diff --git a/ROADMAP.md b/ROADMAP.md
index 7179c8d..f2ba98b 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -283,6 +283,18 @@ Shares components with the admin view. See `docs/architecture/structure.canvas`
       dashboards overview, and the credential that mints is scoped to that
       panel's dashboards and the message endpoints its widgets speak. Deleting
       the panel revokes it
+- [ ] Pair a panel through the portal, for a screen hanging somewhere the
+      installation is not reachable from. Three gates today: the hub's app shell
+      redirects a browser carrying no portal session, its proxy authorizes before
+      forwarding so the unauthenticated pairing call never crosses the tunnel,
+      and the app under a portal takes its bearer from the injected config rather
+      than from storage. A hub token with a `panel` scope opens all three —
+      `decode_portal_token` already branches on scope, and `_panel_may` then
+      applies unchanged, so the installation stays the authority on what the
+      panel reads. The owner check in the hub's `_authorize` is what a panel
+      token must not fall through, and the rate-limit key beside it assumes a
+      user id too. Milestone-level rationale, and the alternative worth weighing
+      first, are in `docs/private/roadmap.md` § M5
 
 ## Phase 5 — Website and docs