docs(create-objectstack): re-anchor the dead tracker citations in packages/create-objectstack/src to the commits that decided them (#20748)

Part of #20594
Clause-②: no

## What changed

This is stage 11 of the `domain:cli` lane of the dead-citation sweep:
`packages/create-objectstack/src`. Every comment site there that cited a
tracker number answering 404 now cites, in ruling C+D's form C (comment
5749154545 on #19123), the commit in this repository's history that
decided what the line describes, and keeps saying in its own words what
that commit decided. PR #20533 is the method, and stages 1 to 10 of this
card (PR #20624, PR #20632, PR #20656, PR #20673, PR #20689, PR #20703,
PR #20713, PR #20723, PR #20735, PR #20741) are the precedents. The card
stays open for the lane's remaining packages, so this PR says `Part of`.

That is **25 sites on 25 lines in 10 files, covering 9 numbers**,
rewritten to **8 distinct commits**:
- the census's **3 sites**: `src/banner.ts` 2, `src/index.ts` 1 (2
numbers);
- **22 test-file comment sites** in 8 test files (the census defers
`*.test.ts`; stages 1 to 10 took test comments too):
`starter-comments-self-contained.test.ts` 9,
`scaffold-e2e-boot-probe.test.ts` 3, `banner-version.test.ts` 2,
`blank-readme-validate-disclosure.test.ts` 2,
`scaffold-next-steps-pm.test.ts` 2, `template-consistency.test.ts` 2,
`scaffold-skills-single-copy.test.ts` 1, `template-ci-workflow.test.ts`
1.

Only comments changed: **25 lines out, 25 in**, every one of them a site
(no companion line), and every touched file keeps its line count (147 /
67 / 58 / 617 / 910 / 261 / 357 / 328 / 221 / 745), so no line citation
into these files moves. **No citation number is added**: the added lines
carry no tracker number at all, and no PR number stands on an added
line. No ADR or ruling-record file in `docs/adr/` or
`scripts/adr-anchors/` records any of these 9 decisions (a grep for the
9 numbers there reads 0 hits; the control number `#7329` reads 2 in the
same tree), so every anchor is a commit.

**No changeset; `skip-changeset`.** The rewritten comments do not reach
the published `dist` (measured below), as in stages 5 and 7 (PR #20689,
PR #20713).

**Scaffold output is untouched.** No site sits inside a template literal
or in a file the scaffolder copies: `src/templates/**` carries zero
tracker citations in either projection, and all 25 sites are `//` or
JSDoc comment prose outside any string. A real scaffold run at base and
at head emits a byte-identical project (below).

## Census: `packages/create-objectstack`, before and after

**Instrument.** The gate's own `node scripts/check-issue-citations.mjs
--census --json`, read-only and unchanged, run under `with-fleet.sh
--read` for the token. The count is its `allocated-but-absent` findings
under `packages/create-objectstack/`. Both runs enumerated the whole
board.

| reading | tree | board | whole-repo `allocated-but-absent` | package
sites | lines | numbers | files |
|---|---|---|---|---|---|---|---|
| before | base `01e78dceef`, run 2026-09-30T01:14:08Z to 01:19:48Z |
enumerated, 186 pages, frontier #20742, 18,569 numbers | 1,077 | **3** |
3 | 2 | 2 |
| after | `4ed638093d`, run 01:30:22Z to 01:35:31Z | enumerated, 186
pages, frontier #20745, 18,572 numbers | 1,074 | **0** | 0 | 0 | 0 |

The whole-repo drop of 3 is exactly these sites: a site-by-site diff of
the two JSON outputs has 3 findings gone (`banner.ts:10`,
`banner.ts:17`, `index.ts:441`) and none added. The other three tallies
(`resolves` 33,014, `resolves-as-pull-request` 1,984,
`cross-repo-unjudged` 995) are equal in both runs.
`packages/create-objectstack` is byte-identical at `4ed638093d` and at
the head (the one merge brought no file under it).

**Supplementary scan (test files, strings and files outside `src/`
included).** The gate's exported `extractCitations` and
`classifyCitation` over all 53 tracked files of the package
(`CHANGELOG.md` excluded), comment-prose and whole-file projections,
with the board from the gate's own `probeBoard`: 77 citations and 33
dead before, 52 and 8 after. Under `src/`: comments 3 dead to 0, test
comments 23 to 1, test strings 7 unchanged; `src/templates/**` 0
citations of any kind. Outside `src/`, one citation
(`vitest.config.ts:24`, `#10374`) answers 200. Its before list of `src/`
comment sites equals the census's. The 8 left are 7 test strings and 1
test comment with no deciding commit (see "The site left" and Acceptance
notes).

