docs(cli): re-anchor the dead tracker citations in packages/cli's files outside src to the commits that decided them (#20883)

Part of #20594
Clause-②: no

## What changed

This is stage 14 of the `domain:cli` lane's dead-citation sweep. It
covers the lane packages' tracked files outside `src/**`, the card's one
remaining stage (claim `5911994187`): `README.md`, `tsconfig*.json`,
`vitest.config.*`, `tsup.config.*` and each package's `test/**`.

The census at the stage's base `660a9b247e` counts **270 dead comment
sites** on that surface. That is over the claim's 40-site line, so this
stage takes the largest package, **`packages/cli`**. Every other package
is listed below with its count.

In `packages/cli`, every comment site on that surface that cited a
tracker number answering 404 now cites a commit instead. Following
ruling C+D's form C (comment `5749154545` on #19123), it is the commit
in this repository's history that decided what the line describes.
Stages 1 to 13 of this card are the precedents; the latest are PR #20767
and PR #20842.

- **154 sites on 149 lines in 56 files**, covering **51 numbers**, now
cite **50 distinct commits**. The 56 files are `vitest.config.ts`,
`tsconfig.test.json` and 54 files under `test/**`: 50 test files,
`helpers/serve-process.ts` and 3 fixtures.
- **Comments only.** 150 lines out and 150 in, and every file keeps its
line count.
- One of the 150 is a companion line: `generate-skill.e2e.test.ts:35`,
"both pass" becomes "both passed".
- Its anchor, commit `3c418c498`, rewrote the two `@example` blocks the
sentence is about. A present tense beside that citation would contradict
it.
- **5 sites have no deciding commit** and are left as they were (see
"The sites left").
- **No tracker number is added.** The 12 numbers still on changed lines
were already on the removed lines, and all 12 answer 200: #5286, #5728,
#10678, #11391, #11643, #11772, #12047, #13158, #14554, #16483, #16888
(kept as a convenience link beside its commit) and #17978.
- **No ADR or ruling record carries any of these decisions.** A grep of
`docs/adr` and `scripts/adr-anchors` finds 0 hits for the 54 numbers and
0 for the 50 shas. The control `7329` finds 1 file in the same tree. So
every anchor is a commit.
- Where an earlier stage gave a number an anchor and the line here
describes the same decision, the same anchor is reused. That covers 33
of the 51 numbers (for `#13504`, the tier half only), read by pairing
the landed stages' removed and added lines. The other 18 anchors are
new.

## Census, per package

**Instrument.** The card's gate does not read these files. Its declared
surface is `packages/**/src/**`, and `surfaceFor` answers null for all
56 touched paths; the control `packages/cli/src/commands/init.ts`
answers `package-docblocks`. So the census is taken by hand, with the
gate's own grammar:
- **Files:** every tracked file of the 19 lane packages outside
`src/**`, `CHANGELOG.md` excluded. That is 534 files.
- **Extraction:** `extractCitations` from
`scripts/check-issue-citations.mjs`, whole-file. Its comment-prose
projection decides comment versus string.
- **Numbers kept:** only those naming this repository.
- **Probe:** each distinct number is probed by REST, `GET
/repos/objectstack-ai/objectstack/issues/N`.

**Probes:**
- **Before**, at base `660a9b247e`, 2026-09-30T13:15:23Z to 13:16:12Z:
889 numbers. 794 answer 200 and 95 answer 404.
- **After**, at head `fda0702246`, 15:00:12Z to 15:01:16Z: 864 numbers.
794 answer 200, 69 answer 404, and one answered 502. That one was
#11267; re-probed twice at 15:01:23Z, it answers 404.
- No number present in both probes changed its answer.
- Citation sites went from 3,634 to 3,480, a drop of exactly the 154
rewritten sites.

