docs: re-anchor the last dead tracker citations in eleven lane packages' files outside src to the commits that decided them (#20923)

Part of #20594
Clause-②: no

## What changed

This is stage 16 of the `domain:cli` lane's dead-citation sweep: **the
17 comment sites left in eleven lane packages' files outside `src/**`**
(claim `5917064266`; the list on stage 15's landing `5916232164`). The
file surface is the one stage 14 set: `README.md`, `tsconfig*.json`,
`vitest.config.*`, `tsup.config.*` and `test/**`.

Every comment site on that surface whose tracker number answers 404 now
cites the commit that decided what the line describes, in ruling C+D's
form C (comment `5749154545` on #19123). Stages 1 to 15 of this card are
the precedents; the latest are PR #20883 and PR #20898.

- **17 sites on 16 lines in 14 files**, covering **9 numbers**, now cite
**9 distinct commits**.
- The 14 files: 5 JSONC configs (`tsconfig.test.json` in
plugin-hono-server, plugin-dev and verify; plugin-hono-server's
`tsconfig.typecheck.json`; client's `tsconfig.json`), 6
`vitest.config.ts` (client, cloud-connection, mcp, rest, runtime, types)
and 3 test files (`qa/vitest-filter-preflight` 2,
`qa/downstream-contract` 1).
- **Comments only.** 16 lines out and 16 in, and every file keeps its
line count. A token guard (below) shows zero non-comment tokens changed.
- **String literals, `describe` / `it` titles and messages are
untouched** (they belong to #20752, fold `5911936313`).
- **No tracker number is added.** The live numbers that share a changed
line stay as they were: #4914, #12542 and #17978 all answer 200.
- **Sites left without a deciding commit: none.**
- Where an earlier stage anchored a number and the line here describes
the same decision, the same anchor is reused: 6 of the 9 numbers. The
other 3 anchors are new (marked below).

## Census

**Instrument.** The card's gate does not read these files (its declared
surface is `packages/**/src/**`), so the census is taken by hand with
the gate's own grammar, as stages 14 and 15 took it:

- **Files:** every tracked file of the eleven packages outside `src/**`,
with `CHANGELOG.md` left out: 81 files. Each is classed ON stage 14's
file list (48 files) or OFF it (33: `package.json`, `LICENSE`, ledgers,
`objectstack.config.ts` and the like). Only ON-list comment sites are
this stage's.
- **Extraction:** `extractCitations` from
`scripts/check-issue-citations.mjs`, with its comment-prose projection
for code and JSONC files and the whole file for `*.md`. The whole-file
extraction minus the comment projection gives the string sites.
- **Numbers kept:** only those naming this repository
(`namesThisRepository`).
- **Probe:** each distinct number, `GET
/repos/objectstack-ai/objectstack/issues/N`; 404 means dead.

| | tree | probe window (UTC) | numbers | answer 200 | answer 404 | dead
comment sites, on-list | comment sites | dead comment sites, off-list |
dead string sites |
|---|---|---|---|---|---|---|---|---|---|
| before | base `cb4c31dd52` | 2026-09-30 18:18:37 to 18:19:15 | 94 | 80
| 14 | **17** (9 numbers, 14 files) | 212 | 2 | 11 |
| after | head `1e3782200f` | 2026-09-30 18:23:26 to 18:24:03 | 88 | 80
| 8 | **0** | 195 | 2 | 11 |

- The before count matches the list on stage 15's landing, package by
package.
- No number present in both probes changed its answer. The 6 numbers
that left the census (#8651, #10485, #12181, #13176, #15145, #16917)
were only on the rewritten lines.
- Comment sites fell by exactly 17. The off-list and string counts did
not move.

