diff --git a/packages/client/tsconfig.json b/packages/client/tsconfig.json
index 26477822d12..a0c64af296f 100644
--- a/packages/client/tsconfig.json
+++ b/packages/client/tsconfig.json
@@ -5,7 +5,7 @@
     "rootDir": "./src",
     "lib": ["ES2020", "DOM", "DOM.Iterable"],
     "types": ["node"],
-    // [#12181] `@objectstack/metadata-core` and `@objectstack/metadata-protocol`
+    // [commit cf71d73f8] `@objectstack/metadata-core` and `@objectstack/metadata-protocol`
     // are imported by `src/meta-delete-item-carriers.test.ts` (the real-door
     // reproduction), i.e. by the TEST program `tsconfig.test.json`, which
     // extends this file. Without these rules tsc resolves those specifiers
diff --git a/packages/client/vitest.config.ts b/packages/client/vitest.config.ts
index bb022d8571f..71c7d3695d4 100644
--- a/packages/client/vitest.config.ts
+++ b/packages/client/vitest.config.ts
@@ -30,7 +30,7 @@ export default defineConfig({
     environment: 'node',
   },
   resolve: {
-    // [#12181] Both entries exist for `meta-delete-item-carriers.test.ts`, the
+    // [commit cf71d73f8] Both entries exist for `meta-delete-item-carriers.test.ts`, the
     // suite here that drives the REAL reset door: it boots
     // `ObjectStackProtocolImplementation` and registers the real
     // `sys_metadata*` object definitions, so it imports two sibling packages as
diff --git a/packages/cloud-connection/vitest.config.ts b/packages/cloud-connection/vitest.config.ts
index 02057449df6..87e67b6dab3 100644
--- a/packages/cloud-connection/vitest.config.ts
+++ b/packages/cloud-connection/vitest.config.ts
@@ -61,5 +61,5 @@ export default defineConfig({
   // them and left them standing (#10374/#13522). Deleting or rewriting this
   // config now costs the disarm as well as the alias. Paraphrased rather than
   // quoted, so a census grep for the retired wording does not land back on this
-  // file (#16917).
+  // file (commit 7ce3154e6).
 });
diff --git a/packages/mcp/vitest.config.ts b/packages/mcp/vitest.config.ts
index 0ecbfd2d451..d0a63cc48ad 100644
--- a/packages/mcp/vitest.config.ts
+++ b/packages/mcp/vitest.config.ts
@@ -15,7 +15,7 @@ export default defineConfig({
     environment: 'node',
   },
   resolve: {
-    // #8651 pinned this package's three engine doubles to the producer-side
+    // Commit 8c65046e4 pinned this package's three engine doubles to the producer-side
     // dispatch predicates, which meant taking `@objectstack/metadata-core` as a
     // devDependency — this package previously depended on neither home of the
     // predicate. That import is a VALUE import, and `@objectstack/metadata-core`
diff --git a/packages/plugins/plugin-dev/tsconfig.test.json b/packages/plugins/plugin-dev/tsconfig.test.json
index ea553400b21..f9440efe687 100644
--- a/packages/plugins/plugin-dev/tsconfig.test.json
+++ b/packages/plugins/plugin-dev/tsconfig.test.json
@@ -1,6 +1,6 @@
 // The TEST-layer type-check program (#14062 — the `packages/plugins/**` family
 // adopting the mechanism #5286 set for `packages/spec`, #5449 generalised,
-// #12542 carried to `packages/rest` and #13176 to `packages/plugins/
+// #12542 carried to `packages/rest` and commit a68c61267 to `packages/plugins/
 // plugin-security`). `tsconfig.json` beside this one stays exactly as it is: it
 // is the BUILD config. This sibling puts the test layer in front of tsc under
 // the module semantics vitest really executes it with, and `package.json`'s
@@ -53,7 +53,7 @@
 // zero: `check:test-typecheck` reads a missing ledger as `{ entries: {} }`, under which
 // ANY error in ANY file here is red immediately, with no entry to be added to. That is
