chore(todo): audit solo tags and close shipped tasks

I tagged the open tasks for solo eligibility: solo means the work needs no decision or preference input, only manual validation afterward. I added solo where the work is self-contained and dropped it where a design or palette decision gates it.

I closed the tasks that shipped (eat zoom-out binding, ledger wiring, transcription stderr, EAT diff darkening), filed the ledger guardrail-UX audit, and added the manual-validation checks for the failing-transcription log and the diff darkness.

1 files changed, 35 insertions, 20 deletions

diff --git a/todo.org b/todo.org
index bcd1bf3a2..581a0741c 100644
--- a/todo.org
+++ b/todo.org
@@ -83,6 +83,17 @@ What we're verifying: =C-; a n= (or =M-SPC=) cycles into a detached ai-term (ali
 - Confirm one is attached (a live =agent [...]= buffer) and one is detached (its =aiv-= tmux session is alive but has no buffer).
 - Press =C-; a n= repeatedly to cycle through the agents.
 Expected: the rotation includes the detached agent; landing on it recreates its terminal buffer and reattaches the tmux session (its live output appears), instead of skipping it. Order is stable (by buffer name) and wraps after the last.
+*** VERIFY EAT diff backgrounds read dark enough (Claude Code diffs)
+What we're verifying: the added/removed line backgrounds in Claude Code diffs (=eat-term-color-22= / =-52=) now render at about half their former brightness (=#002f00= / =#2f0000=, down from =#005F00= / =#5F0000=) and read as comfortably dark while still clearly green/red. Themed via WIP.json + regenerated WIP-theme.el; live in the daemon. This is the darkness judgment only Craig can make.
+- In a live agent (EAT) buffer, have Claude show a colored diff with both added and removed lines (e.g. ask it to edit a file).
+- Look at the added-line green background and the removed-line red background.
+Expected: both backgrounds read as dark/muted, not bright, with green and red still distinct. If still too bright or now too dark, say a direction and I retune the two hex values. If the brighter within-line word-highlight shades are still too bright, those are different eat-term-color indices I'd need to sample live (=C-h F= on a highlighted word) before darkening.
+*** VERIFY transcription error log captures stderr on a failed run
+What we're verifying: a failed transcription now writes the backend's stderr into the .log file the "Errored.  Logs in <file>" notification points at, and no hidden " *transcribe-stderr-*" buffer is left behind. The buffer-not-path fix and the drain-and-kill are unit-tested (39/39 green); this is the live failing-run check only Craig can run.
+- Trigger a transcription that will fail — e.g. feed a corrupt/zero-byte audio file, or point the backend at a missing model — via the normal transcribe command.
+- When the "Errored.  Logs in <file>" notification fires, open that .log file.
+- Run =C-x C-b= (list-buffers) and scan for any buffer named like " *transcribe-stderr-...*".
+Expected: the .log file contains the backend's actual error text (not just the header), and no " *transcribe-stderr-...*" buffer remains.
 *** VERIFY Opening a video from dirvish plays it on repeat (mpv)
 What we're verifying: a video opened from dirvish launches mpv with --loop-file=inf so it plays on repeat; non-video external files are unaffected. The routing, predicate, and arg list are unit-tested (15/15) and verified live; this is the visual playback only Craig can confirm.
 - In dirvish, put point on a video file (.mp4 / .mkv / .webm) and press RET to open it.
@@ -2410,12 +2421,14 @@ CLOSED: [2026-06-25 Thu]
 :END:
 Fixed (commit 4e48432c): removed the redundant =cj/build-org-refile-targets= call from org-roam's :config (=org-roam-config.el=). org-roam is =:defer 1=, so that call ran the multi-file refile scan synchronously at the 1s idle on a cold cache, freezing Emacs at first idle; =org-refile-config.el= already schedules the same build on a 5s idle timer, so it was a duplicate. The first-idle freeze is gone. This removed the *duplicate* early scan, not the scan's cost — making the scan itself faster stays the separate =[#B] Optimize org-capture target building performance= task (profile-first).
 
