---

🎯 Priority for Implementers

Priority	Initiative	Key Deliverables
P0	System Language P0 remainder	Finish remaining hardcoded English strings in admin chrome (bun run check:copy)
P1	Quality Gate Type-Checking	Wire svelte-check --threshold error into bun run check to eliminate silent type drift
P2	Commerce Engine Add-Ons	Promotion rule groups (ConditionPlugin), BOGO/tiered discounts, multi-warehouse, FX resolver, and Stripe Billing
P2	Enterprise Cluster & Cloud	Distributed session clustering, Redis pub/sub worker bridge, and Svelty Managed Cloud recipes

---

1. Core Architecture & Performance (Active Backlog)

• SQLite Write Tail Acceptance Gate:
  • The SQLite group commit batcher is default ON. Finalize acceptance: achieve a replica run free of 🔴 rows and pass --strict-variance across a ≥3-run ensemble.
• Write-Lane Adaptive Coalescing (2027):
  • Shipped adaptive UPDATE lane (SVELTY_WRITE_COALESCE_UPDATE=1): an update on an idle gate skips the coalescer scheduler hop; once any mutation is in flight, updates coalesce. Inserts/deletes keep their previous scheduling unless SVELTY_WRITE_COALESCING=1. Metrics: adaptiveUpdates { enabled, immediate, coalesced }.
  • Evaluate same-tick (0ms) vs 1–2ms insert coalescing windows against 100k and 1M row datasets.
  • Complete the 1M-row PostgreSQL replica proof.
• Two-Plane Core Phase 5 Verification:
  • Run 24-hour PostgreSQL soak with 32 concurrent workers on mixed workloads (LONG_SOAK_HOURS=24).
  • Demonstrate noise-aware memory leak proof with a flat native residual (rss - heapTotal - external) over ≥15-minute steady windows.
  • Publish networked 4-cell matrix separating Cache-Hit (Cell 1) from Origin-Miss (Cells 2 & 3).
  • Add differential wire-vs-domain test coverage for the no-status-column fail-closed branch.
• Multi-Core Cluster Worker Pub/Sub Bridge:
  • Bridge in-process graphql-yoga pub/sub (entryUpdated, yjs:*, SSE) across workers via Redis Pub/Sub when running under SVELTY_CLUSTER_WORKERS.
• API-Only Build Profile (bun run build:api):
  • Shipped dedicated headless build profile (SVELTY_API_ONLY=1) that stubs (app) and (admin) UI route modules with zero runtime UI bundle overhead, leaving API, GraphQL, setup, and auth endpoints fully intact.
• System Copy & i18n Chrome Completion:
  • Reached 100% localization across all 110 (app) files (bun run check:copy reporting 0 offenses) across 8 locales (en, de, fr, es, it, nl, pl, ar).
• Multi-Day Memory Soak:
  • Execute a 24h+ multi-worker soak row measuring heapTotal, external, and arrayBuffers.
  • Add long-horizon memory profiles for non-SQLite engines (PostgreSQL, MariaDB).
• Engine-Native Capability Gaps:
  • Normalise group keys read from JSON extraction types across all SQL adapters to prevent caller post-processing.
  • Harden MariaDB dynamic-field filters (JSON_UNQUOTE) against loose type coercion on numeric vs string comparisons.
• Hardware-Adaptivity Proof On Small Boxes:
  • Boot the Linux image in a 256 MB / 1 vCPU container and run the seed + read + write lanes — the built server carries platform-native modules, so the container is where “boots in 256 MB” is demonstrated rather than derived.
  • Verify the index.cjs heap-cap skip path under Phusion Passenger (the guard is unit-adjacent only; the PASSENGER_* branch has no runtime proof yet).
  • Re-measure the lanes with the entry-applied UV_THREADPOOL_SIZE: the boot-hook assignment was a runtime no-op until 2026-10-14, so historical local runs used libuv’s default of 4 — fs/crypto-heavy paths (media, audit hashing) are the ones expected to move.
  • Publish a small-box row in the comparative ledger (1 vCPU / 512 MB, then 256 MB) so the derived budgets stay a measured column instead of a claim.
  • Add a CI job that runs the profile under docker run --memory=256m and asserts the expected tiers, so a future hardcoded budget fails the build.
  • Derive the adapter-node body ceiling for stacks that never launch through index.cjs (systemd unit, node build/index.js directly), where the 100 MB default still applies.
• Role-token migration for the remaining admin surfaces: beyond the wizard, ~294 src/ Svelte files still paint palette utilities — ≈2 500 paired surface-* light/dark classes (concentrated in config/design-system/+page.svelte, the widget UIs and older pages; the input/textarea/select/stepper primitives are included, so every form inherits them) — plus 38 files / ≈244 legacy-palette usages (gray-*/slate-* pairs, bg-white, dark:bg-[#0d0f12]). The setup wizard is fully migrated and documented as the reference (see style guide); migrate screen by screen with a visual pass, primitives first, and add a budget guard (like consolidate-shades) so the raw-class count can only go down.

---

2. Collection Builder & Content Modeling (Active Backlog)

• Content Hierarchy & Organizational Trees:
  • Implement tenant-scoped hierarchical nodes (folder, tag, term) with two edges: parentId for single-parent tree navigation and a membership join table for tags/terms.
  • Surface sidebar taxonomy filtering across collections and media assets.
• Schema Model Relation & Filter Enhancements:
  • Compile relation operators some, none, and every to capped ID lookups (RELATION_FANOUT cap) via src/services/sdk/namespaces/collections/relation-filter.ts.
  • Support nested mutations { connect, disconnect, create } with a maximum depth of 2.
  • Implement onDelete schema actions (cascade, setNull, restrict) bounded by a fan-out cap of 100.
  • Add virtual field support (type: "virtual") and projection masking (omit / graphql.omit).
• Content write & read correctness:
  • Optimistic locking on entry updates (If-Match / expectedVersion → compare-and-set, 409 VERSION_CONFLICT with details.currentVersion); legacy writes stay last-write-wins.
  • Revision restore (POST /api/collections/:c/:id/revisions/:version/restore) plus bounded pruning (revisionLimit, default 100).
  • Filter-path validation (400 FILTER_UNKNOWN_FIELD) for unknown keys and unaddressable nested paths.
  • Access predicate → WHERE fragment merged before count + page (field stripping stays a separate layer).
  • Draft version row + publish promotion/rollback (reuse content_drafts).
  • enforceAccess by default for every CRUD call, with a logged system: true escape for system callers.
• CMS Tables & List Platform (Smart Table):
  • Team & Cloud Saved Views: enterprise tenant-shared view presets with RBAC visibility controls.
  • Observability integration: pipe list-query-metrics into continuous benchmark trend reporting.
  • Publish formal operational documentation for Bloom filter thresholds and 404 negative cache eviction (see cache system).

