diff --git a/packages/create-objectstack/src/banner-version.test.ts b/packages/create-objectstack/src/banner-version.test.ts
index 5f248c039f0..293c2194e67 100644
--- a/packages/create-objectstack/src/banner-version.test.ts
+++ b/packages/create-objectstack/src/banner-version.test.ts
@@ -1,6 +1,6 @@
 // Copyright (c) 2026 ObjectStack contributors. Apache-2.0 license.
 //
-// Pins #10325: the startup banner (`◆ Create ObjectStack …`) names the
+// Pins commit cec9d239d's fix: the startup banner (`◆ Create ObjectStack …`) names the
 // version `create-objectstack`'s own package.json actually declares, not a
 // hardcoded literal — the banner had said `v6.x` for eleven majors, the
 // first line of output a newcomer ever sees.
@@ -14,7 +14,7 @@
 //   2. The three box lines still render to EQUAL display width with the
 //      borders aligned, computed from PLAIN, ANSI-stripped text — a test
 //      that only greps for the version string would still pass with the
-//      right border pushed out of alignment (the #10322 defect class, one
+//      right border pushed out of alignment (the defect class commit 8d21f7a76 fixed, one
 //      function away in the same file: a box hand-kerned for one string
 //      length, broken by a longer one).
 //
diff --git a/packages/create-objectstack/src/banner.ts b/packages/create-objectstack/src/banner.ts
index ea36b436ef2..b669fefffcd 100644
--- a/packages/create-objectstack/src/banner.ts
+++ b/packages/create-objectstack/src/banner.ts
@@ -7,14 +7,14 @@
  * tests — see the comment above `rewriteProjectIdentity`) purely so the
  * padding math has somewhere to be unit-tested without spawning a subprocess.
  *
- * #10325: the banner used to hardcode `v6.x` — eleven majors stale — rather
+ * Until commit cec9d239d the banner hardcoded `v6.x` — eleven majors stale — rather
  * than reading the version it already had a working reader for
  * (`readCliVersion()` in index.ts, already used by `.version()`). The naive
  * fix of dropping the real version string into the old literal would have
  * reintroduced the same defect class one line later: the box's borders are a
  * fixed run of `═` computed for a 4-character `v6.x`, and `v17.1.0` (7 chars)
  * would push the right border out of alignment without recomputing the pad
- * (the sibling bug in #10322, one function away in the same file — a box
+ * (the sibling bug commit 8d21f7a76 fixed, one function away in the same file — a box
  * hand-kerned for `npm` broken by the one-character-longer `pnpm`).
  */
 
diff --git a/packages/create-objectstack/src/blank-readme-validate-disclosure.test.ts b/packages/create-objectstack/src/blank-readme-validate-disclosure.test.ts
index 8fb30539de6..5714e24edca 100644
--- a/packages/create-objectstack/src/blank-readme-validate-disclosure.test.ts
+++ b/packages/create-objectstack/src/blank-readme-validate-disclosure.test.ts
@@ -1,6 +1,6 @@
 // Copyright (c) 2026 ObjectStack contributors. Apache-2.0 license.
 //
-// Pins #10322 part 3 — the substantive half, per triage: the generated
+// Pins the README half of commit 8d21f7a76 — the substantive half, per triage: the generated
 // `AGENTS.md` calls `validate` the command you must never skip ("Never report
 // a metadata change as done until `npm run validate` passes"), and the
 // newcomer's primary doc, the blank template's own README, must name it where
@@ -47,7 +47,7 @@ describe('blank template README names `validate` at first touch (#10322)', () =>
   });
 
   it('names one consistent package manager throughout — no bare npm mixed into a pnpm doc', () => {
-    // #10322 part 1: pick one and say it everywhere. The blank template
+    // The package-manager half of commit 8d21f7a76: pick one and say it everywhere. The blank template
     // already used pnpm consistently; this pin keeps it that way. Excludes
     // the `engines.pnpm` prose about pnpm-version floors living in
     // template-consistency.test.ts, and non-pm words like "npm" never occur
diff --git a/packages/create-objectstack/src/index.ts b/packages/create-objectstack/src/index.ts
index 3cb3c1b6f9c..b68538942c9 100644
--- a/packages/create-objectstack/src/index.ts
+++ b/packages/create-objectstack/src/index.ts
@@ -438,7 +438,7 @@ const program = new Command()
     // accurate "Next steps" instead of a guess: the probe is a read-only
     // `<pm> --version` check, so running it costs nothing even when there is
     // no install to drive. Previously "Next steps" hardcoded `npm` regardless
-    // of which package manager actually ran (#10322) — a newcomer who just
+    // of which package manager actually ran (fixed by commit 8d21f7a76) — a newcomer who just
     // watched `pnpm install` run was then told `npm run dev`.
