docs: deep-audit wave dispositions in LOTUS_BUGS

Dep triage recorded (zero shipped exposure; SDK now 41.7.0 stable; dompurify
removed); Needs Verification rows for the audit-wave fixes (scheduled-cancel,
emoji lazy-load, SW precache, desktop CSP smoke).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

LOTUS_BUGS.md

@@ -37,6 +37,10 @@ Implemented and gate-green; confirm each per `LOTUS_TESTING.md`, then delete the
 | P4-8 | Encrypted-search cache (opt-in toggle, clear button, logout wipe)                      | `utils/searchCache.ts`, message-search               | enable in search panel → search → reload → coverage persists; logout wipes        |
 | N97a | Session blob migration + cross-tab logout sync                                        | `state/sessions.ts`, `useSessionSync`                | login on old build → new build migrates; logout in tab A → tab B drops to auth    |
 | P4-1 | Slack-style thread notifications (participating default, All/Mentions/Mute, badge math) | `utils/threadNotifications.ts`, `ClientNonUIFeatures`, `roomToUnread` | 6-step checklist in LOTUS_TODO §P4-1                                              |
+| AW-1 | Scheduled-message cancel no longer ghost-sends (error row on failure)                  | `ScheduledMessagesTray.tsx`                          | schedule → cancel with network cut → item stays + error; retry works              |
+| AW-2 | Emoji lazy-load (search/autocomplete/recents fill in; board opens fast)               | `plugins/emoji.ts` + consumers                       | first emoji-board open of a session: grid+search populate; reactions still label  |
+| AW-3 | SW precache (repeat-visit near-instant; deploys still picked up immediately)          | `sw.ts`, `vite.config.js`                            | load app twice (2nd = cached assets); deploy → reload picks new version           |
+| AW-4 | Desktop CSP tighten + Escape/panel fixes + thread Jump to Latest                      | `tauri.conf.json`, Room/ThreadPanel                  | desktop: boots, avatars/media load, VT323 font renders, location maps embed, calls connect, deep links work |
 
 **Verified working in live testing (2026-06):** A2, B1–B4, C1, C3, D (mic/camera/deafen/screenshare/fullscreen/more-menu/PiP). Denoise quality in D is still poor — tracked under the denoise project, not a regression.
 
@@ -146,7 +150,7 @@ retry … AbortError: Restart delayed event timed out before the HS responded`,
 
 ### Dependencies & Build
 
-- **`matrix-js-sdk` pinned to a Release Candidate** (`41.6.0-rc.0`); `@atlaskit` and build tools (`vite`, `typescript`, `eslint`) on unstable/experimental pins — review for stable versions; RC SDK is a tree-shaking/bundle-size risk.
+- ~~**`matrix-js-sdk` pinned to a Release Candidate**~~ — **done (2026-07):** moved to `41.7.0` stable (crypto-wasm 18.3.1 security bump). Deep-audit dep triage: all 16 npm advisories are dev-only/unreachable/dead-dep — zero shipped exposure; dead `dompurify` removed. `@atlaskit`/build-tool pins remain review-worthy but low priority.
 - **Build-time overhead:** `lotusDenoise` does heavy sequential `fs` work in `closeBundle`; `viteStaticCopy` config is complex with redundant renames — could be streamlined.
 
 ### Code Hygiene / DevEx