Dead sites per package. "Comment" is this stage's surface. "String"
means a string, a `describe`/`it` title or a message on the same file
list; those belong to #20752 (form D) and are untouched. "Off-list"
means files outside the claim's file list; they are untouched and listed
below.

| package | comment, before → after | string (unchanged) | off-list
(unchanged) |
|---|---|---|---|
| `cli` | **159 → 5** | 42 | 41 |
| `qa/dogfood` | 94 → 94 | 28 | 0 |
| `plugin-hono-server` | 4 → 4 | 0 | 2 |
| `plugin-dev` | 2 → 2 | 0 | 0 |
| `client` | 2 → 2 | 0 | 1 |
| `qa/vitest-filter-preflight` | 2 → 2 | 0 | 1 |
| `cloud-connection` | 1 → 1 | 0 | 0 |
| `mcp` | 1 → 1 | 0 | 1 |
| `qa/downstream-contract` | 1 → 1 | 0 | 0 |
| `rest` | 1 → 1 | 0 | 7 |
| `runtime` | 1 → 1 | 0 | 1 |
| `types` | 1 → 1 | 0 | 0 |
| `verify` | 1 → 1 | 0 | 0 |
| `qa/http-conformance` | 0 → 0 | 0 | 1 |
| `observability`, `client-react`, `create-objectstack`,
`adapters/hono`, `qa/refd-timer-testkit` | 0 → 0 | 0 | 0 |
| **total** | **270 → 116** | 70 | 55 |

- **`tsconfig*.json` string values: none.** Every dead site in a
`tsconfig*.json` sits in a `//` comment, and these files are JSONC.
  - **Taken here:** cli's `tsconfig.test.json:1`.
- **Still dead:** `verify/tsconfig.test.json:1` (#15145),
`plugin-dev/tsconfig.test.json:3` and `:56`, and
`plugin-hono-server/tsconfig.test.json:3` and `:61` (#13176),
`plugin-hono-server/tsconfig.typecheck.json:12` (#11332, #10724), and
`client/tsconfig.json:8` (#12181).
- **No `README.md`** in any lane package cites a dead number.

## Per-number anchors

`sites` counts the rewritten sites for each number. Each anchor was
checked by blame, and in its message or its diff. The "what it decided"
column is what the lines describe.