---

3. Media Pipeline Consolidation & GC (Active Backlog)

• Derivative Pipeline Unification:
  • Collapse the SIZES ladder and deferred preset passes into a single consolidated, deduplicated pipeline.
  • Background precompilation for operator-defined SIZES presets.
• Delivery Boundary & Storage GC:
  • Reference-aware version retention and orphan blob release (media:cleanup, media:sync-status, metadata.processingStatus) — shipped 2026-10-19; see Media System → Processing status, version retention & cleanup.
  • Implement directory-aware deletion for adapters that support prefix removal (current release is DB-reference-driven because object stores cannot list a prefix portably).
  • Automated derivative GC sweep that reclaims disk for deleted parent media beyond the explicit admin command.
  • Surface focal-point and watermark coordinates directly in REST/GraphQL image payloads.
  • Add ThumbHash LQIP support via the thumbhash package.
• Media gallery coverage & unimplemented surfaces (2026-10-21):
  • Server pagination: the loader reads ?page, preserves the adapter total and the views merge pages; pinned by tests/e2e/routes/mediagallery/media-pagination.spec.ts (2026-10-24).
  • Server-side search across unfetched pages: getByFolder has no search option on all four adapters, so search still ranges over fetched rows. Needs an adapter-level contract + ?q= in the loader.
  • Large-library batched rendering (60-tile window + IntersectionObserver sentinel) pinned by tests/e2e/routes/mediagallery/large-library.spec.ts.
  • Client-side pre-upload optimization (Canvas 2D, 1920×1080 clamp, WebP) pinned by upload-optimization.spec.ts against the stored dimensions.
  • Remote-URL ingestion success + SSRF rejection pinned by remote-ingestion.spec.ts (real local HTTP peer via the test-only exact-origin allowlist).
  • Folder drag-and-drop is covered by move-remote.spec.ts (sveltednd workspace drop target).
  • Video playback + adaptive HLS: hls-video-player.svelte (native HLS or lazy hls.js) is mounted from the details modal whenever metadata.hls.master exists; POST /api/media/transcode produces HLS/MP4 derivatives in the background through ffmpeg and fails closed with 503 FFMPEG_UNAVAILABLE when the binary is absent. Pinned by video-transcode.spec.ts + media-batch-transcode.test.ts.
  • Batch resize/filter: batch-processor.svelte is mounted from the gallery selection toolbar and POST /api/media/batch-process applies one uniform resize/filter/watermark to ≤100 assets with per-asset results. Pinned by batch-processing.spec.ts + media-batch-process.test.ts (integration).
• Large-file upload lanes:
  • TUS 1.0.0 resumable uploads (POST/HEAD/PATCH/DELETE /api/media/tus) with a reload-safe browser client — shipped 2026-10-19.
  • SigV4 presigned direct-to-storage instructions for S3/R2 (upload-instructions + direct-upload/complete) — shipped 2026-10-19.
  • Cloudinary signed direct-upload preset (currently the TUS fallback lane).
  • Multi-instance TUS spool: a shared volume or Redis-backed session store instead of the local spool directory.

---

4. Commerce Engine Add-Ons (Active Backlog)

• Promotions & Discount Rules:
  • Implement ConditionPlugin for complex promotion rules (cart minimums, coupon combinations, category discounts).
  • Add BOGO and tiered volume pricing calculations.
• Inventory & Payments:
  • Multi-warehouse inventory allocation.
  • Real-time currency exchange (FX) resolver with caching.
  • Stripe Billing recurring subscription webhooks and customer portal integration.
  • Durable idempotency storage across server restarts (persisted key locks).
  • Database-level conditional stock decrement for multi-node deployments.
• Storefront SEO:
  • Inject Schema.org structured data markup (Product, Offer, AggregateRating) on /shop routes.

---

5. SEO & GEO Engine Enhancements (Active Backlog)

• SEO Config Cascade:
  • Implement site → collection → entry defaults for title and description templates with token fallbacks.
• Sitemap Variants:
  • Generate specialized image and news sitemap feeds conforming to Google sitemap guidelines.
• Social & Structured Data Automation:
  • Automated templated OG social image generation.
  • Per-type automatic Article and WebPage JSON-LD extraction from CMS fields.

---

6. System Language & i18n Workstream (P0–P4) {#system-language-p0-p4}

• P0: Complete EN/DE Coverage:
  • Eliminate remaining hardcoded English strings in admin chrome using scripts/check-hardcoded-copy.ts.
• P1: EU Pack + Arabic (RTL):
  • Complete review and verification of seeded language catalogs (FR, ES, IT, NL, PL, AR).
• P2: Transparent Language HMR:
  • Hot-reload language catalogs in development after bun run paraglide without manual server restart.
• P4: Compliance Documentation:
  • Publish verifiable translation workflow documentation and Crowdin integration guide adhering to UWG §6.

