fix: harden the org-file mutators and close four verified bugs

An overnight hygiene run over this repo, reviewed adversarially afterward. Every problem below was reproduced before it was fixed, and every fix was re-checked by a skeptic who was told to refute it.

cj-remove-block could silently destroy content. Its range check validated only the first and last lines, so a span from one cj block's opener to a later block's closer passed and the removal deleted everything between — prose, headings, whole tasks, with a zero exit. That is the failure the check exists to prevent, and drift is its normal case, since the calling skill edits the file while processing. It now refuses a range holding more than one block, backs up first, and writes atomically while preserving the file's mode and following symlinks to the real target.

todo-cleanup rewrote todo.org with no backup, alone among the three tools that mutate these files. It now copies to the temp dir like lint-org does. Both backup helpers suffix rather than overwrite, because a second-resolution stamp collapsed two back-to-back invocations into one backup holding already-mutated content — and running todo-cleanup twice in a row is the shipped path.

audit.bats failed about one run in eight, in teardown rather than in its assertions, so a passing test reported as a false red. git commit spawns a detached maintenance process that is still writing packs when the commit returns, racing the cleanup. The fixture disables it.

route_recommend downgraded a correct strong match to weak when two projects shared a basename. lint.sh now sweeps the scripts that get symlinked onto PATH, which were the only shell in the repo with no gate over them.

Two test defects found in review and fixed here: a suite that deleted real backups from the shared temp dir, and one that depended on that directory's contents. Isolation now lives in an autouse fixture rather than in each test's memory.

Known and filed, not closed: the range check still cannot prove the range is the block that was scanned, so drift by exactly one whole block deletes the wrong annotation. That needs a content assertion and a CLI contract change.

8 files changed, 577 insertions, 4 deletions

diff --git a/.ai/metrics/work-the-backlog.jsonl b/.ai/metrics/work-the-backlog.jsonl
index f7bb44b..88c6764 100644
--- a/.ai/metrics/work-the-backlog.jsonl
+++ b/.ai/metrics/work-the-backlog.jsonl
@@ -7,3 +7,9 @@
 {"ts":"2026-07-23T23:57:59-05:00","run_id":"711400a5-c6bc-4684-b928-6b818d0d33f2","project":"rulesets","caller":"speedrun","task":"inbox-send two smaller defects","outcome":"implemented-committed","upfront_decision":false,"commit_sha":"a053e9d","review_findings":0}
 {"ts":"2026-07-24T00:02:14-05:00","run_id":"711400a5-c6bc-4684-b928-6b818d0d33f2","project":"rulesets","caller":"speedrun","task":"lint-org todo-format checkers fire on specs","outcome":"implemented-committed","upfront_decision":true,"commit_sha":"c38bab9","review_findings":0}
 {"ts":"2026-07-24T00:02:49-05:00","run_id":"711400a5-c6bc-4684-b928-6b818d0d33f2","project":"rulesets","caller":"speedrun","task":"notes.org template four lint flags","outcome":"already-satisfied","defer_reason":"already-satisfied","upfront_decision":false,"commit_sha":"","review_findings":0}
+{"ts":"2026-07-24T01:41:14-05:00","run_id":"sentry-fire2-1784875274","project":"rulesets","caller":"loop","task":"cj-remove-block over-deletion + unsafe write","outcome":"implemented-committed","upfront_decision":false,"commit_sha":"17f5d48","review_findings":0}
+{"ts":"2026-07-24T01:43:52-05:00","run_id":"sentry-fire2","project":"rulesets","caller":"loop","task":"route_recommend duplicate-name tier downgrade","outcome":"implemented-committed","upfront_decision":false,"commit_sha":"1b0f284","review_findings":0}
+{"ts":"2026-07-24T02:38:48-05:00","run_id":"sentry-fire3","project":"rulesets","caller":"loop","task":"audit.bats flaky teardown","outcome":"implemented-committed","upfront_decision":false,"commit_sha":"7f45d4b","review_findings":0}
+{"ts":"2026-07-24T03:39:16-05:00","run_id":"sentry-fire4","project":"rulesets","caller":"loop","task":"todo-cleanup missing backup","outcome":"implemented-committed","upfront_decision":false,"commit_sha":"0686784","review_findings":0}
+{"ts":"2026-07-24T04:36:09-05:00","run_id":"sentry-fire5","project":"rulesets","caller":"loop","task":"attachment filename sanitization","outcome":"deferred-verify","defer_reason":"needs-deliberation","upfront_decision":false,"commit_sha":"","review_findings":0}
+{"ts":"2026-07-24T07:38:47-05:00","run_id":"sentry-fire8","project":"rulesets","caller":"loop","task":"bin/ lint coverage gap","outcome":"implemented-committed","upfront_decision":false,"commit_sha":"f91feef","review_findings":1}
diff --git a/.ai/scripts/cj-remove-block.py b/.ai/scripts/cj-remove-block.py
index 71c7b3d..d5137a3 100755
--- a/.ai/scripts/cj-remove-block.py
+++ b/.ai/scripts/cj-remove-block.py
@@ -16,8 +16,12 @@ Companion to the /respond-to-cj-comments skill and to cj-scan.py.
 from __future__ import annotations
 
 import argparse
+import os
 import re
+import shutil
 import sys
+import tempfile
+from datetime import datetime
 from pathlib import Path
 
 SRC_OPEN_RE = re.compile(r"^\s*#\+begin_src\s+cj:", re.IGNORECASE)
@@ -57,12 +61,83 @@ def looks_like_cj_range(lines: list[str], start: int, end: int) -> tuple[bool, s
             f"Line {end} does not look like a #+end_src closing fence "
             f"(got: {last[:60]!r})"
         )
+
+    # The range must hold exactly ONE block. Checking only the first and last
+    # lines let a drifted range run from one block's opener to a *later* block's
+    # closer: validation passed and the removal silently deleted everything
+    # between, prose and headings included. Drift is the case this check exists
+    # for, so it has to look inside the range, not just at its ends.
+    for offset, line in enumerate(lines[start:end - 1], start=start + 1):
+        if SRC_CLOSE_RE.match(line):
+            return False, (
+                f"Range {start}..{end} covers more than one cj block — "
+                f"a #+end_src appears at line {offset}, before the range ends. "
+                f"Re-scan for current line numbers; removing this range would "
+                f"delete everything between the two blocks."
+            )
+        if SRC_OPEN_RE.match(line):
+            return False, (
+                f"Range {start}..{end} covers more than one cj block — "
+                f"a second #+begin_src cj: appears at line {offset}. "
+                f"Re-scan for current line numbers."
+            )
     return True, ""
 
