diff --git a/README.md b/README.md
index c6b9008..3e2e2b1 100644
--- a/README.md
+++ b/README.md
@@ -521,7 +521,34 @@ deploy/
 
 ## Roadmap
 
-- Declared indexed fields for fast queries on large collections.
-- Extend per-collection access rules to multi-tenant projects (public access via a non-secret project id).
-- Richer realtime presence (join/leave, typing) and a multi-process (Redis) adapter for horizontal scale.
-- Publish to npm and a container registry (the GHCR release workflow is wired; first tag publishes).
+**Recently shipped:** pluggable backends — optional **Postgres** (data) and **S3**
+(files) alongside the SQLite + disk defaults; **declared indexed fields** for fast
+queries on large collections; **per-project public collections** via a non-secret
+project id; and realtime **presence** (join/leave/typing) with an optional **Redis**
+fan-out for multi-process scale.
+
+Next, split by who benefits:
+
+_For app developers (the API):_
+
+- **Public realtime** — extend non-secret project-id access to websocket
+  subscriptions on public channels, so a published frontend gets live updates
+  without embedding a secret (closes the gap left by public collections).
+- **Optional per-collection schemas** — opt-in JSON-schema validation with clear
+  `422` errors; zero-config collections stay schemaless by default.
+- **Cursor pagination** (`?after=`) for stable iteration over large collections,
+  built on the new declared indexes (offset paging drifts under concurrent writes).
+
+_For operators (running the server):_
+
+- **Redis-backed rate limiting + presence TTLs** — make per-IP limits and the
+  presence roster correct across the multi-process deployments Redis now enables
+  (today limits are per-process and a hard crash can leave a stale presence entry).
+- **Observability** — a Prometheus `/metrics` endpoint and a `/ready` probe
+  (DB/Redis/S3 reachability) for orchestrated, scaled deployments.
+- **Safe index builds** — `CREATE INDEX CONCURRENTLY` on Postgres so declaring an
+  index on a large live table doesn't block writes.
+
+_Larger, later:_ verifiable identity (JWT/OIDC) for per-user ACL + trusted presence;
+outbound webhooks on data changes; per-project AI provider config; publish to npm +
+GHCR (the release workflow is wired; the first tag publishes).