diff --git a/packages/metadata-protocol/src/discovery-schema-conformance.test.ts b/packages/metadata-protocol/src/discovery-schema-conformance.test.ts
index db61f8ba272..431f4576ea4 100644
--- a/packages/metadata-protocol/src/discovery-schema-conformance.test.ts
+++ b/packages/metadata-protocol/src/discovery-schema-conformance.test.ts
@@ -303,7 +303,7 @@ describe('[#4828] getDiscovery() conforms to DiscoverySchema', () => {
       expect(DiscoverySchema.safeParse(discovery).success).toBe(true);
     });
 
-    // [#6287] `preview` left this list when it stopped being unrecognised: it is
+    // [commit 84c86fb45] `preview` left this list when it stopped being unrecognised: it is
     // a declared `EnvironmentTypeSchema` member and now has a stated fold
     // (`sandbox`), so asserting `development` for it here would assert the
     // opposite of the mapper's decision. The RULE these rows pin — an unknown
diff --git a/packages/metadata-protocol/src/get-meta-item-org-read-gate.test.ts b/packages/metadata-protocol/src/get-meta-item-org-read-gate.test.ts
index 8856acd3660..0893d2d2a4a 100644
--- a/packages/metadata-protocol/src/get-meta-item-org-read-gate.test.ts
+++ b/packages/metadata-protocol/src/get-meta-item-org-read-gate.test.ts
@@ -7,7 +7,7 @@
  *
  * ── The defect, and why the singular verb is the sharper half ─────────────
  *
- * Commit 96326040f (PR #14767) moved {@link organizationIdForMetaRead} INSIDE the PLURAL
+ * Commit 96326040f moved {@link organizationIdForMetaRead} INSIDE the PLURAL
  * verb, `getMetaItems`, and deliberately did not carry to this one. There, the
  * two `queryByOrg` reads are UNIONed, so an ungated organization can only ADD
  * rows — the resurrection that card is about. Here the two `findOverlay` reads
diff --git a/packages/metadata-protocol/src/get-meta-items-org-read-gate.test.ts b/packages/metadata-protocol/src/get-meta-items-org-read-gate.test.ts
index 5304f2d713a..c038a9dad90 100644
--- a/packages/metadata-protocol/src/get-meta-items-org-read-gate.test.ts
+++ b/packages/metadata-protocol/src/get-meta-items-org-read-gate.test.ts
@@ -121,7 +121,7 @@ function makeHarness(rows: StoredRow[]) {
                     return (r as unknown as Record<string, unknown>)[k] === v;
                 }),
             );
-            // `check:objectql-double-limit` (#10978) — hold the caller's bound,
+            // `check:objectql-double-limit` (commit 4c9780c7a) — hold the caller's bound,
             // applied AFTER the filter and BY PRESENCE.
             return opts?.limit === undefined ? matched : matched.slice(0, opts.limit);
         },
diff --git a/packages/metadata-protocol/src/meta-overlay-cache.test.ts b/packages/metadata-protocol/src/meta-overlay-cache.test.ts
index dd55086807d..8e9cb007754 100644
--- a/packages/metadata-protocol/src/meta-overlay-cache.test.ts
+++ b/packages/metadata-protocol/src/meta-overlay-cache.test.ts
@@ -176,7 +176,7 @@ function makeHarness(rows: StoredRow[], options: HarnessOptions = {}) {
                     return (r as unknown as Record<string, unknown>)[k] === v;
                 }),
             );
-            // `check:objectql-double-limit` (#10978) — hold the caller's bound,
+            // `check:objectql-double-limit` (commit 4c9780c7a) — hold the caller's bound,
             // applied AFTER the filter and BY PRESENCE. A double that hands
             // back every row it matched cannot tell a dropped bound from no
             // bound at all.
diff --git a/packages/metadata-protocol/src/migrations/read-probe.test.ts b/packages/metadata-protocol/src/migrations/read-probe.test.ts
index 551f32729a1..660d82c26a8 100644
--- a/packages/metadata-protocol/src/migrations/read-probe.test.ts
+++ b/packages/metadata-protocol/src/migrations/read-probe.test.ts
@@ -30,7 +30,7 @@
  * instead. The MySQL arm runs against a real server in
  * \`seed-tenancy-backfill.live-mysql.test.ts\`; the SQLite arm end to end against
  * a real \`SqlDriver\` in \`packages/runtime\`'s
- * \`seed-tenancy-autonumber-split.integration.test.ts\`; and [#17621] the POSTGRES
+ * \`seed-tenancy-autonumber-split.integration.test.ts\`; and [commit 7e74af3df] the POSTGRES
  * arm — recorded here as NOT MEASURED anywhere for as long as that was true —
  * now runs in \`seed-tenancy-backfill.live-postgres.test.ts\`, on the postgres
  * service the \`Temporal Conformance\` job already provisions. All three arms are
diff --git a/packages/metadata-protocol/src/migrations/seed-tenancy-backfill.live-postgres.test.ts b/packages/metadata-protocol/src/migrations/seed-tenancy-backfill.live-postgres.test.ts
index 35469d66d8a..3457d6e431e 100644
--- a/packages/metadata-protocol/src/migrations/seed-tenancy-backfill.live-postgres.test.ts
+++ b/packages/metadata-protocol/src/migrations/seed-tenancy-backfill.live-postgres.test.ts
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * #17621 — the seed-tenancy backfill's statements, RUN on a live PostgreSQL.
