feat(reports): say what was looked for, and what cannot be decided

contributor-scan 2.16, implementing the approved Req 5.6. `c/memory`
scored zero true positives across 89k lines of C and three distinct
classes of false one, for a structural reason: it models string CALLS and
libpng overflows through arithmetic.

The task allowed retiring the family. Kept, scoped and stated instead --
`strcpy` misuse is real in plenty of C and the family earns its place for
that. Retiring it would have removed the disclosure along with the
coverage, leaving a C scan silent for a reason nobody could read.

**Its own description was the quiet-failure risk.** It claimed "bounds,
lifetime, arithmetic", which is exactly what it does not decide. It now
names the APIs it models, and a new `limits` field in families.toml says
what it cannot: an overflow expressed as an index, a pointer offset, or a
memcpy whose size is computed -- which is how most real C overflows are
written, and how every one of libpng's is.

A limit recorded in a fact table nobody reads is no better than silence, so
the report renders it. **What was analysed** lists every family offered to
a region whether or not it found anything, because a family that ran and
reported nothing is the case a reader is most likely to misread, and it
states plainly that silence means no fact table covered the code rather
than that the code is safe.

The counts are derived from the fact tables the arbiter actually used, so
they cannot drift from what the engine looked for; only the limit sentence
is authored, because "cannot decide an overflow expressed as an index" is a
statement about an abstraction and no table can produce it.

A C scan that finds nothing now says:

  | c | `memory` | 121 | 9 |
  **`memory` (c)** — Models CALLS, not arithmetic...

Gates byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/reports.py

@@ -22,6 +22,7 @@ def write_markdown_report(
     mechanisms: Mapping[str, Mapping[str, object]] | None = None,
     obligations: Mapping[str, Mapping[str, object]] | None = None,
     obligations_summary: Mapping[str, object] | None = None,
+    coverage: Sequence[Mapping[str, object]] | None = None,
 ) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
     verification_by_id = _verification_by_id(verifications or [])
@@ -86,6 +87,8 @@ def write_markdown_report(
             cited_obligations[finding.finding_id] = info_o
             _append_obligation_lines(lines, info_o, (mechanisms or {}).get(str(info_o.get("known_fix") or "")))
         lines.extend(["", finding.rationale, ""])
+    if coverage:
+        _append_coverage(lines, coverage)
     if patterned:
         _append_pattern_matches(lines, patterned)
     if cited:
@@ -391,6 +394,36 @@ def _crowded_pattern_rules(findings: Sequence[StaticFinding]) -> list[StaticFind
     ]
 
 
+def _append_coverage(lines: list[str], coverage: Sequence[Mapping[str, object]]) -> None:
+    """What was looked for, and what could not be decided (Req 5.6).
+
+    A scan that reports nothing has established that nothing it MODELS was found. That is not the same as
+    finding nothing, and the difference is the whole reason this section exists: a silent report read as a
+    clean bill of health is worse than a noisy one, because the reader acts on it.
+    """
+    lines.extend(
+        [
+            "## What was analysed",
+            "",
+            "Each family below was offered to at least one region. **A family that reported nothing has "
+            "established only that nothing it models was found** — silence here means no fact table covered "
+            "the code, not that the code is safe.",
+            "",
+            "| language | family | regions | operations modelled |",
+            "| --- | --- | --- | --- |",
+        ]
+    )
+    for row in coverage:
+        lines.append(f"| {row.get('language')} | `{row.get('family')}` | {row.get('regions')} | {row.get('modelled')} |")
+    lines.append("")
+
+    stated = [row for row in coverage if str(row.get("limits") or "")]
+    if stated:
+        lines.extend(["### Stated limits", ""])
+        for row in stated:
+            lines.extend([f"**`{row.get('family')}` ({row.get('language')})** — {row.get('limits')}", ""])
+
+
 def _is_pattern_only(finding: StaticFinding) -> bool:
     """Is a text match the only thing behind this finding?