## Per-number table

`git blame` at the base ties each line to the commit that wrote it, and
each anchor was read in its message, changeset or diff, not only its
subject.

| number | sites (base line) | anchor: what it decided |
|---|---|---|
| `#10325` | `banner.ts:10`; `banner-version.test.ts:3` | `cec9d239d`:
the startup banner reads the real version from `package.json` through
the new `renderVersionBanner()`, and sizes the box from the version's
plain length, widening and never truncating, instead of the hardcoded
`v6.x`. Both lines blame to it; its message carries the closing trailer
for this number. New anchor. |
| `#10322` | `banner.ts:17`; `index.ts:441`;
`banner-version.test.ts:17`;
`blank-readme-validate-disclosure.test.ts:3`, `:50`;
`scaffold-next-steps-pm.test.ts:3`, `:7` | `8d21f7a76`: detect the
package manager once, up front, and name it in the install line, the
install-failure remedy and every "Next steps" line (labels padded to the
longer of the two instead of hand-kerned for `npm`), and name `validate`
in the blank README's "Getting started". Its message carries the closing
trailer for this number. `index.ts:441` and the two test headers blame
to it; `banner.ts:17` and `banner-version.test.ts:17` blame to
`cec9d239d`, whose message calls this "the sibling bug fixed one
function away in the same file"; `scaffold-next-steps-pm.test.ts:7`
blames to `c6c7feccd`, a re-wrap that keeps the sentence. New anchor. |
| `#19424` | `scaffold-e2e-boot-probe.test.ts:397`, `:679`, `:816` |
`c27e16059`: the boot-probe neighbour announces its own listener (or its
bind error), asks the kernel for its port with `listen(0)`, and the
harness names five distinct outcomes instead of one "never came up"; the
controls block pins each. All three lines blame to it; its message
carries the closing trailer for this number. New anchor. |
| `#16331` | `scaffold-skills-single-copy.test.ts:3` | `fd75728bc`:
install the skills bundle for one agent (`--skill '*' --agent
claude-code -y`) so a scaffolded project's first commit stages it once,
with no symlinks. The line blames to it, and its diff is what added the
number; its message names none. New anchor. |
| `#10990` | `starter-comments-self-contained.test.ts:41`, `:283` |
`21756b325`: converge the shipped template files on the ruled canonical
docs origin and pin that convergence as assertion 4 over
`shippedFiles()`. Both lines blame to it; its message carries the
closing trailer for this number. New anchor for this number. |
| `#11022` | `starter-comments-self-contained.test.ts:50`, `:91`,
`:122`, `:221` | `21756b325`: rewrite the blank README's two
monorepo-only references, add the fifth `MONOREPO_ONLY` pattern (the
framework's own name next to a "repo" word), retire the self-retiring
`EXCLUDED` entry and add the README's two RATIONALE facts. All four
lines blame to it. Stage 3 (PR #20656) gave this number the same anchor.
|
| `#15150` | `starter-comments-self-contained.test.ts:72`, `:133`,
`:141` | `cc986c913`: the sixth `MONOREPO_ONLY` pattern, for a reference
written as a relative path that climbs out of the project, anchored on
bare `../` rather than on a depth judgement. All three lines blame to
it; its diff is what added the number (8 times, across both scaffolders'
pins), its message names none. New anchor. |
| `#16330` | `template-ci-workflow.test.ts:3`;
`template-consistency.test.ts:376` | `4998efa71`: ship
`.github/workflows/ci.yml` in the blank template (the template's first
dot-directory) so a scaffolded project has gates from its first push.
Both lines blame to it; its diff added the number, its message names
none. New anchor. |
| `#10326` | `template-consistency.test.ts:498` | `675ab574e`: declare
the two benign peer skews a clean first install reported as scoped pnpm
`allowedVersions` inside the scaffold. The line blames to it. Stage 3
(PR #20656) gave this number the same anchor. |

**Anchor checks.** Every cited sha matches exactly one object (`git
rev-parse --disambiguate`, count 1 for each of the 8), is a commit, has
one parent, and is an ancestor of `main` (`merge-base --is-ancestor`
against `01e78dceef`, exit 0 for all 8). The checkout is not shallow.
The control leg `2aca1bc4c0` (the parent of the oldest anchor
`675ab574e`, 2026-08-20) exits 0 against the base, and the negative
control (the base as an ancestor of `675ab574e`) exits 1. Two anchors
reuse the landed stages' (`21756b325`, `675ab574e`); six are new.