 
+def _backup(path: Path) -> Path:
+    """Copy path to /tmp before mutating it, mirroring lint-org.el's convention.
+
+    These are Craig's org files. lint-org.el, the other tool that rewrites them,
+    leaves a /tmp copy before touching anything; this matches it so a bad edit is
+    always recoverable without reaching for git (which only reaches the last
+    commit, losing intra-session work).
+    """
+    stamp = datetime.now().strftime("%Y%m%d-%H%M%S")
+    base = Path(tempfile.gettempdir()) / f"{path.name}.before-cj-remove.{stamp}"
+    # Never overwrite an earlier backup. The skill removes several annotations
+    # in quick succession, so a second-resolution stamp collides and the later
+    # copy would replace the earlier one with already-mutated content — losing
+    # the pre-session original the backup exists to preserve.
+    dest = base
+    n = 2
+    while dest.exists():
+        dest = base.with_name(f"{base.name}-{n}")
+        n += 1
+    shutil.copy2(path, dest)
+    return dest
+
+
+def _atomic_write(path: Path, text: str) -> None:
+    """Write text to path via a temp sibling and os.replace.
+
+    A bare write_text truncates the target on open, so a mid-write failure left
+    the org file truncated with no complete copy on disk. Writing a temp sibling
+    and renaming means the file is either its old content or its new content,
+    never a partial.
+    """
+    # Follow a symlink to the file it names. os.replace would otherwise swap the
+    # symlink itself for a regular file, leaving the real target holding the old
+    # content — the edit silently goes nowhere. Resolving also puts the temp
+    # sibling on the same filesystem as the real file, which os.replace needs.
+    path = path.resolve()
+    fd, tmp = tempfile.mkstemp(dir=path.parent, prefix=f".{path.name}.", suffix=".tmp")
+    os.close(fd)
+    tmp_path = Path(tmp)
+    # Carry the original's permissions across. mkstemp creates 0600, and
+    # defaulting to the umask instead widened a deliberately-restricted file
+    # (a 0600 org file came back 0644).
+    shutil.copymode(path, tmp_path)
+    try:
+        tmp_path.write_text(text, encoding="utf-8")
+        os.replace(tmp_path, path)
+    except BaseException:
+        tmp_path.unlink(missing_ok=True)
+        raise
+
+
 def remove_range(path: Path, start: int, end: int) -> None:
     """Read path, validate range looks like cj content, remove the range, write back."""
-    text = path.read_text()
+    text = path.read_text(encoding="utf-8")
     had_trailing_newline = text.endswith("\n")
     lines = text.splitlines(keepends=False)
 
@@ -77,7 +152,9 @@ def remove_range(path: Path, start: int, end: int) -> None:
         new_text += "\n"
     elif not new_lines and had_trailing_newline:
         new_text = ""
-    path.write_text(new_text)
+
+    _backup(path)
+    _atomic_write(path, new_text)
 
 
 def main() -> int:
diff --git a/.ai/scripts/route_recommend.py b/.ai/scripts/route_recommend.py
index 7b36405..12ab132 100644
--- a/.ai/scripts/route_recommend.py
+++ b/.ai/scripts/route_recommend.py
@@ -71,6 +71,15 @@ def recommend(item: str, projects: list[str]) -> tuple[str | None, str]:
     if not projects:
         return (None, "none")
 
+    # Collapse identical names first. Projects are addressed by bare basename, so
+    # two projects sharing one across roots (~/code/notes, ~/projects/notes) arrive
+    # twice; both literal-match, and the tie test below then read that as ambiguity
+    # and downgraded a correct strong match to weak. Deduping here rather than in
+    # discover_destination_names protects every caller of the pure core, not just
+    # the CLI path. Order-preserving, and it collapses only identical names — two
+    # *different* projects matching is real ambiguity and still downgrades.
+    projects = list(dict.fromkeys(projects))
+
     item_lower = item.lower()
     item_tokens = _tokens(item)
 
diff --git a/.ai/scripts/tests/test-todo-cleanup.el b/.ai/scripts/tests/test-todo-cleanup.el
index 838913f..a92d238 100644
--- a/.ai/scripts/tests/test-todo-cleanup.el
+++ b/.ai/scripts/tests/test-todo-cleanup.el
@@ -516,6 +516,12 @@ gitignore todo.org, then run `--archive-done' aging with the DEFAULT archive pat
 .gitignore contents or nil), :archive-ignored (whether git ignores the archive),
 :archive-exists."
   (let* ((root (make-temp-file "tc-git-" t))
+         ;; Private backup dir: this helper writes a file literally named
+         ;; todo.org and runs a real (non-check) pass, so without this its
+         ;; backup lands in the shared temp dir under the exact production
+         ;; name and is indistinguishable from a real one.
+         (temporary-file-directory
+          (file-name-as-directory (make-temp-file "tc-git-bk-" t)))
          (todo (expand-file-name "todo.org" root))
          (archive (expand-file-name "archive/task-archive.org" root))
          (gi (expand-file-name ".gitignore" root)))
@@ -536,7 +542,8 @@ gitignore todo.org, then run `--archive-done' aging with the DEFAULT archive pat
                 :archive-ignored
                 (eq 0 (call-process "git" nil nil nil "check-ignore" "-q" archive))
                 :archive-exists (file-readable-p archive)))
-      (delete-directory root t))))
+      (delete-directory root t)
+      (delete-directory temporary-file-directory t))))
 
 (ert-deftest tc-age-self-protect-gitignores-archive-when-todo-ignored ()
   "When the todo file is gitignored, the aged-out archive is added to .gitignore
@@ -1073,3 +1080,97 @@ line) is left untouched — the strip stops at the first non-planning line."
 
