docs(plugin-auth): re-anchor the dead tracker citations to the commits that decided them

Comment and docblock prose under packages/plugins/plugin-auth/src only. Each
site that cited a tracker number answering 404 now cites the commit in this
repository's history that decided what the line describes, and says in its
own words what that commit decided. 95 sites on 95 lines in 31 files, 16
numbers, 15 anchor commits; 12 further lines are reflow or a lost referent.
No code token moves; every file keeps its line count.

Claude-Session: https://claude.ai/code/session_01XY5uCwTjZj7884yYtyur4H
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-auth/src/account-identity-preflight.test.ts

@@ -18,7 +18,7 @@
  * declaration without the constraint. That population is real and reachable:
  * `syncDeclaredIndexes` logs a plain UNIQUE whose CREATE fails on existing
  * duplicates onto the durability channel and lets the boot continue
- * (#14902 / #15479), deliberately, so one dirty table cannot take a deployment
+ * (commit 61821e54c / #15479), deliberately, so one dirty table cannot take a deployment
  * down. `SYS_ACCOUNT_NO_UNIQUE` below is that deployment, spelled as a fixture
  * — the same shape with the unique index absent.
  *
@@ -51,7 +51,7 @@ const SYSTEM = { context: { isSystem: true } } as never;
 
 /**
  * `sys_account` as a deployment whose declared `(provider_id, account_id)`
- * UNIQUE was never physically created — the #14902 / #15479 population. Only
+ * UNIQUE was never physically created — the commit 61821e54c / #15479 population. Only
  * the columns the probe reads are spelled.
  */
 const SYS_ACCOUNT_NO_UNIQUE = {

packages/plugins/plugin-auth/src/account-identity-preflight.ts

@@ -31,7 +31,7 @@ import { keysetWalk } from '@objectstack/types';
  *
  * ⚠️ "Declared" is not "present". `syncDeclaredIndexes` logs a plain UNIQUE
  * whose CREATE fails on existing duplicates onto the durability channel and
- * lets the boot continue (#14902 / #15479) — deliberately, so one dirty table
+ * lets the boot continue (commit 61821e54c / #15479) — deliberately, so one dirty table
  * cannot take a deployment down. A database that ever held duplicates therefore
  * carries the declaration and not the constraint, and can still hold the class
  * today.

packages/plugins/plugin-auth/src/admin-has-permission-endpoint.ts

@@ -26,7 +26,7 @@
  * who is a platform admin under ADR-0068 (`isPlatformAdminUser`, the same
  * predicate every shaded `/admin/*` mount trusts) sending a body the vendor's
  * own handler would EVALUATE. Every other caller and every other body shape
- * is DELEGATED through `AuthManager.handleRequest` — the #12029 gate-then-
+ * is DELEGATED through `AuthManager.handleRequest` — commit 6dd3e6968's gate-then-
  * delegate seam — so the vendor's native bytes stand: an anonymous caller
  * still gets the enveloped 401, a plain member still gets its own
  * `200 {"error":null,"success":false}` negative (pinned by the non-admin

packages/plugins/plugin-auth/src/admin-remove-user-gate-ordering.test.ts

@@ -1,6 +1,6 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 //
-// #11477 — ORDERING PIN: on `/admin/remove-user` the break-glass guard must run
+// commit 6dd3e6968 — ORDERING PIN: on `/admin/remove-user` the break-glass guard must run
 // AFTER authorization, and the whole `/admin/*` family must agree on that order.
 //
 // ── The defect this pins, and why a pin is half the fix ─────────────────────

packages/plugins/plugin-auth/src/auth-email-locale.test.ts

@@ -8,7 +8,7 @@
  * caller's own `Accept-Language` first (only when it names a locale in
  * `AUTH_EMAIL_TEMPLATE_LOCALES`), and the deployment default second. The
  * 2026-08-13 ruling had made the deployment default the whole answer and
- * rejected `Accept-Language` outright. #14762 then added the rung ABOVE both,
+ * rejected `Accept-Language` outright. Commit 35e94c96b then added the rung ABOVE both,
  * per the #14788 option-D ruling of 2026-09-03: the recipient's own
  * `sys_user.locale` (#13881) when the account holds one.
  *
@@ -479,7 +479,7 @@ describe('#14319 — authEmailLocaleFromRequest', () => {
   });
 });
 
