fix(spec): name a resolving record for two citations the board no longer serves

`check:issue-citations` went red at 0a1bac8 with eight dangling sites across
five files: issue 14919 at six of them and issue 8715 at two. Measured cause,
from the gate's own `--probe-cause`: deleted, all eight — not transferred, not
mistyped. Probed with a lit control beside each, since both dead numbers sit
next to live ones: 8714 404 / 8715 404 / 8716 200, and 14918 404 / 14919 404 /
14920 200. Scattered pairs, not a contiguous band, which is what
deletion-by-author looks like. Both were live references when the prose was
written.

⛔ No number is guessed and none is swapped for a plausible neighbour. Each site
keeps its number in prose and now says it no longer resolves, then names a
record that DOES — verified by probe, not inferred:

  - issue 14919 -> PR #15930, `feat(core)!: retire PluginSecurityScanner`,
    merged 2026-09-05, whose body opens with a closing line naming that very
    issue number. Probe: 200.
  - issue 8715  -> #11825, the half of the pair this tree cites together that
    still resolves, and the same whole-def disposition shape. Probe: 200.

The `#` sigil is what the gate judges (`CITATION_RE`); a bare number in prose is
not a citation, so the number survives verbatim and the reference stops
dangling. `migrations/registry.ts` is GENERATED and was NOT hand-edited: its
three copies come from the two entry files, re-emitted by
`gen:migration-registry`. The module docblock feeds a reference page, so
`check:generated --fix` regenerated
`content/docs/references/kernel/plugin-security-advanced.mdx` through `gen:docs`.

⛔ Nothing else moves: no schema, no key, no registry entry, no changeset level,
no authorable row. Comments and the prose they generate, only.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UDXER3sdqfeVYpEWZs5mZx

Author: claude

content/docs/references/kernel/plugin-security-advanced.mdx

@@ -20,7 +20,9 @@ Features:
 `KernelSecurityVulnerability`, `PluginSecurityManifest.scanResults` and its
 sibling list `.vulnerabilities` — was retired under ADR-0049 enforce-or-remove
 (#15932), after the runtime scanner that was its last type-only importer went
-the same way (#14919). Nothing on this platform scans a plugin.
+the same way. That scanner retirement was issue 14919 — a number DELETED from
+the board and no longer resolving; its live record is PR #15930, which landed
+the removal. Nothing on this platform scans a plugin.
 
 <Callout type="info">
 **Source:** `packages/spec/src/kernel/plugin-security-advanced.zod.ts`

packages/spec/src/kernel/plugin-security-advanced.zod.ts

@@ -19,7 +19,9 @@ import { EvaluatedExpressionInputSchema } from '../shared/expression.zod';
  * `KernelSecurityVulnerability`, `PluginSecurityManifest.scanResults` and its
  * sibling list `.vulnerabilities` — was retired under ADR-0049 enforce-or-remove
  * (#15932), after the runtime scanner that was its last type-only importer went
- * the same way (#14919). Nothing on this platform scans a plugin.
+ * the same way. That scanner retirement was issue 14919 — a number DELETED from
+ * the board and no longer resolving; its live record is PR #15930, which landed
+ * the removal. Nothing on this platform scans a plugin.
  */
 
 /**
@@ -588,7 +590,8 @@ export const PluginSecurityManifestSchema = lazySchema(() => z.object({
    * Tombstone: the scan-result surface is RETIRED (#15932, ADR-0049
    * enforce-or-remove). `KernelSecurityScanResult` and
    * `KernelSecurityVulnerability` left this build with it — the last importer
-   * of either type went with `PluginSecurityScanner` (#14919). Not a bare
+   * of either type went with `PluginSecurityScanner` (issue 14919, a number
+   * deleted from the board; live record: PR #15930). Not a bare
    * deletion: this shape is not `.strict()`, so zod would strip an authored
    * key in silence (ADR-0104).
    */

packages/spec/src/migrations/entries/retired-defs/18.kernel__KernelSecurityScanResult.ts

