diff --git a/docs/PRODUCTION_READINESS_HANDOFF_ROADMAP.md b/docs/PRODUCTION_READINESS_HANDOFF_ROADMAP.md
index b9d4df6..369df43 100644
--- a/docs/PRODUCTION_READINESS_HANDOFF_ROADMAP.md
+++ b/docs/PRODUCTION_READINESS_HANDOFF_ROADMAP.md
@@ -236,7 +236,7 @@ Goal: production data can be created, migrated, backed up, and debugged safely.
 
 - [x] **P9.1** Document Cosmos containers, partition keys, indexes, retention expectations, and backup/restore approach. Commit: `d897702`; Verified: `git diff --check`; `rg -n "Container Inventory|Index Expectations|Retention Expectations|Backup Approach|Restore Approach|COSMOS_DATA_OPERATIONS|note_intake_jobs|palace_diaries" docs/COSMOS_DATA_OPERATIONS.md docs/COSMOS_QUERY_REVIEW.md README.md`. Added `docs/COSMOS_DATA_OPERATIONS.md` covering all current `backend/src/lib/cosmos-init.ts` containers, partition keys, owner scope, index expectations, candidate composite indexes, retention/TTL expectations, Azure Cosmos backup mode guidance, restore sequencing, and release-time operational checks; linked it from README and `docs/COSMOS_QUERY_REVIEW.md`.
 - [x] **P9.2** Add seed/bootstrap strategy for built-in prompt templates, intake rules, default workspace, and feature flags. Commit: `efcc5fa`; Verified: `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; pnpm --filter @notelett/backend run typecheck'`; `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; pnpm --filter @notelett/backend exec vitest run src/lib/product-config.test.ts src/modules/note-prompts/note-prompts.test.ts src/modules/intake/routes.test.ts src/modules/workspaces/routes.integration.test.ts --reporter=verbose'`; `zsh -lc 'source ~/.zshrc; export GITEA_NPM_TOKEN; DB_PROVIDER=memory pnpm run seed:bootstrap'`; `git diff --check`. Added `pnpm run seed:bootstrap`, a backend bootstrap command that persists deterministic built-in prompt templates and intake rules through shared datastore/Cosmos initialization, documented production seed ordering, per-user onboarding workspace behavior, and feature-flag ownership in `docs/SEED_BOOTSTRAP_STRATEGY.md`, linked the strategy from README/release docs, and fixed backend product identity loading so sourced local env still seeds under `productId: "notelett"`.
-- [ ] **P9.3** Add migration plan for encrypted fields, schema changes, and backfills; reuse common platform migration scripts where practical. Commit:
+- [x] **P9.3** Add migration plan for encrypted fields, schema changes, and backfills; reuse common platform migration scripts where practical. Commit: `3b8fa29`; Verified: `git diff --check`; `rg -n "DATA_MIGRATION_AND_BACKFILL_PLAN|migrateDocuments|encrypt-migrate|Encrypted Field Backfill Map|FIELD_ENCRYPT_ENABLED|FIELD_ENCRYPT_KEY_PROVIDER=akv" docs README.md`. Added `docs/DATA_MIGRATION_AND_BACKFILL_PLAN.md` with the NoteLett encrypted-field backfill map, common-platform `@bytelyst/field-encrypt` `migrateDocuments()` reuse guidance, explicit note that the shared `encrypt-migrate.ts` NoteLett config currently covers only `notes.body`, dry-run/live command shape, schema-change sequencing, idempotent backfill operating rules, and rollback guidance; linked it from README, Cosmos operations, field-encryption coverage, and release docs, and corrected seed bootstrap env names to the actual `FIELD_ENCRYPT_*` settings.
 - [ ] **P9.4** Define telemetry event taxonomy and diagnostic breadcrumbs for notes, prompts, intake, reviews, mobile capture, and MCP actions. Commit:
 - [ ] **P9.5** Add operator runbook: incident triage, dependency outage behavior, stuck scheduler/webhook recovery, failed blob upload recovery, failed LLM/extraction recovery. Commit: