docs(types): re-anchor the dead tracker citations in packages/types/src to the commits that decided them (#20673)

Part of #20594
Clause-②: no

## What changed

This is stage 4 of the `domain:cli` lane of the dead-citation sweep:
`packages/types/src/**`. Every comment or docblock site in scope that
cited a tracker number answering 404 now cites, in ruling C+D's form C
(comment 5749154545 on #19123), the commit in this repository's history
that decided what the line describes, and says in its own words what
that commit decided. PR #20533 is the method; PR #20624 (`runtime`), PR
#20632 (`rest`) and PR #20656 (`cli`) are the landed stages this
follows. The card stays open for the form-D stage and the rest of the
lane, so this PR says `Part of`.

That is **83 comment sites on 83 lines in 17 files, covering 12
numbers**: the census's 52 (all of them) and 31 more in test comments,
which the census defers. Each rewritten line cites one of **12 distinct
commits**. No ADR or ruling-record file records any of these twelve
decisions, so every anchor is a commit.

Only comments changed. Every touched file keeps its line count (94 lines
out, 94 in, over 17 files), so no line citation into these files moves.
Eleven of the 94 lines held no dead site; each is the other half of a
sentence that had to change: `thrown-http-error.ts:316-319`,
`node.ts:1103`, `:1429`, `:1447`, `:1452`, `:1476`, and
`node.test.ts:449`, `:2420` (see "Wordings to check").

**No citation number is added.** Over the 94 line pairs, every tracker
number on an added line was already on the line it replaces (per-pair
check: 0 added), and no PR number stands on an added line. No code token
moves (see the guard below). No site was left: no dead comment site in
scope lacked a deciding commit, and no open PR touches
`packages/types/src`.

One file outside `packages/types/src`: a `patch` changeset for
`@objectstack/types`, in PR #20632's form and level.

## Census: `packages/types`, before and after

**Instrument.** The gate's own `node scripts/check-issue-citations.mjs
--census --json`, read-only and unchanged, run with the fleet token. Its
surface is comment prose in `packages/**/src/**/*.ts` with string
literals blanked, and it defers `*.test.ts`. The count is its
`allocated-but-absent` findings under `packages/types/`. Both runs
enumerated the whole board (185 pages), so neither read a truncated
board.

| reading | tree | board | whole-repo `allocated-but-absent` | types
sites | lines | files | numbers |
|---|---|---|---|---|---|---|---|
| before | base `6bff748bbd`, run 2026-09-29T15:31:59Z to 15:41:36Z |
enumerated, 185 pages, frontier #20663, 18,490 numbers | 1,510 | **52**
| 52 | 7 | 11 |
| after | head `686a4c60cb`, run 2026-09-29T16:04:17Z to 16:12:39Z |
enumerated, 185 pages, frontier #20671, 18,498 numbers | 1,458 | **0** |
0 | 0 | 0 |

The before count equals the card's 52 at `f11b5f20a2`: no drift. The
whole-repo drop is 52, exactly this diff's 52 sites, and the whole-repo
resolving count rises by one (32,882 to 32,883): the live #12751 that
`index.ts:4` now spells so the grammar reads it. Both runs read this
worktree, the base and then the base plus this one commit, so no other
change entered either count.

**Supplementary instrument, the whole scope.** The census does not read
test files or strings, and this stage's scope includes test comments. So
a second reading runs the gate's own exported `extractCitations`
(whole-file and comment-prose projections) and `classifyCitation` over
every `.ts` file under `packages/types/src` (42 files), against a board
from the gate's own `probeBoard`. The lit controls #20594, #19123 and
#20656 answered 200 and are on both boards; the dead controls #11671,
#10514 and #14828 answered 404 and are on neither.

| reading | tree | board | citations | dead | src comment | test comment
| src string | test string |
|---|---|---|---|---|---|---|---|---|
| before, 15:34Z | `6bff748bbd` | probed, frontier #20661 | 622 |
**101** | 52 | 31 | 1 | 17 |
| after, 16:04Z | `686a4c60cb` | probed, frontier #20668 | 540 | **18**
| 0 | 0 | 1 | 17 |

Its src-comment column equals the census's 52, site for site (the two
site lists are identical), which is the control on the second
instrument. The drop of 82 citations is the 83 dead sites removed plus
one live number the grammar now reads: `index.ts:4` spelled
`[#11343/#12751]`, whose second half the grammar skips after a slash,
and now reads `[commit c0714eb / #12751]` like its module doc, so the
live #12751 is judged (resolving src comments 273 to 274). Resolving
pull requests (20), cross-repo citations (14) and the other resolving
counts are unchanged. A separate scan for slash-joined pairs in
`packages/types/src` found six (`#11343/#12751`, `#3878/#3899`,
`#7525/#8016`, `#4728/#4825`, `#8621/#8622`, `#5352/#5367`); every
second half answers 200, so no dead number hid behind a slash here.

## Per-number table

Sites and files are the dead comment sites in scope at the base, test
sites counted in brackets. `strings kept` counts string-literal sites,
which are tokens and stay as they were. Every anchor was read in its
message or its diff, not only its subject: it is the commit that made
the change the line describes.

| number | comment sites / files | rewritten | strings kept | anchor |
|---|---|---|---|---|
| `#8824` | 1/1 (1 test) | 1 | 0 | `8ac232306` |
| `#9934` | 5/4 (2 test) | 5 | 2 | `79c46da90` |
| `#10943` | 10/2 (4 test) | 10 | 2 | `46d34ab7c` |
| `#10944` | 1/1 | 1 | 0 | `e598b1cbc` |
| `#11343` | 3/3 (1 test) | 3 | 1 | `c0714eb5d` |
| `#12281` | 1/1 | 1 | 0 | `0783d7b80` |
| `#13197` | 5/2 (2 test) | 5 | 2 | `56c093c4d` |
| `#13279` | 8/5 (2 test) | 8 | 0 | `6a180e42d` |
| `#13324` | 15/3 (7 test) | 15 | 5 | `4cda78c9b` |
| `#15044` | 8/2 (3 test) | 8 | 1 | `088f761e5` |
| `#15045` | 21/2 (8 test) | 21 | 1 | `288fe9c34` |
| `#16657` | 5/2 (1 test) | 5 | 4 | `5a95b0e93` |
| **total** | **83** | **83** | **18** | **12 distinct commits** |

Every cited sha matches exactly one object (`git rev-parse
--disambiguate`, count 1 for each of the 12), is a commit, has one
parent, and is an ancestor of the base (`merge-base --is-ancestor`, exit
0 for all 12). The checkout is not shallow (`--is-shallow-repository`
false); the control leg `f5a9bc2f3` (2026-08-10, older than the oldest
anchor, `8ac232306` of 2026-08-15) exits 0 and the negative control
(this branch's own `686a4c60cb`, not on `main`) exits 1.

**Anchors reused from earlier stages**, so each number carries one
anchor across the tree: `79c46da90` for #9934 (stages 1 and 2, the spec
lane), `46d34ab7c` for #10943, `e598b1cbc` for #10944 and `288fe9c34`
for #15045 (stage 3), `0783d7b80` for #12281 (stage 1), `56c093c4d` for
#13197 (stage 2, the spec lane), `6a180e42d` for #13279 (stages 1 and 2,
`plugin-sharing`) and `c0714eb5d` for #11343 (`plugin-auth`).

**New anchors, and how each was found:**
- `#8824` → `8ac232306`: #8824 is that commit's own PR number (its
subject ends `(#8824)`), so the sha is the object the number named.
`error-leak.test.ts:180` read 「PR #8824 corrected the」 and now reads
「Commit 8ac2323 corrected the」.
- `#13324` → `4cda78c9b`: its subject does not name the number, but its
changeset heading does (「require a missing-table error to name the table
that was READ (#13324)」), and its diff adds `readObject` and every
`[#13324]` marker this module carries. It landed in
`packages/metadata/src/utils/schema-sync-errors.ts`, the file
`6a180e42d` then moved here (a rename at 86 percent similarity).
- `#15044` → `088f761e5`: 「Part of #15044」, the only commit whose
message names the number; it made the #13330 succeeding leg recognise
the package root by the name the declaration promises, and added the
`BOUNDARY` pin at `node.test.ts:1863` that `:2175` and `:2419` point at.
- `#16657` → `5a95b0e93`: it added `operatorFacingErrorText`,
`DECLARED_DATABASE_FAULT_CODE` and the raw-path fragment, and its
message calls itself the fourth prose round on #16657.

