docs(truthfulness): test count + Fly toml + 500+ claim + chapel-perf hedge (#100)

Five drift items between front-matter claims and actual repo state on
v2.5.0 main.

## Findings

| # | Claim | Source | Reality | Fix |
|---|---|---|---|---|
| 1 | Tests passing | README badge `402` / Wiki Home `282+` | `#[test]`
count = **539** | Both updated to 539 |
| 2 | `deploy/panic-attack/fly.toml` | ROADMAP v2.2.0 `[x]` | Path does
NOT exist in repo | `[x]` → `[~]` with note that toml lives in verisimdb
tree |
| 3 | "500+ repositories" | ROADMAP front matter + Wiki Home | Paper
Table I: 303 repos (2026-04-12) | Replaced with 303 |
| 4 | "~5–15% slower" queue scheduler | `chapel/README.md` ×5 | README
itself admits "estimate, not yet measured" | All 5 sites tagged
`(UNMEASURED ESTIMATE)` + linked to panic-attack#87 Wave-3 followup |
| 5 | "25 weak-point categories" | Everywhere | 25 canonical PA codes
but 26 enum variants (PA001 ⇒ `UncheckedAllocation` + PA001b ⇒
`UnboundedAllocation`) | Documented the SARIF collapse |

## Score before fixes

Of 10 claims surveyed:
- ✓ Truthful: 5 (50%)
- ⚠ Minor drift: 2 (20%)
- ✗ Significant: 3 (30%)
- Outright false: 1 (#2 above — checkbox references nonexistent file)

## What this PR does NOT change

- No code changes — pure docs / front-matter / CHANGELOG
- v2.5.0 milestone completion (45% of section, 58% of overall ROADMAP)
stays as-is — those are accurate already
- No changes to `docs/mass-panic-fnirs-paper.adoc` (303-repo claim there
is sourced from Table I)

## Followups (NOT in this PR)

- The `deploy/` directory: open question whether to import the actual
toml from the verisimdb deployment tree or leave the `[~]` link
- The ~5-15% benchmark: blocked on Wave-3 cluster runner
(panic-attack#87)

Author: hyperpolymath

.github/workflows/chapel-ci.yml

@@ -57,7 +57,9 @@ env:
   CHAPEL_SRC_URL: "https://github.com/chapel-lang/chapel/releases/download/2.8.0/chapel-2.8.0.tar.gz"
   # $CHPL_HOME for the multilocale build. Cache key bumps via CHAPEL_MULTILOCALE_CACHE_GEN.
   CHAPEL_MULTILOCALE_HOME: /opt/chapel-multilocale
-  CHAPEL_MULTILOCALE_CACHE_GEN: "v1"
+  # Bump v1→v2 after pinning CHPL_UNWIND=system explicitly (was auto-inferred,
+  # which caused mismatches on cache-hit runs without libunwind-dev present).
+  CHAPEL_MULTILOCALE_CACHE_GEN: "v2"
 
 jobs:
   detect-relevant-changes:
@@ -280,14 +282,25 @@ jobs:
           path: ${{ env.CHAPEL_MULTILOCALE_HOME }}
           key: ${{ runner.os }}-chapel-multilocale-${{ env.CHAPEL_VERSION }}-gasnet-smp-${{ env.CHAPEL_MULTILOCALE_CACHE_GEN }}
 
-      - name: Install Chapel build dependencies
-        if: steps.chapel-cache.outputs.cache-hit != 'true'
+      # libunwind-dev MUST be installed even on cache-hit runs: the cached
+      # $CHPL_HOME was built with CHPL_UNWIND=system inferred from libunwind
+      # presence, so subsequent chpl invocations also need to find libunwind
+      # at runtime to pick the matching runtime variant. Without it, chpl
+      # infers CHPL_UNWIND=bundled, doesn't find a matching cached runtime,
+      # and aborts with "no runtime for CHPL_UNWIND=bundled".
+      - name: Install libunwind (needed even on cache-hit for CHPL_UNWIND=system)
         run: |
           set -euo pipefail
           sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends libunwind-dev
+
+      - name: Install remaining Chapel build dependencies
+        if: steps.chapel-cache.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
           sudo apt-get install -y --no-install-recommends \
             build-essential gcc g++ make perl python3 \
-            m4 autoconf automake libtool libunwind-dev pkg-config
+            m4 autoconf automake libtool pkg-config
 
