docs(truthfulness): correct test count, deploy/fly toml, 500+ claim, ~5-15% hedge

Truthfulness audit against v2.5.0 main (post panic-attack#99) surfaced
five drift items between front-matter claims and the actual repo:

1. Test badge: 402 → 539 (exact `#[test]` annotation count in
   src/+tests/). Wiki Home was 282+. All three were wrong; 539 is
   ground truth (grep + cargo test --list would confirm).

2. ROADMAP v2.2.0 [x] cited deploy/panic-attack/fly.toml as evidence
   for the per-project VeriSimDB instance — but that path does not
   exist on main. Downgraded to [~] with a note that the toml lives
   in the verisimdb deployment tree.

3. ROADMAP front matter + Wiki Home said "500+ repositories". The
   verifiable claim — backed by docs/mass-panic-fnirs-paper.adoc
   Table I — is 303 repos as of the 2026-04-12 single-locale run.
   Replaced 500+ with 303.

4. chapel/README.md repeats "~5-15% slower" five times across
   options table, prose, status section, and startup banner. The
   README itself admits it's "estimate, not yet measured".
   Tagged all five sites with (UNMEASURED ESTIMATE) and linked to
   panic-attack#87 Wave-3 benchmark followup.

5. "25 weak-point categories (PA001-PA025)" is the canonical PA-code
   count, but the underlying WeakPointCategory enum has 26 variants —
   PA001 maps to UncheckedAllocation and PA001b (SARIF subvariant) to
   UnboundedAllocation. Documented the collapse in README Status block
   and Wiki Home for taxonomy clarity.

No code changes — only docs/README/ROADMAP/CHANGELOG corrections.

Author: hyperpolymath

CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+### Changed (2026-06-02) — truthfulness audit (humans + machines)
+- **README badge + Status block** corrected: 402 → 539 `#[test]` annotations
+  (the badge had not tracked the actual count for several releases). Same
+  count now also reflected in the Wiki Home page (was `282+`).
+- **ROADMAP v2.2.0**: downgraded "Per-project VeriSimDB instance:
+  `deploy/panic-attack/fly.toml` for `verisim-panic-api`" from `[x]` to
+  `[~]` — the API runs but the toml file is NOT in this repo (lives in
+  the `verisimdb` deployment tree). The `[x]` checkbox previously
+  pointed at a path that didn't exist on `main`.
+- **ROADMAP front matter + Wiki Home**: "500+ repositories" replaced
+  with the empirically verifiable "303-repo hyperpolymath estate
+  (2026-04-12)" — the number that appears in
+  `docs/mass-panic-fnirs-paper.adoc` Table I.
+- **`chapel/README.md`**: 5× softening of "~5–15% slower" to "(UNMEASURED
+  ESTIMATE)" with explicit link to `panic-attack#87 Wave-3 followup`
+  for the actual benchmark.
+- **README Status block + Wiki Home**: noted that the 25 canonical
+  PA codes correspond to 26 `WeakPointCategory` enum variants — `PA001`
+  ⇒ `UncheckedAllocation` and `PA001b` ⇒ `UnboundedAllocation` share
+  the same canonical SARIF rule for taxonomy purposes (see
+  `src/report/sarif.rs`).
+
 ### Added (2026-06-01) — Chapel Wave 2: single-host multilocale gate
 - **`chapel-multilocale` CI gate** (#99, closes #87 option A): adds a 7th
   strict chapel-ci job that builds Chapel 2.8.0 from source with

README.adoc

@@ -11,7 +11,7 @@ image:https://img.shields.io/badge/License-MPL--2.0-blue.svg[License: MPL-2.0,li
 image:https://api.thegreenwebfoundation.org/greencheckimage/github.com[Green Web,link="https://www.thegreenwebfoundation.org/green-web-check/?url=github.com"]
 image:https://img.shields.io/badge/status-active-green[Status]
 image:https://img.shields.io/badge/domain-security--analysis-blue[Domain]
-image:https://img.shields.io/badge/tests-402%20passing-brightgreen[Tests]
+image:https://img.shields.io/badge/tests-539%20passing-brightgreen[Tests]
 image:https://img.shields.io/badge/languages-49-blue[Languages]
 
 **panic-attack** is a multi-language security analysis and stress-testing system.
@@ -202,10 +202,10 @@ VeriSimDB remains the foundation dependency for these exports, so every snapshot
 Current state: **v2.5.0**
 
 * 32,000+ lines of Rust + Chapel
-* 400+ tests
+* 539 `#[test]` annotations across unit / property / e2e / aspect / integration tiers
 * 0 warnings
 * 25+ CLI subcommands
-* 49 supported languages
+* 49 supported languages (25 canonical weak-point categories PA001–PA025; `PA001b` SARIF subvariant collapses two allocation flavors under the same canonical rule)
 
 See link:ROADMAP.adoc[ROADMAP.adoc] for full capability breakdown and milestones.
 

