fix(model-grounded-detection): ask the residual question the arbiter actually raised

The corrected re-measure returned numbers IDENTICAL to the buggy one, which was
the clue. Routing was fixed, the dominance arbiter was reached, and the finding
was discarded anyway -- because every corroboration was put to the judge as a
TAINT question: "a sanitizer appears on the path: yes, does it suffice?".

For a missing authorization guard that question is meaningless. The judge
answers no to something that does not apply and the claim is dropped. All three
vibe-py access_control pairs scored both_silent this way even though the
dominance arbiter had returned model_corroborated for each of them, which I had
verified by hand earlier in the session.

Fourth instance in this feature of one shape: taint-specific behaviour applied
to every family. Sanitizer matching, config routing, family dispatch, now the
residual question. Each was exposed by a measurement rather than by a check.

The question is now phrased for the arbiter that raised it -- a guard asymmetry
for dominance, a permissive setting for constant abstraction, sanitizer
sufficiency only for taint.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

tests/test_model_pipeline.py

@@ -163,3 +163,37 @@ def test_a_configuration_family_is_arbitrated_by_constant_abstraction() -> None:
     findings = scan_region(_cpg(rows), _config_spec(), function="create_app", client=None, model="", candidates=())
     assert len(findings) == 1 and findings[0].rung is Rung.ENTAILED
     assert findings[0].family == "config_secrets"
+
+
+def test_the_residual_question_matches_the_arbiter_that_raised_it() -> None:
+    """A corroborated verdict from dominance is not a question about a sanitizer.
+
+    The pipeline asked `_sanitizer_question` for every corroboration, so an absence finding was put to the
+    judge as "a sanitizer appears on the path: yes -- does it suffice?", which is meaningless for a missing
+    guard. The judge answered no and the finding was discarded: all three vibe-py access_control pairs scored
+    both_silent even though the dominance arbiter had returned model_corroborated for each. Fourth instance in
+    this feature of taint-specific behaviour applied to every family.
+    """
+    from openultrasast.model.pipeline import residual_question
+
+    rows = [{"operation": "q.filter_by(id=n)", "opLine": "9", "opMethod": "leaky", "dominatingGuards": []},
+            {"operation": "q.filter_by(id=n)", "opLine": "3", "opMethod": "safe", "dominatingGuards": ["current_user"]}]
+    dom = residual_question(_dominance_spec(), "leaky line 9: no discharging guard", "leaky")
+    assert "sanitizer" not in dom.lower(), "an absence bug has no sanitizer to judge"
+    assert "guard" in dom.lower()
+
+    cfg = residual_question(_config_spec(), 'CORS(...): permissive literal "*"', "create_app")
+    assert "sanitizer" not in cfg.lower() and "setting" in cfg.lower()
+
+    taint = residual_question(_spec(), "request.args['c'] -> os.system(cmd)", "run")
+    assert "sanitizer" in taint.lower()
+
+
+def test_a_corroborated_absence_finding_survives_a_judge_that_agrees() -> None:
+    from openultrasast.model.ladder import Rung
+    from openultrasast.model.pipeline import scan_region
+
+    rows = [{"operation": "q.filter_by(id=n)", "opLine": "9", "opMethod": "leaky", "dominatingGuards": []},
+            {"operation": "q.filter_by(id=n)", "opLine": "3", "opMethod": "safe", "dominatingGuards": ["current_user"]}]
+    findings = scan_region(_cpg(rows), _dominance_spec(), function="leaky", client=_Client(), model="m", candidates=())
+    assert len(findings) == 1 and findings[0].rung is Rung.ENTAILED