**Numbers.** All 9 dropped numbers answer 404 by REST (probed
2026-09-30T01:11:14Z and again at 01:50:21Z). The one number kept on a
line beside the changed ones, `#9779`
(`scaffold-e2e-boot-probe.test.ts:673`), answers 200. The anchor
commits' own PR numbers are not cited: three of them (#11030, #11013,
#11191) answer 404 as well, which is the reason the ruling cites
commits.

## The site left

**No deciding commit (1 site, a test comment, so not in the census):**
`template-consistency.test.ts:153` (`#11048`): "admitting them is a
support decision (#11048), not a value to drift here". The number names
an open support decision (whether to admit pnpm 10.0 to 10.4). The only
commit naming it, `568de194e`, files it unassigned; no later commit
decides it, and the floor is still pnpm 10.15 or later at the base.
Stage 3 (PR #20656) left the sibling site
`packages/cli/src/commands/init.ts:267` for the same reason.

## Mechanical guard: no code token moves, and nothing emitted moves

**H2 holds on both readings: the parser-token diff is empty, and the
emitted `dist` and the scaffolded project are byte-identical.**

**Token guard.** It compares the TypeScript parser's leaf tokens
(TypeScript 6.0.3, `getChildren` walk, JSDoc nodes excluded) of the 10
touched files at base `01e78dceef` and at `4ed638093d`. Controls mutate
the head text in memory only.
- Real run: 16,198 base tokens, 0 files differing, exit 0.
- Comment-insertion control: 0 differing, exit 0.
- Code-insertion control: all 10 files differ, exit 1.
- String control (the first character of the first import specifier
flipped in each file): all 10 files differ, first differing kind
`StringLiteral`, exit 1.

All 50 changed lines (25 out, 25 in) are `//` or `*` comment lines.

**Emitted `dist`.** `pnpm --filter create-objectstack build` at base
(before any edit) and at `4ed638093d`, after the same dependency build.
All 24 `dist` files (`index.js`, `chunk-ZIUW7UEA.js`,
`created-summary.js`, `created-summary.d.ts` and the 20 copied template
files) have equal sha256 at base and head, and `diff -r` is empty. None
of the dead numbers appears in the base `dist` at all: tsup drops these
comments.
- Code-mutation control (`scripts/ablation-replace.mjs`, wrap mode,
anchor `Dependency installation failed.` hit 1 to 0, planted marker 0 to
1, blob `b68538942c96` to `860de8778f10`;
`scripts/ablation-dist-preflight.mjs` found the marker in
`dist/index.js`): `index.js` differs from the head build. The blob was
restored to HEAD `b68538942c96` with `git diff HEAD` empty, `dist` was
rebuilt, the preflight in `--absent` mode reads the marker absent from
all 24 files with a clean tree, and the 24 sha256 values equal the first
head build.
- The whole-workspace builds (below) left `create-objectstack`'s `dist`
equal to the same 24 values.

**Scaffold output.** `node
packages/create-objectstack/bin/create-objectstack.js demo-app
--skip-install --skip-skills`, run in an empty directory from the base
build and again from the head build: both emit the same 21 files with
equal sha256, `diff -r` is empty, and the printed output differs only in
the absolute target directory line.

A raw scan of the 10 changed files for ASCII control bytes finds none (a
positive probe on a scratch file with one such byte reads 1), and
`check:nul-bytes` exits 0.

## Changeset

**None; `skip-changeset`.** The package's `files[]` is `dist`,
`README.md` and `CHANGELOG.md`; the build above emits a byte-identical
`dist` at base and head, and the code-mutation control proves that build
does move when code moves. The two other shipped files are untouched, so
this diff publishes nothing.

## Gates (head `a84b73af13`)

This host has no `flock`, so `os-verify-lock.sh` ran in its declared
unlocked mode. Its official wording, verbatim (printed by every run; the
command line differs per run and is listed in the verdicts below):

> **Declared narrowing — verification ran UNLOCKED.**
`scripts/pm/os-verify-lock.sh`
> could not take the shared verify lock on this host: no usable `flock`.
The shared
> verify lock is declared Linux-only (`flock` is util-linux, and a stock
macOS does
> not ship it), so the command below was run directly, without the lock
—
> a declared narrowing, not a silent one. No serialization guarantee
held for this
> run, nor for any sibling agent in this container while it ran.

