diff --git a/docs/roadmap/audit/catalog.md b/docs/roadmap/audit/catalog.md
index 7310c0f..087d123 100644
--- a/docs/roadmap/audit/catalog.md
+++ b/docs/roadmap/audit/catalog.md
@@ -22,7 +22,11 @@ and conditional certificate-trust exposure. Use a patched maintainer toolchain
 and repeat the focused security assessment against it. Actual downstream
 exposure depends on the toolchain that builds the consumer and its transport
 and trust configuration; raising PromptKit's minimum Go requirement is a
-separate compatibility decision, not an implied remedy.
+separate compatibility concern, not an implied remedy.
+[Decision 5](#decision-5-consumer-go-minimum-after-the-toolchain-update) reaffirms
+independent maintainer-toolchain selection and the initial-release consumer
+minimum. Advising consumers about generally applicable Go vulnerabilities is
+outside PromptKit's responsibility.
 
 Sources: [Security 1](07-security.md#1-the-audited-go-toolchain-predates-applicable-networking-security-fixes).
 
@@ -593,37 +597,46 @@ ConfigKit's deferred rejection of unsupported inputs. Remove obsolete adapter
 code and tests. Preserve distinct runtime JSON-copying behavior. This is a
 deliberate compatibility change; this record does not itself implement it.
 
-## Open Decisions
-
-Work through the remaining decisions below in order, retaining their original
-numbers. These are unresolved choices, not additional findings or approved
-changes to public contracts. A decision blocks its dependent remediation, not
-unrelated fixes. In particular, updating the maintainer toolchain need not wait
-for the consumer-minimum decision. Implementation details and optional cleanup
-do not become release gates merely by appearing in this catalog.
-
 ### Decision 5: Consumer Go Minimum After The Toolchain Update
 
 **Related finding:** [1](#1-update-the-audited-maintainer-toolchain-for-applicable-security-fixes).
 
-**Question:** Should the security fixes also change PromptKit's declared minimum
-consumer Go version?
+**Status:** Accepted; maintainer-toolchain remediation pending.
 
-**Recommendation:** Update the maintainer toolchain and repeat the focused
-assessment promptly; initially keep the consumer minimum decision separate.
-Advise affected consumers to rebuild with a patched toolchain. This recognizes
-that PromptKit publishes source and that downstream build/transport choices
-control the deployed exposure.
+**Decision:** Select the maintainer toolchain independently of the consumer Go
+minimum. Always use the latest locally available Go version for PromptKit builds
+and tests, including ordinary development and release validation. Update the
+local installation as needed to address the audit findings; local availability
+alone does not establish that those fixes are present.
 
-**Alternative:** Raise the declared minimum to the selected patched release.
-This makes the supported floor clearer and steers module consumers toward the
-fixed toolchain, but changes compatibility and does not repair already-built
-applications. Assess it under the existing release policy rather than treating
-it as an automatic consequence of the scanner output.
+Normally set the consumer minimum to the initial stable release (`1.x.0`) of
+the current selected series. Advance series in minor releases; preserve the
+minimum in patch releases. Retain the existing exception for a dependency or
+identified correctness requirement that needs a higher patch minimum. This
+reaffirms the [release policy](../../policy/release.md#consumer-minimum-and-release-toolchain)
+and [release procedure](../../release.md#prepare-the-candidate), extending the
+latest-local-toolchain instruction explicitly to ordinary builds and tests.
 
-**Resolve before changing the minimum:** Confirm current advisory applicability,
-select the patched version, and decide whether changing the supported consumer
-floor is justified. No new recurring release gate is implied.
+Advising consumers to update Go for generally applicable vulnerabilities is not
+PromptKit's responsibility. Do not add consumer advisories, upgrade notices, or
+an ongoing vulnerability-notification obligation for those issues to this
+remediation. Downstream toolchain maintenance belongs to the consuming project.
+
+**Alternative considered:** Raising the consumer patch minimum as a routine
+response to general Go security advisories would conflate library compatibility
+with downstream toolchain maintenance. That approach is not selected.
+
+**Remediation follow-through:** Use the selected local toolchain for the focused
+reassessment and clarify ordinary development toolchain selection in contributor
+guidance. No new recurring release gate or general consumer security advisory
+work is introduced. This record does not itself update the installed toolchain.
+
+## Open Decisions
+
+The remaining decision below retains its original number. It is an unresolved
+choice, not an additional finding or approved contract change. It blocks only
+its dependent remediation. Implementation details and optional cleanup do not
+become release gates merely by appearing in this catalog.
 
 ### Decision 6: Retention Of The Legacy Capacity Client Wrapper