+ * Commit 7e74af3df — the seed-tenancy backfill's statements, RUN on a live PostgreSQL.
  *
  * ## The gap this closes
  *
@@ -52,7 +52,7 @@
  * uses) and reports a named SKIP without one — never a silent pass. A runner
  * that knows it provisioned the server sets `OS_EXPECT_LIVE_DIALECT_MATRIX=1`,
  * which turns the missing URL into a failure, so a dropped `env:` line cannot
- * quietly return this seam to the no-coverage state #17621 records.
+ * quietly return this seam to the no-coverage state commit 7e74af3df records.
  *
  * ## Isolation — a per-file SCHEMA, and why the resolver is the MySQL-named one
  *
@@ -253,7 +253,7 @@ describe.skipIf(!PG_URL)('#17621 seed-tenancy backfill on a LIVE PostgreSQL', ()
     const statements: Array<[string, string, unknown[]]> = [
       ['presence probe (fallback arm)', buildSequencesPresenceSql(c), []],
       // The statement the boot path actually runs now. It is in this list for
-      // the reason every other one is here, and #17621 exists because it was
+      // the reason every other one is here, and commit 7e74af3df exists because it was
       // the ONE arm this list could not previously contain.
       ['presence probe (catalog arm)', buildTablePresenceSql(SEQUENCES_TABLE, c) as string, []],
       ['split probe', buildSplitProbeSql(c), [GLOBAL_TENANT, GLOBAL_TENANT]],
diff --git a/packages/metadata-protocol/src/protocol-publish-drafts-closure.test.ts b/packages/metadata-protocol/src/protocol-publish-drafts-closure.test.ts
index 553838c0d0b..b363908321c 100644
--- a/packages/metadata-protocol/src/protocol-publish-drafts-closure.test.ts
+++ b/packages/metadata-protocol/src/protocol-publish-drafts-closure.test.ts
@@ -35,7 +35,7 @@
  * The `objects` and `permissions` gaps are the same defect at advisory
  * severity: they do not refuse, they manufacture findings that describe
  * nothing. Both are pinned below, because a closure that is uniform is the
- * property #9612/#10058 declared and a per-collection patch is what produced
+ * property #9612/commit 6f5a44976 declared and a per-collection patch is what produced
  * this card.
  *
  * ## The discriminating tests are the ones that expect SILENCE
diff --git a/packages/metadata-protocol/src/protocol-publish-drafts-object-field-refs.test.ts b/packages/metadata-protocol/src/protocol-publish-drafts-object-field-refs.test.ts
index 1fba3706020..528f5949da2 100644
--- a/packages/metadata-protocol/src/protocol-publish-drafts-object-field-refs.test.ts
+++ b/packages/metadata-protocol/src/protocol-publish-drafts-object-field-refs.test.ts
@@ -244,7 +244,7 @@ describe('publishPackageDrafts refuses a dangling object field-name list (#15254
         expect(causal.code).toBe('INVALID_METADATA');
 
         // …with a rule id and the offending path, which is what has to reach
-        // the author's screen. The path is name-keyed on the wire (#10064) —
+        // the author's screen. The path is name-keyed on the wire (commit def0d3e63) —
         // `objects.<name>.<key>[i]`, never the gate's private snapshot index.
         const wire = JSON.stringify(causal);
         expect(wire).toContain('object-field-ref-unknown');
diff --git a/packages/metadata-protocol/src/protocol.batch-row-http-status.test.ts b/packages/metadata-protocol/src/protocol.batch-row-http-status.test.ts
index 9229e670004..8184d9290ae 100644
--- a/packages/metadata-protocol/src/protocol.batch-row-http-status.test.ts
+++ b/packages/metadata-protocol/src/protocol.batch-row-http-status.test.ts
@@ -543,7 +543,7 @@ describe('[#14723] section 7 — a `DuplicateRecordError` row reports `UNIQUE_VI
     });
 
     it('[GUARD] a producer that merely SPEAKS `DUPLICATE_RECORD` is not the engine\'s envelope and keeps its own code', async () => {
-        // The same discrimination the whole-request arm makes (#14389 §5):
+        // The same discrimination the whole-request arm makes (commit 10220a7bf):
         // the gate is the registered code AND the class name. A hook throwing
         // the registered member from its own body is a different producer
         // speaking a member of the vocabulary; the verbatim rule still applies.