| number | sites | anchor | what it decided |
|---|---|---|---|
| `#6217` | 4 | `2b641ddd4` | `--json` reserves stdout for the payload
across the `bootSchemaStack` family (its message closes the card) |
| `#10152` | 1 | `ad492e7fd` | wrote the measured suite-cost section
this heading opens (a later commit's message pairs the card with this
PR) |
| `#10323` | 1 | `5a616d558` | `create-objectstack` derives "Created
files" from the finished project |
| `#10324` | 3 | `ecd06f613` | self-contained starter comments, and
creates `starter-comments-self-contained.test.ts` |
| `#10326` | 1 | `675ab574e` | the two benign peer skews declared inside
the scaffold (stage 3's anchor) |
| `#10359` | 4 | `15b63e85a` | retires `os g agent` (stage 3's anchor) |
| `#10366` | 1 | `bbe643c08` | gates plugin-auth's localhost
trusted-origin substitution to non-production (the plugin-auth stage's
anchor) |
| `#10498`, `#10499` | 1, 4 | `6d441e41f` | its squash carries both: the
measured pnpm boundary, and the gate between the two scaffold paths |
| `#10504` | 5 | `ff5733e03` | `UI: 0 Apps` instead of a dropped row;
records the triage ruling |
| `#10557` | 2 | `818e02700` | init's "Created files" summary after
install, and the `create-objectstack` alias |
| `#10763` | 1 | `c2b97c2a1` | `os package publish` prints the server's
reason (stage 3's anchor) |
| `#10917` | 7 | `7940de5e0` | retires the `@capabilities` hook-body
directive |
| `#10926` | 1 | `d173125fb` | the ruling commit stage 3 and the spec
stages used for this number |
| `#10931` | 2 | `afe1c4e0a` | declares the four `@better-auth/utils`
peer skews |
| `#10943` | 1 | `46d34ab7c` | `fallbackImport` becomes a
caller-supplied parameter |
| `#10952` | 6 | `0d4bd93e7` | every summary section prints its zero
state |
| `#10953` | 2 | `be7262e72` | the four structural advisories in `os
validate --json` |
| `#11022` | 2 | `21756b325` | adds the fifth `MONOREPO_ONLY` pattern |
| `#11025` | 3 | `1c3a46f87` | `os g skill` writes `NAME.skill.ts` |
| `#11026` | 2 | `3c418c498` | rewrites `skill.zod.ts`'s two `@example`
blocks off `triggerPhrases`; its changeset names the number |
| `#11071` | 7 | `50fb191dc` | derives every `os generate` filename from
the registry (its message closes the card, and measures the loader) |
| `#11157` | 4 | `a4cb7817f` | `serve` hands the host importer its own
base |
| `#11172` | 2 | `05181e8cc` | keeps the `Runtime:` row and stops
counting an unrendered metric |
| `#11174` | 1 | `ab23c67ab` | `os validate --json --strict` exits 1 |
| `#11267` | 19 | `1ddda1d00` | introduces `childEnv()`, the measurement
table and `serve-process-child-env.e2e.test.ts`; its message names the
card twice |
| `#11268` | 4 | `918988ad3` | the PR itself; its squash changes
`turbo.json` to `@objectstack/cli#test` `dependsOn: ["build"]` |
| `#11671` | 1 | `09b4f4e4e` | the source-hashes provenance companion
(every earlier stage's anchor) |
| `#12125`, `#12285` | 7, 1 | `79cf692b0` | carries `conversions` on
every failure exit. `#12285` is this commit's own PR. Its message
withholds the fold question, which is what 3 of the lines say |
| `#12297` | 3 | `9fd45a952` | `os lint` surfaces conversion notices
(stage 3's anchor) |
| `#12964` | 4 | `e6fd1caf7` | names the missing build output; its
changeset names the number, and it holds both halves |
| `#13109` | 2 | `8b236c826` | matches i18n-extract's walk to
`translatePage`'s |
| `#13112` | 1 | `e7191ce71` | per-condition `types` targets in the
dual-build packages; its changeset names the number |
| `#13193` | 1 | `faff497fd` | `os serve` writes the state file before
it announces the port |
| `#13218` | 1 | `c45d8e6b4` | exports the addressed-component walk; its
changeset says "ruled 2026-08-30" |
| `#13504` | 4 | `55519d503` | the measurement half: attributes the
`import` term per file (`vitest.config.ts:82`, `:261`, `:263`, `:359`) |
| `#13504` | 5 | `44813ba57` | the tier half: the named `unit` /
`integration` split and the partition pin (`:496`, `:541`, `:677`,
`:831` and `vitest-tiers-partition.test.ts:5`; the qa stage's anchor) |
| `#13651` | 1 | `ada3834ad` | the silent hook-body downgrade becomes a
lint verdict (stage 3's anchor) |
| `#14336` | 2 | `79c71d29d` | object / view / action / app scaffolds
`os validate` accepts |
| `#14710` | 2 | `95fdf627b` | wires the test layer into
`check:test-typecheck` |
| `#14715` | 1 | `accb9231c` | the PR itself; keeps the exit-2 assertion
for the never-read reader |
| `#14811` | 1 | `8ad872ba3` | sweeps every `os explain` catalog entry;
its diff adds this heading |
| `#14817` | 2 | `5529a374e` | puts the three platform record pages
under an i18n gate; its message records the harm |
| `#14824` | 6 | `cf6b67164` | `os create` emits a project that installs
outside the monorepo (stage 3's anchor) |
| `#14858` | 5 | `0c5e97368` | a closed stderr read end exits 2 |
| `#15150` | 5 | `cc986c913` | the sixth `MONOREPO_ONLY` pattern (the
create-objectstack stage's anchor) |
| `#16330` | 2 | `4998efa71` | the blank template's CI workflow, with
`lint` (the create-objectstack stage's anchor) |
| `#16350` | 2 | `68aee4c99` | `os init` writes a `lint` script; its
diff adds the pin that cites the number (PR #16888 kept beside it) |
| `#16721` | 1 | `51ae73123` | `LiteKernel.use()` enforces the plugin
contract (the plugin-hono-server stage's anchor) |
| `#17080` | 1 | `8b4890343` | the per-release `spec-changes.json`
section (its message closes the card) |
| `#17853` | 2 | `08f5f0e5a` | a vitest filter that selects nothing says
so (the qa stage's anchor) |

