[Maurice1969DB]

Notes only: a new notes/step-76-*.md and its row in the NOTES.md index. No code, no service/ or docs/ change.

Records the currency check of 2026-11-02:

• c2pa-node 0.9.11 (c2pa-rs 0.91.7, TLS roots after the eMudhra incident) is not taken. c2pa-node 0.9.8+: CallbackSigner no longer timestamps on signAsync contentauth/c2pa-js#244 is still open, and its fix (c2pa-js #251) is not merged. The trigger becomes the first c2pa-node release that contains #251.
• The weekly audit workflow had its npm audit (service) step red since 2026-10-26 while its runs read as success. Fixed in Service lockfile: body-parser 2.4.0, qs 6.17.1 #202 (body-parser 2.4.0, qs 6.17.1). minimatch is left, being only on the install path and movable only through an override.
• The transient PIE download failure on Service lockfile: body-parser 2.4.0, qs 6.17.1 #202's first run, and the re-run that told it apart from a broken download.
• Dependabot chore(service): bump express from 5.2.1 to 5.3.0 in /service #183 and chore(service): bump @contentauth/c2pa-node from 0.9.5 to 0.9.10 in /service #188 closed, with the reasons.