docs(m4.4): clear stale deferred/no-op markers for shipped features (relay, bundle-import audit, M5 redaction, audit drill-in, Transport CLI, traceability)

- SiteCallAudit/ServiceCollectionExtensions.cs: drop "still deferred" note on relay; point to SiteCallAuditActor where it lives
- Transport/Import/BundleImporter.cs: update "Only LoadAsync implemented" to reflect all three phases shipped
- SiteRuntime/Scripts/AuditingDbCommand.cs: replace two M5-deferred redaction comments with accurate references to AuditLogOptions.PerTargetOverrides
- SiteRuntime/Scripts/ScriptRuntimeContext.cs: replace "M5 will layer redaction" note with accurate description of shipped redactor
- CentralUI/AuditLogPage.razor.cs: replace "Bundle C wires… no-op seam" with accurate description of HandleRowSelected implementation
- docs/plans/2026-05-24-transport-design.md §13: update from "CLI Deferred / not built in v1" to reflect shipped BundleCommands.cs; update Open Questions entry
- docs/plans/2026-05-24-transport.md: convert Out-of-Scope "Do NOT build CLI" reminder to a factual note that it shipped
- docs/plans/2026-05-24-transport.md.tasks.json: flip all 30 tasks from pending → done (entire Transport feature shipped)

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Scripts/AuditingDbCommand.cs

@@ -463,8 +463,9 @@ internal sealed class AuditingDbCommand : DbCommand
         }
 
         // RequestSummary captures the SQL statement + parameter values by
-        // default per the alog.md M4 acceptance criteria (M5 will add
-        // per-connection redaction opt-in).
+        // default per the alog.md M4 acceptance criteria. Per-target SQL
+        // parameter redaction is configured via AuditLogOptions.PerTargetOverrides
+        // (RedactSqlParamsMatching) and applied at write time by the redactor.
         string? requestSummary = BuildRequestSummary();
 
         // Extra carries the op discriminator + row count per the vocabulary
@@ -509,7 +510,8 @@ internal sealed class AuditingDbCommand : DbCommand
     /// <summary>
     /// Compose a JSON request summary capturing the SQL statement and
     /// parameter values. Parameter values are captured by default per the
-    /// M4 acceptance criteria — redaction is opt-in and deferred to M5.
+    /// M4 acceptance criteria; per-target SQL-parameter redaction is applied
+    /// at write time via <c>AuditLogOptions.PerTargetOverrides.RedactSqlParamsMatching</c>.
     /// </summary>
     private string? BuildRequestSummary()
     {
@@ -520,8 +522,7 @@ internal sealed class AuditingDbCommand : DbCommand
         }
 
         // Hand-roll the JSON so we don't pull in System.Text.Json for a
-        // shape this small. Values are stringified with ToString() — fully
-        // structured serialisation arrives with the redaction work in M5.
+        // shape this small. Values are stringified with ToString().
         var sb = new System.Text.StringBuilder(sql.Length + 64);
         sb.Append("{\"sql\":");
         AppendJsonString(sb, sql);

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Scripts/ScriptRuntimeContext.cs

@@ -2013,8 +2013,9 @@ public class ScriptRuntimeContext
                 // null per Bundle B's pattern rather than fail the emission.
                 Guid? correlationId = Guid.TryParse(notificationId, out var parsed) ? parsed : (Guid?)null;
 
-                // M4 captures the request summary verbatim — {"subject": "...", "body": "..."}.
-                // M5 will layer redaction / payload-cap enforcement on top.
+                // Capture the request summary — {"subject": "...", "body": "..."}.
+                // Payload cap and per-target body redaction are applied at write
+                // time by the audit redactor (AuditLogOptions / PerTargetRedactionOverride).
                 var requestSummary = JsonSerializer.Serialize(new
                 {
                     subject = subject,