todo: one file per item, grouped by theme, with a generated index

TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly
on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with
frontmatter carrying id, status, created date and order, and the prose body copied
across verbatim. TODO.md becomes a generated index (bun run todo:index).

Dates: where an item's prose stated one it is used; otherwise its old section's;
otherwise 2026-08-20, floored at the day before the split rather than invented.
date_source records which.

Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is
the identity, frontmatter is the machine's half and the body is the owner's.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

todo/infra/revisit-the-frozen-lockfile-rule-in-claude-md.md

@@ -0,0 +1,26 @@
+---
+id: infra/revisit-the-frozen-lockfile-rule-in-claude-md
+title: "Revisit the frozen-lockfile rule in `CLAUDE.md`, now that plugins resolve at install time"
+theme: infra
+status: open
+created: 2026-08-20
+date_source: stated
+order: 5
+---
+
+**Revisit the frozen-lockfile rule in `CLAUDE.md`, now that plugins resolve at install time.**
+Raised by the owner 2026-08-20, to be discussed rather than decided alone.
+
+The rule as written is absolute: `bunfig.toml` sets `frozenLockfile = true`, `bun install` resolves
+from `bun.lock` and nothing else, and an unexplained lockfile change in a diff is the signal the
+whole arrangement exists to produce. The reasoning is the 2026-08-04 compromise, and it is good.
+
+`npmDependencies` does not follow it. Plugin packages are declared as RANGES and installed with a
+plain `bun install` into `plugins/node_modules/`, so they resolve per machine and per install. That
+was chosen deliberately — ranges are what let two plugins share one copy of `sharp` — but it means
+the codebase now holds two different postures on the same risk, and only one of them is written down.
+
+Worth settling: whether the rule should say "the platform's own dependencies" rather than reading as
+universal; whether the merged `plugins/bun.lock` should be committed after all (it would pin the
+tree, at the cost of a per-machine file in git); and whether `bun install --frozen-lockfile` in
+`plugins/` is achievable once that lockfile exists.