**Per package, dead on-list comment sites, before to after:**

| package | before | after |
|---|---|---|
| `packages/plugins/plugin-hono-server` | 4 | 0 |
| `packages/plugins/plugin-dev` | 2 | 0 |
| `packages/client` | 2 | 0 |
| `packages/qa/vitest-filter-preflight` | 2 | 0 |
| `packages/cloud-connection` | 1 | 0 |
| `packages/mcp` | 1 | 0 |
| `packages/qa/downstream-contract` | 1 | 0 |
| `packages/rest` | 1 | 0 |
| `packages/runtime` | 1 | 0 |
| `packages/types` | 1 | 0 |
| `packages/verify` | 1 | 0 |
| **total** | **17** | **0** |

## Per-number anchors

Each anchor was checked by blame on the site and in the anchor's own
message or diff. "Reused" names earlier stages that gave the number the
same anchor.

| number | sites | anchor | what it decided | |
|---|---|---|---|---|
| `#13176` | 4: plugin-hono-server and plugin-dev `tsconfig.test.json`
(:3 and :61 / :56) | `a68c61267` | plugin-security's test layer enters
tsc under a sibling `tsconfig.test.json` at zero residue, with no
`test-typecheck-debt.json`; its diff writes the number into that
config's header and into the TEST_DEBT graduation | reused
(plugin-security) |
| `#11332` | 1: plugin-hono-server `tsconfig.typecheck.json:12` |
`dce5cd4f0` | retires the manifest's `capabilities` / `configuration` /
`extensions` containers as `retiredKey()` tombstones (ADR-0049); its
changeset names the number | reused (spec) |
| `#10724` | 1: the same line | `be21955ba` | retires the nine dead
`contributes` members as `retiredKey()` tombstones (ADR-0049); its
subject names the number | reused (spec) |
| `#12181` | 2: client `tsconfig.json:8`, `vitest.config.ts:33` |
`cf71d73f8` | `meta.deleteItem`'s reset carriers; this same commit wrote
both blocks (the `paths` rules and the alias for the real-door test),
and its changeset names the number | reused (client, cli) |
| `#17853` | 5: vitest-filter-preflight's two test headers, rest /
runtime / types `vitest.config.ts` | `08f5f0e5a` | a vitest filter that
selects no test file says so; its message names the card it lands. The
sentence in the three configs is the one stage 14 and stage 15 rewrote
in cli's and dogfood's | reused (qa, cli, dogfood) |
| `#16917` | 1: cloud-connection `vitest.config.ts:64` | `7ce3154e6` |
the comment-only repair of this file, which wrote the "paraphrased
rather than quoted" sentence; its message names the card it lands |
**new** |
| `#8651` | 1: mcp `vitest.config.ts:18` | `8c65046e4` | pins mcp's
three engine doubles to metadata-core's dispatch predicates, adds that
devDependency and creates this config for the alias; its message names
the card it lands | **new** |
| `#10485` | 1: downstream-contract `test/contract.test.ts:46` |
`35ad101bc` | retires `ThemeSchema` and the `themes` carrier key
(ADR-0049, kept beside it); its subject names the number, and it wrote
this line | reused (spec, qa, cli) |
| `#15145` | 1: verify `tsconfig.test.json:1` | `45a72b0cc` | wires
verify's test layer into `typecheck` through this file; its diff writes
the number into this line and into the coverage-ledger graduation |
**new** |

**ADR and ruling records.** A grep of `docs/adr` and
`scripts/adr-anchors` for the 9 numbers finds one hit: ADR-0088 names
#10724 in a correction note (history, not the ruling), so that number
stays on the commit every earlier stage anchored it to. The sentence it
sits in already names ADR-0049. The control number `7329` finds 1 file
in the same tree.

**Anchor checks:**
- **Each sha is unambiguous:** `git rev-parse --disambiguate` gives
count 1 for each of the 9.
- **Each is a plain commit** with one parent.
- **Each is on the base:** `merge-base --is-ancestor` against
`cb4c31dd52` exits 0 for all 9.
- **The history is complete:** the checkout is not shallow. Control leg:
`01218124ae`, the parent of the oldest anchor `8c65046e4` (2026-08-16),
exits 0. Negative control: the base as an ancestor of `8c65046e4` exits
1.

