diff --git a/docs/CSI-project-stages.md b/docs/CSI-project-stages.md
new file mode 100644
index 0000000..1a88055
--- /dev/null
+++ b/docs/CSI-project-stages.md
@@ -0,0 +1,87 @@
+# CSI sensing project stages
+
+Ladder of increasing difficulty for WiFi sensing on hardware we own
+(MT3000 router, Android phones, AX211 laptop — no purchases required).
+Every rung ends in something visible or verifiable. Deterministic signal
+processing throughout; ML appears only as classifiers labeling measured
+features — no image synthesis, no "guessed" renderings (project rule).
+
+Context: docs/directions.md (capability directions), docs/findings.md
+(firmware facts). Key enabler already established: the stock MT7981
+firmware registers CSI command handlers (0xc2/0xc3/0xc4 — F9 data), and
+MediaTek authored a driver-side CSI patch (2022, never mainlined).
+
+## Stage 0 — pipeline rehearsal, zero firmware work (tonight)
+
+Laptop + phone only. Data is coarse (RSSI: one strength number per
+packet), but the tooling built here is reused by every later stage.
+
+- 0.1 RSSI motion logger: phone streams UDP (iperf), laptop logs signal
+  strength at high rate into Python.
+- 0.2 Dashboard: streaming line plot + waterfall renderer.
+
+Done when: waving at the phone visibly moves the plot; crossing the room
+leaves a streak.
+
+## Stage 1 — first real CSI (router powered again)
+
+- 1.1 Router online; pull its exact firmware blobs; diff against
+  linux-firmware copies (ground truth).
+- 1.2 Port MediaTek's 2022 CSI patch to the router's OpenWrt mt76;
+  rebuild, flash (U-Boot recovery available).
+- 1.3 Verify firmware answers: 0xc2 CSI events flowing (RE says the
+  handlers exist — prove live).
+- 1.4 Collector: netlink → Python → live CSI heatmap (the barcode),
+  phone as talker.
+
+Done when: empty-room barcode sits still; walking through breaks it.
+
+## Stage 2 — clean physics, deterministic DSP
+
+- 2.1 Phase cleaning (conjugate-multiply across packets).
+- 2.2 Live Doppler spectrogram (speed-labeled streaks).
+- 2.3 Breathing extraction: bandpass 0.1–0.6 Hz; verify breaths/min
+  against a stopwatch.
+- 2.4 Distance slices: tone-axis transform; verify at marked positions
+  (2 m / 4 m / 6 m) against the ~2 m resolution budget.
+- 2.5 Event detectors: entry/exit, travel direction, two-person counting
+  (thresholds, no guessing).
+
+Done when: views match physical reality checkable with tape measure and
+stopwatch.
+
+## Stage 3 — firmware upgrades (the RE project pays off)
+
+- 3.1 Crank measurement rate: dedicated sounding traffic instead of
+  borrowed network traffic.
+- 3.2 CSI on every frame + ambient/monitor capture, not just the
+  associated client.
+- 3.3 Channel hopping across the 5 GHz band: synthesize ~555 MHz →
+  ~10-inch distance slices. Verify at marked positions.
+- 3.4 Dual-band simultaneous capture (2.4 + 5 GHz).
+
+Done when: slice resolution measurably improves; the firmware's rate
+ceiling is documented and its patch location known.
+
+## Stage 4 — state of the art, deterministic only
+
+- 4.1 Full range-Doppler radar screen (live, both transforms).
+- 4.2 Gesture vocabulary: ~6 dynamic hand signs classified from measured
+  Doppler streak shapes (small classifier on measured features; per-user
+  training; honest accuracy reporting).
+- 4.3 Transmitter voiceprinting: classify devices by RF signature; detect
+  a MAC-spoofed clone.
+- 4.4 Through-wall characterization: detection reliability vs distance
+  through a known wall.
+- 4.5 Optional (later hardware): second capture node → floor-plan
+  overlay; SAR rail for outline imaging.
+
+Out of scope per project rule: skeleton/pose renderings, point clouds,
+any network-invented pixels.
+
+## Gates
+
+- Physical: router must be powered (unblocks Stage 1).
+- Long grind: Stage 3 firmware work — same RE as the main project, now
+  with concrete purpose; benefits from the dispatch/handler maps already
+  built.