diff --git a/scripts/tests/test_image_build_delegates_the_spa_suite.py b/scripts/tests/test_image_build_delegates_the_spa_suite.py
index bcf667292..7bbbf988a 100644
--- a/scripts/tests/test_image_build_delegates_the_spa_suite.py
+++ b/scripts/tests/test_image_build_delegates_the_spa_suite.py
@@ -74,6 +74,14 @@ another WORKFLOW (a `needs:` edge naming a job called `test` that is not this on
 pinned command invokes (a vite plugin, an npm lifecycle script). Ask of any new pin: what else could
 decide this, and would the pin still match?
 
+Two candidates for that class were probed and are NOT routes, recorded so the next reader does not
+re-derive them. The `setupFiles` entry is pinned by NAME and its CONTENT is not, but a setup file
+that terminates the run is FAIL-NOISY: `process.exit(0)` at the top of `src/setupTests.ts` reports
+`121 failed (121)`, not a green. And `tsconfig*.json` shapes what `tsc -b` compiles, not what vitest
+collects. What remains genuinely unpinned in that direction is a dependency's own install script,
+reached through `npm ci` and `web/package-lock.json` — a supply-chain concern wider than this guard,
+named rather than claimed to be covered.
+
 The cost is stated rather than hidden: a legitimate edit to those command lines reddens this guard
 and its author must update the pin. That is the same deliberate review trigger `KNOWN_GATE_*` uses,
 applied to the two places where a silent change publishes an untested image.