docs: close issue 84 coverage-truth documentation

CLAUDE.md

@@ -41,7 +41,7 @@ Key internal conventions in `src/index.ts`:
 - **In-isolate caches** (best-effort, per Worker isolate): rate-limit buckets, OIDC JWKS TTL cache (force-refreshed when an unknown `kid` appears), and installation-id TTL cache. TTLs and the rate limit are tunable via `NOEMA_*` vars in `wrangler.toml`.
 - **Bindings**: `wrangler.toml` defines only `[vars]` (allowed issuer/audience/owner/workflow ref, GitHub API base, cache/rate-limit knobs). There are no KV/D1/queue/Durable Object bindings. Secrets (`GITHUB_APP_ID`, `GITHUB_APP_PRIVATE_KEY_PEM`, optional `GITHUB_APP_INSTALLATION_ID`) come from `wrangler secret put`; new secrets go into the `Env` interface.
 
-**Tests** (`test/`, Vitest, Node environment): `worker.test.ts` imports the Worker's default export directly and drives it in-process with real WebCrypto-signed JWTs and a mocked global `fetch`; the other test files exercise the `scripts/*.mjs` tooling by spawning it (`spawnSync`) against temp fixtures, and some assert on docs/workflow content (e.g. `workflow-readiness.test.ts`). Coverage is scoped to `src/**/*.ts` (`vitest.config.ts`); `/* v8 ignore */` markers in `src/index.ts` are deliberate.
+**Tests** (`test/`, Vitest, Node environment): `worker.test.ts` imports the Worker's default export directly and drives it in-process with real WebCrypto-signed JWTs and a mocked global `fetch`; the other test files exercise the `scripts/*.mjs` tooling by spawning it (`spawnSync`) against temp fixtures, and some assert on docs/workflow content (e.g. `workflow-readiness.test.ts`). Coverage is scoped to `src/**/*.ts` (`vitest.config.ts`); broad credential/security V8 exclusions are regressions. See `docs/TEST_STRATEGY.md` for the exact 100% owned-production policy and any narrow evidence-bound exceptions.
 
 ## Conventions
 

test/documentation-active-work-contract.test.ts

@@ -79,4 +79,12 @@ describe("canonical active-work documentation", () => {
     expect(gapAudit).toContain("source defect itself is no longer an open implementation gap");
     expect(gapAudit).not.toContain("Direct-main dependent PRs remain blocked by protected-main audit until it integrates");
   });
+
+  it("does not teach contributors that credential-core V8 exclusions are deliberate", () => {
+    const claude = readFileSync("CLAUDE.md", "utf8");
+
+    expect(claude).not.toContain("`/* v8 ignore */` markers in `src/index.ts` are deliberate");
+    expect(claude).toContain("docs/TEST_STRATEGY.md");
+    expect(claude).toContain("broad credential/security V8 exclusions are regressions");
+  });
 });