docs: level-2 VERIFY completes task-shaped, not as a dated header

The old rule dated a resolved VERIFY at every depth, including the top level. A level-2 dated header carries no keyword, so todo-cleanup's --archive-done can never archive it and task-review drops it from selection. Now a top-level VERIFY closes like any other top-level task (DONE/CANCELLED + CLOSED:), and dated rewrites are reserved for level 3 and deeper. Updated the rule and the three places that encoded the old behavior: todo-format.md, respond-to-cj-comments.md, and process-inbox.org. Also repaired two pre-existing level-2 dated headers.

5 files changed, 46 insertions, 29 deletions

diff --git a/.ai/workflows/process-inbox.org b/.ai/workflows/process-inbox.org
index af406ee..687767e 100644
--- a/.ai/workflows/process-inbox.org
+++ b/.ai/workflows/process-inbox.org
@@ -191,7 +191,7 @@ Rename in place to =inbox/PROCESSED-<original-filename>= and add a brief comment
 
 ** Park (Skeptical Review in a no-approvals session)
 
-Move the proposal file into =working/<task-slug>/= alongside the prepared diff, file the =[#B]= VERIFY per the Skeptical Review section, reply to the sender that it's parked for Craig's review, and delete the inbox file. On Craig's approval the apply is mechanical: apply the prepared edits, run the normal verify-and-publish flow, rewrite the VERIFY to a dated log entry per =todo-format.md=, and send the sender the acceptance reply. On rejection, the reject-from-another-project flow above runs unchanged.
+Move the proposal file into =working/<task-slug>/= alongside the prepared diff, file the =[#B]= VERIFY per the Skeptical Review section, reply to the sender that it's parked for Craig's review, and delete the inbox file. On Craig's approval the apply is mechanical: apply the prepared edits, run the normal verify-and-publish flow, close the parked =**= VERIFY per =todo-format.md= (a top-level VERIFY resolves to =DONE= + =CLOSED:=, not a dated header), and send the sender the acceptance reply. On rejection, the reject-from-another-project flow above runs unchanged.
 
 * Phase E — Close out
 
diff --git a/.claude/commands/respond-to-cj-comments.md b/.claude/commands/respond-to-cj-comments.md
index 7ee3909..2f16099 100644
--- a/.claude/commands/respond-to-cj-comments.md
+++ b/.claude/commands/respond-to-cj-comments.md
@@ -1,5 +1,5 @@
 ---
-description: Scan an org file for cj comments — Craig's annotations wrapped in `#+begin_src cj: ... #+end_src` source blocks — and process each via subagent-delegated accuracy. Each item is classified instruction / question / both, then dispatched to an instruction subagent (proposes a file:line patch) or a question subagent (researches with explicit scope, reports answer + evidence + confidence). Main thread reviews proposals before editing; subagents don't write to the source file. Org-mode TODO parents flip to DOING; new content lands under timestamped subheadings one level deeper; on completion, top- and second-level tasks advance to `DONE` while deeper tasks get their heading rewritten to a dated action description (no DONE keyword), becoming an in-place event log. VERIFY tasks at any depth flip to dated log entries with body replaced by the answer or action taken. Public-facing writing (commits, PRs, Slack, email, public docs) gets `/voice personal`; private writing skips it. Summary lists handled instructions, answered questions with evidence + confidence, follow-ups, unresolved items, and an explicit clean / N-remain verdict. Anything needing Craig's input becomes a `VERIFY` task in `todo.org` (top-level or first-level child of a parent task — never deeper) rather than a separate summary file. File/URL references render as clickable org-mode links. Use when an org file accumulates cj comments. Do NOT use for general code review (`/review-code`), new work without cj comments, or trivial items.
+description: Scan an org file for cj comments — Craig's annotations wrapped in `#+begin_src cj: ... #+end_src` source blocks — and process each via subagent-delegated accuracy. Each item is classified instruction / question / both, then dispatched to an instruction subagent (proposes a file:line patch) or a question subagent (researches with explicit scope, reports answer + evidence + confidence). Main thread reviews proposals before editing; subagents don't write to the source file. Org-mode TODO parents flip to DOING; new content lands under timestamped subheadings one level deeper; on completion, top- and second-level tasks advance to `DONE` while deeper tasks get their heading rewritten to a dated action description (no DONE keyword), becoming an in-place event log. VERIFY tasks at `***` and deeper flip to dated log entries with body replaced by the answer or action taken; a top-level (`**`) VERIFY instead closes as `DONE`/`CANCELLED` + `CLOSED:` like any top-level task, the answer in its body. Public-facing writing (commits, PRs, Slack, email, public docs) gets `/voice personal`; private writing skips it. Summary lists handled instructions, answered questions with evidence + confidence, follow-ups, unresolved items, and an explicit clean / N-remain verdict. Anything needing Craig's input becomes a `VERIFY` task in `todo.org` (top-level or first-level child of a parent task — never deeper) rather than a separate summary file. File/URL references render as clickable org-mode links. Use when an org file accumulates cj comments. Do NOT use for general code review (`/review-code`), new work without cj comments, or trivial items.
 ---
 
 # /respond-to-cj-comments — Process cj Comments in an Org File
@@ -143,9 +143,9 @@ For **instructions**:
 
    - **Regular `TODO`/`DOING` at `*` or `**`** — advance to `DONE` + `CLOSED:` line; the keyword and original heading stay visible in the agenda.
    - **Regular `TODO`/`DOING` at `***` and deeper** — rewrite the heading to `<depth> YYYY-MM-DD Day @ HH:MM:SS -ZZZZ <past-tense description>`; drop the keyword/priority/tags.
-   - **`VERIFY` at any depth** — dated-heading rewrite *and* a body replacement: replace the body with either the information Craig provided (when the VERIFY was a question) or a description of the action taken (when it was an instruction / pending-decision marker). VERIFYs at `**` follow this rule even though regular `**` DONE tasks stay task-shaped — a resolved VERIFY is an answered question, not a finished task.
+   - **`VERIFY` — depth decides the heading.** At `***` and deeper, a dated-heading rewrite. At `**`, a terminal keyword (`DONE`/`CANCELLED` + `CLOSED:`) like any top-level task — never a dated `**` header. Either way, replace the body with the information Craig provided (when the VERIFY was a question) or a description of the action taken (when it was an instruction / pending-decision marker).
 
-   **VERIFY-answer pattern.** When a cj annotation's `parent_heading_chain` ends with a `VERIFY ...` heading (i.e., the cj sits directly inside a VERIFY task), the cj is Craig's answer to the question that VERIFY held open. The cj content is the source for the dated-rewrite body. Two shapes:
+   **VERIFY-answer pattern.** When a cj annotation's `parent_heading_chain` ends with a `VERIFY ...` heading (i.e., the cj sits directly inside a VERIFY task), the cj is Craig's answer to the question that VERIFY held open. The cj content is the source for the resolved body. Two shapes:
 
    - *Direct answer.* The cj body IS the answer (a value, decision, link, paste from elsewhere). Lift the cj body verbatim into the new dated body; trim filler ("okay," "approved," "yes,") that isn't load-bearing.
    - *Indirect answer.* The cj points at where the answer lives ("Kostya gave this in Slack — pull it from DM channel X," "see the attached doc"). Execute the instruction first (per step 3 — subagent if research is needed), then the resolved info becomes the dated body.
@@ -153,7 +153,7 @@ For **instructions**:
    Both shapes land at the same end state:
 
    1. Generate the timestamp with `date "+%Y-%m-%d %a @ %H:%M:%S %z"`.
-   2. Rewrite the VERIFY heading to its dated form (depth-preserving) with a short summary of what got answered.
+   2. Rewrite the VERIFY heading by depth: at `***` and deeper, its dated form with a short summary of what got answered; at `**`, a `DONE`/`CANCELLED` keyword + `CLOSED:` line with the heading text kept.
    3. Replace the body with the resolved info (the cj body for direct, the executed result for indirect).
    4. Delete the cj annotation — it's now folded into the body. Don't keep both.
 
diff --git a/claude-rules/todo-format.md b/claude-rules/todo-format.md
index b1fb57b..b9e93bb 100644
--- a/claude-rules/todo-format.md
+++ b/claude-rules/todo-format.md
@@ -130,7 +130,7 @@ becomes
 
 The agenda view (`org-agenda`) shows entries at the section + top-task level. Letting `**` tasks stay task-shaped preserves their visibility as "things that recently shipped." Letting `***+` sub-tasks flip to dated entries keeps the agenda from being clogged with a long list of completed sub-tasks at every depth — those become history within their parent instead.
 
-`VERIFY` is the documented exception: it follows the dated-rewrite rule at **all** depths (including `**`), because a resolved VERIFY is an answered question rather than a finished task. See the VERIFY section below.
+`VERIFY` follows the dated-rewrite rule at `***` and deeper, the same as any sub-task. At `**` it does *not*: a top-level VERIFY completes task-shaped — a `DONE`/`CANCELLED` keyword plus a `CLOSED:` line, exactly like a top-level `TODO`. Dated headers never appear at `**`. Level 2 always carries a terminal keyword; dated headers are a `***`-and-deeper shape only. See the VERIFY section below.
 
