diff --git a/ROADMAP.md b/ROADMAP.md
index 8c9f653..a8fd671 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -44,6 +44,17 @@ falsification hypotheses (H1–H6) are in `DESIGN_v2.md`.
   audio chunk length, audio concurrency, etc. are currently hardcoded defaults (now also CLI flags on
   `run-extract`: `--chunk-chars`, `--max-chunks`). Surface them in the UI so they're visible/adjustable,
   not black-box assumptions we forget about. Tie to the corpus-management UI work.
+- **Daily activity digest email.** A `daily-digest` CLI command rendering a "last 24h" report —
+  corpus throughput (`documents.ingested_at`/`processed_at`, `claims.extracted_at` by kind/cluster),
+  queue health (`backfill.queue.stats()` — surface **failed/stuck** jobs), Qdrant index lag, infra
+  (`spark-status`), and a **key-findings** section (new `ledger` rows by `date_logged`; `candidate_scores`
+  that `cleared_evidence_bar`). All timestamps already default to `datetime('now')`, so the window is a
+  one-liner; the activity half is buildable today. Deliver via **SMTP** (stdlib `smtplib`+`email`, no new
+  dep, configurable per service — `SMTP_HOST/PORT/USER/PASS`, `DIGEST_TO`); ship a `--stdout` dry-run
+  mode; schedule via launchd on the Mac. Two dependencies: (1) the findings section is only real once the
+  **Job A discovery scorers** run on a schedule — until then it's stubbed/echoes manual adversarial runs;
+  (2) sovereignty (guardrail #7) — SMTP through your own/ten31 server keeps it inside the boundary; do NOT
+  route through a third-party email API if findings ever carry Battery/Strike or positioning substance.
 - **Forward live operation** — the only real test: scoring un-pre-selected signals as they arrive, with
   the dual-evaluation ledger as arbiter.