---

7. Quality Gates, Testing & Codebase Hygiene (Active Backlog)

• Type-Checking Gate Integration:
  • Wire svelte-check into pre-commit and CI quality gates (bun run check), including a machine-reporter parse (scripts/check/check-svelte-diagnostics.ts) that fails on warnings as well as errors — --threshold warning only widens output and still exits 0, so it alone was not a gate.
• Editorial Journey Matrix (next step for E2E):
  • Composite multi-field journey (kitchen-sink.spec.ts) + zero-error guard + editor-boundary journey + browser-vitality benchmark + widget interaction matrix (2026-10-23, see achievements 3.60).
  • Extend the composite journey to the remaining widget families: RichText, Textarea, Select, Date, Tags, MediaUpload, Relation, Repeater — include one uploaded image and one relation row, and assert the unsaved-changes guard.
  • Add a shared-harness page.on('pageerror') trap to the whole chromium project (not only the new journeys) once the current console-error allowlist is proven stable.
  • Tighten the browser-vitality budgets from a recorded baseline (domInteractive < 5 s / fill < 1 s / heap < 180 MB are placeholder ceilings) and add an INP measurement for rich-text typing.
  • Browser-mode component tests for RichText, repeater drag-and-drop, the date picker and the media picker (jsdom cannot exercise layout/pointer behaviour).
  • Unhappy paths: double submit, browser Back mid-edit, rejected upload, and direct-URL 403 for an editor.
• Shipped — /user edit dialog & admin table optimization (2026-10-25):
  • Fixed modal-edit-form.svelte and modal-edit-token.svelte reactivity: replaced static page.data destructuring with $derived, guaranteed non-empty user_id ('self' fallback) for editUserSchema, guarded $effect seeding by target identity (seededTargetKey) so active user input is never overwritten, and forwarded close({ success: true }) so DialogManager closes and UserManagement refreshes rows. Consolidated duplicate token expiry helpers into user-remote-utils.ts and skipped the redundant mount-time GET /api/user fetch when SSR initialUsers is present. See achievements 3.64.
• Integration Test Suite Wall-Time Optimization:
  • Consolidate the remaining prepareAuthenticatedContext call sites (the per-test beforeEach wipes in collections, media, system, telemetry, theme, website-tokens are now single beforeAll contexts; token keeps its per-test reset because that reset also clears the create-token rate limiter).
  • Remove the remaining redundant cleanupTestDatabase() hooks in afterAll (19 removed 2026-10-16 — every suite already resets in beforeAll; the rest do real media/file cleanup).
  • Move 3 hermetic integration tests (unified-data-hub/federation.test.ts, resilience-load.test.ts, setup-presets.test.ts) to tests/unit.
  • Collapse SQL adapter smoke tests into a single engine-parameterized contract suite.
  • Replace the remaining soft-skips with hard assertions — done for security, security-negative, collections (now provisions its fixture via /api/testing instead of a sandbox-blocked file write), auth-2fa, theme and both Unified-Data-Hub federation suites; the harness reset now throws instead of warn-and-proceed. Also de-vacuumed metrics, search, marketplace, outbox-plugin-storage, settings, dashboard, website-tokens, graphql (tenant-scoped query now gated on MULTI_TENANT), and the DB contract suites (transaction-contract — the concurrent test inserted via db.crud instead of the txn handle, so its “rollback leak” was a test bug; pool-contention, health-contract, content-nodes-contract, db-interface, resilience-load, cache-contract).
  • Replace the remaining fixed sleeps with condition waits (the harness reset path now health-polls; several API suites still pad with fixed waits).
