test(browser): isolate and await the real zoom extension

docs/pre-phase10-ux/DEPENDENCY_AUDIT.md

@@ -0,0 +1,11 @@
+# Dependency advisory addendum
+
+29 October 2026. Evidence is point-in-time and separate from the sealed source-diff scan.
+
+The solution-wide transitive NuGet audit completed using the installed .NET 9 SDK. It reports one distinct moderate advisory, repeated for the API and its unit-test consumer: inherited `MySqlConnector` 2.4.0, [GHSA-473q-m89c-ghf8](https://github.com/advisories/GHSA-473q-m89c-ghf8). The advisory affects versions before 2.6.1 when `VerifyCA`/`VerifyFull` is used without a configured CA and authentication can send a password before certificate verification. Its stated workarounds include a configured CA or a local connection. This is an existing dependency, not introduced by the A/B/C/D changes.
+
+Evidence: `.artifacts/pre-phase10-ux/integration-nuget-audit-02.json`. The first invocation used an unsupported SDK option and performed no audit; that retained attempt is `integration-nuget-audit-01.json`. Neither file is relabelled as a clean dependency result.
+
+The isolated MariaDB lane explicitly uses loopback with `SslMode=None`; it does not test this TLS mode or establish deployed TLS safety. Production configuration and services were not inspected or changed. Required release-owner action: establish whether deployed connection/authentication settings meet the advisory preconditions, then qualify an upgraded connector or enforce an appropriate trusted CA before production acceptance. Any driver change must independently rerun real MariaDB migration, transactions and RD21 tests; it is not bundled into a running frozen UX regression.
+
+Other recorded audits: production npm has zero known advisories; full npm retains five low-severity development-tool entries. The 48-dependency Python import lock has zero reported known vulnerabilities. Source and artifacts for these checks are in `.artifacts/pre-phase10-ux/integration-independent-01/`. These results do not prove absence of unknown vulnerabilities, qualify parser fuzzing or close production infrastructure/model/cache debt. Security/privacy remains CONDITIONAL and production NO-GO.

docs/pre-phase10-ux/D_ADDENDUM_ACCEPTANCE.md

@@ -30,6 +30,8 @@ The initial zoom recovery run passed both admin cases but was stopped while wait
 
 ## Scope and gates
 
+Later integration replay found a remaining zoom-extension lifecycle race after the first four-case pass. The original `integration-03/` attempt was stopped and remains incomplete; its runtime hashes stayed unchanged and its test-source change is explicit. A direct trace records the worker closing before evaluation. The final test harness verifies the generated worker has executed before installing its network guard, permits only that exact local worker URL in addition to its original local routes, and uses short owned temporary paths with cleanup. `zoom-lifecycle-04.json` records all six repeated EN/light and NB/dark real-zoom cases passing with retries disabled. The interrupted `zoom-lifecycle-03` attempt remains partial. No application or geometry assertion changed.
+
 The sealed security scan through `d52403d` does not include this later delta. Its bounded filters, rate policy, failure-event query and UI were reviewed separately; no new security blocker was identified. This is source review, not a new sealed scan or production acceptance.
 
 Full cumulative ordinary/specialized browser, final Docling, PDF fidelity, source/runtime closure and local C/D activation remain pending. Historical PDF coordinate-oracle failures, human/device/language/print checks, real AI extraction qualification and production infrastructure debt remain open. No production operation, main merge, deployment or Phase 10 cleanup occurred.