diff --git a/NOTEPAD.md b/NOTEPAD.md
index e248215..a7a2acd 100644
--- a/NOTEPAD.md
+++ b/NOTEPAD.md
@@ -58,6 +58,15 @@ Deferring because out of scope is fine, but don't mention deferring than.
   zero rather than as unknown — which is how a deleted `failures_24h` showed as "0 failures"
   unnoticed. The per-card half is one line; Home sums across installations and has nowhere to
   say "3 of 4 reporting", so the two want doing together.
+- PERF/API: enabling or disabling one flow calls `FlowController.reload()`, which tears down
+  and rebuilds *every* flow — reconnecting each node, including the ones that talk to hardware
+  over the network. On the tinyhouse installation (nineteen flows, MQTT + UniFi + aircon) a
+  single toggle takes 8-10s end to end. Same root as the seeding cost below: there is no way
+  to change one flow's runtime state without rebuilding the whole pipeline.
+- CHORE/TEST: `runtime.spec.ts` "the home page lists flows and can stop one" asserts the row
+  reads "Stopped" within Playwright's 5s default. That is shorter than a real installation's
+  rebuild (above), so the spec passes on a small instance and fails on a populated one. It is
+  the rebuild that wants fixing, not the timeout — raising it would only hide the cost.
 - FEAT/SEC: `locked` is a read-only surface, not a permission — the server accepts a publish
   from a panel whose dashboard says locked. Making it real means carrying the flag into
   `_panel_may`.