docs(future-improvements): refresh status (4 of 10 items shipped)

[hyperpolymath]

Summary

`FUTURE-IMPROVEMENTS.md` was written on 2026-02-08 when panic-attack was at v1.0.0, surveying ten Eclexia-scan-driven improvement ideas. We're now at v2.5.0; four of the ten items have shipped but the doc still presents them as future work.

This PR adds a status block at the top of the file and inline Status: SHIPPED markers on the four landed sections, with file/line evidence so a reader can verify the claims at a glance.

Shipped (4)

#	Improvement	Code reference
1	Test Code Exclusion	`Analyzer::strip_cfg_test_modules_rs` — `src/assail/analyzer.rs:923-934`
2	Framework Detection Accuracy	`Analyzer::detect_frameworks` — `src/assail/analyzer.rs:4993`
3	Safe Unwrap Variant Distinction	`safe_unwrap_calls` field on `ProgramStatistics` / `FileStatistics` — `src/types.rs:451,518`
6	Differential Scanning	`Commands::Diff` — `src/main.rs:483`; logic in `src/report/diff.rs`

Outstanding (6)

• chore(deps): bump the rust-minor group with 6 updates #4 Language-Specific Severity Calibration — no "Hardened" tier yet; was gated on chore(ci): Maximize CI/CD values (Dependabot & Permissions) #1+chore(deps): bump rustls-webpki from 0.103.9 to 0.103.10 in the cargo group across 1 directory #3 (now both shipped, so genuinely unblocked).
• chore(deps): bump getrandom from 0.2.17 to 0.3.4 #5 Workspace-Level Consolidated Reporting — no Cargo workspace mode in CLI.
• chore(deps): bump crossterm from 0.26.1 to 0.29.0 #7 Allocation Site Context — no `AllocationCategory` enum.
• chore(deps): bump dirs from 5.0.1 to 6.0.0 #8 Resource Dimension Awareness — long-term, no plugin surface.
• chore(deps): bump the rust-minor group with 6 updates #9 Error Handling Maturity — no metric yet.
• chore(deps): bump eframe from 0.27.2 to 0.34.1 #10 Configurable CI Thresholds — no `[thresholds]` parser; was gated on chore(ci): Maximize CI/CD values (Dependabot & Permissions) #1-4 (now mostly unblocked).

Preservation

• The historical header (`Date: 2026-02-08`, `Tool version: panic-attack v1.0.0`) is preserved as a historical record of what was true at scan time.
• A new `Audit refreshed: 2026-05-26` line records when this status update was performed.
• Body text of each improvement section is unchanged — only the priority line on shipped items gets a "Status: SHIPPED" suffix.

Test plan

• Markdown renders correctly (status table, inline markers)
• All cited file:line locations grep clean against current main
• Signed commit

Not in this PR

Acting on the now-unblocked items (#4, #10) is separate work. Filing this hygiene update first so future planning has accurate ground truth.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 50 issues detected

Severity	Count
🔴 Critical	4
🟠 High	16
🟡 Medium	30

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/panic-attack/panic-attack/reports/panic-attack-20260211180017.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/chain.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/evidence.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/ambush/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/kanren/strategy.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/axial/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "expect() in hot path (4 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/assail/analyzer.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (4 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/panic-attack/panic-attack/benches/scan_bench.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/benches/scan_bench.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence