@@ -57,8 +57,8 @@ offsets-only entry. All `yes` rows use the lab configuration: Apache prefork
 `session.upload_progress=On`. Per-image offsets and `libphp` sha256 are in
 [the offset inventory](docs/offset-inventory.md). The 8.4.25 profile needs the
 default retries because its stage 3 is probabilistic. The 8.4.26 deb13/apxs2
-row is a **contributor-reported source build**, not an official image: its
-stage-3 phase is instance-dependent (the contributor reported 4/4 runs on one Apache master and
+row is a **contributor-reported, not independently confirmed source build**,
+not an official image: its stage-3 phase is instance-dependent (the contributor reported 4/4 runs on one Apache master and
 0/5+ on others), so treat `rce: true` as “reproduced on the reporter's lab” and
 retry on a fresh worker/master. Because two 8.4.26 amd64 profiles exist, the
 dispatcher requires `--profile deb13-apxs2` for this build.
 
@@ -1,7 +1,7 @@
 # PHP 8.4.26 Debian 13 / apxs2 calibration
 
-Status: **contributor-reported**, not independently reproduced by the
-maintainers as of 2026-10-30.
+Status: **contributor-reported, not independently confirmed** by the
+maintainer as of 2026-10-30.
 
 ## Environment
 
 
@@ -79,7 +79,7 @@
   "measured": {
     "chunk_base": "0x7fbcf4200000"
   },
-  "status": "contributor-reported — RCE verified on a source-built Debian 13 lab (apxs2, Apache 2.4.69 prefork, 1 worker): uid=33(www-data) 4/4 runs through the vendor engine with this profile's parameters; stages 1-2 dispatch cleanly on every attempt. Stage-3 phase is instance-dependent (after an apache restart, a fresh master may not reclaim; retry on a new instance) and the layout differs from the docker 8.4.26 image (different toolchain): third stage-3 layout with a K=5 bin-32 phase shift. Each (4,4) pad allocates the session reference at the k-th bin-32 slot, shifting the fake-reference slot linearly, R0 = chunk+0x2260+0x60*K (gdb watchpoint sweep 0..16); K=5 places the bin-56 reclaim slot so the 31-byte fake reference is written whole (chars at R0, framing differs from the upstream 55-byte carrier whose chars land at R0+8). Stage-3 request 1 carries a PHPSESSID cookie and five 5-char/1-byte fill fields; request 2 reclaims with 15x 167-byte fake hashtables then 12x 31-byte fake references, all with 3-char field names. Command proof read out-of-band from /tmp inside the apache mount namespace (PrivateTmp; nsenter).",
+  "status": "contributor-reported, not independently confirmed — RCE verified on a source-built Debian 13 lab (apxs2, Apache 2.4.69 prefork, 1 worker): uid=33(www-data) 4/4 runs through the vendor engine with this profile's parameters; stages 1-2 dispatch cleanly on every attempt. Stage-3 phase is instance-dependent (after an apache restart, a fresh master may not reclaim; retry on a new instance) and the layout differs from the docker 8.4.26 image (different toolchain): third stage-3 layout with a K=5 bin-32 phase shift. Each (4,4) pad allocates the session reference at the k-th bin-32 slot, shifting the fake-reference slot linearly, R0 = chunk+0x2260+0x60*K (gdb watchpoint sweep 0..16); K=5 places the bin-56 reclaim slot so the 31-byte fake reference is written whole (chars at R0, framing differs from the upstream 55-byte carrier whose chars land at R0+8). Stage-3 request 1 carries a PHPSESSID cookie and five 5-char/1-byte fill fields; request 2 reclaims with 15x 167-byte fake hashtables then 12x 31-byte fake references, all with 3-char field names. Command proof read out-of-band from /tmp inside the apache mount namespace (PrivateTmp; nsenter).",
   "oom_mb": 12,
   "oom_margin_mb": 12,
   "memory_limit_tested_mb": [