**Anchor checks:**
- **Each sha is unambiguous:** it matches exactly one object (`git
rev-parse --disambiguate`, count 1 for each of the 50).
- **Each is a plain commit** with one parent.
- **Each is on the base:** `merge-base --is-ancestor` against
`660a9b247e` exits 0 for all 50.
- **The history is complete:** the checkout is not shallow.
- **Control legs:** the parent of the oldest anchor, `8e13ca8764` (the
parent of `2b641ddd4`, 2026-08-08), exits 0. The negative control, the
base as an ancestor of `2b641ddd4`, exits 1.

**Wordings to check, each true of its commit:**
- **A defect named by its number now says so:** "The defect commit
79cf692 fixed — ...".
- **A card's words stay the card's.** Where a line quotes what a card
said or asked, it now says "commit X's card". That is
`vitest.config.ts:263`, `:359` and `:541`, and
`published-subpath-hook-body.pin.test.ts:28`.
- **The #12125 fold question:** "the same question commit 79cf692 left
open", "commit 79cf692 explicitly withheld an answer". The commit's
message reads: "`warnings` and `conversions` are deliberately NOT
folded: whether they should become one field is a live question the
ruling did not address."
- **Ruling dates:** `platform-page-i18n-parity.test.ts:163` keeps its
ruling date as "(the 2026-08-30 ruling)".
- **Headings with a dash rule** keep their width by trimming the rule.
The exception is `commands.test.ts:181`, which keeps a 2-character rule
and grows by 6.

## The sites left

**No deciding commit (5 sites).** The claim says to list them, not
guess.
- **`vitest.config.ts:221` (#10149):** "the outer fan-out ... is a
property of the shard, decided in `ci.yml`".
- Only two commits name the number. `cc21aad8ed` is a measurement that
says "Part of" and leaves the decision to the maintainer. `d18bc32770`
cites the card's recorded reasoning.
- Neither decides it, and the commit that wrote the line (`ad492e7fd`)
only cites it.
- **`test/init.test.ts:189` (#11048):** "Admitting that band is a
support decision".
- It names an open decision (pnpm 10.0 to 10.4), and the floor is still
pnpm 10.15 or later at the base.
- Stage 3 and the create-objectstack stage left the sibling sites for
the same reason.
- **`published-entry-stderr-error-listener.test.ts:11` and `:150`, and
`published-subpath-hook-body.pin.test.ts:35` (#14874):** "npm packs a
`bin` target regardless of `files`".
- No commit message names the number. The commits that add it
(`95d5cbb31`, `b3ef687c0`) only cite it.
- `5023630b1`'s changeset records the same measurement but names no
number, so the link is not proven.