 (provide 'test-todo-cleanup)
 ;;; test-todo-cleanup.el ends here
+
+;;; ---------------------------------------------------------------------------
+;;; Backup before mutating (parity with lint-org.el / wrap-org-table.el)
+;;
+;; todo-cleanup rewrites todo.org in place and left no copy behind, while both
+;; sibling org-mutators back up to /tmp first. It is also the one that runs most
+;; often (every wrap, every sentry fire). Emacs's own backup does not fire under
+;; --batch -q, so there was genuinely no undo short of git.
+
+(ert-deftest tc-backup-written-before-a-real-mutation ()
+  "A real (non-check) run leaves a copy holding the pre-edit content.
+
+`temporary-file-directory' is rebound to a private dir for the duration: the
+backup name derives from the *file's* basename, and the real todo.org shares
+that basename, so a live sentry run writing /tmp/todo.org.before-todo-cleanup.*
+would otherwise be indistinguishable from this test's own artifact. The first
+version of this test globbed the shared /tmp and passed only until a real run
+created one (2026-07-24)."
+  (let* ((dir (make-temp-file "tc-backup-" t))
+         (bdir (file-name-as-directory (make-temp-file "tc-bk-" t)))
+         (file (expand-file-name "todo.org" dir))
+         (before "* P Open Work\n** TODO [#B] parent\n*** DONE a subtask\nCLOSED: [2026-07-01 Tue]\n"))
+    (unwind-protect
+        (progn
+          (with-temp-file file (insert before))
+          (let ((tc-check-only nil)
+                (tc-convert-subtasks t)
+                (temporary-file-directory bdir))
+            (tc-process-file file))
+          (let ((backups (file-expand-wildcards
+                          (concat bdir "todo.org.before-todo-cleanup.*"))))
+            (should backups)
+            (should (string-match-p
+                     "a subtask"
+                     (with-temp-buffer (insert-file-contents (car backups))
+                                       (buffer-string))))))
+      (delete-directory dir t)
+      (delete-directory bdir t))))
+
+(ert-deftest tc-no-backup-in-check-mode ()
+  "--check writes nothing, so it must not leave a backup either.
+Uses a private `temporary-file-directory' for the same isolation reason."
+  (let* ((dir (make-temp-file "tc-backup-" t))
+         (bdir (file-name-as-directory (make-temp-file "tc-bk-" t)))
+         (file (expand-file-name "todo.org" dir)))
+    (unwind-protect
+        (progn
+          (with-temp-file file
+            (insert "* P Open Work\n** TODO [#B] parent\n*** DONE sub\nCLOSED: [2026-07-01 Tue]\n"))
+          (let ((tc-check-only t)
+                (tc-convert-subtasks t)
+                (temporary-file-directory bdir))
+            (tc-process-file file))
+          (should-not (file-expand-wildcards
+                       (concat bdir "todo.org.before-todo-cleanup.*"))))
+      (delete-directory dir t)
+      (delete-directory bdir t))))
+
+(ert-deftest tc-backup-never-overwrites-an-earlier-one ()
+  "Two invocations in the same second must not collapse to one backup.
+
+open-tasks.org runs --convert-subtasks then --archive-done back to back, each
+a sub-second batch run. With a second-resolution stamp and copy-file's
+OK-IF-ALREADY-EXISTS, the second invocation overwrote the first's backup with
+already-mutated content, so the true pre-session original was unrecoverable —
+the exact state the backup exists to preserve (found 2026-07-24 in review)."
+  (let* ((dir (make-temp-file "tc-collide-" t))
+         (bdir (file-name-as-directory (make-temp-file "tc-cbk-" t)))
+         (file (expand-file-name "todo.org" dir))
+         (original (concat "* P Open Work\n** TODO [#B] parent\n*** DONE sub\n"
+                           "CLOSED: [2026-07-01 Tue]\n"
+                           "* P Resolved\n** DONE [#C] old\nCLOSED: [2025-01-01 Wed]\n")))
+    (unwind-protect
+        (progn
+          (with-temp-file file (insert original))
+          ;; Two back-to-back invocations, as the shipped workflow does.
+          (let ((temporary-file-directory bdir))
+            (let ((tc-check-only nil) (tc-convert-subtasks t))
+              (tc-process-file file))
+            (let ((tc-check-only nil) (tc-convert-subtasks nil) (tc-archive-done t)
+                  (tc-archive-retain-days nil))
+              (tc-process-file file)))
+          (let ((backups (file-expand-wildcards
+                          (concat bdir "todo.org.before-todo-cleanup.*"))))
+            ;; Both invocations kept their own backup.
+            (should (= (length backups) 2))
+            ;; And one of them still holds the true original.
+            (should (cl-some (lambda (b)
+                               (string= original
+                                        (with-temp-buffer (insert-file-contents b)
+                                                          (buffer-string))))
+                             backups))))
+      (delete-directory dir t)
+      (delete-directory bdir t))))
diff --git a/.ai/scripts/tests/test_cj_remove_block.py b/.ai/scripts/tests/test_cj_remove_block.py
index 2c8dade..3cdee46 100644
--- a/.ai/scripts/tests/test_cj_remove_block.py
+++ b/.ai/scripts/tests/test_cj_remove_block.py
@@ -14,6 +14,34 @@ import pytest
 SCRIPT = Path(__file__).parent.parent / "cj-remove-block.py"
 