-** VERIFY [#B] transcription: stderr never reaches the log :bug:solo:next:
+** DONE [#B] transcription: stderr never reaches the log :bug:solo:next:
+CLOSED: [2026-06-28 Sun]
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-25
 :END:
-The "/tmp" half is DONE (commit 3d9a650d): video transcripts now land beside the source video (=talk.mp4= -> =talk.txt=), via an =output-base= threaded through =cj/--start-transcription-process= so the outputs derive from the video, not the temp mp3. TDD regression test; full transcription suite green.
-Remaining (the stderr half — needs a live transcription run to verify): =transcription-config.el= =make-process :stderr= with a file PATH creates a BUFFER named like the path, not a file, so the "Errored. Logs in <file>" notification points at a log with no error text, and the hidden stderr buffer leaks per transcription. Fix: route stderr into the process buffer (or a real temp file) and write the captured text out in the sentinel, then drop the leaked buffer. Code-fixable now; held because verifying it needs a real (failing) transcription run. From the 2026-06 config audit.
+The "/tmp" half was DONE earlier (commit 3d9a650d): video transcripts land beside the source video via an =output-base= threaded through =cj/--start-transcription-process=.
+The stderr half is now fixed: =make-process :stderr= had a file PATH, which Emacs turns into a phantom buffer named after the path — so the error text never reached the log and a buffer leaked per run. Fix (2026-06-28): an explicit, erased stderr buffer (=" *transcribe-stderr-<file>*"=) is passed to =:stderr=, threaded to the sentinel, drained into the log file via =cj/--append-to-log=, then killed. Keeping stderr off the stdout =:buffer= leaves the transcript clean. TDD: new =test-tx-start-process-stderr-is-a-buffer-not-a-path= plus strengthened sentinel tests asserting the stderr text reaches the log and the buffer is killed; full transcription suite 39/39 green; live-reloaded.
+Live failing-run confirmation is filed under "Manual testing and validation".
 
 ** DONE [#B] eww User-Agent advice may not inject under Emacs 30 :bug:
 CLOSED: [2026-06-25 Thu]
@@ -2959,17 +2972,21 @@ Tie this into the existing coverage work:
 - Tests cover adapter detection, command building, scope resolution, result
   storage, and key interactive paths.
 
-** TODO [#C] Keymap consolidation — resolve decisions, run Phase 1-2 :feature:refactor:solo:
+** TODO [#C] Keymap consolidation — resolve decisions, run Phase 1-2 :feature:refactor:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-13
 :END:
 Spec: [[id:540bf06b-16b8-46c6-b459-c40d1b9c795d][keybinding-console-safety-spec-doing.org]]. Phase 0 (revert 4a1ecf64) is done and pushed. Decisions D1-D5 are open TODOs in the spec; D2/D4/D5 gate the primary work (Phase 1 prune via Appendix D, Phase 2 consolidate + retire the translation block), while D1/D3 (the console-safe prefix) gate only the optional Phase 3 and can stay open indefinitely. Resolve D2/D4/D5, then run Phase 1-2. Appendix D is the keybinding pruning checklist. Add a =#+TODO: TODO | DONE SUPERSEDED CANCELLED= header line to the spec if adopting those decision keywords (rulesets convention update, 2026-06-12).
 
-** TODO [#C] ledger-config is orphaned — ledger-mode never configured :bug:quick:
+** DONE [#C] ledger-config is orphaned — ledger-mode never configured :bug:quick:
+CLOSED: [2026-06-28 Sun]
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-21
 :END:
-Nothing requires =modules/ledger-config.el= (verified by grep), so .dat/.ledger/.journal open without ledger-mode, reports, or flycheck-ledger. The module looks finished, not staged (unlike duet-config, which documents its pre-alpha orphaning). Decide: wire into init.el (+ =cj/executable-find-or-warn= for the ledger binary) or delete. From the 2026-06 config audit.
+Resolved by wiring (Craig's call 2026-06-28: wire it, not delete). Already landed in commit 6ec857ae (2026-06-24, "feat(ledger): un-orphan ledger-config and rewrite clean-on-save") — =init.el:123= now requires =ledger-config=, after this task's 2026-06-21 review, so the task was stale. Confirmed it loads cleanly; the =cj/executable-find-or-warn "ledger"= guard is in its =:config=. Follow-on audit + guardrail-UX work filed as its own task below.
+
+** TODO [#C] Ledger-config audit + guardrail UX :feature:
+Now that =modules/ledger-config.el= is wired (6ec857ae), audit it thoroughly — correctness first, then especially the data-entry UX. Goal (Craig): a workflow with enough guardrails that it's hard to make a costly mistake in a financial file. Audit surface: clean-on-save behavior (does =ledger-mode-clean-buffer= ever reorder/rewrite in a surprising way; is the demoted-error swallow hiding real problems), flycheck-ledger coverage (unbalanced transactions, bad account names) and whether it surfaces clearly, reconcile safety, the report set, company-ledger account/payee completion as a typo guard, and any add-transaction entry flow. Identify gaps, then design the guardrails (validation on save, completion to prevent account-name drift, a confirm before destructive reconcile, etc.). The correctness/gap audit can run solo; the UX guardrail choices need Craig's preferences, so not tagged :solo:. Priority [#C] is a placeholder — bump if ledger becomes active daily use.
 
 ** TODO [#C] ai-term multi-LLM support — Claude / Codex / ollama :feature:
 Allow creating an ai-term that launches any of Claude, Codex, or a local LLM via ollama, switchable at session start. From rulesets/Craig via the roam inbox. Spec note: =inbox/PROCESSED-2026-06-23-2123-from-rulesets-ai-term-multi-llm-support-from-craig.org=.
@@ -2979,7 +2996,7 @@ Allow creating an ai-term that launches any of Claude, Codex, or a local LLM via
 :END:
 Allow creating an ai-term backed by any of Claude, Codex, or a local LLM via ollama, with the backend chosen seamlessly at the start of the session. ai-term currently assumes Claude; generalize the launch path so the agent backend is a selectable parameter and switching between them at session start is frictionless. Routed here from the rulesets roam-inbox item "multiple agent source improvements" (its bullet 3 asked to send emacs this note); the item's other bullets — naming the agent so non-Claude agents aren't called "Claude", and tightening workflow wording for Codex's more literal reading — stay with rulesets.
 
-** TODO [#C] Migrate tests off mocking primitives (native-comp robustness) :test:refactor:
+** TODO [#C] Migrate tests off mocking primitives (native-comp robustness) :test:refactor:solo:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-21
 :END:
@@ -3151,7 +3168,7 @@ These may override useful defaults - review and pick better bindings:
 
 ** PROJECT [#C] Music Open Work
 Parent grouping the open music / EMMS issues; close each child independently.
-*** VERIFY [#C] music: extract faces for music config :refactor:quick:solo:next:
+*** VERIFY [#C] music: extract faces for music config :refactor:quick:next:
 Needs from Craig: this is theme-side work, not a config edit — the music-config faces were already stripped (2026-06-14), so "extracting" them means DEFINING them in the theme (theme-studio JSON / build-theme) for playlist name, status, the per-button on/off pair, per-key symbol+text, and other labels. That needs the actual color choices and which theme(s) to add them to. Give me the palette intent (or say "pick sensible defaults in WIP") and I'll add the face definitions.
 Pull the music-config faces out to the theme (the config no longer defines faces directly): playlist name, status (paused, etc.), two mode colors per "button" (on vs off), a per-key symbol+text color, and a color for all other labels. Pairs with the 2026-06-14 face-stripping work (music-config faces were removed there and are currently undefined until the theme defines them). From the roam inbox 2026-06-15.
 *** TODO [#C] music: show song information in the modeline          :feature:
@@ -3793,17 +3810,11 @@ After this work lands, mark the original "Finish terminal GPG pinentry configura
 v1 (read-only) implemented and tested (Phases 1-3): the gkeepapi Python bridge (=scripts/google-keep/keep-bridge.py=, 12 tests), the elisp core + =cj/keep-refresh= renderer with atomic writes and async make-process (=modules/google-keep-config.el=, 15 ERT tests), un-orphaned under a =C-c k= prefix, graceful warning when gkeepapi/token/auth is missing. The pure JSON-to-org core is kept extractable per the spec. Live fetch needs the one-time gkeepapi + master-token setup — see "Google Keep v1 live setup and first fetch" under Manual testing and validation.
 Next: v2 (read-write — create/edit back to Keep, with a staleness guard) per the spec, the immediate follow-on once the live read is confirmed. Later: list/checkbox rendering, package extraction.
 Spec: [[file:docs/specs/google-keep-emacs-integration-spec.org][google-keep-emacs-integration-spec.org]] (Ready, 2 review rounds; all five decisions resolved 2026-06-25).
-** VERIFY [#C] Remove unused system-power keybindings :refactor:quick:next:
+** TODO [#C] Remove unused system-power keybindings :refactor:quick:solo:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-20
 :END:
-Needs from Craig: the task says "confirm the exact set to keep before unbinding." Under C-; ! the bindings are shutdown (s), reboot (r), restart-Emacs (e), and friends. Tell me which to keep bound and which to drop (the completing-read menu still reaches the rare ones), and I'll unbind the rest.
-
-=modules/system-commands.el= binds shutdown (=C-; ! s=), reboot (=C-; ! r=), restart-Emacs (=C-; ! e=) and friends under the =C-; != prefix. Craig rarely uses them and wants the key real-estate back. Drop the bindings he doesn't use; the completing-read menu can still reach the rare ones. Confirm the exact set to keep before unbinding. From the roam inbox.
-
-#+begin_src cj: comment
-  remove them all. 
-#+end_src
+=modules/system-commands.el= binds shutdown (=C-; ! s=), reboot (=C-; ! r=), restart-Emacs (=C-; ! e=) and friends under the =C-; != prefix. Craig rarely uses them and wants the key real-estate back. Decision resolved (Craig, 2026-06-28): remove them all — the completing-read menu still reaches the rare ones. Unbind every =C-; != key binding, leave the commands and the menu intact. From the roam inbox.
 
 ** CANCELLED [#C] dirvish image previews missing in the pictures dir :bug:
 CLOSED: [2026-06-25 Thu]
@@ -4149,8 +4160,10 @@ Three small reveal.js improvements; collected into one task because each on its
 ** TODO [#D] Treesitter grammar offline cache :feature:
 Treesitter grammars are downloaded by =treesit-auto= on first use and live outside the localrepo. For true offline reproducibility, cache the grammars next to the localrepo (a =.localrepo/treesitter/= tier, or a separate mirror script). Cross-linked from =docs/design/localrepo.org=.
 
-** TODO [#C] EAT diff green and red too bright :quick:
-The added and removed line backgrounds in Claude Code diffs read too bright. Sample a live colored diff in an agent buffer to read the exact =eat-term-color= indices (the added green is =eat-term-color-22= / =#005F00=, confirmed via =C-h F=; also the removed red and the brighter word-highlight shades), then add darker =eat-term-color-N= overrides to =WIP-theme.el= so green and red darken together. Caveat: a 256-cube color override is global, hitting every terminal program that emits it. Needs Craig's call on the target darkness.
+** DONE [#C] EAT diff green and red too bright :quick:
+CLOSED: [2026-06-28 Sun]
+Darkened the added/removed line backgrounds. Added =eat-term-color-22= (added green) and =eat-term-color-52= (removed red) to the eat section of =scripts/theme-studio/WIP.json= at about half their former brightness — =#005F00= -> =#002f00=, =#5F0000= -> =#2f0000= (Craig: pick an appropriate darkness from WIP.json; halved, symmetric, still clearly green/red). Regenerated =themes/WIP-theme.el= via build-theme.el and re-applied the WIP theme live in the daemon (confirmed: =eat-term-color-22= = #002f00, =-52= = #2f0000). EAT uses each face's :foreground as the palette value for both fg and bg paint, so darkening the foreground darkens the diff background.
+Scope notes: (1) the green index (22) was confirmed via =C-h F=; the red (52) is the symmetric ANSI-256 dark-diff counterpart — if removed lines don't darken, the real index needs a live sample. (2) Only the line backgrounds are themed; the brighter within-line word-highlight shades are different (unconfirmed) indices, left for a live sample if Craig still finds them bright. (3) A 256-cube override is global (hits every terminal program emitting color 22/52). (4) Studio round-trip caveat: a future studio re-export may drop these cube faces until the studio formally tracks them. Visual darkness confirm filed under "Manual testing and validation".
 