## Not in this stage

- **The other lane packages**, 116 dead comment sites in total: see the
census table.
- **String sites (70, form D, #20752, not moved):**
- **`cli`, 42 sites in 24 test files.** Examples: `describe('#12125 —
...')` in `build-json-failure-conversions.e2e.test.ts:300`, `:459` and
`:557`, and `describe('[#11025] ...')` in
`generate-skill.e2e.test.ts:203`.
- **`qa/dogfood`, 28 sites in 13 test files**, including
`authz-conformance.matrix.ts:429` (3 numbers in one string).
- **Off-list files (55 sites):**
- **`cli`:** `bin/run-dev.js` 6 and `bin/run.js` 4 (comments;
`bin/run.js` ships). `scripts/check-app-nav-i18n.mjs` has 13 comment and
14 string sites. `vitest-tiers.ts` has 2 and `vitest-tiers.fixtures.ts`
1 (comments). `test-typecheck-debt.json` has 1 (string).
  - **`plugin-hono-server`:** `objectstack.config.ts` 2.
- **`test-typecheck-debt.json` strings:** `rest` 7, and 1 each in
`runtime`, `mcp`, `client` and `qa/http-conformance`.
- **`qa/vitest-filter-preflight`:** `package.json` 1 (the description
string).

## Mechanical guard: no code token moves

The check compares the TypeScript parser's leaf tokens of the 56 changed
files at base `660a9b247e` against head `fda0702246`. It walks with
`getChildren`, excludes JSDoc nodes, and treats comments as trivia.
`tsconfig.test.json` is compared by its parsed JSONC value. Controls
mutate the head text in memory only.

| run | result | exit |
|---|---|---|
| real diff | 86,550 base tokens, **0 files differing** | 0 |
| comment-insertion control | 0 differing | 0 |
| code-insertion control | 56 of 56 differ | 1 |
| string control (one character flipped in each file's first real
`StringLiteral`) | 56 of 56 differ (55 first at a `StringLiteral`, plus
the JSON value) | 1 |

A raw scan of the 56 changed files for control bytes finds none. Its
positive control, a scratch file holding a U+0001 byte, matches 1.

## Changeset: none (`skip-changeset`)

`@objectstack/cli`'s published set is `files: ["dist", "README.md",
"CHANGELOG.md"]`, plus the `bin` target npm packs regardless of `files`.
No touched path is in it:
- `dist` is built from `tsconfig.build.json` (`rootDir: "src"`,
`include: ["src"]`).
- `bin/` is not touched.

Measured on the built package at head, 3 phrases the change adds occur
in 0 files of `dist`:
- "commit 55519d5's card"
- "the two templates commit cf6b671 repaired"
- "commit 1ddda1d"

The positive control, a `src` docblock phrase ("already drifted once
(closed by commit 6d441e4)"), occurs in `dist/commands/init.js`.

## Tests (head `fda0702246`, `os-verify-lock` with
`OS_VERIFY_LOCK_SLOT=issue-20594-outsidesrc`)

- **Closure build.** `pnpm --workspace-concurrency=2 --filter
'@objectstack/cli...' build` → VERDICT command-exit 0.
- **Unit tier.** `pnpm --filter @objectstack/cli exec vitest run
--project unit --maxWorkers=2` → VERDICT 0, Test Files 237 passed (237),
Tests 3370 passed (3370). The unit tier holds 23 of the 50 touched test
files.
- **Queue integration tier.** The one touched file ran by name:
`--project integration
test/published-entry-stderr-error-listener.test.ts` → 1 file, 6 tests
passed.
- **Nightly tier.** The other 26 touched test files ran by name under
`OS_TEST_TIERS=nightly`, in 4 runs: 9 files / 87 tests, 6 / 74, 6 / 22
and 5 / 22, each VERDICT 0 and all passed.
- **Coverage.** Every touched test file ran.
- **Typecheck.** `pnpm --filter @objectstack/cli typecheck` → VERDICT 0.
- It runs `tsc --noEmit` and then `check:test-typecheck`, which reports
"3 file(s) / 28 error(s) / 6 pinned signature(s) held in
test-typecheck-debt.json". That is the ledger as it stands at the base,
unchanged.
- **Whole workspace.** `pnpm exec turbo run build
--filter='./packages/*' --filter='./packages/*/*' --concurrency=2` →
VERDICT 0, 71/71 tasks. This was needed by the two gates that read built
output.
- **Reverse verification: none.** A comment-only change has no behaviour
to invert. The token guard's controls are the sensitivity proof.

