fix: harden the org-file mutators and close four verified bugs

An overnight hygiene run over this repo, reviewed adversarially afterward. Every problem below was reproduced before it was fixed, and every fix was re-checked by a skeptic who was told to refute it.

cj-remove-block could silently destroy content. Its range check validated only the first and last lines, so a span from one cj block's opener to a later block's closer passed and the removal deleted everything between — prose, headings, whole tasks, with a zero exit. That is the failure the check exists to prevent, and drift is its normal case, since the calling skill edits the file while processing. It now refuses a range holding more than one block, backs up first, and writes atomically while preserving the file's mode and following symlinks to the real target.

todo-cleanup rewrote todo.org with no backup, alone among the three tools that mutate these files. It now copies to the temp dir like lint-org does. Both backup helpers suffix rather than overwrite, because a second-resolution stamp collapsed two back-to-back invocations into one backup holding already-mutated content — and running todo-cleanup twice in a row is the shipped path.

audit.bats failed about one run in eight, in teardown rather than in its assertions, so a passing test reported as a false red. git commit spawns a detached maintenance process that is still writing packs when the commit returns, racing the cleanup. The fixture disables it.

route_recommend downgraded a correct strong match to weak when two projects shared a basename. lint.sh now sweeps the scripts that get symlinked onto PATH, which were the only shell in the repo with no gate over them.

Two test defects found in review and fixed here: a suite that deleted real backups from the shared temp dir, and one that depended on that directory's contents. Isolation now lives in an autouse fixture rather than in each test's memory.

Known and filed, not closed: the range check still cannot prove the range is the block that was scanned, so drift by exactly one whole block deletes the wrong annotation. That needs a content assertion and a CLI contract change.

6 files changed, 419 insertions, 3 deletions

diff --git a/claude-templates/.ai/scripts/cj-remove-block.py b/claude-templates/.ai/scripts/cj-remove-block.py
index 71c7b3d..d5137a3 100755
--- a/claude-templates/.ai/scripts/cj-remove-block.py
+++ b/claude-templates/.ai/scripts/cj-remove-block.py
@@ -16,8 +16,12 @@ Companion to the /respond-to-cj-comments skill and to cj-scan.py.
 from __future__ import annotations
 
 import argparse
+import os
 import re
+import shutil
 import sys
+import tempfile
+from datetime import datetime
 from pathlib import Path
 
 SRC_OPEN_RE = re.compile(r"^\s*#\+begin_src\s+cj:", re.IGNORECASE)
@@ -57,12 +61,83 @@ def looks_like_cj_range(lines: list[str], start: int, end: int) -> tuple[bool, s
             f"Line {end} does not look like a #+end_src closing fence "
             f"(got: {last[:60]!r})"
         )
+
+    # The range must hold exactly ONE block. Checking only the first and last
+    # lines let a drifted range run from one block's opener to a *later* block's
+    # closer: validation passed and the removal silently deleted everything
+    # between, prose and headings included. Drift is the case this check exists
+    # for, so it has to look inside the range, not just at its ends.
+    for offset, line in enumerate(lines[start:end - 1], start=start + 1):
+        if SRC_CLOSE_RE.match(line):
+            return False, (
+                f"Range {start}..{end} covers more than one cj block — "
+                f"a #+end_src appears at line {offset}, before the range ends. "
+                f"Re-scan for current line numbers; removing this range would "
+                f"delete everything between the two blocks."
+            )
+        if SRC_OPEN_RE.match(line):
+            return False, (
+                f"Range {start}..{end} covers more than one cj block — "
+                f"a second #+begin_src cj: appears at line {offset}. "
+                f"Re-scan for current line numbers."
+            )
     return True, ""
 
