Vulnerability closure needs verification

A ticket marked done is not evidence that a flaw is gone.

Patches fail to apply, services do not restart, a configuration reverts, the fix goes to the wrong environment. Closing on the basis of an intention rather than a check means the next scan reopens it, or worse, it does not because coverage moved. Verification is the difference between a remediation process and a ticketing process.