The document is in the queue, screened and waiting. Model Armor sees it before any extractor does — the screen sits in front of the model, not after it, so a document carrying instructions never gets the chance to be persuasive.
The fleet read it on one of its hourly runs. That run is the same Cloud Run job you could trigger by hand: the dashboard has no Vertex access of its own and can only ask the job to start.