## Wordings to check

- **A stale future tense, corrected by its anchor.**
`thrown-http-error.ts:315-320` said #12281 「is a separate card with its
own measurement-first step, so nothing here applies it; this function is
the shape it will read」. `a81aa9dd5` wrote that on 2026-08-29;
`0783d7b80` landed the next day and its message says 「the door now reads
`serverFaultProvenance`」. Citing the commit in the future tense would
contradict itself, so the six lines now read 「Commit 0783d7b — the
prose axis of the same 2026-08-27 ruling — reads the `'declared'` limb
of this same function … It landed separately, after its own
measurement-first step, so nothing here applies it; this function is the
shape it reads rather than a second copy it would have had to grow.」
- **An open question named by a number that had already landed.**
`node.ts:1447-1452` called where a relative specifier should resolve
from 「an open policy question owned by #10944」 and ended with 「Answering
half of another card's undecided question」. `e598b1cbc` (#10944's
landing) had merged 40 minutes before `46d34ab7c` wrote those lines, and
it refuses the relative spelling. The lines now read 「the policy
question commit e598b1c settled for `serve` (it refuses a relative
`plugins: [...]` entry rather than silently re-basing it)」 and
「Answering half of another change's question」.
- **「the card」 once the antecedent became a commit.**
`node.ts:1102-1103` 「#15045 is the card about telling an operator which
one was measured」 now reads 「commit 288fe9c is the change that tells
an operator which one was measured」. `node.ts:1476` 「the second
verification axis the card holds open」 now reads 「the second
verification axis that commit left unbuilt」, which is what `288fe9c34`'s
message says (「deliberately not built here」). `node.test.ts:449` 「The
card's own 4-row matrix」 now reads 「The 4-row matrix behind that
commit」.
- **Headings that named a defect by its number now say so.**
`node.test.ts:1566` reads 「Fixed by commit 088f761: the SUCCEEDING leg
recognised the package by the DECLARATION KEY」 and `:1881` reads
「Reworded by commit 288fe9c: the location sub-case REFUSES correctly
and EXPLAINED itself wrongly」 (`288fe9c34` changed the wording and kept
the refusal). The dash-rule headings trim trailing dashes:
`node.ts:1381`, `node.test.ts:1566`.
- **A quoted triage.** `node.test.ts:2160` quoted 「#15045's triage」; it
now reads 「quoted from the triage commit 288fe9c landed」. That
commit's changeset records the same decision in its own words: the key
stays the expectation 「because widening it would accept any directory
sitting at the key and trade a wrong REMEDY for a wrong LOAD」.
`node.test.ts:2053` said #15045 「asked for this sentence」; it now says
`288fe9c34` 「wrote this sentence」, and that commit's own test comment
says the card asked for it.
- **A defect that proved a point.**
`driver-error-classification.callers.test.ts:24-25` said the omission is
the shape 「#13324 existed to close」 and that prose 「is exactly what
#13324 proved insufficient」; it now reads 「the … shape commit 4cda78c
closed」 and 「prose is exactly what that commit's defect proved
insufficient」.
- **「pre-#N」 spellings** (the card's control sites
`driver-error-classification.ts:608` and `node.ts:1428`, plus
`callers.test.ts:20` and `node.test.ts:594`) now say 「before commit X」.

## Mechanical guard: no code token moves

The check compares the TypeScript parser's leaf tokens (TypeScript
6.0.3, JSDoc nodes excluded, comments being trivia) of each touched file
at base `6bff748bbd` against the working tree at `686a4c60cb`, over all
17 touched files, and lists EVERY differing token, not only the first.
Controls mutate the head text in memory only, so nothing on disk moved
for them.

- Real run: 31,911 base tokens, token counts equal in every file, **0
differing tokens** (exit 0).
- Comment-insertion control (a new line comment in `node.ts`): 0
differing tokens (exit 0).
- Code-insertion positive control (a declaration prepended to
`node.ts`): the count differs and a difference appears at token 0 (exit
1).
- String positive control (one character changed inside the kept
`undeclaredMessage` literal at `node.ts:383`): exactly 1 differing
token, a `StringLiteral` at token 672 (exit 1).

So H2 holds by the token guard. The emitted `dist` is not
byte-identical, because the docblocks ship, which is why the changeset
is `patch`. Line balance: every touched file is +N/−N and every line
count is equal at base and head (17 files). A raw scan of the 18 changed
files for control bytes finds none (its positive control, a scratch file
holding a U+0001 byte, matches).

## Changeset

This change ships bytes, so a `patch` changeset for `@objectstack/types`
is included, in PR #20632's form and level: 「Comments only: no error
code, refusal text, type, export or runtime behaviour changes.」

Measured on the built package: `files[]` is `dist`, `README.md` and
`CHANGELOG.md`. After the build, the rewritten docblocks reach `dist`:
`0783d7b80`, `79c46da90`, `5a95b0e93` and `c0714eb5d` are in
`dist/index.d.ts` and `index.d.mts`, `4cda78c9b` in all four `index`
files, `6a180e42d` in `index.js` and `index.mjs`, and `46d34ab7c` and
`288fe9c34` in `dist/node.d.ts` and `node.d.mts`. The positive control,
the unchanged sentence 「sanitisation REGIME is the condition, not one of
its two outcomes」 of the `0783d7b80` docblock, is in `dist/index.d.ts`
beside it; a negative control phrase appears nowhere. Of the twelve dead
numbers, only #10943 remains in `dist`, twice, and both are the kept
operator-facing string at `node.ts:383` (see Acceptance notes).

