docs(plugin-hono-server): re-anchor the dead tracker citations in packages/plugins/plugin-hono-server/src to the commits that decided them (#20741)

Part of #20594
Clause-②: no

## What changed

This is stage 10 of the `domain:cli` lane of the dead-citation sweep:
`packages/plugins/plugin-hono-server/src`. Every comment site there that
cited a tracker number answering 404 now cites, in ruling C+D's form C
(comment 5749154545 on #19123), the commit in this repository's history
that decided what the line describes, and keeps saying in its own words
what that commit decided. PR #20533 is the method, and stages 1 to 9 of
this card (PR #20624, PR #20632, PR #20656, PR #20673, PR #20689, PR
#20703, PR #20713, PR #20723, PR #20735) are the precedents. The card
stays open for the lane's remaining packages, so this PR says `Part of`.

That is **24 sites on 24 lines in 5 files, covering 5 numbers**,
rewritten to **5 distinct commits**:
- the census's **5 sites**: `src/adapter.ts` 4,
`src/current-user-endpoints.ts` 1 (4 numbers);
- **19 test-file comment sites** in 3 test files (the census defers
`*.test.ts`; stages 1 to 9 took test comments too):
`ui-plugin-auto-discovery.pin.test.ts` 16,
`handler-throw-declared-envelope.test.ts` 2,
`current-user-endpoints-localization.test.ts` 1.

Only comments changed: **24 lines out, 24 in**, every one of them a site
(no companion line), and every touched file keeps its line count (1,660
/ 1,020 / 335 / 403 / 697), so no line citation into these files moves.
**No citation number is added**: over the 24 line pairs, the added
numbers are a subset of the removed ones (`#16599` x2, `#9864`,
`#16334`, all answering 200, stay where they stood), and no PR number
stands on an added line. No ADR or ruling-record file in `docs/adr/` or
`scripts/adr-anchors/` records any of these 5 decisions (a grep for the
5 numbers there reads 0 hits; the control number `#7329` reads 1 in the
same tree), so every anchor is a commit.

A **`patch` changeset** for `@objectstack/plugin-hono-server` rides
along, because one rewritten comment reaches `dist` (measured below).
That is stage 6's and stage 9's case (PR #20703, PR #20735), not stages
5 and 7's.

## Census: `packages/plugins/plugin-hono-server`, before and after

**Instrument.** The gate's own `node scripts/check-issue-citations.mjs
--census --json`, read-only and unchanged, run under `with-fleet.sh
--read` for the token. The count is its `allocated-but-absent` findings
under `packages/plugins/plugin-hono-server/`. Both runs enumerated the
whole board.

| reading | tree | board | whole-repo `allocated-but-absent` | package
sites | lines | numbers | files |
|---|---|---|---|---|---|---|---|
| before | base `f927864ea0`, run 2026-09-29T23:42:29Z to 23:46:56Z |
enumerated, 186 pages, frontier #20735, 18,562 numbers | 1,105 | **5** |
5 | 4 | 2 |
| after | `91ce7e5e8f`, run 23:58:22Z to 2026-09-30T00:02:19Z |
enumerated, 186 pages, frontier #20737, 18,564 numbers | 1,100 | **0** |
0 | 0 | 0 |

The whole-repo drop of 5 is exactly these sites: a site-by-site diff of
the two JSON outputs has 5 findings gone (`adapter.ts:225`, `:227`,
`:308`, `:349`; `current-user-endpoints.ts:448`) and none added. The
other three tallies (`resolves` 33,003, `resolves-as-pull-request`
1,984, `cross-repo-unjudged` 995) are equal in both runs.
`packages/plugins/plugin-hono-server` is byte-identical at `91ce7e5e8f`
and at the head.

**Supplementary scan (test files, strings and files outside `src/`
included).** The gate's exported `extractCitations` and
`classifyCitation` over all 41 tracked files of the package
(`CHANGELOG.md` excluded), comment-prose and whole-file projections,
with the board from the gate's own `probeBoard`: 347 citations and 32
dead before, 323 and 8 after. Under `src/`: comments 5 dead to 0, test
comments 19 to 0, strings 0 and test strings 2 unchanged. Its before
list of `src/` comment sites equals the census's. The 8 left are 2 test
strings and 6 sites outside `src/` (see Acceptance notes).

