app/NOTEPAD.md

This file captures tasks which derive from roadmap tasks (unfinished, deferred), bugs encountered during usage and feature requests/improvements which are not fitting directly in the roadmap.
Always sort by priority and put tasks blocked by other tasks/features at the dedicated section.
When working on a task, check for other, similar tasks that could be resolved on the way.
Use following pattern to classify tasks: TYPE/SCOPE
Where TYPE could be BUG, FEAT, PERF, CHORE and SCOPE could be UX, UI, FLOW, NODE, API, INFRA, DOCS appended by MOBILE if only for mobile use case.
Don't write temporary reasons for deferring a task in the task description (only strategical reasons should be noted).
Deferring because out of scope is fine, but don't mention deferring than.

## Open

- BUG/UI: the CSS duration tokens were retuned to 250/500 ms but `lib/motion.ts` still
  carries 200/300, so JS animations (panels, dock, tabs) run at a different speed to CSS
  transitions. They are meant to mirror each other; pick the intended values and update
  `motion.ts` in both repos.
- BUG/API: `pytest tests/` deletes every user on teardown (`tests/conftest.py`), so running
  it against the development database logs you out of the running app. Point tests at their
  own database, or reseed with `init_db` afterwards.
- CHORE/FLOW: the InfluxDB token committed in the old `flow/nodes/influx_test.py` is in
  pushed history (`d222ce5`). Rotate it in InfluxDB; removing it from history needs a
  rewrite of published commits.
- BUG/UI: six template Playwright specs fail on validation copy that no longer matches
  (`login`, `sign-up`, `reset-password`, `user-settings` theme persistence). Unrelated to
  the flow editor, which passes; fix or delete them with the `Item` cleanup.
- CHORE/UI: `bunx playwright test` starts a dev server on :5173, which is not in the API's
  `BACKEND_CORS_ORIGINS`, so every spec fails at login. Run against the integrated stack
  with `PLAYWRIGHT_BASE_URL=http://app.localhost`, or add the dev origin to CORS.
- FEAT/UI: no undo on the canvas. Deleting a node autosaves immediately, so a mis-click
  costs the node's source.
- PERF/UI: the Monaco chunk is 2.6 MB. It only loads when a node panel opens, but the
  editor could be trimmed further or swapped for CodeMirror if that becomes a problem.
- FEAT/UI: renaming a message updates only the node being edited; the nodes consuming it
  keep the old name and quietly disconnect. Offer to rename across the flow.
- CHORE/INFRA: port the n3xd CI workflows (pre-commit, backend tests, Playwright shards,
  compose smoke) to `.gitea/workflows/`. The Gitea instance runs Gitea Actions and needs CI
  enabled per repository.
- CHORE/FLOW: `app/flow/nodes.py` and `state.py` are excluded from strict mypy
  (`[[tool.mypy.overrides]]` in `pyproject.toml`). The node classes still carry prototype
  typing and redis-py types its calls as sync/async unions. Shrink the exclusion as each
  integration is revisited.
- FEAT/API: per-hook shared secrets for `HttpNode` webhooks. They are mounted unauthenticated
  under `/hooks/{flow}/…` because devices cannot present a JWT.
- FEAT/FLOW: state does not survive a restart — the engine runs on `MemoryState` unless
  `REDIS_HOST` is set, and there is no Redis compose service yet.
- CHORE/FLOW: rotating `SECRET_KEY` makes the stored secrets unreadable, since the Fernet key
  is derived from it. Needs a re-encrypt path before anyone rotates in production.
- PERF/FLOW: every save rebuilds the whole pipeline. Fine at the current flow count; rebuild
  only the touched flow when it starts to show.
- FEAT/UI: reintroduce `--chart-*` tokens as one designed sequential scale when the first
  chart lands. The stock shadcn five were dropped because their light and dark values are
  unrelated hues.
- CHORE/API: `backend/app/models.py` still holds the template's `Item` model. It has no
  purpose now that flows are persisted and can go with its routes and tests.
- PERF/UI: both frontend bundles exceed the 500 kB warning threshold. Revisit chunking
  once the canvas and editor are in, since they will dominate.

## Blocked

- FEAT/INFRA: MQTT broker and InfluxDB compose services for local development. The node types
  exist; a local broker would make them testable without external hardware.
- CHORE/INFRA: `bun install` inside the frontend Docker build intermittently fails with
  "Fail extracting tarball" for several packages at once, and succeeds on a plain rebuild.
  It looks like concurrent extraction under memory pressure. Pin down or retry in the
  Dockerfile if it starts costing CI time.