## Gates (head `686a4c60cb`)

This host has no `flock`, so `os-verify-lock.sh` ran in its declared
unlocked mode. Its disclosure, verbatim, from each locked run at this
head:

```text
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 2s · declare it in the PR body · pnpm --filter @objectstack/types exec vitest run --project repo --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 5s · declare it in the PR body · pnpm --filter @objectstack/types exec vitest run --project local --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 2s · declare it in the PR body · pnpm --filter @objectstack/types typecheck
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 28s · declare it in the PR body · pnpm --filter '@objectstack/types...' build
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 46s · declare it in the PR body · pnpm lint
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 93s (1m33s) · declare it in the PR body · pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=4
```

`origin/main` did not move after the branch was cut: `git merge
origin/main` answered 「Already up to date」 at `6bff748bbd`, so the base
is the merge base and nothing needed rebuilding. `origin/main` has since
moved to `6c11ef9ecb` (PR #20663: two pages under
`content/docs/automation`, read 16:13Z). It touches nothing this diff or
its gates read, so the branch was not merged again and every reading
here stays at `686a4c60cb`.

- **Build:** the dependency closure (`@objectstack/types...`: `spec`
then `types`) and then the whole workspace (71 tasks, 71 successful).
`check-dts-emitted` finds 2 of 2 declared declaration files. The build
left the tree clean.
- **Tests:** `--project local`: 22 files, 685 tests pass. `--project
repo`: 1 file (`driver-error-classification.callers.test.ts`, touched
here), 7 tests pass. 22 + 1 is all 23 test files in the package, so
every touched test file ran.
- **Typecheck:** `pnpm --filter @objectstack/types typecheck` exits 0.
`tsc --listFiles` counts 42 `src` files under `tsconfig.json`, all 23
test files among them, so every touched test file is type-checked.
- **Lint:** the repo-wide `pnpm lint` (`eslint . --no-inline-config`)
exits 0 at `686a4c60cb` (2026-09-29T16:01:23Z to 16:02:09Z). Not
narrowed.
- **Citation judging:** `node scripts/check-issue-citations.mjs --base
origin/main` exits 0: 5 citations judged across 7 files (4 resolve, 1
cross-repo). These are the live numbers that stay on rewritten non-test
lines. It defers `*.test.ts`, so the per-pair count over the whole diff
covers the rest: 0 numbers added.
- **Derived gates:** `node scripts/pm/dispatch-gates.mjs --repo
objectstack-ai/objectstack --commands` at `686a4c60cb` derived 61
families. All 61 ran and exit 0, and `--ran` over a record carrying each
exit code reads 「61 derived, 61 run, 0 NOT-MEASURED, 0 UNRUN」 (a derived
zero). Among them: `check:doc-authoring`, `check:nul-bytes`,
`check:issue-citations` (self-test), `check:published-files`,
`check:dts-closure`, `check:dual-build-cjs-loads`,
`check:type-check-coverage` and `check:type-check-debt`.
- **Artifact rosters:** all 36 non-self-test roster rows that run
without a pull request exit 0 at `686a4c60cb`, the four whose rosters
share a directory with this diff among them (`check-changeset-fixed`,
`check:authz-resolver`, `check:error-code-casing`,
`check:filter-alias-parity`). The other three,
`check-closing-target-claim`, `check-partof-closing-keyword` and
`check-single-claim-paths`, need a pull request's context; they are run
against this PR once it exists and reported on the card. The 18
checker-health-only rows were not run.

## Hypotheses (measured first)

- **H0 holds.** The filtered census answers 52 dead sites at
`6bff748bbd` (52 lines, 7 files, 11 numbers), equal to the card's count
at `f11b5f20a2`: no drift.
- **H1 holds, with no exceptions.** After the rewrite the filtered
census answers 0 dead sites for `packages/types/`. No site is left for
an open PR or an unfound anchor: the claim's read and this stage's read
of the open PRs' file lists (15:40:08Z, 7 open PRs) found none touching
`packages/types/src` (the Version Packages PR touches only
`packages/types/CHANGELOG.md` and `package.json`). A second read before
this PR was opened (16:13:18Z, 11 open PRs) found the same.
- **H2 holds, by the token guard** above: 0 differing parser leaf tokens
over the 17 touched files, with the comment control at 0 and the code
and string controls each turning red.