Its verdict line from each run (the closure build and the base build at
`01e78dceef`; the head build, the first whole-workspace build, the
tests, the boot-probe file and the typecheck at `4ed638093d`; the second
whole-workspace build, tests and typecheck at this head after the
merge):

```text
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 22s · declare it in the PR body · pnpm --workspace-concurrency=2 --filter 'create-objectstack^...' build
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 2s · declare it in the PR body · pnpm --filter create-objectstack build
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 1s · declare it in the PR body · pnpm --filter create-objectstack build
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 134s (2m14s) · declare it in the PR body · pnpm exec turbo run build --filter=./packages/* --filter=./packages/*/* --concurrency=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 8s · declare it in the PR body · pnpm --filter create-objectstack exec vitest run --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 2s · declare it in the PR body · pnpm --filter create-objectstack exec vitest run --maxWorkers=2 src/scaffold-e2e-boot-probe.test.ts
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 2s · declare it in the PR body · pnpm --filter create-objectstack typecheck
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 35s · declare it in the PR body · pnpm exec turbo run build --filter=./packages/* --filter=./packages/*/* --concurrency=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 7s · declare it in the PR body · pnpm --filter create-objectstack exec vitest run --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 2s · declare it in the PR body · pnpm --filter create-objectstack typecheck
```

- **Build:** `create-objectstack`'s dependency closure
(`@objectstack/spec`, its only workspace dependency), then the package,
then the whole workspace, `turbo run build --filter=./packages/*
--filter=./packages/*/* --concurrency=2`, 71 of 71 tasks, before and
again after the merge. The tree was clean after each.
- **Tests:** `vitest run --maxWorkers=2`: 16 files, 247 tests: 233
passed and 14 skipped, at this head and at `4ed638093d`. The 14 skipped
are the whole of `scaffold-e2e-boot-probe.test.ts` (run alone: 1 file
skipped, 14 tests skipped), which its own `RUNNABLE` gate
(`process.platform === 'linux'`, plus `bash`, `curl`, `openssl`) skips
on this macOS host. **NOT MEASURED locally:
`scaffold-e2e-boot-probe.test.ts`, reason: Linux-only by its own gate;
CI runs it.** Its diff is 3 comment lines with identical parser tokens.
- **Typecheck:** `pnpm --filter create-objectstack typecheck` (`tsc
--noEmit`) exits 0 at this head and at `4ed638093d`. `--listFiles`
reaches 26 `src/` files outside `src/templates/`, including all 16 tests
and all 10 touched files.
- **Spec artifacts:** not run. Neither `origin/main`'s one incoming
commit nor this diff touches `packages/spec`.
- **Lint:** the repo-wide `pnpm lint` (`eslint . --no-inline-config`)
exits 0 at this head (2026-09-30T02:00:09Z to 02:00:43Z), and at
`4ed638093d` (01:49:31Z to 01:50:04Z).
- **Citation judging:** after merging `origin/main` (`697845d19f`),
`node scripts/check-issue-citations.mjs --base origin/main` reports "no
issue citations added against 697845d (2 file(s) read)" (exit 0).
- **Derived gates:** `node scripts/pm/dispatch-gates.mjs --repo
objectstack-ai/objectstack --commands` derived 52 families, the same
list at `4ed638093d` and at this head. All 52 exit 0 at this head in one
pass, and `--ran` with the exit-coded record reads "52 derived, 52 run,
0 NOT-MEASURED, 0 UNRUN" (a derived zero). Among them:
`check:issue-citations`, `check:doc-authoring`, `check:nul-bytes`,
`check:published-files`, `check:cross-package-test-inputs`,
`check:dts-closure`, `check:dual-build-cjs-loads`,
`check:type-check-debt`, `check-changeset-no-major`.
- **Artifact rosters:** 36 of the 39 non-self-test roster rows exit 0 at
this head, among them `check:scaffold-emission-policy` and the three the
derivation marks as keeping their roster under one of this diff's paths
(`check:authz-resolver`, `check:error-code-casing`,
`check:filter-alias-parity`). The other three need a pull request's
context; they are run against this PR once it exists and reported on the
card. The 18 self-test-only rows grade their checkers' fixtures and
cannot judge this diff.

