Roadmap

Vumbnail’s core is live and serving production traffic. The active work is concentrated on revenue activation, reliability, and cost reduction, in that spirit. Dates reflect repo artifacts.

Live (shipped & serving traffic)

• Thumbnail URL API — Vimeo/YouTube, sizes, passwords, playlists. → Thumbnail URL API
• Three-layer caching + negative cache + fallbacks. → Caching & delivery
• Freemium watermarking with referrer/non-domain cohorts; rollout pinned to 100% and hardcoded out of the hot path (2026-05-12). → Freemium watermarking
• Paid access via Stripe webhook → KV/D1/customers.json; entitlements in runtime mode (cutover 2026-03-11). → Paid access
• Edge watermark router Snippet — hot-set short-circuit, Borås escape, malformed-path fallback; test/rollback hardening in progress. → Edge watermark router
• P0 watermark-error fix — transform failures now fail open (HTTP 200) rather than 500 (deployed 2026-05-13).
• Operator dashboard and outreach toolkit (internal).

In progress

• Snippet test & health hardening — rollback safety + local contract tests done; post-deploy health checks underway. Gates the Snippet cost-reduction work.
• P1 miss-path attribution — stage-1 counters deployed (2026-05-13); collecting a long-enough sample to rank edge-cache vs. R2 vs. negative-cache misses before optimizing.
• Snippet worker cost reduction — expand the hot set / reviewed-referrer slice to divert more metered Worker+KV traffic (~$1.07/M saved per diverted request); blocked on hardening above.
• KV projection cache TTL tuning — 60s → 300s to cut entitlement-projection reads; pending a freshness decision.
• Non-domain watermark cohorts — core shipped; known-user list generation + remote overlay publishing remain.
• Developer docs & API DX — first-wave public docs (paid quickstart, auth patterns, “why still watermarked?”, Next.js image cache caveats) planned in an Astro Starlight apps/docs site.

Staged watermark flip program

Status: Planned — blocked on the G0 gates below. A 2026-06-14 live re-probe shows watermark delivery is now wm-dominant at the probed colo, with an active reverse leak: no-referrer/direct users get watermarked images from the referrer-blind page-rule cache — the opposite of the developer-friendly policy. The fix is decided: the edge Snippet is the deterministic control point (watermark = 307 redirect to a distinct wm.jpg key; the bare URL stays clean), no-referrer resolves to clean, and dev/local traffic is detected by referrer host — never user agent (implementation Planned). Flipping a host adds it to WM_DOMAINS + its current ids to HOT, and removes it from the worker referrer cohort in the same release — otherwise the worker re-pins the watermark on miss and purges don’t stick.

G0 pre-flight gates — all currently open

• C02 — a paying customer with empty entitlements would be watermarked; resolve or waive before any flip.
• Purge tooling — batch wrapper, fail-closed pre-wave cost gate, and invocations/KV poll must be built (current purge tool is single-URL, uncapped).
• No-referrer → clean policy sign-off (written) before the first purge.
• HOT-refresh automation for rotating catalogs (decay to ~0% in ~8 weeks).
• Cache-Control: no-store on the 307 before flipping any >1M/mo host.

Rollout order, one batch at a time with 24–72h soak and numeric abort criteria:

1. Canary — H01 (the only host still leaking clean).
2. Single-host batches, then the stable bundle H04/H05/H06/H07.
3. H03 isolated (rotating catalog; decay-monitored).
4. H09 (plus its subdomain).
5. H08 last and alone — highest volume (~4M/mo), ramped id-by-id, gated on operator visibility.
6. Tail H10–H14, also gated on operator visibility.

Purges follow the sequencing rule (snippet live → propagated → ids HOT → cohort removed → smoke green → trickle-purge) with per-wave URL caps and hard cost ceilings; rollback is dual-lane (snippet off + cohort backoff + purge) — snippet-disable alone never restores clean. Net program effect is a monthly savings, since redirects skip the worker. Full procedure: Staged rollouts and Cost-safe cache purging.

Planned

• Whale-watermark expansion — open watermark serving for reviewed high-volume hosts; blocked on non-domain-cohort validation. Reverse-leak fix and pricing-funnel wiring are prerequisites.
• Cache purge API (paid) — force-refresh a thumbnail. → Cache purge API
• Video-metadata queue recovery — repair the metadata pipeline so the system can learn from new customers without manual support.
• Vimeo request reduction (P2) — keep cutting the largest upstream-failure bucket.
• Canary host cutover — move remaining /6* routes off Vercel onto Cloudflare (removes Vercel spend; needs a cost estimate).
• Durable auth-email delivery, observability capture, YouTube legacy path routing (P3).
• Animated thumbnails productization (currently flagged off). → Animated thumbnails
• Shopify app launch (scaffolded/researched). → Shopify app

Parked

Worthwhile but not the current bottleneck: page-rules centralization, dashboard metric provenance + pie charts, action-tracking substrate, Stripe email automation, DuckDB BI evaluation, function-declaration refactor, security-header audit, hotspot-ranking refactor tranches.

How priorities are set

Work is scored on a running backlog and re-ranked against measured production signals (error buckets, subrequest breakdowns, cost reports). The bias is: unlock revenue, keep paying customers clean, fail open, and don’t add Cloudflare spend without a written estimate. See Design principles.