• Recently shipped (2026-10-22): buildFieldSkeleton() seeds every declared field before the first widget mount (fixes the /collection/posts?create=true 500 from bind:value={undefined}); session rotation retires the predecessor for a 2-minute grace window and createSession({ isRotation: true }) skips the device/parallel caps; getFreshLayoutUser() strips credentials before the layout user is serialized into page data; Access Management tabs are static imports so the permissions table is server-rendered; admin tables use SMART_TABLE_* chrome; plugin workspaces render inside the content column instead of a fullscreen overlay; sidebar navigation uses plain goto() so it reuses the hover preload instead of forcing refreshAll.
• Also shipped (2026-10-22): the remaining client-only config pages (automations + its new editor load, webhooks, trash, workflows, sync, system-settings, extensions, design-system) now return their first payload from +page.server.ts; the dashboard renders cpu/disk/memory/system-messages tiles during SSR via an eager import.meta.glob registry (FirstScreenWidget); /user seeds initialUsers + initialSessions through getRequestLocalCMS(); (app)/+layout.server.ts no longer duplicates contentStructure; getStatusFacets() is SWR-cached and the collection warm-up writes the canonical find-cache key; the media gallery and monitor dashboard load in a single Promise.all; benchmark history is pruned to 50 rows per series per engine. See achievements 3.58.
• Open — brand palette vs WCAG AA: --color-primary-500 (oklch(76.87% 0.2296 137.58deg)) cannot be used as text (1.58:1 on surface-200) or as a white-on-fill badge (1.94:1). Fixing it means darkening the default primary ramp to ≈primary-900 luminance or amending the status-shade contract; both change every text-primary-* usage, so it needs a design decision before the Auth & Branding RTL audit can go green. See achievements 3.59.
• Recently shipped (2026-10-18): src/plugins/init.server.ts merges a plugin’s index.server.ts with its plugin_workspace slot server; scripts/benchmark-matrix/index.ts splits Feature HTTP Read to isolate heavy relational and mixed workloads (relational-performance, mixed-workload) into their own sequential lane, eliminating SQLite lock contention under full-matrix runs without lowering reliability guards; server-side requiredIf and showIf evaluation added to CollectionsNamespace write path with zero hot-path overhead; server-side cookie consent logging wired to sys_consent_audit via public plugin route /api/plugins/cookie-consent/consent and consentStore with allowedOrigins enforcement.
• Codebase & Documentation Cleanup:
  • Reconcile documented-but-unmounted components (TokenPicker mounted once in (app)/+layout.svelte with TokenRegistry entry-field registration; two-factor-setup-modal documented as superseded by modal-two-factor-auth).
  • Prune deprecated zero-caller symbols: MigrationEngine.executeMigration, buildRawTenantFilter, resolveSameSourceJoinTarget, UpsertOperation.
  • Prune orphaned scripts (2026-10-18): analyze-base-metrics.ts, check-deprecated.ts, generate-comprehensive-comparison.ts, provision-e2e.ts, record-cold-warm-benchmarks.ts, plus the one-shot locale codemods (add-page-title-suffix-key.mjs, fix-embedded-expression-messages.mjs, verify-locale-parity.mjs) and the duplicate create-app.ts (the published bin is create-app.js).
  • Validate inline code paths: resolve 107 stale inline `src/…` references in docs and add verification to tests/lint-docs.ts.
  • Wire up server-side cookie consent logging in src/plugins/cookie-consent/api.server.ts.
• State Migration:
  • Migrated legacy stores (systemState, overallState) in src/stores/system/state.svelte.ts to Svelte 5 runes ($state(), $derived()), fully eradicating svelte/store with internal native #listeners subscription support.

