Answer prose round 1: 1 🔴, 4 🟡 (0 misread); correct the older changelog entries, keep each fact in one home, rewrap the Keto header

examples/plugins/auth-admin/admin-grants.test.ts

@@ -126,8 +126,6 @@ test("applyGrants sends the whole change as one Keto transaction, and a failure
   await assert.rejects(applyGrants(keto(true), userSubject("u1"), diff), /boom/);
 });
 
-// grantDiff never touches a held name nobody declares, so the picker lists them apart and offers a
-// Remove for each. A reader is told what is held but offered no button.
 test("buildPermissionPicker lists direct grants no plugin declares, with a remove action only for a writer", () => {
   const direct = ["zed:read", "users:read", "old:write"];
   const picker = buildPermissionPicker({ action: "/auth-admin/users/u1/permissions", declared, direct });

examples/plugins/auth-admin/views/partials/permission-picker.ejs

@@ -9,8 +9,6 @@
 
   Locals: csrfToken, permissions ({ action, baseline, choices, empty, error, field, hint, inheritedNote, legend, notice, pending, readOnly, submit, undeclared }).
 
-  `undeclared` lists direct grants of names no plugin declares, outside the form above because grantDiff
-  never revokes one. Each has its own Remove form, and a reader gets the names without the button.
 %>
   <section class="form-card" aria-labelledby="permissions-h">
     <h2 class="card-title" id="permissions-h"><%= permissions.legend %></h2>