Rewrite numbered work-item labels in code comments as descriptive names

bridge/src/audit.rs

@@ -86,7 +86,7 @@ fn truncate(s: &str) -> String {
 }
 
 /// Whole seconds since the Unix epoch (integer-only; no float). A clock before
-/// the epoch records 0.
+/// this point records 0.
 fn unix_seconds() -> u64 {
     SystemTime::now()
         .duration_since(UNIX_EPOCH)

bridge/src/capabilities.rs

@@ -1,7 +1,7 @@
 //! Device capabilities resolved from the ready message, and the
 //! capability-gating contract (`specs/mcp-bridge.allium`): a tool that
 //! names a required capability is advertised iff the device provides it.
-//! The concrete capability tools arrive in 5.1-5.4; 5.0 fixes the gate.
+//! The concrete capability tools are added later; this fixes the gate.
 
 use crate::wire::{DetectedToolchain, Features};
 
@@ -127,7 +127,7 @@ impl Capabilities {
             // PokeRequiresBothArmingLayers (the device /ALLOWMEMWRITE arm is the
             // independent device half).
             "mem_write" => self.mem != MemTier::None && self.allow_memory_write,
-            // 5.4 retired "utf8": the device emits valid UTF-8 on every tier, so
+            // "utf8" was retired: the device emits valid UTF-8 on every tier, so
             // the wire is uniformly UTF-8 and no tool gates on encoding
             // (DeviceCapabilities.encoding is informational provenance only).
             // The runtime-registration opt-in gates win32_register_toolchain
@@ -140,8 +140,8 @@ impl Capabilities {
 
 /// The capability a tool requires to be advertised. `None` = always
 /// advertised; `Some(cap)` = advertised iff `Capabilities::satisfies(cap)`.
-/// 5.3 wires the FIRST real entries (the gate was empty/unexercised since
-/// 5.0): the five memory tools. The four read/control tools require `mem`
+/// Wires the FIRST real entries (the gate was empty/unexercised before):
+/// the five memory tools. The four read/control tools require `mem`
 /// (any tier); `win32_poke` requires the two-factor `mem_write`
 /// (`MemoryWriteToolRequiresOptIn`). On a `mem: none` device all five are
 /// pruned from `tools/list` — the first real exercise of the G1
@@ -152,7 +152,7 @@ pub const GATED_TOOLS: &[(&str, &str)] = &[
     ("win32_poke", "mem_write"),
     ("win32_terminate", "mem"),
     ("win32_release", "mem"),
-    // 5.5: the pty exec tool advertises only on a ConPTY-capable device
+    // The pty exec tool advertises only on a ConPTY-capable device
     // (PtyToolGatedOnCapability); win32_exec/win32_list_commands name no
     // capability and are always advertised.
     ("win32_pty_exec", "pty"),

bridge/src/lib.rs

@@ -1,4 +1,4 @@
-//! MCP bridge for the MCP-Win32s device (Phase 5.0, bridge core).
+//! MCP bridge for the MCP-Win32s device (bridge core).
 //!
 //! An MCP server (stdio, via `rmcp`) that fronts a Win32s..Win11 device
 //! reachable over the frozen newline-JSON wire protocol (serial/TCP).

bridge/src/main.rs

@@ -1,4 +1,4 @@
-//! mcp-w32s-bridge entry point (Phase 5.0).
+//! mcp-w32s-bridge entry point.
 //!
 //! Connects to the Win32 device, completes the ready handshake, then
 //! serves MCP over stdio. Logging goes to stderr — stdout is the MCP

bridge/src/server.rs

@@ -219,7 +219,7 @@ struct Inner {
     /// registration mutates it (the new tools materialise on the next session,
     /// per the registry-as-source-of-truth model).
     registry: Mutex<Registry>,
-    /// Runtime resilience (5.5): the device-facing circuit-breaker and the
+    /// Runtime resilience: the device-facing circuit-breaker and the
     /// per-tool token-bucket rate limiter every relayed call passes through
     /// (rate-limit -> breaker -> relay), plus the append-only power-tool audit
     /// log (PowerToolsAreAudited).
@@ -399,7 +399,7 @@ impl Bridge {
     /// successful call (compile-error-≠-tool-error). The device failing to RUN
     /// the toolchain (a `status:"error"` reply) is the only isError case.
     // The build descriptors (role/command/template/dialect/diagnostic) are a
-    // flat per-call list bound in build_route; the 5.5 audit added tool_name,
+    // flat per-call list bound in build_route; the audit added tool_name,
     // tipping one past clippy's 7-arg heuristic. Bundling them into a struct
     // would be a single-use wrapper, so the list is kept flat.
     #[allow(clippy::too_many_arguments)]
@@ -744,7 +744,7 @@ impl Bridge {
         Ok(self.round_trip_power("win32_remove_dir", cmd).await)
     }
 
-    // ----- memory tools (5.3) -------------------------------------------
+    // ----- memory tools -------------------------------------------------
     // Each is a 1:1 relay to a device wire command (MemoryToolsRegistered).
     // They are gated by GATED_TOOLS: spawn_retain/peek/terminate/release on
     // "mem", poke on the two-factor "mem_write" — pruned from tools/list on a
@@ -846,7 +846,7 @@ impl Bridge {
         Ok(self.round_trip("win32_release", cmd).await)
     }
 
-    // ----- exec discovery tools (5.5) -----------------------------------
+    // ----- exec discovery tools -----------------------------------------
     // The three exec tools are 1:1 relays to the device's exec/ptyExec/
     // listCommands wire commands (ExecToolsRegistered, ExecToolsAreDirectRelays).
     // win32_exec/win32_pty_exec are destructive and power-audited; win32_exec
@@ -1074,8 +1074,8 @@ fn catalogued_build_commands() -> HashSet<String> {
         .collect()
 }
 
-/// Base64-decode a device reply field (`stdout_b64`/`stderr_b64`) to text. As
-/// of 5.4 the device owns the whole text pipeline and transcodes console output
+/// Base64-decode a device reply field (`stdout_b64`/`stderr_b64`) to text. The
+/// device owns the whole text pipeline and transcodes console output
 /// to UTF-8 on every tier, so these bytes are ALREADY valid UTF-8 — the bridge
 /// only validates them (no codepage logic, no `encoding_rs`/`oem_cp`). The
 /// `from_utf8_lossy` is kept purely as a belt-and-suspenders for a malformed

bridge/src/wire.rs

@@ -64,8 +64,8 @@ pub struct Features {
     pub extra: BTreeMap<String, Value>,
 }
 
-/// A command to the device: `{"cmd":..,"id":.., <args>}`. 5.0 issues
-/// only `echo`; the typed capability commands arrive in 5.1+.
+/// A command to the device: `{"cmd":..,"id":.., <args>}`. The bridge issues
+/// only `echo`; the typed capability commands are added later.
 #[derive(Debug, Clone, Serialize)]
 pub struct Command {
     pub cmd: String,

bridge/tests/build_tools.rs

@@ -1,4 +1,4 @@
-//! 5.2 integration tests: the schema-driven build subsystem — generated
+//! Integration tests: the schema-driven build subsystem — generated
 //! win32_<vendor>_<role> tools, the two meta tools, the opt-in gate, and the
 //! end-to-end build pipeline (typed params -> injection-safe argv -> catalogued
 //! exec -> diagnostic parse). Each cites its obligation IDs from
@@ -177,7 +177,7 @@ async fn registration_requires_opt_in() {
     let _ = on.cancel().await;
 }
 
-/// rule-success.CapabilitiesResolved (the 5.2 additions) — from_ready parses the
+/// rule-success.CapabilitiesResolved (the build-subsystem additions) — from_ready parses the
 /// ready features' `toolchains` array, and the operator opt-in flag threads
 /// through to toolchain_registration. An empty/absent array is no toolchains.
 #[test]

bridge/tests/encoding.rs

@@ -1,4 +1,4 @@
-//! 5.4 bridge passthrough tests. The device owns the whole text pipeline and
+//! Bridge passthrough tests. The device owns the whole text pipeline and
 //! emits valid UTF-8 on every OS tier, so the wire is uniformly UTF-8: the
 //! `encoding` ready tag is INFORMATIONAL provenance (it gates nothing) and the
 //! bridge adds no charset crate. Obligations: bridge/OBLIGATIONS-5.4.md.

bridge/tests/exec_tools.rs

@@ -1,4 +1,4 @@
-//! 5.5 integration tests: the exec discovery tool surface — the three exec
+//! Integration tests: the exec discovery tool surface — the three exec
 //! tools (win32_exec / win32_pty_exec / win32_list_commands), the pty
 //! capability prune (PtyToolGatedOnCapability), THE UNSAFE-EXEC SAFETY GATE
 //! (UnsafeExecRequiresOperatorOptIn: refused without opt-in, relayed with it),

bridge/tests/file_tools.rs

@@ -39,7 +39,7 @@ const FILE_TOOLS: &[&str] = &[
 
 /// rule-success.FileToolsRegistered, rule-entity-creation.FileToolsRegistered.1 —
 /// tools/list over the duplex advertises exactly the eight win32_* file
-/// tools plus the existing 5.0 echo tool, each with an inputSchema.
+/// tools plus the existing echo tool, each with an inputSchema.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn file_tools_all_advertised() {
     use rmcp::ServiceExt;
@@ -368,7 +368,7 @@ async fn file_tools_relay_to_device_cmds() {
     );
 }
 
-/// Cross-module scenario (device reply -> MCP result, the 5.0 generic
+/// Cross-module scenario (device reply -> MCP result, the generic
 /// mapping): a device status:"error" reply to a copy surfaces as an
 /// isError tool result carrying the reason; a device ok reply surfaces as
 /// a success result with structuredContent.

bridge/tests/integration.rs

@@ -1,4 +1,4 @@
-//! 5.0 integration tests: the bridge's tool-call -> device round-trip ->
+//! Integration tests: the bridge's tool-call -> device round-trip ->
 //! result mapping, against the mock device. Each cites its obligation
 //! IDs from bridge/OBLIGATIONS-5.0.md.
 
@@ -83,8 +83,8 @@ async fn transport_failure_maps_to_iserror() {
 }
 
 /// rule-success.ToolAdvertised, invariant.AdvertisedToolsAreCapable — the
-/// gate mechanism. 5.3 wires the FIRST real gated tools (the five memory
-/// tools), closing the G1 gap that left this prune set empty since 5.0. The
+/// gate mechanism. The FIRST real gated tools (the five memory
+/// tools) close the G1 gap that had left this prune set empty. The
 /// `caps()` helper here is a `mem: none` device, so every memory tool is
 /// pruned regardless of pty. (The per-capability logic is property-tested in
 /// props.rs; the tools/list effect in memory.rs.)

bridge/tests/memory.rs

@@ -1,4 +1,4 @@
-//! 5.3 integration tests: the memory peek/poke tool surface — the five
+//! Integration tests: the memory peek/poke tool surface — the five
 //! win32_* memory tools, the FIRST real G1 capability prune (mem: none ->
 //! absent from tools/list), the two-factor poke opt-in gate, honest hints,
 //! and the 1:1 device-command relay. Each cites its obligation IDs from
@@ -136,7 +136,7 @@ async fn memory_tools_registered() {
     let _ = client.cancel().await;
 }
 
-/// The FIRST real G1 capability prune (carried empty/unexercised since 5.0):
+/// The FIRST real G1 capability prune (carried empty/unexercised until now):
 /// with `mem: none` the four mem-gated tools are ABSENT from tools/list; with
 /// `mem: process` they appear. The prune->absence path, finally exercised.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]

bridge/tests/props.rs

@@ -1,4 +1,4 @@
-//! 5.0 property tests (the theft analog): the pure capability-gating and
+//! Property tests (the theft analog): the pure capability-gating and
 //! response-mapping logic. Cites obligations from bridge/OBLIGATIONS-5.0.md.
 
 use mcp_w32s_bridge::capabilities::{Capabilities, EncodingProvenance, MemTier};
@@ -45,7 +45,7 @@ fn caps(
 
 proptest! {
     /// capability_satisfied (rule-success.ToolAdvertised, invariant.
-    /// AdvertisedToolsAreCapable; 5.3 capability_satisfied_mem): each named
+    /// AdvertisedToolsAreCapable; capability_satisfied_mem): each named
     /// capability matches the device exactly; an unknown capability is never
     /// satisfied. The two-factor mem_write gate holds iff BOTH the tier is
     /// non-none AND the operator opted in (MemoryWriteToolRequiresOptIn).
@@ -60,7 +60,7 @@ proptest! {
         prop_assert_eq!(c.satisfies("pty"), pty);
         prop_assert_eq!(c.satisfies("mem"), mem != MemTier::None);
         prop_assert_eq!(c.satisfies("mem_write"), mem != MemTier::None && amw);
-        // 5.4 retired "utf8": encoding is informational, so it never gates a
+        // "utf8" was retired: encoding is informational, so it never gates a
         // tool. The old gate name now falls through to the unknown arm.
         prop_assert!(!c.satisfies("utf8"));
         prop_assert!(!c.satisfies("unknown_capability_xyz"));

bridge/tests/resilience.rs

@@ -1,4 +1,4 @@
-//! 5.5 integration tests: runtime resilience and the power-tool audit. A
+//! Integration tests: runtime resilience and the power-tool audit. A
 //! tripped circuit-breaker and an exhausted rate limiter refuse a call LOCALLY
 //! (recoverable isError, device untouched — ToolCallCircuitOpen /
 //! ToolCallRateLimited); every power-tool call produces a durable audit record

src/charset_tables.h

@@ -1,5 +1,5 @@
 /*
- * charset_tables.h - Embedded code-page <-> Unicode tables (work-item 5.4)
+ * charset_tables.h - Embedded code-page <-> Unicode tables
  *
  * GENERATED DATA. The tables in src/charset_tables.c are produced by
  * tools/gen_charset_tables.py from the vendored Unicode Consortium MICSFT

src/encoding.c

@@ -1,5 +1,5 @@
 /*
- * encoding.c - Full-range text encoding for MCP-Win32s (work-item 5.4).
+ * encoding.c - Full-range text encoding for MCP-Win32s.
  *
  * This translation unit carries the PURE UTF-8 <-> UTF-16 codec (the
  * Utf8Codec contract: utf16_to_utf8 / utf8_to_utf16). No Win32, no floating

src/encoding.h

@@ -1,5 +1,5 @@
 /*
- * encoding.h - Full-range text encoding for MCP-Win32s (work-item 5.4)
+ * encoding.h - Full-range text encoding for MCP-Win32s
  *
  * The device owns the ENTIRE text pipeline and emits valid UTF-8 on every wire
  * surface across the whole target range (Win3.1+Win32s 1.25a -> Win11), using

src/feat.c

@@ -189,7 +189,7 @@ void FeatInit(void)
         }
 
         /*
-         * 5.4: the delay-loaded -W (UTF-16) file/dir/spawn set - the `wide`
+         * The delay-loaded -W (UTF-16) file/dir/spawn set - the `wide`
          * encoding tier. Resolved only here as string literals, never linked
          * by name, so the import resolver still loads the binary on Win32s.
          */

src/feat.h

@@ -24,7 +24,7 @@
 #define FEAT_FORCE_NO_CTRL_EVENTS      0x0004
 #define FEAT_FORCE_NO_PTY              0x0008
 #define FEAT_FORCE_NO_BINARY_TYPE      0x0010
-/* 5.4: force the pre-NT -A fallback on an NT host so the codepage tier (our own
+/* Force the pre-NT -A fallback on an NT host so the codepage tier (our own
  * tables) and the -A file/spawn paths are exercisable where the -W uplift would
  * otherwise win. */
 #define FEAT_FORCE_NO_WIDE_FILEAPI     0x0020
@@ -57,7 +57,7 @@ typedef struct {
     int has_proc_thread_attr_list;
     int has_set_process_mitigation;
 
-    /* 5.4: the delay-loaded -W (UTF-16) file/dir uplift (the `wide` encoding
+    /* The delay-loaded -W (UTF-16) file/dir uplift (the `wide` encoding
      * tier). All eight file/dir -W APIs exist since NT 3.1, so one flag covers
      * them; CreateProcessW is tracked separately (the spawn path). NULL/0 on
      * Win32s/9x -> the codepage tier (our own tables) handles narrowing. */
@@ -81,7 +81,7 @@ typedef struct {
     BOOL    (WINAPI *pSetProcessMitigationPolicy)(int, PVOID, FeatSizeT);
 
     /*
-     * 5.4 -W uplift (the `wide` tier). The find-data / startup-info out-params
+     * The -W uplift (the `wide` tier). The find-data / startup-info out-params
      * are typed void * so feat.h need not pull in WIN32_FIND_DATAW / STARTUPINFOW
      * (the C89 SDK headers carry them inconsistently - the exec_ops.c job-struct
      * precedent); the caller declares the W struct locally and casts. NULL when

src/file_ops.c

@@ -1,7 +1,7 @@
 /*
  * file_ops.c - File operations for MCP-Win32s
  *
- * Tier-aware text encoding (work-item 5.4): every inbound agent path is a
+ * Tier-aware text encoding: every inbound agent path is a
  * UTF-8 wire path, prepared for the host's file API by EncOpenPath. On the
  * `wide` tier (NT family) the ops call the delay-loaded -W file APIs over the
  * widened UTF-16 (g_features.p*W); on the `manifest`/`codepage` tiers they call

src/mem_ops.c

@@ -1,5 +1,5 @@
 /*
- * mem_ops.c - Tiered, user-mode memory peek/poke (work-item 5.3).
+ * mem_ops.c - Tiered, user-mode memory peek/poke.
  *
  * The device's highest-stakes capability: bounded, consented, logged ring-3
  * memory read/write. See mem_ops.h for the contract and memory-ops.allium for

src/mem_ops.h

@@ -1,5 +1,5 @@
 /*
- * mem_ops.h - Tiered, user-mode memory peek/poke (work-item 5.3)
+ * mem_ops.h - Tiered, user-mode memory peek/poke
  *
  * Spec: memory-ops.allium. The device's highest-stakes capability: bounded,
  * consented, logged ring-3 memory read/write. We use exactly what each OS

src/uart.c

@@ -1,6 +1,6 @@
 /*
  * uart.c - Win32s direct-UART serial route: the PURE detection ladder and
- * driving logic (work-item 6.2 / task #37). Spec: specs/uart.allium; the frozen
+ * driving logic (task #37). Spec: specs/uart.allium; the frozen
  * contract is src/uart.h (each function's doc comment is the per-function spec).
  *
  * Everything here is OS-independent: it touches the 16550 ONLY through the

src/uart.h

@@ -1,5 +1,5 @@
 /*
- * uart.h - Win32s direct-UART serial route (work-item 6.2 / task #37)
+ * uart.h - Win32s direct-UART serial route (task #37)
  *
  * Spec: uart.allium. The tier-aware serial backend's Win32s-only internal
  * route: where the Win32 communications API is an exported-but-stubbed no-op

tests/host/theft_encoding.c

@@ -2,7 +2,7 @@
  * theft_encoding.c - host-native property-based tests for the pure UTF-8 <->
  * UTF-16 codec (src/encoding.c: Utf16ToUtf8 / Utf8ToUtf16).
  *
- * 5.4 theft host PBT harness (specs/encoding.allium contract Utf8Codec). The
+ * Theft host PBT harness (specs/encoding.allium contract Utf8Codec). The
  * codec's SAFETY pins, each hammered at 50k autoshrinking trials:
  *
  *   codec/round_trip      a WELL-FORMED UTF-16 unit sequence survives

tests/host/theft_mem.c

@@ -1,7 +1,7 @@
 /*
  * theft_mem.c - host-native property-based tests for the pure memory guards.
  *
- * 5.3 theft host PBT harness (tests/OBLIGATIONS-5.3.md, specs/memory-ops.allium:
+ * Theft host PBT harness (tests/OBLIGATIONS-5.3.md, specs/memory-ops.allium:
  * SAFETY PIN #1 invariant.AddressIsWellFormed, SAFETY PIN #2
  * invariant.MemoryAccessRangeBounded - the strongest pin on the off-by-overflow
  * class). Properties (autoshrinking):

tests/host/theft_uart.c

@@ -2,13 +2,13 @@
  * theft_uart.c - host-native property-based tests for the pure Win32s direct-
  * UART ladder (src/uart.c), driven over the injected UartPortIo seam against a
  * simulated 16550 (tests/uart_sim.h). C99 + POSIX, ASan/UBSan, 50k trials per
- * property - the strongest pin on the 6.2 security invariants.
+ * property - the strongest pin on the security invariants.
  *
  * Spec: specs/uart.allium; obligations: tests/OBLIGATIONS-6.2.md. The pure
  * functions reference no Win32 type, so src/uart.c is compiled -DUART_HOST_PURE
  * (which leaves the asm inb/outb + transport wiring out) and linked here.
  *
- * Properties (each maps to a 6.2 obligation; SECURITY PINs called out):
+ * Properties (each maps to an obligation; SECURITY PINs called out):
  *
  *   P1 fifo_iff_16550a        PIN #4 invariant.FifoEnabledImpliesDetected16550A,
  *                             rule-success.UartChipIdentified: fifo_enabled==1

tests/test_encoding.c

@@ -1,6 +1,6 @@
 /*
  * test_encoding.c - on-target tests for the full-range text encoding subsystem
- * (work-item 5.4). Spec: encoding.allium.
+ * Spec: encoding.allium.
  *
  * This file grows across the encoding modules; the section below covers the
  * code-page tables (M2): the exhaustive per-page round-trip on the bijective

tests/test_feat.c

@@ -165,7 +165,7 @@ TEST_CASE(force_fallback_zeroes_flags_and_pointers) {
 }
 
 /* ========================================================
- * #7 The 5.4 delay-loaded -W (UTF-16) uplift resolves on
+ * #7 The delay-loaded -W (UTF-16) uplift resolves on
  *    this NT host: all eight file/dir pointers plus
  *    CreateProcessW are non-NULL and the two flags are set.
  *    The has_wide_fileapi flag implies every backing pointer
@@ -208,7 +208,7 @@ TEST_CASE(wide_uplift_probe) {
 }
 
 /* ========================================================
- * #8 FeatForceFallback drops the 5.4 -W uplift: both wide
+ * #8 FeatForceFallback drops the -W uplift: both wide
  *    flags clear and ALL NINE -W pointers go NULL, so the
  *    codepage (-A) tier can be exercised on an NT host.
  *    An unrelated capability is preserved.
@@ -256,7 +256,7 @@ TEST_CASE(force_fallback_wide) {
 }
 
 /* The os_family_maps_to_tier / EncTierCurrent test is added with the
- * encoding tier half (a later 5.4 module supplies that function). */
+ * encoding tier half (a later module supplies that function). */
 
 int main(void)
 {