chore(todo-format): level-2 VERIFY closes terminal, not dated

A resolved VERIFY at level 2 was rewritten to a dated org header (** 2026-... <desc>), following the old "VERIFY dates at all depths" rule. Dated headers at level 2 fall through every tool that keys on the keyword: --archive-done never moves them, task-review never selects them, and they pile up in Open Work.

The rule is now depth-split, matching ordinary tasks. VERIFY dates only at level 3 and deeper. At level 2 it closes with a DONE/CANCELLED keyword plus a CLOSED line, the answer in the body.

I fixed the two existing violations (the Dirvish d/D and C-; b pull-away VERIFYs, reverted from dated ** headers to ** DONE), and closed the two F9 GUI manual-test VERIFYs after confirming them.

2 files changed, 42 insertions, 40 deletions

diff --git a/.claude/rules/todo-format.md b/.claude/rules/todo-format.md
index b1fb57b8f..b9e93bb5a 100644
--- a/.claude/rules/todo-format.md
+++ b/.claude/rules/todo-format.md
@@ -130,7 +130,7 @@ becomes
 
 The agenda view (`org-agenda`) shows entries at the section + top-task level. Letting `**` tasks stay task-shaped preserves their visibility as "things that recently shipped." Letting `***+` sub-tasks flip to dated entries keeps the agenda from being clogged with a long list of completed sub-tasks at every depth — those become history within their parent instead.
 
-`VERIFY` is the documented exception: it follows the dated-rewrite rule at **all** depths (including `**`), because a resolved VERIFY is an answered question rather than a finished task. See the VERIFY section below.
+`VERIFY` follows the dated-rewrite rule at `***` and deeper, the same as any sub-task. At `**` it does *not*: a top-level VERIFY completes task-shaped — a `DONE`/`CANCELLED` keyword plus a `CLOSED:` line, exactly like a top-level `TODO`. Dated headers never appear at `**`. Level 2 always carries a terminal keyword; dated headers are a `***`-and-deeper shape only. See the VERIFY section below.
 
 ## VERIFY tasks
 
@@ -191,19 +191,31 @@ The sibling rule is the active force that keeps `todo.org` flat. Without
 it, VERIFYs accumulate one level deeper than their trigger every time —
 turning a clean parent tree into a long pole of nested sub-headings.
 
-### Completion — dated rewrite + content replacement
+### Completion — depth decides the heading shape
 
-When a VERIFY resolves, **rewrite the heading and body together** at the
-same depth — regardless of whether the VERIFY is at `**` or `***`:
+When a VERIFY resolves, **rewrite the heading and body together**. The body
+replacement is the same at every depth (step 2 below); the heading shape
+depends on the VERIFY's level, mirroring the depth-based rule for ordinary
+tasks — dated entries at `***` and deeper, terminal keyword at `**`.
 
-1. **Replace the heading.** Drop the `VERIFY` keyword (and any priority
-   cookie / tags) and replace with a timestamp + short description:
+1. **Replace the heading — by depth.**
 
-       *** 2026-05-15 Fri @ 14:00:00 -0500 <what was answered or done>
+   - **At `***` and deeper — dated event-log entry.** Drop the `VERIFY`
+     keyword (and any priority cookie / tags) and replace with a timestamp +
+     short description:
 
-   Generate the timestamp with `date "+%Y-%m-%d %a @ %H:%M:%S %z"`.
-   Match the original depth (a `**` VERIFY becomes `** YYYY-MM-DD ...`;
-   a `***` VERIFY becomes `*** YYYY-MM-DD ...`).
+         *** 2026-05-15 Fri @ 14:00:00 -0500 <what was answered or done>
+
+     Generate the timestamp with `date "+%Y-%m-%d %a @ %H:%M:%S %z"`.
+
+   - **At `**` — terminal keyword, like any top-level task.** Change
+     `VERIFY` to `DONE` (answered / check passed) or `CANCELLED` (abandoned),
+     keep the heading text, priority cookie, and tags, and add a
+     `CLOSED: [YYYY-MM-DD Day]` line. Never a dated heading — a `**` dated
+     header is a defect; repair it to `DONE`/`CANCELLED` + `CLOSED:`.
+
+         ** DONE [#B] <original VERIFY topic> :tags:
+         CLOSED: [2026-05-15 Fri]
 
 2. **Replace the body.** Drop the original question/instruction prose and
    replace with either:
@@ -213,16 +225,18 @@ same depth — regardless of whether the VERIFY is at `**` or `***`:
      instruction or pending-decision marker — what was done, when, where
      the artifact lives).
 
