docs(cli): re-anchor the dead tracker citations in packages/cli's files outside src to the commits that decided them

Stage 14 of the domain:cli lane's dead-citation sweep: comment prose in
packages/cli's test/**, vitest.config.ts and tsconfig.test.json. Every
comment site that cited a tracker number answering 404 now cites, in
ruling C+D's form C, the commit in this repository's history that decided
what the line describes. 154 sites on 149 lines in 56 files, 51 numbers,
50 distinct commits; one companion line moves a stale present tense into
the past (generate-skill.e2e.test.ts:35). Five sites have no deciding
commit and are left as they were (#10149, #11048, #14874 x3).

Comments only: 150 lines out, 150 in, every file keeps its line count.

Claude-Session: https://claude.ai/code/session_01VvcEokUG1tvVxkceYfR5XB
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/cli/test/artifact-pinned-boot.e2e.test.ts

@@ -126,7 +126,7 @@ function runServe(env: Record<string, string>, opts: { migrateAndExit?: boolean
                 // `childEnv`, not a bare `...process.env`: the vitest worker
                 // exports `TEST=true`, and better-auth 1.7.1 reads it directly
                 // to switch its own origin/CSRF validation OFF in the child —
-                // see `helpers/serve-process.ts` for the measurement (#11267).
+                // see `helpers/serve-process.ts` for the measurement (commit 1ddda1d00).
                 // This boot exits at `kernel:ready` (`OS_MIGRATE_AND_EXIT`) and
                 // never answers a request, so nothing here CHANGES; it is the
                 // hygiene half, so the next assertion added to this file starts

packages/cli/test/build-json-advisory-parity.e2e.test.ts

@@ -4,8 +4,8 @@
  * #11727 — `os build --json` dropped the #3366 capability-provider hints and
  * the ADR-0046 package-docs advisories that `os validate --json` carries.
  *
- * The fourth measured instance of one class in these two files (#10953,
- * #11174, #11643, this): an advisory computed and then formatted *inside* an
+ * The fourth measured instance of one class in these two files (commit be7262e72,
+ * commit ab23c67ab, #11643, this): an advisory computed and then formatted *inside* an
  * `if (... && !flags.json)` print block, which puts it structurally out of
  * reach of the payload — computed, then discarded, for the one audience
  * `--json` exists to serve. Measured at `origin/main` 589758d22 over the

packages/cli/test/build-json-failure-conversions.e2e.test.ts

@@ -15,7 +15,7 @@
  * to appear exactly ONCE — the payload now carries the notice, and the terminal
  * gains no second stderr line for it.
  *
- * #12125 — `os build --json`'s FAILURE payloads dropped the `conversions` field
+ * The defect commit 79cf692b0 fixed — `os build --json`'s FAILURE payloads dropped the `conversions` field
  * the run had ALREADY COMPUTED, on all nine of its failure exits.
  *
  * The same "computed, then dropped on a failure exit" shape as the `warnings`
@@ -523,7 +523,7 @@ describe('#12125 — the contract is exhaustive over `compile.ts`, not just over
     // The one integer left, and it rots only in the direction that has to be
     // reviewed anyway: exits being REMOVED. Ten is the population the ruling in
     // this file's header was made over — nine failure exits plus the terminal
-    // success payload, the count `#12285` pinned on the day it landed — not a
+    // success payload, the count commit 79cf692b0 pinned on the day it landed — not a
     // count of today. (Today is eleven: the tenth FAILURE exit is ADR-0130 D4's
     // per-package author-time rule leg, #14439, a multi-package artifact
     // running the same rule table once per package. It arrived after the ruling

packages/cli/test/build-warning-truncation-notice.test.ts

@@ -15,7 +15,7 @@
  * notice is indistinguishable from a complete one, so an author who reads it
  * and sees their file is clean has read a list that stopped early. Same shape
  * as the dropped summary rows pinned in `print-metadata-stats-zero-row.test.ts`
- * (#10504, #10952): output that cannot distinguish "none" from "not shown".
+ * (commits ff5733e03, 0d4bd93e7): output that cannot distinguish "none" from "not shown".
  *
  * WHAT THESE PINS ASSERT — the pair, not the cap. A test that only checked
  * "50 entries printed" passes on the silent tree and pins nothing. So the

packages/cli/test/commands.test.ts

@@ -132,7 +132,7 @@ describe('os explain — schema catalog accuracy', () => {
   // The catalog's element shape, stated locally: `SchemaInfo` is not exported,
   // and these tests must stay honest even where `SCHEMAS` widens to `any`.
   // ⚠️ The reason recorded here has CHANGED and the discipline has not. This
-  // file no longer sits outside every tsc program: #14710 landed
+  // file no longer sits outside every tsc program: commit 95fdf627b landed
   // `packages/cli/tsconfig.test.json`, whose `include: ["test/**/*"]` puts this
   // file in the program (`tsc --noEmit --listFiles -p tsconfig.test.json`
   // resolves it), and it carries NO row in `test-typecheck-debt.json` — so any
@@ -178,7 +178,7 @@ describe('os explain — schema catalog accuracy', () => {
   });
 });
 
