Instead of implementing it directly into AEM I would use a IDP solution, which can do the MFA authentication for you and the connect it via SAML to AEM.(Implementing all that into AEM on your own is possible, but you need to the right expertise to do that in a secure way.)

I assume that the bottleneck in the initial case was the child node list, which needs to be maintained as many node types support only ordered child lists. If the ordering wouldn't matter at all, a nodetype like "oak:unstructured" would have helped, because there the updates of the childnode list wo...

How do you deploy this file? Via fullstack pipeline or frontend pipeline?In case of the fullstack pipeline: Not a problem, as new instances will be started with an empty dispatcher cache. So you don't need to invalidate them.Frontend pipeline: Good question, I am not an expert in that ... would need...

I am wondering about this dependency. On the Joda time homepage I found this prominent statement:Note that from Java SE 8 onwards, users are asked to migrate to java.time (JSR-310) - a core part of the JDK which replaces this project. I read that this this version still needs to support java 6 and t...

Can you please point me to the documentation which says that SAML 2.0 authentication on publish is not available on AEM CS?(I know a number of cases, where this is working.)

Groovy console is not supported. Meaning that it might work, but it also might not work. 

if your code is calling the replication API anway directly: There is replicator.replicate() method which takes an array of pathes to replicate. IIRC even in AEM 6.x this packaged these paths up in a single call (in AEM CS it definitely does that).

p.limit=-1 asks the query engine to return all results. And querybuilder will read the complete result set, which can take time because all results need to be filtered. Can you please run the query through the query explain tool? In AEM CS you can also use the query performance tool, see https://exp...

what AEM version are you using?

 you could define all nodes in the path /apps/cq/core/content/nav/tools/ to nt:unstructured nodes (by providing a proper .content.xml or whatever way you prefer); because then filevault never falls back to its defaults (which is a nt:folder for a folder in your content structure). Then the simplest ...