todo: one file per item, grouped by theme, with a generated index

TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly
on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with
frontmatter carrying id, status, created date and order, and the prose body copied
across verbatim. TODO.md becomes a generated index (bun run todo:index).

Dates: where an item's prose stated one it is used; otherwise its old section's;
otherwise 2026-08-20, floored at the day before the split rather than invented.
date_source records which.

Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is
the identity, frontmatter is the machine's half and the body is the owner's.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

todo/fleet/_index.md

@@ -0,0 +1,8 @@
+---
+theme: fleet
+heading: "Fleet — one command across every server"
+kind: theme
+---
+
+**The list exists: `docs/servers.md`**, written 2026-08-21 and verified from this host. Five machines
+hold a platform checkout, three run it, and it records how to reach each one.

todo/fleet/a-way-to-mark-a-commit-this-one-ships-so-a.md

@@ -0,0 +1,31 @@
+---
+id: fleet/a-way-to-mark-a-commit-this-one-ships-so-a
+title: "A way to mark a commit \"this one ships\", so a release is not just `master`'s tip"
+theme: fleet
+status: open
+created: 2026-08-21
+date_source: stated
+order: 2
+---
+
+**A way to mark a commit "this one ships", so a release is not just `master`'s tip.** Wanted
+2026-08-21. **No version numbers** — not now — and **not a tag**: the owner does not want a second
+ref to mint and push for something the commit itself could carry. So a **codeword in the commit
+message**, and the fleet updater pulls to the newest commit carrying it rather than to whatever
+`master` points at.
+
+That distinction is the whole value: today a server updates to the tip, so an in-progress commit
+ships the moment it is pushed. A marker makes shipping a deliberate act while leaving the push
+unchanged.
+
+Shape to settle when it is built:
+
+- **A trailer, not a word in prose** — `Release: yes` on its own line, in the same family as
+  `Co-Authored-By`. `git log --grep='^Release:' --format=%H -1` then gives the target SHA in one
+  command, and no commit message that merely *talks* about a release matches by accident.
+- **The trade against a tag, stated honestly:** a tag can be moved or deleted when a release turns
+  out to be bad; a commit message cannot be edited once pushed. Un-marking means marking a newer
+  commit — which is a forward-only, revert-shaped workflow. That is a fine answer, but it should
+  be a chosen one.
+- The updater then does a checkout at that SHA, not a `pull` — same discipline the plugin-pinning
+  item asks for: **verify `rev-parse HEAD` matches, or refuse.**

todo/fleet/an-orchestrator-that-acts-on-every-server-at.md

@@ -0,0 +1,25 @@
+---
+id: fleet/an-orchestrator-that-acts-on-every-server-at
+title: "An orchestrator that acts on every server at once"
+theme: fleet
+status: open
+created: 2026-08-20
+date_source: assumed
+order: 1
+---
+
+**An orchestrator that acts on every server at once** — pull and update every platform, restart a
+process everywhere, report which host is behind. The list is the input; this is the thing that
+reads it.
+
+Three facts from writing the list decide the design, and all three are verified: the checkout
+**path differs per host** (take it from PM2's `pm_cwd` for the `officer` process, never a
+hard-coded path); `alpha` carries a **second, stale checkout** so pulling the wrong one succeeds
+while changing nothing; and the **git remotes differ** — one host pulls over HTTPS and one points
+at a different Gitea altogether. An orchestrator built on "ssh, cd to the same path, git pull"
+is wrong on three counts before it starts.
+
+Open: whether this is a script over SSH, an Officer screen, or a chat capability; and whether
+`headscale` and `omega` — checkout present, nothing running — are targets at all. Note the
+platform already has an **Update button** for a single server (`03abdeb2`); this is that, fanned
+out, and it should probably share the code rather than reimplement the pull.