## Hypotheses (measured first)

- **H0 holds.** At base `01e78dceef` the filtered census answers 3 sites
on 3 lines, 2 numbers, 2 files, as on the seat's `0be898499f`. The
whole-repo count is 1,077.
- **H1 holds.** After the rewrite, the filtered census answers 0 for
`packages/create-objectstack`. No census site was left for an open PR
(the file lists of all open PRs were read at 2026-09-30T01:21:44Z and
again at 01:52:53Z, 8 PRs each time: only the Version Packages PR #20639
touches the package, in `CHANGELOG.md` and `package.json`) or for an
unfound anchor. The one site left for an unfound anchor is a test
comment, outside the census.
- **H2 holds.** The parser leaf-token diff of all 10 touched files is
empty with its controls firing, and, independently, the emitted `dist`
and the scaffolded project are byte-identical at base and head, with a
code-mutation control that changes `dist`.

## Acceptance notes

- **Strings, the form-D stage.** Seven dead numbers remain in string
literals, all test titles in `src/`: `banner-version.test.ts:66` and
`:96` (`#10325`), `blank-readme-validate-disclosure.test.ts:25`
(`#10322`), `scaffold-e2e-boot-probe.test.ts:829` (`#19424`),
`scaffold-next-steps-pm.test.ts:173` and `:197` (`#10322`),
`template-consistency.test.ts:503` (`#10326`). They stay on the card for
its form-D stage; no string moved here. None is an assertion text or
scaffold output.
- **Outside `src/**`:** nothing dead. The one citation there,
`vitest.config.ts:24` (`#10374`), answers 200; `README.md` and `bin/`
carry none.
- **Live but misdirected numbers, a different class.** Two numbers in
this package answer 200, but as unrelated pull requests. `#4902`
(`index.ts:165`, `:239`; `rewrite-identity.ts:36`;
`runtime-image.ts:140`; `rewrite-identity.test.ts:3`, and the test title
at `:123`) was written by `8d41998b0`, whose own message names `#4926`
(the remote-template object-name rewrite being silently skipped), and
`f2f09e4e3` repeated it at `runtime-image.ts:140`; `#4902` itself is an
unrelated `init-service` guard PR. `#3120` (`template-copy.ts:20`;
`template-consistency.test.ts:259`) was written by `3b6ef8a32` (the
scaffolded `.gitignore`), and `#3120` is an unrelated approvals-docs PR.
The census reads both as `resolves-as-pull-request`, a reading and not a
finding, and this card is about 404s, so neither moved here. Noted, not
filed.
- **Card-word residue, cited nowhere.** Some rewritten test headers
still say "the card" or "per triage" nearby
(`banner-version.test.ts:13`,
`blank-readme-validate-disclosure.test.ts:3`). They cite no dead number,
so they were left, as the landed stages left theirs.
- **The moving `origin/main`.** The branch merged `origin/main` once
(`a84b73af13`, merging `697845d19f`: PR #20742, the `service-package`
citation re-anchoring). Nothing under `packages/create-objectstack` or
`packages/spec` changed, so the package's tests, typecheck, every
derived gate, the roster rows and lint were rerun at the merge head and
all read as before.

## Deviations

- **Three derived gates first read NOT MEASURED.**
`check:dual-build-cjs-loads`, `check:lean-entry-closure` and
`check:type-check-debt` exited 3 (PREREQUISITE NOT MET: built output
absent) in the first pass, before the whole-workspace build. Rerun after
it, each exits 0, and all 52 exit 0 in the single pass at this head.
- **The first code-mutation attempt was void.** Its replacement text
contained the anchor, so the anchor count could not fall;
`ablation-replace.mjs` refused it (anchor 1 to 1, exit 1) and restored
the blob to HEAD before anything was built. The second attempt, with a
replacement that does not contain the anchor, is the one reported above.
- **The two builds inside the code-mutation control** (the mutate leg
and the restore leg) ran directly, not through `os-verify-lock.sh`. On
this host that wrapper runs unlocked anyway, so nothing was serialized
either way.
- **Commit trailers** are AGENTS.md's model-free pair (`Claude-Session`
plus `Co-authored-by: Claude`), and the pre-push trailer check passed on
every push. The harness's attribution reminder asked for a model-named
trailer and a different PR footer, and AGENTS.md overrides it. The merge
commit carries git's default message.