 ** TODO [#C] Webm previews not rendering in dirvish :bug:solo:
 Dirvish computes a valid MD5-hashed cache path and =ffmpegthumbnailer= thumbnails the webm fine by hand, but dirvish's async cache generation never lands the jpg, so no preview shows. Root-cause the async step: trace the =(cache . CMD)= recipe dispatch and sentinel (=dirvish-shell-preview-proc-s=, =dirvish--make-proc=) to find why the generated jpg is never written or displayed.
@@ -4158,7 +4171,7 @@ Dirvish computes a valid MD5-hashed cache path and =ffmpegthumbnailer= thumbnail
 ** TODO [#C] Completion category for the mu4e attachment picker :feature:solo:
 The Save-attachment picker (=mu4e-attachments.el=) has bare candidates worth a category. Add a custom category plus a table annotation-function showing each attachment's MIME type and size; confirm the mu4e part-plist keys first. Helper =cj/completion-table-annotated= is in =system-lib=.
 
-** TODO [#C] Completion categories for the file-basename pickers :feature:
+** TODO [#C] Completion categories for the file-basename pickers :feature:solo:
 Eight =completing-read= pickers list bare file basenames, so marginalia can't annotate them: chrono-tools sounds, org-drill flashcards, help-config Info files, test-runner tests, music-config files, vc-config clone dirs, plus hugo drafts and org-agenda projects. For each, either make the candidates absolute paths so the standard =file= category resolves them, or tag a custom category with a small annotator. Decide per site. Helper =cj/completion-table= is in =system-lib=.
 
 ** TODO [#D] Claude Code unterminated-color bleed (upstream)
@@ -4167,7 +4180,9 @@ Claude Code truncates a colored span without a reset, so the color bleeds down t
 ** TODO [#D] occur/xref font-lock coloring watch :bug:
 =occur= and =xref= enable font-lock themselves, not via =global-font-lock-mode=, so the exclusion fix does not apply and they show source-line fontification on purpose. No action unless a result ever renders with colors that do not match its source buffer, in which case investigate the real mechanism.
 
-** TODO [#B] eat semi-char mode swallows zoom-out :bug:solo:
+** DONE [#B] eat semi-char mode swallows zoom-out :bug:solo:
+CLOSED: [2026-06-27 Sat]
+Shipped in commit 69fee81f: =eat-semi-char-mode-map= now binds =C--= -> =text-scale-decrease= and =C-0= -> =cj/eat-text-scale-reset= (=eat-config.el:495-496=). Original report below.
 In =eat-semi-char-mode= (the AI session buffers) =C--= is bound to =eat-self-input= and forwarded to the terminal, so it never reaches =text-scale-decrease= and the font can only grow. On velox 2026-06-27 a session climbed to text-scale 17 (~20x, unreadable) with no in-buffer way down. Fix (binding in =eat-semi-char-mode-map= works for eat, unlike ghostel): =C--= to =text-scale-decrease=, =C-0= to =(text-scale-set 0)=. Tradeoff: =C--= no longer forwarded to the terminal (Claude TUI and tmux do not use it), =C-0= shadows =digit-argument= inside eat buffers only. From the home-emacs inbox handoff 2026-06-27. Roam KB 799e8ab5-1c2c-4874-9abc-dff2ec354181.
 
 * Emacs Someday/Maybe