-The completed VERIFY becomes an in-place event log entry. The original
-question is preserved by the dated heading + body shape; anyone scanning
-the agenda or `git log` can see what was asked and what landed.
-
-**Note on the top-level case.** Regular `**` DONE tasks stay task-shaped
-with a `DONE` keyword + `CLOSED:` line per *Completion — depth-based*
-above. VERIFYs at `**` are the exception — they convert to dated log
-entries on completion because a resolved VERIFY isn't a "done task," it's
-an answered question. The dated-rewrite rule wins for VERIFYs at all
-depths.
+Either way the completed VERIFY records what was asked and what landed: at
+`***` and deeper as a dated event-log entry, at `**` as a `DONE`/`CANCELLED`
+task whose body holds the answer. Anyone scanning the agenda or `git log`
+can see both.
+
+**Note on the top-level case.** A `**` VERIFY completes exactly like a `**`
+`TODO`: a `DONE`/`CANCELLED` keyword + `CLOSED:` line, with the answer or
+action in the body. The earlier habit of dating a resolved top-level VERIFY
+— treating "answered question, not a finished task" as license for a `**`
+dated header — is retired. It put dated headers at level 2, where the agenda
+truncates them out of a clean keyword scan. Dated rewrite is for `***` and
+deeper only; `**` always carries a terminal keyword.
 
 ### Don't leave stale placeholders
 
diff --git a/todo.org b/todo.org
index 952891b13..ab941c11a 100644
--- a/todo.org
+++ b/todo.org
@@ -195,7 +195,8 @@ From the 2026-06 config audit, =modules/transcription-config.el=:
 - =:210= — =make-process :stderr= with a file PATH creates a BUFFER named like the path (verified by probe); the "Errored. Logs in <file>" notification points at a log without the error text, and the hidden stderr buffer leaks per transcription. Route stderr into the process buffer or write it out in the sentinel.
 - =:370-374= — video path derives txt/log from the temp mp3's /tmp path; the transcript lands in /tmp and dies on reboot, contradicting the "alongside the source" docstring. Pass the video's path as the output base.
 
-** 2026-06-20 Sat @ 10:29:42 -0400 Dirvish: d duplicates, D force-deletes (guarded)
+** DONE [#C] Dirvish: free D for hard-delete, move duplicate :feature:quick:next:
+CLOSED: [2026-06-20 Sat]
 Decided with Craig 2026-06-20: remove delete-to-trash entirely, bind =d= = =cj/dirvish-duplicate-file= and =D= = =cj/dirvish-hard-delete= (sudo rm -rf after a =yes-or-no-p= naming the exact targets). Built in =modules/dirvish-config.el= (=cj/--dirvish-hard-delete-command= pure builder + =cj/dirvish-hard-delete= command; keymap =d=/=D= swap). 4 ERT tests for the command builder; full suite green; live-reloaded into the daemon (=dirvish-mode-map= =d=/=D= rebinding confirmed). Manual keypress + sudo-flow check filed under Manual testing and validation.
 
 ** VERIFY [#C] page-signal pager account deregistered — re-registration needs your hands
@@ -204,7 +205,8 @@ Decided with Craig 2026-06-20: remove delete-to-trash entirely, bind =d= = =cj/d
 :END:
 Reported by .emacs.d 2026-06-12 01:01: the dedicated pager number (+15045173983, the Claude Pager Google Voice number on signal-cli) returns "User ... is not registered" on every send — Signal appears to have deregistered it (GV numbers get periodically re-verified). Re-registration requires captcha/SMS, which only you can do. Until then every page-signal call fails; .emacs.d's config-audit page fell back to email. Wrapper lives at claude-templates/bin/page-signal.
 
