From merged fixes to verified remediation: evaluating production evidence across Drupal website fleets

Research preprint, version 0.1. Not peer reviewed.Security maintenance produces several kinds of evidence: a dependency update in a repository, a deployment outcome, an installed-package observation and a later advisory assessment. These records concern different objects and times. Treating them as interchangeable can produce unsupported conclusions about which production sites were remediated by a deadline. This paper specifies a narrow reporting problem for website fleets: determining whether every in-scope runtime was fixed for a particular advisory at a defined deadline, using evidence received by a later reporting cutoff. We separate that condition from first remediation time, present status and complete contractual compliance. A conservative evidence model returns fixed, affected or unverified, retaining uncertainty when identity, temporal coverage, runtime scope or advisory interpretation is insufficient. An indistinguishability example demonstrates why snapshots before and after a deadline cannot resolve an unobserved rollback at the deadline. We implement a deterministic benchmark that crosses deployment scenarios with reporting intervals, sampling phases, missing reports, delivery delays and availability of complete runtime-change evidence. Across 12,384 configurations and 74,304 method decisions, the conservative snapshot-only rule classified 168 configurations, while adding complete runtime histories classified 3,180; neither produced an incorrect classification within the model. A scoped six-hour-freshness heuristic produced 108 false-fixed classifications, all associated with rollback before the deadline. The results describe the constructed benchmark, not the prevalence of failures in deployed Drupal fleets. Sentinel Connector supplies the motivating operational context; the tested reconciliation logic is an independent research prototype. The contribution is a precise, reproducible treatment of temporal and scope uncertainty that can support future field evaluation of fleet patching evidence.The PDF includes the manuscript and reproducibility appendix. The companion ZIP contains benchmark v1.2.0, all synthetic evidence and results, figure sources, run instructions and SHA-256 manifests. All deployment histories are synthetic. No Drupal deployment, customer dataset or commercial service was tested.Competing interests: I am affiliated with TrueCMS / Sentinel Connector and have a commercial interest in Sentinel Connector. Funding: No external funding.Research assistance: Generative AI tools assisted source discovery, manuscript preparation, code generation and implementation review. Numerical results were computed by executing the supplied deterministic program. I take responsibility for all contents.Licensing: Manuscript, appendix, figures and synthetic data: CC BY 4.0. Python source: MIT. See RIGHTS.md and LICENSE-MIT.txt in the archive. Cited works retain their own terms.The prototype validates contradictions within the evidence used for a decision; it is not a whole-bundle consistency validator. The paper makes no claim of field validation, peer review, journal acceptance or arXiv publication.