Record two more consequences of the mislabelled Spanish production

Measured on oldbox:

* The UmbraTrans dashboard reports the Spanish lane as "complete".
  project_status.py derives each language's state from the presence and
  chapter count of deal-hunter-<tag>/runs/ch-N/translation.json, and
  deal-hunter-es has 32 of 32. It never looks at what the text says, so a
  directory name and a file count are standing in for a measurement. The
  other nine target languages correctly report not_started.

* A real Spanish run would silently reuse the Chinese translations.
  pipeline.py caches by file existence and the run directory is chosen by
  the caller, so a Spanish run pointed at deal-hunter-es without --force
  would skip drafting and publish the Chinese under a Spanish name.

Neither was fixed here: the UmbraTrans checkout on oldbox is behind and
dirty, and the script check belongs in the same place as the ingest's.

specs/27-translation-pipeline-multipass.md

@@ -299,6 +299,26 @@ delivery ingest now checks the script of the delivered text against the
 declared language and refuses a delivery whose text is written in another
 language (`umbraaudio/languages.py:script_mismatch`).
 
+Two further consequences, both measured on oldbox:
+
+3. **The UmbraTrans dashboard reports the Spanish lane as complete.**
+   `umbratrans_web/project_status.py` derives each language's state from the
+   presence and chapter count of `deal-hunter-<tag>/runs/ch-N/translation.json`.
+   `deal-hunter-es` has 32 of 32, so the status module reports `es-ES` as
+   `complete` - and it never looks at what the text says. The other nine
+   target languages correctly report `not_started`, because their directories
+   do not exist. A status derived from a directory name and a file count is
+   the same "declared value disagrees with the measured value" defect, one
+   layer up: the ingest now checks the script, and the status module does not.
+4. **A real Spanish run would silently reuse the Chinese translations.**
+   `pipeline.py` caches by file existence (`_read` returns the cached JSON
+   unless `--force` is passed), and the run directory is chosen by the caller
+   (`--run-dir`), not derived from `target_language`. So a Spanish run pointed
+   at `productions/deal-hunter-es` without `--force` would find the cached
+   `ch-N-cXXX.draft.json` files, skip the drafting, and publish the Chinese
+   under a Spanish name. Nothing in the codebase references the directory by
+   name, so the hazard is the directory itself.
+
 ## Open questions
 
 1. Which model runs Passes 1-4? This is where the local LLM question returns,