## Verification

All at head `1e3782200f`. Heavy runs went through
`scripts/pm/os-verify-lock.sh` with
`OS_VERIFY_LOCK_SLOT=issue-20594-outside`.

- **Build (whole workspace):** `pnpm exec turbo run build
--filter='./packages/*' --filter='./packages/*/*' --concurrency=2` → 71
successful, 71 total (9 cached), lock verdict command-exit 0.
- **Typecheck, ten packages** (cloud-connection declares no `typecheck`
script): `pnpm --workspace-concurrency=2 --filter` plugin-hono-server,
plugin-dev, client, vitest-filter-preflight, mcp, downstream-contract,
rest, runtime, types, verify `run typecheck` → 10 of 10 `Done`, 0 `error
TS`, lock verdict command-exit 0. That reads every touched JSONC config
(plugin-hono-server's runs `tsconfig.typecheck.json` by name; the
`tsconfig.test.json` files are read by `check:test-typecheck`, all at
their recorded ledgers). `--listFilesOnly` holds all 3 touched test
files in their packages' programs.
- **Tests, by name** (one lock call, verdict command-exit 0). Each
touched test file ran, and each touched `vitest.config.ts` was loaded by
a run of its own package:
- vitest-filter-preflight: `test/config-wiring-sweep.test.ts`,
`test/filter-preflight.test.ts` → 2 files, 97 tests passed.
- downstream-contract: `test/contract.test.ts` → 1 file, 13 tests
passed.
- client: `src/meta-delete-item-carriers.test.ts` (the suite the edited
alias block serves) → 20 passed.
- cloud-connection: `src/canonical-expression-envelopes.test.ts` (the
suite the alias exists for) → 16 passed.
- mcp: `src/mcp-stdio-tools.test.ts` (the engine doubles the edited
block describes) → 12 passed.
- rest, runtime, types (`--project local`):
`src/rest-exec-ctx-memo.test.ts` 4 passed,
`src/app-plugin.ordering.test.ts` 3 passed, `src/email-verified.test.ts`
2 passed.
- **Token guard**, base `cb4c31dd52` against head, 14 files, 5,764 base
tokens: **0 files differ**. TypeScript files are compared as leaf tokens
(`getChildren`, JSDoc nodes skipped), JSONC files as the scanner's
non-trivia token stream plus their parsed value (0 of 5 values differ).
Controls, in memory only: a comment inserted into each file, 0 of 14
differ; a statement appended, 14 of 14; one character flipped inside
each file's first string token, 14 of 14 (9 `StringLiteral`, 5 JSON
strings).
- **Control bytes:** a scan of the 14 files finds 0 (positive control, a
scratch file holding U+0001: 1). `pnpm check:nul-bytes` exits 0.
- **Nothing publishes.** `npm pack --dry-run` in each of the 9 public
packages packs only `dist/**`, `README.md`, `CHANGELOG.md`, `LICENSE`
and `package.json`: 0 of the 11 touched files in those packages is
packed. After the build, the first 48 characters of each of the 16 added
comment lines occur in 0 files of any package's `dist/`; control: a
`src` docblock phrase an earlier stage wrote ("Maintainer-seat ruling,
landed by commit cf71d73") occurs in
`packages/client/dist/index.d.ts`. The other two packages are private.

## Gates

All at head `1e3782200f`, exit codes captured before any pipe.