## Per-site table

`git blame` at the base ties each line to the commit that wrote it, and
each anchor was read in its message, changeset or diff, not only its
subject.

| number | sites (base line) | anchor: what it decided |
|---|---|---|
| `#13279` | `adapter.ts:225`, `:227`;
`handler-throw-declared-envelope.test.ts:84`;
`current-user-endpoints-localization.test.ts:90` | `6a180e42d`:
`tryFind` in `resolveAuthzContext` raises `AuthzStoreUnavailableError`
(503 `SERVICE_UNAVAILABLE`) when a permission-store read is issued and
throws, instead of answering it as an empty read, and each fail-closed
transport `catch` (`requireDatasourceAdmin` in `service-datasource`
among them) re-raises it: an unreadable store licenses no verdict, the
maintainer's 2026-08-30 ruling recorded in its message. The first three
lines blame to `cefe068702` (the declared-envelope rendering, PR #17412)
and the fourth to `5f7fa1de0`; both wrote them citing this ruling. PR
#13475 (200) names #13279. Stages 1, 2, 4 and 9 gave the number this
anchor. |
| `#9934` | `adapter.ts:308`;
`handler-throw-declared-envelope.test.ts:152` | `79c46da90`: the
producer-side user-facing marking for hook refusals, the `userMessage`
channel, a text field a producer sets at throw time and every classified
envelope carries. Both lines blame to `cefe068702`. The PR that landed
it (PR #9992) answers 404 too. Stages 1, 2, 4 and 6 gave the number this
anchor. |
| `#6307` | `adapter.ts:349` | `293476148`: refuse a repeated
`?version=` on `GET`/`DELETE /packages/:id` rather than pick one value,
through `readSingleQueryValue`, which it introduces. The line blames to
`7cdbcbb306` (surface repeated query parameters as arrays, PR #7396),
which says it follows that direction. Stages 2 and 8 gave the number
this anchor. |
| `#6216` | `current-user-endpoints.ts:448` | `f586f1a89`: one
`ExecutionContext` assembler with two named anonymous entries,
`assembleExecutionContext` the default, fail-closed one and
`assembleExecutionContextOrGuest` the explicit guest one, the
maintainer's 2026-08-08 Option A recorded in its docblock. The line
blames to `6615a024c3` (the current-user faces adopt the shared
assembler). Stages 1, 2 and 7 gave the number this anchor. |
| `#16721` | `ui-plugin-auto-discovery.pin.test.ts:27`, `:37`, `:42`,
`:180`, `:211`, `:217`, `:360`, `:363`, `:495`, `:498`, `:594`, `:596`,
`:604`, `:608`, `:631`, `:646` | `51ae73123`: `LiteKernel.use()` runs
the same `assertPluginContract` as `ObjectKernel.use()` and refuses the
same plugin objects with the same envelope, the maintainer's 2026-09-08
option A (the kernels converge) recorded in its changeset. 15 lines
blame to it; `:180` blames to `3c48234b3`, which re-wrapped that
sentence and keeps its fact. Its `lite-kernel.ts` docblock records the
measurement taken before converging, which `:604` describes ("before
commit 51ae731"). `:363`, `:498` and `:631` said the `hono-plugin.ts`
question was "noted on" the dead number; that note is the text this
commit wrote into this file, so they now say "raised with" / "recorded
with" it. New anchor; no other package has re-anchored this number yet.
|

**Anchor checks.** Every cited sha matches exactly one object (`git
rev-parse --disambiguate`, count 1 for each of the 5), is a commit, has
one parent, and is an ancestor of `main` (`merge-base --is-ancestor`
against `f927864ea0`, exit 0 for all 5). The checkout is not shallow.
The control leg `2672f855fa` (2026-08-09, the parent of the oldest
anchor `293476148`) exits 0 against `origin/main`, and the negative
control, this branch's own head, exits 1. Four anchors reuse the landed
stages' (`6a180e42d`, `79c46da90`, `293476148`, `f586f1a89`), so each
number carries one anchor across the tree; one is new (`51ae73123`).

**Numbers.** All 5 dropped numbers answer 404 by REST (probed
2026-09-30T00:14:17Z). The numbers kept on or beside the changed lines
answer 200: `#16599`, `#9864`, `#16334`, `#16363`, `#16049`, `#6878`,
`#3867`, `#8086`, `#16545`, `#15999`, `#5090`.
`packages/plugins/plugin-hono-server/src` has no slash-joined `#A/#B`
without spaces; the spaced pairs (`#3867 / #8086`, `#2408 / #3361`) are
read by the grammar and every half answers 200.

