diff --git a/components/auth/GAPS.md b/components/auth/GAPS.md
index 93bda5d..16dfe9d 100644
--- a/components/auth/GAPS.md
+++ b/components/auth/GAPS.md
@@ -137,7 +137,7 @@ then #4–#5 alongside cutover, then #6–#7 as cleanup. Each extraction lands b
 source project before any consumer migrates. This stays consistent with the repos' loose coupling:
 adoption is opt-in per project, one consumer version-bump at a time.
 
-## Decisions still open
-- Shared dev base DN value (A3).
-- Whether constraints stay opaque `object?` or get a small `IConstraintPolicy` (shared-contract Q3). → #20
-- Shared JWT/refresh helper or not (#7). → #20
+## Decisions
+- Shared dev base DN value (A3) — done: `dc=zb,dc=local`.
+- Constraints stay opaque `object?`; no `IConstraintPolicy` (shared-contract Q3) — **parked** by owner decision 2026-11-09 until a second consumer asks. → #20 (closed)
+- No shared JWT/refresh helper (#7) — **parked** by owner decision 2026-11-09 until a second consumer asks. → #20 (closed)