-** 2026-06-20 Sat @ 10:29:42 -0400 C-; b + arrow pulls a window away from a sole window
+** DONE [#C] Pull a fullscreen terminal window away with C-; b + arrow :feature:next:
+CLOSED: [2026-06-20 Sat]
 Decided with Craig 2026-06-20: when the selected window is the sole window, =C-; b= + arrow keeps that window on the arrow's edge and slivers =other-buffer= in on the opposite side (=minimize-window=, so the current window keeps almost the whole frame), focus staying put; each further arrow then shrinks it step by step via =windsize=, reading the same as resizing an existing split. Generalizes to any sole window, not just terminals — resize was a no-op there before. Built in =modules/ui-navigation.el= (=cj/window-pull-side= pure mapping + =cj/window--pull-away= + a =one-window-p= branch in =cj/window-resize-sticky=). ERT tests for the mapping and both sticky paths; geometry verified in a headless frame (down -> terminal 37/40 at the bottom, reveal 2 lines slivered on top via window-min-height=1, windsize-down then steps it down); full suite green; live-reloaded into the daemon. Refined from a first cut that split toward the arrow and jumped to 50%, per Craig's feedback. Manual gesture check filed under Manual testing and validation.
 
 ** VERIFY [#C] Remove unused system-power keybindings :refactor:quick:next:
@@ -436,24 +438,10 @@ What we're verifying: in dirvish, d now duplicates the file at point (delete-to-
 - Answer no first (confirm nothing happens), then press D again and answer yes
 - Note whether sudo prompts for a password and whether the file actually disappears
 Expected: d duplicates; D names the exact targets and only deletes on yes; the files are gone with no trash copy. If sudo needs a password that shell-command can't supply, flag it — the delete may need to route through a tty instead.
-*** VERIFY F9 agent toggle no longer shrinks the window after a C-; b pull-away
-What we're verifying: the f9 split-shrink bug is fixed. The toggle now captures the agent window's total-height (not body-height), so the capture/replay round-trip is immune to the mode line's pixel height — the agent should keep the same height across repeated toggles even with the WIP theme's near-zero =mode-line-inactive= (=:height 2=). The batch harness can't reproduce this (a TTY mode line is always a full line), so this needs a real GUI frame.
-- Open the agent (F9) and maximize it so it fills the frame (=C-x 1= inside it)
-- Pull it down with =C-; b <down>= (the reveal slivers in above; the agent becomes the bottom window) and press =<escape>= to end the sticky resize
-- Note the agent window's height (eyeball it, or =M-:= the form below)
-#+begin_src emacs-lisp
-(window-total-height (get-buffer-window (current-buffer)))
-#+end_src
-- Press F9 to toggle the agent off, then F9 again to toggle it back on. Repeat 5–6 times.
-- Re-check the height after each on-toggle
-Expected: the agent window stays the same height every cycle (no one-line-per-toggle shrink). Before the fix it lost ~1 line each toggle. If it still shrinks, capture the height sequence and reopen this as a TODO — the remaining drift would point at a different rounding source than the mode-line pixel height.
-*** VERIFY F9 toggle preserves all windows in a 3-window layout
-What we're verifying: toggling the agent off then on in a 3-window layout no longer eats a working window. The fix re-splits the agent into its own window on toggle-on instead of reusing the working window at the edge, so the layout is preserved across the toggle (off then on returns the same three windows). Batch tests already assert the window count; this is the visual read in a real frame.
-- Set up three windows: a code/file window on top, a second working window (e.g. todo.org) in the middle, and the agent (F9) as a full-width strip at the bottom
-- Note the three windows and which buffers they show
-- Press F9 to toggle the agent off (the bottom strip closes, two windows remain)
-- Press F9 again to toggle it back on
-Expected: you are back to three windows — the agent returns as its own bottom strip, and both working windows (code + middle) are still showing their buffers. Before the fix, toggle-on replaced the middle/bottom working window with the agent, leaving two windows.
+*** 2026-06-20 Sat @ 22:11:00 -0400 F9 agent toggle no longer shrinks after a C-; b pull-away
+Craig confirmed in his live GUI frame: the agent window keeps its height across repeated F9 toggles after a C-; b pull-away, even under the WIP theme's near-zero mode-line-inactive. The total-height capture/replay fix holds (dbee95ae).
+*** 2026-06-20 Sat @ 22:11:00 -0400 F9 toggle preserves all windows in a 3-window layout
+Craig confirmed in his live GUI frame: toggling the agent off then on in a 3-window layout returns the same three windows — both working windows survive and the agent re-splits its own bottom strip. The reversible-toggle fix holds (64916462).
 
 ** PROJECT [#A] Theme-Studio Open Work
 Parent grouping the open theme-studio / theming issues; close each child independently.