## Acceptance notes

- **Form D, not touched here.** 18 dead numbers stand inside string
literals: 17 in test titles and test-code strings (8 files, 8 numbers),
and one an operator reads. That one is the `undeclaredMessage` note at
`node.ts:383`, 「a caller that needs its own resolution passes `{
fallbackImport: (s) => import(s) }`, #10943)」, printed when the host
importer's undeclared fallback fails without a caller base. It is also
the only dead number left in `dist`. The comments around it
(`node.ts:368`, `:1381`, `:1428`) now cite `46d34ab7c`. Ruling D (no
number, the lesson in words) is a string change outside this
comment-only stage; the card already carries a form-D stage for the lane
(ACCEPT 5888034755), and this string is its author-shown first in
`packages/types`. A second one is a remedy an author reads: the `REMEDY`
text at `callers.test.ts:281`, which that gate test prints for any call
site that omits `readObject` (「Without it the predicate returns the
pre-#13324 WIDE verdict」).
- **Outside the scope and the census surface.** `packages/types` outside
`src/**` holds one dead citation: `vitest.config.ts:25` cites #17853
(404), the same number PR #20624 and PR #20632 reported in their
packages' `vitest.config.ts`. The six other citations outside `src/**`
(`CHANGELOG.md` excluded) resolve. It stays for a later stage of this
card.

## Deviations

- Eleven lines beyond the dead sites are the other half of a rewritten
sentence (listed under What changed), and the six lines at
`thrown-http-error.ts:315-320` move from the future tense to the
present, because the claim they carried stopped being true when
`0783d7b80` landed (see Wordings to check).
- The anchors were researched in this session, not delegated; every one
was checked against its commit's message or diff.
- Commit trailers are AGENTS.md's model-free pair (`Claude-Session` plus
`Co-authored-by: Claude`), and the pre-push trailer check passed on
every push; the harness's attribution reminder asked for a model-named
trailer and a different PR footer, which AGENTS.md overrides.

---
_Generated by [Claude
Code](https://claude.ai/code/session_local_1d2a197c-c20e-4e90-9be8-413d4d432289)_

Co-authored-by: Jack Zhuang <50353452+hotlong@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

.changeset/types-provenance-anchors.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/types': patch
+---
+
+Provenance comments in `@objectstack/types` were re-anchored
+
+Comment and docblock lines under `src/` that cited tracker numbers which no
+longer resolve on GitHub now cite the commit in this repository's history that
+decided the matter, and say in their own words what was decided. Comments
+only: no error code, refusal text, type, export or runtime behaviour changes.

packages/types/src/driver-error-classification.callers.test.ts

@@ -7,7 +7,7 @@
  *
  * ── The defect class ─────────────────────────────────────────────────────────
  *
- * #13324 repaired the predicate by giving it `readObject`, so a driver fault
+ * Commit 4cda78c9b repaired the predicate by giving it `readObject`, so a driver fault
  * naming a DIFFERENT relation can no longer be answered "this table is not
  * provisioned yet". The parameter had to ship OPTIONAL: `@objectstack/types` is
  * published (17.2.0, `exports` `.` and `./node`), and re-exported again from
@@ -17,12 +17,12 @@
  *
  * Optional is right for the world outside this repo and wrong for the inside of
  * it. `isMissingTableError(err)` still compiles, still type-checks, and still
- * returns the pre-#13324 WIDE verdict — silently. On the authz path
+ * returns the WIDE verdict from before commit 4cda78c9b — silently. On the authz path
  * (`packages/core/src/security/resolve-authz-context.ts`) that verdict resolves
  * a permission-store OUTAGE to `[]` permissions instead of failing loud, so the
  * omission fails in the OPEN direction. That is the same declared-but-not-
- * enforced shape #13324 existed to close, one level up: the obligation is
- * stated in prose, and prose is exactly what #13324 proved insufficient.
+ * enforced shape commit 4cda78c9b closed, one level up: the obligation is
+ * stated in prose, and prose is exactly what that commit's defect proved insufficient.
  *
  * ── Why a gate and not a required parameter ──────────────────────────────────
  *

packages/types/src/driver-error-classification.operator-text.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * [#16657] `operatorFacingErrorText` — the dialect's words for a record an
+ * [commit 5a95b0e93] `operatorFacingErrorText` — the dialect's words for a record an
  * operator reads later.
  *
  * ## The regression this closes, and why "one `cause` away" was not enough

