chore(todo): consolidate TODO comments into the five fixed marker tags

Retag every Shirabe-authored TODO comment to one of the fixed tags:
phase-c, phase-d, plugin, php-runtime, phase-e.

Upstream-authored TODO comments from Composer/Symfony are left
untouched to preserve the ported code shape.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

27 files changed, 102 insertions, 103 deletions

diff --git a/crates/shirabe-external-packages/src/seld/signal/signal_handler.rs b/crates/shirabe-external-packages/src/seld/signal/signal_handler.rs
index bd794628..b2f1873e 100644
--- a/crates/shirabe-external-packages/src/seld/signal/signal_handler.rs
+++ b/crates/shirabe-external-packages/src/seld/signal/signal_handler.rs
@@ -3,7 +3,7 @@
 #[derive(Debug)]
 pub struct SignalHandler;
 
-// TODO(phase-d): disable signal handler at all for now.
+// TODO(phase-c): disable signal handler at all for now.
 impl SignalHandler {
     pub const SIGINT: &'static str = "SIGINT";
     pub const SIGTERM: &'static str = "SIGTERM";
diff --git a/crates/shirabe-external-packages/src/symfony/console/command/command.rs b/crates/shirabe-external-packages/src/symfony/console/command/command.rs
index 2af60db0..f9808878 100644
--- a/crates/shirabe-external-packages/src/symfony/console/command/command.rs
+++ b/crates/shirabe-external-packages/src/symfony/console/command/command.rs
@@ -61,7 +61,7 @@ impl CommandData {
     pub const DEFAULT_DESCRIPTION: Option<&'static str> = None;
 
     pub fn get_default_name() -> Option<String> {
-        // TODO(review): PHP uses ReflectionClass to read the #[AsCommand] attribute
+        // TODO(phase-c): PHP uses ReflectionClass to read the #[AsCommand] attribute
         // and ReflectionProperty to check that `$defaultName` is declared on the late-static
         // class itself (not inherited). Reflection-based late static binding cannot be
         // reproduced in Phase A; human review needed for the porting strategy.
@@ -69,7 +69,7 @@ impl CommandData {
     }
 
     pub fn get_default_description() -> Option<String> {
-        // TODO(review): same Reflection/late-static-binding concern as get_default_name().
+        // TODO(phase-c): same Reflection/late-static-binding concern as get_default_name().
         todo!()
     }
 
@@ -429,7 +429,7 @@ pub trait Command: std::fmt::Debug + shirabe_php_shim::AsAny + shirabe_php_shim:
         self.initialize(input.clone(), output.clone())?;
 
         if let Some(process_title) = self.get_process_title() {
-            // TODO: PHP probes for cli_set_process_title / setproctitle availability.
+            // TODO(phase-c): PHP probes for cli_set_process_title / setproctitle availability.
             if shirabe_php_shim::function_exists("cli_set_process_title") {
                 if !shirabe_php_shim::cli_set_process_title(&process_title) {
                     if shirabe_php_shim::PHP_OS == "Darwin" {
@@ -874,7 +874,7 @@ impl Command for CommandData {
         &self,
         code: Box<dyn Fn(&mut dyn InputInterface, &mut dyn OutputInterface) -> PhpMixed>,
     ) {
-        // TODO: PHP rebinds an unbound Closure's $this to the command instance via
+        // TODO(php-runtime): PHP rebinds an unbound Closure's $this to the command instance via
         // ReflectionFunction/Closure::bind. Rust closures have no `$this` rebinding;
         // the closure is stored as-is.
         *self.code.borrow_mut() = Some(code);
diff --git a/crates/shirabe-external-packages/src/symfony/console/formatter/output_formatter.rs b/crates/shirabe-external-packages/src/symfony/console/formatter/output_formatter.rs
index 6651d9cd..bb04f61d 100644
--- a/crates/shirabe-external-packages/src/symfony/console/formatter/output_formatter.rs
+++ b/crates/shirabe-external-packages/src/symfony/console/formatter/output_formatter.rs
@@ -255,7 +255,7 @@ impl OutputFormatterInterface for OutputFormatter {
 
         // PHP returns the shared style instance; ownership cannot be expressed without Clone on
         // the trait object.
-        // TODO(human-review): returning a shared style here needs an Rc/Clone strategy in Phase C.
+        // TODO(phase-c): returning a shared style here needs an Rc/Clone strategy in Phase C.
         let _ = &self.styles[&shirabe_php_shim::strtolower(name)];
         todo!()
     }
diff --git a/crates/shirabe-external-packages/src/symfony/console/helper/table.rs b/crates/shirabe-external-packages/src/symfony/console/helper/table.rs
index 99c1b6ea..42c920f6 100644
--- a/crates/shirabe-external-packages/src/symfony/console/helper/table.rs
+++ b/crates/shirabe-external-packages/src/symfony/console/helper/table.rs
@@ -465,7 +465,7 @@ impl Table {
         }
 
         if self.rendered {
-            // TODO(phase-b): downcast output to ConsoleSectionOutput to call clear().
+            // TODO(phase-c): downcast output to ConsoleSectionOutput to call clear().
             let _ = ConsoleSectionOutput::clear;
             let row_count = self.calculate_row_count();
             let _ = row_count;
@@ -482,7 +482,7 @@ impl Table {
         // PHP indexes $this->rows by arbitrary key; sparse assignment over a positional Vec is not
         // modeled and has no callers.
         let _ = (column, row);
-        // TODO(phase-d): sparse `$this->rows[$column] = $row` over a positional row vector.
+        // TODO(phase-c): sparse `$this->rows[$column] = $row` over a positional row vector.
         todo!()
     }
 
diff --git a/crates/shirabe-external-packages/src/symfony/finder/spl_file_info.rs b/crates/shirabe-external-packages/src/symfony/finder/spl_file_info.rs
index c1d158dd..6f03fe14 100644
--- a/crates/shirabe-external-packages/src/symfony/finder/spl_file_info.rs
+++ b/crates/shirabe-external-packages/src/symfony/finder/spl_file_info.rs
@@ -78,7 +78,7 @@ impl SplFileInfo {
 
     pub fn get_size(&self) -> i64 {
         // \SplFileInfo::getSize() returns the file size in bytes (throws on failure).
-        // TODO(phase-d): PHP throws a \RuntimeException on stat failure; this returns 0 instead.
+        // TODO(phase-c): PHP throws a \RuntimeException on stat failure; this returns 0 instead.
         shirabe_php_shim::filesize(&self.pathname).unwrap_or(0)
     }
 }
diff --git a/crates/shirabe-external-packages/src/symfony/string/unicode_string.rs b/crates/shirabe-external-packages/src/symfony/string/unicode_string.rs
index e4158466..9048f77b 100644
--- a/crates/shirabe-external-packages/src/symfony/string/unicode_string.rs
+++ b/crates/shirabe-external-packages/src/symfony/string/unicode_string.rs
@@ -34,7 +34,7 @@ impl UnicodeString {
         width
     }
 
-    // TODO(phase-d): the faithful `length()` uses `grapheme_strlen` (extended grapheme clusters),
+    // TODO(phase-c): the faithful `length()` uses `grapheme_strlen` (extended grapheme clusters),
     // which needs Unicode segmentation tables with no Rust std equivalent and no permitted crate.
     // Approximated with the code-point count, exact only when no combining/multi-code-point
     // clusters are present (e.g. ASCII).
@@ -42,7 +42,7 @@ impl UnicodeString {
         shirabe_php_shim::mb_strlen(&self.string, "UTF-8")
     }
 