diff --git a/packages/metadata-protocol/src/protocol.datasource-delete-prolongation.test.ts b/packages/metadata-protocol/src/protocol.datasource-delete-prolongation.test.ts
index b0c6911e5d2..9931944568b 100644
--- a/packages/metadata-protocol/src/protocol.datasource-delete-prolongation.test.ts
+++ b/packages/metadata-protocol/src/protocol.datasource-delete-prolongation.test.ts
@@ -17,7 +17,7 @@
  * re-verification carrier: re-measure the prolongation once that fix lands, and
  * close only on the measurement.
  *
- * The re-verification (PR #14431) found that #13331 closes the registry-heal
+ * The re-verification (commit a98b61b3e) found that #13331 closes the registry-heal
  * half but opens a SECOND gap on the read-in-window path (see "Arms" below,
  * preserved as history). Ruling A′ (2026-09-03, director batch #22, comment
  * 5528370129) ordered the fix for that gap: `applyRemoteMetadataMutation`
@@ -110,7 +110,7 @@
  *      writes the deleted row straight back into the registry the bridge
  *      just healed — and the registry has no TTL.
  *
- * So the prolongation was — PR #14431's finding, kept as history below —
+ * So the prolongation was — commit a98b61b3e's finding, kept as history below —
  * neither unconditionally bounded nor unconditionally unbounded, and the
  * discriminator was not time but TRAFFIC:
  *
@@ -132,7 +132,7 @@
  * one. The bounded arm is the quiet-replica arm.
  *
  * ---------------------------------------------------------------------------
- * Why the re-hydration USED TO happen, precisely (history — PR #14431)
+ * Why the re-hydration USED TO happen, precisely (history — commit a98b61b3e)
  * ---------------------------------------------------------------------------
  * Nothing on the bridge's receipt path touched the WRITE EPOCH that keys the
  * overlay cache. `applyRemoteMetadataMutation` re-read the row and repaired the
@@ -180,7 +180,7 @@
  *     re-derived (the dispatch forbids re-deriving that finding).
  *  3. list-cache TTL (#5109) ............. RE-MEASURED, then CLOSED. At this
  *     door the cache is `meta-overlay-cache`, not `MetadataManager.listCache` —
- *     PR #14431 found it did not merely delay the correct answer, it FED the
+ *     commit a98b61b3e found it did not merely delay the correct answer, it FED the
  *     untimed registry, converting a 30s residue into an unbounded one on any
  *     read landing in the window. Ruling A′'s bump on the receipt path retires
  *     this cache at the moment of convergence, so the read that follows has
@@ -691,7 +691,7 @@ describe('[#13609] ⭐ the re-verification: how long does the peer keep serving
 
         // `measureProlongationMs` reads the door once BEFORE advancing the
         // clock — i.e. inside the residue window, which is what a replica
-        // under load does continuously. Previously (PR #14431) that read
+        // under load does continuously. Previously (commit a98b61b3e) that read
         // converted the bounded cache residue into an unbounded registry
         // entry. Now the convergence bump has already retired the cache
         // before this first read runs, so the read-in-window traffic
diff --git a/packages/metadata-protocol/src/protocol.diff-credential-redaction.test.ts b/packages/metadata-protocol/src/protocol.diff-credential-redaction.test.ts
index 02e88925900..38e7bf99ea9 100644
--- a/packages/metadata-protocol/src/protocol.diff-credential-redaction.test.ts
+++ b/packages/metadata-protocol/src/protocol.diff-credential-redaction.test.ts
@@ -16,7 +16,7 @@
  * is no body for the item-level redactor to take. This is the same "different
  * plane, same stored bytes" split that made #7990 its own card.
  *
- * ## The ruled shape (maintainer ruling, issue comment 5299845282 — Option B)
+ * ## The ruled shape (maintainer ruling, recorded in commit 75e66fc8e's message — Option B)
  *
  *   > Ruled: Option B — diff raw, then redact emitted values at redactor-named
  *   > paths, keeping the path and the "changed" signal.
diff --git a/packages/metadata-protocol/src/protocol.invalid-metadata-422-face-inventory.test.ts b/packages/metadata-protocol/src/protocol.invalid-metadata-422-face-inventory.test.ts
index 0a98541bcbb..7dac9eb3799 100644
--- a/packages/metadata-protocol/src/protocol.invalid-metadata-422-face-inventory.test.ts
+++ b/packages/metadata-protocol/src/protocol.invalid-metadata-422-face-inventory.test.ts
@@ -19,7 +19,7 @@
  * channel exists and the sentence is the SOLE carrier of the author's
  * prescription. Commit 809e61221 reached the same verdict for the sibling 409.
