{
  "entrypoint_kind": "function_call",
  "entrypoint_detail": "Alternate data paths (nested Map, List, Object[], non-List Collection, custom Number, BigInteger-overflow, StringBuilderFormattable) into MapMessage.getFormattedMessage([\"JSON\"]) -> MapMessageJsonFormatter.format",
  "service_started": false,
  "healthcheck_passed": false,
  "target_path_reached": true,
  "runtime_stack": ["openjdk-17", "log4j-api-2.25.4-vulnerable", "log4j-api-2.25.5-fixed", "log4j-api-2.26.0-vulnerable", "log4j-api-2.26.1-fixed", "gson-2.11.0"],
  "proof_artifacts": ["logs/vuln_variant/variant_2.25.4.log","logs/vuln_variant/variant_2.25.5.log","logs/vuln_variant/variant_2.26.0.log","logs/vuln_variant/variant_2.26.1.log","logs/vuln_variant/compile.log"],
  "variant_outcome": "no_bypass_alternate_triggers_on_vulnerable",
  "bypass_confirmed": false,
  "version_results": {
    "2.25.4": {"status": "VULNERABLE", "bare": 17, "quoted": 1, "parseFail": 17},
    "2.25.5": {"status": "FIXED", "bare": 0, "quoted": 18, "parseFail": 0},
    "2.26.0": {"status": "VULNERABLE", "bare": 17, "quoted": 1, "parseFail": 17},
    "2.26.1": {"status": "FIXED", "bare": 0, "quoted": 18, "parseFail": 0}
  },
  "notes": "Variant harness exercises alternate data paths into MapMessageJsonFormatter not covered by the original repro. BYPASS=false: a fixed version (2.25.5/2.26.1) still emitting bare non-finite tokens on any alternate path would be a bypass."
}