diff --git a/REFACTORING-AUDIT.md b/REFACTORING-AUDIT.md
index 55f3a8c..f9946f7 100644
--- a/REFACTORING-AUDIT.md
+++ b/REFACTORING-AUDIT.md
@@ -278,6 +278,7 @@ The current composition root is `cmd/serve.go`; `repository.System` aggregates P
 - A003 remains in progress: PostgreSQL/Redis adapter ownership and use-case integration still need to move out of the legacy `repository/db` composition.
 - Added `auth/infrastructure/postgres` and `auth/infrastructure/redis` composition boundaries and switched `cmd/serve.go` to use them; the legacy adapters remain wrapped behind these boundaries pending per-repository port integration (`8ce3727`).
 - Added domain-port adapters for User, Identity, and Cache that translate legacy repository records at the infrastructure edge and satisfy `domain/ports`; mapping, full tests, and infrastructure vet pass in `7d9dd25`.
+- Added mappings and domain-port adapters for Session, Permission, Role, RolePermission, BankInfo, and OTPTemplate, completing the explicit persistence boundary coverage; full Auth tests pass in `e6e8e34`.
 
 ### `I001` — publisher-backed ICO purchase map
 
diff --git a/REFACTORING-TODO.md b/REFACTORING-TODO.md
index 6ba74b5..bfabac4 100644
--- a/REFACTORING-TODO.md
+++ b/REFACTORING-TODO.md
@@ -106,7 +106,7 @@ This is the authoritative execution tracker for the refactor. Work is performed
 |---|---|---|---|
 | A001 | `DONE` | Map every auth RPC to business operations and dependencies. | Method-level migration map is recorded in `REFACTORING-AUDIT.md`; completed on `2026-08-30`. |
 | A002 | `DONE` | Introduce auth domain entities, value objects, errors, and repository ports. | Added pure Auth entities/value objects, domain errors, and inward-facing repository/cache ports with no gRPC, GORM, Redis, or framework imports; committed as `32f182b`/`d292822`. |
-| A003 | `STARTED` | Move auth persistence and Redis implementations into infrastructure. | Explicit persistence/domain mappings are now established; remaining adapter relocation and repository integration are in progress. |
+| A003 | `STARTED` | Move auth persistence and Redis implementations into infrastructure. | Explicit mappings and domain-port adapters now cover users, identities, sessions, permissions, roles, role-permissions, bank information, OTP templates, and cache; legacy repository integration and ownership migration remain. |
 | A004 | `TODO` | Extract OTP application use cases and thin gRPC adapters. | OTP behavior and status mapping remain compatible. |
 | A005 | `TODO` | Extract authentication/JWT application use cases and adapters. | Token behavior, validation, and status mapping remain compatible. |
 | A006 | `TODO` | Extract identity and permission use cases and adapters. | Public and internal authorization services pass tests. |
@@ -288,3 +288,4 @@ Append one row whenever a task changes status. Existing rows are never rewritten
 | 2026-08-30 | A002 | `TODO` | `STARTED` | Began the pure Auth domain model and port foundation. |
 | 2026-08-30 | A002 | `STARTED` | `DONE` | Added transport/persistence-independent entities, NationalID/Mobile/BirthDate value objects, domain errors, and repository/cache ports; focused and full Auth tests pass in `32f182b`/`d292822`. |
 | 2026-08-30 | A003 | `TODO` | `STARTED` | Added infrastructure persistence mappings between legacy database records and the new Auth domain entities; mapping tests and full Auth tests pass in `58f6a43`. |
+| 2026-08-30 | A003 | `STARTED` | `STARTED` | Added remaining persistence mappings and domain-port adapters for sessions, permissions, roles, role-permissions, bank information, and OTP templates; full Auth tests pass in `e6e8e34`. Legacy repository implementations still require relocation/integration. |