diff --git a/docs/roadmap.md b/docs/roadmap.md
index cdca982..a675eda 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -171,21 +171,30 @@ client) is built and live. Two changes harden it from "works" to "secure by defa
 
   PIN pairing (§8a) stays the bootstrap — the first device, or when no approver is online.
 
-## 9. Client→host network speed test *(next — prerequisite for a user-settable bitrate)*
+## 9. Client→host network speed test + settable bitrate *(host side done — client UI remaining)*
 
-Before exposing a user-settable bitrate, the client needs a way to **measure what the network
-actually sustains** between it and the host, so the bitrate picker is informed (suggest/cap a safe
+Measure what the network actually sustains so the bitrate picker is informed (suggest/cap a safe
 value) instead of guesswork that ends in a stuttering stream.
 
-- A short **bandwidth probe over the punktfunk/1 data path**: the host bursts a few seconds of
-  FEC-encoded payload (sized like a real high-bitrate stream) while the client measures sustained
-  throughput + packet loss + jitter, and reports the achievable Mbps (plus the FEC-recovered
-  headroom — the GF(2¹⁶) Leopard wall-breaker is exactly what makes a high-loss link still usable).
-- Surface it in the client UI ("Test network" → "~XXX Mbps · recommended bitrate YYY") and the web
-  console; feed the result into the bitrate control (clamp/suggest) once that lands.
-- Reuse the existing `Session`/FEC plumbing — a probe is just a non-video AU stream the client
-  byte-counts + times; no new transport. Pairs with bitrate negotiation (bitrate in Hello/Welcome,
-  alongside the mode renegotiation already in place).
+**Done & live (host + protocol + connector + C ABI, `74819b1`):**
+- **Bitrate negotiation**: `bitrate_kbps` rides Hello/Welcome (trailing-byte back-compat). The
+  client requests a rate; the host clamps to [500 kbps, 500 Mbps] (or its 20 Mbps default on 0),
+  applies it to NVENC (replacing the old hardcoded 20 Mbps) on the initial mode + every reconfigure,
+  and echoes the resolved value. C ABI: `punktfunk_connect_ex3(…, bitrate_kbps, …)` +
+  `punktfunk_connection_bitrate()`.
+- **Bandwidth probe over the punktfunk/1 data path**: `ProbeRequest{target_kbps,duration_ms}` /
+  `ProbeResult{bytes_sent,…}` control messages + a `FLAG_PROBE` packet flag. The host bursts
+  zero-filled FEC-encoded AUs at the target goodput for the duration (clamped ≤ 1 Gbps / ≤ 5 s,
+  video paused), reports what it sent; the connector measures received bytes/window → goodput + loss
+  and exposes it (`punktfunk_connection_speed_test()` + `punktfunk_connection_probe_result()` →
+  `PunktfunkProbeResult{throughput_kbps, loss_pct, …}`). Probe filler is diverted from the decoder.
+  Validated on loopback (synthetic source): a 20 Mbps/2 s probe measured 20050 kbps at 0% loss,
+  interleaved probe AUs excluded from frame verification. `punktfunk-client-rs` gains `--bitrate` +
+  `--speed-test KBPS:MS` as the reference/loopback driver.
+
+**Remaining (client UI):** wire the C ABI into the Apple client — a "Test network" action
+(`speed_test` → poll `probe_result` → "~XXX Mbps · recommended bitrate YYY") feeding a bitrate
+control (`connect_ex3`), and surface both in the web console.
 
 ## 10. HDR + 10-bit color *(parked — blocked upstream at the compositor producer)*