feat(reports): the model's own suspicion band is a proposal too

contributor-scan 2.17, completing Req 5.5.

Task 2.11 made static pattern matches proportionate and left the model
layer's own suspicions alone, reasoning that a proposer had reasoned about
them. That does not survive inspection. A model suspicion is what the
enumerator proposed at a site the graph could NOT decide, affirmed by a
judge with no coverage there -- and its own rationale says exactly that:
"the model resolved no flow here; its sink table may not cover this API".
It is a pattern match with an opinion attached, and it reads like a
reasoned claim only because a model produced it.

  vampi    60 findings, 61 sections -> 26, report 1085 lines -> 446
  libpng   198 findings, 39 sections -> 30

**What it costs, which is the number that decides whether the rule is
right.** For each known vulnerability the recipe declares, take every
finding row at its location and ask whether any survives the rule. All
three of vampi's -- the SQL injection and both documented BOLAs -- are
still found at model_entailed and all three survive. Nothing known is
hidden. Three vulnerabilities in one repository is also a statement about
how small the evidence base is, and the artifact says so.

The obligations checker sits at `suspicion` too and is NOT grouped: its
output comes from a structural analysis, an obligated operation with no
discharging guard, rather than from a guess. An earlier attempt at this
rule filtered on rung alone and would have collapsed it; six tests failed
and they were right to.

"Pattern matches" is now "Proposed, not corroborated", since it holds two
shapes. Model rows group by FAMILY rather than by rule, because their rule
is always `model`.

Gates byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/measurements/2026-09-09-report-proportionality-model-band.json

@@ -0,0 +1,25 @@
+{
+  "generated": "2026-09-09",
+  "measured": {
+    "libpng": {
+      "findings": 198,
+      "sections_after_2_11": 39,
+      "sections_after_2_17": 30
+    },
+    "vampi": {
+      "findings": 60,
+      "report_lines": "1085 -> 446",
+      "sections_after": 26,
+      "sections_before": 61
+    }
+  },
+  "reading": "Task 2.11 made static pattern matches proportionate and left the model layer's own suspicions alone, on the reasoning that a proposer had reasoned about them. That reasoning does not survive inspection: a model suspicion is what the enumerator proposed at a site the graph could NOT decide, affirmed by a judge with no coverage there. Its own rationale says so -- 'the model resolved no flow here; its sink table may not cover this API'. It is a pattern match with an opinion attached, and it reads like a reasoned claim only because a model produced it.",
+  "spec": "contributor-scan 2.17 (Req 5.5) -- the model's own suspicion band",
+  "the_section_renamed": "'Pattern matches' became 'Proposed, not corroborated', because it now holds two shapes: a static pattern saying an API is present, and a candidate the model could not decide. Model rows group by FAMILY rather than by rule, since their rule is always `model`.",
+  "what_is_not_grouped": "The obligations checker also sits at `suspicion`, and is NOT grouped. Its output comes from a structural analysis -- an obligated operation with no discharging guard -- rather than from a guess. An earlier attempt at this rule filtered on rung alone and would have collapsed it; six tests failed and they were right to.",
+  "what_it_costs": {
+    "caveat": "Three known vulnerabilities in one repository. The rule would hide a real finding that only ever reached model-suspicion, and no such finding exists in the evidence base -- which is a statement about how small the evidence base is as much as about the rule.",
+    "method": "For each known vulnerability the recipe declares, take every finding row at its location and ask whether any survives the rule. If a known vulnerability appeared ONLY at model-suspicion, this rule hides it, and that is the number that decides whether the rule is right.",
+    "result": "VAmPI-SQLI, VAmPI-BOLA and VAmPI-BOLA-BOOKS all still found at model_entailed and all three survive the rule. Nothing known is hidden."
+  }
+}