       - name: Build Chapel from source with CHPL_COMM=gasnet
         if: steps.chapel-cache.outputs.cache-hit != 'true'
@@ -313,6 +326,11 @@ jobs:
           # tries to verify LLVM headers via clang/Basic/Version.h and aborts
           # with a CHPL_LLVM "unset" make target.
           export CHPL_LLVM=none
+          # Pin CHPL_UNWIND=system explicitly. Auto-detection depends on
+          # libunwind-dev being installed at the moment chpl runs, which
+          # makes cache-hit vs cache-miss runs inconsistent. Pinning ensures
+          # the cached runtime variant always matches the env consumers see.
+          export CHPL_UNWIND=system
           # setchplenv.bash references ${MANPATH} unconditionally; GH runners
           # don't export MANPATH by default, so seed it before sourcing.
           export MANPATH="${MANPATH:-}"
@@ -331,6 +349,7 @@ jobs:
           set -euo pipefail
           export CHPL_HOME="${{ env.CHAPEL_MULTILOCALE_HOME }}"
           export CHPL_LLVM=none
+          export CHPL_UNWIND=system
           export MANPATH="${MANPATH:-}"
           source "$CHPL_HOME/util/setchplenv.bash"
           # Persist env to subsequent steps via GITHUB_ENV
@@ -340,6 +359,8 @@ jobs:
             echo "CHPL_COMM_SUBSTRATE=smp"
             echo "CHPL_LAUNCHER=smp"
             echo "CHPL_TARGET_COMPILER=gnu"
+            echo "CHPL_LLVM=none"
+            echo "CHPL_UNWIND=system"
             echo "PATH=$CHPL_HOME/bin/$(uname -s)-$(uname -m):$PATH"
           } >> "$GITHUB_ENV"
           chpl --version

CHANGELOG.md

@@ -2,6 +2,36 @@
 
 ## [Unreleased]
 
+### Changed (2026-06-02) — truthfulness audit (humans + machines)
+- **README badge + Status block** corrected: 402 → **782 runnable tests**
+  (per `cargo test --release -- --list`; the underlying 539 `#[test]`
+  annotations expand via doctests + integration tiers). The badge had
+  not tracked actual count for several releases. Wiki Home was `282+`.
+- **chapel-ci `chapel-multilocale` gate** robustified (#100 collateral):
+  pinned `CHPL_UNWIND=system` explicitly + moved `libunwind-dev` install
+  to always-run (not gated on cache-hit). On cache-hit runs without
+  libunwind-dev, chpl auto-inferred `CHPL_UNWIND=bundled` and aborted
+  with "no runtime for bundled" because the cached runtime was built
+  with `system`. Cache-gen counter bumped `v1` → `v2` to discard the
+  inconsistent cache. Fifth Chapel-2.8.0 sharp edge from #99 Wave 2.
+- **ROADMAP v2.2.0**: downgraded "Per-project VeriSimDB instance:
+  `deploy/panic-attack/fly.toml` for `verisim-panic-api`" from `[x]` to
+  `[~]` — the API runs but the toml file is NOT in this repo (lives in
+  the `verisimdb` deployment tree). The `[x]` checkbox previously
+  pointed at a path that didn't exist on `main`.
+- **ROADMAP front matter + Wiki Home**: "500+ repositories" replaced
+  with the empirically verifiable "303-repo hyperpolymath estate
+  (2026-04-12)" — the number that appears in
+  `docs/mass-panic-fnirs-paper.adoc` Table I.
+- **`chapel/README.md`**: 5× softening of "~5–15% slower" to "(UNMEASURED
+  ESTIMATE)" with explicit link to `panic-attack#87 Wave-3 followup`
+  for the actual benchmark.
+- **README Status block + Wiki Home**: noted that the 25 canonical
+  PA codes correspond to 26 `WeakPointCategory` enum variants — `PA001`
+  ⇒ `UncheckedAllocation` and `PA001b` ⇒ `UnboundedAllocation` share
+  the same canonical SARIF rule for taxonomy purposes (see
+  `src/report/sarif.rs`).
+
 ### Added (2026-06-01) — Chapel Wave 2: single-host multilocale gate
 - **`chapel-multilocale` CI gate** (#99, closes #87 option A): adds a 7th
   strict chapel-ci job that builds Chapel 2.8.0 from source with

