review-severitylisted

# Review Severity Every reviewer tiers findings on one model, so a finding lands the same tier whoever raises it. A tier is **earned** by a named consequence plus a reachable path -- not by unease, vividness, or how easy it is to fix. ## The spine **Severity = consequence-if-shipped = impact x reachability.** Confidence is *not* part of it (separate gate, below). - **Impact** = KIND (corruption / breach / crash / wrong-result / disclosure) x MAGNITUDE (damage per occurrence) x TIME-HORIZON (irreversibility is just long-horizon impact). - **Reachability** = P(path reached) x P(trigger), classed **live / edge / dead**. Judge it at the **trust boundary** -- a public/exported API or persisted state is a live entry point even with no in-repo caller; a *missing or weakened* control on a boundary (authz, rate-limit, crypto strength, secure default) defaults **live**, its impact being the breach it fails to prevent. And at **intended-completion** for a diff -- a named wiring/flag/call path is *pending-live*; only *provably* unwired code is dead. "I couldn't find the caller" is not dead. ## Tiers (directives) - **Critical -- never ship / regenerate.** On a reachable path the code misbehaves or is unsafe above the magnitude floor: data loss/corruption (including *silent*), security breach, crash/hang/resource-exhaustion, won't build-or-run, broken reference, or a wrong result users/callers/downstream act on ("behaves right" means correct *output*, not merely