http: follow-ups for pipes, SSR and HTTP, and Analog #369

Items still open from the audit issues #350, #351 and #352. The fixed items landed in #361 and #362; this issue tracks what is left. Each item says why it was not part of that fix.

From #350 (pipes)

Partly done (the rest is open):

• Low: Silent truncation: Added asyncTotal to PipePageReport and state, a 'Showing N of M subscriptions' line, and instanceTotal for capped per-instance lists. Component targets (cap 10) still carry no flag. (done in fix(components): report silent limits, fix two notices, add real-app CD tests and an API canary #380)
• Low: First calls of new pipe classes are missed: Documented the delay (a pipe class that first appears while recording is patched on the next report) in inspectors/pipes.md. Patching from the mutation path was not done. (done in feat(pipes): churn detection, migration suggestions, hot pipes and per-template pipe lists #477)

Open:

• Low: Full source scan on every request: Needs a shared mtime-keyed index invalidated from the Vite watcher. That spans several files plus the server lifecycle, so it is too big for a small fix. (done in feat(pipes): churn detection, migration suggestions, hot pipes and per-template pipe lists #477)
• Low: False duplicate async subscriptions: Choosing which sources count as 'obviously shared' (Subject, shareReplay, store.select) is a heuristic and product decision, not a local fix. (done in fix(forms): tag only the WebMCP call's own changes as agent, and stop flagging shared async sources #464)
• Improvement: Hot pipes sort and view: New view and sort in the panel, which needs a UI/product decision. Timing data now exists for it. (done in feat(pipes): churn detection, migration suggestions, hot pipes and per-template pipe lists #477)
• Improvement: Per-template pipe list in Components inspector: Cross-inspector feature, not local. (done in feat(pipes): churn detection, migration suggestions, hot pipes and per-template pipe lists #477)
• Improvement: Migration suggestions as agent actions: New agent action tools and config entries, which needs a design decision. (done in feat(pipes): churn detection, migration suggestions, hot pipes and per-template pipe lists #477)
• Improvement: Detect identical-result churn: Needs per-call deep-equality tracking and a threshold decision. (done in feat(pipes): churn detection, migration suggestions, hot pipes and per-template pipe lists #477)
• Improvement: pipe-usages agent resource: New public agent resource plus config entries, which needs a decision. The custom usage data it would serve now exists in get-pipes. (done in feat(pipes): churn detection, migration suggestions, hot pipes and per-template pipe lists #477)

From #351 (HTTP, SSR and hydration)

Partly done (the rest is open):

• Low: client cache check disagrees with the server one: One requestSkipReason predicate in http-cache-reason.ts is now used by both cacheSkipReason and transferCacheEligible, so credentials 'include'/'same-origin' are handled on the client too, with a test. Not done: letting withPangular({ transferCache }) take HttpTransferCacheOptions, which is new public API. (done in feat: add cdSlowMs, an NgRx size cap, transfer cache options, security status and token rotation #471)
• Low: hydration scan goes stale: When ngDevMode has no counters, the scanner cache key is now a 5 s time bucket, so later incremental hydration shows up. The walk now covers only elements, text and comments. Tested. No dedicated rescan on @defer (hydrate) triggers. (done in fix: finish small follow-ups across forms, router, http, analog, signals and compat #418)
• Low: duplicated, unanchored URL glob: The glob matcher now lives in one helper, url-glob.ts, used by fault rules and SSR overrides. A leading ^ anchors the pattern at the start of the path, also on absolute URLs. Form hints, tool descriptions and docs are updated, and tests are added. No live match count in the rule form (UI feature). (done in feat(http): add fault presets, HAR export, copy as fetch or cURL, an HTTP lint and call origins #473)

Open:

• Medium: network inspector page is too big (split into child components and a store): A large refactor across the whole panel page, not a small fix; it needs its own change. (done in refactor(ui): split the network page into section components #495)
• Low: console patch moves every call site: The issue says this should land with the single console tap planned in phase 3 of 4: a shell you live in #342; it also needs build/source-map changes. (done in fix(overlay): keep console call sites, gate the Native profiler, skip unchanged NgRx stores #466)
• Improvement: payload tab extras: New UI features plus a refetch action; needs a design decision. (done in feat(http): add fault presets, HAR export, copy as fetch or cURL, an HTTP lint and call origins #473 and feat: refetch, rule presets, redaction counts, device pick, router types and Firefox build #491)
• Improvement: duplicate/waterfall lint and lint-http agent tool: New agent tool and new analysis; not small or local. (done in feat(http): add fault presets, HAR export, copy as fetch or cURL, an HTTP lint and call origins #473)
• Improvement: Copy as fetch/cURL and replay: New panel feature with a write action; needs a design decision. (done in feat(http): add fault presets, HAR export, copy as fetch or cURL, an HTTP lint and call origins #473)
• Improvement: HAR export: New export feature; not small. (done in feat(http): add fault presets, HAR export, copy as fetch or cURL, an HTTP lint and call origins #473)
• Improvement: Server-Timing entry per server HttpClient call: Changes the Server-Timing format and needs per-call tracking across http.ts and the middleware; better done on its own. (done in feat(http): add fault presets, HAR export, copy as fetch or cURL, an HTTP lint and call origins #473)
• Improvement: rule presets (offline, slow 3G, flaky): New rule semantics and UI; a product decision. (done in feat(http): add fault presets, HAR export, copy as fetch or cURL, an HTTP lint and call origins #473 and feat: refetch, rule presets, redaction counts, device pick, router types and Firefox build #491)
• Improvement: label httpResource/resource()/@defer calls: Needs a design for detecting the call origin. (done in feat(http): add fault presets, HAR export, copy as fetch or cURL, an HTTP lint and call origins #473)
• Improvement: record native fetch calls: Large new collector on both sides. (done in feat(mcp): performance and build inspectors, native fetch, server errors, oxlint ratchet #489)

From #352 (Analog)

Partly done (the rest is open):

• Medium: Config parsing stops after 4000 characters: The analog() options are now sliced to the matching close paren, with strings masked, and prerender routes are read only inside the prerender block. Tested with a long nitro block and a sitemap.routes decoy. Reporting a config that could not be fully parsed is skipped, because it needs a new field and UI. (done in fix: finish small follow-ups across forms, router, http, analog, signals and compat #418)

Open:

• Medium: Server calls mix across tabs (no pageId on AnalogCall): Needs a page-tagging scheme for dev server requests (overlay header or Referer map) plus a page filter in the tool and the Server tab, so it is not a small, local fix. (done in fix(analog): scope server calls to their tab and keep the source scan #467)
• Medium: Synchronous rescans on every push: Replacing the TTL with watcher-driven invalidation and changing when the panel refetches touches the Vite plugin, the register code and the panel. That is a design change, not a local fix. (done in fix(analog): scope server calls to their tab and keep the source scan #467)
• Low: load() payload stringified on every tick: A WeakMap keyed by the data object would serve a stale preview when the app changes the object in place. The perf gain does not justify that correctness risk without a mutation signal. (decided: won't fix)
• Low: Page chain follows firstChild only: Walking every outlet and tagging entries changes the report shape, loadFrom indexing and the panel and agent output. Too broad for this batch. (done in fix: work through the follow-up lists and mask Signal Forms secrets in signal graphs #438)
• Improvement: Server route playground: Large UI feature that needs a product decision. (done in feat(analog): playground, content schema, transform and build views, Nitro and runtime tools #480)
• Improvement: Payload tab with TransferState entries: New tab across three files that needs a design decision. (done in feat(analog): playground, content schema, transform and build views, Nitro and runtime tools #480)
• Improvement: Runtime config view: New feature and data surface that needs a product decision. (done in feat(analog): playground, content schema, transform and build views, Nitro and runtime tools #480)
• Improvement: Nitro internals with purge action: New action tool and feature; too large and needs a decision. (done in feat(analog): playground, content schema, transform and build views, Nitro and runtime tools #480)
• Improvement: Per-route data inspector: Needs a new page RPC and a lazy tree UI. (done in feat(analog): playground, content schema, transform and build views, Nitro and runtime tools #480)
• Improvement: Render mode check: New hub fetch feature; not small. (done in feat(analog): playground, content schema, transform and build views, Nitro and runtime tools #480)
• Improvement: Content tab frontmatter schema and preview: Needs a new config option, which is a product decision. (done in feat(analog): playground, content schema, transform and build views, Nitro and runtime tools #480)
• Improvement: Vite transform stack link: New cross-module feature. (done in feat(analog): playground, content schema, transform and build views, Nitro and runtime tools #480)
• Improvement: Build analysis: New feature; not small. (done in feat(analog): playground, content schema, transform and build views, Nitro and runtime tools #480)

Tracked elsewhere

These items from the audit are not listed above because another issue already tracks them:

• Library pipes seen only at runtime: phase 1 of 4: safe by default and wired into your workflow #340
• The hydration mismatch overlay and diff: phase 2 of 4: deeper inspection #341 (hydration overlay) and phase 4 of 4: deeper diagnosis #343 (NG0500 explainer)