packages/types/src/driver-error-classification.targeted-table.test.ts

@@ -4,7 +4,7 @@
  * #13438 — `isMissingTableError` prefers the table a driver DECLARED it targeted
  * over the caller-supplied `readObject`.
  *
- * The residual #13324 left behind: a caller names its OBJECT, a driver compiles
+ * The residual commit 4cda78c9b left behind: a caller names its OBJECT, a driver compiles
  * the statement against the PHYSICAL table, and for a federated object
  * (ADR-0015, `external.remoteName`) the two differ. `crm_order` reads
  * `legacy_orders`; when that remote is genuinely absent the phrase names
@@ -14,7 +14,7 @@
  * Maintainer ruling 2026-09-01 (option 2 on the card): the driver declares the
  * table it targeted on the envelope, the predicate prefers it. The pair the
  * ruling asks for is pinned here — an absent remote reads benign again, and a
- * DIFFERENT relation's error still reads not-benign (the #13324 narrowing must
+ * DIFFERENT relation's error still reads not-benign (the narrowing commit 4cda78c9b made must
  * not reopen) — with the declaration present. The driver's half (that
  * `driver-sql` really stamps `external.remoteName`, live, on each dialect) is
  * `packages/drivers/driver-sql/src/sql-driver-13438-federated-missing-remote-envelope.test.ts`.
@@ -181,7 +181,7 @@ describe('isMissingTableError — a declared targeted table beats the caller-sup
         });
 
         it('a declared node whose phrase mismatches is NOT rescued by a matching cause', () => {
-            // Same disposition #6347 and #13324 gave the exclusion: recognition
+            // Same disposition #6347 and commit 4cda78c9b gave the exclusion: recognition
             // ends the question rather than descending.
             const err = envelope(
                 Object.assign(new Error('no such table: main.absent_base'), {

packages/types/src/driver-error-classification.test.ts

@@ -4,7 +4,7 @@
  * #4728 / #4825 — the classifications that decide whether a driver failure may
  * be silenced.
  *
- * [#13279] Moved here with the module it tests, from
+ * [commit 6a180e42d] Moved here with the module it tests, from
  * `packages/metadata/src/utils/schema-sync-errors.test.ts`. Unchanged except
  * for the import path: `@objectstack/core`'s authorization resolver now asks
  * `isMissingTableError`, so the predicate lives in the package both sides

packages/types/src/driver-error-classification.ts

@@ -4,7 +4,7 @@
  * Driver-error classification: "which driver failures may be silenced?"
  * (#4728, #4825; rule from #4632).
  *
- * ## Home — `@objectstack/types`, since #13279
+ * ## Home — `@objectstack/types`, since commit 6a180e42d
  *
  * This module was born in `@objectstack/metadata` and lived there through
  * #4728 / #4825 / #5841. `@objectstack/metadata/errors`' own docblock recorded
@@ -16,7 +16,7 @@
  *
  * What forced it: `resolveAuthzContext` (`@objectstack/core`) must ask
  * {@link isMissingTableError} to tell a permission-store OUTAGE from a
- * deployment whose `sys_*` tables were never provisioned (#13279). Core cannot
+ * deployment whose `sys_*` tables were never provisioned (commit 6a180e42d). Core cannot
  * import `@objectstack/metadata` — metadata **depends on** core — so the
  * predicate had to move to a package both sides already depend on, or be
  * copied. Copying was measured and rejected: two vocabularies of "which driver
@@ -134,7 +134,7 @@
 // `relation-sub-object.ts` next door for the superstring hole it closes and for
 // why the exclusion's width deliberately differs from the extractor's. That
 // module was already this one's dependency across the package boundary; since
-// #13279 moved this file into `@objectstack/types`, the two are siblings.
+// commit 6a180e42d moved this file into `@objectstack/types`, the two are siblings.
 import { isRelationSubObjectPhrase } from './relation-sub-object.js';
 
