# Roadmap — where it goes next

> **Populated by phase 5 — not yet written.** Phase 5 depends on phase 4: you cannot sequence work
> that has not been reconciled into one backlog.

A **proposal**, not a commitment. The ordering is reasoned and can be overruled; what is not negotiable
is that every item traces to a `BL-###` in [status/backlog.md](../status/index.md), so nothing is
scheduled that was not first triaged.

## Planned contents

| File | Covers |
| --- | --- |
| `next-up.md` | The next 3–5 units of work, each spec'd enough to start |
| `deferred.md` | Recorded, each with the trigger that pulls it forward |
| `tech-debt.md` | What must be paid before scale, and what deferring it costs |
| `pre-launch.md` | The hard gate before real users touch this |

## One item already known for `pre-launch.md`

The repo **contains live credentials on purpose** — a deliberate pre-launch trade for a demo deployment,
documented in [root CLAUDE.md §6](../../CLAUDE.md) and [DEPLOY.md](../../DEPLOY.md). Before onboarding
real users those values must be rotated and the secret half moved out of git.

One value is load-bearing and must **never** change: `Seams:FieldEncryption:Key` and `:HashKey` decrypt
every encrypted column and derive the `PhoneHash` that every login looks up. Rotating them locks every
account out.