-// ── #14762 — the stored rung ───────────────────────────────────────────────
+// ── commit 35e94c96b — the stored rung ─────────────────────────────────────
 
 /**
  * #14788 was ruled option D on 2026-09-03 (maintainer verbatim 「同意」):

packages/plugins/plugin-auth/src/auth-manager.test.ts

@@ -1553,7 +1553,7 @@ describe('AuthManager', () => {
     });
   });
 
-  // #10366 — the localhost-wildcard trio is a DEVELOPMENT convenience and is
+  // commit bbe643c08 — the localhost-wildcard trio is a DEVELOPMENT convenience and is
   // gated on `NODE_ENV !== 'production'`. Before the gate the condition tested
   // only emptiness, so a production deployment whose trusted-origin list
   // resolved empty silently CSRF-trusted every `localhost` / `*.localhost`
@@ -2530,7 +2530,7 @@ describe('AuthManager', () => {
       expect(sms.sent[0].body).toContain('verification code');
     });
 
-    // ── #14762 — the recipient's own `sys_user.locale` as the top rung ──────
+    // ── commit 35e94c96b — the recipient's own `sys_user.locale` as the top rung
     //
     // #14788 was ruled option D on 2026-09-03: `sys_user.locale` when set →
     // the request's `Accept-Language` → the deployment default. There is no
@@ -2651,7 +2651,7 @@ describe('AuthManager', () => {
 
     // ── #14641 — the SMS INVITE path gets the same rung ──────────────────
     //
-    // Its OWN describe, sibling to #14762 above rather than nested inside it:
+    // Its OWN describe, sibling to commit 35e94c96b's above, not nested inside it:
     // the reporter path is what the next reader greps, and these pins answer
     // for #14641, not for the card that gave the OTP send its rung.
     describe("#14641 — the invitation SMS reads the invitee's own locale", () => {
@@ -2858,7 +2858,7 @@ describe('AuthManager', () => {
       expect(data.acceptUrl).toBe('http://localhost:3000/_console/accept-invitation/tok456');
     });
 
-    // #11741 — the invitation producer HOLDS an organization (the invitation
+    // commit b706af987 — the invitation producer HOLDS an organization (the invitation
     // row's own organizationId), so it threads that exact value into
     // SendTemplateInput for the sys_email.organization_id stamp. Auth mail
     // that genuinely has no organization (password reset / verification /
@@ -4086,15 +4086,15 @@ describe('AuthManager', () => {
       expect(written).toEqual(['hash:current', 'hash:old1']); // prepend + trim to 2
     });
 
-    // ---- #8676: the same control, against an engine that actually STRIPS ----
+    // ---- commit d6e80b28b: the same control, against an engine that actually STRIPS ----
     //
     // ⚠️ Every test above uses `makeEngine`, which hands back the stored object
     // untouched. That is a faithful model of a strip-less engine — and it is
-    // precisely why those tests carry NO information about #8676: once
+    // precisely why those tests carry NO information about commit d6e80b28b: once
     // `sys_account.password` and `previous_password_hashes` are `internal:
     // true`, the REAL engine omits both from this read, with no `isSystem`
     // carve-out and in spite of the explicit projection (#7728's design;
-    // measured against a real ObjectQL engine + stub driver on #8676, which
+    // measured against a real ObjectQL engine + stub driver for commit d6e80b28b, which
     // returned `{"id":"a1"}` for the exact query at `assertPasswordNotReused`).
     // `compareList` then empties, the loop never runs, `PASSWORD_REUSE` is
     // never thrown, and the method's own `catch { return undefined }` means
@@ -4188,7 +4188,7 @@ describe('AuthManager', () => {
       });
 
       it('⛔ the recovery is LOAD-BEARING: drop the accessor and the control provably dies', async () => {
-        // The falsification arm. This is the pre-#8676 shape — a stripping
+        // The falsification arm. This is the shape before commit d6e80b28b — a stripping
         // engine with no privileged accessor — and it is what every assertion
         // in this block would look like if the recovery were removed. Pinned so
         // the four tests above can never pass vacuously: if the strip stopped