 /**
@@ -372,7 +372,7 @@ const MISSING_TABLE: DriverErrorSignature = {
          *
          * [#6615] All three now read one home — `@objectstack/types` — instead
          * of three hand-kept copies, so the phrase can no longer be taught to
-         * the repo a fourth time or drift in one package only. [#13279] This
+         * the repo a fourth time or drift in one package only. [commit 6a180e42d] This
          * file now lives in that same home, so the read is a sibling import. The **width**
          * difference that used to justify the copy is preserved and is the
          * reason the home exports two functions rather than one: those two
@@ -386,7 +386,7 @@ const MISSING_TABLE: DriverErrorSignature = {
          */
         matchesMessage: isRelationSubObjectPhrase,
         /**
-         * [#13324] "…and the relation it names is not the one you read."
+         * [commit 4cda78c9b] "…and the relation it names is not the one you read."
          *
          * The sibling of the phrase above, reached one step further out. That
          * one recognises a failure about something INSIDE a relation, which
@@ -408,7 +408,7 @@ const MAX_CAUSE_DEPTH = 4;
  * [#13438] The physical table a driver's statement TARGETED, declared on the
  * error envelope by the producer that knows it.
  *
- * `readObject` closed the #13324 hole for callers that can name what they read
+ * `readObject` (commit 4cda78c9b) closed the hole for callers that can name what they read
  * — and left a residual one layer down. A caller names its OBJECT (the API
  * name); a driver compiles the statement against the PHYSICAL table, and for a
  * federated object (ADR-0015, `external.remoteName`) those are two different
@@ -424,7 +424,7 @@ const MAX_CAUSE_DEPTH = 4;
  * stamps the table its statement targeted onto it — and the predicate PREFERS
  * a declared table over the caller-supplied `readObject`. The caller never
  * needs to know a federated object's remote name, and a driver that declares
- * nothing gets exactly the #13324 behaviour.
+ * nothing gets exactly the behaviour commit 4cda78c9b introduced.
  *
  * A symbol key from the global registry, held non-enumerable: the carrier
  * discipline `driver-sql` already applies to its withheld-diagnostic symbols
@@ -438,7 +438,7 @@ const MAX_CAUSE_DEPTH = 4;
  * ⚠️ A declaration is EVIDENCE, so it also narrows the one-argument form: an
  * envelope declaring `legacy_orders` whose dialect phrase names some other
  * relation reads not-benign even with no `readObject` — the driver supplied
- * the fact the caller could not. That is the #13324 verdict reached without
+ * the fact the caller could not. That is commit 4cda78c9b's verdict, reached without
  * the caller's help, in the direction the module docblock calls cheap.
  */
 export const DRIVER_TARGETED_TABLE: symbol = Symbol.for('objectstack.driver.targetedTable');
@@ -596,7 +596,7 @@ export function isSchemaAlreadyExistsError(error: unknown, depth = 0): boolean {
  * Postgres' two phrasings — the relation is right there in the message because
  * it exists (#6347). See {@link MISSING_TABLE}'s `excludes`.
  *
- * [#13324] Neither is a failure that names a **different relation**, and that
+ * [commit 4cda78c9b] Neither is a failure that names a **different relation**, and that
  * one cannot be seen without `readObject`. The message test asks what the
  * phrase LOOKS like and never which table it names, so a read of a view whose
  * base table has been dropped — `no such table: main.<base>`, measured on
@@ -605,7 +605,7 @@ export function isSchemaAlreadyExistsError(error: unknown, depth = 0): boolean {
  * be about the table the caller asked for, or it is not evidence about it.
  *
  * Pass `readObject` from every in-repo call site. It is **optional** so that
- * omitting it is exactly the pre-#13324 behaviour rather than a new loud
+ * omitting it is exactly the behaviour before commit 4cda78c9b rather than a new loud
  * failure — this is a published export (`@objectstack/types`, and still
  * `@objectstack/metadata/errors` by re-export), and a required parameter would
  * be a breaking change to it. The cost of the choice
@@ -626,12 +626,12 @@ export function isSchemaAlreadyExistsError(error: unknown, depth = 0): boolean {
  * federated object (ADR-0015) that is not the name the driver put in the
  * statement — `crm_order` reads `external.remoteName: 'legacy_orders'`, so a
  * genuinely absent remote raised a phrase naming `legacy_orders` against a
- * caller naming `crm_order`, and the #13324 comparison read it loud. A driver
+ * caller naming `crm_order`, and the comparison commit 4cda78c9b added read it loud. A driver
  * that knows the table it targeted now DECLARES it on the envelope
  * ({@link declareTargetedTable}), and a declared table is preferred over
  * `readObject` outright: the phrase is compared against the declared name, and
  * the caller-supplied one is not consulted at that node or below it. Absent a
- * declaration the comparison is the #13324 one, unchanged. Two consequences,
+ * declaration the comparison is commit 4cda78c9b's, unchanged. Two consequences,
  * both pinned: a genuinely absent federated remote reads benign again without
  * the caller learning the mapping; and — because a declaration is evidence the
  * caller did not have — an envelope whose phrase names a relation other than
@@ -654,11 +654,11 @@ export function isMissingTableError(error: unknown, readObject?: string, depth =
 }
 
 // ---------------------------------------------------------------------------
-// Operator-facing text for a DECLARED driver fault (#16657)
+// Operator-facing text for a DECLARED driver fault (commit 5a95b0e93)
 // ---------------------------------------------------------------------------
 
