refactor: replace overloaded surface terminology

packages/feedback/message-feedback/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/feedback/message-feedback/README.md
-README.md: a9ebad25907e32435c8d2a65eb4b2cd9eaa89eeb
+README.md: 54c6b92fbb68027a4aedb198948785183661a724
 README.zh.md: 29cbee0c1ec2ee810948d895c762d2e6320e9b66

packages/feedback/message-feedback/README.md

@@ -77,7 +77,7 @@ Independent. Listing or mutating message feedback does not touch a model request
 
 - **Client aggregate and UI are absent** — the Host Remote contract ships, but the Client Remote aggregate contribution and any UI consumer are separately owned and deferred.
 - **Compare-and-set is single-process** — the per-Session queue serializes one service instance only; multiple Host processes writing one storage root can still lose updates because storage-domain exposes no cross-process conditional write.
-- **No durable Session deletion cascade** — Session persistence has no deletion surface, and `session/disposed`/`host/session-removed` mean detach rather than durable deletion. The service therefore retains empty rows and may leave orphan rows after out-of-band log removal instead of deleting valid feedback on detach.
+- **No durable Session deletion cascade** — Session persistence has no deletion API, and `session/disposed`/`host/session-removed` mean detach rather than durable deletion. The service therefore retains empty rows and may leave orphan rows after out-of-band log removal instead of deleting valid feedback on detach.
 - **Detach/catalog retirement window** — a request in the narrow interval after live detach but before the persistence catalog materializes the header can receive `session-not-found`; callers retry after retirement materialization.
 - **Header identity is not a content fingerprint** — `{createdAt, cwd}` detects reuse only when those fields differ; a cloned log retaining the same header identity is indistinguishable.
 - **Trusted caller boundary** — `list`/`put`/`delete` carry no authenticated actor or audit identity. A deployment must expose the Host gateway only through its trusted or separately authenticated boundary until authorization and attribution are added.

packages/feedback/message-feedback/tests/helpers.ts

@@ -30,7 +30,7 @@ export interface MessageFixture {
   readonly replacementAssistantMessageId: MessageId
 }
 
-/** Append one deterministic transcript surface used by target-validation tests. */
+/** Append one deterministic transcript used by target-validation tests. */
 export function appendMessageFixture(session: Session): Omit<MessageFixture, 'session'> {
   session.append('turn/start', { turn: 1 })
   session.append('step/start', { turn: 1, step: 1 })