docs(spec): correct six points of spec drift, and neutralise the --push blacklist claims

[lsimons]

Docs only — nothing under src/ or tests/. Covers items 1, 4, 5, 6 and the meta
note of #54; items 2 and 3 (S07) land with the #50 fix. In every case the code is
what ships and the spec was wrong. Every claim was re-verified against the code
before the spec was edited; all of #54's claims in this scope held up.

1. S30 + S09 — macro carrier serialisation

_render_confluence_macro emits a :::confluence-macro {name="…"} fenced div with
the depth-aware colon scheme, not the ```confluence-xml fence S30 claimed.
_render_raw_block is what emits that fence — for RawBlock(format="confluence-storage")
and any other format the writer does not recognise, which S30 also did not say.

S09 separately described a pre-IR markdownify / ```{=confluence} strategy.
That form now survives only in a comment in ai/rewrite.py and a bundled skill;
S09 now describes the IR path, and gained the S28/S29/S30 links it was missing.
The reader side was already correct and is untouched.

4. S09 — config schema and output_dir

spaces: is registered as section="confluence", collection="spaces" — nested,
not top level. S19 already documented it correctly, so S09 was the outlier rather
than a competing source of truth.

sync-space does not read output_dir from config at all: it uses --output, or
default_output_for_space()'s git-origin-URL heuristic. mdd search is the only
reader. Now stated explicitly.

5. S39 — Confluence .mddignore wiring is no longer deferred

It has landed: confluence/sync/mddignore.py bridges the matcher to the page-title
hierarchy via synthetic rel-paths, wired to --ignore and --prune-ignored. S39
listed it as follow-up in five places, including a self-contradiction where it said
Confluence supports --prune-ignored and then said Confluence support was pending.
Lucid's follow-up statements are deliberately left alone.

6. S09 + S14 — the undocumented body-safety guards

_check_body_safety refuses an empty body, and a body under 10% of the remote
length, overridable with --allow-empty / --allow-shrink. These are the main
thing standing between a bad local file and a wiped page and were in no spec.

Documented in S09, where the flags and the implementation live, with a
cross-reference from S14 step 4f rather than duplicating the thresholds in two
places. Tracing the sync path turned up a detail the issue did not have:
sync-space's push calls update_page with no allow_empty/allow_shrink
kwargs, so sync always applies the strict guard with no override available, and a
trip becomes a recorded push failure in the run summary rather than a crash.

S14 step 4c said archive "update[s] the export header"; the code only flips
frontmatter status. Fixed to match, pointing at S27's implementation note.

Meta — S06's counts

"38 specs, 14 research notes" was wrong on both: it is 37 and 15. Rather than
swap in today's numbers, the count is dropped — this sentence is the thing that
just drifted, it will drift again (this batch is touching specs right now), and the
point of the sentence is "there is a lot of prior art and none of it is operator
docs", not a census.

Beyond #54: two things found on the way

S27 contradicted itself. Its Tests bullet said archive "flips frontmatter status
and export header", while its own implementation note correctly says the header is
never touched. The code agrees with the note. Fixed, in its own commit — S27 is not
one of #54's points. Worth having, because S14 now points at S27 as the authority
for exactly this.

Eight --push-triggered blacklist claims neutralised. The #50 fix moves
Confluence blacklist enforcement to the sync/export entry points, so a
blacklisted space aborts regardless of --push. A sweep for the claim rather than
the filename found it in three specs: S14 (three places), S09 (including a restated
copy of S07 §2.6's "local-only export is unrestricted"), and S39 (five places — its
whole precedence argument rested on a pull-vs-push contrast, now reframed onto
coarse-gate-versus-fine-filter, which holds either way).

None of these re-specify the new mechanism; each drops the trigger claim or defers
to S07, so this does not collide with the #50 branch.

Gates

mise run spec-check exit 0 · mise run ci green, 2415 passed, 88.03% coverage.

Refs #54

Co-Authored-By: lsimons-bot bot@leosimons.com