test(spec): security, ai, identity, integration, migrations, marketplace, meta-spelling and studio test titles state each cited decision in words instead of a tracker number (stage 14)

packages/spec/src/ai/agent.test.ts

@@ -71,7 +71,7 @@ describe('AIModelConfigSchema', () => {
   });
 });
 
-describe('agent.tools retirement (ADR-0064 / #3820, tombstoned in #3894)', () => {
+describe('agent.tools retirement (ADR-0064) — tombstoned; tools move into skills', () => {
   it('REJECTS a legacy inline tools array, with the fix in the message', () => {
     // Tombstoned, not deleted: AgentSchema is `strictObject`, so a plain
     // deletion would reject the key with a generic unknown-key error.

packages/spec/src/ai/conversation.test.ts

@@ -291,7 +291,7 @@ describe('ConversationSessionSchema', () => {
   it('should accept full session with messages', () => {
     const session = {
       id: 'session-1',
-      name: 'Support Chat - Case #123',
+      name: 'Support Chat - Case',
       context: {
         sessionId: 'session-1',
         userId: 'user-1',
@@ -590,7 +590,7 @@ describe('Real-World Conversation Examples', () => {
 // `ConversationAnalytics` is runtime-emitted, so the silent-strip alternative
 // is the real hazard: this shape is not strict, and a producer still writing
 // `duration` would have lost the one measurement on the row with no error at all.
-describe('ConversationAnalytics.duration carries its unit (#15680)', () => {
+describe('ConversationAnalytics.duration carries its unit', () => {
   const base = {
     sessionId: 'session-1',
     totalMessages: 10,

packages/spec/src/ai/knowledge-source.test.ts

@@ -48,7 +48,7 @@ const SOURCE: KnowledgeSource = {
 
 const CRON_5_FIELD = '0 3 * * *';
 
-describe('KnowledgeRefreshPolicySchema.cron — the typed cron slot (#14825)', () => {
+describe('KnowledgeRefreshPolicySchema.cron — the typed cron slot', () => {
   it('positive control: a 5-field cron on a full knowledge source parses and normalizes to the cron envelope', () => {
     const r = KnowledgeSourceSchema.safeParse({ ...SOURCE, refresh: { cron: CRON_5_FIELD } });
     expect(r.success, r.success ? '' : JSON.stringify(r.error.issues)).toBe(true);
@@ -94,8 +94,8 @@ describe('KnowledgeRefreshPolicySchema.cron — the typed cron slot (#14825)', (
   });
 
   it.each([
-    ['a dialect the protocol does not declare (`js`, retired at #3278, ADR-0058 addendum)', 'js'],
-    ['a declared dialect that is not this slot\'s (`cel`, #15028)', 'cel'],
+    ['a dialect the protocol does not declare (`js`, a retired expression dialect, ADR-0058 addendum)', 'js'],
+    ['a declared dialect that is not this slot\'s (`cel`)', 'cel'],
   ])('refuses an envelope naming %s with ONE `invalid_union` at `cron` whose message is the cron dialect-only sentence', (_label, dialect) => {
     const r = KnowledgeRefreshPolicySchema.safeParse({ cron: { dialect, source: 'x' } });
     expect(r.success).toBe(false);

packages/spec/src/ai/skill-trigger-condition-value-shape.test.ts

@@ -44,7 +44,7 @@ function valueIssue(result: ReturnType<typeof parse>) {
   return issues[0]!;
 }
 
-describe('#7113 — the reported shape is refused at authoring time', () => {
+describe('a set operator carrying a scalar is refused at authoring time', () => {
   it('refuses the card example: a set operator carrying a scalar', () => {
     const result = parse({ field: 'userRole', operator: 'in', value: 'admin' });
     const issue = valueIssue(result);
@@ -72,7 +72,7 @@ describe('#7113 — the reported shape is refused at authoring time', () => {
   });
 });
 