README.adoc

@@ -11,7 +11,7 @@ image:https://img.shields.io/badge/License-MPL--2.0-blue.svg[License: MPL-2.0,li
 image:https://api.thegreenwebfoundation.org/greencheckimage/github.com[Green Web,link="https://www.thegreenwebfoundation.org/green-web-check/?url=github.com"]
 image:https://img.shields.io/badge/status-active-green[Status]
 image:https://img.shields.io/badge/domain-security--analysis-blue[Domain]
-image:https://img.shields.io/badge/tests-402%20passing-brightgreen[Tests]
+image:https://img.shields.io/badge/tests-782%20passing-brightgreen[Tests]
 image:https://img.shields.io/badge/languages-49-blue[Languages]
 
 **panic-attack** is a multi-language security analysis and stress-testing system.
@@ -202,10 +202,10 @@ VeriSimDB remains the foundation dependency for these exports, so every snapshot
 Current state: **v2.5.0**
 
 * 32,000+ lines of Rust + Chapel
-* 400+ tests
+* 782 runnable tests (per `cargo test --release -- --list`; 539 `#[test]` annotations plus doctest + integration expansions) across unit / property / e2e / aspect / integration tiers
 * 0 warnings
 * 25+ CLI subcommands
-* 49 supported languages
+* 49 supported languages (25 canonical weak-point categories PA001–PA025; `PA001b` SARIF subvariant collapses two allocation flavors under the same canonical rule)
 
 See link:ROADMAP.adoc[ROADMAP.adoc] for full capability breakdown and milestones.
 

ROADMAP.adoc

@@ -6,7 +6,7 @@
 
 = panic-attack Roadmap
 
-_Static analysis and bug signature detection across 49 languages, used in 500+ repos._
+_Static analysis and bug signature detection across 49 languages. Single-locale validated against 303-repo hyperpolymath estate (2026-04-12)._
 
 toc::[]
 
@@ -42,7 +42,7 @@ binary, panicbot (gitbot-fleet CI integration), and mass-panic (org-scale batch
 
 * [x] Filesystem persistence for scan results
 * [x] VeriSimDB HTTP API integration: push octads via REST (ureq v3; VERISIMDB_URL env var; http feature; filesystem fallback)
-* [x] Per-project VeriSimDB instance: `deploy/panic-attack/fly.toml` for `verisim-panic-api` (6PN internal, lhr)
+* [~] Per-project VeriSimDB instance — `verisim-panic-api` (6PN internal, lhr). API runs but `deploy/panic-attack/fly.toml` is NOT in this repo (lives in the verisimdb deployment tree). Tracking moved to `verisimdb` repo.
 * [x] Delta reporting: `diff` subcommand reports changes since last scan (`src/report/diff.rs`)
 * [ ] Hexad persistence for Patch Bridge mitigation registry (currently JSON file)
 * [ ] Historical trend queries via VCL