- **Derivation:** `node scripts/pm/dispatch-gates.mjs --repo
objectstack-ai/objectstack --commands`, no paths, derives **52
commands** (14 paths against merge base `cb4c31dd52`). Re-derived after
fetching `origin/main` to `4d0b9cd542`: the same 52, and none of the 4
upstream commits touches a derivation input or a file here.
- **All 52 exit 0**, each on its first run.
- **Reconciliation:** `dispatch-gates --ran` over the recorded `COMMAND
:: exit CODE` list → "52 derived, 52 run, 0 NOT-MEASURED, 0 UNRUN", exit
0.
- **Roster gates the derivation marks as keeping a roster under
`packages/`:** `pnpm check:authz-resolver`, `pnpm
check:error-code-casing` and `pnpm check:filter-alias-parity` → exit 0
each.
- **`pnpm lint`** (repo-wide `eslint . --no-inline-config`, the family
the derivation does not name) → exit 0, 2026-09-30T18:26:35Z to
18:30:31Z.
- `node scripts/check-issue-citations.mjs` (diff mode, in the 52) reads
0 files, because none of these paths is on its declared surface; the
hand census above is the measurement for this surface.
- A local `git merge-tree --write-tree` of this head against
`origin/main` `4d0b9cd542` is clean.

**The 52 derived commands:** stage 15's list with `pnpm --filter
@objectstack/spec run check:skill-examples` and `node
scripts/check-tenant-audit-census.mjs` (with its `--self-test`) in, and
`check:empty-state`, `check:liveness`, `check:strictness-ledger` and
`check:variant-docs` (spec) out:

- `node scripts/check-ci-filter-parity.mjs`
- `node scripts/check-closing-keyword-parity.mjs` and `--self-test`
- `node scripts/check-comment-mask-adoption.mjs` and `--self-test`
- `node scripts/check-comment-mask-corpus.mjs`
- `node scripts/check-issue-citations.mjs`
- `node scripts/check-keyed-text-bounds.mjs` and `--self-test`
- `node scripts/check-platform-object-tenancy-census.mjs` and
`--self-test`
- `node scripts/check-plugin-teardown-shape.mjs` and `--self-test`
- `node scripts/check-registry-log-declared.mjs` and `--self-test`
- `node scripts/check-rest-log-spy-declared.mjs` and `--self-test`
- `node scripts/check-system-context-census.mjs` and `--self-test`
- `node scripts/check-tenant-audit-census.mjs` and `--self-test`
- `node scripts/check-undeclared-dep-imports.mjs` and `--self-test`
- `node scripts/docs-audit/check-affected-docs.mjs`
- `node scripts/docs-audit/check-drift-comment.mjs`
- `pnpm --filter @objectstack/spec run check:skill-examples`
- `pnpm check:cross-package-test-inputs`,
`check:dispatcher-error-vocabulary`, `check:doc-authoring`,
`check:driver-memory-census`, `check:dts-closure`,
`check:dual-build-cjs-loads`, `check:engine-double-contract`,
`check:gitlink-declared`, `check:issue-citations`,
`check:lean-entry-closure`, `check:logger-receiver-detach`,
`check:nul-bytes`, `check:objectql-double-limit`,
`check:org-identifier`, `check:page-declaration-shape`,
`check:published-files`, `check:query-options-erasure`,
`check:refd-timer-probe`, `check:slot-lookup`,
`check:sourcemap-no-sources-content`, `check:test-source-alias`,
`check:tier-file-adoption`, `check:type-check-coverage`,
`check:type-check-debt`, `check:watch-hint-literal`,
`check:where-matcher`