-describe('#7113 — list operators require an array', () => {
+describe('list operators require an array', () => {
   it.each(SKILL_TRIGGER_LIST_VALUE_OPERATORS)('%s refuses a scalar', (operator) => {
     const issue = valueIssue(parse({ field: 'objectName', operator, value: 'lead' }));
     expect(issue.code).toBe('custom');
@@ -109,7 +109,7 @@ describe('#7113 — list operators require an array', () => {
   });
 });
 
-describe('#7113 — identity operators require a string', () => {
+describe('identity operators require a string', () => {
   it.each(SKILL_TRIGGER_SCALAR_VALUE_OPERATORS)('%s refuses an array', (operator) => {
     const issue = valueIssue(parse({ field: 'objectName', operator, value: ['lead'] }));
     expect(issue.code).toBe('custom');
@@ -127,7 +127,7 @@ describe('#7113 — identity operators require a string', () => {
   });
 });
 
-describe('#7113 — `contains` keeps BOTH shapes (#5685: no stricter than the runtime)', () => {
+describe('`contains` keeps BOTH shapes — no stricter than the runtime', () => {
   it('accepts a string comparand — the substring branch', () => {
     expect(parse({ field: 'viewName', operator: 'contains', value: 'kanban' }).success).toBe(true);
   });
@@ -147,7 +147,7 @@ describe('#7113 — `contains` keeps BOTH shapes (#5685: no stricter than the ru
   });
 });
 
-describe('#7113 — the exported vocabularies are the contract, not a copy', () => {
+describe('the exported vocabularies are the contract, not a copy', () => {
   it('the two vocabularies are disjoint and both subsets of the operator enum', () => {
     const all = [
       ...SKILL_TRIGGER_LIST_VALUE_OPERATORS,
@@ -172,7 +172,7 @@ describe('#7113 — the exported vocabularies are the contract, not a copy', ()
   });
 });
 
-describe('#7113 — the refinement does not disturb the carrier', () => {
+describe('the value-shape refinement does not disturb the carrier', () => {
   it('an unrelated operator/value pair still parses through Skill.triggerConditions', () => {
     const skill = SkillSchema.parse({
       name: 'order_management',

packages/spec/src/ai/skill.test.ts

@@ -192,7 +192,7 @@ describe('defineSkill', () => {
   });
 });
 
-describe('#3896 close-out — retired `triggerPhrases`', () => {
+describe('retired `triggerPhrases` — phrases never routed a skill; triggerConditions do', () => {
   it('REJECTS the retired key with the routing prescription', () => {
     let message = '';
     try {

packages/spec/src/ai/solution-blueprint.test.ts

@@ -671,7 +671,7 @@ describe('strict mirror ↔ lenient schema — key parity', () => {
 // because the model happened to retry with a repaired blueprint the user never
 // saw. Two declarations of one contract, disagreeing about values.
 // ---------------------------------------------------------------------------
-describe('strict mirror ↔ lenient schema — VALUE parity (cloud#1967)', () => {
+describe('strict mirror ↔ lenient schema — VALUE parity', () => {
   /** The regex a zod string leaf enforces, or null when it enforces none. */
   const patternOf = (schema: any): string | null => {
     const checks = schema?.def?.checks;

packages/spec/src/ai/tool-confirmation-prescription-tense.pin.test.ts

@@ -142,7 +142,7 @@ function aiDoorBody(): string {
   return source.slice(start, end === -1 ? source.length : end);
 }
 
-describe('[#17487] the confirmation-gate prescriptions match the door that runs', () => {
+describe('the confirmation-gate prescriptions match the door that runs', () => {
   it('anchors on real text in all three carriers', () => {
     // Anti-vacuity for every assertion below: an empty carrier would pass
     // "carries no denial" by reading nothing.

packages/spec/src/ai/tool.test.ts

@@ -250,7 +250,7 @@ describe('defineTool', () => {
     expect(message).not.toContain('Did you mean');
   });
 