 
+@pytest.fixture(autouse=True)
+def isolated_tmpdir(tmp_path, monkeypatch):
+    """Give every test in this module a private TMPDIR.
+
+    The script backs up to the system temp dir under a name derived from the
+    edited file's BASENAME. The real todo.org shares that basename, so any test
+    operating on a fixture named todo.org writes something indistinguishable
+    from a production backup — and an earlier version of this file globbed the
+    shared /tmp and unlinked every match, so a routine `make test` destroyed
+    Craig's real backups (found in review, 2026-07-24).
+
+    Isolating at module scope rather than per-test is deliberate: the same bug
+    was fixed once in the elisp sibling and left here, so relying on each new
+    test to remember is exactly how it recurred. Autouse makes it structural.
+    """
+    d = tmp_path / "_tmpdir"
+    d.mkdir()
+    # TMPDIR covers subprocess invocations of the script.
+    monkeypatch.setenv("TMPDIR", str(d))
+    # tempfile.gettempdir() caches its answer on first call, so a test that
+    # loads the module in-process would keep writing to the real /tmp no matter
+    # what TMPDIR says. Override the cache too — this is the gap that made the
+    # env-var-only version still leak one backup per suite run.
+    import tempfile as _tempfile
+    monkeypatch.setattr(_tempfile, "tempdir", str(d))
+    return d
+
+
 @pytest.fixture
 def run_remove(tmp_path):
     """Write content to a temp org file, run cj-remove-block, return new contents."""
@@ -155,3 +183,142 @@ class TestCjRemoveBlockSafety:
         err, post_content = run_remove_expecting_failure(original, start=4, end=2)
         assert err.returncode != 0
         assert post_content == original
+
+
+class TestMultiBlockRangeRefused:
+    """The validation exists to catch a drifted range, but it only checked the
+    first and last lines of that range. A span from one block's opening fence to
+    a LATER block's closing fence passed, and the removal silently deleted every
+    line between — real prose, headings, whole tasks — with a zero exit. Drift is
+    the skill's normal operating mode (respond-to-cj-comments edits the file as it
+    processes, and a file under cj review usually holds several blocks), so this
+    is the exact scenario the check was written for. Reproduced 2026-07-24."""
+
+    TWO_BLOCKS = (
+        "* Alpha\n"
+        "#+begin_src cj:\n"
+        "note A\n"
+        "#+end_src\n"
+        "KEEP THIS LINE\n"
+        "* Beta\n"
+        "#+begin_src cj:\n"
+        "note B\n"
+        "#+end_src\n"
+    )
+
+    def test_range_spanning_two_blocks_is_refused(self, run_remove_expecting_failure):
+        # Lines 2..9: block one's opener through block two's closer.
+        err, content = run_remove_expecting_failure(self.TWO_BLOCKS, 2, 9)
+        assert err.returncode == 1
+        assert "KEEP THIS LINE" in content, "content between the blocks was destroyed"
+        assert "* Beta" in content, "a heading between the blocks was destroyed"
+
+    def test_refusal_names_the_reason(self, run_remove_expecting_failure):
+        err, _ = run_remove_expecting_failure(self.TWO_BLOCKS, 2, 9)
+        assert "more than one" in err.stderr.decode().lower()
+
+    def test_a_correct_single_block_range_still_removes(self, run_remove):
+        # The fix must not over-tighten: the legitimate range still works.
+        out = run_remove(self.TWO_BLOCKS, 2, 4)
+        assert "note A" not in out
+        assert "KEEP THIS LINE" in out
+        assert "note B" in out, "the second block must be untouched"
+
+    def test_a_nested_end_src_inside_the_range_is_refused(self, run_remove_expecting_failure):
+        # Any #+end_src before the final line means the range covers >1 block.
+        content = (
+            "#+begin_src cj:\n"
+            "a\n"
+            "#+end_src\n"
+            "middle\n"
+            "#+begin_src cj:\n"
+            "b\n"
+            "#+end_src\n"
+        )
+        err, after = run_remove_expecting_failure(content, 1, 7)
+        assert err.returncode == 1
+        assert "middle" in after
+
+
+class TestSafeMutation:
+    """The script rewrites Craig's org files (todo.org, notes.org). It wrote with
+    a bare write_text, which truncates the target on open, and took no backup —
+    so a mid-write failure left the file truncated with no copy to recover from.
+    lint-org.el, the other tool that mutates these files, backs up to a temp dir
+    first. Match that, and make the write atomic.
+
+    Every test here redirects TMPDIR to a private directory. The backup name
+    derives from the file's basename, and the real todo.org shares it, so a test
+    globbing the shared temp dir cannot tell its own artifact from a genuine
+    backup — and an earlier version of this class globbed /tmp and unlinked every
+    match, so a routine `make test` destroyed real backups (found in review,
+    2026-07-24). Never glob or delete across the shared temp dir."""
+
+    ONE_BLOCK = "* T\n#+begin_src cj:\nnote\n#+end_src\nkeep\n"
+
+    def test_a_backup_is_written_before_mutating(self, tmp_path):
+        import subprocess, glob, os
+        bdir = tmp_path / "bk"
+        bdir.mkdir()
+        f = tmp_path / "todo.org"
+        f.write_text(self.ONE_BLOCK)
+        subprocess.run(
+            ["python3", str(SCRIPT), "--file", str(f), "--start", "2", "--end", "4"],
+            check=True, capture_output=True,
+            env={**os.environ, "TMPDIR": str(bdir)},
+        )
+        backups = glob.glob(str(bdir / "todo.org.before-cj-remove.*"))
+        assert backups, "no backup was written before mutating the org file"
+        assert "note" in Path(max(backups)).read_text()
+
+    def test_no_partial_file_when_the_write_fails(self, tmp_path, monkeypatch):
+        import importlib.util
+        spec = importlib.util.spec_from_file_location("crb", SCRIPT)
+        mod = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(mod)
+        bdir = tmp_path / "bk"
+        bdir.mkdir()
+        monkeypatch.setenv("TMPDIR", str(bdir))
+        f = tmp_path / "todo.org"
+        f.write_text(self.ONE_BLOCK)
+        def boom(*a, **k):
+            raise OSError("disk full")
+        monkeypatch.setattr(mod.os, "replace", boom)
+        with pytest.raises(OSError):
+            mod.remove_range(f, 2, 4)
+        # The original survives intact — no truncation, no partial.
+        assert f.read_text() == self.ONE_BLOCK
+
+
+class TestBackupNeverOverwrites:
+    """Same defect class as todo-cleanup's, and more reachable here: the
+    respond-to-cj-comments skill removes several annotations in quick
+    succession, so a second-resolution stamp collides and the later backup
+    overwrote the earlier one with already-mutated content."""
+
+    TWO_BLOCKS = (
+        "* A\n#+begin_src cj:\nfirst\n#+end_src\n"
+        "* B\n#+begin_src cj:\nsecond\n#+end_src\n"
+    )
+
+    def test_consecutive_removals_each_keep_a_backup(self, tmp_path, monkeypatch):
+        import subprocess, glob
+        bdir = tmp_path / "bk"
+        bdir.mkdir()
+        monkeypatch.setenv("TMPDIR", str(bdir))
+        f = tmp_path / "todo.org"
+        f.write_text(self.TWO_BLOCKS)
+        original = f.read_text()
+        # Remove the second block, then the first — back to back, same second.
+        subprocess.run(["python3", str(SCRIPT), "--file", str(f),
+                        "--start", "6", "--end", "8"],
+                       check=True, capture_output=True,
+                       env={**__import__("os").environ, "TMPDIR": str(bdir)})
+        subprocess.run(["python3", str(SCRIPT), "--file", str(f),
+                        "--start", "2", "--end", "4"],
+                       check=True, capture_output=True,
+                       env={**__import__("os").environ, "TMPDIR": str(bdir)})
+        backups = glob.glob(str(bdir / "todo.org.before-cj-remove.*"))
+        assert len(backups) == 2, f"expected 2 backups, got {len(backups)}"
+        contents = [Path(b).read_text() for b in backups]
+        assert original in contents, "no backup holds the true original"
diff --git a/.ai/scripts/tests/test_route_recommend.py b/.ai/scripts/tests/test_route_recommend.py
index acc4755..2ec900a 100644
--- a/.ai/scripts/tests/test_route_recommend.py
+++ b/.ai/scripts/tests/test_route_recommend.py
@@ -122,3 +122,31 @@ def test_cli_exclude_drops_current_project(tmp_path):
     r = _run(["--exclude", "foo"], roots=[tmp_path / "projects"], item="fix the foo widget")
     assert r.returncode == 0
     assert r.stdout.strip() == "none"
+
+
+# ----------------------------------------------------------------------
+# Duplicate candidate names
+#
+# Projects are collapsed to bare basenames, so two projects sharing a basename
+# across roots (~/code/notes and ~/projects/notes) appear twice in the candidate
+# list. Both literal-match, recommend read len(strong) > 1 as an ambiguous tie,
+# and a correct strong match was downgraded to weak. Latent when discovered
+# 2026-07-24 (27 projects, 27 distinct basenames) but real.
+# ----------------------------------------------------------------------
+
+def test_duplicate_candidate_name_keeps_strong_confidence():
+    assert rr.recommend("fix the notes thing", ["notes", "other"]) == ("notes", "strong")
+    # The same name twice must not read as a tie.
+    assert rr.recommend("fix the notes thing", ["notes", "notes", "other"]) == ("notes", "strong")
+
+
+def test_genuine_ambiguity_still_downgrades():
+    # Two DIFFERENT projects both matching is a real tie and stays weak — the
+    # dedupe must collapse identical names only, never real ambiguity.
+    dest, conf = rr.recommend("notes and other both", ["notes", "other"])
+    assert conf == "weak"
+
+
+def test_duplicates_do_not_change_the_chosen_destination():
+    dest, _ = rr.recommend("fix the notes thing", ["notes", "notes"])
+    assert dest == "notes"
diff --git a/.ai/scripts/todo-cleanup.el b/.ai/scripts/todo-cleanup.el
index c4a87de..cb333e2 100644
--- a/.ai/scripts/todo-cleanup.el
+++ b/.ai/scripts/todo-cleanup.el
@@ -100,6 +100,12 @@
 ;;   --check-child-priority is the report-only alias for --sync-child-priority
 ;;   --check.
 