 // strictly stronger than a ledger holding nothing, and it is the same call
-// `plugin-security` recorded for itself in #13176. If this package ever acquires
+// `plugin-security` recorded for itself in commit a68c61267. If this package ever acquires
 // residue that cannot be fixed in the PR that causes it, THAT is when a ledger and a
 // `gen:test-typecheck-debt` script are owed — and adding one is maintainer-only
 // (#5286), exactly as the gate says when it refuses.
diff --git a/packages/plugins/plugin-hono-server/tsconfig.test.json b/packages/plugins/plugin-hono-server/tsconfig.test.json
index 57ef71a9bb0..af206288de7 100644
--- a/packages/plugins/plugin-hono-server/tsconfig.test.json
+++ b/packages/plugins/plugin-hono-server/tsconfig.test.json
@@ -1,6 +1,6 @@
 // The TEST-layer type-check program (#14062 — the `packages/plugins/**` family
 // adopting the mechanism #5286 set for `packages/spec`, #5449 generalised,
-// #12542 carried to `packages/rest` and #13176 to `packages/plugins/
+// #12542 carried to `packages/rest` and commit a68c61267 to `packages/plugins/
 // plugin-security`). `tsconfig.json` beside this one stays exactly as it is: it
 // is the BUILD config. This sibling puts the test layer in front of tsc under
 // the module semantics vitest really executes it with, and `package.json`'s
@@ -58,7 +58,7 @@
 // zero: `check:test-typecheck` reads a missing ledger as `{ entries: {} }`, under which
 // ANY error in ANY file here is red immediately, with no entry to be added to. That is
 // strictly stronger than a ledger holding nothing, and it is the same call
-// `plugin-security` recorded for itself in #13176. If this package ever acquires
+// `plugin-security` recorded for itself in commit a68c61267. If this package ever acquires
 // residue that cannot be fixed in the PR that causes it, THAT is when a ledger and a
 // `gen:test-typecheck-debt` script are owed — and adding one is maintainer-only
 // (#5286), exactly as the gate says when it refuses.
diff --git a/packages/plugins/plugin-hono-server/tsconfig.typecheck.json b/packages/plugins/plugin-hono-server/tsconfig.typecheck.json
index cc3a22c3acd..dba816e40c8 100644
--- a/packages/plugins/plugin-hono-server/tsconfig.typecheck.json
+++ b/packages/plugins/plugin-hono-server/tsconfig.typecheck.json
@@ -9,7 +9,7 @@
 // does not export it, and `pnpm --filter @objectstack/plugin-hono-server
 // typecheck` still exited 0. A wrong key or a wrong import here cost nothing at
 // author time, which is the whole defect: the ADR-0049 manifest retirements
-// (#11332 / #10724 / #4914) lean on the `retiredKey()` DOUBLE channel -- tsc
+// (commit dce5cd4f0 / commit be21955ba / #4914) lean on the `retiredKey()` DOUBLE channel -- tsc
 // (input typed `never`) plus parse -- and the tsc half was blind at the only
 // two places in this repo where a plugin manifest is authored in TypeScript.
 //
diff --git a/packages/qa/downstream-contract/test/contract.test.ts b/packages/qa/downstream-contract/test/contract.test.ts
index e1ccf5ff679..d8721d8d634 100644
--- a/packages/qa/downstream-contract/test/contract.test.ts
+++ b/packages/qa/downstream-contract/test/contract.test.ts
@@ -43,7 +43,7 @@ describe('downstream consumer contract (#2035)', () => {
     ['ObjectExtension', ObjectExtensionSchema, more.DcObjectExtension],
     ['Cube', CubeSchema, more.DcCube],
     ['Mapping', MappingSchema, more.DcMapping],
-    // ['Theme', …] left with ThemeSchema (#10485, ADR-0049).
+    // ['Theme', …] left with ThemeSchema (commit 35ad101bc, ADR-0049).
     ['TranslationBundle', TranslationBundleSchema, more.DcTranslationBundle],
   ];
 