-  it('emission order: which key is wrong → the fix → the history, last (#5955)', () => {
+  it('emission order: which key is wrong → the fix → the history, last', () => {
     // The template's ordering contract, asserted on this surface because the
     // fold is what brings this surface under it. `history` sat in the middle
     // until #5955 and pushed the fix past ~character 220 on the single-line

packages/spec/src/identity/api-key-retirement.test.ts

@@ -52,7 +52,7 @@ import {
 //
 // Form follows #4988 / #5055 / #8075: resolved symbol identity over every
 // public entry via the build-time `export-origins/` artifact.
-describe('[#8715] identity/ ApiKeySchema retirement', () => {
+describe('identity/ ApiKeySchema retirement', () => {
   /** The 3 names the retired def exported (1 schema const + 2 types). */
   const RETIRED_NAMES = ['ApiKeySchema', 'ApiKey', 'ApiKeyParsed'] as const;
 
@@ -79,7 +79,7 @@ describe('[#8715] identity/ ApiKeySchema retirement', () => {
 
     // ── ABSENCE (every entry, not just ./identity) ────────────────────────
     for (const name of RETIRED_NAMES) {
-      expect(holdersOf(name), `${name} must have zero holders after #8715`).toEqual([]);
+      expect(holdersOf(name), `${name} must have zero holders after the ApiKeySchema retirement`).toEqual([]);
     }
 
     // ── SURVIVAL ──────────────────────────────────────────────────────────

packages/spec/src/identity/identity.test.ts

@@ -85,7 +85,7 @@ describe('UserSchema', () => {
  * drop of `.url()` (which would start admitting `''` and `'not-a-url'`) goes
  * red here rather than passing as "still accepts null".
  */
-describe('[#18509] UserSchema.image accept set', () => {
+describe('UserSchema.image accept set — null, the shape better-auth serves', () => {
   const base = {
     id: 'user_123',
     email: 'test@example.com',
@@ -199,7 +199,7 @@ describe('AccountSchema', () => {
   });
 });
 
-describe('Session is not declared here (#4641)', () => {
+describe('Session is not declared here', () => {
   // Pin: this module no longer declares the bare `SessionSchema` name. The pin is
   // compile-time (`typeof import` is type-level only — no runtime barrel load):
   // if the name is re-added here, the conditional type flips to `true` and the

packages/spec/src/identity/organization.test.ts

@@ -129,7 +129,7 @@ describe('OrganizationSchema', () => {
  * The whole accept set is pinned, not just the row that moved — see the sibling
  * block in `identity.test.ts` for why.
  */
-describe('[#18509] OrganizationSchema.logo accept set', () => {
+describe('OrganizationSchema.logo accept set — null, the shape better-auth serves', () => {
   const base = {
     id: 'org_123',
     name: 'Acme Corporation',
@@ -198,7 +198,7 @@ describe('[#18509] OrganizationSchema.logo accept set', () => {
    * "accepts the served body" and "stopped checking" are otherwise the same
    * green.
    */
-  it('[#18728] accepts a served read-route body WHOLE — updatedAt absent, metadata decoded', () => {
+  it('accepts a served read-route body WHOLE — updatedAt absent, metadata decoded', () => {
     const served = {
       id: 'org_123',
       name: 'Acme Corporation',
@@ -213,7 +213,7 @@ describe('[#18509] OrganizationSchema.logo accept set', () => {
     expect(result.success).toBe(true);
   });
 
-  it('[#18728] accepts the same body with metadata OMITTED — an unset column', () => {
+  it('accepts the same body with metadata OMITTED — an unset column', () => {
     const { metadata: _unset, ...withoutMetadata } = {
       id: 'org_123',
       name: 'Acme Corporation',
@@ -226,7 +226,7 @@ describe('[#18509] OrganizationSchema.logo accept set', () => {
     expect(result.success).toBe(true);
   });
 