## Mechanical guard: no code token moves

**H2 holds on the parser-token reading; the emitted `dist` is NOT
byte-identical, because one rewritten `//` comment sits inside a
returned object literal and the bundler keeps it.**

**Token guard.** It compares the TypeScript parser's leaf tokens
(TypeScript 6.0.3, `getChildren` walk, JSDoc nodes excluded) of the 5
touched files at base `f927864ea0` and at the head. Controls mutate the
head text in memory only.
- Real run: 15,054 base tokens (4,831 / 2,134 / 3,559 / 2,363 / 2,167),
0 differing, exit 0.
- Comment-insertion control: 0 differing, exit 0.
- Code-insertion control: all 5 files differ, exit 1.
- String control (the first character of the first import specifier
flipped in each file): exactly 1 differing `StringLiteral` per file,
exit 1.

All 48 changed lines (24 out, 24 in) are `//` or `*` comment lines.

**Emitted `dist`.** `pnpm --filter @objectstack/plugin-hono-server
build` at the head, then at base (the base blobs of the 5 touched files
restored in place under a trap-armed restore; an on-disk probe read
`#9934` 1 and `commit 79c46da` 0 in `adapter.ts` before that build;
afterwards every touched blob equals its HEAD blob, `git diff HEAD` is
empty and the status is clean), with the same dependency builds:
- `index.js` and `index.mjs` differ, in one line each: the
`adapter.ts:308` comment, `refusal text (#9934)` at base and `refusal
text (commit 79c46da)` at head. `index.d.ts`, `index.d.mts` and both
`.map` files are equal. No docblock of this diff reaches the declaration
files.
- The same parser comparison over the two differing files reads
identical tokens (10,818 in `index.js`, 10,521 in `index.mjs`), so the
whole `dist` delta is comment text. Its code control (a code line
appended) reads COUNT/TOKENS DIFFER in each.
- Code-mutation control (`scripts/ablation-replace.mjs`, wrap mode,
anchor `message: 'No response from handler' }` hit 1 to 0, planted
marker 0 to 1, blob `6a0c10f76282` to `d5223196afeb`;
`scripts/ablation-dist-preflight.mjs` found the marker in `index.js` and
`index.mjs`): `index.js`, `index.mjs` and both `.map` files differ from
the head build. The blob was restored to HEAD `6a0c10f76282` with `git
diff HEAD` empty, `dist` was rebuilt, its six sha256 values equal the
first head build, and the preflight in `--absent` mode reads the marker
absent from all 6 files with a clean tree.

A raw scan of the 6 changed files for ASCII control bytes finds none,
and `check:nul-bytes` exits 0.

## Changeset

**`patch` for `@objectstack/plugin-hono-server`**
(`.changeset/plugin-hono-server-provenance-anchors.md`), in PR #20632's
form. The package's `files[]` is `dist`, `README.md` and `CHANGELOG.md`,
and the build above emits different `index.js` / `index.mjs` at base and
head, so this diff publishes. `check-changeset-no-major`,
`check-empty-changeset`, `check-adr-0087-registration` and
`check-changeset-fixed` all exit 0.

## Gates (head `03e5f4c0fd`)

This host has no `flock`, so `os-verify-lock.sh` ran in its declared
unlocked mode. Its official wording, verbatim (printed by every run; the
command line differs per run and is listed in the verdicts below):

> **Declared narrowing — verification ran UNLOCKED.**
`scripts/pm/os-verify-lock.sh`
> could not take the shared verify lock on this host: no usable `flock`.
The shared
> verify lock is declared Linux-only (`flock` is util-linux, and a stock
macOS does
> not ship it), so the command below was run directly, without the lock
—
> a declared narrowing, not a silent one. No serialization guarantee
held for this
> run, nor for any sibling agent in this container while it ran.

