comment-identitylisted

# comment-identity — named identity for an uncredentialed direct REST write On a direct REST path with no selected identity and no supplied per-doc token, an agent otherwise creates or writes as anonymous. This primitive upgrades that specific fallback by one rung: before the first such write, it acquires ONE **Ephemeral** handle (`@owner.e-xxxx` — session-scoped, 30-day-idle TTL, can never become a botlet) and reuses it for later direct REST writes in the session. It is **lazy** (nothing is minted until the first qualifying direct REST write — read-only and tool/browser sessions stay unchanged) and **idempotent per session** (every later call reuses the same handle). One canonical helper does the work: `ensure-session-identity` (next to this file). ## When to run it Call it **right before the session's first direct REST write only when both are true**: no supplied per-doc token authorizes the comm, and the human did not select a registered identity for this session. The common case is an uncredentialed direct `POST /docs`; it may also apply to a direct comment or PATCH after that Ephemeral handle has been invited to the comm. Never run it for a Comment.io tool or MCP call, browser action, URL fetch/open, or read. Tools/connectors and authenticated browsers carry their own identity; the URL-fetch-only route is read-only. With a supplied per-doc token, keep that token and identify it only when its personalized quickstart/API response asks for `display_name` or `POST /agen