chore(process): #312 H12 — session-end issue-qualification audit

scripts/issue-qualification-audit.sh: lists OPEN issues missing a `priority:` label
(the #237 ranking keys off priority:/gate labels, so an unlabeled issue is invisible
to it). "Fully qualified" = has a priority: label; gate-vs-backlog derives from the
review label / milestone, and a milestone is NOT required (backlog is unmilestoned).
Advisory (exit 1 if any unqualified); fail-open without Gitea creds. Wired into the
kickoff session-end protocol + a lore bullet. Tested live (flagged 2) + no-creds no-op.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/handoffs/chicorytv-issue-queue.md

@@ -62,9 +62,11 @@ Then work the queue:
    reviewer-repo audits are claimed by comment only.
 4. Read the issue bodies (they carry the task context/evidence) and work the item under the
    HARD CONSTRAINTS below.
-5. Finish by following the session-end protocol in #237: ONE session comment on the tracker
-   (template in the tracker body, incl. triage verdicts for any new issues), remove your
-   `in-progress` labels, and complete the per-issue Task Completion Protocol from CLAUDE.md.
+5. Finish by following the session-end protocol in #237: run the **H12 qualification audit**
+   (`ETV_GITEA_BASICAUTH=user:pass scripts/issue-qualification-audit.sh`) and add a `priority:`
+   label to anything it lists (every issue you filed this session included); then ONE session
+   comment on the tracker (template in the tracker body, incl. triage verdicts for any new issues),
+   remove your `in-progress` labels, and complete the per-issue Task Completion Protocol from CLAUDE.md.
 
 HARD CONSTRAINTS:
 - Work in worktrees off origin/main. Copy web/node_modules from the main checkout.
@@ -162,6 +164,13 @@ HARD CONSTRAINTS:
   them (`./scripts/update-openapi.sh` + `npm run generate:api`) — never hand-resolve; git text-merges
   them plausibly-but-wrong and `npm run check:api` is the guard. Escape hatch for a deliberate
   non-rebased push: `ETV_SKIP_REBASE_CHECK=1 git push`.
+- **H12 issue-qualification audit** (ersatztv#312, `scripts/issue-qualification-audit.sh`): a
+  session-end check that lists OPEN issues missing a `priority:` label — the #237 ranking keys off
+  `priority:`/gate labels, so an unlabeled issue is invisible to it. "Fully qualified" = has a
+  `priority: {high,medium,low}` label (that signals triage ran; gate-vs-backlog is then derivable
+  from the `review` label / milestone, and a milestone is NOT required — backlog is unmilestoned).
+  Run it at session end and label anything it flags (esp. issues you filed this session). Fail-open
+  without creds; advisory (exit 1 when any are unqualified). Sibling to H11 (both #311/#312).
 - **CI VM test timeouts**: heavy-render web tests (100+ item grids) need explicit vitest
   timeouts (e.g. 15s) — the CI VM hit the 5s default on a test that runs in ~1s locally
   (run 686). Bump per-test, don't raise the global default.

scripts/issue-qualification-audit.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# H12 (ersatztv#312) — session-end audit: list OPEN issues that are not "fully qualified" for the
+# #237 ranking protocol. An issue is qualified when it carries a `priority:` label — that is the
+# signal triage happened; gate-vs-backlog is then derivable (a `review` label / open milestone =
+# gate, otherwise backlog), and a milestone is deliberately NOT required (backlog is unmilestoned).
+# So the one mandatory check is: does the issue have a `priority: {high,medium,low}` label?
+#
+# Run it at session end (kickoff session-end protocol) and qualify anything it lists before closing.
+# Advisory: prints the under-qualified set and exits 1 if any exist, 0 if all clean. Fail-OPEN with
+# no creds / Gitea unreachable (prints a notice, exits 0 — never a spurious signal).
+#
+# Creds from env: ETV_GITEA_TOKEN or ETV_GITEA_BASICAUTH (user:pass). ETV_GITEA_URL overrides the
+# base (default: the LAN instance); ETV_GITEA_REPO overrides owner/repo (default timothy/ersatztv).
+set -uo pipefail
+
+base_url="${ETV_GITEA_URL:-http://192.168.1.95:3000}/api/v1"
+repo="${ETV_GITEA_REPO:-timothy/ersatztv}"
+
+gq() {
+  local path="$1"
+  if [ -n "${ETV_GITEA_TOKEN:-}" ]; then
+    curl -sf -H "Authorization: token $ETV_GITEA_TOKEN" "$base_url/$path" 2>/dev/null
+  elif [ -n "${ETV_GITEA_BASICAUTH:-}" ]; then
+    curl -sf -u "$ETV_GITEA_BASICAUTH" "$base_url/$path" 2>/dev/null
+  else
+    return 1
+  fi
+}
+
+if [ -z "${ETV_GITEA_TOKEN:-}" ] && [ -z "${ETV_GITEA_BASICAUTH:-}" ]; then
+  echo "H12 audit: no Gitea creds in env (ETV_GITEA_TOKEN or ETV_GITEA_BASICAUTH) — skipping (no-op)."
+  exit 0
+fi
+
+# Page through OPEN issues (type=issues excludes PRs; .pull_request guard is belt-and-suspenders).
+# Emit "#N<TAB>title" for any issue with NO 'priority:' label.
+missing=""
+page=1
+while :; do
+  batch=$(gq "repos/$repo/issues?state=open&type=issues&limit=50&page=$page") || {
+    echo "H12 audit: Gitea unreachable — skipping (no-op)."; exit 0; }
+  count=$(printf '%s' "$batch" | jq 'length' 2>/dev/null || echo 0)
+  [ "${count:-0}" -eq 0 ] && break
+  rows=$(printf '%s' "$batch" | jq -r '
+    .[]
+    | select(.pull_request == null)
+    | select(([ (.labels // [])[].name | select(startswith("priority:")) ] | length) == 0)
+    | "#\(.number)\t\(.title)"' 2>/dev/null || true)
+  [ -n "$rows" ] && missing="${missing}${rows}"$'\n'
+  page=$((page + 1))
+done
+
+if [ -z "$(printf '%s' "$missing" | tr -d '[:space:]')" ]; then
+  echo "H12 audit: every open issue carries a priority: label. ✓"
+  exit 0
+fi
+echo "H12 audit: OPEN issues missing a 'priority:' label — qualify these before session end"
+echo "(the #237 ranking keys off priority:/gate labels; an unlabeled issue is invisible to it):"
+printf '%s' "$missing" | sed '/^[[:space:]]*$/d' | sed 's/^/  /'
+exit 1