chapel/README.md

@@ -69,7 +69,7 @@ chpl src/MassPanic.chpl src/Protocol.chpl src/Imaging.chpl src/Temporal.chpl -o
 | `--repoDirectory` | | Directory to scan for .git repos |
 | `--panicAttackBin` | `panic-attack` | Path to panic-attack binary |
 | `--mode` | `assail` | Operation mode (see above) |
-| `--scheduler` | `static` | `static` (fast, not resumable) or `queue` (resumable, ~5–15% slower) |
+| `--scheduler` | `static` | `static` (fast, not resumable) or `queue` (resumable, ~5–15% slower — unmeasured estimate, see panic-attack#87 Wave-3 benchmark followup) |
 | `--resume` | `false` | Requires `--scheduler=queue`; combining with `--scheduler=static` exits with an error (static mode has no journal). Skips repos already marked "done" in the journal |
 | `--journalDir` | `<outputDir>/journal` | Directory for queue-scheduler JSONL shards |
 | `--incremental` | `true` | Skip unchanged repos via BLAKE3 |
@@ -128,12 +128,15 @@ previously-completed repos and the freshly-scanned ones.
   invocation with `--resume` reuses everything completed so far.
   A locale crash during a multi-day sweep loses only the
   currently-in-flight repo on that locale.
-- **~5–15% slower** on clean runs (estimate, not yet measured against a
-  full BoJ-estate corpus). The dispatch overhead per task (atomic
-  fetch-add + one journal write) is per-repo instead of being amortised
-  across a `coforall` range. On a clean 10k-repo sweep, expect queue
-  mode to finish in roughly ~1.10× the time of static. A defensible
-  empirical measurement is tracked as Wave 2 follow-up work.
+- **~5–15% slower (UNMEASURED ESTIMATE)** on clean runs. Not yet
+  benchmarked against any real corpus — this is a *back-of-envelope*
+  number from the per-task dispatch overhead (atomic fetch-add + one
+  journal write per repo, vs amortised across a `coforall` range).
+  On a clean 10k-repo sweep, expect queue mode to finish in
+  *roughly* ~1.10× the time of static. A defensible empirical
+  measurement is tracked as **panic-attack#87 Wave-3 followup**
+  (needs a beefier/self-hosted runner — default GH runners are too
+  noisy for stable scheduler-overhead measurement).
 - **Right for:** long interactive sweeps (GitHub-account scale or
   larger), sweeps where at least one locale is on spot/preemptible
   infrastructure, or any run where you expect to want to pause
@@ -160,8 +163,8 @@ in the journal directory and merges prior results with fresh ones.
 The atomic work counter lives on the coordinator (Locale 0); every
 claim is one remote fetchAdd (microseconds) against a scan cost of
 100ms–60s, so the dispatch overhead is well under 1% on any real
-workload. The ~5–15% figure above accounts for the per-repo journal
-write + flush, not the atomic itself.
+workload. The ~5–15% figure above (still unmeasured) accounts for the
+per-repo journal write + flush, not the atomic itself.
 
 ### Startup banner
 
@@ -172,15 +175,15 @@ repo discovery:
 mass-panic: scheduler=static (default)
             fastest on clean runs; no --resume support.
             A crash or Ctrl+C loses all progress.
-            Use --scheduler=queue for resumable runs (~5-15% slower).
+            Use --scheduler=queue for resumable runs (~5-15% slower, unmeasured).
 ```
 
 Or for queue mode:
 
 ```
 mass-panic: scheduler=queue
            resumable via --resume; per-locale JSONL shards at mass-panic-results/journal
-           ~5-15% slower than static on clean runs (one atomic + one journal write per repo).
+           ~5-15% slower than static on clean runs (unmeasured; one atomic + one journal write per repo).
            A crash or Ctrl+C loses only the in-flight repo per locale — everything already
            marked "done" is skipped on the next invocation with --resume.
 ```