Clarify receipt scope and distinguish snapshot revisions from CI audits

Author: CompleteDotTech

docs/CHECKER_STATUS.md

@@ -204,7 +204,7 @@ are repository build/test evidence only. No live targets were scanned.
 
 ## Future delivery procedure
 
-Implement future parsers in its exploit-specific destination, preserving
+Implement each future parser in its exploit-specific destination, preserving
 its existing result semantics, input bounds, standalone distribution and
 publication protections. Original issues remain the acceptance authority.
 Update the parent only after destination changes, meaningful synthetic tests,

docs/EDGE_ADVISORY_MATRIX.md

@@ -6,7 +6,7 @@ per-device rule evidence; flag names vary below. No combined edge scanner is
 introduced. The first two NetScaler checkers already carry separately dated
 CISA-ADP KEV and vendor exploitation metadata. The remaining explicit KEV-field
 updates are merged in separate Copilot-reviewed PRs. All actual merge-commit
-CI jobs passed; [delivery receipts](CHECKER_STATUS.md#actual-merge-commit-ci-receipts)
+CI jobs for those 15 updated checkers passed; [delivery receipts](CHECKER_STATUS.md#actual-merge-commit-ci-receipts)
 record their exact commits.
 
 CISA's official [kev-data mirror](https://github.com/cisagov/kev-data) confirms
@@ -46,7 +46,9 @@ remain uncertain under each checker's rules. Missing versions normally remain
 unknown. One explicit exception is BeyondTrust's operator-declared SaaS deployment
 with `custom_build=false`: its pinned checker can report `fixed_version_reported`
 without a version, using `operator_unverified` confidence. This is an unverified
-provider-managed deployment claim, not patch attestation or a safety guarantee. Optional network mode is omitted because passive
+provider-managed deployment claim, not patch attestation or a safety guarantee.
+
+Optional network mode is omitted because passive
 responses cannot establish firmware patch/configuration state; no network mode
 is needed to satisfy this offline delivery.
 

docs/NODE_ADVISORY_MATRIX.md

@@ -11,9 +11,13 @@ as incomplete fixes are not silently treated as separate new July/October entrie
 The table records the **existing embedded snapshots**, not new thresholds or
 independently verified deployments. Each pinned snapshot contains the exact
 preconditions, lifecycle/branch exclusions, sources, caveats and its earlier
-verification date. Each destination's audited default-branch commit passed hosted
-CI; receipts are in [CHECKER_STATUS.md](CHECKER_STATUS.md). No runtime, website or
-production deployment was assessed for this matrix.
+verification date. The 20 additional Node checkers' audited default-branch CI
+receipts are in the historical initial-audit table in
+[CHECKER_STATUS.md](CHECKER_STATUS.md#exact-hosted-receipts). Those audited CI
+revisions are distinct from the older pinned snapshot revisions below; this
+matrix does not claim a CI run on each snapshot commit. The newer Node2Shell
+and OCI delivery receipts are in its current merge-commit table. No runtime,
+website or production deployment was assessed for this matrix.
 
 | CVE / checker | Reported fixes by covered major | Pinned evidence contract and preconditions |
 | --- | --- | --- |