@@ -7,15 +7,18 @@
 // compliance and a six-number summary — and no layer ever emitted, stored, parsed
 // or read one. Its only importer of any kind was `PluginSecurityScanner`, a
 // type-only import from `packages/core/src/security/security-scanner.ts`, and
-// #14919 deleted that file; the census after it landed put every remaining
+// PR #15930 deleted that file (it closed issue 14919, a number since deleted
+// from the board and no longer resolving); the census after it landed put every remaining
 // reference inside the declaring module itself, against a lit control (five hits
 // for `PluginSecurityManifest` in the same file), so the zero is a reading.
 //
 // Whole-def retirement, not a tombstone: nothing parses this def, so there is no
 // author to hand a prescription to and no `${defKey}:${name}` key leaving a live
 // shape. `RETIRED_DEFS_BY_MAJOR[18]` plus the semantic entry
 // `plugin-security-scan-result-surface-retired` ARE the declaration — the
-// #11825 / #8715 shape. The two authorable carriers that pointed here,
+// #11825 shape (its sibling in the pair this tree usually cites, issue 8715, is
+// a number deleted from the board; 11825 is the half that still resolves).
+// The two authorable carriers that pointed here,
 // `PluginSecurityManifest.scanResults` and `.vulnerabilities`, are separately
 // tombstoned and registered in `RETIRED_KEYS_BY_MAJOR[18]`.
 //

packages/spec/src/migrations/entries/retired-keys/18.kernel__PluginSecurityManifest__scanResults.ts

@@ -6,8 +6,9 @@
 // zero authors and zero parsers: no `.parse`/`.safeParse` site existed anywhere
 // against the scan-result schemas, so a publisher could declare a clean scan on a
 // plugin manifest, be accepted, and get nothing — the declared-not-enforced shape
-// Prime Directive #10 names, one layer out from the runtime scanner #14919
-// removed for the same reason.
+// Prime Directive #10 names, one layer out from the runtime scanner that PR
+// #15930 removed for the same reason (that PR closed issue 14919, a number since
+// deleted from the board and no longer resolving).
 //
 // Tombstoned with `retiredKey()`, not deleted: `PluginSecurityManifestSchema` is a
 // plain `z.object`, not `.strict()`, so a bare deletion would strip an authored

packages/spec/src/migrations/registry.ts

@@ -14844,8 +14844,9 @@ export const RETIRED_KEYS_BY_MAJOR: Readonly<Record<number, readonly string[]>>
     // zero authors and zero parsers: no `.parse`/`.safeParse` site existed anywhere
     // against the scan-result schemas, so a publisher could declare a clean scan on a
     // plugin manifest, be accepted, and get nothing — the declared-not-enforced shape
-    // Prime Directive #10 names, one layer out from the runtime scanner #14919
-    // removed for the same reason.
+    // Prime Directive #10 names, one layer out from the runtime scanner that PR
+    // #15930 removed for the same reason (that PR closed issue 14919, a number since
+    // deleted from the board and no longer resolving).
     //
     // Tombstoned with `retiredKey()`, not deleted: `PluginSecurityManifestSchema` is a
     // plain `z.object`, not `.strict()`, so a bare deletion would strip an authored
@@ -17366,15 +17367,18 @@ export const RETIRED_DEFS_BY_MAJOR: Readonly<Record<number, readonly string[]>>
     // compliance and a six-number summary — and no layer ever emitted, stored, parsed
     // or read one. Its only importer of any kind was `PluginSecurityScanner`, a
     // type-only import from `packages/core/src/security/security-scanner.ts`, and
-    // #14919 deleted that file; the census after it landed put every remaining
+    // PR #15930 deleted that file (it closed issue 14919, a number since deleted
+    // from the board and no longer resolving); the census after it landed put every remaining
     // reference inside the declaring module itself, against a lit control (five hits
     // for `PluginSecurityManifest` in the same file), so the zero is a reading.
     //
     // Whole-def retirement, not a tombstone: nothing parses this def, so there is no
     // author to hand a prescription to and no `${defKey}:${name}` key leaving a live
     // shape. `RETIRED_DEFS_BY_MAJOR[18]` plus the semantic entry
     // `plugin-security-scan-result-surface-retired` ARE the declaration — the
-    // #11825 / #8715 shape. The two authorable carriers that pointed here,
+    // #11825 shape (its sibling in the pair this tree usually cites, issue 8715, is
+    // a number deleted from the board; 11825 is the half that still resolves).
+    // The two authorable carriers that pointed here,
     // `PluginSecurityManifest.scanResults` and `.vulnerabilities`, are separately
     // tombstoned and registered in `RETIRED_KEYS_BY_MAJOR[18]`.
     //