A security vulnerability has a code-level remediation and a project-level framing. The remediation is the diff that closes the primitive. The framing is the commit title, the PR body, the changelog entry, the release notes, the artifacts a downstream consumer sees before they see the diff. This pattern names the shape where the remediation is correct and complete, and the project's framing of its own patch describes it as hygiene: linter conformance, refactor pass, dependency bump, type tightening.
The commit message is motivated by the mechanical reason the maintainer touched the file (a lint rule firing, a type checker complaining, a refactor sweep) rather than the security reason the file needed to be touched. The CVE record exists; the researcher's advisory exists; the public PoC exists; none of them are referenced from the project's own disclosure channel. A downstream consumer whose patch cadence is "upgrade on security advisory" does not install the fix at the right urgency. A consumer whose cadence is "upgrade on linter adoption" does, by accident.
The remediation is in the repository. The fact that it is a remediation lives outside the repository, in the CVE record and the researcher's advisory.