## Gates (head `fda0702246`)

- **Derivation.** `node scripts/pm/dispatch-gates.mjs --repo
objectstack-ai/objectstack --commands` derives 49 families.
  - All 49 ran, and every recorded exit code is 0.
  - Three needed a second run, each for a reason outside the diff:
- `check:dual-build-cjs-loads` refused with exit 3 (PREREQUISITE NOT
MET, no `dist` for 9 packages). After the whole-workspace build it exits
0.
- `check:query-options-erasure` hit my 300 s cap on a contended box.
Rerun, it exits 0 in 363 s ("ratchet holds ... none new").
- `check:type-check-debt` refused with exit 3 (no built `objectql`).
After the build it exits 0 ("none above its recorded number").
- **Reconciliation.** `--ran`: 49 derived, 49 run, 0 NOT-MEASURED, 0
UNRUN.
- **Issue citations, diff mode.** `node
scripts/check-issue-citations.mjs` → 0 citations added.
- **Lint.** `pnpm lint` (`eslint . --no-inline-config`, repo-wide) →
exit 0, 2026-09-30T14:56:17Z to 15:00:01Z, at `fda0702246`.

## Acceptance notes

- **`origin/main` moved 14 commits past the base (to `9905e61ca2`), and
the branch was not merged forward.**
  - Of the files those commits touch, 0 are among this PR's 56.
- The derived family set on `9905e61ca2` with this diff applied (a
throwaway detached worktree, since removed) is the same 49 commands.
  - The merge-ref CI and the queue cover the joint tree.
- **Five nearby wordings still read as before, because they are not
sites:**
- `print-metadata-stats-zero-row.test.ts:101` says "That card" and
`:184` "that card's head". Both now follow a commit citation and mean
the card behind it.
- The `it` title at `generate-skill.e2e.test.ts:269` says both spec
`@example` blocks "still pass" `triggerPhrases`. That is stale since
`3c418c498`, but it is a test string and belongs to form D.
- **The #14874 wording repeats in `bin/run.js:225` and three
`scripts/check-changeset-no-major.mjs` sites.** Both are outside this
surface; `scripts/**` is #15809's lane.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01VvcEokUG1tvVxkceYfR5XB)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

packages/cli/test/artifact-pinned-boot.e2e.test.ts

@@ -126,7 +126,7 @@ function runServe(env: Record<string, string>, opts: { migrateAndExit?: boolean
                 // `childEnv`, not a bare `...process.env`: the vitest worker
                 // exports `TEST=true`, and better-auth 1.7.1 reads it directly
                 // to switch its own origin/CSRF validation OFF in the child —
-                // see `helpers/serve-process.ts` for the measurement (#11267).
+                // see `helpers/serve-process.ts` for the measurement (commit 1ddda1d00).
                 // This boot exits at `kernel:ready` (`OS_MIGRATE_AND_EXIT`) and
                 // never answers a request, so nothing here CHANGES; it is the
                 // hygiene half, so the next assertion added to this file starts

packages/cli/test/build-json-advisory-parity.e2e.test.ts

@@ -4,8 +4,8 @@
  * #11727 — `os build --json` dropped the #3366 capability-provider hints and
  * the ADR-0046 package-docs advisories that `os validate --json` carries.
  *
- * The fourth measured instance of one class in these two files (#10953,
- * #11174, #11643, this): an advisory computed and then formatted *inside* an
+ * The fourth measured instance of one class in these two files (commit be7262e72,
+ * commit ab23c67ab, #11643, this): an advisory computed and then formatted *inside* an
  * `if (... && !flags.json)` print block, which puts it structurally out of
  * reach of the payload — computed, then discarded, for the one audience
  * `--json` exists to serve. Measured at `origin/main` 589758d22 over the