 ## VERIFY tasks
 
@@ -191,19 +191,31 @@ The sibling rule is the active force that keeps `todo.org` flat. Without
 it, VERIFYs accumulate one level deeper than their trigger every time —
 turning a clean parent tree into a long pole of nested sub-headings.
 
-### Completion — dated rewrite + content replacement
+### Completion — depth decides the heading shape
 
-When a VERIFY resolves, **rewrite the heading and body together** at the
-same depth — regardless of whether the VERIFY is at `**` or `***`:
+When a VERIFY resolves, **rewrite the heading and body together**. The body
+replacement is the same at every depth (step 2 below); the heading shape
+depends on the VERIFY's level, mirroring the depth-based rule for ordinary
+tasks — dated entries at `***` and deeper, terminal keyword at `**`.
 
-1. **Replace the heading.** Drop the `VERIFY` keyword (and any priority
-   cookie / tags) and replace with a timestamp + short description:
+1. **Replace the heading — by depth.**
 
-       *** 2026-05-15 Fri @ 14:00:00 -0500 <what was answered or done>
+   - **At `***` and deeper — dated event-log entry.** Drop the `VERIFY`
+     keyword (and any priority cookie / tags) and replace with a timestamp +
+     short description:
 
-   Generate the timestamp with `date "+%Y-%m-%d %a @ %H:%M:%S %z"`.
-   Match the original depth (a `**` VERIFY becomes `** YYYY-MM-DD ...`;
-   a `***` VERIFY becomes `*** YYYY-MM-DD ...`).
+         *** 2026-05-15 Fri @ 14:00:00 -0500 <what was answered or done>
+
+     Generate the timestamp with `date "+%Y-%m-%d %a @ %H:%M:%S %z"`.
+
+   - **At `**` — terminal keyword, like any top-level task.** Change
+     `VERIFY` to `DONE` (answered / check passed) or `CANCELLED` (abandoned),
+     keep the heading text, priority cookie, and tags, and add a
+     `CLOSED: [YYYY-MM-DD Day]` line. Never a dated heading — a `**` dated
+     header is a defect; repair it to `DONE`/`CANCELLED` + `CLOSED:`.
+
+         ** DONE [#B] <original VERIFY topic> :tags:
+         CLOSED: [2026-05-15 Fri]
 
 2. **Replace the body.** Drop the original question/instruction prose and
    replace with either:
@@ -213,16 +225,18 @@ same depth — regardless of whether the VERIFY is at `**` or `***`:
      instruction or pending-decision marker — what was done, when, where
      the artifact lives).
 
-The completed VERIFY becomes an in-place event log entry. The original
-question is preserved by the dated heading + body shape; anyone scanning
-the agenda or `git log` can see what was asked and what landed.
-
-**Note on the top-level case.** Regular `**` DONE tasks stay task-shaped
-with a `DONE` keyword + `CLOSED:` line per *Completion — depth-based*
-above. VERIFYs at `**` are the exception — they convert to dated log
-entries on completion because a resolved VERIFY isn't a "done task," it's
-an answered question. The dated-rewrite rule wins for VERIFYs at all
-depths.
+Either way the completed VERIFY records what was asked and what landed: at
+`***` and deeper as a dated event-log entry, at `**` as a `DONE`/`CANCELLED`
+task whose body holds the answer. Anyone scanning the agenda or `git log`
+can see both.
+
+**Note on the top-level case.** A `**` VERIFY completes exactly like a `**`
+`TODO`: a `DONE`/`CANCELLED` keyword + `CLOSED:` line, with the answer or
+action in the body. The earlier habit of dating a resolved top-level VERIFY
+— treating "answered question, not a finished task" as license for a `**`
+dated header — is retired. It put dated headers at level 2, where the agenda
+truncates them out of a clean keyword scan. Dated rewrite is for `***` and
+deeper only; `**` always carries a terminal keyword.
 
 ### Don't leave stale placeholders
 
diff --git a/claude-templates/.ai/workflows/process-inbox.org b/claude-templates/.ai/workflows/process-inbox.org
index af406ee..687767e 100644
--- a/claude-templates/.ai/workflows/process-inbox.org
+++ b/claude-templates/.ai/workflows/process-inbox.org
@@ -191,7 +191,7 @@ Rename in place to =inbox/PROCESSED-<original-filename>= and add a brief comment
 