-  it('⭐ [#18728] still REFUSES metadata as null or as the stored JSON text', () => {
+  it('⭐ still REFUSES metadata as null or as the stored JSON text', () => {
     // The producer omits an unset column and decodes a set one, so neither of
     // these is a shape any route sends. They must stay refused: if either ever
     // parses, the producer has regressed or this schema has been loosened to
@@ -245,7 +245,7 @@ describe('[#18509] OrganizationSchema.logo accept set', () => {
     }
   });
 
-  it('⭐ [#18728] `.optional()` widened updatedAt by ABSENCE only — a present value is still a datetime', () => {
+  it('⭐ `.optional()` widened updatedAt by ABSENCE only — a present value is still a datetime', () => {
     const result = OrganizationSchema.safeParse({
       id: 'org_123',
       name: 'Acme Corporation',

packages/spec/src/identity/platform-admin-capabilities.test.ts

@@ -7,7 +7,7 @@ import { ADMIN_FULL_ACCESS, ADMIN_FULL_ACCESS_CAPABILITIES } from './eval-user.z
 import { PermissionSetSchema } from '../security/permission.zod';
 import { PLATFORM_CAPABILITIES, PLATFORM_CAPABILITY_NAMES } from '../security/capabilities';
 
-describe('ADMIN_FULL_ACCESS_CAPABILITIES (#11965, Choice 6A)', () => {
+describe('ADMIN_FULL_ACCESS_CAPABILITIES — the one platform-admin list plugin-security imports', () => {
   it('carries exactly the two capability-bearing fields — name/label stay with the declaring package', () => {
     // The export is the capability CONTENT, not a permission set. `name` /
     // `label` (or any other authored field) creeping in here would make the
@@ -31,7 +31,7 @@ describe('ADMIN_FULL_ACCESS_CAPABILITIES (#11965, Choice 6A)', () => {
     expect(parsed.objects['*'].modifyAllRecords).toBe(true);
   });
 
-  it('the wildcard grants NO export — #8681 ruling pinned at the declaration\'s new home', () => {
+  it('the wildcard grants NO export — export stays an opt-in axis, pinned at the declaration\'s new home', () => {
     // [#3544/#8681] export is an OPT-IN axis, deliberately absent from the
     // super-user wildcard (maintainer ruling 2026-08-15). Moving the
     // declaration into spec must not resurrect it.
@@ -40,7 +40,7 @@ describe('ADMIN_FULL_ACCESS_CAPABILITIES (#11965, Choice 6A)', () => {
     expect(parsed.objects['*'].allowExport).not.toBe(true);
   });
 
-  it('[#21260] carries the compliance ledger’s audit capability, declared org-scoped', () => {
+  it('carries the compliance ledger’s audit capability, declared org-scoped', () => {
     // Ruling B on #21175: platform administrators hold it by default, through
     // this grant (and the config-derived envelope core builds from this same
     // list). The other shipped sets withhold it, pinned on the seeded sets in

packages/spec/src/identity/position-delegatable-enforcer.pin.test.ts

@@ -101,7 +101,7 @@ function unbackedRuleIds(prose: string, backed: Set<string>): string[] {
   return [...new Set(named.filter((id) => !backed.has(id)))];
 }
 
-describe('`delegatable` JSDoc names only enforcers that exist (#6628)', () => {
+describe('`delegatable` JSDoc names only enforcers that exist', () => {
   it('reads a real rule table off `packages/lint`', () => {
     const ids = declaredSecurityRuleIds();
     // A floor, not an exact count — new security rules are expected. Its only

packages/spec/src/identity/position.test.ts

@@ -232,7 +232,7 @@ describe('PositionSchema', () => {
 // ADR-0010 protection envelope the #4071 ledger flagged as the known sibling
 // gap (applyProtection stamps EVERY registered metadata type; position could
 // not represent the stamp).
-describe('unknown keys are rejected, not stripped (#4001)', () => {
+describe('unknown keys are rejected, not stripped', () => {
   const unknownKeyIssue = (value: unknown) => {
     const result = PositionSchema.safeParse(value);
     expect(result.success).toBe(false);
@@ -253,7 +253,7 @@ describe('unknown keys are rejected, not stripped (#4001)', () => {
       .toContain('FLAT');
   });
 