+;; Before any modification a backup is copied to
+;;   /tmp/<basename>.before-todo-cleanup.<YYYYMMDD-HHMMSS>
+;; matching lint-org.el and wrap-org-table.el. Skipped under --check, which
+;; writes nothing.
+;;
+
 (require 'org)
 (require 'cl-lib)
 (require 'calendar)
@@ -832,9 +838,37 @@ event-log entry, pulling the timestamp from its CLOSED cookie.  Honors
 ;;; ---------------------------------------------------------------------------
 ;;; Driver + reporting
 
+(defun tc--backup (file)
+  "Copy FILE to /tmp before any modification.  Skipped in --check mode.
+
+Matches `lint-org.el' and `wrap-org-table.el', the other tools that rewrite
+these org files. todo-cleanup runs the most often of the three (every wrap,
+every sentry fire), and Emacs's own backup does not fire under --batch -q, so
+without this a mechanical rewrite has no undo short of git — which recovers
+only to the last commit and loses intra-session work."
+  (let* ((base (format "%s%s.before-todo-cleanup.%s"
+                       temporary-file-directory
+                       (file-name-nondirectory file)
+                       (format-time-string "%Y%m%d-%H%M%S")))
+         (backup base)
+         (n 2))
+    ;; Never overwrite an earlier backup. A second-resolution stamp collides
+    ;; when two invocations run back to back, which the shipped workflow does
+    ;; (open-tasks.org runs --convert-subtasks then --archive-done, each a
+    ;; sub-second batch run). Overwriting there replaces the true pre-session
+    ;; original with already-mutated content — losing exactly what the backup
+    ;; exists to preserve. Suffix instead, so every invocation keeps its own.
+    (while (file-exists-p backup)
+      (setq backup (format "%s-%d" base n))
+      (setq n (1+ n)))
+    (copy-file file backup nil)
+    backup))
+
 (defun tc-process-file (file)
   (setq tc-current-file (file-name-nondirectory file))
   (setq tc-current-dir (file-name-directory (expand-file-name file)))
+  (unless tc-check-only
+    (tc--backup file))
   (with-current-buffer (find-file-noselect file)
     (org-mode)
     (cond
diff --git a/.ai/session-context.org b/.ai/session-context.org
index e3f539c..d095f80 100644
--- a/.ai/session-context.org
+++ b/.ai/session-context.org
@@ -6,7 +6,7 @@
 