-    // TODO(phase-d): the faithful `slice()` uses `grapheme_substr` (grapheme-cluster offsets), which
+    // TODO(phase-c): the faithful `slice()` uses `grapheme_substr` (grapheme-cluster offsets), which
     // needs Unicode segmentation tables with no std equivalent and no permitted crate. Approximated
     // with code-point offsets via `mb_substr`, exact only without combining/multi-code-point clusters.
     pub fn slice(&self, start: i64, length: Option<i64>) -> Self {
diff --git a/crates/shirabe-php-rpc/src/lib.rs b/crates/shirabe-php-rpc/src/lib.rs
index 7ec1f925..9b9c9222 100644
--- a/crates/shirabe-php-rpc/src/lib.rs
+++ b/crates/shirabe-php-rpc/src/lib.rs
@@ -330,7 +330,7 @@ impl Worker {
     }
 }
 
-// TODO(phase-d): every failure here panics rather than propagating a `Result`; this is an interim
+// TODO(phase-c): every failure here panics rather than propagating a `Result`; this is an interim
 // step until PHP RPC gets proper error handling (see docs/dev/php-rpc.md).
 static WORKER: LazyLock<Mutex<Worker>> = LazyLock::new(|| {
     Mutex::new(
diff --git a/crates/shirabe-php-shim/src/array.rs b/crates/shirabe-php-shim/src/array.rs
index 6c2004cf..29338aae 100644
--- a/crates/shirabe-php-shim/src/array.rs
+++ b/crates/shirabe-php-shim/src/array.rs
@@ -686,7 +686,7 @@ pub fn sort<T: Ord>(_array: &mut Vec<T>) {
 
 pub fn sort_with_flags<T: Ord>(array: &mut [T], flags: i64) {
     if flags != SORT_REGULAR {
-        // TODO(phase-d): flag-specific comparison (SORT_NUMERIC/SORT_STRING/
+        // TODO(phase-c): flag-specific comparison (SORT_NUMERIC/SORT_STRING/
         // SORT_NATURAL/SORT_FLAG_CASE) cannot be expressed for a generic
         // `T: Ord` element. No caller passes a non-regular flag yet.
         todo!("sort() with flags other than SORT_REGULAR");
@@ -714,7 +714,7 @@ pub fn ksort<V>(array: &mut IndexMap<String, V>) {
 
 // PHP's default SORT_REGULAR comparison for array keys: two integer-like keys
 // compare numerically, otherwise byte-wise as strings.
-// TODO(phase-d): full SORT_REGULAR semantics for mixed integer/non-numeric-string
+// TODO(phase-c): full SORT_REGULAR semantics for mixed integer/non-numeric-string
 // keys are not reproduced; every current caller uses homogeneous string keys.
 fn php_sort_regular_key(a: &str, b: &str) -> std::cmp::Ordering {
     if let (Ok(na), Ok(nb)) = (a.parse::<i64>(), b.parse::<i64>())
diff --git a/crates/shirabe-php-shim/src/env.rs b/crates/shirabe-php-shim/src/env.rs
index 9043167b..d84a8ad9 100644
--- a/crates/shirabe-php-shim/src/env.rs
+++ b/crates/shirabe-php-shim/src/env.rs
@@ -14,7 +14,7 @@ pub fn getenv<K: AsRef<std::ffi::OsStr>>(key: K) -> Option<std::ffi::OsString> {
 /// thread is concurrently reading or writing the process environment for the
 /// duration of this call.
 pub unsafe fn putenv<K: AsRef<std::ffi::OsStr>, V: AsRef<std::ffi::OsStr>>(key: K, value: V) {
-    // TODO: validate key and value format to avoid panic?
+    // TODO(phase-c): validate key and value format to avoid panic?
     unsafe { std::env::set_var(key, value) }
 }
 
@@ -24,7 +24,7 @@ pub unsafe fn putenv<K: AsRef<std::ffi::OsStr>, V: AsRef<std::ffi::OsStr>>(key:
 /// thread is concurrently reading or writing the process environment for the
 /// duration of this call.
 pub unsafe fn putenv_clear<K: AsRef<std::ffi::OsStr>>(key: K) {
-    // TODO: validate key and value format to avoid panic?
+    // TODO(phase-c): validate key and value format to avoid panic?
     unsafe { std::env::remove_var(key) }
 }
 
diff --git a/crates/shirabe-php-shim/src/fs.rs b/crates/shirabe-php-shim/src/fs.rs
index efc9d2be..3cc2df36 100644
--- a/crates/shirabe-php-shim/src/fs.rs
+++ b/crates/shirabe-php-shim/src/fs.rs
@@ -765,7 +765,7 @@ pub fn chmod(_path: &str, _mode: u32) -> bool {
 pub fn fileperms(_path: &str) -> i64 {
     use std::os::unix::fs::MetadataExt;
     // PHP returns the full st_mode (file type bits included).
-    // TODO(phase-d): PHP returns false on error; this i64 signature reports 0 instead.
+    // TODO(phase-c): PHP returns false on error; this i64 signature reports 0 instead.
     std::fs::metadata(_path)
         .map(|m| m.mode() as i64)
         .unwrap_or(0)
@@ -852,7 +852,7 @@ pub fn file_put_contents(_path: &str, _data: &[u8]) -> Option<i64> {
 }
 
 pub fn file_put_contents3(_filename: &str, _data: &str, _flags: i64) -> Option<i64> {
-    // TODO(phase-d): the LOCK_EX and FILE_USE_INCLUDE_PATH flags are ignored; only FILE_APPEND is
+    // TODO(phase-c): the LOCK_EX and FILE_USE_INCLUDE_PATH flags are ignored; only FILE_APPEND is
     // honored.
     let append = _flags & FILE_APPEND != 0;
     let mut opts = std::fs::OpenOptions::new();
@@ -886,7 +886,7 @@ pub fn file_get_contents5(
     _offset: i64,
     _length: Option<i64>,
 ) -> Option<String> {
-    // TODO(phase-d): the stream $context and FILE_USE_INCLUDE_PATH are ignored; only $offset and
+    // TODO(phase-c): the stream $context and FILE_USE_INCLUDE_PATH are ignored; only $offset and
     // $length are applied (to the file read from the local filesystem).
     // PHP supports the file:// stream wrapper; strip it to read the local file.
     let path = _path.strip_prefix("file://").unwrap_or(_path);
@@ -1025,7 +1025,7 @@ pub fn sys_get_temp_dir() -> String {
 
 pub fn tempnam(_dir: &str, _prefix: &str) -> Option<String> {
     use std::os::unix::fs::PermissionsExt;
-    // TODO(phase-d): PHP falls back to the system temp dir when $dir is not writable; that fallback
+    // TODO(phase-c): PHP falls back to the system temp dir when $dir is not writable; that fallback
     // is not implemented here.
     for _ in 0..1000 {
         let name = format!("{}{:08x}", _prefix, fastrand::u32(..));
@@ -1048,7 +1048,7 @@ pub fn tempnam(_dir: &str, _prefix: &str) -> Option<String> {
 
 // A directory-handle resource. This is a distinct resource kind from the byte streams modeled by
 // PhpResource; readdir/closedir have no callers yet, so it only records the opened path.
-// TODO(phase-d): give it real readdir/closedir behavior (cursor over the entries) when needed.
+// TODO(phase-c): give it real readdir/closedir behavior (cursor over the entries) when needed.
 #[derive(Debug)]
 pub struct PhpDirHandle {
     pub path: std::path::PathBuf,
diff --git a/crates/shirabe-php-shim/src/lib.rs b/crates/shirabe-php-shim/src/lib.rs
index ab904a46..3012f578 100644
--- a/crates/shirabe-php-shim/src/lib.rs
+++ b/crates/shirabe-php-shim/src/lib.rs
@@ -69,7 +69,7 @@ pub enum PhpMixed {
     String(String),
     List(Vec<PhpMixed>),
     Array(IndexMap<String, PhpMixed>),
-    // TODO: consolidate Object to Array.
+    // TODO(phase-e): consolidate Object to Array.
     Object(IndexMap<String, PhpMixed>),
     // Resources, arbitrary objects and callables are intentionally excluded. Do not add these
     // things to this type.
@@ -425,7 +425,7 @@ pub enum StreamBacking {
     /// A real file on disk (also `/dev/null`); the OS tracks the position.
     File(std::fs::File),
     /// `php://memory` and `php://temp` — an in-memory growable buffer.
-    /// TODO(phase-d): `php://temp/maxmemory:N` spills to a temp file past N bytes;
+    /// TODO(phase-c): `php://temp/maxmemory:N` spills to a temp file past N bytes;
     /// the threshold is ignored here and everything stays in memory.
     Memory(std::io::Cursor<Vec<u8>>),
     /// A child process pipe created by `proc_open`. Half-duplex and not seekable.
diff --git a/crates/shirabe-php-shim/src/preg.rs b/crates/shirabe-php-shim/src/preg.rs
index 06ea7284..c2ec563b 100644
--- a/crates/shirabe-php-shim/src/preg.rs
+++ b/crates/shirabe-php-shim/src/preg.rs
@@ -597,7 +597,7 @@ pub fn php_regex_anchored(pattern: &str) -> bool {
 /// compiles to a per-call-site cached `&'static regex::Regex`, instead of going through the
 /// runtime `PATTERN_CACHE` lookup by string key. Expands to a `(&'static regex::Regex, bool)`
 /// tuple, ready to pass straight into any `preg_*` function.
-// TODO: `$php_pattern` is still translated from PHP delimiter/modifier syntax at runtime (on
+// TODO(phase-e): `$php_pattern` is still translated from PHP delimiter/modifier syntax at runtime (on
 // first use at each call site). Once call sites pass native `regex`-crate syntax directly, drop
 // this wrapper and call `regex_macro::regex!` directly.
 #[macro_export]
diff --git a/crates/shirabe-php-shim/src/process.rs b/crates/shirabe-php-shim/src/process.rs
index 770cea0c..1485adf7 100644
--- a/crates/shirabe-php-shim/src/process.rs
+++ b/crates/shirabe-php-shim/src/process.rs
@@ -63,7 +63,7 @@ pub fn system(command: &str, result_code: Option<&mut i64>) -> Option<String> {
         *code = result.status.code().unwrap_or(-1) as i64;
     }
     // PHP system() passes the command output straight through to the script's output.
-    // TODO(phase-d): PHP flushes line by line as the command runs; here the whole output is captured
+    // TODO(phase-c): PHP flushes line by line as the command runs; here the whole output is captured
     // and emitted once the command finishes, which changes interleaving/streaming timing.
     let _ = std::io::stdout().write_all(&result.stdout);
     let _ = std::io::stdout().flush();
diff --git a/crates/shirabe-php-shim/src/runtime.rs b/crates/shirabe-php-shim/src/runtime.rs
index 71bb4530..c529c263 100644
--- a/crates/shirabe-php-shim/src/runtime.rs
+++ b/crates/shirabe-php-shim/src/runtime.rs
@@ -44,7 +44,7 @@ pub const PHP_OS: &str = match std::env::consts::OS.as_bytes() {
 };
 
 pub fn constant(_name: &str) -> PhpMixed {
-    // TODO(phase-d): resolving a constant by name needs a runtime constant registry, which the shim
+    // TODO(php-runtime): resolving a constant by name needs a runtime constant registry, which the shim
     // does not provide (constants are ported as Rust `const`s, not looked up by string).
     todo!()
 }
@@ -186,7 +186,7 @@ pub fn ini_get(option: &str) -> Option<String> {
 
 pub fn get_loaded_extensions() -> Vec<String> {
     // Mirrors the set recognized by extension_loaded().
-    // TODO(phase-d): this models only the Composer-relevant subset, not PHP's full extension list
+    // TODO(php-runtime): this models only the Composer-relevant subset, not PHP's full extension list
     // (Core, standard, date, pcre, ...).
     [
         "Phar", "curl", "filter", "hash", "iconv", "intl", "mbstring", "openssl", "zip", "zlib",
@@ -200,7 +200,7 @@ pub fn phpversion(_extension: &str) -> Option<String> {
     if _extension.is_empty() {
         Some(PHP_VERSION.to_string())
     } else {
-        // TODO(phase-d): per-extension version strings are not modeled; PHP returns the extension's
+        // TODO(php-runtime): per-extension version strings are not modeled; PHP returns the extension's
         // own version, or false when the extension is not loaded.
         todo!()
     }
@@ -210,7 +210,7 @@ pub fn phpversion(_extension: &str) -> Option<String> {
 pub fn set_error_handler(_callback: fn(i64, &str, &str, i64) -> bool) {}
 
 pub fn debug_backtrace() -> Vec<IndexMap<String, PhpMixed>> {
-    // TODO(phase-d): capturing a PHP-style call stack requires runtime introspection of the
+    // TODO(php-runtime): capturing a PHP-style call stack requires runtime introspection of the
     // interpreter frames, which has no equivalent in the compiled shim.
     todo!()
 }
@@ -218,7 +218,7 @@ pub fn debug_backtrace() -> Vec<IndexMap<String, PhpMixed>> {
 /// Equivalent to PHP `include $file;`
 pub fn include_file(file: &str) -> PhpMixed {
     let _ = file;
-    // TODO(phase-d): `include` evaluates a PHP source file at runtime; there is no PHP interpreter.
+    // TODO(php-runtime): `include` evaluates a PHP source file at runtime; there is no PHP interpreter.
     todo!()
 }
 
@@ -228,7 +228,7 @@ pub fn spl_autoload_register(
     prepend: bool,
 ) -> bool {
     let _ = (callback, throw, prepend);
-    // TODO(phase-d): class autoloading has no analogue in compiled Rust (classes are not loaded by
+    // TODO(php-runtime): class autoloading has no analogue in compiled Rust (classes are not loaded by
     // name at runtime), so the callback is dropped. Returns success so callers that register an
     // autoloader during startup can proceed; this is not a faithful implementation.
     true
@@ -236,7 +236,7 @@ pub fn spl_autoload_register(
 
 pub fn spl_autoload_unregister(callback: Box<dyn Fn(&str) -> PhpMixed + Send + Sync>) -> bool {
     let _ = callback;
-    // TODO(phase-d): see spl_autoload_register; nothing is registered, so this is a no-op stub.
+    // TODO(php-runtime): see spl_autoload_register; nothing is registered, so this is a no-op stub.
     true
 }
 
@@ -268,7 +268,7 @@ pub fn version_compare(_v1: &str, _v2: &str, _op: &str) -> bool {
         ">=" | "ge" => c >= 0,
         "==" | "=" | "eq" => c == 0,
         "!=" | "<>" | "ne" => c != 0,
-        // TODO(phase-d): PHP returns null for an unknown operator; this bool signature reports false.
+        // TODO(phase-c): PHP returns null for an unknown operator; this bool signature reports false.
         _ => false,
     }
 }
@@ -284,7 +284,7 @@ pub fn restore_error_handler() {}
 pub fn spl_object_hash<T: ?Sized>(_object: &T) -> String {
     // PHP returns a unique 32-char hex id per object instance; the object's address serves as the
     // identity here.
-    // TODO(phase-d): as in PHP, an address can be reused after an object is freed, so uniqueness is
+    // TODO(phase-c): as in PHP, an address can be reused after an object is freed, so uniqueness is
     // not guaranteed across an object's whole lifetime without an object store.
     format!("{:032x}", _object as *const T as *const u8 as usize)
 }
@@ -320,13 +320,13 @@ pub fn php_uname(mode: &str) -> String {
 }
 
 pub fn trigger_error(_message: &str, _error_level: i64) {
-    // TODO(phase-d): emitting a PHP error obeys error_reporting and the installed error handler
+    // TODO(php-runtime): emitting a PHP error obeys error_reporting and the installed error handler
     // (both runtime state not modeled here); writing unconditionally to stderr would diverge.
     todo!()
 }
 
 pub fn trigger_deprecation(_package: &str, _version: &str, _message: &str, _arg: &str) {
-    // TODO(phase-d): symfony/deprecation-contracts triggers an E_USER_DEPRECATED via the error
+    // TODO(php-runtime): symfony/deprecation-contracts triggers an E_USER_DEPRECATED via the error
     // subsystem, which is not modeled (see trigger_error).
     todo!()
 }
@@ -337,34 +337,34 @@ pub fn usleep(_microseconds: u64) {
 
 /// Equivalent to PHP's __DIR__ magic constant
 pub fn php_dir() -> String {
-    // TODO(phase-d): __DIR__ is the directory of the source file at compile time; it must be supplied
+    // TODO(php-runtime): __DIR__ is the directory of the source file at compile time; it must be supplied
     // per call site (e.g. via a macro), not from a runtime shim function.
     todo!()
 }
 
 pub fn dir() -> String {
-    // TODO(phase-d): see php_dir; __DIR__ is a per-source-file compile-time value.
+    // TODO(php-runtime): see php_dir; __DIR__ is a per-source-file compile-time value.
     todo!()
 }
 
 /// Equivalent to PHP's `require <file>` returning the file's return value
 pub fn require_php_file(_filename: &str) -> PhpMixed {
-    // TODO(phase-d): `require` evaluates a PHP source file at runtime; there is no PHP interpreter.
+    // TODO(php-runtime): `require` evaluates a PHP source file at runtime; there is no PHP interpreter.
     todo!()
 }
 
 pub fn php_require(_file: &str) -> PhpMixed {
-    // TODO(phase-d): see require_php_file.
+    // TODO(php-runtime): see require_php_file.
     todo!()
 }
 
 pub fn memory_get_usage() -> i64 {
-    // TODO(phase-d): return PHP's actual emalloc-tracked memory usage instead of a stub 0.
+    // TODO(phase-c): return PHP's actual emalloc-tracked memory usage instead of a stub 0.
     0
 }
 
 pub fn memory_get_peak_usage(_real_usage: bool) -> i64 {
-    // TODO(phase-d): return PHP's actual emalloc-tracked peak memory usage instead of a stub 0.
+    // TODO(phase-c): return PHP's actual emalloc-tracked peak memory usage instead of a stub 0.
     0
 }
 
@@ -372,18 +372,18 @@ pub fn call_user_func<T>(_callback: &str, _args: &[PhpMixed]) -> T
 where
     T: From<PhpMixed>,
 {
-    // TODO(phase-d): invoking a function by name needs a runtime function registry; the shim has no
+    // TODO(php-runtime): invoking a function by name needs a runtime function registry; the shim has no
     // way to resolve a callable from a string.
     todo!()
 }
 
 pub fn call_user_func_array(_callback: &str, _args: &PhpMixed) -> PhpMixed {
-    // TODO(phase-d): see call_user_func.
+    // TODO(php-runtime): see call_user_func.
     todo!()
 }
 
 pub fn call_php_callable(_callback: &PhpMixed, _args: &[PhpMixed]) -> PhpMixed {
-    // TODO(phase-d): PhpMixed carries no callable variant; a runtime callable cannot be invoked.
+    // TODO(php-runtime): PhpMixed carries no callable variant; a runtime callable cannot be invoked.
     todo!()
 }
 
@@ -393,12 +393,12 @@ pub fn error_get_last() -> Option<IndexMap<String, PhpMixed>> {
 }
 
 pub fn globals_get(_name: &str) -> PhpMixed {
-    // TODO(phase-d): the PHP $GLOBALS superglobal is not modeled in the shim.
+    // TODO(php-runtime): the PHP $GLOBALS superglobal is not modeled in the shim.
     todo!()
 }
 
 pub fn globals_set(_name: &str, _value: PhpMixed) {
-    // TODO(phase-d): the PHP $GLOBALS superglobal is not modeled in the shim.
+    // TODO(php-runtime): the PHP $GLOBALS superglobal is not modeled in the shim.
     todo!()
 }
 
@@ -408,13 +408,13 @@ pub fn clone<T: Clone>(_value: T) -> T {
 }
 
 pub fn ini_set(_varname: &str, _value: &str) -> Option<String> {
-    // TODO(phase-d): ini_set must return the previous value and have its override observed by a
+    // TODO(php-runtime): ini_set must return the previous value and have its override observed by a
     // subsequent ini_get; ini_get is currently a static lookup, so overrides cannot be wired up yet.
     todo!()
 }
 
 pub fn composer_dev_warning_time() -> i64 {
-    // TODO(phase-d): COMPOSER_DEV_WARNING_TIME is a build-time constant baked into Composer's release
+    // TODO(phase-c): COMPOSER_DEV_WARNING_TIME is a build-time constant baked into Composer's release
     // artifact; it has no fixed value in source and must be provided by the build process.
     todo!()
 }
@@ -433,45 +433,45 @@ pub fn gc_enable() {
 }
 
 pub fn react_promise_resolve(_value: PhpMixed) -> PhpMixed {
-    // TODO(phase-d): depends on the react/promise port (shirabe_external_packages), which is not yet
+    // TODO(phase-c): depends on the react/promise port (shirabe_external_packages), which is not yet
     // available.
     todo!()
 }
 
 pub fn ioncube_loader_iversion() -> i64 {
-    // TODO(phase-d): the ionCube loader is not present (extension_loaded reports it absent), so this
+    // TODO(phase-c): the ionCube loader is not present (extension_loaded reports it absent), so this
     // function is never defined at runtime; left unimplemented.
     todo!()
 }
 
 pub fn ioncube_loader_version() -> String {
-    // TODO(phase-d): see ioncube_loader_iversion.
+    // TODO(phase-c): see ioncube_loader_iversion.
     todo!()
 }
 
 pub fn phpinfo(_what: i64) {
-    // TODO(phase-d): phpinfo() dumps the full PHP runtime configuration, which the shim does not
+    // TODO(php-runtime): phpinfo() dumps the full PHP runtime configuration, which the shim does not
     // model.
     todo!()
 }
 
 pub fn sapi_windows_vt100_support(_resource: &crate::PhpResource) -> bool {
-    // TODO(phase-d): Windows-only SAPI function; not defined on the non-Windows target this build
+    // TODO(phase-c): Windows-only SAPI function; not defined on the non-Windows target this build
     // models (function_exists reports it absent).
     todo!()
 }
 
 pub fn sapi_windows_cp_get(_kind: Option<&str>) -> i64 {
-    // TODO(phase-d): Windows-only SAPI function; see sapi_windows_vt100_support.
+    // TODO(phase-c): Windows-only SAPI function; see sapi_windows_vt100_support.
     todo!()
 }
 
 pub fn sapi_windows_cp_set(_codepage: i64) -> bool {
-    // TODO(phase-d): Windows-only SAPI function; see sapi_windows_vt100_support.
+    // TODO(phase-c): Windows-only SAPI function; see sapi_windows_vt100_support.
     todo!()
 }
 
 pub fn sapi_windows_cp_conv(_in_codepage: i64, _out_codepage: i64, _subject: &str) -> String {
-    // TODO(phase-d): Windows-only SAPI function; see sapi_windows_vt100_support.
+    // TODO(phase-c): Windows-only SAPI function; see sapi_windows_vt100_support.
     todo!()
 }
diff --git a/crates/shirabe-php-shim/src/stream.rs b/crates/shirabe-php-shim/src/stream.rs
index b977ce4b..e34849ed 100644
--- a/crates/shirabe-php-shim/src/stream.rs
+++ b/crates/shirabe-php-shim/src/stream.rs
@@ -14,7 +14,7 @@ pub fn stream_get_contents(stream: &PhpResource) -> Option<String> {
 }
 
 pub fn stream_resolve_include_path(filename: &str) -> Option<String> {
-    // TODO(phase-d): resolution searches the `include_path` ini setting, which the shim does not
+    // TODO(phase-c): resolution searches the `include_path` ini setting, which the shim does not
     // model; checking only the current directory would silently miss configured include paths.
     let _ = filename;
     todo!()
diff --git a/crates/shirabe-php-shim/src/string.rs b/crates/shirabe-php-shim/src/string.rs
index e0c84836..d793082d 100644
--- a/crates/shirabe-php-shim/src/string.rs
+++ b/crates/shirabe-php-shim/src/string.rs
@@ -35,7 +35,7 @@ pub fn substr_count(haystack: &str, needle: &str) -> i64 {
 }
 
 // Byte-based, matching PHP's substr_replace.
-// TODO(phase-d): PHP accepts negative $start/$length (counting from the end); this signature takes
+// TODO(phase-c): PHP accepts negative $start/$length (counting from the end); this signature takes
 // usize and therefore cannot express those cases.
 pub fn substr_replace(string: &str, replace: &str, start: usize, length: usize) -> String {
     let bytes = string.as_bytes();
@@ -833,7 +833,7 @@ fn php_to_float(v: &PhpMixed) -> f64 {
 }
 
 pub fn html_entity_decode(_s: &str) -> String {
-    // TODO(phase-d): only numeric entities and the most common named entities (the HTML 4.01 markup
+    // TODO(phase-c): only numeric entities and the most common named entities (the HTML 4.01 markup
     // set PHP enables by default) are decoded; the full named-entity table is not ported.
     let chars: Vec<char> = _s.chars().collect();
     let mut out = String::with_capacity(_s.len());
@@ -1031,7 +1031,7 @@ pub fn php_strip_whitespace(path: &str) -> String {
 
 pub fn hexdec(_s: &str) -> i64 {
     // PHP hexdec() ignores characters outside [0-9A-Fa-f].
-    // TODO(phase-d): PHP promotes the result to float on overflow; this i64 return wraps instead.
+    // TODO(phase-c): PHP promotes the result to float on overflow; this i64 return wraps instead.
     let mut acc: u64 = 0;
     for &b in _s.as_bytes() {
         let d = match b {
@@ -1134,7 +1134,7 @@ pub fn uniqid(_prefix: &str, _more_entropy: bool) -> String {
         now.subsec_micros()
     );
     if _more_entropy {
-        // TODO(phase-d): PHP uses its combined LCG; this uses `fastrand`, so the random suffix is
+        // TODO(phase-c): PHP uses its combined LCG; this uses `fastrand`, so the random suffix is
         // not reproducible against PHP (it is non-deterministic in PHP too).
         format!("{}.{:.8}", base, fastrand::f64() * 10.0)
     } else {
diff --git a/crates/shirabe-php-shim/src/var.rs b/crates/shirabe-php-shim/src/var.rs
index dd0592f8..f611462a 100644
--- a/crates/shirabe-php-shim/src/var.rs
+++ b/crates/shirabe-php-shim/src/var.rs
@@ -52,14 +52,14 @@ fn serialize_into(out: &mut String, value: &PhpMixed) {
             }
             out.push('}');
         }
-        // TODO(phase-d): object serialization needs the PHP class name and the property
+        // TODO(php-runtime): object serialization needs the PHP class name and the property
         // visibility name-mangling ("O:len:\"Class\":n:{...}"), which PhpMixed::Object does not
         // carry.
         PhpMixed::Object(_) => todo!(),
     }
 }
 
-// TODO(phase-d): PHP's serialize uses serialize_precision (-1 => shortest round-trip), which Rust's
+// TODO(phase-c): PHP's serialize uses serialize_precision (-1 => shortest round-trip), which Rust's
 // default float formatting also produces, but the two differ on scientific-notation spelling (PHP
 // "1.0E+20" vs Rust "1e20") for very large/small magnitudes.
 fn serialize_float(f: f64) -> String {
@@ -124,7 +124,7 @@ pub fn is_callable(value: &PhpMixed) -> bool {
     match value {
         // Scalars and null are never callable in PHP.
         PhpMixed::Null | PhpMixed::Bool(_) | PhpMixed::Int(_) | PhpMixed::Float(_) => false,
-        // TODO(phase-d): PHP is_callable() checks whether a string names an existing function, or an
+        // TODO(php-runtime): PHP is_callable() checks whether a string names an existing function, or an
         // array/object resolves to a method/__invoke. PhpMixed has no callable variant and the shim
         // has no function/method registry, so callability of these cannot be determined.
         _ => todo!(),
@@ -136,7 +136,7 @@ pub fn is_object(_value: &PhpMixed) -> bool {
 }
 
 pub fn is_a(_object_or_class: &PhpMixed, _class: &str, _allow_string: bool) -> bool {
-    // TODO(phase-d): requires runtime class information (the object's class and its ancestry), which
+    // TODO(php-runtime): requires runtime class information (the object's class and its ancestry), which
     // PhpMixed::Object does not carry.
     todo!()
 }
@@ -151,7 +151,7 @@ pub fn is_null(_value: &PhpMixed) -> bool {
 
 pub fn is_iterable(value: &PhpMixed) -> bool {
     // PHP is_iterable() is true for arrays and Traversable objects.
-    // TODO(phase-d): PhpMixed::Object cannot report whether it implements Traversable, so an
+    // TODO(php-runtime): PhpMixed::Object cannot report whether it implements Traversable, so an
     // iterable object is conservatively treated as non-iterable here.
     matches!(value, PhpMixed::List(_) | PhpMixed::Array(_))
 }
@@ -188,7 +188,7 @@ pub fn is_numeric_to_int(value: &PhpMixed) -> i64 {
 /// Approximates PHP's `<=>` for two strings: if both are numeric strings, compare numerically
 /// (as PHP does), otherwise fall back to a byte-wise comparison.
 ///
-/// TODO: this only covers the string/string case of PHP's loose comparison. PHP's `<=>` has many
+/// TODO(phase-c): this only covers the string/string case of PHP's loose comparison. PHP's `<=>` has many
 /// more special-cased rules across other operand type combinations (bool, array, null, object,
 /// numeric-string-vs-non-numeric-string, ...). Extend this if a new caller needs those.
 pub fn loosely_compare(a: &str, b: &str) -> std::cmp::Ordering {
@@ -207,24 +207,24 @@ pub fn loosely_compare(a: &str, b: &str) -> std::cmp::Ordering {
 }
 
 pub fn instance_of<T>(_value: &PhpMixed) -> bool {
-    // TODO(phase-d): PHP `instanceof` needs the runtime class of the value, which PhpMixed::Object
+    // TODO(php-runtime): PHP `instanceof` needs the runtime class of the value, which PhpMixed::Object
     // does not carry.
     todo!()
 }
 
 pub fn is_subclass_of(_object_or_class: &PhpMixed, _class_name: &str, _allow_string: bool) -> bool {
-    // TODO(phase-d): requires runtime class ancestry, which PhpMixed::Object does not carry.
+    // TODO(php-runtime): requires runtime class ancestry, which PhpMixed::Object does not carry.
     todo!()
 }
 
 pub fn get_class(_object: &PhpMixed) -> String {
-    // TODO(phase-d): PhpMixed::Object carries no class name; there is no runtime class to report.
+    // TODO(php-runtime): PhpMixed::Object carries no class name; there is no runtime class to report.
     todo!()
 }
 
 // Overload accepting an `anyhow::Error` (PHP's `get_class($e)` is commonly used on exceptions).
 pub fn get_class_err(_e: &anyhow::Error) -> String {
-    // TODO(phase-d): PHP returns the exception's class name. anyhow::Error carries the concrete
+    // TODO(phase-c): PHP returns the exception's class name. anyhow::Error carries the concrete
     // exception type, but mapping each ported exception struct to its PHP class name is not yet
     // wired up (cf. php_exception_get_code which downcasts case by case).
     todo!()
@@ -234,7 +234,7 @@ pub fn get_class_err(_e: &anyhow::Error) -> String {
 /// class name; in Rust we don't have a runtime class name, so this stub is left
 /// as `todo!()`.
 pub fn get_class_obj<T: ?Sized>(_object: &T) -> String {
-    // TODO(phase-d): PHP returns the object's class name; Rust has no runtime class name for an
+    // TODO(php-runtime): PHP returns the object's class name; Rust has no runtime class name for an
     // arbitrary `T` (the static type path is not the PHP class name).
     todo!()
 }
@@ -247,7 +247,7 @@ pub fn get_debug_type(value: &PhpMixed) -> String {
         PhpMixed::Float(_) => "float".to_string(),
         PhpMixed::String(_) => "string".to_string(),
         PhpMixed::List(_) | PhpMixed::Array(_) => "array".to_string(),
-        // TODO(phase-d): PHP returns the object's class name; PhpMixed::Object carries none.
+        // TODO(php-runtime): PHP returns the object's class name; PhpMixed::Object carries none.
         PhpMixed::Object(_) => todo!(),
     }
 }
@@ -259,7 +259,7 @@ pub fn get_debug_type_obj<T>(_value: &T) -> String {
 }
 
 pub fn instantiate_class(_class: &str, _args: Vec<PhpMixed>) -> PhpMixed {
-    // TODO(phase-d): instantiating a class by name needs a runtime class registry (reflection),
+    // TODO(php-runtime): instantiating a class by name needs a runtime class registry (reflection),
     // which the shim does not provide.
     todo!()
 }
@@ -274,7 +274,7 @@ pub fn php_to_string(value: &PhpMixed) -> String {
         PhpMixed::String(s) => s.clone(),
         // PHP renders any array as the literal string "Array".
         PhpMixed::List(_) | PhpMixed::Array(_) => "Array".to_string(),
-        // TODO(phase-d): PHP casts an object to string via its __toString() method; PhpMixed::Object
+        // TODO(php-runtime): PHP casts an object to string via its __toString() method; PhpMixed::Object
         // carries no class/method information to dispatch to.
         PhpMixed::Object(_) => todo!(),
     }
@@ -447,7 +447,7 @@ fn var_export_into(out: &mut String, value: &PhpMixed, level: usize) {
             var_export_indent(out, level);
             out.push(')');
         }
-        // TODO(phase-d): PHP renders objects as "\Class::__set_state(array(...))"; PhpMixed::Object
+        // TODO(php-runtime): PHP renders objects as "\Class::__set_state(array(...))"; PhpMixed::Object
         // carries no class name.
         PhpMixed::Object(_) => todo!(),
     }
diff --git a/crates/shirabe-php-shim/src/zip.rs b/crates/shirabe-php-shim/src/zip.rs
index 93b65fd5..83dd70ce 100644
--- a/crates/shirabe-php-shim/src/zip.rs
+++ b/crates/shirabe-php-shim/src/zip.rs
@@ -248,7 +248,7 @@ impl ZipArchive {
     }
 
     pub fn set_external_attributes_name(&self, _name: &str, _opsys: i64, _attr: i64) -> bool {
-        // TODO(phase-d): PHP's setExternalAttributesName mutates an already-added
+        // TODO(phase-c): PHP's setExternalAttributesName mutates an already-added
         // entry's external attributes (e.g. Unix permissions) after addFile. The
         // `zip` crate fixes external attributes at start_file time via FileOptions
         // and exposes no API to amend a written entry, so this cannot be faithfully
diff --git a/crates/shirabe-php-src/src/standard/string.rs b/crates/shirabe-php-src/src/standard/string.rs
index 5af60f5f..5f723f05 100644
--- a/crates/shirabe-php-src/src/standard/string.rs
+++ b/crates/shirabe-php-src/src/standard/string.rs
@@ -153,7 +153,7 @@ fn hex_digit_value(b: u8) -> Option<u8> {
 ///
 /// The allowed-tags parameter is omitted from this signature.
 /// State: 0 = text, 1 = inside a tag, 2 = inside an HTML comment, 3 = inside `<? ... ?>` / `<!`.
-/// TODO(phase-d): this omits allowed-tags handling and the tag-depth counter, so it can diverge
+/// TODO(phase-c): this omits allowed-tags handling and the tag-depth counter, so it can diverge
 /// from PHP on malformed markup (unterminated comments/quotes, nested `<`).
 pub fn strip_tags(_str: &str) -> String {
     let bytes = _str.as_bytes();
diff --git a/crates/shirabe/src/composer.rs b/crates/shirabe/src/composer.rs
index a0a8f248..356aefc1 100644
--- a/crates/shirabe/src/composer.rs
+++ b/crates/shirabe/src/composer.rs
@@ -14,7 +14,7 @@ use crate::util::r#loop::Loop;
 use shirabe_external_packages::composer::pcre::Preg;
 use shirabe_php_shim::php_regex;
 
-// TODO: change this information to Shirabe version.
+// TODO(phase-c): change this information to Shirabe version.
 pub const VERSION: &str = "2.9.7";
 pub const BRANCH_ALIAS_VERSION: &str = "";
 pub const RELEASE_DATE: &str = "2026-04-14 13:31:52";
diff --git a/crates/shirabe/src/console/application.rs b/crates/shirabe/src/console/application.rs
index 8b1cbe60..56718164 100644
--- a/crates/shirabe/src/console/application.rs
+++ b/crates/shirabe/src/console/application.rs
@@ -164,7 +164,7 @@ impl Application {
         let io: std::rc::Rc<std::cell::RefCell<dyn IOInterface>> =
             std::rc::Rc::new(std::cell::RefCell::new(NullIO::new()));
 
-        // TODO(phase-d): Composer registers shutdown function that reports special message for
+        // TODO(php-runtime): Composer registers shutdown function that reports special message for
         // OOM. In Shirabe, limit of memory allocation has effect only on PHP side so that the
         // corresponding shutdown function should be registered in PHP runtime, not here.
         // if (!$shutdownRegistered) { ... }
@@ -1264,7 +1264,7 @@ impl Application {
             // PHP rewrites `@anonymous\0` markers via class_exists/get_parent_class/class_implements.
             // Rust error messages never carry PHP's anonymous-class marker and those reflection
             // primitives have no Rust equivalent, so the branch is unreachable here.
-            // TODO(review): port the @anonymous rewrite if it ever becomes relevant.
+            // TODO(phase-c): port the @anonymous rewrite if it ever becomes relevant.
 
             let width = if self.terminal.get_width() != 0 {
                 self.terminal.get_width() - 1
@@ -1290,7 +1290,7 @@ impl Application {
             if !throwable_is_exception_interface(e)
                 || output_interface::VERBOSITY_VERBOSE <= verbosity
             {
-                // TODO(review): anyhow::Error carries no PHP file/line, so getFile()/getLine() take
+                // TODO(phase-c): anyhow::Error carries no PHP file/line, so getFile()/getLine() take
                 // the 'n/a' fallback PHP itself uses when they are unavailable. The real source
                 // location cannot be reproduced (it would be a Rust path, not Composer's PHP path).
                 messages.push(format!(
@@ -2520,7 +2520,7 @@ impl ApplicationHandle {
                     if e.downcast_ref::<TransportException>().is_some() {
                         // PHP: ReflectionProperty $reflProp = new \ReflectionProperty($e, 'code');
                         //      $reflProp->setValue($e, Installer::ERROR_TRANSPORT_EXCEPTION);
-                        // TODO: reflection-based mutation of the existing exception is not portable;
+                        // TODO(phase-c): reflection-based mutation of the existing exception is not portable;
                         // we surface the rewritten code via a fresh TransportException at the call site.
                         let _ = Installer::ERROR_TRANSPORT_EXCEPTION;
                     }
@@ -2590,7 +2590,7 @@ impl ApplicationHandle {
             Some(output) => output,
         };
 
-        // TODO: PHP installs a temporary `set_exception_handler($renderException)` and cooperates
+        // TODO(php-runtime): PHP installs a temporary `set_exception_handler($renderException)` and cooperates
         // with Symfony's ErrorHandler to keep/restore it. PHP's process-global exception handler
         // stack has no Rust equivalent; the rendering itself is invoked directly in the catch
         // branch below. Review needed for the handler save/restore dance.
@@ -2636,7 +2636,7 @@ impl ApplicationHandle {
 
                 // $exitCode = $e->getCode();
                 // is_numeric($exitCode) ? max(1, (int) $exitCode) : 1
-                // TODO(review): anyhow::Error has no PHP-style getCode(); the exit code derived
+                // TODO(phase-c): anyhow::Error has no PHP-style getCode(); the exit code derived
                 // from the exception's `code` field needs the downcast strategy decided.
                 let exit_code = shirabe_php_shim::php_exception_get_code(&e);
                 if shirabe_php_shim::is_numeric_string(&exit_code.to_string()) {
@@ -2846,7 +2846,7 @@ impl ApplicationHandle {
 
         if !application.borrow().signals_to_dispatch_event.is_empty() {
             // $commandSignals = $command instanceof SignalableCommandInterface ? $command->getSubscribedSignals() : []
-            // TODO(review): SymfonyCommand is not a SignalableCommandInterface here; downcast needed.
+            // TODO(phase-c): SymfonyCommand is not a SignalableCommandInterface here; downcast needed.
             let command_signals: Vec<i64> = Vec::new();
             let _ = std::marker::PhantomData::<dyn SignalableCommandInterface>;
 
@@ -2860,7 +2860,7 @@ impl ApplicationHandle {
                 }
 
                 if Terminal::has_stty_available() {
-                    // TODO: registers SIGINT/SIGTERM handlers that restore the stty mode via
+                    // TODO(phase-c): registers SIGINT/SIGTERM handlers that restore the stty mode via
                     // shell_exec('stty ...'). pcntl signal handlers have no faithful Rust
                     // equivalent in Phase A.
                     let _stty_mode = shirabe_php_shim::shell_exec("stty -g");
@@ -3005,7 +3005,7 @@ fn throwable_get_code(e: &(dyn std::error::Error + 'static)) -> i64 {
 /// PHP's `get_debug_type($e)` for the title line, reached only when the message is empty or output
 /// is verbose. PHP returns the exception's fully-qualified class name; Rust has no runtime FQCN, so
 /// this maps the enumerable exception types to their PHP class names and falls back to `Exception`.
-/// TODO(review): the fully-qualified name (e.g. `Composer\...`) cannot be reproduced faithfully.
+/// TODO(phase-c): the fully-qualified name (e.g. `Composer\...`) cannot be reproduced faithfully.
 fn throwable_debug_type(e: &(dyn std::error::Error + 'static)) -> String {
     let name = if e
         .downcast_ref::<shirabe_php_shim::RuntimeException>()
diff --git a/crates/shirabe/src/installer/installation_manager.rs b/crates/shirabe/src/installer/installation_manager.rs
index 3a04a8e9..cf75469c 100644
--- a/crates/shirabe/src/installer/installation_manager.rs
+++ b/crates/shirabe/src/installer/installation_manager.rs
@@ -308,9 +308,9 @@ impl InstallationManager {
                 SignalHandler::SIGTERM.to_string(),
                 SignalHandler::SIGHUP.to_string(),
             ],
-            // TODO(phase-b): closure captures &mut self via &mut cleanup_promises
+            // TODO(phase-c): closure captures &mut self via &mut cleanup_promises
             Box::new(move |signal: String, handler: &SignalHandler| {
-                // TODO(phase-b): self.io.write_error(...); self.run_cleanup(&cleanup_promises);
+                // TODO(phase-c): self.io.write_error(...); self.run_cleanup(&cleanup_promises);
                 let _ = signal;
                 handler.exit_with_last_signal();
             }),
@@ -802,7 +802,7 @@ impl InstallationManager {
             return;
         }
 
-        // TODO(phase-c-promise): PHP collects every http_downloader.add() promise and runs them via
+        // TODO(phase-c): PHP collects every http_downloader.add() promise and runs them via
         // Loop::wait; the single-threaded sync bridge block_on's each notification serially instead.
         let result: anyhow::Result<()> = (|| -> anyhow::Result<()> {
             for (repo_url, packages) in self.notifiable_packages.borrow().iter() {
@@ -929,7 +929,7 @@ impl InstallationManager {
 
     /// PHP: waitOnPromises() creates a ProgressBar up front and Loop::wait advances it while the
     /// concurrent promises resolve.
-    /// TODO(phase-c-promise): Loop::wait has no active-job counter to feed the bar yet, so a
+    /// TODO(phase-c): Loop::wait has no active-job counter to feed the bar yet, so a
     /// single 0% -> 100% jump is rendered after the wait instead of PHP's timing-driven
     /// intermediate snapshots.
     async fn wait_on_promises<'p>(
diff --git a/crates/shirabe/src/json/json_file.rs b/crates/shirabe/src/json/json_file.rs
index dbcd7a19..cba11f01 100644
--- a/crates/shirabe/src/json/json_file.rs
+++ b/crates/shirabe/src/json/json_file.rs
@@ -534,7 +534,7 @@ impl JsonFile {
     /// @throws ParsingException
     /// @return bool                      true on success
     pub(crate) fn validate_syntax(json: &str, file: Option<&str>) -> anyhow::Result<bool> {
-        // TODO(phase-d): make json_decode() returns an error object with details.
+        // TODO(phase-c): make json_decode() returns an error object with details.
         let error = match serde_json::from_str::<serde_json::Value>(json) {
             Ok(_) => {
                 // TODO(phase-c): Rust's &str is guaranteed as UTF-8, but PHP string is not. Change `json`
diff --git a/crates/shirabe/src/repository/composer_repository.rs b/crates/shirabe/src/repository/composer_repository.rs
index ba68d22c..015a278e 100644
--- a/crates/shirabe/src/repository/composer_repository.rs
+++ b/crates/shirabe/src/repository/composer_repository.rs
@@ -982,7 +982,7 @@ impl ComposerRepository {
             // then does a single `$this->loop->wait($promises)`; mirror that here by polling all
             // downloads concurrently via FuturesOrdered (submission order preserved) before doing
             // any of the per-name response processing below.
-            // TODO(phase-c-promise): the fan-out below is structurally concurrent, but each
+            // TODO(phase-c): the fan-out below is structurally concurrent, but each
             // `start_cached_async_download` future still resolves through `HttpDownloader::add`'s
             // `curl_runtime()`/`sync_executor::block_on` bridge, so real I/O overlap does not happen
             // yet (see util/loop.rs::wait). That only changes once a single top-level Runtime
@@ -1770,7 +1770,7 @@ impl ComposerRepository {
         // does a single `$this->loop->wait($promises)`; mirror that here by polling all downloads
         // concurrently via FuturesOrdered (submission order preserved) before doing any of the
         // per-name response processing below.
-        // TODO(phase-c-promise): the fan-out below is structurally concurrent, but each
+        // TODO(phase-c): the fan-out below is structurally concurrent, but each
         // `start_cached_async_download` future still resolves through `HttpDownloader::add`'s
         // `curl_runtime()`/`sync_executor::block_on` bridge, so real I/O overlap does not happen yet
         // (see util/loop.rs::wait). That only changes once a single top-level Runtime replaces those
diff --git a/crates/shirabe/src/util/auth_helper.rs b/crates/shirabe/src/util/auth_helper.rs
index 8a621eb1..2131a107 100644
--- a/crates/shirabe/src/util/auth_helper.rs
+++ b/crates/shirabe/src/util/auth_helper.rs
@@ -496,7 +496,6 @@ impl AuthHelper {
                     username,
                 )));
             } else if password == "custom-headers" {
-                // TODO:
                 // Handle custom HTTP headers from auth.json
                 #[allow(unused_assignments)]
                 let mut custom_headers: PhpMixed = PhpMixed::Null;
diff --git a/crates/shirabe/src/util/http/curl_downloader.rs b/crates/shirabe/src/util/http/curl_downloader.rs
index 3b65b0f6..89e9661e 100644
--- a/crates/shirabe/src/util/http/curl_downloader.rs
+++ b/crates/shirabe/src/util/http/curl_downloader.rs
@@ -76,9 +76,9 @@ impl CurlDownloader {
         //   - cookie_store(true)        ~ CURL_LOCK_DATA_COOKIE
         //   - redirect(none)            ~ CURLOPT_FOLLOWLOCATION = false (we follow manually)
         // The libcurl version-specific multiplexing / accept-encoding workarounds are not needed.
-        // TODO: a brand-new reqwest client is created per CurlDownloader; that is acceptable here
+        // TODO(phase-e): a brand-new reqwest client is created per CurlDownloader; that is acceptable here
         // (one HttpDownloader owns one CurlDownloader) but not pooled across them.
-        // TODO: cookie sharing (CURL_LOCK_DATA_COOKIE) would need reqwest's `cookies` feature
+        // TODO(phase-c): cookie sharing (CURL_LOCK_DATA_COOKIE) would need reqwest's `cookies` feature
         // (.cookie_store(true)); omitted as it is not required for package downloads.
         let client = reqwest::Client::builder()
             .pool_max_idle_per_host(8)
@@ -507,10 +507,10 @@ impl CurlDownloader {
             .and_then(|v| v.as_int())
             .map(|n| n as u64);
 
-        // TODO: per-request ssl (cafile/verify_peer/local_cert) and proxy settings are reqwest
+        // TODO(phase-c): per-request ssl (cafile/verify_peer/local_cert) and proxy settings are reqwest
         // Client-level, not request-level. They are not applied here yet; a ConnectionOptions-keyed
         // Client cache (as in the design sketch) is required to honor them.
-        // TODO: CURLOPT_IPRESOLVE (force IPv4/IPv6) has no direct reqwest API.
+        // TODO(phase-c): CURLOPT_IPRESOLVE (force IPv4/IPv6) has no direct reqwest API.
         let _ = attributes;
 
         let reqwest_method =
diff --git a/crates/shirabe/src/util/loop.rs b/crates/shirabe/src/util/loop.rs
index c2fa3b08..f94788ac 100644
--- a/crates/shirabe/src/util/loop.rs
+++ b/crates/shirabe/src/util/loop.rs
@@ -49,7 +49,7 @@ impl Loop {
         let mut pending: FuturesUnordered<_> = promises.into_iter().collect();
         let mut uncaught: Option<anyhow::Error> = None;
 
-        // TODO(phase-c-promise): promises are now polled concurrently via FuturesUnordered, but
+        // TODO(phase-c): promises are now polled concurrently via FuturesUnordered, but
         // each individual future (HttpDownloader::add/add_copy etc.) still resolves through a
         // blocking bridge (curl_runtime()/sync_executor::block_on), so real I/O overlap does not
         // happen yet — the bridged future fully blocks the thread until it settles before the next
@@ -67,7 +67,7 @@ impl Loop {
     }
 
     pub fn abort_jobs(&self) {
-        // TODO(phase-c-promise): no-op until a cancellation mechanism is introduced. PHP cancels
+        // TODO(phase-c): no-op until a cancellation mechanism is introduced. PHP cancels
         // every in-flight promise group it tracks in $currentPromises; reintroduce that tracking
         // once the asynchronous workers support cancellation on a multi-thread runtime.
     }