docs(qa): re-anchor the dead tracker citations in packages/qa to the commits that decided them

packages/qa/downstream-contract/src/additional-domains.fixtures.ts

@@ -8,7 +8,7 @@
 // README.
 //
 // The annotations moved from `XInput` to the BARE name in protocol 17
-// (ADR-0122 phase 2, #6083) and that is not an exception to the freeze — it is
+// (ADR-0122 phase 2, commit 53068c130) and that is not an exception to the freeze — it is
 // the freeze working. These fixtures pin the AUTHOR state; phase 2 moved the
 // author state onto the bare name and retired `XInput` as a synonym of it, so
 // keeping `XInput` here was not an option and switching to it was not a choice.
@@ -130,7 +130,7 @@ export const DcMapping: Mapping = {
   fieldMapping: [{ source: 'Name', target: 'name', transform: 'none' }],
 };
 
-// `DcTheme` left with `ThemeSchema` (#10485, ADR-0049 — the theme authoring
+// `DcTheme` left with `ThemeSchema` (commit 35ad101bc, ADR-0049 — the theme authoring
 // surface is retired; the freeze pins author state against a LIVE surface, and
 // this one no longer exists).
 

packages/qa/http-conformance/src/adapter.ts

@@ -29,7 +29,7 @@ import type { HttpResponseObserver } from '@objectstack/core';
  * - **`getPort()`**: used by boot code/tests to discover the OS-assigned
  *   port after `listen(0)`.
  *
- * Since #6143 it also implements the contract's optional
+ * Since commit 12298c7d6 it also implements the contract's optional
  * {@link NodeHttpServer.setFallbackHandler} — see the CONTRACT there. That is
  * NOT a third soft extension: the member is part of `IHttpServer` and carries
  * four testable guarantees, and this adapter has to satisfy them before the
@@ -186,7 +186,7 @@ export class NodeHttpServer implements IHttpServer {
      * Install the LAST-RESORT handler — see the CONTRACT on
      * `IHttpServer.setFallbackHandler` in `@objectstack/spec/contracts`
      * (#5040 §1-C). `node:http` ships no not-found hook to map onto, so this
-     * adapter builds the equivalent out of its own router (#6143). The four
+     * adapter builds the equivalent out of its own router (commit 12298c7d6). The four
      * guarantees, and how each is honoured HERE:
      *
      *  1. **Only after every registered route has missed.** The handler is a
@@ -254,7 +254,7 @@ export class NodeHttpServer implements IHttpServer {
      * an accurate `Allow` when the path exists under another verb, otherwise
      * the shared 404 body.
      *
-     * Extracted from {@link handleRequest} by #6143 because it gained a second
+     * Extracted from {@link handleRequest} by commit 12298c7d6 because it gained a second
      * call site: the fall-through after an installed fallback declined to
      * answer. Both paths must produce the byte-identical answer — a fallback
      * that writes nothing may not cost a caller the `Allow` header.
@@ -343,7 +343,7 @@ export class NodeHttpServer implements IHttpServer {
                 }
             });
         }
-        // The LAST-RESORT seam (#6143): consulted ONLY here, i.e. only once
+        // The LAST-RESORT seam (commit 12298c7d6): consulted ONLY here, i.e. only once
         // every explicitly registered route has missed — see the CONTRACT on
         // {@link setFallbackHandler}. Resolved BEFORE the request body is read
         // so an unmatched request on a server with NO fallback installed still

packages/qa/http-conformance/src/fallback-seam.conformance.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * `IHttpServer.setFallbackHandler` — cross-adapter conformance (#6143).
+ * `IHttpServer.setFallbackHandler` — cross-adapter conformance (commit 12298c7d6).
  *
  * The contract (`packages/spec/src/contracts/http-server.ts`, #5040 §1-C)
  * makes four testable promises, and until this file the conformance package
@@ -24,7 +24,7 @@
  *
  * Every case here runs against BOTH adapters over a real socket: the
  * zero-dependency `NodeHttpServer` (this package's reference implementation,
- * which gained the member for this suite — #6143) and `HonoHttpServer` (the
+ * which gained the member for this suite — commit 12298c7d6) and `HonoHttpServer` (the
  * primary adapter). A Hono-only conditional case would prove nothing about
  * cross-adapter agreement, which is the entire point of this package.
  */

packages/qa/http-conformance/src/query-multiplicity.conformance.test.ts

@@ -73,7 +73,7 @@
  * `fallback-seam.conformance.test.ts`) repeated a parameter at all.
  *
  * Consumer-side tests do not cover it either: `packages/rest`'s
- * `package-routes-query-multiplicity.test.ts` (#6307) hand-constructs
+ * `package-routes-query-multiplicity.test.ts` (commit 293476148) hand-constructs
  * `query: { version: [...] }` and drives the handler directly, so it asserts a
  * shape no adapter is obliged to produce. A hand-built double can produce
  * anything, which is precisely why that suite stayed green while the adapters
@@ -293,7 +293,7 @@ describe('node ↔ hono: the repeated-parameter answer no longer depends on whic
     });
 
     it('hands a consumer the SAME operand on either adapter — the ambiguity is visible, not collapsed', async () => {
-        // Why the shape agreement is not cosmetic: this is the read #6307
+        // Why the shape agreement is not cosmetic: this is the read commit 293476148
         // found on `DELETE /api/v1/packages/:id`, where a truthy single
         // `version` silently narrowed a destructive operation's scope. Before
         // route 2 the operand differed by server — `'1.0.0'` on Hono, an ARRAY

packages/qa/vitest-filter-preflight/src/index.ts

@@ -2,7 +2,7 @@
 
 /**
  * A vitest FILE FILTER that selects nothing must say so — even when the rest
- * of the same run selects something (#17853, #17978).
+ * of the same run selects something (commit 08f5f0e5a, #17978).
  *
  * ## The defect this closes, and the half vitest already covers
  *
@@ -270,7 +270,7 @@ export function testFilesUnder(root: string): string[] {
  * other seven: its `Populations` is a record of CONCRETE paths and a glob
  * pattern cannot be a member of one. `packages/cli` satisfies the concrete-path
  * contract only as a by-product of a tier walk it already performed for
- * unrelated reasons (#13504 / #14554), so it passes its two exact arrays to
+ * unrelated reasons (commit 44813ba57 / #14554), so it passes its two exact arrays to
  * `runFilterPreflight` directly and never calls this function.
  *
  * The exact project's population is `L` itself — exact, not a superset, because