Function classify_origin 

pub fn classify_origin(covering: Option<Taint>) -> Origin

Classify a reflection’s origin from the taint covering its intervention.

Deterministic code over the transcript’s recorded taint — no model in the loop. None coverage — a torn transcript, or one recorded before taint was — fails closed to Untrusted.