---

8. Enterprise, Security & Community (Active Backlog)

• Row-level access as a query constraint:

  • ACCESS_RULES private setting compiles per-collection/per-role read rules into a WHERE fragment merged before pagination, keyset cursors, COUNT(*) and streaming; also enforced on single/bulk update and delete. Dynamic tokens: $user._id, $user.role, $tenant.id. Shipped 2026-10-19 (src/services/security/access-rule-service.ts).
  • Write rules beyond read (create/update/delete per row) and operator support ($ne, $in beyond arrays, relation traversal).
  • Admin UI for rule authoring with validation and a preview of the generated filter.

• Third-Party Security Audit — posture: Security posture:

  • Commission an independent external penetration test prior to enterprise GA. Not performed as of 2026-10-18.

• Cryptographic agility (PQC readiness) — reference: Quantum security:

  • Key-ID envelopes (v2:<keyId>:…, binary key IDs, SCHB2 backups) and a configured decrypt ring (*_KEY_RING). Shipped in src/utils/security/envelope.ts; rotation is now a two-phase operation.
  • Hybrid at-rest envelope (AES-256-GCM payload under a random DEK, DEK wrapped with ML-KEM-768 + HKDF). Primitive shipped in src/utils/security/hybrid-kem.ts; opt-in for backups via PQC_HYBRID_BACKUPS=true and collection fields via PQC_HYBRID_FIELDS=true (src/utils/security/field-encryption.ts).
  • Optional SHA-384/SHA-512 checksum profile (CHECKSUM_ALGORITHM) for new artifacts; legacy bare-hex values still verify as SHA-256. The append-only audit chain stays SHA-256.
  • Pin the documented parameters with crypto-inventory, key-ring, hybrid-kem and checksum-profile tests; extend them when an envelope format changes.

• GraphQL Supergraph:

  • Apollo Federation v2 compatibility for multi-service enterprise architectures.

• Cross-Source Data Merge (v3.1):

  • Federated queries across heterogeneous databases.

• Community & Launch:

  • Framework quickstart guides (Next.js, Astro, Nuxt, SvelteKit consumers).
  • Marketplace static OpenGraph card synchronization on live docroot.
  • Interactive “Was this page helpful?” feedback component on docs routes.
  • Public ecosystem launch (Product Hunt, Hacker News, awesome-cms).

---

9. AI Provider Architecture (Active Backlog)

Based on publicly available release notes for Drupal AI 1.5.0 (Workflows of AI, 2026-10-12). Adopted items are recorded in achievements-2026 §3.53.

• Provider port:
  • Extracted typed AiProvider interface (src/services/ai/ai-provider.ts) defining generate/chat/embed/usage contracts with OpenTelemetry GenAI naming, decoupling inference callers from specific LLM vendors with server-side provider resolution.
• ChatProcessor seam:
  • Moved /api/chat behind ChatProcessor interface (src/services/ai/chat-processor.ts, AI_CHAT_PROCESSOR setting) with pluggable custom processor registration and abort handling.
• ChatMemory:
  • Persisted conversation threads server-side (src/services/ai/chat-memory.ts), scoped by tenantId + conversationId with L1/L2 cache, 24h TTL, 40-turn / 8k / 32k window, and POST /api/ai/chat/reset.
• Streaming guardrails:
  • Deterministic redactSecrets() and chunk-safe createStreamRedactor() (src/utils/security/stream-redaction.ts) applied across chat responses, SSE streaming, and content events.
• Moderation fail-closed:
  • Fail-closed moderateAiText() (src/services/ai/moderation.ts) with private-setting / env config and MODERATION_UNAVAILABLE on provider downtime.
• Reranker: re-order semantic-index candidates by answer relevance (top-N configurable), keeping keyword scores as the fallback.
• Token budgets: per-tenant daily token ceilings derived from the existing quota primitive, surfaced in the admin dashboard.
• Exporter: optional OpenTelemetry OTLP export for the gen_ai.* attributes already emitted (currently structured logs only).

10. UX & Design-System Consistency (Active Backlog)

Findings from the 2026-10-24 theme/UX review that need a design decision or a cross-page refactor (the chrome, status-shade and control-size items shipped in §3.63 of the achievements log):

• Permissions matrix: the access-management permissions table is still bespoke. Move it onto SmartTableShell (or the native table primitives) so sorting, empty state and responsive overflow match the other admin lists.
• Save models: the Design System page exposes three separate save paths (user overrides, admin theme, preset import). Define one dirty-state/save contract and make the action bar consistent across them.
• SmartTableShell adoption: media table, trash, queue and webhook logs still hand-roll their tables. Adopt SmartTableShell (including its unused toolbar slot) so list chrome has one owner.