packages/cli/test/build-json-failure-conversions.e2e.test.ts

@@ -15,7 +15,7 @@
  * to appear exactly ONCE — the payload now carries the notice, and the terminal
  * gains no second stderr line for it.
  *
- * #12125 — `os build --json`'s FAILURE payloads dropped the `conversions` field
+ * The defect commit 79cf692b0 fixed — `os build --json`'s FAILURE payloads dropped the `conversions` field
  * the run had ALREADY COMPUTED, on all nine of its failure exits.
  *
  * The same "computed, then dropped on a failure exit" shape as the `warnings`
@@ -523,7 +523,7 @@ describe('#12125 — the contract is exhaustive over `compile.ts`, not just over
     // The one integer left, and it rots only in the direction that has to be
     // reviewed anyway: exits being REMOVED. Ten is the population the ruling in
     // this file's header was made over — nine failure exits plus the terminal
-    // success payload, the count `#12285` pinned on the day it landed — not a
+    // success payload, the count commit 79cf692b0 pinned on the day it landed — not a
     // count of today. (Today is eleven: the tenth FAILURE exit is ADR-0130 D4's
     // per-package author-time rule leg, #14439, a multi-package artifact
     // running the same rule table once per package. It arrived after the ruling

packages/cli/test/build-warning-truncation-notice.test.ts

@@ -15,7 +15,7 @@
  * notice is indistinguishable from a complete one, so an author who reads it
  * and sees their file is clean has read a list that stopped early. Same shape
  * as the dropped summary rows pinned in `print-metadata-stats-zero-row.test.ts`
- * (#10504, #10952): output that cannot distinguish "none" from "not shown".
+ * (commits ff5733e03, 0d4bd93e7): output that cannot distinguish "none" from "not shown".
  *
  * WHAT THESE PINS ASSERT — the pair, not the cap. A test that only checked
  * "50 entries printed" passes on the silent tree and pins nothing. So the

packages/cli/test/commands.test.ts

@@ -132,7 +132,7 @@ describe('os explain — schema catalog accuracy', () => {
   // The catalog's element shape, stated locally: `SchemaInfo` is not exported,
   // and these tests must stay honest even where `SCHEMAS` widens to `any`.
   // ⚠️ The reason recorded here has CHANGED and the discipline has not. This
-  // file no longer sits outside every tsc program: #14710 landed
+  // file no longer sits outside every tsc program: commit 95fdf627b landed
   // `packages/cli/tsconfig.test.json`, whose `include: ["test/**/*"]` puts this
   // file in the program (`tsc --noEmit --listFiles -p tsconfig.test.json`
   // resolves it), and it carries NO row in `test-typecheck-debt.json` — so any
@@ -178,7 +178,7 @@ describe('os explain — schema catalog accuracy', () => {
   });
 });
 
-// ── `os explain` — the WHOLE catalog, swept against the spec (#14811) ──────
+// ── `os explain` — the WHOLE catalog, swept against the spec (commit 8ad872ba3) ──
 //
 // #14782 pinned one entry (`flow`) by parsing its `example` against the real
 // schema. This generalises that technique to every entry, and derives the entry

packages/cli/test/create-plugin-docs-parity.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * The `plugin` template's SHAPE against what the docs promise (#14824).
+ * The `plugin` template's SHAPE against what the docs promise (commit cf6b67164).
  *
  * ## Why this pin exists
  *
@@ -14,7 +14,7 @@
  * govern at all (it emits no `objectstack.config.ts`). So the docs were the
  * only statement of its shape, and nothing held them to it.
  *
- * The maintainer's ruling on #14824 is that a documented developer-facing
+ * The maintainer's ruling that commit cf6b67164 landed is that a documented developer-facing
  * command must work for the developer who follows the docs. This file is the
  * half of that which no install can check: that the listing the developer READS
  * is the listing they GET.

