docs(metadata-protocol): re-anchor the remaining dead tracker and comment-id citations in test comments

Stage 2 of the domain:engine lane's dead-citation sweep, packages/metadata-protocol
only: the 22 test-comment sites carrying 13 numbers that answer 404 (which the
census never reads), the dead comment-id citation on two lines, and the dead
convenience PR number beside commit 9632604. Each now cites the commit in
this repository's history that made the decision the sentence describes
(ruling C+D form C). Comment prose only; every file keeps its line count.

Claude-Session: https://claude.ai/code/session_017xfMoEjKUuSh2xYB8sCozp
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/metadata-protocol/src/discovery-schema-conformance.test.ts

@@ -303,7 +303,7 @@ describe('[#4828] getDiscovery() conforms to DiscoverySchema', () => {
       expect(DiscoverySchema.safeParse(discovery).success).toBe(true);
     });
 
-    // [#6287] `preview` left this list when it stopped being unrecognised: it is
+    // [commit 84c86fb45] `preview` left this list when it stopped being unrecognised: it is
     // a declared `EnvironmentTypeSchema` member and now has a stated fold
     // (`sandbox`), so asserting `development` for it here would assert the
     // opposite of the mapper's decision. The RULE these rows pin — an unknown

packages/metadata-protocol/src/get-meta-item-org-read-gate.test.ts

@@ -7,7 +7,7 @@
  *
  * ── The defect, and why the singular verb is the sharper half ─────────────
  *
- * Commit 96326040f (PR #14767) moved {@link organizationIdForMetaRead} INSIDE the PLURAL
+ * Commit 96326040f moved {@link organizationIdForMetaRead} INSIDE the PLURAL
  * verb, `getMetaItems`, and deliberately did not carry to this one. There, the
  * two `queryByOrg` reads are UNIONed, so an ungated organization can only ADD
  * rows — the resurrection that card is about. Here the two `findOverlay` reads

packages/metadata-protocol/src/get-meta-items-org-read-gate.test.ts

@@ -121,7 +121,7 @@ function makeHarness(rows: StoredRow[]) {
                     return (r as unknown as Record<string, unknown>)[k] === v;
                 }),
             );
-            // `check:objectql-double-limit` (#10978) — hold the caller's bound,
+            // `check:objectql-double-limit` (commit 4c9780c7a) — hold the caller's bound,
             // applied AFTER the filter and BY PRESENCE.
             return opts?.limit === undefined ? matched : matched.slice(0, opts.limit);
         },

packages/metadata-protocol/src/meta-overlay-cache.test.ts

@@ -176,7 +176,7 @@ function makeHarness(rows: StoredRow[], options: HarnessOptions = {}) {
                     return (r as unknown as Record<string, unknown>)[k] === v;
                 }),
             );
-            // `check:objectql-double-limit` (#10978) — hold the caller's bound,
+            // `check:objectql-double-limit` (commit 4c9780c7a) — hold the caller's bound,
             // applied AFTER the filter and BY PRESENCE. A double that hands
             // back every row it matched cannot tell a dropped bound from no
             // bound at all.

packages/metadata-protocol/src/migrations/read-probe.test.ts

@@ -30,7 +30,7 @@
  * instead. The MySQL arm runs against a real server in
  * \`seed-tenancy-backfill.live-mysql.test.ts\`; the SQLite arm end to end against
  * a real \`SqlDriver\` in \`packages/runtime\`'s
- * \`seed-tenancy-autonumber-split.integration.test.ts\`; and [#17621] the POSTGRES
+ * \`seed-tenancy-autonumber-split.integration.test.ts\`; and [commit 7e74af3df] the POSTGRES
  * arm — recorded here as NOT MEASURED anywhere for as long as that was true —
  * now runs in \`seed-tenancy-backfill.live-postgres.test.ts\`, on the postgres
  * service the \`Temporal Conformance\` job already provisions. All three arms are

packages/metadata-protocol/src/migrations/seed-tenancy-backfill.live-postgres.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * #17621 — the seed-tenancy backfill's statements, RUN on a live PostgreSQL.
+ * Commit 7e74af3df — the seed-tenancy backfill's statements, RUN on a live PostgreSQL.
  *
  * ## The gap this closes
  *
@@ -52,7 +52,7 @@
  * uses) and reports a named SKIP without one — never a silent pass. A runner
  * that knows it provisioned the server sets `OS_EXPECT_LIVE_DIALECT_MATRIX=1`,
  * which turns the missing URL into a failure, so a dropped `env:` line cannot
- * quietly return this seam to the no-coverage state #17621 records.
+ * quietly return this seam to the no-coverage state commit 7e74af3df records.
  *
  * ## Isolation — a per-file SCHEMA, and why the resolver is the MySQL-named one
  *
@@ -253,7 +253,7 @@ describe.skipIf(!PG_URL)('#17621 seed-tenancy backfill on a LIVE PostgreSQL', ()
     const statements: Array<[string, string, unknown[]]> = [
       ['presence probe (fallback arm)', buildSequencesPresenceSql(c), []],
       // The statement the boot path actually runs now. It is in this list for
-      // the reason every other one is here, and #17621 exists because it was
+      // the reason every other one is here, and commit 7e74af3df exists because it was
       // the ONE arm this list could not previously contain.
       ['presence probe (catalog arm)', buildTablePresenceSql(SEQUENCES_TABLE, c) as string, []],
       ['split probe', buildSplitProbeSql(c), [GLOBAL_TENANT, GLOBAL_TENANT]],

