docs(check-console-injection): record why packages/spec is not in ci.yml's console filter

[os-zhuang]

Header-only. One file, 44 added lines, zero deletions, no behaviour change.

This lands the PM's ruling on #9710's open question — where to record the
measurement — which was answered C: put it in
scripts/check-console-injection.mjs's header, where #9667's cache-key cost
model already lives, rather than in ci.yml.

Refs: #9710 deliberately, not a closing keyword. That card's ruled outcome
is keep B — do not widen the filter, do not build the light job; this commit
implements none of what the card asked for, so it must not auto-close it. The
PM closes it with the ruling recorded.

What the new section records

A sibling of the existing "Adding packages/spec to the cache key was
considered and REJECTED" paragraph, placed after the EXPIRY section and before
the failure-response one:

• the gap is real — packages/spec is absent from ci.yml's console paths
  filter, so a spec-only PR never schedules Console Pin Gate;
• the reason it stays that way is not cost. Of this gate's six failure
  verdicts, five are pure functions of the restored dist plus its stamp —
  which a spec-only diff cannot move, the cache key being the pin and the build
  script and cache entries immutable — and exactly one reads this tree, the
  probe-expiry re-check, which needs packages/spec/dist because
  readSpecBlob resolves the package's exports map;
• so the proposed restore-only job would start the gate 15 more times per 100
  commits (6/100 today, 21/100 with packages/spec added) and skip the only
  tree-sensitive assertion on every one of them;
• and the fully built variant still passes on "spec moved forward since the
  dist was built" — the headline scenario — which PR fix(ci): verify the RESTORED console dist bundles this tree's spec, not only the built one #9706's ruling table
  already calls "not a failure — the ruled cache design accepts lag";
• check:console-injection silently drops its only tree-sensitive assertion when packages/spec is unbuilt — and nothing requires the spec blob #10428 is named as the exit: derive the expiry probe from packages/spec
  source text, making that assertion buildless, which reopens the trigger
  question on different terms.

Full working (paths-filter replay under both picomatch versions, per-commit
attribution) stays on #9710's ruling comment; the header carries the conclusion
plus the numbers that make it checkable.

Verification — all at c84898aeb (the final commit)

node scripts/pm/dispatch-gates.mjs derived three families for this diff, all
green at head:

gate	verdict line
pnpm check:console-injection	✓ check-console-injection --self-test: 21 assertions over real fixture trees (real evaluate() path) (exit 0)
node scripts/check-cross-package-test-inputs.mjs	OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check:nul-bytes (standing, any edit)	check-nul-bytes: OK (scanned 6124 text file(s) … no raw ASCII control bytes).

pnpm lint — os-verify-lock: VERDICT command-exit 0 · held the lock 58s · waited 171s, ESLint silent. It ran on byte-identical content: the commit
changed no bytes (git status --porcelain = 0 lines, git diff HEAD empty at
c84898aeb). Relevant because PR #10429's
comment-swallow/no-code-inside-block-comment targets exactly this shape —
every added line carries the * prose marker, blank ones included, and the
block contains no */ sequence (packages/spec is written unglobbed for that
reason).

Independently reproduced the ruling's price numbers here before writing them
down, by literal-path replay over the same window (all seven console filter
entries are literal paths, so no matcher is needed): 100 first-parent commits
ending e502a6a8e → baseline 6/100, + packages/spec21/100 (+15),
+ packages/spec/src16/100, and 5 of the 15 add .describe( text
under packages/spec. The five-vs-one verdict split was re-derived from the
current source, not inherited from the brief — it matches.

Not in this diff

• ⛔ .github/workflows/ci.yml — that was option A and it is ruled out.
• No new flag, no new assertion, no test change, no behaviour change.
• Changeset: scripts/** publishes nothing (the root package is private), so
  skip-changeset. Re-derived at diff time by publish surface.

Refs: #9710 (the card and its ruling) · #9667 (the cost model already in this
header) · #9706 (the ruling table) · #10428 (the exit)

---

Generated by Claude Code