todo: one file per item, grouped by theme, with a generated index

TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly
on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with
frontmatter carrying id, status, created date and order, and the prose body copied
across verbatim. TODO.md becomes a generated index (bun run todo:index).

Dates: where an item's prose stated one it is used; otherwise its old section's;
otherwise 2026-08-20, floored at the day before the split rather than invented.
date_source records which.

Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is
the identity, frontmatter is the machine's half and the body is the owner's.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

todo/multi-user/markinterruptedjobs-and-getoldestpendingjob.md

@@ -0,0 +1,14 @@
+---
+id: multi-user/markinterruptedjobs-and-getoldestpendingjob
+title: "`markInterruptedJobs()` and `getOldestPendingJob()` are platform-wide"
+theme: multi-user
+status: open
+created: 2026-08-20
+date_source: assumed
+order: 18
+---
+
+**`markInterruptedJobs()` and `getOldestPendingJob()` are platform-wide.** The pipeline queue is a
+single global lane; ownership is enforced one layer up, in `pipeline-jobs-routes.ts`, by an
+explicit `job.userId !== user.id → 404` on every by-id route. Correct today, but the queue itself
+has no notion of whose work it is running.