Say that the Default Setup config schema reflects what Default Setup is known to send

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

src/config/db-config.ts

@@ -87,9 +87,9 @@ export interface UserConfig {
 }
 
 /**
- * A subset of the `UserConfig` schema that is used by Default Setup. None of these properties may
- * add queries, since a per-language CodeQL bundle can be used with a `config` input that only sets
- * them.
+ * A subset of the `UserConfig` schema that is known to be used by Default Setup. None of these
+ * properties may add queries, since a per-language CodeQL bundle can be used with a `config` input
+ * that only sets them.
  */
 const DEFAULT_SETUP_CONFIG_SCHEMA = {
   "threat-models": json.optional(json.array(json.string)),
@@ -99,8 +99,9 @@ const DEFAULT_SETUP_CONFIG_SCHEMA = {
 } as const satisfies json.Schema;
 
 /**
- * Returns whether `config` is a mapping that only sets the properties that Default Setup sets in
- * the `config` input, to valid values.
+ * Returns whether `config` matches what we expect Default Setup to send in the `config` input: a
+ * mapping that only sets properties in `DEFAULT_SETUP_CONFIG_SCHEMA`, with values of the expected
+ * types.
  */
 export function matchesDefaultSetupConfigSchema(config: UserConfig): boolean {
   // Unless validation is enabled, `parseUserConfig` doesn't check that the YAML is a mapping.

src/per-language-bundles.ts

@@ -58,8 +58,8 @@ export interface QueryConfigInputs {
  * query packs are downloaded together with their dependencies.
  *
  * Any configuration file is assumed to configure such queries, since reading it may need file or API
- * access. So is the `config` input, unless it only sets the properties that default setup sets (see
- * `matchesDefaultSetupConfigSchema`).
+ * access. So is the `config` input, unless it only sets the properties that default setup is known
+ * to set (see `matchesDefaultSetupConfigSchema`).
  *
  * @throws A `ConfigurationError` if the `queries` input or the `github-codeql-extra-queries`
  *   repository property is a '+' with no queries after it, unless an input that's checked earlier
@@ -76,7 +76,7 @@ export function getOtherLanguagePacksReason(
   }
 
   // The `config` input can configure queries in the same way as a configuration file. The
-  // properties that default setup sets, listed in `DEFAULT_SETUP_CONFIG_SCHEMA` in
+  // properties that default setup is known to set, listed in `DEFAULT_SETUP_CONFIG_SCHEMA` in
   // `config/db-config.ts`, don't add queries.
   if (
     inputs.configInput !== undefined &&