     //
     // The probe reports WHY as well as WHAT. `npm` used to mean two different
diff --git a/packages/create-objectstack/src/scaffold-e2e-boot-probe.test.ts b/packages/create-objectstack/src/scaffold-e2e-boot-probe.test.ts
index bc214f5497c..6b3163931e5 100644
--- a/packages/create-objectstack/src/scaffold-e2e-boot-probe.test.ts
+++ b/packages/create-objectstack/src/scaffold-e2e-boot-probe.test.ts
@@ -394,7 +394,7 @@ function said(r: Ran): string {
  * spells it — would hang until the harness timeout. Measured while writing this
  * file: every case sat at its 240s ceiling.
  *
- * ## Why this waits on the child's own word instead of on a clock (#19424)
+ * ## Why this waits on the child's own word instead of on a clock (commit c27e16059)
  *
  * The wait this replaces was 80 `curl` probes 0.25s apart — exactly 20s — run
  * through `execFileSync('bash', …, { stdio: 'ignore' })` against a child
@@ -676,7 +676,7 @@ describe.skipIf(!RUNNABLE)('[#9779] scaffold-e2e.yml boot-and-probe blocks asser
       it('refuses a neighbour already answering the URL its loop accepts as proof', async () => {
         // The neighbour goes up FIRST and reports the port the kernel gave it,
         // so the script is rewritten around a port that is already held rather
-        // than around one that merely tested free a moment ago (#19424).
+        // than around one that merely tested free a moment ago (commit c27e16059).
         const n = await neighbour();
         const port = n.port;
         const script = stepScript(step).replaceAll('8080', String(port));
@@ -813,7 +813,7 @@ async function failedNeighbour(
 }
 
 /**
- * The controls for the instrument above (#19424).
+ * The controls for the instrument above (commit c27e16059).
  *
  * ⛔ A green suite is not evidence that a diagnostic works — only a
  * deliberately broken child is. Each case here breaks the neighbour a
diff --git a/packages/create-objectstack/src/scaffold-next-steps-pm.test.ts b/packages/create-objectstack/src/scaffold-next-steps-pm.test.ts
index d3ddd10ff63..9942c6621fe 100644
--- a/packages/create-objectstack/src/scaffold-next-steps-pm.test.ts
+++ b/packages/create-objectstack/src/scaffold-next-steps-pm.test.ts
@@ -1,10 +1,10 @@
 // Copyright (c) 2026 ObjectStack contributors. Apache-2.0 license.
 //
-// Pins #10322: the printed "Next steps" (and the install-failure remedy) must
+// Pins commit 8d21f7a76: the printed "Next steps" (and the install-failure remedy) must
 // name the SAME package manager the run actually detected — never a
 // hardcoded `npm` regardless of what ran. Before this fix, a newcomer whose
 // install ran with `pnpm` was told to run `npm run dev` / `npm run validate`
-// afterwards — the third of the "three different answers" #10322 measured.
+// afterwards — the third of the "three different answers" commit 8d21f7a76 measured.
 // `packages/cli/src/commands/init.ts`'s own "Next steps" already threads its
 // detected `chosenPm` through; this file is the same contract for
 // `create-objectstack`.
diff --git a/packages/create-objectstack/src/scaffold-skills-single-copy.test.ts b/packages/create-objectstack/src/scaffold-skills-single-copy.test.ts
index fd91653aaac..12c8e84d3c8 100644
--- a/packages/create-objectstack/src/scaffold-skills-single-copy.test.ts
+++ b/packages/create-objectstack/src/scaffold-skills-single-copy.test.ts
@@ -1,6 +1,6 @@
 // Copyright (c) 2026 ObjectStack contributors. Apache-2.0 license.
