The plan doc records post-plan changes in its As-built deltas section; the
follow-up audit's four findings (integrated byte accounting, the VERIFY-4
transcode grace, the operator kill-list API with unrevoke, and the previously
unguarded Audiobookshelf byte routes) belong there so the intent doc and the
as-built matrix agree. Also restates what stays deferred.
Part of the stream monitoring & kill-switch epic.