 ** Active Goal
 
-Sentry armed for the night on =sentry/2026-07-23-ratio=, hourly. Morning teardown is Craig's.
+Sentry re-armed for the night 2026-07-24 on =sentry/2026-07-24-ratio=, hourly, with the implement pass ON (=:SENTRY_MAY_IMPLEMENT: yes=). This run implements solo, decision-free tasks and arriving solo work on the branch, never pushing; shared-asset/convention proposals still park. Bug+refactor finding files graded tasks. Every review runs the premise check first (reproduce before judging). Morning teardown + merge is Craig's. Earlier-tonight run (2026-07-24 00:xx) shipped the sentry workflow addition itself (pass 11 refactor finding, pass 12 opt-in implement, the =:SENTRY_MAY_IMPLEMENT:= marker) to main, plus the speedrun (4 solo tasks) and eight parked VERIFYs.
 
 ** Decisions
 
@@ -173,6 +173,157 @@ Filed [#A], SCHEDULED today — the only [#A] of the night. The fix is find-not-
 
 Two fires' worth of evidence now says bundle-to-bundle propagation is where this repo leaks changes.
 
+** 00:51 — Fire 1 of the 2026-07-24 run (working) — first fire with pass 12 live
+
+Lock acquired, branch =sentry/2026-07-24-ratio= verified, tree clean outside the spine. Digest:
+
+- P1 roam pull — ran, already up to date.
+- P2 inbox zero — ran, no-op. Inbox at zero (the question-capture proposal was parked during entry).
+- P3 triage intake — skipped: no active source surviving the mail/messenger exclusion.
+- P4 todo cleanup — ran with real work. =--archive-done= moved three completed speedrun tasks out of Open Work into Resolved; =--convert-subtasks= normalized the tree. Committed.
+- P5 task audit — mechanical subset. Staleness 13, back to the pre-speedrun baseline now that the four solo tasks closed.
+- P6 working-files hygiene — ran. All =working/= dirs still have open backing VERIFY tasks (the parked proposals). No orphans.
+- P7 spec status board — ran. Two READY specs, nothing stuck.
+- P8 link integrity — ran. The docs-lifecycle spec still shows its two known prose false positives (=file:→id:= and =keep-file:-links-through-pilot=, bare =file:= tokens org parses as bracketless links). Correctly unaffected by tonight's spec-scoping, since =link-to-local-file= is org-lint's own checker, not a todo-format one. No new findings.
+- P9 git health — main level with origin, sentry branch correctly has no upstream, no stale branches.
+- P10 prep freshness — skipped: no =daily-prep/=.
+- P11 bug and refactor finding — ran, first fire under the widened pass. Rotating area: the cross-project routing scripts (=route_recommend.py=, =broadcast.py=), untouched by the previous six areas. One verified latent bug filed [#D] (below). Refactor note not worth a task: =recommend='s two weak-tier branches collapse to a single =_tiebreak= call, since =_tiebreak= on a one-element list returns that element. Two lines, no behavior change, so it's a digest line rather than backlog noise.
+- P12 solo-task implementation — *active this run* (=:SENTRY_MAY_IMPLEMENT: yes=) but a correct no-op: zero eligible tasks. All four open =:solo:= TODOs were completed in tonight's speedrun, so the ready bucket is empty. Nothing to implement, nothing deferred.
+
+*** The finding
+
+=route_recommend='s =discover_destination_names= collapses projects to bare basenames, so two projects sharing a basename across roots would both literal-match and read as an ambiguous tie, downgrading a correct strong match to weak. Reproduced by direct probe. Latent rather than live: 27 projects, 27 distinct basenames today. The destination stays right, only the tier is wrong, so the cost is an extra routing prompt. Filed [#D] with the order-preserving dedupe as the fix.
+
+** 01:33 — Fire 2 (working) — pass 12's first real implementations
+
+Digest:
+
+- P1 roam pull — ran, already up to date.
+- P2 inbox zero — ran. Project inbox at zero. The roam inbox dropped 9 → 5 (another session filed some); all 5 remaining belong to archsetup or work, none rulesets-claimed, so roam mode is correctly a no-op here.
+- P3 triage intake — skipped: no active source.
+- P4 todo cleanup — ran, all three checks clean (fire 1 did the archiving).
+- P5 task audit — mechanical subset. Staleness 13, flat.
+- P6 working-files hygiene — ran. All =working/= dirs still backed by open VERIFYs.
+- P7 spec status board — ran. Two READY specs, nothing stuck.
+- P8 link integrity — ran. Only the docs-lifecycle spec's two known prose false positives.
+- P9 git health — main level with origin, sentry branch correctly upstream-less.
+- P10 prep freshness — skipped: no =daily-prep/=.
+- P11 bug and refactor finding — rotating area: the cj-comment tooling (=cj-scan.py=, =cj-remove-block.py=). Two findings filed, one of them serious.
+- P12 solo-task implementation — *two tasks implemented and committed to the branch* (17f5d48, 1b0f284). Both premise-checked before a line was written.
+
+*** The serious find: cj-remove-block destroys content
+
+=looks_like_cj_range= validated only the first and last lines of a range. A span from one cj block's opener to a *later* block's closer passed, and the removal then deleted everything between — prose, headings, whole tasks — silently, exit 0. That is exactly the failure the check exists to prevent, and drift is its normal case, since =respond-to-cj-comments= edits the file while processing and a file under cj review usually holds several blocks. Reproduced on a two-block fixture that lost a heading and two content lines. Filed [#B], then implemented in pass 12 after an independent re-verification on a different fixture shape.
+
+Same file, second defect fixed alongside: =remove_range= rewrote the org file with a bare =write_text= (truncates on open) and took no backup, so a mid-write failure would leave =todo.org= truncated with nothing to recover from. =lint-org.el= already backs these files up to =/tmp= before mutating; cj-remove-block now matches that and writes atomically.
+
+*** The measurement lesson, third time tonight
+