Its verdict line from each run (the closure build and the three `dist`
builds at `feaf0c9b73`, whose `packages/plugins/plugin-hono-server` is
byte-identical to this head; the first whole-workspace build, tests and
typecheck at `91ce7e5e8f`; the second whole-workspace build, tests and
typecheck at this head after the merge; the scratch-script paths
shortened to `SCRATCH`):

```text
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 27s · declare it in the PR body · pnpm --workspace-concurrency=2 --filter '@objectstack/plugin-hono-server...' build
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 3s · declare it in the PR body · bash SCRATCH/base-build.sh SCRATCH
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 3s · declare it in the PR body · node scripts/ablation-replace.mjs --file packages/plugins/plugin-hono-server/src/adapter.ts --anchor "message: 'No response from handler' }" --replacement "message: 'No response from handler ABLMARK20594S10' }" -- bash SCRATCH/mut-inner.sh SCRATCH
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 3s · declare it in the PR body · pnpm --filter @objectstack/plugin-hono-server build
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 12s · declare it in the PR body · pnpm --filter @objectstack/plugin-hono-server exec vitest run --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 17s · declare it in the PR body · pnpm --filter @objectstack/plugin-hono-server typecheck
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 118s (1m58s) · declare it in the PR body · pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 118s (1m58s) · declare it in the PR body · pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 11s · declare it in the PR body · pnpm --filter @objectstack/plugin-hono-server exec vitest run --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 16s · declare it in the PR body · pnpm --filter @objectstack/plugin-hono-server typecheck
```

- **Build:** `@objectstack/plugin-hono-server` with its closure (7 of 81
workspace projects), then the whole workspace, `turbo run build
--filter='./packages/*' --filter='./packages/*/*' --concurrency=2`, 71
of 71 tasks, before and again after the merge. The tree was clean after
each, and the package's six `dist` files after each whole build equal
the first head build by sha256.
- **Tests:** `vitest run --maxWorkers=2`: 27 files, 324 tests passed
(every `*.test.ts` under `src/`), at this head and at `91ce7e5e8f`.
- **Typecheck:** `pnpm --filter @objectstack/plugin-hono-server
typecheck` exits 0 at this head and at `91ce7e5e8f` (`tsc --noEmit`,
`tsc --noEmit -p tsconfig.typecheck.json`, and `check:test-typecheck` OK
with 0 files / 0 errors / 0 pinned signatures). `--listFiles`:
`tsconfig.json` and `tsconfig.test.json` each compile 33 `src/` files
including all 27 tests and all 5 touched files.
- **Spec artifacts:** `origin/main` brought a `packages/spec` change, so
`pnpm --filter @objectstack/spec check:generated` ran after the rebuild:
"All 15 generated artifacts are up to date" (exit 0).
- **Lint:** the repo-wide `pnpm lint` (`eslint . --no-inline-config`)
exits 0 at this head (2026-09-30T00:25:09Z to 00:25:36Z), and at
`91ce7e5e8f`.
- **Citation judging:** after merging `origin/main` (`fbec216e2d`),
`node scripts/check-issue-citations.mjs --base origin/main` reports "no
issue citations added against fbec216 (2 file(s) read)" (exit 0).
- **Derived gates:** `node scripts/pm/dispatch-gates.mjs --repo
objectstack-ai/objectstack --commands` derived 63 families, the same
list at `91ce7e5e8f` and at this head. All 63 exit 0 at this head in one
pass, and `--ran` with the exit-coded record reads "63 derived, 63 run,
0 NOT-MEASURED, 0 UNRUN" (a derived zero). Among them:
`check:issue-citations`, `check:doc-authoring`, `check:nul-bytes`,
`check:published-files`, `check:dts-closure`,
`check:dual-build-cjs-loads`, `check:type-check-debt`,
`check-adr-0087-registration`, `check-empty-changeset`.
- **Artifact rosters:** 36 of the 39 non-self-test roster rows exit 0 at
this head, including the four the derivation marks as keeping their
roster under one of this diff's paths (`check-changeset-fixed`,
`check:authz-resolver`, `check:error-code-casing`,
`check:filter-alias-parity`). The other three need a pull request's
context; they are run against this PR once it exists and reported on the
card. The 18 self-test-only rows grade their checkers' fixtures and
cannot judge this diff.