 
+def _backup(path: Path) -> Path:
+    """Copy path to /tmp before mutating it, mirroring lint-org.el's convention.
+
+    These are Craig's org files. lint-org.el, the other tool that rewrites them,
+    leaves a /tmp copy before touching anything; this matches it so a bad edit is
+    always recoverable without reaching for git (which only reaches the last
+    commit, losing intra-session work).
+    """
+    stamp = datetime.now().strftime("%Y%m%d-%H%M%S")
+    base = Path(tempfile.gettempdir()) / f"{path.name}.before-cj-remove.{stamp}"
+    # Never overwrite an earlier backup. The skill removes several annotations
+    # in quick succession, so a second-resolution stamp collides and the later
+    # copy would replace the earlier one with already-mutated content — losing
+    # the pre-session original the backup exists to preserve.
+    dest = base
+    n = 2
+    while dest.exists():
+        dest = base.with_name(f"{base.name}-{n}")
+        n += 1
+    shutil.copy2(path, dest)
+    return dest
+
+
+def _atomic_write(path: Path, text: str) -> None:
+    """Write text to path via a temp sibling and os.replace.
+
+    A bare write_text truncates the target on open, so a mid-write failure left
+    the org file truncated with no complete copy on disk. Writing a temp sibling
+    and renaming means the file is either its old content or its new content,
+    never a partial.
+    """
+    # Follow a symlink to the file it names. os.replace would otherwise swap the
+    # symlink itself for a regular file, leaving the real target holding the old
+    # content — the edit silently goes nowhere. Resolving also puts the temp
+    # sibling on the same filesystem as the real file, which os.replace needs.
+    path = path.resolve()
+    fd, tmp = tempfile.mkstemp(dir=path.parent, prefix=f".{path.name}.", suffix=".tmp")
+    os.close(fd)
+    tmp_path = Path(tmp)
+    # Carry the original's permissions across. mkstemp creates 0600, and
+    # defaulting to the umask instead widened a deliberately-restricted file
+    # (a 0600 org file came back 0644).
+    shutil.copymode(path, tmp_path)
+    try:
+        tmp_path.write_text(text, encoding="utf-8")
+        os.replace(tmp_path, path)
+    except BaseException:
+        tmp_path.unlink(missing_ok=True)
+        raise
+
+
 def remove_range(path: Path, start: int, end: int) -> None:
     """Read path, validate range looks like cj content, remove the range, write back."""
-    text = path.read_text()
+    text = path.read_text(encoding="utf-8")
     had_trailing_newline = text.endswith("\n")
     lines = text.splitlines(keepends=False)
 
@@ -77,7 +152,9 @@ def remove_range(path: Path, start: int, end: int) -> None:
         new_text += "\n"
     elif not new_lines and had_trailing_newline:
         new_text = ""
-    path.write_text(new_text)
+
+    _backup(path)
+    _atomic_write(path, new_text)
 
 
 def main() -> int:
diff --git a/claude-templates/.ai/scripts/route_recommend.py b/claude-templates/.ai/scripts/route_recommend.py
index 7b36405..12ab132 100644
--- a/claude-templates/.ai/scripts/route_recommend.py
+++ b/claude-templates/.ai/scripts/route_recommend.py
@@ -71,6 +71,15 @@ def recommend(item: str, projects: list[str]) -> tuple[str | None, str]:
     if not projects:
         return (None, "none")
 
+    # Collapse identical names first. Projects are addressed by bare basename, so
+    # two projects sharing one across roots (~/code/notes, ~/projects/notes) arrive
+    # twice; both literal-match, and the tie test below then read that as ambiguity
+    # and downgraded a correct strong match to weak. Deduping here rather than in
+    # discover_destination_names protects every caller of the pure core, not just
+    # the CLI path. Order-preserving, and it collapses only identical names — two
+    # *different* projects matching is real ambiguity and still downgrades.
+    projects = list(dict.fromkeys(projects))
+
     item_lower = item.lower()
     item_tokens = _tokens(item)
 
