measure(contributor-scan): first ontology coverage run, and it found a family we do not have

NodeGoat models 18 of 175 distinct call names, covering 12 percent of 1,185 calls. That share is not
a score: most of what a program calls is not security-relevant, and a high number would mean the
tables were too loose. It is a baseline to move deliberately.

The top product candidate is res.render, 23 calls with five in a method that reads untrusted input.
Task 14.3 reasoned its way to that same gap by hand and declined to model it as a flow sink; the
instrument found it in one run, which is the validation that matters. It also surfaced Math.random in
the user data-access module, and weak randomness is a weakness class this ontology has no family for
at all -- so no family census could have found it, because the family list is itself the blind spot.
That is the kind of gap only a coverage instrument finds.

It had to be taught what is not an API. The first run ranked _tmp_3.push and __ecma.Array.factory
first, which is how the frontend lowers a destructuring and an array literal, and a Cypress suite and
a Gruntfile held four of the next five. Both are separated now, because noise at the top of a
worklist is how a worklist stops being read.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

src/openultrasast/cpg/queries/vocabulary.sc

@@ -36,7 +36,14 @@
     head.trim.takeRight(120)
   }
 
-  val calls = cpg.call.filterNot(_.name.startsWith("<operator")).l
+  // Names the FRONTEND synthesised are not names the code calls. jssrc2cpg lowers a destructuring to
+  // `_tmp_3.push` and an array literal to `__ecma.Array.factory`, and on the first measured subject those
+  // were the two most frequent candidates in the list -- noise at the top of a worklist is how a worklist
+  // stops being read.
+  def synthesised(name: String): Boolean =
+    name.startsWith("<") || name.startsWith("__ecma") || name.matches("^_tmp_?[0-9]*\\..*") || name.startsWith("_tmp")
+
+  val calls = cpg.call.filterNot(c => c.name.startsWith("<operator") || synthesised(c.name)).l
 
   // Memoised per method: does this method read something the ontology calls untrusted input? A gap that sits
   // beside a source is worth more attention than one that does not, and that is a ranking hint rather than a
@@ -78,6 +85,7 @@
       "modelled" -> items.exists(_.modelledHere),
       "nearSource" -> items.count(_.near),
       "file" -> first.file,
+      "spellings" -> items.map(_.spelling).distinct.size,
       "line" -> first.line
     )
   }