Make the README witness check capable of failing

[sroussey]

Closes #350.

The problem

sourceFiles collected every .ts under src/, tests included — and the witness table is a set of string literals in this very file. The corpus therefore contained the strings it was searching for, so every witness matched itself and the check could not fail for any reason.

Three changes, each verified by breaking the tree

I checked each guard by making the regression it exists to catch and confirming the right test went red, rather than by reading the code.

1. Test files are out of the corpus, and a self-check holds them out. Excluding them is one line in sourceFiles; without an assertion the next refactor of that function restores the loop with nothing failing. Reverting the line now fails:

AssertionError: expected [ …(836) ] to not include 'src/exampleCoverage.test.ts'

It also asserts the corpus is non-empty — an empty one passes every check below it.

2. A witness must appear on an import, not anywhere in the file. RateLimiter occurs eleven times outside tests:

• once as real evidence — import type { RateLimiter } from "workglow"
• ten times in prose comments, or as a substring of a longer local name like secFetchRateLimiterTableNames

Ten of the eleven prove nothing, and a substring search cannot tell them from the one that does. Verified by putting a witness string in a comment only and watching the package be reported unproven.

The extraction strips comments first and matches whole statements, not lines. That detail is load-bearing: these imports are routinely multi-line, and createStandardKbStrategy sits on a continuation line of one — a line-wise filter reported @workglow/ai as missing, which is how I found it.

3. The README's commands resolve against the registered command tree. For the reason commandsBoot.test.ts gives: help output is prose, and a name appearing in some description satisfies a substring check without being registered at all. It walks the leading bare words of each backticked `sec …` and stops at the first flag or placeholder, since only the subcommand path is resolvable.

One correction to the issue

The issue says this check "has already found one defect (sec show companies does not exist) before being written". That string is not in the README today — grep finds nothing, and all fifteen backticked invocations resolve. So the check lands green rather than red; it is a ratchet against the next one, not a fix for a live break. Adding `sec show companies` to the README does fail it, which is how I confirmed it is not vacuous.

Verification

format, lint, typecheck all clean. exampleCoverage.test.ts 4/4 and commandsBoot.test.ts 2/2.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LWp6Z6wvAPDaDCjAFcTSj6

---

Generated by Claude Code