## Acceptance notes

- **Changeset:** none. Nine of the eleven packages publish, but no
touched file is in any package's `files` (measured above), and
`qa/vitest-filter-preflight` and `qa/downstream-contract` are private.
The PR carries `skip-changeset`.
- **Left in these eleven packages, not this stage's:** 2 dead comment
sites off stage 14's file list, in plugin-hono-server's
`objectstack.config.ts` (:19 #11332, :26 #10724), and 11 dead string
sites: the `test-typecheck-debt.json` notes in client (1), mcp (1), rest
(7) and runtime (1), and vitest-filter-preflight's `package.json`
description (1). All 13 are among the 55 off-list sites stage 14 listed.
- **What remains on this card after this stage:** the 55 off-list sites
stage 14 listed, and the five `cli` sites with no deciding commit
(#10149, #11048, #14874 x3). None of them is touched here.
- **Grammar reach, measured on this surface:** the gate's grammar does
not extract the second number of a slash-joined pair such as
`#10374/#13522`. On these 81 files that shape holds 4 such numbers
(#3060, #7778, #13522, #14016), and all 4 answer 200
(2026-09-30T19:04Z), so the census above misses no dead site.
- **No open PR touches these files.** The claim's serial check read all
11 open PRs' file lists at `cb4c31dd52`; #20602 and #20583 on this seat
stay in `packages/rest/src` and `packages/cli/src`.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01VvcEokUG1tvVxkceYfR5XB)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

packages/client/tsconfig.json

@@ -5,7 +5,7 @@
     "rootDir": "./src",
     "lib": ["ES2020", "DOM", "DOM.Iterable"],
     "types": ["node"],
-    // [#12181] `@objectstack/metadata-core` and `@objectstack/metadata-protocol`
+    // [commit cf71d73f8] `@objectstack/metadata-core` and `@objectstack/metadata-protocol`
     // are imported by `src/meta-delete-item-carriers.test.ts` (the real-door
     // reproduction), i.e. by the TEST program `tsconfig.test.json`, which
     // extends this file. Without these rules tsc resolves those specifiers

packages/client/vitest.config.ts

@@ -30,7 +30,7 @@ export default defineConfig({
     environment: 'node',
   },
   resolve: {
-    // [#12181] Both entries exist for `meta-delete-item-carriers.test.ts`, the
+    // [commit cf71d73f8] Both entries exist for `meta-delete-item-carriers.test.ts`, the
     // suite here that drives the REAL reset door: it boots
     // `ObjectStackProtocolImplementation` and registers the real
     // `sys_metadata*` object definitions, so it imports two sibling packages as

packages/cloud-connection/vitest.config.ts

@@ -61,5 +61,5 @@ export default defineConfig({
   // them and left them standing (#10374/#13522). Deleting or rewriting this
   // config now costs the disarm as well as the alias. Paraphrased rather than
   // quoted, so a census grep for the retired wording does not land back on this
-  // file (#16917).
+  // file (commit 7ce3154e6).
 });

packages/mcp/vitest.config.ts

@@ -15,7 +15,7 @@ export default defineConfig({
     environment: 'node',
   },
   resolve: {
-    // #8651 pinned this package's three engine doubles to the producer-side
+    // Commit 8c65046e4 pinned this package's three engine doubles to the producer-side
     // dispatch predicates, which meant taking `@objectstack/metadata-core` as a
     // devDependency — this package previously depended on neither home of the
     // predicate. That import is a VALUE import, and `@objectstack/metadata-core`

packages/plugins/plugin-dev/tsconfig.test.json

@@ -1,6 +1,6 @@
 // The TEST-layer type-check program (#14062 — the `packages/plugins/**` family
 // adopting the mechanism #5286 set for `packages/spec`, #5449 generalised,
-// #12542 carried to `packages/rest` and #13176 to `packages/plugins/
+// #12542 carried to `packages/rest` and commit a68c61267 to `packages/plugins/
 // plugin-security`). `tsconfig.json` beside this one stays exactly as it is: it
 // is the BUILD config. This sibling puts the test layer in front of tsc under
 // the module semantics vitest really executes it with, and `package.json`'s
@@ -53,7 +53,7 @@
 // zero: `check:test-typecheck` reads a missing ledger as `{ entries: {} }`, under which
 // ANY error in ANY file here is red immediately, with no entry to be added to. That is
 // strictly stronger than a ledger holding nothing, and it is the same call
-// `plugin-security` recorded for itself in #13176. If this package ever acquires
+// `plugin-security` recorded for itself in commit a68c61267. If this package ever acquires
 // residue that cannot be fixed in the PR that causes it, THAT is when a ledger and a
 // `gen:test-typecheck-debt` script are owed — and adding one is maintainer-only
 // (#5286), exactly as the gate says when it refuses.

