Now that the pipeline sees the whole estate, the numbers in the issue are
obsolete and the work decomposes. A hundred and fifteen critical findings in
running images have a fix version and are an update exercise. Sixty-eight have
none, concentrated on eight images, and each needs a decision with an expiry
rather than a patch. Sixty-two sit on three build artefacts that run nowhere and
are almost entirely unfixable — for those, remediation is the wrong answer; they
belong out of the registry or out of the target set.
Concentration matters for scoping: forty-one running images carry critical
findings, but nineteen of them carry eighty percent.
The pass is deliberately critical-first. Twenty-six hundred high findings in
running images are a category, not an undertaking, and saying so belongs in the
closeout rather than in a footnote.
Thore Cimbal
24ae5b9d2b