diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
index 1b9e9cf..1c00dc2 100644
--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -53,8 +53,9 @@ It assumes:
 - [x] Cosmos-first repositories no longer take an injected legacy service handle for users, profiles, presets, snapshots, capital ledger, or strategy presets; legacy Postgres reads/writes go through `legacySupabaseClient.ts`
 - [x] `apiServer` no longer imports `SupabaseService`; admin-scoped HTTP behavior uses `isTradingAdmin` (platform JWT role first, then legacy user-store admin flag)
 - [x] Shared order/reconciliation row types live in `tradingPersistenceTypes.ts`; trading user row shape lives in `tradingUserTypes.ts` (with `SupabaseService` re-exporting for compatibility)
-- [-] DRY cleanup is largely complete for runtime/config/bootstrap, websocket auth helpers, platform-session handling, request tracing, persistence type layering, legacy access surface, and the backtest feature-flag contract; **optional follow-ups:** shrink `SupabaseService.ts`, tighten root-level script imports, admin audit schema
-- [-] Cosmos-only execution persistence is in place for main `backend/src` runtime paths; **remaining:** many one-off `backend/*.ts` maintenance scripts still import `supabaseService` directly; classify or migrate over time
+- [x] Root-level `backend/*.ts` maintenance scripts: raw Postgres access uses `getLegacySupabaseClient()` where practical; `loadDynamicConfig()` calls no longer pass a dead `supabaseService` argument; scripts that must keep `supabaseService` (reconciliation helpers, monkey-patches, `subscribeToProfiles`, etc.) are listed in `docs/BACKEND_LEGACY_SUPABASE_SCRIPTS.md`
+- [-] DRY cleanup is largely complete for runtime/config/bootstrap, websocket auth helpers, platform-session handling, request tracing, persistence type layering, legacy access surface, and the backtest feature-flag contract; **optional follow-ups:** shrink `SupabaseService.ts`, admin audit schema
+- [x] Cosmos-only execution persistence is in place for main `backend/src` runtime paths; remaining direct `supabaseService` imports in one-off root scripts are intentional and documented (see `docs/BACKEND_LEGACY_SUPABASE_SCRIPTS.md`)
 
 ## 3. Guiding Rules
 
@@ -619,5 +620,5 @@ Reason:
 - [x] Finish remaining web direct legacy data-table reads and writes behind backend APIs
 - [x] Replace remaining transitional web auth compatibility surfaces with fully common-platform-native session handling
 - [x] Add release smoke coverage for web auth/kill-switch and mobile auth/kill-switch flows
-- [ ] Audit root-level `backend/*.ts` scripts: migrate `getClient`-only usage to `legacySupabaseClient` where practical, or document intentional direct `supabaseService` use
+- [x] Audit root-level `backend/*.ts` scripts: migrate `getClient`-only usage to `legacySupabaseClient` where practical, or document intentional direct `supabaseService` use (see `docs/BACKEND_LEGACY_SUPABASE_SCRIPTS.md`, 2026-04-05)
 - [ ] Phase 2 backlog still open: module layout under `backend/src`, legacy module classification, generic lib split, typed API contract sweep, websocket models, admin audit schema, deprecated-endpoint / legacy compatibility documentation