 //
-// #16331 — a scaffolded project's FIRST `git add -A` must stage the skills
+// Commit fd75728bc — a scaffolded project's FIRST `git add -A` must stage the skills
 // bundle exactly once, and a clone of that commit must yield readable
 // `SKILL.md` files.
 //
diff --git a/packages/create-objectstack/src/starter-comments-self-contained.test.ts b/packages/create-objectstack/src/starter-comments-self-contained.test.ts
index 436bf308eb5..082ae4d4c23 100644
--- a/packages/create-objectstack/src/starter-comments-self-contained.test.ts
+++ b/packages/create-objectstack/src/starter-comments-self-contained.test.ts
@@ -38,7 +38,7 @@
 // would widen this suite's declared cross-package read radius to buy nothing.
 //
 // Assertion 3 only judges URLs already on the canonical origin; host
-// CONVERGENCE — is the origin the RULED one at all — is assertion 4 (#10990).
+// CONVERGENCE — is the origin the RULED one at all — is assertion 4 (commit 21756b325).
 // It could not have lived anywhere else: the published-readme-links gate
 // prescribes the same canonical origin, but its population is publishable
 // packages' PUBLISHED markdown, which never reaches this package's templates
@@ -47,7 +47,7 @@
 // `shippedFiles()` below is the one walker in the repo that already
 // enumerates exactly what a scaffold ships, so the host pin belongs here.
 //
-// ## A fifth `MONOREPO_ONLY` pattern, found while fixing #11022
+// ## A fifth `MONOREPO_ONLY` pattern, found while fixing the blank README (commit 21756b325)
 //
 // `blank/README.md` named "the ObjectStack framework repo" as the home of
 // `skills/` — a monorepo-only reference in PROSE rather than in one of the
@@ -69,7 +69,7 @@
 // project. `os create` shipped exactly that into a project README —
 // `[ObjectStack Documentation](../../content/docs)` — and assertion 1 read
 // the file, matched none of its five patterns, and reported it as a PASSING
-// row, which is worse than never having reported on it (#15150).
+// row, which is worse than never having reported on it (commit cc986c913).
 //
 // The sixth pattern closes that spelling. It is a pure regression guardrail:
 // this tree ships zero `../` of any kind today, so it catches nothing on the
@@ -88,7 +88,7 @@ const contentDocs = path.resolve(HERE, '..', '..', '..', 'content', 'docs');
  * Nothing is excluded — every shipped file is scanned. `blank/README.md` used
  * to carry a self-retiring entry here ("still carries an ADR identifier; owned
  * by another card") while its ADR-0097 reference and its unlinked "ObjectStack
- * framework repo" reference were another card's (#11022); both are gone now,
+ * framework repo" reference were another card's; commit 21756b325 removed both,
  * so the retirement fired as designed and this map goes back to empty rather
  * than staying around as a silent exemption over the most-read file in the
  * tree.
@@ -119,7 +119,7 @@ const MONOREPO_ONLY = [
   { label: 'a bare issue number', re: /(^|[^\w/])#\d{3,6}\b/ },
   { label: 'a repo build-script path', re: /\bscripts\/[\w.-]+\.(?:mjs|mts|cjs|ts|js)\b/ },
   { label: 'a monorepo package path', re: /\bpackages\/[a-z0-9][\w-]*\//i },
-  // #11022: `blank/README.md` named "the ObjectStack framework repo" as the
+  // Added by commit 21756b325: `blank/README.md` named "the ObjectStack framework repo" as the
   // home of `skills/`, unlinked — a reader with only their own scaffolded
   // project has no way to reach it. The first four patterns are syntactic
   // identifiers (an ADR id, an issue number, a repo-relative path); this one
@@ -130,7 +130,7 @@ const MONOREPO_ONLY = [
   // "a monorepo root" (`blank/pnpm-workspace.yaml`), which is a correct,
   // self-contained, followable statement about a directory they do have.
