The portal's SHORTFALL_REMEDIATED constant now carries only the OC charge
reference (de-PII'd from the public member-portal repo); the member
identity and the timeline of the manual reset live here, keyed on the
charge, plus the rationale for charging-keyed exclusion.
The write-up has sat on incident/2026-10-02-gateway-cve-upgrade since the
outage and that branch is now far behind main. This lifts just the incident
text and the CVE note into incidents/, attributed to InferenceBot with the
substance unchanged, and links it from infrastructure.md under a new
Incident log section.