[Castor-o7]

From the operator's request for a review of all READMEs, relayed by the watchman.

• Top: keeps one positioning line, "It's a triage aid for an analyst to check, not something to act on without a person", and points to Status.
• ## Status: now after the usage sections, just before Layout. Each item is re-checked against today's files:
  • "22 of 40 stories shipped" comes from ROADMAP.md's progress line.
  • Calibration on 55 labeled IPs, and the VirusTotal effect: ROADMAP.md's "Where we stand" table, and README's own Calibration section.
  • OTX-only evidence can be gamed: 3.5 is shipped as measurement only. The fixes, 3.8, 3.9 and 3.10 (PDX-38 to PDX-40), are still open in ROADMAP.md, and SECURITY.md's Poisoned feeds section says the same.
  • VirusTotal's free tier: ROADMAP 1.7 (PDX-30), and README's VirusTotal section.
  • Next to test: real analysts (5.7, PDX-26, open); prompt injection against the summary (4.1, PDX-16, open, and SECURITY.md's injection section, "Open"); CDNs, cloud hosts and Tor (2.3, PDX-8, and 3.1, PDX-11, both open).
• Unchanged: the adversarial-results and calibration links are kept, the SECURITY.md pointer stays, and nothing unbuilt is claimed.

Wrong rather than gloomy, now fixed: the old link to the adversarial results, ROADMAP.md#35-adversarial-test-suite--m, pointed at an anchor that doesn't exist. Since 3.5 shipped, GitHub's anchor is #35-adversarial-test-suite--m---shipped, which I read from GitHub's rendered ROADMAP.md. Every other ROADMAP link in README and SECURITY.md resolves. No other file linked the old #status-and-known-limits anchor.

Not checked: the rest of the README line by line, the description line (the watchman says it's fine), and the code.

🤖 Generated with Claude Code