app/NOTEPAD.md

This file captures tasks which derive from roadmap tasks (unfinished, deferred), bugs encountered during usage and feature requests/improvements which are not fitting directly in the roadmap.
Always sort by priority and put tasks blocked by other tasks/features at the dedicated section.
When working on a task, check for other, similar tasks that could be resolved on the way.
Use following pattern to classify tasks: TYPE/SCOPE
Where TYPE could be BUG, FEAT, PERF, CHORE and SCOPE could be UX, UI, FLOW, NODE, API, INFRA, DOCS appended by MOBILE if only for mobile use case.
Don't write temporary reasons for deferring a task in the task description (only strategical reasons should be noted).
Deferring because out of scope is fine, but don't mention deferring than.

## Open

- BUG/UI: when the edges pulse on message, they change their color (go from slightly darker back to normal) at the end again. Double check that after the animation they end up with the same color as before to not have this double-pulse effect
- BUG/UI: enlarge the icon in the sidebar slightly
- BUG/UI: clicking outside the panel does not discard the flow edit panel
- BUG/UI: the graph showed in the node edit panel should also be shown for a specific edge inside the pop-up panel when clicking the edge
- FEAT/FLOW: single-stepping a paused flow. The work queue it needed now exists: pausing
  parks claimed items per flow and resuming drains them, so a step button is a matter of
  popping one parked item instead of all of them.
- FEAT/UI: interrupting a node that is already running. Pause holds nodes that have not been
  submitted yet; one already executing runs to completion.
- BUG/UI: the enlarged panel (for code editing) should still maintain its floating style
- BUG/UI: `SidePanel`'s mobile branch does not set `data-testid` on the `SheetContent`, so
  `[data-testid=node-panel]` does not exist on a phone. Mobile specs cannot address the panel.
- CHORE/API: node source saves carry no version precondition, so two clients editing the same
  node's code are last-writer-wins. The flow document is what the optimistic lock protects;
  code files would need their own, and an exact-match one produces false conflicts against a
  single client's own interleaved flow and source saves.
- FEAT/UI: publishing and discarding are only reachable while no side panel is open, since the
  floating chrome hides for the panel. Editing a node's code and publishing it is therefore
  close-panel-then-publish.
- FEAT/UI: no screen for the OAuth clients an agent registers. They can only be listed or
  removed in the database, so withdrawing one agent's access means deleting its rows or
  rotating `OAUTH_PRIVATE_KEY_FILE`, which cuts off all of them.
- CHORE/INFRA: `requires-python` is capped below 3.14 because the MCP SDK wants a newer
  starlette there than the pinned `sentry-sdk<2` allows. Lift the cap when sentry-sdk moves
  to 2.x.
- FEAT/UI: no screen for alerting. Channels and rules are API-only (`/alerts/config`),
  so setting up a phone notification means calling the endpoint by hand.
- FEAT/UI: there is no screen for managing the secrets store itself. A node parameter marked
  `x-secret` offers the stored secrets, but they can only be created through the API.
- FEAT/FLOW: input discretization drops the trailing edge — if a producer goes quiet inside
  the window, the consumer never sees the last value. Delivering it at the end of the window
  needs a timer per (node, port).
- CHORE/FLOW: shared node sources bypass the draft/publish split. Editing one writes the
  library copy and reloads immediately, since the code is not any single flow's to hold back.
  Deliberate, but it means a shared node is the one thing publish does not gate.
- FEAT/UI: flow-level edits (title, inputs) go through `FlowPanel.onChange` and stay outside
  the undo stack.
- CHORE/UI: `make test-backend` cannot reach Postgres while the integrated stack is up —
  `compose.local.yml` does `db: ports: !reset []`. Run it against the container's address, or
  move the suite inside the compose network.
- CHORE/UI: the Playwright specs run against the development stack and leave their users and
  flows behind, which is why the flowbar filled with `test_flow_*`. Give them their own data
  or clean up after themselves, as `pytest` now does.
- CHORE/UI: the standalone Vite origin (`make dev-frontend` on :5173) is still not in
  `BACKEND_CORS_ORIGINS`. `scripts/setup.sh` regenerates the list on every `make init` and
  `compose.local.yml` re-declares it as a container variable that wins, so the origin has to
  be added in both places to work.
- CHORE/INFRA: `test-backend.yml` runs pytest on the runner host, so it keeps the fixed
  container name and port 5432 that `compose.ci.yml` resets everywhere else. Two concurrent
  runs of that one job collide.
- PERF/UI: (deferred for now) the Monaco chunk is 2.6 MB. It only loads when a node panel opens, but the
  editor could be trimmed further or swapped for CodeMirror if that becomes a problem.
- CHORE/FLOW: four modules of `app/flow/nodes/` are still excluded from strict mypy
  (`[[tool.mypy.overrides]]` in `pyproject.toml`): `mqtt`, `http`, `influx` and `delay`. They
  carry prototype typing, `croniter` ships no stubs and `influxdb_client` does not re-export
  its names. `base` and `mlp` are checked; shrink the rest as each integration is revisited.
- CHORE/FLOW: a node function returning something other than a dict raises `AttributeError`
  in `Node._to_messages` rather than a named error. Outputs are keyed by port, so a non-dict
  cannot be one — say so where the return value is mapped.
- PERF/FLOW: every save rebuilds the whole pipeline. Fine at the current flow count; rebuild
  only the touched flow when it starts to show.
- FEAT/UI: reintroduce `--chart-*` tokens as one designed sequential scale when the first
  chart lands. The node sparkline draws one series in `--primary` and needs none.
- PERF/UI: the app's entry chunk is 680 kB (210 kB gzipped) and exceeds the warning
  threshold. React Flow and Monaco are already lazy; a manualChunks split measured no better,
  so this needs route-level work on the shell rather than chunking config.

- CHORE/INFRA: `bun run --filter frontend build` fails on this workspace with
  `crypto.hash is not a function` — Vite 7 wants Node 20.12+ and the host has 18. The
  Docker image builds fine, so it only bites local bundling; `bunx tsc` still type-checks.

## Blocked

- FEAT/UI: a "Bug" icon on the node error bubble opening the logs panel at that node's
  traceback. The panel now has the traceback; wiring the bubble to open and filter it needs
  the panel's open state lifted into `FlowEditor`.
- FEAT/INFRA: MQTT broker and InfluxDB compose services for local development. The node types
  exist; a local broker would make them testable without external hardware.
- CHORE/INFRA: `bun install` inside the frontend Docker build intermittently fails with
  "Fail extracting tarball" for several packages at once, and succeeds on a plain rebuild.
  It looks like concurrent extraction under memory pressure. Pin down or retry in the
  Dockerfile if it starts costing CI time.