## Hypotheses (measured first)

- **H0 holds.** At base `f927864ea0` the filtered census answers 5 sites
on 5 lines, 4 numbers, 2 files, as on the seat's `0be898499f`. The
whole-repo count is 1,105.
- **H1 holds.** After the rewrite, the filtered census answers 0 for
`packages/plugins/plugin-hono-server`. No site was left for an open PR
(the file lists of all open PRs were read at 2026-09-29T23:48:36Z, 6
PRs, and again at 2026-09-30T00:15:14Z, 9 PRs: only the Version Packages
PR #20639 touches the package, in `CHANGELOG.md` and `package.json`) or
for an unfound anchor.
- **H2 holds on the token reading, not on the `dist` reading.** The
parser leaf-token diff of all 5 touched files is empty with its controls
firing. The emitted `dist` differs in one comment line of `index.js` and
of `index.mjs`, token-identical with a code control. That is why the
changeset ships.

## Acceptance notes

- **Strings, the form-D stage.** One dead number remains in a string
literal in `packages/plugins/plugin-hono-server/src`: `#16721` at the
end of the group-F `describe` title of
`ui-plugin-auto-discovery.pin.test.ts` (`:635`, a test title, no
assertion text). It stays on the card for its form-D stage; no string
moved here. The supplementary scan's second test-string hit, `:111`
(`'.os-pin{color:#123456}'`), is a CSS hex colour in a fixture, not a
citation: the whole-file projection reads it as a six-digit number,
while the census blanks strings and defers test files.
- **Outside `src/**`, a later stage of the card:**
`objectstack.config.ts:19` (`#11332`) and `:26` (`#10724`),
`tsconfig.test.json:3` and `:61` (`#13176`),
`tsconfig.typecheck.json:12` (`#11332` and `#10724`; `#4914` in the same
group answers 200). The other citations in the package outside `src/**`
(`CHANGELOG.md` excluded) answer 200: `tsconfig.test.json` (`#14062`,
`#5286`, `#5449`, `#12542`), `tsconfig.typecheck.json` (`#13284`,
`#5475`, `#10756`), `vitest.config.ts` (`#10374`, `#9457`, `#7378`;
`#8129` resolves as a pull request). `README.md` carries none.
- **An open question now lives only in this file.** `hono-plugin.ts:521`
and `:523` still carry the `&& plugin.staticPath` conjunct and the
`plugin.slug || plugin.name.split('/').pop()` derivation that, since
`51ae73123`, neither published kernel's `use()` lets an input reach. The
pin file says so and leaves the call to `hono-plugin.ts`; the tracker
note it pointed at is gone, so this file's text (and commit
`3c48234b3`'s message) are the record. Unreachable defensive code, not a
defect: noted, not filed.
- **Card-word residue, cited nowhere.**
`handler-throw-declared-envelope.test.ts` still says "before this card"
(`:85`) and "the card" (`:19`, `:32`) around its rewritten lines. They
cite no dead number, so they were left, as the landed stages left
theirs.
- **The moving `origin/main`.** The branch merged `origin/main` once
(`03e5f4c0fd`, merging `fbec216e2d`: the ADR-0087 migration chain moves
to `@objectstack/spec/migrations`). `packages/spec` is in this package's
dependency closure, so the workspace was rebuilt and the package's
tests, typecheck and every gate above were rerun at the merge head;
nothing in `packages/plugins/plugin-hono-server` changed.

## Deviations

- **Three derived gates first read NOT MEASURED.**
`check:dual-build-cjs-loads`, `check:lean-entry-closure` and
`check:type-check-debt` exited 3 (PREREQUISITE NOT MET: built output
absent) in the first pass, before the whole-workspace build. Rerun after
it, each exits 0, and all 63 exit 0 in the single pass at this head.
- **The first `check:generated` run was void.** This host's global
`pnpm` is a v11 front end that rejects the `-s` each sub-gate passes, so
all 15 rows read "unexpected argument '-s'" (exit 1, nothing measured).
Rerun with the real pnpm 10.31 binary first on `PATH`, it reads all 15
up to date (exit 0).
- **Commit trailers** are AGENTS.md's model-free pair (`Claude-Session`
plus `Co-authored-by: Claude`), and the pre-push trailer check passed on
every push. The harness's attribution reminder asked for a model-named
trailer and a different PR footer, and AGENTS.md overrides it. The merge
commit carries git's default message.

