[docs] distinguish frozen destinations from generated board paths

Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>

Author: yyods

docs/specifications/firmware/TDD.md

@@ -2436,6 +2436,15 @@ pico-sdk, BTstack and its actually linked third parties, CYW43, TinyUSB, and
 every contributing ARM GNU/newlib runtime archive. Deleting or substituting
 one class fails even when the remaining evidence is canonically rehashed.
 
+ESP frozen-payload tests MUST reach the production observer with a real
+descriptor-captured retained board layout and literal manifest selections.
+They distinguish a flat workspace destination from its canonical-source-relative
+`pyble/` copy, and preserve already-prefixed and historical package selections.
+Missing nested copies, matching flat decoys, stale bytes, file/directory
+symlinks, and duplicate frozen destinations are rejection cases. The existing
+lock-generated version exception and overlay byte checks remain independently
+covered; tests must not replace the snapshot or byte comparison with a model.
+
 RP2 environment-proof tests MUST run the actual checked-in build driver through
 the production Arm observer's parser boundary. They separately cover the strict
 `unset` command and the exact pinned offline CMake assignment/export block,

docs/specifications/firmware/browser-flashing.md

@@ -1573,6 +1573,19 @@ The following ESP-IDF resolution rules are part of that fail-closed mapping:
    tree; materializing such an ambient tree is neither an audit prerequisite
    nor substitute evidence for bytes used by the build.
 
+   A frozen destination is not necessarily its generated board source path.
+   `prepare.sh` materializes a selected canonical `firmware/pyble/<relative>`
+   source at `BOARD_DIR/pyble/<relative>`, independently of the manifest's
+   destination. In particular, the flat frozen `pyble_workspace.py` destination
+   uses `BOARD_DIR/pyble/pyble_workspace.py`; already-prefixed `pyble/...`
+   destinations MUST NOT gain a second `pyble/` prefix. The audit MUST derive
+   that physical copy path from the canonical source-relative path, retain the
+   original frozen destination, and compare the exact retained copy bytes.
+   A flat matching decoy cannot replace a missing or changed nested copy.
+   The lock-generated `_version.py` exception, overlay copies, separately
+   admitted first-party modules, and upstream selections keep their existing
+   validation rules.
+
    The collector MUST open every component of that exact retained `BOARD_DIR`
    descriptor-relatively without following links, capture its complete bytes
    and node identities, and materialize a byte-identical execution snapshot in