diff --git a/REFACTORING-AUDIT.md b/REFACTORING-AUDIT.md
index f8ef5f2..debd865 100644
--- a/REFACTORING-AUDIT.md
+++ b/REFACTORING-AUDIT.md
@@ -294,6 +294,7 @@ The current composition root is `cmd/serve.go`; `repository.System` aggregates P
 ### `A005` — authentication/JWT checkpoint
 
 - Extracted HTTP bearer-token normalization into `application/auth` and kept JWT verification/error mapping behavior unchanged; focused and full Auth tests pass in `1d72faa`.
+- Extracted refresh-token marker validation into `application/auth` while preserving refresh-flow behavior; full Auth tests pass in `4225332`.
 - A005 remains in progress: JWT validation, session checks, refresh-token flow, and broader authentication orchestration still need application ports and adapters.
 
 ### `I001` — publisher-backed ICO purchase map
diff --git a/REFACTORING-TODO.md b/REFACTORING-TODO.md
index 45a5718..618cb0c 100644
--- a/REFACTORING-TODO.md
+++ b/REFACTORING-TODO.md
@@ -298,3 +298,4 @@ Append one row whenever a task changes status. Existing rows are never rewritten
 | 2026-08-30 | A004 | `STARTED` | `STARTED` | Wired the OTP template repository port and infrastructure adapter into runtime composition and TFA processing; full Auth tests pass in `741415b`. |
 | 2026-08-30 | A004 | `STARTED` | `DONE` | Added thin gRPC registration adapters and routed Auth service registration through them; full Auth tests pass in `b56d54c`. |
 | 2026-08-30 | A005 | `TODO` | `STARTED` | Extracted bearer-token normalization into `application/auth`; full Auth tests pass in `1d72faa`. |
+| 2026-08-30 | A005 | `STARTED` | `STARTED` | Extracted refresh-token marker validation into `application/auth`; full Auth tests pass in `4225332`. |