+A full-suite run went red on =audit.bats= test 4. I stashed my changes, saw it pass clean, and had a one-sample A/B pointing straight at my own diff. Re-ran three times with the changes restored and it passed every time. The failure is an intermittent teardown flake (=rm -rf= racing something still writing into a fixture =.git/objects=), not my change, and I nearly filed the wrong cause off a single sample. Filed [#C] with the git-background-gc theory explicitly labelled a lead rather than a verified cause.
+
+Committed only on a genuinely green re-run, not on the red with a hand-wave.
+
+** 02:33 — Fire 3 (working) — the flake's cause traced, and my own lead disproved
+
+Digest:
+
+- P1 roam pull — ran, already up to date.
+- P2 inbox zero — ran, no-op. Project inbox at zero; roam holds 5, none rulesets-claimed.
+- P3 triage intake — skipped: no active source.
+- P4 todo cleanup — ran. =--archive-done= moved fire 2's two completed tasks to Resolved. Committed.
+- P5 task audit — mechanical subset. Staleness 13, flat.
+- P6 working-files hygiene — ran, all dirs backed.
+- P7 spec status board — ran, two READY, nothing stuck.
+- P8 link integrity — ran, only the known docs-lifecycle prose false positives.
+- P9 git health — main level with origin, branch upstream-less, nothing stale.
+- P10 prep freshness — skipped.
+- P11 bug and refactor finding — no new findings. The fire's whole investigative budget went to confirming fire 2's filed flake, which is the honest place for it; a hunt that finds nothing new is a result.
+- P12 solo-task implementation — one task implemented and committed (7f45d4b).
+
+*** Confirming the cause before fixing, and disproving my own lead
+
+Fire 2 filed the =audit.bats= flaky teardown with a stated theory: =gc.auto='s loose-object threshold. Pass 12's premise check went after that theory rather than the fix, and killed it — a fixture holds five objects against a default threshold of 6700, so that mechanism cannot fire.
+
+The real cause came from a =GIT_TRACE= run: =git commit= spawns =git maintenance run --auto --quiet --detach= on git 2.55. The commit returns while the detached process is still writing a pack, and teardown's =rm -rf= races it. Every failed run had left a =tmp_pack_*= behind, which is the thread that led there.
+
+Fix: =maintenance.auto false= plus =gc.auto 0= in the fixture, killing the background writer rather than retrying the delete (a retry loop hides a live process instead of removing it). Validated over 20 consecutive clean runs against a ~1-in-8 baseline, and recorded honestly in the task that 20 clean runs alone would be ~7% likely by luck — the trace is the evidence, the runs confirm.
+
+This is the second night running where the premise check changed the outcome. Fire 2 it stopped a wrong causation call; here it stopped me implementing a fix for a mechanism that was never operating. Both times the cost of checking was minutes and the cost of not checking would have been a plausible, wrong, committed change.
+
+** 03:33 — Fire 4 (working) — two hypotheses killed, one real gap closed
+
+Digest:
+
+- P1 roam pull — ran, up to date. P2 inbox zero — no-op, both surfaces clean. P3 triage — skipped, no active source.
+- P4 todo cleanup — ran. Archived fire 3's completed task to Resolved. Committed.
+- P5 task audit — mechanical subset. Staleness 13, flat all night.
+- P6 working-files — all dirs backed. P7 spec board — two READY, nothing stuck. P8 link integrity — only the known prose false positives. P9 git health — clean. P10 — skipped, no prep dir.
+- P11 bug and refactor finding — rotating area: the org-file mutators, chosen because =cj-remove-block= yielded a serious find in that same class last fire. One gap filed.
+- P12 solo-task implementation — one task implemented and committed (0686784).
+
+*** What the area review actually found, and what it disproved
+
+The lead was that =todo-cleanup.el= might lose data. It rewrites =todo.org=, creates archive files, and moves subtrees *between* files, which is the shape that bit =cj-remove-block=. Two specific hypotheses, both tested, both wrong:
+
+- *"A mid-move failure loses a subtree from both files."* No. The order is delete-from-buffer, write-archive, save-todo.org-last, so an archive-write failure aborts before the save. Verified by making the archive directory unwritable: exit 255, =todo.org= byte-identical, content intact.
+- *"Errors are swallowed on the mutation path."* No. The only =ignore-errors= in the file wrap =call-process "git"=, never a write.
+
+What survived was narrower and real: todo-cleanup mutates with *no backup*, while both sibling mutators (=lint-org.el=, =wrap-org-table.el=) copy to =/tmp= first, and =cj-remove-block= joined them last fire. It is also the one that runs most often. Confirmed empirically that Emacs's own backup does not fire under =--batch -q=, so there was genuinely no undo short of git. Filed [#C], then implemented in P12.
+
+Also checked my own change for regression rather than assuming: a missing input file exits 255 and creates nothing, identical to the pre-change version tested from git.
+
+*** Running tally on the premise habit
+
+Three fires, three times it changed the outcome. Fire 2 it stopped a wrong causation call. Fire 3 it disproved my own filed =gc.auto= theory before I could implement against it. Here it killed two data-loss hypotheses before they became tasks, leaving only the gap that was actually there. The pattern is consistent: the cheap check keeps a plausible story from becoming a committed change.
+
+** 04:33 — Fire 5 (working) — the first real defer, and last fire's fix proving itself
+
+Digest:
+
+- P1 roam pull — ran, up to date. P2 inbox zero — no-op, both surfaces clean. P3 triage — skipped, no active source.
+- P4 todo cleanup — ran, archived fire 4's completed task. *Confirmed last fire's backup fix working live*: the real =--archive-done= run left =/tmp/todo.org.before-todo-cleanup.20260724-043331=. Dogfooded within an hour of shipping.
+- P5 task audit — staleness 13, flat all night. P6 working-files — all backed. P7 spec board — two READY. P8 link integrity — only the known prose false positives. P9 git health — clean. P10 — skipped.
+- P11 bug and refactor finding — rotating area: the attachment/email handlers, chosen because they parse genuinely untrusted input, unlike every internal-tooling area covered so far. One finding filed.
