todo: one file per item, grouped by theme, with a generated index

TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly
on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with
frontmatter carrying id, status, created date and order, and the prose body copied
across verbatim. TODO.md becomes a generated index (bun run todo:index).

Dates: where an item's prose stated one it is used; otherwise its old section's;
otherwise 2026-08-20, floored at the day before the split rather than invented.
date_source records which.

Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is
the identity, frontmatter is the machine's half and the body is the owner's.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

todo/waiting-on-owner/_index.md

@@ -0,0 +1,5 @@
+---
+theme: waiting-on-owner
+heading: "Waiting on the owner to run it"
+kind: theme
+---

todo/waiting-on-owner/plan-mode-is-live-and-has-never-been-exercised.md

@@ -0,0 +1,26 @@
+---
+id: waiting-on-owner/plan-mode-is-live-and-has-never-been-exercised
+title: "Plan mode is live and has never been exercised"
+theme: waiting-on-owner
+status: open
+created: 2026-08-17
+date_source: stated
+order: 2
+---
+
+**Plan mode is live and has never been exercised.** Landed `1b811dfa` on 2026-08-17; all three
+processes were restarted the same evening, so the code IS running. Not one part of it has been used:
+not the toggle, not the plan card, not the round trip from the sidecar's pending promise to a browser
+and back, not the stored column, not `settleAllPlans`.
+
+**`docs/chat-plan-mode-test-plan.md` is the checklist** — eleven ordered tests, what each should show,
+and what its failure looks like. Test 4 (approve) is the one most likely to be wrong: it is the case
+that changed the design, because approving `ExitPlanMode` drops the harness into `default` rather than
+back into `bypassPermissions`.
+
+Safe to leave untested. Plan mode is opt-in and off by default, so a conversation that never touches
+the toggle behaves exactly as it did before. The one failure worth knowing in advance is a turn that
+never ends after a plan is answered — that would be a leaked `canUseTool` promise, and
+`pm2 restart officer-claude-code` clears it.
+
+Design and the probe results behind it: `docs/chat-plan-mode.md`.

todo/waiting-on-owner/the-ai-usage-panel-works-for-one-account-the.md

@@ -0,0 +1,25 @@
+---
+id: waiting-on-owner/the-ai-usage-panel-works-for-one-account-the
+title: "The AI usage panel works for one account; the multi-account half is unproven"
+theme: waiting-on-owner
+status: open
+created: 2026-08-18
+date_source: stated
+order: 1
+---
+
+**The AI usage panel works for one account; the multi-account half is unproven.** Landed and verified
+live 2026-08-18 — click the harness pill in the chat composer and it shows Claude Code's own usage
+display, limits with countdowns, tokens by day and by model.
+
+What is NOT proven is the reason it was built: a second Anthropic login, the account tabs, and a
+stored row surviving a switch. **Group C of `docs/ai-usage-panel.md`** is that, and test 10 is the one
+most likely to be wrong — a refresh must not overwrite an account it could not measure, and that
+failure is silent.
+
+Deliberately deferred rather than forgotten: the owner switches accounts when the work needs it, and
+the worst case is one wrong tab. Run Group C the first time a second login lands on this machine.
+
+Also unexercised: the model dropdown no longer renders the literal string `claude-code` for a chat
+that named no tier. Needs `officer-claude-code` restarted, not just `officer` — the parser in the
+sidecar is what emits it.