Severity threshold lookups no longer require two feature checks to pass before consulting per-site severity config
What
The function that computes per-key/per-site severity thresholds (referred to as t1/t2, also dht) used to require both an internal _1() and On() check to pass before it would consult the severityBySite config, otherwise falling back to a default. That early gate has been removed: the function now reads the site's severity config unconditionally (still honoring an explicit "off"), regardless of those two checks.
Why Means severity thresholds configured per site now always take effect rather than being silently skipped when the two gate checks didn't both pass.
The finding does not say what user-visible effect, if any, this has since the explicit off case is still respected.