diff --git a/claude-templates/.ai/scripts/tests/test-todo-cleanup.el b/claude-templates/.ai/scripts/tests/test-todo-cleanup.el
index 838913f..a92d238 100644
--- a/claude-templates/.ai/scripts/tests/test-todo-cleanup.el
+++ b/claude-templates/.ai/scripts/tests/test-todo-cleanup.el
@@ -516,6 +516,12 @@ gitignore todo.org, then run `--archive-done' aging with the DEFAULT archive pat
 .gitignore contents or nil), :archive-ignored (whether git ignores the archive),
 :archive-exists."
   (let* ((root (make-temp-file "tc-git-" t))
+         ;; Private backup dir: this helper writes a file literally named
+         ;; todo.org and runs a real (non-check) pass, so without this its
+         ;; backup lands in the shared temp dir under the exact production
+         ;; name and is indistinguishable from a real one.
+         (temporary-file-directory
+          (file-name-as-directory (make-temp-file "tc-git-bk-" t)))
          (todo (expand-file-name "todo.org" root))
          (archive (expand-file-name "archive/task-archive.org" root))
          (gi (expand-file-name ".gitignore" root)))
@@ -536,7 +542,8 @@ gitignore todo.org, then run `--archive-done' aging with the DEFAULT archive pat
                 :archive-ignored
                 (eq 0 (call-process "git" nil nil nil "check-ignore" "-q" archive))
                 :archive-exists (file-readable-p archive)))
-      (delete-directory root t))))
+      (delete-directory root t)
+      (delete-directory temporary-file-directory t))))
 
 (ert-deftest tc-age-self-protect-gitignores-archive-when-todo-ignored ()
   "When the todo file is gitignored, the aged-out archive is added to .gitignore
@@ -1073,3 +1080,97 @@ line) is left untouched — the strip stops at the first non-planning line."
 
 (provide 'test-todo-cleanup)
 ;;; test-todo-cleanup.el ends here
+
+;;; ---------------------------------------------------------------------------
+;;; Backup before mutating (parity with lint-org.el / wrap-org-table.el)
+;;
+;; todo-cleanup rewrites todo.org in place and left no copy behind, while both
+;; sibling org-mutators back up to /tmp first. It is also the one that runs most
+;; often (every wrap, every sentry fire). Emacs's own backup does not fire under
+;; --batch -q, so there was genuinely no undo short of git.
+
+(ert-deftest tc-backup-written-before-a-real-mutation ()
+  "A real (non-check) run leaves a copy holding the pre-edit content.
+
+`temporary-file-directory' is rebound to a private dir for the duration: the
+backup name derives from the *file's* basename, and the real todo.org shares
+that basename, so a live sentry run writing /tmp/todo.org.before-todo-cleanup.*
+would otherwise be indistinguishable from this test's own artifact. The first
+version of this test globbed the shared /tmp and passed only until a real run
+created one (2026-07-24)."
+  (let* ((dir (make-temp-file "tc-backup-" t))
+         (bdir (file-name-as-directory (make-temp-file "tc-bk-" t)))
+         (file (expand-file-name "todo.org" dir))
+         (before "* P Open Work\n** TODO [#B] parent\n*** DONE a subtask\nCLOSED: [2026-07-01 Tue]\n"))
+    (unwind-protect
+        (progn
+          (with-temp-file file (insert before))
+          (let ((tc-check-only nil)
+                (tc-convert-subtasks t)
+                (temporary-file-directory bdir))
+            (tc-process-file file))
+          (let ((backups (file-expand-wildcards
+                          (concat bdir "todo.org.before-todo-cleanup.*"))))
+            (should backups)
+            (should (string-match-p
+                     "a subtask"
+                     (with-temp-buffer (insert-file-contents (car backups))
+                                       (buffer-string))))))
+      (delete-directory dir t)
+      (delete-directory bdir t))))
+
+(ert-deftest tc-no-backup-in-check-mode ()
+  "--check writes nothing, so it must not leave a backup either.
+Uses a private `temporary-file-directory' for the same isolation reason."
+  (let* ((dir (make-temp-file "tc-backup-" t))
+         (bdir (file-name-as-directory (make-temp-file "tc-bk-" t)))
+         (file (expand-file-name "todo.org" dir)))
+    (unwind-protect
+        (progn
+          (with-temp-file file
+            (insert "* P Open Work\n** TODO [#B] parent\n*** DONE sub\nCLOSED: [2026-07-01 Tue]\n"))
+          (let ((tc-check-only t)
+                (tc-convert-subtasks t)
+                (temporary-file-directory bdir))
+            (tc-process-file file))
+          (should-not (file-expand-wildcards
+                       (concat bdir "todo.org.before-todo-cleanup.*"))))
+      (delete-directory dir t)
+      (delete-directory bdir t))))
+
+(ert-deftest tc-backup-never-overwrites-an-earlier-one ()
+  "Two invocations in the same second must not collapse to one backup.
+
+open-tasks.org runs --convert-subtasks then --archive-done back to back, each
+a sub-second batch run. With a second-resolution stamp and copy-file's
+OK-IF-ALREADY-EXISTS, the second invocation overwrote the first's backup with
+already-mutated content, so the true pre-session original was unrecoverable —
+the exact state the backup exists to preserve (found 2026-07-24 in review)."
+  (let* ((dir (make-temp-file "tc-collide-" t))
+         (bdir (file-name-as-directory (make-temp-file "tc-cbk-" t)))
+         (file (expand-file-name "todo.org" dir))
+         (original (concat "* P Open Work\n** TODO [#B] parent\n*** DONE sub\n"
+                           "CLOSED: [2026-07-01 Tue]\n"
+                           "* P Resolved\n** DONE [#C] old\nCLOSED: [2025-01-01 Wed]\n")))
+    (unwind-protect
+        (progn
+          (with-temp-file file (insert original))
+          ;; Two back-to-back invocations, as the shipped workflow does.
+          (let ((temporary-file-directory bdir))
+            (let ((tc-check-only nil) (tc-convert-subtasks t))
+              (tc-process-file file))
+            (let ((tc-check-only nil) (tc-convert-subtasks nil) (tc-archive-done t)
+                  (tc-archive-retain-days nil))
+              (tc-process-file file)))
+          (let ((backups (file-expand-wildcards
+                          (concat bdir "todo.org.before-todo-cleanup.*"))))
+            ;; Both invocations kept their own backup.
+            (should (= (length backups) 2))
+            ;; And one of them still holds the true original.
+            (should (cl-some (lambda (b)
+                               (string= original
+                                        (with-temp-buffer (insert-file-contents b)
+                                                          (buffer-string))))
+                             backups))))
+      (delete-directory dir t)
+      (delete-directory bdir t))))
diff --git a/claude-templates/.ai/scripts/tests/test_cj_remove_block.py b/claude-templates/.ai/scripts/tests/test_cj_remove_block.py
index 2c8dade..3cdee46 100644
--- a/claude-templates/.ai/scripts/tests/test_cj_remove_block.py
+++ b/claude-templates/.ai/scripts/tests/test_cj_remove_block.py
@@ -14,6 +14,34 @@ import pytest
 SCRIPT = Path(__file__).parent.parent / "cj-remove-block.py"
 