packages/plugins/plugin-hono-server/tsconfig.test.json

@@ -1,6 +1,6 @@
 // The TEST-layer type-check program (#14062 — the `packages/plugins/**` family
 // adopting the mechanism #5286 set for `packages/spec`, #5449 generalised,
-// #12542 carried to `packages/rest` and #13176 to `packages/plugins/
+// #12542 carried to `packages/rest` and commit a68c61267 to `packages/plugins/
 // plugin-security`). `tsconfig.json` beside this one stays exactly as it is: it
 // is the BUILD config. This sibling puts the test layer in front of tsc under
 // the module semantics vitest really executes it with, and `package.json`'s
@@ -58,7 +58,7 @@
 // zero: `check:test-typecheck` reads a missing ledger as `{ entries: {} }`, under which
 // ANY error in ANY file here is red immediately, with no entry to be added to. That is
 // strictly stronger than a ledger holding nothing, and it is the same call
-// `plugin-security` recorded for itself in #13176. If this package ever acquires
+// `plugin-security` recorded for itself in commit a68c61267. If this package ever acquires
 // residue that cannot be fixed in the PR that causes it, THAT is when a ledger and a
 // `gen:test-typecheck-debt` script are owed — and adding one is maintainer-only
 // (#5286), exactly as the gate says when it refuses.

packages/plugins/plugin-hono-server/tsconfig.typecheck.json

@@ -9,7 +9,7 @@
 // does not export it, and `pnpm --filter @objectstack/plugin-hono-server
 // typecheck` still exited 0. A wrong key or a wrong import here cost nothing at
 // author time, which is the whole defect: the ADR-0049 manifest retirements
-// (#11332 / #10724 / #4914) lean on the `retiredKey()` DOUBLE channel -- tsc
+// (commit dce5cd4f0 / commit be21955ba / #4914) lean on the `retiredKey()` DOUBLE channel -- tsc
 // (input typed `never`) plus parse -- and the tsc half was blind at the only
 // two places in this repo where a plugin manifest is authored in TypeScript.
 //

packages/qa/downstream-contract/test/contract.test.ts

@@ -43,7 +43,7 @@ describe('downstream consumer contract (#2035)', () => {
     ['ObjectExtension', ObjectExtensionSchema, more.DcObjectExtension],
     ['Cube', CubeSchema, more.DcCube],
     ['Mapping', MappingSchema, more.DcMapping],
-    // ['Theme', …] left with ThemeSchema (#10485, ADR-0049).
+    // ['Theme', …] left with ThemeSchema (commit 35ad101bc, ADR-0049).
     ['TranslationBundle', TranslationBundleSchema, more.DcTranslationBundle],
   ];
 

packages/qa/vitest-filter-preflight/test/config-wiring-sweep.test.ts

@@ -3,7 +3,7 @@
 /**
  * ⛔ A preflight nobody invoked is a phantom check — it evaluates never, and
  * deleting it leaves every assertion in `filter-preflight.test.ts` just as green
- * (#17853, #17978).
+ * (commit 08f5f0e5a, #17978).
  *
  * ## Why this is a DERIVED sweep and not a list of eight packages
  *

packages/qa/vitest-filter-preflight/test/filter-preflight.test.ts

@@ -2,7 +2,7 @@
 
 /**
  * A named path that will run no tests is reported, and a run that loses nothing
- * is byte-identical (#17853, #17978).
+ * is byte-identical (commit 08f5f0e5a, #17978).
  *
  * `../src/index.ts` carries the mechanism, the vitest readings, the measurement
  * that rejected the reporter seam and the measurement that rejected consuming