   { label: 'a reference to the ObjectStack repo as an unlinked location', re: /\bObjectStack (?:framework )?(?:mono)?repo\b/i },
-  // #15150: the five patterns above are all spelled ABSOLUTELY — a
+  // Added by commit cc986c913: the five patterns above are all spelled ABSOLUTELY — a
   // repo-rooted path, an identifier, or a name. This one is the same class of
   // unfollowable reference written RELATIVELY, as a path that climbs out of
   // the project the reader actually has. A scaffolded project has no parent
@@ -138,7 +138,7 @@ const MONOREPO_ONLY = [
   // them however faithfully it describes this monorepo.
   //
   // Anchored on `../`, deliberately NOT on `./`, and deliberately not on the
-  // depth judgement #15150 proposed (`check:cross-package-test-inputs`-style
+  // depth judgement commit cc986c913 set aside (`check:cross-package-test-inputs`-style
   // "the shallowest point a path reaches"). In THIS population the two give
   // the same answer, for a measured reason: every relative reference the
   // shipped tree carries is `./`-anchored and points DOWNWARD from the file
@@ -218,7 +218,7 @@ describe('shipped template comments are followable by a stranger', () => {
       ],
     },
     {
-      // #11022's two rewrites (ADR-0097 -> a public docs link; "the ObjectStack
+      // Commit 21756b325's two rewrites (ADR-0097 -> a public docs link; "the ObjectStack
       // framework repo" -> the followable install form) are RATIONALE entries
       // too, for the same reason blank/objectstack.config.ts and
       // note.object.ts already are: assertions 1/3/4 only ever check that
@@ -280,7 +280,7 @@ describe('shipped template comments are followable by a stranger', () => {
   });
 
   // ── assertion 4: no non-canonical docs host ships into a project ────────
-  // #10990: three shipped lines cited `objectstack.com` (not even a
+  // Fixed by commit 21756b325: three shipped lines cited `objectstack.com` (not even a
   // redirecting alias — a different, wrong domain) or `docs.objectstack.ai`
   // (an accepted-but-unratified alias per the published-readme-links gate's
   // DOCS_HOSTS) instead of the ruled canonical origin (maintainer ruling,
diff --git a/packages/create-objectstack/src/template-ci-workflow.test.ts b/packages/create-objectstack/src/template-ci-workflow.test.ts
index ca72e93a2c0..f470a417fb0 100644
--- a/packages/create-objectstack/src/template-ci-workflow.test.ts
+++ b/packages/create-objectstack/src/template-ci-workflow.test.ts
@@ -1,6 +1,6 @@
 // Copyright (c) 2026 ObjectStack contributors. Apache-2.0 license.
 //
-// The bundled template's own CI workflow (#16330).
+// The bundled template's own CI workflow (commit 4998efa71).
 //
 // The scaffolder already creates a `.github/` directory at runtime — for one
 // file, `copilot-instructions.md` — while the template's gates (`validate`,
diff --git a/packages/create-objectstack/src/template-consistency.test.ts b/packages/create-objectstack/src/template-consistency.test.ts
index 36ab445bd90..bf3706864ad 100644
--- a/packages/create-objectstack/src/template-consistency.test.ts
+++ b/packages/create-objectstack/src/template-consistency.test.ts
@@ -373,7 +373,7 @@ describe('templates survive npm packing', () => {
     expect(rules).toContain('.env');
   });
 
-  // The first dot-DIRECTORY the template has ever carried (#16330). The set
+  // The first dot-DIRECTORY the template has ever carried (commit 4998efa71). The set
   // comparison above already covers it, but it names nothing: a strip of
   // `.github` would read there as "some file went missing". Naming the path
   // literally, the way the .dockerignore case below does, is what makes the
@@ -495,7 +495,7 @@ describe('blank template pnpm build approvals (#3119)', () => {
 
 // A brand-new scaffold's very first `pnpm install` reported two unmet peers —
 // on the one screen where a newcomer is deciding whether this project is solid,
-// with nothing they did to cause it and nothing they can do about it (#10326).
+// with nothing they did to cause it and nothing they can do about it (until commit 675ab574e).
 // Both are third-party ranges we cannot edit, so the declaration is pnpm's
 // scoped `allowedVersions`, and it has to travel INSIDE the scaffold: a
 // `peerDependencyRules` block in this repo's own pnpm-workspace.yaml would not