docs(mcp): re-anchor the dead tracker citations in packages/mcp/src to the commits that decided them

packages/mcp/src/__tests__/plugin-execution-context.test.ts

@@ -3,8 +3,8 @@
 // ── The stdio ExecutionContext is assembled by the SHARED assembler (#7279) ──
 //
 // `resolveStdioExecutionContext` was the LAST hand-written `ExecutionContext`
-// assembly on the platform: #6216 converged the dispatcher / REST / share-link
-// sites onto `assembleExecutionContext` and this face was not in that card's
+// assembly on the platform: commit f586f1a89 converged the dispatcher / REST / share-link
+// sites onto `assembleExecutionContext` and this face was not in that commit's
 // inventory at all. Hand assembly is what let it fall behind the envelope in
 // two different ways, and this file pins both halves of the convergence plus
 // the one deliberate DIVERGENCE it keeps.

packages/mcp/src/mcp-record-id-key-mistake-refusal.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * #17568 — a refusal for a MISSING required key must also name the UNEXPECTED
+ * Commit 9c9e6d08f — a refusal for a MISSING required key must also name the UNEXPECTED
  * key the caller actually sent.
  *
  * THE DEFECT, measured on a real Claude Code client against a real service

packages/mcp/src/mcp-server-runtime.metadata-outage.test.ts

@@ -286,11 +286,11 @@ describe('object_schema resource — a metadata outage is not "Object not found"
     // declined to presume an equivalence the contract did not then document
     // (Prime Directive #12).
     //
-    // [#6724] The parenthetical that used to sit here claimed that the facade's
+    // [commit 4f3d2322e] The parenthetical that used to sit here claimed that the facade's
     // `getObject` is NOT `get('object', name)`. That was false: the two hand
     // back the identical object on every implementation this repo ships (pinned by
     // `packages/objectql/src/metadata-service-getobject-equivalence.test.ts`,
-    // PR #6839; documented on `IMetadataService.getObject` by PR #6723).
+    // PR #6839; documented on `IMetadataService.getObject` by commit 8ad609c69).
     // Whether the resolver should change is a separate call this correction
     // does not make. What this case pins is unchanged either way: the
     // diagnosed read is a verdict probe on the MISS path only.