-// ── `os explain` — the WHOLE catalog, swept against the spec (#14811) ──────
+// ── `os explain` — the WHOLE catalog, swept against the spec (commit 8ad872ba3) ──
 //
 // #14782 pinned one entry (`flow`) by parsing its `example` against the real
 // schema. This generalises that technique to every entry, and derives the entry

packages/cli/test/create-plugin-docs-parity.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * The `plugin` template's SHAPE against what the docs promise (#14824).
+ * The `plugin` template's SHAPE against what the docs promise (commit cf6b67164).
  *
  * ## Why this pin exists
  *
@@ -14,7 +14,7 @@
  * govern at all (it emits no `objectstack.config.ts`). So the docs were the
  * only statement of its shape, and nothing held them to it.
  *
- * The maintainer's ruling on #14824 is that a documented developer-facing
+ * The maintainer's ruling that commit cf6b67164 landed is that a documented developer-facing
  * command must work for the developer who follows the docs. This file is the
  * half of that which no install can check: that the listing the developer READS
  * is the listing they GET.

packages/cli/test/create.test.ts

@@ -1,11 +1,11 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * `os create`'s emitted contract — the pin for #14824.
+ * `os create`'s emitted contract — the pin for commit cf6b67164.
  *
  * ## The defect this file used to certify
  *
- * Until #14824 the only assertion here was
+ * Until commit cf6b67164 the only assertion here was
  * `expect(packageJson.dependencies['@objectstack/cli']).toBe('workspace:*')` —
  * a test that PASSED on the defect, and would have gone red on the fix. Every
  * project `os create` emitted declared its `@objectstack/*` dependencies with
@@ -89,7 +89,7 @@ describe('os create: the sweep covers every shipped template', () => {
   it('derives its population from the template map', () => {
     expect(TEMPLATE_KEYS.length).toBeGreaterThan(0);
     // Named so a rename is loud rather than silent. `plugin` is the survivor of
-    // the two #14824 reported; `example` was retired in #16483.
+    // the two templates commit cf6b67164 repaired; `example` was retired in #16483.
     expect(TEMPLATE_KEYS).toEqual(expect.arrayContaining(['plugin']));
   });
 
@@ -214,7 +214,7 @@ describe.each(TEMPLATE_KEYS)('os create %s --in-repo — the platform-work emiss
  *
  * ## The defect
  *
- * #14824 pointed the default emission at a developer outside this monorepo and
+ * Commit cf6b67164 pointed the default emission at a developer outside this monorepo and
  * the name did not move with the audience: `os create plugin my-thing` kept
  * writing `"name": "@objectstack/plugin-my-thing"` — a scope its new owner
  * cannot publish to — and no `private` flag. ⚠️ Nothing here could see it. The

packages/cli/test/docs-cli-enumeration-parity.test.ts

@@ -13,8 +13,8 @@
  *
  *   #8965        an earlier under-inclusive drift on this page.
  *   #16892 ①     the scaffolded-scripts sentence said "these" of THREE commands
- *                and named TWO npm scripts. Under-inclusive from #16330, and
- *                for all four scaffolders from #16350 / PR #16888.
+ *                and named TWO npm scripts. Under-inclusive from commit 4998efa71, and
+ *                for all four scaffolders from commit 68aee4c99 (PR #16888).
  *   #16892 ②     `os lint` declares ELEVEN flags; the page documented FOUR.
  *                One of the seven missing was `--include-platform`, which the
  *                command NAMES IN ITS OWN HINT — so a reader following that

packages/cli/test/extract-hook-body.test.ts

@@ -113,7 +113,7 @@ describe('extractHookBody', () => {
     expect(() => extractHookBody(fn, 'hook bad')).toThrow(/eval/);
   });
 
-  // ── the `@capabilities` directive, RETIRED (#10917) ─────────────────────
+  // ── the `@capabilities` directive, RETIRED (commit 7940de5e0) ───────────
   //
   // Ruled under ADR-0049 enforce-or-remove: the comment-borne override was read
   // off `String(fn)`, and every ordinary authoring path (`.ts`, `.js`, `.mjs`,
@@ -171,7 +171,7 @@ describe('extractHookBody', () => {
   });
 
   // The #4391 sibling that pinned `crypto.hash` being filtered OUT of an
-  // explicit `@capabilities` override went with the directive (#10917): with no
+  // explicit `@capabilities` override went with the directive (commit 7940de5e0): with no
   // override branch there is no token list to filter, so the guarantee is now
   // structural rather than a case. The inference half of #4391 is still pinned
   // by the test above, which is the route `crypto.hash` could still arrive on.

packages/cli/test/fixtures/option-b-reader-probe.ts

@@ -201,7 +201,7 @@ function makeRecorder(rec: Recording) {
     name: 'com.objectstack.probe.option-b-recorder',
     // No `type`: `PluginSchema` defaults an absent `type` to `standard`, and
     // `'service'` is not a member of the declared closed set — `ObjectKernel`
-    // refused this object already, and since #16721 `LiteKernel.use()` (the
+    // refused this object already, and since commit 51ae73123 `LiteKernel.use()` (the
     // kernel `bootAndRecord` boots) runs the same contract. Nothing here reads
     // `.type`; the recorder IS the subsystems, not a typed plugin.
     version: '1.0.0',