---
_Generated by [Claude
Code](https://claude.ai/code/session_local_1d2a197c-c20e-4e90-9be8-413d4d432289)_

Co-authored-by: Jack Zhuang <50353452+hotlong@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

packages/create-objectstack/src/banner-version.test.ts

@@ -1,6 +1,6 @@
 // Copyright (c) 2026 ObjectStack contributors. Apache-2.0 license.
 //
-// Pins #10325: the startup banner (`◆ Create ObjectStack …`) names the
+// Pins commit cec9d239d's fix: the startup banner (`◆ Create ObjectStack …`) names the
 // version `create-objectstack`'s own package.json actually declares, not a
 // hardcoded literal — the banner had said `v6.x` for eleven majors, the
 // first line of output a newcomer ever sees.
@@ -14,7 +14,7 @@
 //   2. The three box lines still render to EQUAL display width with the
 //      borders aligned, computed from PLAIN, ANSI-stripped text — a test
 //      that only greps for the version string would still pass with the
-//      right border pushed out of alignment (the #10322 defect class, one
+//      right border pushed out of alignment (the defect class commit 8d21f7a76 fixed, one
 //      function away in the same file: a box hand-kerned for one string
 //      length, broken by a longer one).
 //

packages/create-objectstack/src/banner.ts

@@ -7,14 +7,14 @@
  * tests — see the comment above `rewriteProjectIdentity`) purely so the
  * padding math has somewhere to be unit-tested without spawning a subprocess.
  *
- * #10325: the banner used to hardcode `v6.x` — eleven majors stale — rather
+ * Until commit cec9d239d the banner hardcoded `v6.x` — eleven majors stale — rather
  * than reading the version it already had a working reader for
  * (`readCliVersion()` in index.ts, already used by `.version()`). The naive
  * fix of dropping the real version string into the old literal would have
  * reintroduced the same defect class one line later: the box's borders are a
  * fixed run of `═` computed for a 4-character `v6.x`, and `v17.1.0` (7 chars)
  * would push the right border out of alignment without recomputing the pad
- * (the sibling bug in #10322, one function away in the same file — a box
+ * (the sibling bug commit 8d21f7a76 fixed, one function away in the same file — a box
  * hand-kerned for `npm` broken by the one-character-longer `pnpm`).
  */
 

packages/create-objectstack/src/blank-readme-validate-disclosure.test.ts

@@ -1,6 +1,6 @@
 // Copyright (c) 2026 ObjectStack contributors. Apache-2.0 license.
 //
-// Pins #10322 part 3 — the substantive half, per triage: the generated
+// Pins the README half of commit 8d21f7a76 — the substantive half, per triage: the generated
 // `AGENTS.md` calls `validate` the command you must never skip ("Never report
 // a metadata change as done until `npm run validate` passes"), and the
 // newcomer's primary doc, the blank template's own README, must name it where
@@ -47,7 +47,7 @@ describe('blank template README names `validate` at first touch (#10322)', () =>
   });
 
   it('names one consistent package manager throughout — no bare npm mixed into a pnpm doc', () => {
-    // #10322 part 1: pick one and say it everywhere. The blank template
+    // The package-manager half of commit 8d21f7a76: pick one and say it everywhere. The blank template
     // already used pnpm consistently; this pin keeps it that way. Excludes
     // the `engines.pnpm` prose about pnpm-version floors living in
     // template-consistency.test.ts, and non-pm words like "npm" never occur

packages/create-objectstack/src/index.ts

@@ -438,7 +438,7 @@ const program = new Command()
     // accurate "Next steps" instead of a guess: the probe is a read-only
     // `<pm> --version` check, so running it costs nothing even when there is
     // no install to drive. Previously "Next steps" hardcoded `npm` regardless
-    // of which package manager actually ran (#10322) — a newcomer who just
+    // of which package manager actually ran (fixed by commit 8d21f7a76) — a newcomer who just
     // watched `pnpm install` run was then told `npm run dev`.
     //
     // The probe reports WHY as well as WHAT. `npm` used to mean two different

packages/create-objectstack/src/scaffold-e2e-boot-probe.test.ts

@@ -394,7 +394,7 @@ function said(r: Ran): string {
  * spells it — would hang until the harness timeout. Measured while writing this
  * file: every case sat at its 240s ceiling.
  *
- * ## Why this waits on the child's own word instead of on a clock (#19424)
+ * ## Why this waits on the child's own word instead of on a clock (commit c27e16059)
  *
  * The wait this replaces was 80 `curl` probes 0.25s apart — exactly 20s — run
  * through `execFileSync('bash', …, { stdio: 'ignore' })` against a child
@@ -676,7 +676,7 @@ describe.skipIf(!RUNNABLE)('[#9779] scaffold-e2e.yml boot-and-probe blocks asser
       it('refuses a neighbour already answering the URL its loop accepts as proof', async () => {
         // The neighbour goes up FIRST and reports the port the kernel gave it,
         // so the script is rewritten around a port that is already held rather
-        // than around one that merely tested free a moment ago (#19424).
+        // than around one that merely tested free a moment ago (commit c27e16059).
         const n = await neighbour();
         const port = n.port;
         const script = stepScript(step).replaceAll('8080', String(port));
@@ -813,7 +813,7 @@ async function failedNeighbour(
 }
 
