Scanners publish verdicts nobody fixes. A compliance-style reading of SecOps: one owned queue, proportionate deadlines and exceptions that expire.