Threat report in, validated STIX 2.1 bundle out. How procedures became a first-class object, why four human gates sit in the middle, and how the pipeline learns from every correction.