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -127,7 +127,7 @@ import {
   interpolatePhoneSms,
   loadPhoneSmsTemplateBody,
 } from './phone-sms-texts.js';
-// #14762 — the stored rung of the ruled locale ladder reuses the messaging
+// commit 35e94c96b — the stored rung of the ruled locale ladder reuses the messaging
 // seam's normalizer rather than growing a second one. `normalizeRecipientLocale`
 // is the platform's ONE reader of a value at rest in `sys_user.locale`, and its
 // refusal of the stringified-nothing literals (`"undefined"`, `"null"`) is part
@@ -1691,7 +1691,7 @@ export class AuthManager {
           // background-task handling (see sendVerificationEmail) and the
           // forget-password route always returns {status:true}, so this never
           // leaks whether an address exists nor turns the request into a 500.
-          // #14762 — the ladder's stored rung. It matters most HERE: an
+          // commit 35e94c96b — the ladder's stored rung. It matters most HERE: an
           // admin-initiated reset (`admin-import-users.ts` calls
           // `requestPasswordReset`) reaches this callback with the ADMIN's
           // request, so without this rung the user's mail carries the admin's
@@ -1756,7 +1756,7 @@ export class AuthManager {
             // template/loader errors, and returns status:'failed' on transport
             // errors — surface both so resend is honest and signup stays
             // resilient via better-auth's background-task error handling.
-            // #14762 — the stored rung, same ladder as the reset above. An
+            // commit 35e94c96b — the stored rung, same ladder as the reset above. An
             // admin re-triggering verification for a user is the same
             // requester-is-not-the-recipient shape.
             const storedLocale = await this.storedRecipientLocale({ id: user.id });
@@ -2164,7 +2164,7 @@ export class AuthManager {
             // guard itself now lives in ONE module both call sites share —
             // `last-local-credential.ts`, whose header records this trap.
             //
-            // ⚠️ `/admin/remove-user` IS ALSO SHADED NOW (#11477) — and it DOES
+            // ⚠️ `/admin/remove-user` IS ALSO SHADED NOW (commit 6dd3e6968) — and it DOES
             // still reach this hook, which is the opposite of the line above
             // and is the point. Its mount only runs `gateAdmin` and then
             // RE-DISPATCHES the request through `handleRequest`, so it re-enters
@@ -2575,7 +2575,7 @@ export class AuthManager {
         // default root domain — see project-provisioning.ts) pass CSRF checks
         // without operators having to configure trustedOrigins manually.
         //
-        // NON-PRODUCTION ONLY (#10366). This substitution is a development
+        // NON-PRODUCTION ONLY (commit bbe643c08). This substitution is a development
         // convenience and is now gated on the same `NODE_ENV` dev signal used
         // by the fallback auth secret and the dev Origin synthesis below, so
         // the boundary this comment claims is the boundary that is enforced.
@@ -3369,7 +3369,7 @@ export class AuthManager {
           //     `routes/crud-invites.mjs`, so an existing account being invited
           //     elsewhere reaches this callback normally). Their column is a
           //     language they chose for themselves — the same authority the
-          //     reset / verification sends read since #14762.
+          //     reset / verification sends read since commit 35e94c96b.
           //  2. NO row — a genuinely new invitee. Their language is still truly
           //     unknown at invitation time, so the deployment default stands,
           //     exactly as before.
@@ -3411,7 +3411,7 @@ export class AuthManager {
               },
               relatedObject: 'sys_invitation',
               relatedId: invitation.id,
-              // #11741 — the invitation HOLDS its organization; thread it so
+              // commit b706af987 — the invitation HOLDS its organization; thread it so
               // the sys_email row is stamped. Org-less auth mail (reset /
               // verification / magic link) deliberately threads nothing.
               ...(invitation.organizationId
@@ -5157,7 +5157,7 @@ export class AuthManager {
   }
 