diff --git a/packages/qa/vitest-filter-preflight/test/config-wiring-sweep.test.ts b/packages/qa/vitest-filter-preflight/test/config-wiring-sweep.test.ts
index 6ce20f8a372..33498ea529c 100644
--- a/packages/qa/vitest-filter-preflight/test/config-wiring-sweep.test.ts
+++ b/packages/qa/vitest-filter-preflight/test/config-wiring-sweep.test.ts
@@ -3,7 +3,7 @@
 /**
  * ⛔ A preflight nobody invoked is a phantom check — it evaluates never, and
  * deleting it leaves every assertion in `filter-preflight.test.ts` just as green
- * (#17853, #17978).
+ * (commit 08f5f0e5a, #17978).
  *
  * ## Why this is a DERIVED sweep and not a list of eight packages
  *
diff --git a/packages/qa/vitest-filter-preflight/test/filter-preflight.test.ts b/packages/qa/vitest-filter-preflight/test/filter-preflight.test.ts
index 1de5efea02c..d83b262d3e7 100644
--- a/packages/qa/vitest-filter-preflight/test/filter-preflight.test.ts
+++ b/packages/qa/vitest-filter-preflight/test/filter-preflight.test.ts
@@ -2,7 +2,7 @@
 
 /**
  * A named path that will run no tests is reported, and a run that loses nothing
- * is byte-identical (#17853, #17978).
+ * is byte-identical (commit 08f5f0e5a, #17978).
  *
  * `../src/index.ts` carries the mechanism, the vitest readings, the measurement
  * that rejected the reporter seam and the measurement that rejected consuming
diff --git a/packages/rest/vitest.config.ts b/packages/rest/vitest.config.ts
index 6561f301ccb..1279afef801 100644
--- a/packages/rest/vitest.config.ts
+++ b/packages/rest/vitest.config.ts
@@ -18,7 +18,7 @@ import {
 // repo. `extends: true` keeps the root options (aliases included) on both.
 const REPO_TESTS: string[] = JSON.parse(readFileSync(path.join(__dirname, 'vitest.repo-tests.json'), 'utf8'));
 
-// #17853 / #17978 — say so when a path named on the command line will run no
+// Commit 08f5f0e5a / #17978 — say so when a path named on the command line will run no
 // tests. Invoked HERE, at config load, and ⛔ deliberately NOT as a
 // `test.reporters` entry: naming that option replaces vitest's own reporter
 // defaulting instead of extending it, which measurably changes a healthy run's
diff --git a/packages/runtime/vitest.config.ts b/packages/runtime/vitest.config.ts
index efc62a51e48..f2bbf50e648 100644
--- a/packages/runtime/vitest.config.ts
+++ b/packages/runtime/vitest.config.ts
@@ -51,7 +51,7 @@ import {
 // repo. `extends: true` keeps the root options (aliases included) on both.
 const REPO_TESTS: string[] = JSON.parse(readFileSync(path.join(__dirname, 'vitest.repo-tests.json'), 'utf8'));
 
-// #17853 / #17978 — say so when a path named on the command line will run no
+// Commit 08f5f0e5a / #17978 — say so when a path named on the command line will run no
 // tests. Invoked HERE, at config load, and ⛔ deliberately NOT as a
 // `test.reporters` entry: naming that option replaces vitest's own reporter
 // defaulting instead of extending it, which measurably changes a healthy run's
diff --git a/packages/types/vitest.config.ts b/packages/types/vitest.config.ts
index c2f03814c52..757b9fef2b2 100644
--- a/packages/types/vitest.config.ts
+++ b/packages/types/vitest.config.ts
@@ -22,7 +22,7 @@ import {
 // repo. `extends: true` keeps the root options (aliases included) on both.
 const REPO_TESTS: string[] = JSON.parse(readFileSync(path.join(__dirname, 'vitest.repo-tests.json'), 'utf8'));
 
-// #17853 / #17978 — say so when a path named on the command line will run no
+// Commit 08f5f0e5a / #17978 — say so when a path named on the command line will run no
 // tests. Invoked HERE, at config load, and ⛔ deliberately NOT as a
 // `test.reporters` entry: naming that option replaces vitest's own reporter
 // defaulting instead of extending it, which measurably changes a healthy run's
diff --git a/packages/verify/tsconfig.test.json b/packages/verify/tsconfig.test.json
index 73c531db2bb..ba7ecdea768 100644
--- a/packages/verify/tsconfig.test.json
+++ b/packages/verify/tsconfig.test.json
@@ -1,4 +1,4 @@
-// The TEST-layer type-check program (#15145), adopting the #5286 mechanism that
+// The TEST-layer type-check program (commit 45a72b0cc), adopting the #5286 mechanism that
 // #5449 generalised and that 30 sibling configs now use. `tsconfig.json` beside
 // this file is unchanged: it is the BUILD config, its `exclude` of
 // `**/*.test.ts` stays, and this sibling puts the excluded layer in front of