diff --git a/NOTEPAD.md b/NOTEPAD.md
index ed19531..5a878eb 100644
--- a/NOTEPAD.md
+++ b/NOTEPAD.md
@@ -8,54 +8,47 @@ Deferring because out of scope is fine, but don't mention deferring than.
 
 ## Open
 
-- BUG/UI: the sidebar background on dark mode does not match the background of the viewport/flow panel
-- BUG/UI: there is some strage dot (li item) sitting next to the appearance button
-- FEAT/UI: introduce User settings page showing up in the sidebar where the apperance, email password etc can be set (copy UX design from ../../n3xd/app)
-- BUG/UI: edge value labels should be opaque
-- BUG/UI: the popover which opens when clicking on an edge should be more compact, i.e. make label, value and last updated fit in a single row (truncate decimals) 
-- BUG/API: `pytest tests/` deletes every user on teardown (`tests/conftest.py`), so running
-  it against the development database logs you out of the running app. Point tests at their
-  own database, or reseed with `init_db` afterwards.
+- BUG/UI: `SidePanel`'s mobile branch does not set `data-testid` on the `SheetContent`, so
+  `[data-testid=node-panel]` does not exist on a phone. Mobile specs cannot address the panel.
+- FEAT/UI: no way to point a node parameter at a stored secret. The store and the
+  `{"$secret": "name"}` reference both work, but the params form only produces literals, so a
+  webhook secret typed there lands in `flow.json`.
+- FEAT/UI: flow-level edits (title, inputs) go through `FlowPanel.onChange` and stay outside
+  the undo stack.
+- CHORE/UI: `make test-backend` cannot reach Postgres while the integrated stack is up —
+  `compose.local.yml` does `db: ports: !reset []`. Run it against the container's address, or
+  move the suite inside the compose network.
+- CHORE/UI: the Playwright specs run against the development stack and leave their users and
+  flows behind, which is why the flowbar fills with `test_flow_*`. Give them their own data
+  or clean up after themselves, as `pytest` now does.
+- CHORE/UI: the standalone Vite origin (`make dev-frontend` on :5173) is still not in
+  `BACKEND_CORS_ORIGINS`. `scripts/setup.sh` regenerates the list on every `make init` and
+  `compose.local.yml` re-declares it as a container variable that wins, so the origin has to
+  be added in both places to work.
+- CHORE/INFRA: `test-backend.yml` runs pytest on the runner host, so it keeps the fixed
+  container name and port 5432 that `compose.ci.yml` resets everywhere else. Two concurrent
+  runs of that one job collide.
 - CHORE/FLOW: the InfluxDB token committed in the old `flow/nodes/influx_test.py` is in
   pushed history (`d222ce5`). Rotate it in InfluxDB; removing it from history needs a
   rewrite of published commits.
-- BUG/UI: six template Playwright specs fail on validation copy that no longer matches
-  (`login`, `sign-up`, `reset-password`, `user-settings` theme persistence). Unrelated to
-  the flow editor, which passes; fix or delete them with the `Item` cleanup.
-- CHORE/UI: `bunx playwright test` starts a dev server on :5173, which is not in the API's
-  `BACKEND_CORS_ORIGINS`, so every spec fails at login. Run against the integrated stack
-  with `PLAYWRIGHT_BASE_URL=http://app.localhost`, or add the dev origin to CORS.
-- FEAT/UI: no undo on the canvas. Deleting a node autosaves immediately, so a mis-click
-  costs the node's source.
-- PERF/UI: the Monaco chunk is 2.6 MB. It only loads when a node panel opens, but the
+- PERF/UI: (deferred for now) the Monaco chunk is 2.6 MB. It only loads when a node panel opens, but the
   editor could be trimmed further or swapped for CodeMirror if that becomes a problem.
-- FEAT/UI: renaming a message updates only the node being edited; the nodes consuming it
-  keep the old name and quietly disconnect. Offer to rename across the flow.
-- CHORE/INFRA: port the n3xd CI workflows (pre-commit, backend tests, Playwright shards,
-  compose smoke) to `.gitea/workflows/`. The Gitea instance runs Gitea Actions and needs CI
-  enabled per repository.
-- CHORE/FLOW: `app/flow/nodes.py` and `state.py` are excluded from strict mypy
-  (`[[tool.mypy.overrides]]` in `pyproject.toml`). The node classes still carry prototype
-  typing and redis-py types its calls as sync/async unions. Shrink the exclusion as each
-  integration is revisited.
-- FEAT/API: per-hook shared secrets for `HttpNode` webhooks. They are mounted unauthenticated
-  under `/hooks/{flow}/…` because devices cannot present a JWT.
-- FEAT/FLOW: state does not survive a restart — the engine runs on `MemoryState` unless
-  `REDIS_HOST` is set, and there is no Redis compose service yet.
-- CHORE/FLOW: rotating `SECRET_KEY` makes the stored secrets unreadable, since the Fernet key
-  is derived from it. Needs a re-encrypt path before anyone rotates in production.
+- CHORE/FLOW: `app/flow/nodes.py` is excluded from strict mypy (`[[tool.mypy.overrides]]` in
+  `pyproject.toml`). The node classes still carry prototype typing, `croniter` ships no stubs
+  and `influxdb_client` does not re-export its names. Shrink it as each integration is revisited.
 - PERF/FLOW: every save rebuilds the whole pipeline. Fine at the current flow count; rebuild
   only the touched flow when it starts to show.
 - FEAT/UI: reintroduce `--chart-*` tokens as one designed sequential scale when the first
-  chart lands. The stock shadcn five were dropped because their light and dark values are
-  unrelated hues.
-- CHORE/API: `backend/app/models.py` still holds the template's `Item` model. It has no
-  purpose now that flows are persisted and can go with its routes and tests.
-- PERF/UI: both frontend bundles exceed the 500 kB warning threshold. Revisit chunking
-  once the canvas and editor are in, since they will dominate.
+  chart lands. The node sparkline draws one series in `--primary` and needs none.
+- PERF/UI: the app's entry chunk is 680 kB (210 kB gzipped) and exceeds the warning
+  threshold. React Flow and Monaco are already lazy; a manualChunks split measured no better,
+  so this needs route-level work on the shell rather than chunking config.
 
 ## Blocked
 
+- FEAT/UI: a "Bug" icon on the node error bubble opening the console at the full error. The
+  bubble now shows one line and the traceback only reaches the server log; there is no
+  console in the roadmap yet for it to open.
 - FEAT/INFRA: MQTT broker and InfluxDB compose services for local development. The node types
   exist; a local broker would make them testable without external hardware.
 - CHORE/INFRA: `bun install` inside the frontend Docker build intermittently fails with