 
+@pytest.fixture(autouse=True)
+def isolated_tmpdir(tmp_path, monkeypatch):
+    """Give every test in this module a private TMPDIR.
+
+    The script backs up to the system temp dir under a name derived from the
+    edited file's BASENAME. The real todo.org shares that basename, so any test
+    operating on a fixture named todo.org writes something indistinguishable
+    from a production backup — and an earlier version of this file globbed the
+    shared /tmp and unlinked every match, so a routine `make test` destroyed
+    Craig's real backups (found in review, 2026-07-24).
+
+    Isolating at module scope rather than per-test is deliberate: the same bug
+    was fixed once in the elisp sibling and left here, so relying on each new
+    test to remember is exactly how it recurred. Autouse makes it structural.
+    """
+    d = tmp_path / "_tmpdir"
+    d.mkdir()
+    # TMPDIR covers subprocess invocations of the script.
+    monkeypatch.setenv("TMPDIR", str(d))
+    # tempfile.gettempdir() caches its answer on first call, so a test that
+    # loads the module in-process would keep writing to the real /tmp no matter
+    # what TMPDIR says. Override the cache too — this is the gap that made the
+    # env-var-only version still leak one backup per suite run.
+    import tempfile as _tempfile
+    monkeypatch.setattr(_tempfile, "tempdir", str(d))
+    return d
+
+
 @pytest.fixture
 def run_remove(tmp_path):
     """Write content to a temp org file, run cj-remove-block, return new contents."""
@@ -155,3 +183,142 @@ class TestCjRemoveBlockSafety:
         err, post_content = run_remove_expecting_failure(original, start=4, end=2)
         assert err.returncode != 0
         assert post_content == original
+
+
+class TestMultiBlockRangeRefused:
+    """The validation exists to catch a drifted range, but it only checked the
+    first and last lines of that range. A span from one block's opening fence to
+    a LATER block's closing fence passed, and the removal silently deleted every
+    line between — real prose, headings, whole tasks — with a zero exit. Drift is
+    the skill's normal operating mode (respond-to-cj-comments edits the file as it
+    processes, and a file under cj review usually holds several blocks), so this
+    is the exact scenario the check was written for. Reproduced 2026-07-24."""
+
+    TWO_BLOCKS = (
+        "* Alpha\n"
+        "#+begin_src cj:\n"
+        "note A\n"
+        "#+end_src\n"
+        "KEEP THIS LINE\n"
+        "* Beta\n"
+        "#+begin_src cj:\n"
+        "note B\n"
+        "#+end_src\n"
+    )
+
+    def test_range_spanning_two_blocks_is_refused(self, run_remove_expecting_failure):
+        # Lines 2..9: block one's opener through block two's closer.
+        err, content = run_remove_expecting_failure(self.TWO_BLOCKS, 2, 9)
+        assert err.returncode == 1
+        assert "KEEP THIS LINE" in content, "content between the blocks was destroyed"
+        assert "* Beta" in content, "a heading between the blocks was destroyed"
+
+    def test_refusal_names_the_reason(self, run_remove_expecting_failure):
+        err, _ = run_remove_expecting_failure(self.TWO_BLOCKS, 2, 9)
+        assert "more than one" in err.stderr.decode().lower()
+
+    def test_a_correct_single_block_range_still_removes(self, run_remove):
+        # The fix must not over-tighten: the legitimate range still works.
+        out = run_remove(self.TWO_BLOCKS, 2, 4)
+        assert "note A" not in out
+        assert "KEEP THIS LINE" in out
+        assert "note B" in out, "the second block must be untouched"
+
+    def test_a_nested_end_src_inside_the_range_is_refused(self, run_remove_expecting_failure):
+        # Any #+end_src before the final line means the range covers >1 block.
+        content = (
+            "#+begin_src cj:\n"
+            "a\n"
+            "#+end_src\n"
+            "middle\n"
+            "#+begin_src cj:\n"
+            "b\n"
+            "#+end_src\n"
+        )
+        err, after = run_remove_expecting_failure(content, 1, 7)
+        assert err.returncode == 1
+        assert "middle" in after
+
+
+class TestSafeMutation:
+    """The script rewrites Craig's org files (todo.org, notes.org). It wrote with
+    a bare write_text, which truncates the target on open, and took no backup —
+    so a mid-write failure left the file truncated with no copy to recover from.
+    lint-org.el, the other tool that mutates these files, backs up to a temp dir
+    first. Match that, and make the write atomic.
+
+    Every test here redirects TMPDIR to a private directory. The backup name
+    derives from the file's basename, and the real todo.org shares it, so a test
+    globbing the shared temp dir cannot tell its own artifact from a genuine
+    backup — and an earlier version of this class globbed /tmp and unlinked every
+    match, so a routine `make test` destroyed real backups (found in review,
+    2026-07-24). Never glob or delete across the shared temp dir."""
+
+    ONE_BLOCK = "* T\n#+begin_src cj:\nnote\n#+end_src\nkeep\n"
+
+    def test_a_backup_is_written_before_mutating(self, tmp_path):
+        import subprocess, glob, os