-  it('points `permissions` at permission-set bindings (#9885, ADR-0049 retirement)', () => {
+  it('points `permissions` at permission-set bindings (ADR-0049 retirement)', () => {
     // The sys_position row column of the same name was retired (no producer,
     // no reader); this guidance is the live-authoring half of the
     // prescription — the migrate-meta half is the semantic entry

packages/spec/src/integration/connector-author-shape.test.ts

@@ -150,7 +150,7 @@ function typescriptBlocks(markdown: string): string[] {
  */
 const ELISION = /\.\.\.\s*[,}\]]/;
 
-describe('[#5515] SYNC_ARCHITECTURE.md L3 connector examples compile', () => {
+describe('SYNC_ARCHITECTURE.md L3 connector examples compile', () => {
   const markdown = readFileSync(SYNC_ARCHITECTURE, 'utf8');
   const allBlocks = typescriptBlocks(markdown);
   const connectorBlocks = allBlocks.filter((b) => b.includes('Connector'));
@@ -214,7 +214,7 @@ describe('[#5515] SYNC_ARCHITECTURE.md L3 connector examples compile', () => {
   });
 });
 
-describe('[#5515] the spellings the example used to carry are rejected', () => {
+describe('the spellings the example used to carry are rejected', () => {
   // Reverse verification, direction stated BEFORE running: each probe below
   // restores one retired key into an otherwise-valid literal, and each must go
   // RED with a named diagnostic. Not "some diagnostic" — a bare non-empty check
@@ -290,7 +290,7 @@ describe('[#5515] the spellings the example used to carry are rejected', () => {
   });
 });
 
-describe('[#5515] the schema rejects them at RUNTIME too, and how it says so', () => {
+describe('the schema rejects them at RUNTIME too, and how it says so', () => {
   // The compile probes above guard the TYPE surface. These guard the PARSE
   // surface, and they are not redundant with it: what an author is told when
   // they get it wrong is the difference between a fixable mistake and a
@@ -337,7 +337,7 @@ describe('[#5515] the schema rejects them at RUNTIME too, and how it says so', (
   });
 });
 
-describe('[#5515] the bare `Connector` is the author shape; `ConnectorParsed` is the parse result', () => {
+describe('the bare `Connector` is the author shape; `ConnectorParsed` is the parse result', () => {
   // The fourth diagnostic, pinned as an ANNOTATION fact rather than fixed by
   // renaming this file's aliases. Direction stated before running: the SAME
   // literal is green under the bare `Connector` and red under `ConnectorParsed`,

packages/spec/src/integration/connector-provider-errors.test.ts

@@ -10,7 +10,7 @@ import {
   isConnectorUpstreamUnavailable,
 } from './connector-provider-errors';
 
-describe('#3017 — connector provider upstream-unavailable classification', () => {
+describe('connector provider upstream-unavailable classification — an unreachable upstream degrades instead of aborting boot', () => {
   it('the error carries the marker code, a stable name, and the cause', () => {
     const cause = new Error('connect ECONNREFUSED 127.0.0.1:9999');
     const err = new ConnectorUpstreamUnavailableError('mcp server unreachable', { cause });

packages/spec/src/integration/connector-provider.test.ts

@@ -88,7 +88,7 @@ describe('ADR-0097 connector schema evolution', () => {
             ).not.toThrow();
         });
 
-        it('rejects inline `authentication` secrets on a catalog descriptor (#7990)', () => {
+        it('rejects inline `authentication` secrets on a catalog descriptor', () => {
             const result = DeclarativeConnectorEntrySchema.safeParse({
                 name: 'legacy',
                 label: 'Legacy',