diff --git a/ROADMAP.md b/ROADMAP.md
index 0ff45ac..fc6db4b 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -161,14 +161,20 @@ force-stopped at the drain deadline on shutdown; full suite green.
 
 ## v0.4 — WebSocket upgrade path
 
-1. **Handshake**: detect `Connection: Upgrade` + `Upgrade: websocket` in
-   the pipeline; `Conn::upgrade(handler)` short-circuits — conn actor
-   validates `Sec-WebSocket-Key`, emits 101, exits the HTTP loop.
-   (SHA-1 + base64 needed; vendor a tiny SHA-1 rather than pulling a
-   crate — urus has two deps and it should stay that way.)
-2. **Frame codec**: RFC 6455 framing — fragmentation, masking (client
-   frames are always masked), control frames (ping/pong/close), 125-byte
-   control-payload rule, close-code handshake.
+1. **Handshake** ✅ (49538cc) — `Conn::upgrade()` (handler arg comes
+   with chunk 3): §4.2.1 validation, 101 + accept key, marker field on
+   `Conn`, actor leaves the HTTP loop (fd drops until chunk 3 takes
+   over). Rejections stay plain HTTP (400 / 426 + version header) with
+   keep-alive intact. **Dep decision changed at the design pass**: SHA-1
+   is `sha1_smol` (zero transitive deps) — dep #3 SPENT, no hand-rolled
+   crypto (user call). The v0.6 JSON question is therefore a dep #4
+   question now. Base64 stays in-tree, encode-only.
+2. **Frame codec** ✅ (2869153) — pure `ws::frame`: incremental
+   `decode` (mask-required server mode), minimal-length + RSV + control
+   rules enforced, header-derived cap check before payload buffering,
+   close-code wire validation, `Assembler` for fragmentation with
+   whole-message UTF-8 check, `FrameError`→close-code map
+   (1002/1009/1007). §5.7 examples pinned verbatim.
 3. **Duplex topology** (the design decision from the assessment):
    - **(a) Two actors, dup'd fd**: reader actor on the dup, writer actor
      on the original, writer owns a `Receiver<Frame>`; the user handler