diff --git a/docs/roadmap.md b/docs/roadmap.md
index 6c87e48..f5800fd 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -66,7 +66,7 @@ Implementation order:
    - `[x]` CLI recovery errors tell operators the next command to run.
    - `[x]` JSON sync status is script-friendly for stale/failed peer detection.
 
-- `[~]` Two-node operator-flow test coverage.
+- `[x]` Two-node operator-flow test coverage.
   Acceptance criteria:
   - `[x]` A two-daemon test covers owner-rooted init, peer-card exchange,
     enrollment request submission, owner approval, `geth sync now`, and
@@ -106,7 +106,7 @@ Implementation order:
     compatible with `iroh-blobs`, `iroh-docs`, and `iroh-gossip` without
     introducing a second daemon endpoint.
 
-- `[~]` File sync reconciliation polish.
+- `[x]` File sync reconciliation polish.
   Acceptance criteria:
   - `[x]` `cas root apply` has a richer three-way base/local/remote reconcile
     path for safe updates and deletes.
@@ -293,7 +293,7 @@ resource-scoped capability decisions.
   - JSON is not used as the signed representation.
   - Tests verify equivalent operations hash/sign identically across runs.
 
-- `[~]` SSH-admin-rooted keychain initialization.
+- `[x]` SSH-admin-rooted keychain initialization.
   Acceptance criteria:
   - `[x]` `geth keychain init` records a local `KeychainInit`.
   - `[x]` `geth keychain init --admin-key <path>` records an admin SSH public
@@ -361,7 +361,7 @@ resource-scoped capability decisions.
     `kv.write_prefix:apps/foo/`.
   - Tests cover grant, revoke, group membership, and denied access.
 
-- `[~]` `auth explain` real decision path.
+- `[x]` `auth explain` real decision path.
   Acceptance criteria:
   - `[x]` `geth auth grant` and `geth auth revoke` persist signed local auth
     ops when run through the CLI.
@@ -374,7 +374,7 @@ resource-scoped capability decisions.
     missing and matched endpoint bindings, matching grants, revoked grants, and
     bearer access.
 
-- `[~]` Resource secrets and bearer invites.
+- `[x]` Resource secrets and bearer invites.
   Acceptance criteria:
   - `[x]` `geth secret create <resource>` records resource secret epoch 1
     metadata.
@@ -398,7 +398,7 @@ resource-scoped capability decisions.
   - `[x]` Tests verify the public bearer id differs from the private token and
     remote bearer auth uses the token.
 
-- `[~]` SSH certificate and revocation lifecycle.
+- `[x]` SSH certificate and revocation lifecycle.
   Acceptance criteria:
   - `[x]` `geth ssh cert request/requests/approve/import/list` persist local
     metadata.
@@ -521,7 +521,7 @@ authorization and durable-state boundaries clear.
 
 Goal: add authorized stream-oriented management workflows over Iroh.
 
-- `[~]` Dumbpipe-style Iroh streams.
+- `[x]` Dumbpipe-style Iroh streams.
   Acceptance criteria:
   - `[x]` `geth pipe listen/connect` works against a local daemon-lifetime
     registry.
@@ -545,7 +545,7 @@ Goal: add authorized stream-oriented management workflows over Iroh.
   - `[x]` TCP streams close cleanly and propagate errors through the local
     forwarder logs.
 
-- `[~]` TCP forwarding.
+- `[x]` TCP forwarding.
   Acceptance criteria:
   - `[x]` A local loopback TCP listener can forward over an authorized Iroh
     pipe with `geth pipe forward-tcp`.
@@ -668,7 +668,7 @@ Automerge documents.
     Iroh control path and advances high-water cursors only after schema checks
     and successful local application.
 
-- `[~]` Automerge document resource.
+- `[x]` Automerge document resource.
   Acceptance criteria:
   - `[x]` `geth document create/status` works for local documents.
   - `[x]` Document metadata and empty Automerge state are stored durably.
@@ -702,7 +702,7 @@ and future group key evolution.
   - `[x]` Tree objects are content-addressed and stored in CAS.
   - `[x]` Tests cover deterministic tree hashing.
 
-- `[~]` File roots.
+- `[x]` File roots.
   Acceptance criteria:
   - `[x]` A file root maps a local path to a CAS tree resource.
   - `[x]` `geth cas root add/list/scan` persists local root metadata and latest