packages/cli/test/create.test.ts

@@ -1,11 +1,11 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * `os create`'s emitted contract — the pin for #14824.
+ * `os create`'s emitted contract — the pin for commit cf6b67164.
  *
  * ## The defect this file used to certify
  *
- * Until #14824 the only assertion here was
+ * Until commit cf6b67164 the only assertion here was
  * `expect(packageJson.dependencies['@objectstack/cli']).toBe('workspace:*')` —
  * a test that PASSED on the defect, and would have gone red on the fix. Every
  * project `os create` emitted declared its `@objectstack/*` dependencies with
@@ -89,7 +89,7 @@ describe('os create: the sweep covers every shipped template', () => {
   it('derives its population from the template map', () => {
     expect(TEMPLATE_KEYS.length).toBeGreaterThan(0);
     // Named so a rename is loud rather than silent. `plugin` is the survivor of
-    // the two #14824 reported; `example` was retired in #16483.
+    // the two templates commit cf6b67164 repaired; `example` was retired in #16483.
     expect(TEMPLATE_KEYS).toEqual(expect.arrayContaining(['plugin']));
   });
 
@@ -214,7 +214,7 @@ describe.each(TEMPLATE_KEYS)('os create %s --in-repo — the platform-work emiss
  *
  * ## The defect
  *
- * #14824 pointed the default emission at a developer outside this monorepo and
+ * Commit cf6b67164 pointed the default emission at a developer outside this monorepo and
  * the name did not move with the audience: `os create plugin my-thing` kept
  * writing `"name": "@objectstack/plugin-my-thing"` — a scope its new owner
  * cannot publish to — and no `private` flag. ⚠️ Nothing here could see it. The

packages/cli/test/docs-cli-enumeration-parity.test.ts

@@ -13,8 +13,8 @@
  *
  *   #8965        an earlier under-inclusive drift on this page.
  *   #16892 ①     the scaffolded-scripts sentence said "these" of THREE commands
- *                and named TWO npm scripts. Under-inclusive from #16330, and
- *                for all four scaffolders from #16350 / PR #16888.
+ *                and named TWO npm scripts. Under-inclusive from commit 4998efa71, and
+ *                for all four scaffolders from commit 68aee4c99 (PR #16888).
  *   #16892 ②     `os lint` declares ELEVEN flags; the page documented FOUR.
  *                One of the seven missing was `--include-platform`, which the
  *                command NAMES IN ITS OWN HINT — so a reader following that

packages/cli/test/extract-hook-body.test.ts

@@ -113,7 +113,7 @@ describe('extractHookBody', () => {
     expect(() => extractHookBody(fn, 'hook bad')).toThrow(/eval/);
   });
 
-  // ── the `@capabilities` directive, RETIRED (#10917) ─────────────────────
+  // ── the `@capabilities` directive, RETIRED (commit 7940de5e0) ───────────
   //
   // Ruled under ADR-0049 enforce-or-remove: the comment-borne override was read
   // off `String(fn)`, and every ordinary authoring path (`.ts`, `.js`, `.mjs`,
@@ -171,7 +171,7 @@ describe('extractHookBody', () => {
   });
 
   // The #4391 sibling that pinned `crypto.hash` being filtered OUT of an
-  // explicit `@capabilities` override went with the directive (#10917): with no
+  // explicit `@capabilities` override went with the directive (commit 7940de5e0): with no
   // override branch there is no token list to filter, so the guarantee is now
   // structural rather than a case. The inference half of #4391 is still pinned
   // by the test above, which is the route `crypto.hash` could still arrive on.

packages/cli/test/fixtures/option-b-reader-probe.ts

@@ -201,7 +201,7 @@ function makeRecorder(rec: Recording) {
     name: 'com.objectstack.probe.option-b-recorder',
     // No `type`: `PluginSchema` defaults an absent `type` to `standard`, and
     // `'service'` is not a member of the declared closed set — `ObjectKernel`
-    // refused this object already, and since #16721 `LiteKernel.use()` (the
+    // refused this object already, and since commit 51ae73123 `LiteKernel.use()` (the
     // kernel `bootAndRecord` boots) runs the same contract. Nothing here reads
     // `.type`; the recorder IS the subsystems, not a typed plugin.
     version: '1.0.0',