Record the PHP-does-blacklist finding, the accepted Go 401 after logout, and the 22-ported corpus so later phases do not revive the harness artifact. Co-authored-by: Cursor <cursoragent@cursor.com>