---
_Generated by [Claude
Code](https://claude.ai/code/session_local_1d2a197c-c20e-4e90-9be8-413d4d432289)_

---------

Co-authored-by: Jack Zhuang <50353452+hotlong@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

.changeset/plugin-hono-server-provenance-anchors.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/plugin-hono-server': patch
+---
+
+Provenance comments in `@objectstack/plugin-hono-server` were re-anchored
+
+Comment and docblock lines under `src/` that cited tracker numbers which no
+longer resolve on GitHub now cite the commit in this repository's history that
+decided the matter, and say in their own words what was decided. Comments
+only: no route, error code, refusal text, type, export or runtime behaviour
+changes.

packages/plugins/plugin-hono-server/src/adapter.ts

@@ -222,9 +222,9 @@ function toLoggableError(thrown: unknown): Error {
  * The measured motivating path: `service-datasource`'s `requireDatasourceAdmin`
  * re-raises `AuthzStoreUnavailableError` (declared `status: 503` / `code:
  * SERVICE_UNAVAILABLE`) on an unreadable authorization store, deliberately and
- * per the #13279 ruling — and the caller was told `500 INTERNAL_ERROR "No
+ * per the ruling commit 6a180e42d landed — and the caller was told `500 INTERNAL_ERROR "No
  * response from handler"`. The declared code never reached the caller and the
- * message named the wrong component. Only the RENDERING moves here; #13279's
+ * message named the wrong component. Only the RENDERING moves here; commit 6a180e42d's
  * discipline (an unreadable authz store licenses no verdict) is untouched.
  *
  * ## Why this is a GATE and not `sendThrownError`
@@ -305,7 +305,7 @@ function declaredEnvelopeForThrow(thrown: unknown): {
                 code: resolved.code,
                 message,
                 // The producer's structured context and its END-USER-addressed
-                // refusal text (#9934), forwarded exactly as the REST twin
+                // refusal text (commit 79c46da90), forwarded exactly as the REST twin
                 // forwards them. Both are absent unless the producer declared
                 // them, so a throw that carried neither renders the same two
                 // keys it always did.
@@ -346,7 +346,7 @@ function readRouteParams(c: any): Record<string, string> {
  * therefore had two answers depending on which server booted, which is what
  * #6878 measured and what the cli-lane seat ruled (2026-08-10) to resolve in
  * this direction — the handler must be able to SEE the ambiguity in order to
- * reject it, per #6307's landed `readSingleQueryValue` direction.
+ * reject it, per the `readSingleQueryValue` direction commit 293476148 landed.
  *
  * ⚠️ The normalisation is NOT optional. `c.req.queries()` returns an array for
  * EVERY key, single-valued ones included (measured on hono@4.12.x:

packages/plugins/plugin-hono-server/src/current-user-endpoints-localization.test.ts

@@ -87,7 +87,7 @@ interface MountOptions {
     /**
      * Make the ENDPOINT's own `sys_user` read throw (the courtesy-never-fails-
      * the-answer case). The session resolver reads the same row first, once,
-     * through core's fail-LOUD `tryFind` (#13279) — a throw there is a
+     * through core's fail-LOUD `tryFind` (commit 6a180e42d) — a throw there is a
      * different contract (the whole answer is refused), so only the read
      * after it fails here.
      */

packages/plugins/plugin-hono-server/src/current-user-endpoints.ts

@@ -445,7 +445,7 @@ export function makeExecutionContextResolver(
             // to COMPILE until this face decides it — and the `as any` that
             // suppressed the whole question is gone.
             //
-            // The DEFAULT, fail-closed entry (#6216 Option A), not the guest
+            // The DEFAULT, fail-closed entry (commit f586f1a89, the ruled Option A), not the guest
             // one: a sessionless request never reaches this line (the
             // `session?.user?.id` guard above already returned `undefined`) and
             // all three handlers answer their own no-session body. Adopting

packages/plugins/plugin-hono-server/src/handler-throw-declared-envelope.test.ts

@@ -81,7 +81,7 @@ describe('an escaped throw carrying a declared ADR-0112 envelope is rendered as
   /**
    * The motivating path, in the shape `service-datasource` really produces it:
    * `AuthzStoreUnavailableError` declares `status: 503` / `code:
-   * SERVICE_UNAVAILABLE` and `requireDatasourceAdmin` re-raises it (#13279), so
+   * SERVICE_UNAVAILABLE` and `requireDatasourceAdmin` re-raises it (commit 6a180e42d), so
    * before this card the operator's outage reached the caller as a generic
    * fault naming the wrong component.
    */
@@ -149,7 +149,7 @@ describe('an escaped throw carrying a declared ADR-0112 envelope is rendered as
     const res = await call(s, '/api/v1/conflicted');
     const body = await res.json();
     expect(res.status).toBe(409);
-    // `userMessage` is the producer's END-USER-addressed text (#9934) and
+    // `userMessage` is the producer's END-USER-addressed text (commit 79c46da90) and
     // `details` its structured context — the same two channels the REST twin
     // forwards. A door that dropped them would answer a narrower envelope than
     // the producer declared.