  *
- * The maintainer ruling on #11017 (2026-08-22, option D) resolved it by
+ * The maintainer ruling of 2026-08-22 (option D, landed as commit d806081dd) resolved it by
  * reusing commit 82cb6e849/#11099's per-face rendering rather than by declaring a
  * response contract for `duplicatePackage`: faces that already carry a
  * structured `issues[]` drop the prose restatement; the duplicate face keeps
diff --git a/packages/metadata-protocol/src/protocol.ts b/packages/metadata-protocol/src/protocol.ts
index 5be50ab5907..766d14add06 100644
--- a/packages/metadata-protocol/src/protocol.ts
+++ b/packages/metadata-protocol/src/protocol.ts
@@ -22790,7 +22790,7 @@ export class ObjectStackProtocolImplementation implements
             }
         }
         // [commit 75e66fc8e] Diff RAW, then redact the EMITTED values — maintainer ruling
-        // (comment 5299845282), Option B. The comparison runs on the stored
+        // (recorded in that commit's message), Option B. The comparison runs on the stored
         // bodies untouched, so a credential ROTATION still registers as a
         // changed path; only the values leaving this function are taken from
         // the type's redacted projection of those same bodies.
diff --git a/packages/metadata-protocol/src/protocol.ui-view-hidden-columns.test.ts b/packages/metadata-protocol/src/protocol.ui-view-hidden-columns.test.ts
index bfcd487732c..bc5550ec22c 100644
--- a/packages/metadata-protocol/src/protocol.ui-view-hidden-columns.test.ts
+++ b/packages/metadata-protocol/src/protocol.ui-view-hidden-columns.test.ts
@@ -23,7 +23,7 @@
 //
 // ## Why this file drives more than one field
 //
-// ⛔ An earlier measurement (PR #13244) drove ONE hidden field, which happened
+// ⛔ An earlier measurement (commit 889ec5b42) drove ONE hidden field, which happened
 // not to be a priority name, saw it dropped, and reported *"hidden is dropped
 // by declaration"*. That reading was true of the field it drove and false of
 // the class — a **false clearance**: a result that reads as general because
@@ -43,7 +43,7 @@
 // and "true of the class": it drives EVERY priority name hidden at once.
 //
 // ⚠️ The sibling harness `packages/rest/src/ui-view-route-tenancy.measurement.test.ts`
-// (#13214 / PR #13258) drives the same defect through the REST route and pins
+// (commit 3d10755f0, for the card commit cc837dbfe fixed) drives the same defect through the REST route and pins
 // the pre-fix answer as a measurement. It belongs to that card and is
 // deliberately not edited here; this file is the pin next to the code.
 
diff --git a/packages/metadata-protocol/src/runtime-authoring-gate.dataset-writes.test.ts b/packages/metadata-protocol/src/runtime-authoring-gate.dataset-writes.test.ts
index da06492d4d7..9c4bcfec727 100644
--- a/packages/metadata-protocol/src/runtime-authoring-gate.dataset-writes.test.ts
+++ b/packages/metadata-protocol/src/runtime-authoring-gate.dataset-writes.test.ts
@@ -88,7 +88,7 @@ describe('the host threads a dataset publish to the runtime gate (#19143)', () =
     expect((verdict.error as { code?: string }).code).toBe('INVALID_METADATA');
     expect((verdict.error as { status?: number }).status).toBe(422);
 
-    // The receipt the author reads back: rule id, name-keyed path (#10064), and
+    // The receipt the author reads back: rule id, name-keyed path (commit def0d3e63), and
     // the string they actually typed.
     const issues = (verdict.error as { issues?: Array<Record<string, unknown>> }).issues!;
     const wire = JSON.stringify(issues);
diff --git a/packages/metadata-protocol/src/sys-metadata-repository.contract.test.ts b/packages/metadata-protocol/src/sys-metadata-repository.contract.test.ts
index 99ef73ef756..a2be88e8c61 100644
--- a/packages/metadata-protocol/src/sys-metadata-repository.contract.test.ts
+++ b/packages/metadata-protocol/src/sys-metadata-repository.contract.test.ts
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * #10420 — `SysMetadataRepository` under the SHARED repository contract suite.
+ * Commit 05bc692e0 — `SysMetadataRepository` under the SHARED repository contract suite.
  *
  * ## Why this file exists
  *