# FloorRadar — Product Roadmap

> What's planned, in progress, and recently shipped.
> Rendered in-app via the 🗺️ Roadmap header button.

---

## In Progress

### Authenticated end-to-end test coverage
- Extend the smoke suite to cover signed-in flows (deals tab, all tabs, changelog modal, logout)
- Wire the auth-gated half into CI alongside the unauthenticated suite
- **Effort:** 1 session | **Priority:** MEDIUM

---

## Planned — Near Term

### Multi-tenant foundations
- Refactor data model so the app can serve more than one establishment
- Replace tenant-specific assumptions with tenant-scoped lookups throughout the app
- **Effort:** 2-3 sessions | **Priority:** HIGH

### Admin role separation
- Distinguish admin and standard users
- Hide administrative actions from non-admin sessions
- **Effort:** 1 session | **Priority:** HIGH

### Versioned database baseline
- Capture the current schema as a version-controlled migration so changes are reviewable in PRs
- **Effort:** 1 session | **Priority:** HIGH

---

## Planned — Medium Term

### M&A research toolkit
- Acquisition-focused features for buyers researching IL gaming establishments: owner-contact enrichment, comparable-set analysis, municipality regulation tracker, terminal-operator concentration, tax-tier curve calculator, watchlists with email alerts
- **Effort:** 3 weeks | **Priority:** HIGH

### Subscription billing + self-serve onboarding
- Stripe Checkout + Customer Portal for tiered subscriptions
- Signup → claim your establishment → automated license verification → 14-day trial → paid
- Mobile-friendly verification document upload
- **Effort:** 2 weeks | **Priority:** HIGH

### Operational baseline for paid users
- Customer-facing support email and response SLA
- Error monitoring and incident-response playbook
- Database backup and tested restore
- Customer-success outreach for the first cohort
- **Effort:** 1.5 weeks | **Priority:** HIGH

---

## Future / Strategic

### Multi-establishment under one login
- Manage several establishments from a single account with a top-bar selector and aggregated dashboard view
- **Effort:** 1-2 weeks | **Priority:** HIGH (post-launch)

### Team accounts and roles
- Invite collaborators to your account — owners manage billing, admins manage establishments, members and viewers have read access at different scopes
- **Effort:** 1 week | **Priority:** HIGH (post-launch)

### Mobile-first dashboard
- Phone-native KPIs and views — see this month's revenue, your municipal rank, and momentum from your phone
- **Effort:** 1 week | **Priority:** MEDIUM

### Per-deal research reports
- One-time deep-dive M&A scorecard delivered as a PDF, for buyers who don't want a full subscription
- **Effort:** 3-5 days | **Priority:** MEDIUM

### Smarter rate limiting
- Debounce search input and throttle background loads to keep the app responsive under heavy use
- **Effort:** 1 session | **Priority:** LOW

### Visual regression testing
- Automated screenshot diffs on UI changes to catch unintended visual breaks
- **Effort:** 1 hour | **Priority:** LOW

### Markdown rendering library upgrade
- Replace ad-hoc markdown handling with a vetted library across the app
- **Effort:** 1 session | **Priority:** LOW

---

## Completed

### Continuous testing on every PR ✅
- Smoke suite runs automatically against the deploy preview for every pull request and against the live site on every push to main
- 25 assertions covering page load, security headers, error handling, asset integrity, and unauthenticated redirect

### Roadmap modal UI ✅
- Header `🗺️ Roadmap` button opens an in-app modal that renders this file as feature cards across In Progress / Near Term / Medium Term / Future / Done tabs

### Login error sanitization ✅
- Login page returns generic, user-friendly error messages

### Subresource Integrity on third-party scripts ✅
- All CDN-hosted scripts and stylesheets carry integrity hashes

### Inline-script removal ✅
- All inline event handlers and inline `<script>` blocks moved to external modules

### Sensitive-path protection ✅
- Internal documentation and project-meta files are no longer publicly served

### Continuous review pipeline ✅
- Multi-pass review framework (design, schema, security, pre-commit) with reports persisted alongside the code

### Council secret scanning ✅
- CI gate prevents review reports from accidentally landing committed credentials