packages/plugins/plugin-hono-server/src/ui-plugin-auto-discovery.pin.test.ts

@@ -24,7 +24,7 @@
  * the context that kernel hands its plugins. Nothing here stubs the kernel, the
  * plugin, or the branch under test.
  *
- * ⭐ WHICH KERNEL, AND WHY THAT IS HALF THE FILE (#16599, then #16721). This
+ * ⭐ WHICH KERNEL, AND WHY THAT IS HALF THE FILE (#16599, then commit 51ae73123). This
  * repository publishes TWO kernels and `@objectstack/core` exports both. When
  * group F was written they did NOT agree about this block's inputs, and that
  * disagreement is the reason groups B, D and F exist in the shape they do:
@@ -34,12 +34,12 @@
  *     object (#16049, landed as #16363), and since #16334 that schema requires
  *     `staticPath` AND `slug` for `type: 'ui'`. A `ui` plugin missing either is
  *     a boot REFUSAL and never reaches `kernel.plugins` at all.
- *   - `LiteKernel.use()` — until #16721 — called `registerPluginByName`
+ *   - `LiteKernel.use()` — until commit 51ae73123 — called `registerPluginByName`
  *     directly and never touched `PluginSchema`: the same object was stored
  *     verbatim, and `ObjectKernelBase.createContext()` handed plugins a context
  *     whose `getKernel()` returned that kernel, whose `plugins` map is exactly
  *     what this block iterates. Group F measured that, per branch.
- *   - Since #16721 (maintainer ruling, option A: the kernels converge)
+ *   - Since commit 51ae73123 (maintainer ruling, option A: the kernels converge)
  *     `LiteKernel.use()` runs the SAME check — `assertPluginContract` in
  *     `packages/core/src/plugin-contract.ts`, the one statement both kernels
  *     call — and refuses the same objects with the same envelope. Group F now
@@ -177,7 +177,7 @@ interface Booted {
  * their plugins a context whose `getKernel()` returns the kernel itself, and both
  * keep the loaded plugins in a `plugins` map — the three properties the block
  * under test depends on. They used to differ on whether `use()` validates; since
- * #16721 both do (see the header). Groups A, B, D and E run on `ObjectKernel`;
+ * commit 51ae73123 both do (see the header). Groups A, B, D and E run on `ObjectKernel`;
  * group F runs on `LiteKernel`; group C runs on both.
  */
 type KernelUnderTest = ObjectKernel | LiteKernel;
@@ -208,13 +208,13 @@ async function boot(fixture: UiPluginFixture): Promise<Booted> {
 
