[sarthakagrawal927]

Self-reported external drill completion was earning unverified learning credit: concept mastery, roadmap ELO, review-question scheduling, and clearing deliberately suspended review items. The change keeps the solved activity/status record but gates all those mastery-related effects on the existing verification path. Automated verification still earns mastery, ELO, and normal review behavior.

The CI dependency gate also reported three new high advisories. This PR updates the existing Zod and Undici overrides to their patched same-major versions and moves the dev-only Happy DOM test environment to 21.0.4, the first patched version. No audit allowlist changes or new dependencies are included.

Validation: focused BuildLab tests pass (12 tests), pnpm typecheck passes, Biome check passes on changed files, and git diff --check passes. The updated frozen lockfile install succeeded; a read-only audit now reports 0 high/critical advisories (17 moderate/low). The push hook checked all 532 files successfully. Full exact-head CI is running.

This fixes the concrete unverified-credit defect. It does not establish the issue's delayed, no-hint transfer outcome: current aggregate progress records do not capture hint/answer exposure or a no-hint transfer result, and this PR does not claim that outcome.

[sarthakagrawal927]

Independent final review: PASS+NOTES at edcfa86. The functional patch was independently reviewed in CodeVetter/Claude and its 12 BuildLab tests passed: all four mastery effects require verification while solved activity and saved progress remain. The final dependency-only update received a separate Claude review with no findings; the persistence target passed under the patched dependency graph. The Zod override is confined to v4, Undici stays same-major, and Happy DOM is dev-only. Exact-head CI is green. Low sign-in copy advisory is non-blocking because the existing Feynman nudge distinguishes signed-out users. No delayed transfer-learning outcome is claimed.