 /**
- * The controls for the instrument above (#19424).
+ * The controls for the instrument above (commit c27e16059).
  *
  * ⛔ A green suite is not evidence that a diagnostic works — only a
  * deliberately broken child is. Each case here breaks the neighbour a

packages/create-objectstack/src/scaffold-next-steps-pm.test.ts

@@ -1,10 +1,10 @@
 // Copyright (c) 2026 ObjectStack contributors. Apache-2.0 license.
 //
-// Pins #10322: the printed "Next steps" (and the install-failure remedy) must
+// Pins commit 8d21f7a76: the printed "Next steps" (and the install-failure remedy) must
 // name the SAME package manager the run actually detected — never a
 // hardcoded `npm` regardless of what ran. Before this fix, a newcomer whose
 // install ran with `pnpm` was told to run `npm run dev` / `npm run validate`
-// afterwards — the third of the "three different answers" #10322 measured.
+// afterwards — the third of the "three different answers" commit 8d21f7a76 measured.
 // `packages/cli/src/commands/init.ts`'s own "Next steps" already threads its
 // detected `chosenPm` through; this file is the same contract for
 // `create-objectstack`.

packages/create-objectstack/src/scaffold-skills-single-copy.test.ts

@@ -1,6 +1,6 @@
 // Copyright (c) 2026 ObjectStack contributors. Apache-2.0 license.
 //
-// #16331 — a scaffolded project's FIRST `git add -A` must stage the skills
+// Commit fd75728bc — a scaffolded project's FIRST `git add -A` must stage the skills
 // bundle exactly once, and a clone of that commit must yield readable
 // `SKILL.md` files.
 //

packages/create-objectstack/src/starter-comments-self-contained.test.ts

@@ -38,7 +38,7 @@
 // would widen this suite's declared cross-package read radius to buy nothing.
 //
 // Assertion 3 only judges URLs already on the canonical origin; host
-// CONVERGENCE — is the origin the RULED one at all — is assertion 4 (#10990).
+// CONVERGENCE — is the origin the RULED one at all — is assertion 4 (commit 21756b325).
 // It could not have lived anywhere else: the published-readme-links gate
 // prescribes the same canonical origin, but its population is publishable
 // packages' PUBLISHED markdown, which never reaches this package's templates
@@ -47,7 +47,7 @@
 // `shippedFiles()` below is the one walker in the repo that already
 // enumerates exactly what a scaffold ships, so the host pin belongs here.
 //
-// ## A fifth `MONOREPO_ONLY` pattern, found while fixing #11022
+// ## A fifth `MONOREPO_ONLY` pattern, found while fixing the blank README (commit 21756b325)
 //
 // `blank/README.md` named "the ObjectStack framework repo" as the home of
 // `skills/` — a monorepo-only reference in PROSE rather than in one of the
@@ -69,7 +69,7 @@
 // project. `os create` shipped exactly that into a project README —
 // `[ObjectStack Documentation](../../content/docs)` — and assertion 1 read
 // the file, matched none of its five patterns, and reported it as a PASSING
-// row, which is worse than never having reported on it (#15150).
+// row, which is worse than never having reported on it (commit cc986c913).
 //
 // The sixth pattern closes that spelling. It is a pure regression guardrail:
 // this tree ships zero `../` of any kind today, so it catches nothing on the
@@ -88,7 +88,7 @@ const contentDocs = path.resolve(HERE, '..', '..', '..', 'content', 'docs');
  * Nothing is excluded — every shipped file is scanned. `blank/README.md` used
  * to carry a self-retiring entry here ("still carries an ADR identifier; owned
  * by another card") while its ADR-0097 reference and its unlinked "ObjectStack
- * framework repo" reference were another card's (#11022); both are gone now,
+ * framework repo" reference were another card's; commit 21756b325 removed both,
  * so the retirement fired as designed and this map goes back to empty rather
  * than staying around as a silent exemption over the most-read file in the
  * tree.
@@ -119,7 +119,7 @@ const MONOREPO_ONLY = [
   { label: 'a bare issue number', re: /(^|[^\w/])#\d{3,6}\b/ },
   { label: 'a repo build-script path', re: /\bscripts\/[\w.-]+\.(?:mjs|mts|cjs|ts|js)\b/ },
   { label: 'a monorepo package path', re: /\bpackages\/[a-z0-9][\w-]*\//i },
-  // #11022: `blank/README.md` named "the ObjectStack framework repo" as the
+  // Added by commit 21756b325: `blank/README.md` named "the ObjectStack framework repo" as the
   // home of `skills/`, unlinked — a reader with only their own scaffolded
   // project has no way to reach it. The first four patterns are syntactic
   // identifiers (an ADR id, an issue number, a repo-relative path); this one
@@ -130,15 +130,15 @@ const MONOREPO_ONLY = [
   // "a monorepo root" (`blank/pnpm-workspace.yaml`), which is a correct,
   // self-contained, followable statement about a directory they do have.
   { label: 'a reference to the ObjectStack repo as an unlinked location', re: /\bObjectStack (?:framework )?(?:mono)?repo\b/i },
-  // #15150: the five patterns above are all spelled ABSOLUTELY — a
+  // Added by commit cc986c913: the five patterns above are all spelled ABSOLUTELY — a
   // repo-rooted path, an identifier, or a name. This one is the same class of
   // unfollowable reference written RELATIVELY, as a path that climbs out of
   // the project the reader actually has. A scaffolded project has no parent
   // directory to climb into, so `../../content/docs` resolves nowhere for
   // them however faithfully it describes this monorepo.
   //
   // Anchored on `../`, deliberately NOT on `./`, and deliberately not on the
-  // depth judgement #15150 proposed (`check:cross-package-test-inputs`-style
+  // depth judgement commit cc986c913 set aside (`check:cross-package-test-inputs`-style
   // "the shallowest point a path reaches"). In THIS population the two give
   // the same answer, for a measured reason: every relative reference the
   // shipped tree carries is `./`-anchored and points DOWNWARD from the file
@@ -218,7 +218,7 @@ describe('shipped template comments are followable by a stranger', () => {
       ],
     },
     {
-      // #11022's two rewrites (ADR-0097 -> a public docs link; "the ObjectStack
+      // Commit 21756b325's two rewrites (ADR-0097 -> a public docs link; "the ObjectStack
       // framework repo" -> the followable install form) are RATIONALE entries
       // too, for the same reason blank/objectstack.config.ts and
       // note.object.ts already are: assertions 1/3/4 only ever check that
@@ -280,7 +280,7 @@ describe('shipped template comments are followable by a stranger', () => {
   });
 