packages/mcp/src/mcp-server-runtime.ts

@@ -269,7 +269,7 @@ interface ToolWorldHint {
  * ```
  *
  * For the two safety hints, omission lands on the cautious answer and costs
- * only information — which is why #13318 could move them to omit-when-unsourced
+ * only information — which is why commit 3ec8646f1 could move them to omit-when-unsourced
  * and call it conservative. For this one, omission lands on the LESS cautious
  * reading: a tool that sources nothing is understood by every conforming host
  * to reach an open world. That trade is accepted on purpose. For an
@@ -622,7 +622,7 @@ async function diagnosedGet(
  * this answer be trusted as complete?" is asked of the contract member that is
  * declared to answer it.
  *
- * [#6724] This TSDoc used to offer a second, factual ground — that the
+ * [commit 4f3d2322e] This TSDoc used to offer a second, factual ground — that the
  * equivalence "does not hold in general", `MetadataFacade.getObject` (objectql)
  * returning "a different shape from its own `get()`". That claim is **false**,
  * and it was asserted rather than measured. `SchemaRegistry.getItem`
@@ -633,8 +633,8 @@ async function diagnosedGet(
  * **identical object reference** on a hit, and both answer `undefined` on a
  * miss. All three shipped implementations are pinned that way by
  * `packages/objectql/src/metadata-service-getobject-equivalence.test.ts`
- * (PR #6839 for #6745), and `IMetadataService.getObject` has documented the
- * equivalence since PR #6723 (#6505) — so the "no documented equivalence" half
+ * (commit 7a5ef0008, PR #6839), and `IMetadataService.getObject` has documented the
+ * equivalence since commit 8ad609c69 (#6505) — so the "no documented equivalence" half
  * above is a fact about #6055's repo, not today's.
  *
  * Correcting the record does not decide the design question, and this note
@@ -649,7 +649,7 @@ async function diagnosedGet(
  *   object that is genuinely absent. That is the conservative direction — it
  *   withholds, it never admits — and no such host exists today
  *   (`MetadataManager` is the only `getDiagnosed` implementation on `main`).
- *   Since PR #6723 the contract also rules such a host out by declaration, so
+ *   Since commit 8ad609c69 the contract also rules such a host out by declaration, so
  *   this reads as residual risk against a contract violation, not as a live
  *   divergence anyone can point at.
  */

packages/mcp/src/mcp-tool-bridge-safety-annotations.test.ts

@@ -420,7 +420,7 @@ describe('bridgeTools — the safety annotations a client receives', () => {
 // ---------------------------------------------------------------------------
 
 /**
- * THE DIRECTION THE CASE ABOVE CANNOT SEE (#13486).
+ * THE DIRECTION THE CASE ABOVE CANNOT SEE (commit 6193e576d).
  *
  * `safetyAnnotations` keeps two literal name sets that are hand copies of
  * `PLATFORM_TOOLS_BY_PACKAGE`. The registry-driven pin above catches a name

packages/mcp/src/plugin.ts

@@ -5,7 +5,7 @@ import {
   assembleExecutionContext,
   resolveAuthzContext,
   resolveLocalizationContext,
-  // [#15348 / #16013 / #17114] The two symbols this door's tenancy-posture
+  // [#15348 / #16013 / commit 4af758d47] The two symbols this door's tenancy-posture
   // read is built from. `classifyAdmissionTenancyPosture` is the ONE shared
   // classification decision 1 option A requires (#13906) — branded "never
   // registered" ⇒ quiet `undefined`, every other rejection ⇒ the loud
@@ -64,7 +64,7 @@ import { CONNECT_AGENT_UI_BUNDLE } from './connect-ui.js';
  *    admitting on it is exactly the permissive-on-failure defect #13906 exists
  *    to repair, and the reason this seam is not a one-liner.
  *
- * [#17114] That classification is no longer hand-written here — it is
+ * [commit 4af758d47] That classification is no longer hand-written here — it is
  * `classifyAdmissionTenancyPosture` (`@objectstack/core`), the shared function
  * #16013 extracted and which this seam was one of the two left outside. ⛔ The
  * RESOLUTION is NOT shared: which of this door's two accessors may be asked is
@@ -123,7 +123,7 @@ async function resolveStdioTenancyPosture(ctx: PluginContext): Promise<TenancyPo
  * call is scoped exactly like the same identity over REST (RLS / FLS / tenant).
  *
  * [#7279] Assembled by the SHARED `assembleExecutionContext` rather than by
- * hand. This face was the last hand-written assembly left after #6216 converged
+ * hand. This face was the last hand-written assembly left after commit f586f1a89 converged
  * the dispatcher / REST / share-link sites, and hand assembly is what let it
  * fall behind the envelope twice over: it dropped `tabPermissions`, and it
  * resolved no localization at all. The assembler's field set is CLOSED, so the

packages/mcp/src/stdio-data-bridge.not-found.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * #8422 — the stdio bridge's by-id write seams must throw the repo's ONE
+ * Commit 4810dd628 — the stdio bridge's by-id write seams must throw the repo's ONE
  * not-found envelope (`recordNotFoundError`, `@objectstack/core`), not a
  * locally minted `Error`.
  *

packages/mcp/src/stdio-data-bridge.ts

@@ -82,7 +82,7 @@ import {
 } from '@objectstack/spec/data';
 import type { ExecutionContext } from '@objectstack/spec/kernel';
 import type { IDataEngine, IMetadataService } from '@objectstack/spec/contracts';
-// [#8422] The repo's ONE single-record 404 (#4435/#5138/#7867). Imported from
+// [commit 4810dd628] The repo's ONE single-record 404 (#4435/#5138/#7867). Imported from
 // `@objectstack/core` rather than re-minted here or reached via
 // `@objectstack/metadata-protocol`'s re-export: this package already declares
 // a direct `@objectstack/core` dependency (`plugin.ts` imports from it too),
@@ -391,7 +391,7 @@ export function createStdioDataBridge(deps: StdioDataBridgeDeps): McpDataBridge
       // nothing is the #5138/#5581 defect the HTTP path already paid for: an
       // integrator reading a success receipt records the change as landed.
       // `registerObjectTools` turns a throw into a tool error, so the caller
-      // is told. [#8422] Throws the repo's ONE not-found envelope
+      // is told. [commit 4810dd628] Throws the repo's ONE not-found envelope
       // (`recordNotFoundError`, `@objectstack/core`) rather than a bare
       // `Error`, so a stdio caller sees the same `RECORD_NOT_FOUND` / 404 the
       // HTTP bridge's `callData` path throws for the identical miss.

packages/mcp/src/stdio-tenancy-posture-api-key-matrix.test.ts

@@ -566,7 +566,7 @@ describe('[#15348] §5 — the posture and the membership are both re-read per c
 });
 
 // ---------------------------------------------------------------------------
-// §6 [#17114] — the fold onto `classifyAdmissionTenancyPosture`, measured at
+// §6 [commit 4af758d47] — the fold onto `classifyAdmissionTenancyPosture`, measured at
 // the two edges a fold can get wrong.
 //
 // §1 and §4 already pin the discrimination itself on the registry's own