   /**
-   * [#11640] Whether an outbound email transport is wired RIGHT NOW.
+   * [commit bf8d129b5] Whether an outbound email transport is wired RIGHT NOW.
    *
    * The one public read of the fact every verification link depends on: with
    * no transport the `sendVerificationEmail` callback has nowhere to send, so
@@ -5198,7 +5198,7 @@ export class AuthManager {
    * entirely and `EmailService`'s ladder resolves its documented `en-US`
    * default exactly as before.
    *
-   * #14762 layered the per-recipient stored preference on TOP of both rungs:
+   * Commit 35e94c96b layered the per-recipient stored preference on TOP of both rungs:
    * `sys_user.locale` (#13881, ruling 2026-09-01) when the account holds one,
    * then this request's `Accept-Language`, then the deployment default. The
    * request rung did not lose its argument — it is still what answers for an
@@ -5222,7 +5222,7 @@ export class AuthManager {
       // address that would actually land.
       const target = newEmail.trim().toLowerCase();
       if (!target) return;
-      // #14762 — the stored rung on top of the #14319 ladder. The recipient is
+      // commit 35e94c96b — the stored rung on top of the #14319 ladder. The recipient is
       // the account holder, so their own column outranks the header the
       // request happened to carry.
       const storedLocale = from.id ? await this.storedRecipientLocale({ id: from.id }) : undefined;
@@ -5343,7 +5343,7 @@ export class AuthManager {
     // one provider template covers sign-in and reset, and the SMS reveals
     // nothing about what the code unlocks.
     //
-    // #14762 — the recipient of an OTP IS the user, so the locale is theirs to
+    // commit 35e94c96b — the recipient of an OTP IS the user, so the locale is theirs to
     // name: `sys_user.locale` first, the deployment default underneath.
     //
     // ⚠️ The row is looked up here rather than taken from the callback: the
@@ -5460,7 +5460,7 @@ export class AuthManager {
    * `kernel:ready` and on every settings change (same pattern as
    * {@link setAppName}). Unset ⇒ the built-in English text.
    *
-   * #14762 — this is now the SECOND rung, not the whole answer. The OTP send
+   * Commit 35e94c96b — this is now the SECOND rung, not the whole answer. The OTP send
    * reads the recipient's own `sys_user.locale` first (#13881, ruling
    * 2026-09-01, the same column the messaging channels resolve per recipient)
    * and falls here when the account holds none. #14641 gave the SMS INVITE
@@ -5513,7 +5513,7 @@ export class AuthManager {
    *
    * Per-user locale EXISTS since #13881 (maintainer ruling 2026-09-01):
    * `sys_user.locale`, resolved per recipient by service-messaging for
-   * notification mail (`recipient-locale.ts`). #14762 layered it on top of
+   * notification mail (`recipient-locale.ts`). Commit 35e94c96b layered it on top of
    * this ladder for the sends that hold a recipient row — reset, verification
    * and the change-email notice — so the order is stored → request → this
    * rung, per the #14788 option-D ruling of 2026-09-03. Nothing here changed:
@@ -5530,7 +5530,7 @@ export class AuthManager {
   private emailLocale?: string;
 
