Classify defects by both code trigger and operational activation
A defect's presence in source does not establish operational impact. For each finding, record the code predicate, environment and configuration gate, required data shape, and whether the affected workflow is currently reachable. Assign severity from the combined activation state,…