+- P12 solo-task implementation — *deferred*, and correctly. First defer of the run.
+
+*** The find: attachment filenames are partly sanitized, in two different ways
+
+Both writers derive on-disk names from the =filename= an email declares, and both sanitize incompletely, covering *different* gaps. =eml-view= cleans the name but interpolates the extension raw. =gmail-fetch='s =safe_filename= handles path separators and leading =..= and nothing else. Probed both with the same adversarial set: a =; rm -rf ~= extension survives in both, a literal newline survives in both, a 300-character extension produces a 314-character filename in both.
+
+Two things I checked so this doesn't get over-graded later. Not RCE — files are written through Python =open=, never a shell. Not path traversal — =splitext= only returns an extension when the last dot follows the last separator, so =ext= can never hold a slash, and the traversal case is neutralized in both scripts. The genuine harms are narrower: a newline in a filename breaks downstream tooling that reads the directory as a line-delimited list, and an unbounded extension blows the 255-byte limit so a crafted attachment aborts extraction. Graded [#C] on that honest read rather than the scarier one.
+
+I also corrected my own framing mid-investigation. I first read this as the familiar "one sibling hardened, the other not" pattern from the last two fires. It isn't — =safe_filename= is narrower than it looks, and the two scripts are *differently* incomplete. Neither handles newlines or length.
+
+*** Why pass 12 deferred instead of implementing
+
+The fix itself is clear, but where the shared sanitizer lives is a design call: a shared helper module (clean, but a new synced template file plus =importlib= gymnastics for kebab-named scripts), duplicate it in both (self-contained, but drift — the exact defect class that produced three separate findings tonight), or patch each in place (smallest diff, permanent divergence). That is deliberation, not a quick factual question, so checklist item 4 fires and the unattended loop defers. Filed the VERIFY with the three options and my lean, and left the task *un-=:solo:=-tagged* so a later run doesn't pick it up and guess.
+
+This is the checklist discriminating rather than rubber-stamping. Four fires implemented; this one correctly didn't.
+
+sentry at 05:33: nothing (bug hunt swept =scripts/*.py=; two candidate gaps both disproved — =workflow-integrity.py= *is* gated, its bats runs the real checker against the real canonical tree under =make test=, and =update-skills.py= is an on-demand maintenance command rather than a gate. Recorded so neither gets re-investigated.)
+
+sentry at 06:33: nothing (bug hunt swept =wrap-org-table.el=, the third org-file mutator and the one with prior history — its load-time dispatch caused the 2026-07-09 corruption. Clean on every probe: the entry-script guard correctly refuses to dispatch when lint-org merely =require='s it, it backs up before writing like its siblings, and it is block-aware — a table inside =#+begin_example= stayed verbatim while a real over-budget table wrapped onto continuation rows with rules. Second consecutive quiet hunt.)
+
+** 07:33 — Fire 8 (working) — a time bomb I planted four fires ago went off
+
+Digest: P1-P10 all no-op (roam current, both inboxes clean, todo cleanup clean, staleness 13, working dirs backed, two READY specs, only the known prose link false positives, git clean). P11 found a real coverage gap. P12 implemented it, and the suite caught a regression of my own making.
+
+*** The find: the only ungated shell in the repo
+
+=scripts/lint.sh= sweeps =scripts/*.sh=, the language hooks, and the language githooks. It never touched =claude-templates/bin/= — zero references. Those four scripts (=ai=, =agent-text=, =agent-page=, =install-ai=) are the ones =make install= symlinks onto PATH, which makes them the *most* exposed shell in the repo and left them the only shell with no gate over it. All four are clean today, so the guard is a no-op by design; it exists so a future regression can't pass silently. The =ai= launcher was hardened to 42 tests recently and nothing enforced that going forward.
+
+The test pins *coverage*, not cleanliness: it plants a broken file in each swept location and asserts lint complains, so a location that stops being swept fails the suite rather than passing quietly.
+
+Surfaced a bigger question I did *not* answer overnight: rulesets ships shellcheck enforcement to consuming projects (the bash bundle's pre-commit, =validate-bash.sh=) and runs none on itself. Filed as a VERIFY, because turning it on would surface the false positives dispositioned earlier this session and choosing between fixing them or adding disable-directives is a preference, not a fact.
+
+*** The regression: my own test, detonating on schedule
+
+The full suite went red on the two backup tests I added in fire 4. Not a flake — a time bomb. They globbed =/tmp/todo.org.before-todo-cleanup.*=, but the backup name derives from the file's *basename*, and the real =todo.org= shares it. So a live sentry run's genuine backup was indistinguishable from the test's own artifact, and the check-mode test (which asserts *no* backup exists) failed the moment fire 5's real archive pass created one.
+
+They passed when written only because no real backup existed yet. Three now sit in =/tmp=. Both tests rebind =temporary-file-directory= to a private dir, and I verified they pass with the real backups present rather than by clearing them.
+
+Worth naming plainly: I shipped a test whose correctness depended on the state of a shared directory that the code under test writes to in production. That is the "no shared mutable state" rule in =testing.md=, and I broke it while fixing a different durability bug. The suite caught it two fires later, which is the argument for running the full suite every fire rather than only the touched file.
+
 * Sentry approval queue (2026-07-23)
 
 Five items. Each names what, why, and the exact edit. Items 2 through 5 are also filed as =VERIFY [#B]= tasks in =todo.org= with prepared diffs under =working/=, so they survive this anchor being archived — say "approve the parked <topic>" for any of them.