+        bdir = tmp_path / "bk"
+        bdir.mkdir()
+        f = tmp_path / "todo.org"
+        f.write_text(self.ONE_BLOCK)
+        subprocess.run(
+            ["python3", str(SCRIPT), "--file", str(f), "--start", "2", "--end", "4"],
+            check=True, capture_output=True,
+            env={**os.environ, "TMPDIR": str(bdir)},
+        )
+        backups = glob.glob(str(bdir / "todo.org.before-cj-remove.*"))
+        assert backups, "no backup was written before mutating the org file"
+        assert "note" in Path(max(backups)).read_text()
+
+    def test_no_partial_file_when_the_write_fails(self, tmp_path, monkeypatch):
+        import importlib.util
+        spec = importlib.util.spec_from_file_location("crb", SCRIPT)
+        mod = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(mod)
+        bdir = tmp_path / "bk"
+        bdir.mkdir()
+        monkeypatch.setenv("TMPDIR", str(bdir))
+        f = tmp_path / "todo.org"
+        f.write_text(self.ONE_BLOCK)
+        def boom(*a, **k):
+            raise OSError("disk full")
+        monkeypatch.setattr(mod.os, "replace", boom)
+        with pytest.raises(OSError):
+            mod.remove_range(f, 2, 4)
+        # The original survives intact — no truncation, no partial.
+        assert f.read_text() == self.ONE_BLOCK
+
+
+class TestBackupNeverOverwrites:
+    """Same defect class as todo-cleanup's, and more reachable here: the
+    respond-to-cj-comments skill removes several annotations in quick
+    succession, so a second-resolution stamp collides and the later backup
+    overwrote the earlier one with already-mutated content."""
+
+    TWO_BLOCKS = (
+        "* A\n#+begin_src cj:\nfirst\n#+end_src\n"
+        "* B\n#+begin_src cj:\nsecond\n#+end_src\n"
+    )
+
+    def test_consecutive_removals_each_keep_a_backup(self, tmp_path, monkeypatch):
+        import subprocess, glob
+        bdir = tmp_path / "bk"
+        bdir.mkdir()
+        monkeypatch.setenv("TMPDIR", str(bdir))
+        f = tmp_path / "todo.org"
+        f.write_text(self.TWO_BLOCKS)
+        original = f.read_text()
+        # Remove the second block, then the first — back to back, same second.
+        subprocess.run(["python3", str(SCRIPT), "--file", str(f),
+                        "--start", "6", "--end", "8"],
+                       check=True, capture_output=True,
+                       env={**__import__("os").environ, "TMPDIR": str(bdir)})
+        subprocess.run(["python3", str(SCRIPT), "--file", str(f),
+                        "--start", "2", "--end", "4"],
+                       check=True, capture_output=True,
+                       env={**__import__("os").environ, "TMPDIR": str(bdir)})
+        backups = glob.glob(str(bdir / "todo.org.before-cj-remove.*"))
+        assert len(backups) == 2, f"expected 2 backups, got {len(backups)}"
+        contents = [Path(b).read_text() for b in backups]
+        assert original in contents, "no backup holds the true original"
diff --git a/claude-templates/.ai/scripts/tests/test_route_recommend.py b/claude-templates/.ai/scripts/tests/test_route_recommend.py
index acc4755..2ec900a 100644
--- a/claude-templates/.ai/scripts/tests/test_route_recommend.py
+++ b/claude-templates/.ai/scripts/tests/test_route_recommend.py
@@ -122,3 +122,31 @@ def test_cli_exclude_drops_current_project(tmp_path):
     r = _run(["--exclude", "foo"], roots=[tmp_path / "projects"], item="fix the foo widget")
     assert r.returncode == 0
     assert r.stdout.strip() == "none"
+
+
+# ----------------------------------------------------------------------
+# Duplicate candidate names
+#
+# Projects are collapsed to bare basenames, so two projects sharing a basename
+# across roots (~/code/notes and ~/projects/notes) appear twice in the candidate
+# list. Both literal-match, recommend read len(strong) > 1 as an ambiguous tie,
+# and a correct strong match was downgraded to weak. Latent when discovered
+# 2026-07-24 (27 projects, 27 distinct basenames) but real.
+# ----------------------------------------------------------------------
+
+def test_duplicate_candidate_name_keeps_strong_confidence():
+    assert rr.recommend("fix the notes thing", ["notes", "other"]) == ("notes", "strong")
+    # The same name twice must not read as a tie.
+    assert rr.recommend("fix the notes thing", ["notes", "notes", "other"]) == ("notes", "strong")
+
+
+def test_genuine_ambiguity_still_downgrades():
+    # Two DIFFERENT projects both matching is a real tie and stays weak — the
+    # dedupe must collapse identical names only, never real ambiguity.
+    dest, conf = rr.recommend("notes and other both", ["notes", "other"])
+    assert conf == "weak"
+
+
+def test_duplicates_do_not_change_the_chosen_destination():
+    dest, _ = rr.recommend("fix the notes thing", ["notes", "notes"])
+    assert dest == "notes"
diff --git a/claude-templates/.ai/scripts/todo-cleanup.el b/claude-templates/.ai/scripts/todo-cleanup.el
index c4a87de..cb333e2 100644
--- a/claude-templates/.ai/scripts/todo-cleanup.el
+++ b/claude-templates/.ai/scripts/todo-cleanup.el
@@ -100,6 +100,12 @@
 ;;   --check-child-priority is the report-only alias for --sync-child-priority
 ;;   --check.
 
