diff --git a/docs/roadmap.md b/docs/roadmap.md
index c1f8bf0..da74b44 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -14,6 +14,50 @@ Status markers:
 These are the remaining gaps that must close before the prototype is a smooth
 end-to-end test target for the intended personal mesh use cases.
 
+Implementation order:
+
+1. `[~]` Close remote authorization and replicated-state safety gaps.
+   Acceptance criteria:
+   - `[ ]` Add tests proving denied remote operations do not mutate local state.
+   - `[ ]` Add tests proving unsigned, invalidly signed, and conflicting
+     replicated records do not mutate trust/resource state.
+   - `[ ]` Improve `auth explain` diagnostics enough for operators to
+     distinguish discovered-only peers, missing endpoint bindings, missing
+     grants, matching grants, revocations, and bearer access.
+
+2. `[ ]` Replace bootstrap sync transports with Iroh-native backends where the
+   pinned APIs are stable.
+   Acceptance criteria:
+   - `[ ]` CAS uses `iroh-blobs` or has a documented pinned blocker.
+   - `[ ]` KV uses Iroh Documents or has a documented pinned blocker.
+   - `[ ]` Pubsub uses `iroh-gossip` or has a documented pinned blocker.
+
+3. `[ ]` Polish file sync reconciliation.
+   Acceptance criteria:
+   - `[ ]` Add a safe three-way apply path for non-conflicting
+     create/update/delete/rename changes.
+   - `[ ]` Keep ambiguous changes as durable conflicts.
+   - `[ ]` Add two-root integration coverage.
+
+4. `[ ]` Replace JSON document state with durable Automerge documents.
+   Acceptance criteria:
+   - `[ ]` Store Automerge documents durably.
+   - `[ ]` Sync Automerge changes over Iroh.
+   - `[ ]` Gate document sync with resource authorization.
+
+5. `[ ]` Harden DB sync for real cr-sqlite usage.
+   Acceptance criteria:
+   - `[ ]` Add a real cr-sqlite-enabled two-node integration test, or document
+     a precise blocker if the extension is unavailable in CI/dev.
+   - `[ ]` Decide and document whether CAS-backed DB snapshots/batches are part
+     of the prototype.
+
+6. `[ ]` Finish operational first-run polish.
+   Acceptance criteria:
+   - `[ ]` README has a two-machine walkthrough for the main smoke tests.
+   - `[ ]` CLI recovery errors tell operators the next command to run.
+   - `[ ]` JSON sync status is script-friendly for stale/failed peer detection.
+
 - `[~]` Two-node operator-flow test coverage.
   Acceptance criteria:
   - `[x]` A two-daemon test covers owner-rooted init, peer-card exchange,