   /**
-   * #14762 — the ladder's TOP rung: the recipient's own `sys_user.locale`,
+   * Commit 35e94c96b — the ladder's TOP rung: the recipient's own `sys_user.locale`,
    * read best-effort off the identity row.
    *
    * Returns `undefined` for every shape that cannot name a language — no data
@@ -5545,7 +5545,7 @@ export class AuthManager {
    * The read is one row on an indexed predicate, projected to the single
    * column, under a system context — the recipient's own language must resolve
    * regardless of who triggered the send, which is exactly the
-   * admin-initiated case #14762 was about, and the INVITER-triggered case
+   * admin-initiated case commit 35e94c96b fixed, and the INVITER-triggered case
    * #14641 added. Three predicates, one per caller shape: `sys_user.id` (the
    * sends that hold a user row), the unique `phone_number` (the SMS sends,
    * which are handed a number and nothing else), and the unique `email` (the
@@ -5580,7 +5580,7 @@ export class AuthManager {
    * what the ladder's "no locale means the DOCUMENTED default" contract is
    * written against.
    *
-   * #14762 — three rungs now, in the order ruled for #14788 on 2026-09-03
+   * Commit 35e94c96b — three rungs now, in the order ruled for #14788 on 2026-09-03
    * (option D): the recipient's own **stored** `sys_user.locale` → the
    * **request**'s `Accept-Language` (#14319) → the **deployment** default
    * (#8195). The recorded reasoning is that a value the user chose is stronger
@@ -5615,7 +5615,7 @@ export class AuthManager {
    * one exists, else the built-in bilingual text. Template lookups are
    * best-effort — an outage must never block an OTP send.
    *
-   * #14762 — `storedLocale` is the recipient's own `sys_user.locale` when the
+   * Commit 35e94c96b — `storedLocale` is the recipient's own `sys_user.locale` when the
    * caller could resolve one ({@link storedRecipientLocale}); the deployment
    * default stands underneath it. There is NO request rung on this surface:
    * the ruled ladder's middle rung is the request's `Accept-Language`, and an
@@ -5626,7 +5626,7 @@ export class AuthManager {
    * row as {@link phoneSmsLocaleChain}'s terminal floor exactly as before.
    *
    * A caller that passes nothing — or one whose recipient resolves no row —
-   * gets exactly the pre-#14762 deployment-default behaviour. #14641 made the
+   * gets exactly the deployment default, as before commit 35e94c96b. #14641 made the
    * SMS invite path a passer rather than an abstainer; it is no longer the
    * standing example of a caller that names nothing.
    */
@@ -7551,10 +7551,10 @@ export class AuthManager {
    * (this file, ~line 671) declares `{ info?; warn }` and NO `error`, and it is
    * re-exported from the package `index.ts`, so adding `error?` is a
    * published-shape change. #12981's ruling routes that LEVEL question to
-   * #13398 and tells this batch to fix the SILENCE only — the same split
-   * batches 1 and 2 landed for `plugin-security`'s two exported sinks. `warn`
-   * is the guaranteed channel here and the lowest level a reader still reads as
-   * a failure, so nothing is lost but loudness.
+   * the published-sink ruling (commit e238c79f0) and tells this batch to fix the
+   * SILENCE only — the same split batches 1 and 2 landed for `plugin-security`'s
+   * two exported sinks. `warn` is the guaranteed channel here and the lowest
+   * level a reader still reads as a failure, so nothing is lost but loudness.
    *
    * ⛔ Call `warn` through the PROPERTY, never through an extracted reference —
    * `@objectstack/core`'s `ObjectLogger` is class-based and its `warn` reaches
@@ -8023,7 +8023,7 @@ export class AuthManager {
         fields: ['id', 'password', 'previous_password_hashes'],
         context: SYSTEM_CTX,
       } as any);
-      // [#8676] Both columns are `internal: true`, so the engine's read path
+      // [commit d6e80b28b] Both columns are `internal: true`, so the engine's read path
       // omits them from the row above — with no `isSystem` carve-out and in
       // spite of the explicit projection (#7728's design). Recover them
       // through the privileged accessor, or `compareList` below is empty and
@@ -8071,7 +8071,7 @@ export class AuthManager {
         context: SYSTEM_CTX,
       } as any);
       if (!account?.id) return;
-      // [#8676] As above — the flagged column is omitted from the read, so
+      // [commit d6e80b28b] As above — the flagged column is omitted from the read, so
       // recover it before extending the ring. Without this the ring is rebuilt
       // from an empty history on every change and never grows past one entry.
       await recoverInternalFieldsForSystemRead(