diff --git a/.changeset/spec-last-six-dead-citation-anchors.md b/.changeset/spec-last-six-dead-citation-anchors.md
new file mode 100644
index 00000000000..dc951df11e7
--- /dev/null
+++ b/.changeset/spec-last-six-dead-citation-anchors.md
@@ -0,0 +1,14 @@
+---
+'@objectstack/spec': patch
+---
+
+Six provenance comments in `src/data/` and `src/ui/` were re-anchored
+
+Clause-②: no
+
+Six comment and docblock lines in `src/data/datasource.zod.ts`, `src/data/filter.zod.ts`,
+`src/data/value-roundtrip-conformance.ts` and `src/ui/component.zod.ts` cited tracker numbers
+that no longer resolve on GitHub. Each now cites the commit in this repository's history that
+decided the matter, and the datasource comment also says in words which refusal it means: a
+credential written into mongo's `options` passthrough. The live numbers beside them stay.
+Comments only: no type, schema, export or runtime behaviour changes.
diff --git a/packages/spec/src/data/datasource.zod.ts b/packages/spec/src/data/datasource.zod.ts
index 92324fabcfc..bea475baf59 100644
--- a/packages/spec/src/data/datasource.zod.ts
+++ b/packages/spec/src/data/datasource.zod.ts
@@ -698,8 +698,9 @@ export const DatasourceSchema = lazySchema(() => strictObject(
   // `MongoConfigSchema` (a config-level refinement sees only `config`;
   // `credentialsRef` sits on the datasource), so both run here, where both
   // halves are visible at once. They compose independently with the config
-  // gate above: a config also violating #8082/#8336/#9040 reports those
-  // issues too, each at its own path.
+  // gate above: a config also violating #8082/#8336, or the refusal of a
+  // credential in mongo's `options` passthrough (commit 24206416a), reports
+  // those issues too, each at its own path.
   //
   // The two arms split on the connect path's OWN branch test, not on key
   // presence: `buildMongoUrl` opens `if (explicit) return explicit;`, so a
diff --git a/packages/spec/src/data/filter.zod.ts b/packages/spec/src/data/filter.zod.ts
index 214d2831259..8e993b6b473 100644
--- a/packages/spec/src/data/filter.zod.ts
+++ b/packages/spec/src/data/filter.zod.ts
@@ -1064,7 +1064,7 @@ export const RangeOperatorSchema = lazySchema(() => z.object({
  * @see https://github.com/objectstack-ai/objectstack/issues/4706 (the ruling)
  * @see https://github.com/objectstack-ai/objectstack/issues/5702 (the SQL family — landed)
  * @see https://github.com/objectstack-ai/objectstack/issues/6520 (the JS faces — landed)
- * @see https://github.com/objectstack-ai/objectstack/issues/17590 (the membership reading — the SQL family landed)
+ * @see commit e04a0aff2 (the membership reading, landed with the SQL family)
  * @see https://github.com/objectstack-ai/objectstack/issues/7398 (the refusal whose prescription this spelling is)
  */
 /**
diff --git a/packages/spec/src/data/value-roundtrip-conformance.ts b/packages/spec/src/data/value-roundtrip-conformance.ts
index dab6be47130..f87771db867 100644
--- a/packages/spec/src/data/value-roundtrip-conformance.ts
+++ b/packages/spec/src/data/value-roundtrip-conformance.ts
@@ -97,7 +97,7 @@
  * belongs in this table and the case that proves it belongs in this file.
  *
  * @see https://github.com/objectstack-ai/objectstack/issues/12393 (this table)
- * @see https://github.com/objectstack-ai/objectstack/issues/12380 (the measured boundary set)
+ * @see commit 4045b954d (the measured boundary set)
  * @see https://github.com/objectstack-ai/objectstack/issues/9276 (the value class deliberately excluded)
  */
 
diff --git a/packages/spec/src/ui/component.zod.ts b/packages/spec/src/ui/component.zod.ts
index 1dc1750c39a..b3c50c4bc3f 100644
--- a/packages/spec/src/ui/component.zod.ts
+++ b/packages/spec/src/ui/component.zod.ts
@@ -672,7 +672,7 @@ export const PageHeaderProps = strictObject({
    * How many header actions render as inline buttons before the rest fold into
    * the overflow menu — desktop and mobile budgets (#4001 batch A).
    *
-   * Declared on the #5611/#5775/#6276 rule, for the same reason and by the same
+   * Declared on the #5611 / #5775 / commit 78f0be872 rule, for the same reason and by the same
    * evidence: the renderer has always read them and the schema had not caught
    * up. `containers.tsx:1358` resolves
    * `schema?.maxVisible ?? schema?.properties?.maxVisible` (and the `mobile*`
@@ -748,7 +748,7 @@ export const PageTabsProps = strictObject({
    * comment invites the override: *"Authors who want the strip even at length 1
    * can pass `properties.alwaysShowStrip: true`"* (`containers.tsx:637`, read as
    * `schema?.properties?.alwaysShowStrip === true`). Declared on the same
-   * #5611/#5775/#6276 rule as `page:header`'s action budget: the delivered,
+   * #5611 / #5775 / commit 78f0be872 rule as `page:header`'s action budget: the delivered,
    * invited shape is the contract, and a closed schema that rejected it would
    * be the declaration disagreeing with the renderer in the direction that
    * costs the author.
@@ -4552,7 +4552,7 @@ export const ObjectMetricPropsSchema = lazySchema(() => strictObject({
    * equally true of `page:header`'s `icon`, which is REFUSED precisely because
    * no render path reads it. Vocabulary does not separate the two verdicts; a
    * read point does (#9397 closed premise-overtaken re-deriving one from
-   * scratch; #9881/#9972 recorded the accordion and tab items). This is the
+   * scratch; #9881 / commit 60e0f900a recorded the accordion and tab items). This is the
    * same record for the metric tile.
    *
    * The key is LIVE at the objectui pin this repo builds against