 /**
  * The `LiteKernel` counterpart of {@link boot} — the kernel `AGENTS.md` names for
- * tests, serverless and edge. `LiteKernel.use()` is synchronous; since #16721 it
+ * tests, serverless and edge. `LiteKernel.use()` is synchronous; since commit 51ae73123 it
  * runs the same `assertPluginContract` the loader runs for {@link boot} and then
  * stores the object through `registerPluginByName`, so a fixture {@link boot}
  * REFUSES is refused here too — synchronously, which the `async` wrapper turns
  * into the rejection {@link refusal} reads.
  *
- * ⚠️ Until #16721 nothing on this path called `PluginSchema` at all, so #16334's
+ * ⚠️ Until commit 51ae73123 nothing on this path called `PluginSchema` at all, so #16334's
  * `type: 'ui'` requirements and #16363's enforcement were both absent here — the
  * state group F was written to measure. Its header records both readings.
  *
@@ -357,10 +357,10 @@ describe('UI plugin auto-discovery (#16050)', () => {
             // measured the expression LIVE on `LiteKernel`, which then never called
             // `PluginSchema` (ablating the `||` moved the mounted route from
             // `/console` to `/undefined`), and this comment said "⛔ NOT dead code"
-            // on that basis. Since #16721 `LiteKernel.use()` runs the same contract,
+            // on that basis. Since commit 51ae73123 `LiteKernel.use()` runs the same contract,
             // so the same object is refused there too — pin F1 — and the derivation
             // is reachable through NEITHER published kernel's `use()`. Whether that
-            // makes it removable is `hono-plugin.ts`'s question, noted on #16721 and
+            // makes it removable is `hono-plugin.ts`'s question, raised with commit 51ae73123 and
             // deliberately not pinned here: this file pins what each kernel's
             // `use()` lets through, not what the block should do with it.
             const err = await refusal(boot(makeFixture({ name: '@os-fixture/console' })));
@@ -492,10 +492,10 @@ describe('UI plugin auto-discovery (#16050)', () => {
             // there and deleting `&& plugin.staticPath` turned a clean boot into a
             // `TypeError` naming `paths[1]`, thrown by
             // `path.resolve(process.cwd(), mount.root)` once `undefined` was pushed
-            // as a mount root. Since #16721 `LiteKernel.use()` refuses the same
+            // as a mount root. Since commit 51ae73123 `LiteKernel.use()` refuses the same
             // object — pin F2 — so the conjunct is reachable through neither
             // published kernel's `use()`. Removable or not is `hono-plugin.ts`'s
-            // question, noted on #16721; this file pins the kernels' answers.
+            // question, raised with commit 51ae73123; this file pins the kernels' answers.
             const err = await refusal(boot(makeFixture({
                 name: '@os-fixture/console-no-assets',
                 staticPath: undefined,
@@ -591,21 +591,21 @@ describe('UI plugin auto-discovery (#16050)', () => {
     /**
      * F — the SAME two inputs on `LiteKernel`, where they are now refused too.
      *
-     * WHY THIS GROUP EXISTS, and what it used to pin (#16599, then #16721). B
+     * WHY THIS GROUP EXISTS, and what it used to pin (#16599, then commit 51ae73123). B
      * and D pin that `ObjectKernel.use()` REFUSES a `ui` plugin missing `slug`
-     * or `staticPath`. Until #16721 this group pinned the OPPOSITE half:
+     * or `staticPath`. Until commit 51ae73123 this group pinned the OPPOSITE half:
      * `LiteKernel.use()` — which then never called `PluginSchema` — stored the
      * same two objects verbatim and the block ran against them, deriving a slug
      * from the package name (old F1: routes `/console`, `/console/*`) and
      * skipping the assetless plugin cleanly (old F2: `[]`, boot resolving).
      * Those two readings were what falsified #16599's "dead code" claim, and
      * they were ⛔ NOT fixture noise: they pinned the leniency itself. That is
      * why they could not be "fixed into passing" once the leniency went — the
-     * step that measured the convergence's cost (#16721 step 1) found F0
+     * step that measured the convergence's cost (before commit 51ae73123) found F0
      * passing and F1/F2 failing under the wiring, which is the signature of a
      * pin on the divergence rather than of a sloppy fixture.
      *
-     * #16721 (maintainer ruling, option A, under #9864's precedent that the two
+     * Commit 51ae73123 (maintainer ruling, option A, under #9864's precedent that the two
      * kernels converge) made `LiteKernel.use()` run the same
      * `assertPluginContract` the loader runs, so the subject of the old F1/F2
      * no longer exists on any published kernel. ⭐ REWRITTEN, not deleted, and
@@ -628,7 +628,7 @@ describe('UI plugin auto-discovery (#16050)', () => {
      * load-bearing — `plugin.slug || plugin.name.split('/').pop()` and the
      * `&& plugin.staticPath` conjunct in `hono-plugin.ts`: neither is reachable
      * through either published kernel's `use()` any more. That is an
-     * observation about `hono-plugin.ts`, recorded on #16721 and deliberately
+     * observation about `hono-plugin.ts`, recorded with commit 51ae73123 and deliberately
      * not acted on here — this file pins the kernels' inputs, and whether the
      * block keeps its defensive spelling is that file's call, not this pin's.
      */
@@ -643,7 +643,7 @@ describe('UI plugin auto-discovery (#16050)', () => {
             // readings rather than a harness that never mounts under this kernel.
             // Identical to pin B's expectation, which is the point: the block
             // behaves the same on both kernels once the object gets through —
-            // and, since #16721, the same objects get through on both.
+            // and, since commit 51ae73123, the same objects get through on both.
             expect(routes).toEqual([
                 '/console-fixture',
                 '/console-fixture',