 /**
- * [#16657] The ADR-0112 code a driver declares when the backend, not the
+ * [commit 5a95b0e93] The ADR-0112 code a driver declares when the backend, not the
  * caller, refused the work. Spelled as a literal for the same reason
  * {@link declaresServerFault} spells `status`/`code` by hand: this package is
  * the common dependency every consumer of the question already has, and reading
@@ -667,7 +667,7 @@ export function isMissingTableError(error: unknown, readObject?: string, depth =
 const DECLARED_DATABASE_FAULT_CODE = 'DATABASE_ERROR';
 
 /**
- * [#16657] The fragment that identifies `SqlDriver`'s RAW-path envelope, and
+ * [commit 5a95b0e93] The fragment that identifies `SqlDriver`'s RAW-path envelope, and
  * only it.
  *
  * The raw terminal (`rawStatementFaultError`, `driver-sql/src/sql-driver.ts`;
@@ -727,7 +727,7 @@ function messageChannelOf(node: unknown): string {
 
 /**
  * The text an OPERATOR should read for `error` — the dialect's own words when a
- * driver composed over them, the error's own message otherwise (#16657).
+ * driver composed over them, the error's own message otherwise (commit 5a95b0e93).
  *
  * # The defect this closes
  *

packages/types/src/email-verified.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * [#11343 / #12751] The verified-email allow-list, pinned representation by
+ * [commit c0714eb5d / #12751] The verified-email allow-list, pinned representation by
  * representation. This predicate is shared between the walled owner-elevation
  * gate (which REFUSES on `false`) and the owner-verification boot diagnostic
  * (which stays quiet on `true`) — the pin here is what both consumers stand

packages/types/src/email-verified.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * [#11343 / #12751] Verified-email predicate over a stored `sys_user` row — a
+ * [commit c0714eb5d / #12751] Verified-email predicate over a stored `sys_user` row — a
  * fail-closed ALLOW-LIST over the representations a driver may hand back for
  * the `sys_user.email_verified` boolean column (JS `true`, SQLite `1`, and
  * their stringified forms). Everything else — `false`/`0`, `null`, an ABSENT

packages/types/src/error-leak.test.ts

@@ -138,7 +138,7 @@ describe('looksLikeInternalErrorLeak — shipped-dialect phrasings (#8132)', ()
         // SQLite/libsql message-only errors: the same conditions with NO
         // `SQLITE_` prefix to trip the existing limb. Measured shapes in this
         // repo — `driver-error-classification.ts` (next door, moved here by
-        // #13279 from `metadata/src/utils/schema-sync-errors.ts`) documents both.
+        // commit 6a180e42d from `metadata/src/utils/schema-sync-errors.ts`) documents both.
         ['sqlite bare missing table', 'no such table: sys_metadata'],
         ['sqlite bare missing table with a schema prefix', 'no such table: main.sys_metadata_history'],
         ['sqlite bare missing column', 'no such column: bogus'],
@@ -177,7 +177,7 @@ describe('looksLikeInternalErrorLeak — shipped-dialect phrasings (#8132)', ()
  * MySQL, and a reviewer sizing a disclosure residual on PR #8737 quoted it in
  * good faith; the claim was false (`driver-sql` branches on `mysql`/`mysql2`,
  * CI stands up a live `mysql:8.0` for a required check, live MySQL 8.0.46
- * measurements landed driver fixes #8621/#8622). PR #8824 corrected the
+ * measurements landed driver fixes #8621/#8622). Commit 8ac232306 corrected the
  * sentence and pinned the narrower, then-true fact — the predicate did not
  * COVER MySQL — as a deliberate tripwire for the decision that was still open.
  *

packages/types/src/index.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
 export * from './degraded-boot.js';
-// [#11343/#12751] The one verified-email predicate the walled owner-elevation
+// [commit c0714eb5d / #12751] The one verified-email predicate the walled owner-elevation
 // gate (plugin-security) and the owner-verification boot diagnostic
 // (plugin-auth) both read — see the module doc for why it must be one.
 export * from './email-verified.js';
@@ -48,7 +48,7 @@ export * from './relation-sub-object.js';
 // Four hand-written vocabularies used to answer it and disagreed about MySQL,
 // which is why every MySQL conflict came back 500 instead of 409.
 export * from './unique-violation.js';
-// [#4728/#4825, moved here by #13279] The one "which driver failures may be
+// [#4728/#4825, moved here by commit 6a180e42d] The one "which driver failures may be
 // silenced?" vocabulary — `isMissingTableError` (a READ failed because the
 // table was never provisioned) and `isSchemaAlreadyExistsError` (a DDL failure
 // that was just the table already being there). It was `@objectstack/metadata`'s