Exercise 1: Why the Report, Not the Exploitation Itself, Is the Real Deliverable — Possible Solution
====================================================================

WHY THE REPORT IS THE ACTUAL DELIVERABLE
------------------------------
Per this chapter, "the exploitation itself leaves no lasting artifact
— once testing ends, everything that happened during pentest1-4
through pentest1-8 only continues to exist for the client in one
form: the written report." The actual actions taken during testing —
a UNION query run, a script executed, a lateral move made — are
transient events. They happen, and then they're over; nothing about
having performed them persists on its own. The client cannot act on
"the tester successfully exploited a SQL injection point last
Tuesday" as a bare fact — they can only act on a written record of
what was found, how severe it is, and how to fix it.

WHAT HAPPENS TO AN UNDOCUMENTED CONFIRMED FINDING
------------------------------
Per this chapter, "a pentest that finds real, serious vulnerabilities
but produces a poor report has, in a real and practical sense, failed
to deliver the thing the client actually paid for." A vulnerability
that was genuinely confirmed via a real proof-of-concept (per
pentest1-7's own discipline) but never properly written up in the
report effectively CEASES TO EXIST from the client's perspective once
the engagement ends. The client has no way to know it was found, no
way to prioritize fixing it, and no record to act on — the technical
work of confirming it delivered zero actual value, despite being real
and correctly executed. The value of a finding isn't created by
discovering it; it's only realized once it's documented in a way the
client can act on.

THE UNDERLYING PRINCIPLE
------------------------------
This chapter's broader point — restated via its own connection to
pentest1-2's written scope document — is that the entire engagement
is bookended by written documents precisely because those are the
only two things that persist and are enforceable/actionable: the
scope agreement defines what's authorized before testing, and the
report defines what was found after it. Everything technical in
between only matters insofar as it's captured accurately in that
final document.

WHY THIS WORKS AS AN ANSWER
------------------------------
It explains specifically why exploitation itself is transient using
the chapter's own wording, and follows the logical consequence through
to its natural conclusion: an undocumented finding has effectively no
value to the client, regardless of how real or well-executed the
underlying testing was.