+;; Before any modification a backup is copied to
+;;   /tmp/<basename>.before-todo-cleanup.<YYYYMMDD-HHMMSS>
+;; matching lint-org.el and wrap-org-table.el. Skipped under --check, which
+;; writes nothing.
+;;
+
 (require 'org)
 (require 'cl-lib)
 (require 'calendar)
@@ -832,9 +838,37 @@ event-log entry, pulling the timestamp from its CLOSED cookie.  Honors
 ;;; ---------------------------------------------------------------------------
 ;;; Driver + reporting
 
+(defun tc--backup (file)
+  "Copy FILE to /tmp before any modification.  Skipped in --check mode.
+
+Matches `lint-org.el' and `wrap-org-table.el', the other tools that rewrite
+these org files. todo-cleanup runs the most often of the three (every wrap,
+every sentry fire), and Emacs's own backup does not fire under --batch -q, so
+without this a mechanical rewrite has no undo short of git — which recovers
+only to the last commit and loses intra-session work."
+  (let* ((base (format "%s%s.before-todo-cleanup.%s"
+                       temporary-file-directory
+                       (file-name-nondirectory file)
+                       (format-time-string "%Y%m%d-%H%M%S")))
+         (backup base)
+         (n 2))
+    ;; Never overwrite an earlier backup. A second-resolution stamp collides
+    ;; when two invocations run back to back, which the shipped workflow does
+    ;; (open-tasks.org runs --convert-subtasks then --archive-done, each a
+    ;; sub-second batch run). Overwriting there replaces the true pre-session
+    ;; original with already-mutated content — losing exactly what the backup
+    ;; exists to preserve. Suffix instead, so every invocation keeps its own.
+    (while (file-exists-p backup)
+      (setq backup (format "%s-%d" base n))
+      (setq n (1+ n)))
+    (copy-file file backup nil)
+    backup))
+
 (defun tc-process-file (file)
   (setq tc-current-file (file-name-nondirectory file))
   (setq tc-current-dir (file-name-directory (expand-file-name file)))
+  (unless tc-check-only
+    (tc--backup file))
   (with-current-buffer (find-file-noselect file)
     (org-mode)
     (cond