   // ── assertion 4: no non-canonical docs host ships into a project ────────
-  // #10990: three shipped lines cited `objectstack.com` (not even a
+  // Fixed by commit 21756b325: three shipped lines cited `objectstack.com` (not even a
   // redirecting alias — a different, wrong domain) or `docs.objectstack.ai`
   // (an accepted-but-unratified alias per the published-readme-links gate's
   // DOCS_HOSTS) instead of the ruled canonical origin (maintainer ruling,

packages/create-objectstack/src/template-ci-workflow.test.ts

@@ -1,6 +1,6 @@
 // Copyright (c) 2026 ObjectStack contributors. Apache-2.0 license.
 //
-// The bundled template's own CI workflow (#16330).
+// The bundled template's own CI workflow (commit 4998efa71).
 //
 // The scaffolder already creates a `.github/` directory at runtime — for one
 // file, `copilot-instructions.md` — while the template's gates (`validate`,

packages/create-objectstack/src/template-consistency.test.ts

@@ -373,7 +373,7 @@ describe('templates survive npm packing', () => {
     expect(rules).toContain('.env');
   });
 
-  // The first dot-DIRECTORY the template has ever carried (#16330). The set
+  // The first dot-DIRECTORY the template has ever carried (commit 4998efa71). The set
   // comparison above already covers it, but it names nothing: a strip of
   // `.github` would read there as "some file went missing". Naming the path
   // literally, the way the .dockerignore case below does, is what makes the
@@ -495,7 +495,7 @@ describe('blank template pnpm build approvals (#3119)', () => {
 
 // A brand-new scaffold's very first `pnpm install` reported two unmet peers —
 // on the one screen where a newcomer is deciding whether this project is solid,
-// with nothing they did to cause it and nothing they can do about it (#10326).
+// with nothing they did to cause it and nothing they can do about it (until commit 675ab574e).
 // Both are third-party ranges we cannot edit, so the declaration is pnpm's
 // scoped `allowedVersions`, and it has to travel INSIDE the scaffold: a
 // `peerDependencyRules` block in this repo's own pnpm-workspace.yaml would not