router: follow-ups for the store, forms and router inspectors #368

Items still open from the audit issues #347, #348 and #349. The fixed items landed in #362; this issue tracks what is left. Each item says why it was not part of that fix.

From #347 (NgRx store)

Partly done (the rest is open):

• Low: Classic state is serialized twice; same() compares with JSON.stringify: report() now reuses the serialized classic state (c.last) while the store still holds the same object as lastRaw. same() is now a structural deep compare with no string building (and key order no longer matters). Not done: the overlay's JSON.stringify body compare in ngrx-overlay.ts, because removing it needs dirty tracking for signal stores too. Caveat: a store that mutates its state in place would now report the cached copy, which was already invisible to the diff. (done in fix(overlay): keep console call sites, gate the Native profiler, skip unchanged NgRx stores #466)
• Low: Report entries are not shape-checked (null log entry throws in mergeNgrxReport): mergeNgrxReport now checks each store, log entry and classic block with valibot looseObject schemas and drops bad ones (a null entry no longer throws). Test added. Not done: the per-page size cap, because honest pages already bound blobs through serialize budgets, and choosing what to show for an oversized blob is a product decision. (done in feat: add cdSlowMs, an NgRx size cap, transfer cache options, security status and token rotation #471)

Open:

• Medium: Store DevTools history actions missing (toggle, commit, reset, sweep, pause, lock): These are six new NgrxRequest types and new write tools with ACTION_TOOLS gating and panel controls: new public API and a product decision, too big for a small local fix. (done in feat(store): Store DevTools controls, ngrx.trace call sites, state tree and action stats #478)
• Medium: No call site for any entry (opt-in ngrx.trace stack capture): Needs a new config option, stack trimming and redaction, and a file-link UI: a new public option and a design decision. (done in feat(store): Store DevTools controls, ngrx.trace call sites, state tree and action stats #478)
• Low: The collector patches store objects (to confirm): Confirmed that the collector wraps methods and signal set/update and patches dispatch. The suggested fix (watchState-only mode, a record toggle that unwraps, a documented clash with withDevtools) is a design change, not a small fix. (done in feat(store): Store DevTools controls, ngrx.trace call sites, state tree and action stats #478)
• Improvement: collapsible state tree with search, copy path and changed-key highlight: New component and design work, not small or local. (done in feat(store): Store DevTools controls, ngrx.trace call sites, state tree and action stats #478)
• Improvement: agent tool that explains why a state changed: New agent tool (public API plus config.ts registration) that also depends on the untracked stack trace item. (done in feat(store): Store DevTools controls, ngrx.trace call sites, state tree and action stats #478)
• Improvement: action frequency and duration view, flagging effect loops: New collector aggregation and a new panel view: needs product and design decisions. (done in feat(store): Store DevTools controls, ngrx.trace call sites, state tree and action stats #478)

From #348 (forms and WebMCP)

Partly done (the rest is open):

• Low: A running WebMCP call tags every event as agent: webMcp.active() now covers only the synchronous window (current !== null), so events streamed during a long async submit are no longer tagged agent. takeActivity, which tags pushed diffs, still counts running calls; changing it would also re-tag the submit outcome, so it was left as is. (done in fix(forms): tag only the WebMCP call's own changes as agent, and stop flagging shared async sources #464)

Open:

• Low: Unlinked WebMCP tools are not shown in the panel: Needs new panel UI in app/ (a page-level list); larger than a local fix. (done in fix: work through the follow-up lists and mask Signal Forms secrets in signal graphs #438)
• Low: The forms page is one 1,666-line component: Large refactor of app/ into several components and a store; not small or local. (done in feat(forms): inline edit, WebMCP try, Playwright export, schema view and a11y lint #479)
• Improvement: Inline editing of value/touched/dirty in the tree: New panel UI; needs a design decision. (done in feat(forms): inline edit, WebMCP try, Playwright export, schema view and a11y lint #479)
• Improvement: Turn form history into a Playwright/Testing Library test: New feature extending the export format; not small. (done in feat(forms): inline edit, WebMCP try, Playwright export, schema view and a11y lint #479)
• Improvement: Signal Forms schema view: New feature across package and panel. (done in feat(forms): inline edit, WebMCP try, Playwright export, schema view and a11y lint #479)
• Improvement: Accessibility checks in forms lint: Several new lint rules; larger than a local change. (done in feat(forms): inline edit, WebMCP try, Playwright export, schema view and a11y lint #479)
• Improvement: WebMCP 'Try this tool' button and inputSchema JSON: New gated action plus panel UI; needs a product decision. (done in feat(forms): inline edit, WebMCP try, Playwright export, schema view and a11y lint #479)
• Improvement: Skip full serialization when nothing changed: Needs version-counter tracking across collector and serializer; not small. (done in feat(forms): inline edit, WebMCP try, Playwright export, schema view and a11y lint #479)
• Improvement: Per-form origin attribution: Reworks origin tracking across the collector; needs a design. (done in feat(forms): inline edit, WebMCP try, Playwright export, schema view and a11y lint #479)
• Improvement: Show setup errors as a page-level banner in the panel: Panel UI work in the 1,666-line forms page; left for the panel refactor. (done in fix: work through the follow-up lists and mask Signal Forms secrets in signal graphs #438)

From #349 (router)

Partly done (the rest is open):

• Medium: links on parents are missed: linksOf now also selects [routerlinkactive], so <li routerLinkActive><a routerLink> is found (test in router-audit.test.ts). Property-bound [routerLink] on other elements and the MAX_LINKS truncation count are not done: the count would change the payload type shared with the panel. (done in fix: finish small follow-ups across forms, router, http, analog, signals and compat #418)
• Medium: router attached only once: overlay.ts now detaches when the router is disposed or its root leaves the DOM, then attaches again. The 3-miss cap is replaced with createScanBackoff (new reset()). Overlay tests cover the disposed router and a late router. A second app that appears while the first router is still alive is not detected. (done in feat(router): several apps on one page, and Ionic stacks in the Capacitor tab #485)

Open:

• Low: shared module state across routers: Moving the state into a per-router context is a wider refactor of router.ts. The overlay watches only one router at a time. (done in feat(router): keep router state per app on pages with several apps #492)
• Low: panel copies server types by hand: Needs a shared types entry point or a contract test across app and package, which is larger than a local fix. (done in feat: refetch, rule presets, redaction counts, device pick, router types and Firefox build #491)
• Low: timeline phase colours hard-coded (to confirm): The hex colours are confirmed, but the contrast was not measured. The fix needs new theme tokens and palette choices under ui-guidelines.md, which is design work. (done in fix: finish small follow-ups across forms, router, http, analog, signals and compat #418)
• Low: events-only wording contradicts the data: The wording spans the package, panel and docs, and the right fix (wording or how mode is set) is a decision. (done in fix(components): report silent limits, fix two notices, add real-app CD tests and an API canary #380 and fix: finish small follow-ups across forms, router, http, analog, signals and compat #418)
• Improvement: 'what happens if I go to X' card: New feature across the package and panel. (done in feat(router): diff, preview and follow navigations, with open redirect and lint checks #474)
• Improvement: diff two navigations view: New feature and UI design. (done in feat(router): diff, preview and follow navigations, with open redirect and lint checks #474)
• Improvement: live redirect-from-query check: New detection feature; not small. (done in feat(router): diff, preview and follow navigations, with open redirect and lint checks #474)
• Improvement: HTTP list from the HTTP collector: Cross-collector change. (done in feat(router): diff, preview and follow navigations, with open redirect and lint checks #474)
• Improvement: navigation streaming resource/tool: New public agent API. (done in feat(router): diff, preview and follow navigations, with open redirect and lint checks #474)
• Improvement: record withNavigationErrorHandler / Navigation API: New data and UI; not small. (done in feat(router): diff, preview and follow navigations, with open redirect and lint checks #474)
• Improvement: new lint rules: New rules need design and docs; not small. (done in feat(router): diff, preview and follow navigations, with open redirect and lint checks #474)

Tracked elsewhere

These items from the audit are not listed above because another issue already tracks them:

• Scrubbing through past NgRx states: phase 4 of 4: deeper diagnosis #343 (full state at any past entry)
• Gating instrument and resolve-lazy behind actions.router: phase 1 of 4: safe by default and wired into your workflow #340 (fill ACTION_TOOLS.router)