fix(cj-scan): suppress detection inside nested non-cj begin_* blocks

cj-scan.py matched =#+begin_src cj:= / =#+end_src= line-by-line without awareness of enclosing block scopes. A cj fence embedded inside =#+begin_example= (typical when documenting what the <cj yasnippet emits) or =#+begin_src snippet= (the yasnippet definition itself) was misclassified as a live cj annotation. Two false positives surfaced from a /respond-to-cj-comments run against an org file with yasnippet docs.

Track an active wrapper_type. When the scanner sees =#+begin_<type>= for any type other than cj: (the cj-open regex is checked first), enter a wrapper state where every line is content until the matching =#+end_<type>= closer fires. Inside a wrapper, both fence patterns and legacy inline cj: lines stay suppressed. Added the TestCjScanNestedFencesIgnored class with 6 tests: nesting inside example, src <other-lang>, and quote; regression guards for clean wrapper close and unclosed-wrapper non-swallow. Canonical pytest: 302 passed, 1 skipped.

1 files changed, 27 insertions, 0 deletions

diff --git a/todo.org b/todo.org
index 2160558..aea4ab1 100644
--- a/todo.org
+++ b/todo.org
@@ -1800,6 +1800,33 @@ Scope:
 Origin: came up while authoring =triage-intake.org= on 2026-05-11.
 
 * Rulesets Resolved
+** DONE [#C] Fix =cj-scan= false positives on cj fences nested inside other =#+begin_*= blocks :bug:
+CLOSED: [2026-05-15 Fri]
+
+=cj-scan.py= was matching =#+begin_src cj:= / =#+end_src= line-by-line
+without awareness of enclosing block scopes.  A cj fence embedded inside a
+=#+begin_example= block (typically when documenting what the =<cj= yasnippet
+emits) or inside =#+begin_src snippet= (the yasnippet definition itself) was
+misclassified as a live cj annotation.  Surfaced from a /respond-to-cj-comments
+run against the dotemacs =todo.org= that reported two false positives in the
+=<cj= yasnippet documentation.
+
+Fix: track an active =wrapper_type= state.  When the scanner sees =#+begin_<type>=
+(for any =<type>= other than =cj:= via the more-specific cj-open regex, which
+is checked first), it enters a wrapper state where every line is treated as
+content until the matching =#+end_<type>= closer fires.  Inside a wrapper, cj
+fence patterns and legacy inline =cj:= lines are both suppressed.
+
+Tests: added =TestCjScanNestedFencesIgnored= (6 tests) to
+=claude-templates/.ai/scripts/tests/test_cj_scan.py= covering nesting inside
+=#+begin_example=, =#+begin_src <other-lang>=, and =#+begin_quote=, plus
+regression guards that a wrapper closes cleanly (a subsequent real cj fence
+is still detected) and that an unclosed wrapper doesn't silently swallow
+later content into false-positive cj blocks.
+
+Full =make test-scripts= equivalent (=python3 -m pytest=): 302 passed, 1
+skipped, 0 failures.
+
 ** DONE [#A] Add =make doctor= — verify ~/.claude/ matches repo + settings.json :feature:
 
 A drift detector that scans =~/.claude/= and reports anything inconsistent with what the repo expects. Single-command answer to "is my machine consistent with rulesets?"