads neither the
+      editor nor the grid library, which is what a wall panel is pointed at
 - [ ] Per-device view
 
 ## Phase 5 — Website and docs