packages/metadata-protocol/src/protocol-publish-drafts-closure.test.ts

@@ -35,7 +35,7 @@
  * The `objects` and `permissions` gaps are the same defect at advisory
  * severity: they do not refuse, they manufacture findings that describe
  * nothing. Both are pinned below, because a closure that is uniform is the
- * property #9612/#10058 declared and a per-collection patch is what produced
+ * property #9612/commit 6f5a44976 declared and a per-collection patch is what produced
  * this card.
  *
  * ## The discriminating tests are the ones that expect SILENCE

packages/metadata-protocol/src/protocol-publish-drafts-object-field-refs.test.ts

@@ -244,7 +244,7 @@ describe('publishPackageDrafts refuses a dangling object field-name list (#15254
         expect(causal.code).toBe('INVALID_METADATA');
 
         // …with a rule id and the offending path, which is what has to reach
-        // the author's screen. The path is name-keyed on the wire (#10064) —
+        // the author's screen. The path is name-keyed on the wire (commit def0d3e63) —
         // `objects.<name>.<key>[i]`, never the gate's private snapshot index.
         const wire = JSON.stringify(causal);
         expect(wire).toContain('object-field-ref-unknown');

packages/metadata-protocol/src/protocol.batch-row-http-status.test.ts

@@ -543,7 +543,7 @@ describe('[#14723] section 7 — a `DuplicateRecordError` row reports `UNIQUE_VI
     });
 
     it('[GUARD] a producer that merely SPEAKS `DUPLICATE_RECORD` is not the engine\'s envelope and keeps its own code', async () => {
-        // The same discrimination the whole-request arm makes (#14389 §5):
+        // The same discrimination the whole-request arm makes (commit 10220a7bf):
         // the gate is the registered code AND the class name. A hook throwing
         // the registered member from its own body is a different producer
         // speaking a member of the vocabulary; the verbatim rule still applies.

packages/metadata-protocol/src/protocol.datasource-delete-prolongation.test.ts

@@ -17,7 +17,7 @@
  * re-verification carrier: re-measure the prolongation once that fix lands, and
  * close only on the measurement.
  *
- * The re-verification (PR #14431) found that #13331 closes the registry-heal
+ * The re-verification (commit a98b61b3e) found that #13331 closes the registry-heal
  * half but opens a SECOND gap on the read-in-window path (see "Arms" below,
  * preserved as history). Ruling A′ (2026-09-03, director batch #22, comment
  * 5528370129) ordered the fix for that gap: `applyRemoteMetadataMutation`
@@ -110,7 +110,7 @@
  *      writes the deleted row straight back into the registry the bridge
  *      just healed — and the registry has no TTL.
  *
- * So the prolongation was — PR #14431's finding, kept as history below —
+ * So the prolongation was — commit a98b61b3e's finding, kept as history below —
  * neither unconditionally bounded nor unconditionally unbounded, and the
  * discriminator was not time but TRAFFIC:
  *
@@ -132,7 +132,7 @@
  * one. The bounded arm is the quiet-replica arm.
  *
  * ---------------------------------------------------------------------------
- * Why the re-hydration USED TO happen, precisely (history — PR #14431)
+ * Why the re-hydration USED TO happen, precisely (history — commit a98b61b3e)
  * ---------------------------------------------------------------------------
  * Nothing on the bridge's receipt path touched the WRITE EPOCH that keys the
  * overlay cache. `applyRemoteMetadataMutation` re-read the row and repaired the
@@ -180,7 +180,7 @@
  *     re-derived (the dispatch forbids re-deriving that finding).
  *  3. list-cache TTL (#5109) ............. RE-MEASURED, then CLOSED. At this
  *     door the cache is `meta-overlay-cache`, not `MetadataManager.listCache` —
- *     PR #14431 found it did not merely delay the correct answer, it FED the
+ *     commit a98b61b3e found it did not merely delay the correct answer, it FED the
  *     untimed registry, converting a 30s residue into an unbounded one on any
  *     read landing in the window. Ruling A′'s bump on the receipt path retires
  *     this cache at the moment of convergence, so the read that follows has
@@ -691,7 +691,7 @@ describe('[#13609] ⭐ the re-verification: how long does the peer keep serving
 
         // `measureProlongationMs` reads the door once BEFORE advancing the
         // clock — i.e. inside the residue window, which is what a replica
-        // under load does continuously. Previously (PR #14431) that read
+        // under load does continuously. Previously (commit a98b61b3e) that read
         // converted the bounded cache residue into an unbounded registry
         // entry. Now the convergence bump has already retired the cache
         // before this first read runs, so the read-in-window traffic