"After the plan" of docs/security-audit-2026-10-17.md: security.md's history paragraph names A2 and the seven mediums and what closed them; the roadmap gets the row security-audit-2026-10-17 (26 of 29 plan lines; stage H is the owner's host, S4 in progress) and two proposed rows the audit left as product choices: upstream-tls-verify (M7's optional "secure") and server-dmarc-hint (S3's product side). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>