Improve evidence classification and compact CLI reporting

tests/test_rules.py

@@ -5,6 +5,14 @@ from rpcscope.rules import evaluate_host
 
 
 class RuleTests(unittest.TestCase):
+    def test_negative_capability_with_retained_conflict_still_gets_review_finding(self):
+        host = HostEvidence("192.0.2.1", checks={"smbghost": "exposed"})
+        host.merge(HostEvidence(host.address, checks={"smbghost": "not-exposed"}))
+        findings = evaluate_host(host)
+        self.assertEqual(len(findings), 1)
+        self.assertIn("conflict", findings[0].title)
+        self.assertEqual(findings[0].confidence, "low")
+
     def test_rules_separate_exposure_from_confirmed_vulnerability(self):
         host = HostEvidence(
             address="10.10.10.25",
@@ -78,7 +86,7 @@ class RuleTests(unittest.TestCase):
         self.assertEqual(finding.confidence, "low")
         self.assertIn("requires validation", finding.title)
         self.assertEqual(finding.evidence, host.check_details["smbghost"])
-        self.assertIn("does not distinguish patched", finding.impact)
+        self.assertIn("never SMBGhost patch state", finding.impact)
 
     def test_checker_positive_includes_actual_evidence(self):
         host = HostEvidence("10.10.10.25", checks={"ms17-010": "vulnerable"},