diff --git a/packages/tool-bash/src/index.ts b/packages/tool-bash/src/index.ts
index 9a15c6ad7a..4bc6e02650 100644
--- a/packages/tool-bash/src/index.ts
+++ b/packages/tool-bash/src/index.ts
@@ -20,7 +20,7 @@
  * ownership check is the fence that stops one session's agent from reading or
  * killing another session's background task.
  *
- * TODO(tool-bash-owner-hmr): the ownership map is per-plugin-instance, so an
+ * XXX(tool-bash-owner-hmr): the ownership map is per-plugin-instance, so an
  * independent HMR reload of `tool-bash` (without reloading `dsh-bash`) starts a
  * fresh map and a task spawned before the reload becomes un-owned (open to any
  * caller). This is acceptable today — HMR is dev-only, the ACP session boundary
@@ -162,7 +162,7 @@ export function apply(ctx: Context): void {
   // another session's background task. A task with no recorded owner (started by
   // a non-loop caller, `exec.agent` absent) is unowned and accessible to anyone.
   // An independent `tool-bash` HMR reload resets this map — see the
-  // TODO(tool-bash-owner-hmr) note in the module doc.
+  // XXX(tool-bash-owner-hmr) note in the module doc.
   const taskOwner = new Map<string, Agent>()
 
   /**
diff --git a/packages/tool-bash/tests/tools.spec.ts b/packages/tool-bash/tests/tools.spec.ts
index cc25d9d9d4..e519bd8850 100644
--- a/packages/tool-bash/tests/tools.spec.ts
+++ b/packages/tool-bash/tests/tools.spec.ts
@@ -410,7 +410,7 @@ describe('background task ownership (cross-session isolation)', () => {
   })
 
   it('documents the HMR caveat: an independent tool-bash reload resets ownership', async () => {
-    // The ownership map is per-plugin-instance (TODO(tool-bash-owner-hmr)). When
+    // The ownership map is per-plugin-instance (XXX(tool-bash-owner-hmr)). When
     // ONLY tool-bash is reloaded (bash/executor + task survive), the new instance
     // has an empty map, so the previously-owned task becomes unowned (open). This
     // test pins that documented behavior — a regression here (e.g. an accidental
diff --git a/vendor/README.md b/vendor/README.md
index e3be4cfde9..04e63f26c1 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -44,7 +44,3 @@ To update a vendored package from upstream:
 3. Re-apply the local modifications listed above (or drop them if upstream made them unnecessary — update the log either way).
 4. Update the version and commit hash in the manifest table.
 5. Run `pnpm install && pnpm run test && pnpm run build` at the repo root.
-
-5. **`cordis/src/fiber.ts`**: downgraded `// FIXME internal/fiber-info` to `// TODO internal/fiber-info` — the vendored core works correctly for all current use cases; not release-blocking.
-6. **`cordis/src/reflect.ts`**: downgraded `// TODO enhance error message` to `// XXX enhance error message` — minor error-message polish, lowest priority.
-7. **`loader/src/index.ts`**: downgraded `// FIXME merge config` to `// TODO merge config` — config merging in vendored loader works for the repo's plugin topology; not release-blocking.
diff --git a/vendor/cordis/src/fiber.ts b/vendor/cordis/src/fiber.ts
index df852ae26f..840bc54352 100644
--- a/vendor/cordis/src/fiber.ts
+++ b/vendor/cordis/src/fiber.ts
@@ -373,7 +373,7 @@ export class Fiber {
     const oldState = this.state
     this.state = callback() ?? this._getState()
     if (oldState === this.state) return
-    // TODO internal/fiber-info
+    // FIXME internal/fiber-info
     this.context.emit('internal/status', this, oldState)
 
     // only notify changes between ACTIVE and NON-ACTIVE states
diff --git a/vendor/cordis/src/reflect.ts b/vendor/cordis/src/reflect.ts
index 93ccffaf17..4bc9fb44db 100644
--- a/vendor/cordis/src/reflect.ts
+++ b/vendor/cordis/src/reflect.ts
@@ -247,7 +247,7 @@ export class ReflectService {
     return this.ctx.fiber.effect(function* () {
       const entries = Array.isArray(mixins) ? mixins.map(key => [key, key]) : Object.entries(mixins)
       const getTarget = (ctx: Context, error: Error) => {
-        // XXX enhance error message
+        // TODO enhance error message
         return ctx[source]
       }
       for (const [key, value] of entries) {
diff --git a/vendor/loader/src/index.ts b/vendor/loader/src/index.ts
index 2839979676..e18fc2ffa2 100644
--- a/vendor/loader/src/index.ts
+++ b/vendor/loader/src/index.ts
@@ -105,7 +105,7 @@ export class Loader extends EntryTree {
       // 1. set `fiber.entry`
       if (fiber.parent[Entry.key] && !fiber.entry) {
         fiber.entry = fiber.parent[Entry.key]
-        // TODO merge config
+        // FIXME merge config
         Inject.resolve(fiber.entry!.options.inject, fiber.inject)
       }