http: follow-ups for pipes, SSR and HTTP, and Analog #369

Items still open from the audit issues #350, #351 and #352. The fixed items landed in #361 and #362; this issue tracks what is left. Each item says why it was not part of that fix.

From #350 (pipes)

Partly done (the rest is open):

• Low: Silent truncation: Added asyncTotal to PipePageReport and state, a 'Showing N of M subscriptions' line, and instanceTotal for capped per-instance lists. Component targets (cap 10) still carry no flag.
• Low: First calls of new pipe classes are missed: Documented the delay (a pipe class that first appears while recording is patched on the next report) in inspectors/pipes.md. Patching from the mutation path was not done.

Open:

• Low: Full source scan on every request: Needs a shared mtime-keyed index invalidated from the Vite watcher. That spans several files plus the server lifecycle, so it is too big for a small fix.
• Low: False duplicate async subscriptions: Choosing which sources count as 'obviously shared' (Subject, shareReplay, store.select) is a heuristic and product decision, not a local fix.
• Improvement: Hot pipes sort and view: New view and sort in the panel, which needs a UI/product decision. Timing data now exists for it.
• Improvement: Per-template pipe list in Components inspector: Cross-inspector feature, not local.
• Improvement: Migration suggestions as agent actions: New agent action tools and config entries, which needs a design decision.
• Improvement: Detect identical-result churn: Needs per-call deep-equality tracking and a threshold decision.
• Improvement: pipe-usages agent resource: New public agent resource plus config entries, which needs a decision. The custom usage data it would serve now exists in get-pipes.

From #351 (HTTP, SSR and hydration)

Partly done (the rest is open):

• Low: client cache check disagrees with the server one: One requestSkipReason predicate in http-cache-reason.ts is now used by both cacheSkipReason and transferCacheEligible, so credentials 'include'/'same-origin' are handled on the client too, with a test. Not done: letting withPangular({ transferCache }) take HttpTransferCacheOptions, which is new public API.
• Low: hydration scan goes stale: When ngDevMode has no counters, the scanner cache key is now a 5 s time bucket, so later incremental hydration shows up. The walk now covers only elements, text and comments. Tested. No dedicated rescan on @defer (hydrate) triggers.
• Low: duplicated, unanchored URL glob: The glob matcher now lives in one helper, url-glob.ts, used by fault rules and SSR overrides. A leading ^ anchors the pattern at the start of the path, also on absolute URLs. Form hints, tool descriptions and docs are updated, and tests are added. No live match count in the rule form (UI feature).

Open:

• Medium: network inspector page is too big (split into child components and a store): A large refactor across the whole panel page, not a small fix; it needs its own change.
• Low: console patch moves every call site: The issue says this should land with the single console tap planned in phase 3 of 4: a shell you live in #342; it also needs build/source-map changes.
• Improvement: payload tab extras: New UI features plus a refetch action; needs a design decision.
• Improvement: duplicate/waterfall lint and lint-http agent tool: New agent tool and new analysis; not small or local.
• Improvement: Copy as fetch/cURL and replay: New panel feature with a write action; needs a design decision.
• Improvement: HAR export: New export feature; not small.
• Improvement: Server-Timing entry per server HttpClient call: Changes the Server-Timing format and needs per-call tracking across http.ts and the middleware; better done on its own.
• Improvement: rule presets (offline, slow 3G, flaky): New rule semantics and UI; a product decision.
• Improvement: label httpResource/resource()/@defer calls: Needs a design for detecting the call origin.
• Improvement: record native fetch calls: Large new collector on both sides.

From #352 (Analog)

Partly done (the rest is open):

• Medium: Config parsing stops after 4000 characters: The analog() options are now sliced to the matching close paren, with strings masked, and prerender routes are read only inside the prerender block. Tested with a long nitro block and a sitemap.routes decoy. Reporting a config that could not be fully parsed is skipped, because it needs a new field and UI.

Open:

• Medium: Server calls mix across tabs (no pageId on AnalogCall): Needs a page-tagging scheme for dev server requests (overlay header or Referer map) plus a page filter in the tool and the Server tab, so it is not a small, local fix.
• Medium: Synchronous rescans on every push: Replacing the TTL with watcher-driven invalidation and changing when the panel refetches touches the Vite plugin, the register code and the panel. That is a design change, not a local fix.
• Low: load() payload stringified on every tick: A WeakMap keyed by the data object would serve a stale preview when the app changes the object in place. The perf gain does not justify that correctness risk without a mutation signal.
• Low: Page chain follows firstChild only: Walking every outlet and tagging entries changes the report shape, loadFrom indexing and the panel and agent output. Too broad for this batch.
• Improvement: Server route playground: Large UI feature that needs a product decision.
• Improvement: Payload tab with TransferState entries: New tab across three files that needs a design decision.
• Improvement: Runtime config view: New feature and data surface that needs a product decision.
• Improvement: Nitro internals with purge action: New action tool and feature; too large and needs a decision.
• Improvement: Per-route data inspector: Needs a new page RPC and a lazy tree UI.
• Improvement: Render mode check: New hub fetch feature; not small.
• Improvement: Content tab frontmatter schema and preview: Needs a new config option, which is a product decision.
• Improvement: Vite transform stack link: New cross-module feature.
• Improvement: Build analysis: New feature; not small.

Tracked elsewhere

These items from the audit are not listed above because another issue already tracks them:

• Library pipes seen only at runtime: phase 1 of 4: safe by default and wired into your workflow #340
• The hydration mismatch overlay and diff: phase 2 of 4: deeper inspection #341 (hydration overlay) and phase 4 of 4: deeper diagnosis #343 (NG0500 explainer)