todo: one file per item, grouped by theme, with a generated index

TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly
on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with
frontmatter carrying id, status, created date and order, and the prose body copied
across verbatim. TODO.md becomes a generated index (bun run todo:index).

Dates: where an item's prose stated one it is used; otherwise its old section's;
otherwise 2026-08-20, floored at the day before the split rather than invented.
date_source records which.

Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is
the identity, frontmatter is the machine's half and the body is the owner's.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

todo/multi-user/assertpermissiontotality-checks-the-wrong.md

@@ -0,0 +1,19 @@
+---
+id: multi-user/assertpermissiontotality-checks-the-wrong
+title: "`assertPermissionTotality` checks the wrong list, and `registry.test.ts` has been red since 2026-08-13"
+theme: multi-user
+status: open
+created: 2026-08-13
+date_source: stated
+order: 12
+---
+
+**`assertPermissionTotality` checks the wrong list, and `registry.test.ts` has been red since
+2026-08-13.** It is fed `Object.keys(handlers)` from `server.tsx`, but Bun serves the _route table_.
+Those diverged when the cliamp/desktop/vault plugins were switched off: `/api/cliamp/ws` and
+`/api/cliamp/audio/ws` are still live routes with their handlers and registry claims commented out.
+Not exploitable — `isWsProviderAllowed` finds no permission and 403s a member; the owner upgrades onto
+a dead socket. But the boot check that exists to stop exactly this cannot see it. Two fixes: point
+totality at the route table, and either delete the dead routes or restore their claims. The 8 failing
+tests in `registry.test.ts` are the same drift — `REAL_WS` still lists all nine providers as served,
+which is why nobody noticed. Found 2026-08-14.