[JoshRob297]

Two documents that were measured but never published, plus a link from the coverage matrix.

PORTABILITY.md — the matrix behind "public PoC results vary by host": 17 measured cells on the same lab image, and what each one shows.

• memory_limit is not the gate — post_max_size is. At 512M/480 MB the chain runs the same because the body fits; at the default 8M the primitive never starts.
• On prefork, worker saturation is mandatory: 0/3 without holding the other children, 6/6 / 4/4 / 3/3 at 4 / 8 / 16 workers with N-1 held.
• A proxy has to stop buffering (3/3 off, 0/1 on), and KeepAlive On breaks the chain outright (0/5) — the cheapest mitigation on the list, and it is not in PHP.
• display_errors=Off blocks exactly one thing: the libphp leak. Primitive A and the chunk base survive.
• The withdrawn 15/15 cookie row is in the table with its 0/3 controlled repetition, so the correction is visible instead of implied.

TIMELINE.md — the disclosure from 11 Aug to today, public sources plus our lab dates, marked. It is what makes claims checkable: the release moved from the 22nd to the 21st because of the CVE leak, and Chainguard shipped the fix six hours early, which explains exploitation attempts without a validated public PoC.

Both in English and Spanish. No finding changes; the 9bie paragraph in the README now points at the matrix for the profile that was not reproduced here.