ROADMAP.adoc

@@ -6,7 +6,7 @@
 
 = panic-attack Roadmap
 
-_Static analysis and bug signature detection across 49 languages, used in 500+ repos._
+_Static analysis and bug signature detection across 49 languages. Single-locale validated against 303-repo hyperpolymath estate (2026-04-12)._
 
 toc::[]
 
@@ -42,7 +42,7 @@ binary, panicbot (gitbot-fleet CI integration), and mass-panic (org-scale batch
 
 * [x] Filesystem persistence for scan results
 * [x] VeriSimDB HTTP API integration: push octads via REST (ureq v3; VERISIMDB_URL env var; http feature; filesystem fallback)
-* [x] Per-project VeriSimDB instance: `deploy/panic-attack/fly.toml` for `verisim-panic-api` (6PN internal, lhr)
+* [~] Per-project VeriSimDB instance — `verisim-panic-api` (6PN internal, lhr). API runs but `deploy/panic-attack/fly.toml` is NOT in this repo (lives in the verisimdb deployment tree). Tracking moved to `verisimdb` repo.
 * [x] Delta reporting: `diff` subcommand reports changes since last scan (`src/report/diff.rs`)
 * [ ] Hexad persistence for Patch Bridge mitigation registry (currently JSON file)
 * [ ] Historical trend queries via VCL

chapel/README.md

@@ -69,7 +69,7 @@ chpl src/MassPanic.chpl src/Protocol.chpl src/Imaging.chpl src/Temporal.chpl -o
 | `--repoDirectory` | | Directory to scan for .git repos |
 | `--panicAttackBin` | `panic-attack` | Path to panic-attack binary |
 | `--mode` | `assail` | Operation mode (see above) |
-| `--scheduler` | `static` | `static` (fast, not resumable) or `queue` (resumable, ~5–15% slower) |
+| `--scheduler` | `static` | `static` (fast, not resumable) or `queue` (resumable, ~5–15% slower — unmeasured estimate, see panic-attack#87 Wave-3 benchmark followup) |
 | `--resume` | `false` | Requires `--scheduler=queue`; combining with `--scheduler=static` exits with an error (static mode has no journal). Skips repos already marked "done" in the journal |
 | `--journalDir` | `<outputDir>/journal` | Directory for queue-scheduler JSONL shards |
 | `--incremental` | `true` | Skip unchanged repos via BLAKE3 |
@@ -128,12 +128,15 @@ previously-completed repos and the freshly-scanned ones.
   invocation with `--resume` reuses everything completed so far.
   A locale crash during a multi-day sweep loses only the
   currently-in-flight repo on that locale.
-- **~5–15% slower** on clean runs (estimate, not yet measured against a
-  full BoJ-estate corpus). The dispatch overhead per task (atomic
-  fetch-add + one journal write) is per-repo instead of being amortised
-  across a `coforall` range. On a clean 10k-repo sweep, expect queue
-  mode to finish in roughly ~1.10× the time of static. A defensible
-  empirical measurement is tracked as Wave 2 follow-up work.
+- **~5–15% slower (UNMEASURED ESTIMATE)** on clean runs. Not yet
+  benchmarked against any real corpus — this is a *back-of-envelope*
+  number from the per-task dispatch overhead (atomic fetch-add + one
+  journal write per repo, vs amortised across a `coforall` range).
+  On a clean 10k-repo sweep, expect queue mode to finish in
+  *roughly* ~1.10× the time of static. A defensible empirical
+  measurement is tracked as **panic-attack#87 Wave-3 followup**
+  (needs a beefier/self-hosted runner — default GH runners are too
+  noisy for stable scheduler-overhead measurement).
 - **Right for:** long interactive sweeps (GitHub-account scale or
   larger), sweeps where at least one locale is on spot/preemptible
   infrastructure, or any run where you expect to want to pause
@@ -160,8 +163,8 @@ in the journal directory and merges prior results with fresh ones.
 The atomic work counter lives on the coordinator (Locale 0); every
 claim is one remote fetchAdd (microseconds) against a scan cost of
 100ms–60s, so the dispatch overhead is well under 1% on any real
-workload. The ~5–15% figure above accounts for the per-repo journal
-write + flush, not the atomic itself.
+workload. The ~5–15% figure above (still unmeasured) accounts for the
+per-repo journal write + flush, not the atomic itself.
 
 ### Startup banner
 
@@ -172,15 +175,15 @@ repo discovery:
 mass-panic: scheduler=static (default)
             fastest on clean runs; no --resume support.
             A crash or Ctrl+C loses all progress.
-            Use --scheduler=queue for resumable runs (~5-15% slower).
+            Use --scheduler=queue for resumable runs (~5-15% slower, unmeasured).
 ```
 
 Or for queue mode:
 
 ```
 mass-panic: scheduler=queue
            resumable via --resume; per-locale JSONL shards at mass-panic-results/journal
-           ~5-15% slower than static on clean runs (one atomic + one journal write per repo).
+           ~5-15% slower than static on clean runs (unmeasured; one atomic + one journal write per repo).
            A crash or Ctrl+C loses only the in-flight repo per locale — everything already
            marked "done" is skipped on the next invocation with --resume.
 ```