build(site): [SITE-07] checkpoint frozen vendor notices and open lifecycle evidence

refactor/risks.json

@@ -618,10 +618,14 @@
         "refactor/third-party.json",
         "docs/assets/js/vs",
         "refactor/site-inventory.md",
-        "refactor/baselines/site-provenance.json"
+        "refactor/baselines/site-provenance.json",
+        "refactor/changes/2026-09-14-SITE-07-vendor-notices.md",
+        "refactor/baselines/site-notices-checkpoint.json",
+        "scripts/site-vendor/manifest.json"
       ],
       "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
-      "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+      "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。",
+      "workspaceState": "Monaco 0.30.1 runtime fingerprints and complete upstream LICENSE/ThirdPartyNotices now ship with the site; all three desktop TypeScript worker cases pass. Closure review found no Codicons entry in those notices, while the separate Microsoft Codicons source distinguishes content CC-BY-4.0 from code MIT. Exact bundled codicon.ttf version and attribution mapping remain to verify; do not infer full font clearance from Monaco MIT."
     },
     {
       "id": "VENDOR-07",
@@ -636,10 +640,14 @@
         "refactor/third-party.json",
         "docs/assets/js/vconsole.min.js",
         "refactor/site-inventory.md",
-        "refactor/baselines/site-provenance.json"
+        "refactor/baselines/site-provenance.json",
+        "refactor/changes/2026-09-14-SITE-07-vendor-notices.md",
+        "refactor/baselines/site-notices-checkpoint.json",
+        "scripts/site-vendor/manifest.json"
       ],
       "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
-      "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+      "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。",
+      "workspaceState": "Upstream 3.15.0 LICENSE copied verbatim but contains only the MIT declaration and a promise of a license copy; actual MIT body is absent. Completeness and bundled dependency notices remain open; mobile WebKit destruction also produces a log-store update page error."
     },
     {
       "id": "VENDOR-08",
@@ -6158,6 +6166,25 @@
         "test/performance-report.test.js"
       ],
       "resolutionRationale": "The fix enforces an existing observation requirement rather than rounding failed values or relaxing a gate. Exact reverse-adaptation tests preserve the frozen body, deterministic clock tests cover early/overshooting/error paths, and the same installed candidate passes the full native paired protocol in all three engines. Performance review signals remain separate."
+    },
+    {
+      "id": "VCONSOLE-LIFECYCLE-01",
+      "title": "vConsole 3.15.0 mobile destruction can leave a callback updating a removed log store",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "SITE-07",
+        "SITE-05"
+      ],
+      "evidence": [
+        "refactor/changes/2026-09-14-SITE-07-vendor-notices.md",
+        "refactor/baselines/site-notices-checkpoint.json",
+        "scripts/site-vendor/manifest.json",
+        "test/browser/site-vendor.spec.js"
+      ],
+      "compatibleResolution": "Reproduce the exact delayed callback from fixed upstream source and preserve logging/global/CSS behavior while preventing work on a removed store; do not remove destruction checks or catch page errors to pass.",
+      "closureCriteria": "A deterministic old-build failure and fixed native three-engine logging/destruction checks with no late errors, plus maintainable source/build provenance and required notices.",
+      "workspaceState": "First native check: desktop worker 3/3 and mobile Chromium/Firefox pass; WebKit mobile page fails with undefined is not an object (evaluating s.O.get(n).update) after destruction. Upstream log model schedules RAF and reads Store.get(id).update while unbindPlugin deletes the store; exact causal callback remains to isolate."
     }
   ]
 }