docs(todo): add follow-ups for category-3 rules and language-rule audit

Two open decisions from the 2026-05-07 rulesets centralization pass:

- Category-3 rule copies in the deepsat tree (`coding-rulesets/` and `orchestration_dashboard_mvp/`) — read each and decide between leave, sync, or symlink.
- Language-specific rule files (python-testing, typescript-testing, elisp-testing, elisp) duplicated across multiple project mirrors — audit and possibly canonicalize.

1 files changed, 19 insertions, 0 deletions

diff --git a/todo.org b/todo.org
index 99adf6a..e2abbc0 100644
--- a/todo.org
+++ b/todo.org
@@ -1821,3 +1821,22 @@ Resolved during implementation:
 - Reporting: skill prints "Summary of changes" listing which patterns fired (audit value).
 - Public-artifact scope check (#39): flag-only, user resolves manually. Blocking would frustrate on legitimate path mentions.
 - Tier 1 active-voice detection: suggestion-only in v1. Auto-rewrite for unambiguous cases deferred to v2.
+
+* TODO [#C] Decide on category-3 rule copies in the deepsat tree
+
+While symlinking personal-project =.claude/rules/= mirrors to the rulesets canonical on 2026-05-07, two locations didn't fit the "personal mirror → symlink" pattern and were left untouched pending judgment:
+
+- =~/projects/work/deepsat/code/coding-rulesets/claude-rules/{testing,verification}.md= — looks like a vendored team-shared copy.
+- =~/projects/work/deepsat/code/orchestration_dashboard_mvp/.claude/rules/{testing,verification}.md= — could be project-specific overrides.
+
+For each: read the file, diff against the rulesets canonical, decide whether it's an intentional diverge (leave alone), stale (sync content), or should canonicalize (replace with symlink and accept the cross-repo dependency). The orchestration_dashboard_mvp pair is the project where Vrezh's PR review surfaced this whole thread, so any decision there has team-visibility implications.
+
+* TODO [#C] Audit language-specific rule files for cross-project duplication
+
+The four canonical rules (=commits=, =testing=, =verification=, =subagents=) are now symlinked across the five personal-project mirrors as of 2026-05-07. But several language-specific rule files exist in multiple project mirrors and may be duplicated or drifted:
+
+- =python-testing.md= in =~/projects/work/.claude/rules/=
+- =typescript-testing.md= in =~/projects/work/deepsat/code/.claude/rules/=
+- =elisp-testing.md= and =elisp.md= in =~/.emacs.d/=, =~/code/gloss/=, =~/code/chime/=
+
+The Elisp pair is the most suspicious — three repos using essentially the same rules. Audit: diff these across the projects, check for drift, then decide whether to canonicalize them under =~/code/rulesets/claude-rules/languages/<lang>/= and symlink, or leave them as project-local.