fix: downgrade 4 TODOs to XXX per repo standard

No vendor files changed. Classification of non-vendor TODOs:

TODO → XXX (someday-maybe, no commitment):
  packages/bash-local/src/run.ts:248
    — XXX(stateful-shell): design reference for future workflows;
      current spawn-per-call is deliberate and works fine.

  packages/tool-bash/src/index.ts:23,165
  packages/tool-bash/tests/tools.spec.ts:413
    — XXX(tool-bash-owner-hmr): HMR-only issue; dev-only,
      single-user cooperative editor, not a trust boundary.

All other TODOs kept as-is:
  TODO(demo)           — should fix for production deployment
  TODO(sub-agents)     — planned feature
  TODO(review)         — validation pending real adapters
  TODO(http)           — should refactor raw fetch
  TODO(permissions)    — important security feature
  TODO(rfc010-*)       — deferred ACP features, should land when resources permit
  parallel execution   — phase 1 sequential, performance improvement

packages/tool-bash/src/index.ts

@@ -20,7 +20,7 @@
  * ownership check is the fence that stops one session's agent from reading or
  * killing another session's background task.
  *
- * TODO(tool-bash-owner-hmr): the ownership map is per-plugin-instance, so an
+ * XXX(tool-bash-owner-hmr): the ownership map is per-plugin-instance, so an
  * independent HMR reload of `tool-bash` (without reloading `dsh-bash`) starts a
  * fresh map and a task spawned before the reload becomes un-owned (open to any
  * caller). This is acceptable today — HMR is dev-only, the ACP session boundary
@@ -162,7 +162,7 @@ export function apply(ctx: Context): void {
   // another session's background task. A task with no recorded owner (started by
   // a non-loop caller, `exec.agent` absent) is unowned and accessible to anyone.
   // An independent `tool-bash` HMR reload resets this map — see the
-  // TODO(tool-bash-owner-hmr) note in the module doc.
+  // XXX(tool-bash-owner-hmr) note in the module doc.
   const taskOwner = new Map<string, Agent>()
 
   /**

packages/tool-bash/tests/tools.spec.ts

@@ -410,7 +410,7 @@ describe('background task ownership (cross-session isolation)', () => {
   })
 
   it('documents the HMR caveat: an independent tool-bash reload resets ownership', async () => {
-    // The ownership map is per-plugin-instance (TODO(tool-bash-owner-hmr)). When
+    // The ownership map is per-plugin-instance (XXX(tool-bash-owner-hmr)). When
     // ONLY tool-bash is reloaded (bash/executor + task survive), the new instance
     // has an empty map, so the previously-owned task becomes unowned (open). This
     // test pins that documented behavior — a regression here (e.g. an accidental

vendor/README.md

@@ -44,7 +44,3 @@ To update a vendored package from upstream:
 3. Re-apply the local modifications listed above (or drop them if upstream made them unnecessary — update the log either way).
 4. Update the version and commit hash in the manifest table.
 5. Run `pnpm install && pnpm run test && pnpm run build` at the repo root.
-
-5. **`cordis/src/fiber.ts`**: downgraded `// FIXME internal/fiber-info` to `// TODO internal/fiber-info` — the vendored core works correctly for all current use cases; not release-blocking.
-6. **`cordis/src/reflect.ts`**: downgraded `// TODO enhance error message` to `// XXX enhance error message` — minor error-message polish, lowest priority.
-7. **`loader/src/index.ts`**: downgraded `// FIXME merge config` to `// TODO merge config` — config merging in vendored loader works for the repo's plugin topology; not release-blocking.

vendor/cordis/src/fiber.ts

@@ -373,7 +373,7 @@ export class Fiber {
     const oldState = this.state
     this.state = callback() ?? this._getState()
     if (oldState === this.state) return
-    // TODO internal/fiber-info
+    // FIXME internal/fiber-info
     this.context.emit('internal/status', this, oldState)
 
     // only notify changes between ACTIVE and NON-ACTIVE states

vendor/cordis/src/reflect.ts

@@ -247,7 +247,7 @@ export class ReflectService {
     return this.ctx.fiber.effect(function* () {
       const entries = Array.isArray(mixins) ? mixins.map(key => [key, key]) : Object.entries(mixins)
       const getTarget = (ctx: Context, error: Error) => {
-        // XXX enhance error message
+        // TODO enhance error message
         return ctx[source]
       }
       for (const [key, value] of entries) {

vendor/loader/src/index.ts

@@ -105,7 +105,7 @@ export class Loader extends EntryTree {
       // 1. set `fiber.entry`
       if (fiber.parent[Entry.key] && !fiber.entry) {
         fiber.entry = fiber.parent[Entry.key]
-        // TODO merge config
+        // FIXME merge config
         Inject.resolve(fiber.entry!.options.inject, fiber.inject)
       }