 ** Park (Skeptical Review in a no-approvals session)
 
-Move the proposal file into =working/<task-slug>/= alongside the prepared diff, file the =[#B]= VERIFY per the Skeptical Review section, reply to the sender that it's parked for Craig's review, and delete the inbox file. On Craig's approval the apply is mechanical: apply the prepared edits, run the normal verify-and-publish flow, rewrite the VERIFY to a dated log entry per =todo-format.md=, and send the sender the acceptance reply. On rejection, the reject-from-another-project flow above runs unchanged.
+Move the proposal file into =working/<task-slug>/= alongside the prepared diff, file the =[#B]= VERIFY per the Skeptical Review section, reply to the sender that it's parked for Craig's review, and delete the inbox file. On Craig's approval the apply is mechanical: apply the prepared edits, run the normal verify-and-publish flow, close the parked =**= VERIFY per =todo-format.md= (a top-level VERIFY resolves to =DONE= + =CLOSED:=, not a dated header), and send the sender the acceptance reply. On rejection, the reject-from-another-project flow above runs unchanged.
 
 * Phase E — Close out
 
diff --git a/todo.org b/todo.org
index 48fd31c..4cf7093 100644
--- a/todo.org
+++ b/todo.org
@@ -34,7 +34,8 @@ Tags are assigned and refreshed by =task-audit=; =task-review= keeps them honest
 
 * Rulesets Open Work
 
-** 2026-06-20 Sat @ 21:59:42 -0400 ~/.dotfiles discovery added to ai launcher; bootstrapped on velox
+** DONE [#B] ~/.dotfiles discovery added to ai launcher; bootstrapped on velox
+CLOSED: [2026-06-20 Sat]
 Craig reported =~/.dotfiles= missing from the launcher picker. Two root causes, both fixed: (1) applied the parked one-liner =maybe_add_candidate "$HOME/.dotfiles"= in =build_candidates()= (=claude-templates/bin/ai=, after the =~/.emacs.d= line); (2) =~/.dotfiles/.ai/= was absent on velox — the 2026-06-16 bootstrap was on another machine and =.ai/= is gitignored, so it never traveled — re-bootstrapped via =install-ai.sh --gitignore ~/.dotfiles=.
 
 Verified end-to-end: =build_candidates()= now lists =~/.dotfiles= (protocols.org guard passes). sync-check clean (bin/ai is single-canonical, no mirror). By-name launch =ai ~/.dotfiles= already worked via single_mode's marker-only check. working/ai-dotfiles-discovery/ staging dir removed.
@@ -175,7 +176,8 @@ Expected: all four behave per the spec; any miss promotes to a bug task. (Agent-
 *** 2026-06-10 Wed @ 18:21:33 -0500 Phase 4 done — monthly hygiene automation live
 =scripts/kb-hygiene.sh= (6 bats green, shellcheck clean, read-only by design) inventories =:agent:= nodes, flags orphans / duplicate titles / conflict files, and writes an org report into the rulesets inbox; =roam-hygiene.timer= (monthly, Persistent) installed + enabled. Live run against the real KB verified (4 agent nodes, 428 files, 0 conflicts). Conditional vNext stays in the spec's scope tiers: a =/promote= command if the wrap-up prompt proves insufficient, an =:agent:inbox:= staging tag if free writes prove too noisy. Commit b014095.
 
-** 2026-06-16 Tue @ 00:53:36 -0500 Phase E spec'd — folded into the autonomous-batch spec
+** DONE Phase E spec'd — folded into the autonomous-batch spec
+CLOSED: [2026-06-16 Tue]
 :PROPERTIES:
 :CREATED: [2026-06-16 Tue]
 :END:
@@ -2693,7 +2695,8 @@ What we're verifying: the SessionStart(clear) hook fires and the fresh context r
 - In any project session with a live .ai/session-context.org (this rulesets session qualifies), type /clear
 - Send any short message (the injected context loads but the model waits for your next keystroke)
 Expected: the reply starts with "flushed." on its own line, restates the Active Goal and immediate Next Step, and does NOT run the startup workflow.
-** 2026-06-12 Fri @ 02:56:58 -0500 New personal projects are home regroupings — no mechanism needed
+** DONE New personal projects are home regroupings — no mechanism needed
+CLOSED: [2026-06-12 Fri]
 Craig's call (2026-06-12): new personal projects will live in home, and there's no project-creation mechanism to build — he'll be working in home and simply decide to group some things differently. Nothing to do.
 
 Concurrence, verified: no template doc directs new personal work into ~/projects (first-session.org, install-ai.sh, and the README carry no such guidance; the only ~/projects references are discovery-root scans, which home and work still need). The situation as it stands: a new personal "project" is an area dir plus tasks inside home's existing =.ai/= machinery, no bootstrap step; =first-session.org= remains the bootstrap for standalone code projects in ~/code, unchanged and correct; "launch finances"-style trigger phrases for folded names degrade politely to the no-match candidate list, worth work only if real friction shows up.