6 files changed, 662 insertions, 1 deletions

diff --git a/.ai/scripts/tests/inbox-status.bats b/.ai/scripts/tests/inbox-status.bats
index bc8a734..27a497e 100644
--- a/.ai/scripts/tests/inbox-status.bats
+++ b/.ai/scripts/tests/inbox-status.bats
@@ -45,6 +45,18 @@ teardown() {
     [[ "$output" == *"0 pending"* ]]
 }
 
+@test "inbox-status: ignores an in-flight .inbox-send-* temp file" {
+    mkdir "$TMP/inbox"
+    # inbox-send writes to a .inbox-send-* temp then renames it into place;
+    # during that window the temp must not read as a pending handoff, or a
+    # concurrent boundary check blocks on a file that's about to become real.
+    touch "$TMP/inbox/.inbox-send-abc123.org"
+    cd "$TMP"
+    run "$SCRIPT"
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"0 pending"* ]]
+}
+
 @test "inbox-status: -q suppresses the per-item lines" {
     mkdir "$TMP/inbox"
     echo body > "$TMP/inbox/handoff.org"
diff --git a/.ai/scripts/tests/test-lint-org.el b/.ai/scripts/tests/test-lint-org.el
index 30a79bd..ceee209 100644
--- a/.ai/scripts/tests/test-lint-org.el
+++ b/.ai/scripts/tests/test-lint-org.el
@@ -193,6 +193,65 @@ real suspicious-language warning here
 #+end_src
 ")
 
+;; invalid-block, false-positive case — a correctly paired example block whose
+;; body holds a heading-shaped line.  org's parser reads the `** ' inside the
+;; verbatim body as a structural break, loses the open block, and flags BOTH
+;; delimiters as "Possible incomplete block".
+(defconst lo-test--verbatim-heading-block "\
+* Heading
+
+#+begin_example
+** Feature Name or Topic
+Body line.
+#+end_example
+
+Trailing prose.
+")
+
+;; invalid-block, literal-delimiter case — a paired src block whose body holds
+;; a literal `#+end_example' plus a heading-shaped line.  Only `#+end_src'
+;; closes a src block, so all three findings here are false.
+(defconst lo-test--literal-end-in-src "\
+* Heading
+
+#+begin_src text
+#+end_example
+** heading shaped
+#+end_src
+")
+
+;; invalid-block, uppercase-delimiter case — org accepts #+BEGIN_/#+END_ in
+;; either case, and the pre-fix script flagged both delimiters here too.
+(defconst lo-test--uppercase-verbatim-block "\
+* Heading
+
+#+BEGIN_EXAMPLE
+** heading shaped
+#+END_EXAMPLE
+")
+
+;; invalid-block, genuine case — a block that really is never closed.  The
+;; suppression must not reach this one.
+(defconst lo-test--unterminated-block "\
+* Heading
+
+#+begin_example
+truly unterminated block body
+")
+
+;; A genuinely unterminated block *after* a correctly paired one — verifies the
+;; suppression is scoped per block rather than per file.
+(defconst lo-test--paired-then-unterminated "\
+* Heading
+
+#+begin_example
+** heading shaped
+#+end_example
+
+#+begin_example
+never closed
+")
+
 ;; Mixed fixture — each category once.
 (defconst lo-test--mixed "\
 * Mixed
@@ -392,6 +451,55 @@ suspicious-language judgment."
     (should (= 1 suspicious))))
 
 ;;; ---------------------------------------------------------------------------
+;;; invalid-block — false positives on correctly paired verbatim blocks
+
+(ert-deftest lo-verbatim-heading-block-emits-no-invalid-block ()
+  "Normal: a paired example block containing a heading-shaped body line emits
+no invalid-block judgment.  Both delimiters are flagged by org-lint because the
+parser treats the `** ' inside the verbatim body as a structural break."
+  (let* ((out (lo-test--run lo-test--verbatim-heading-block))
+         (res (plist-get out :result))
+         (judgments (lo-test--judgments (plist-get out :issues))))
+    ;; File untouched, no fixes applied — suppression only, never a rewrite.
+    (should (equal lo-test--verbatim-heading-block res))
+    (should (= 0 (plist-get out :fixes)))
+    (should-not (member 'invalid-block (lo-test--checkers judgments)))))
+
+(ert-deftest lo-literal-end-delimiter-in-src-emits-no-invalid-block ()
+  "Boundary: a paired src block whose body holds a literal `#+end_example' and
+a heading-shaped line emits no invalid-block judgment.  Only `#+end_src' closes
+a src block, so the interior delimiter is body text."
+  (let* ((out (lo-test--run lo-test--literal-end-in-src))
+         (judgments (lo-test--judgments (plist-get out :issues))))
+    (should-not (member 'invalid-block (lo-test--checkers judgments)))))
+
+(ert-deftest lo-uppercase-verbatim-block-emits-no-invalid-block ()
+  "Boundary: block delimiters are case-insensitive in org, so an uppercase
+`#+BEGIN_EXAMPLE' pair is suppressed the same as a lowercase one."
+  (let* ((out (lo-test--run lo-test--uppercase-verbatim-block))
+         (judgments (lo-test--judgments (plist-get out :issues))))
+    (should-not (member 'invalid-block (lo-test--checkers judgments)))))
+
+(ert-deftest lo-unterminated-block-still-emits-invalid-block ()
+  "Error: a block that is never closed still emits its invalid-block judgment.
+This is the finding the checker exists for — the suppression must not mask it."
+  (let* ((out (lo-test--run lo-test--unterminated-block))
+         (judgments (lo-test--judgments (plist-get out :issues))))
+    (should (member 'invalid-block (lo-test--checkers judgments)))))
+
+(ert-deftest lo-invalid-block-suppression-is-scoped-per-block ()
+  "Boundary: a paired block and an unterminated block in the same file — the
+paired one is suppressed and the unterminated one still reports.  Exactly one
+invalid-block judgment, and it points at the unterminated opener (line 7)."
+  (let* ((out (lo-test--run lo-test--paired-then-unterminated))
+         (judgments (lo-test--judgments (plist-get out :issues)))
+         (invalid (cl-remove-if-not
+                   (lambda (i) (eq (plist-get i :checker) 'invalid-block))
+                   judgments)))
+    (should (= 1 (length invalid)))
+    (should (= 7 (plist-get (car invalid) :line)))))
+
+;;; ---------------------------------------------------------------------------
 ;;; --check mode
 
 (ert-deftest lo-check-mode-does-not-modify-file ()
@@ -859,3 +967,134 @@ heading, so it is not flagged — only two-or-more indented stars are."
 
 (provide 'test-lint-org)
 ;;; test-lint-org.el ends here
+
+;;; ---------------------------------------------------------------------------
+;;; task-missing-last-reviewed (claude-rules/todo-format.md)
+
+(ert-deftest lo-task-without-last-reviewed-is-judgment ()
+  "An open level-2 task with no :LAST_REVIEWED: is flagged."
+  (let* ((out (lo-test--run "* Open Work\n** TODO [#B] A task :feature:\nBody.\n"))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-task-with-last-reviewed-is-clean ()
+  "A task carrying the property is not flagged."
+  (let* ((out (lo-test--run (concat "* Open Work\n** TODO [#B] A task :feature:\n"
+                                    ":PROPERTIES:\n:LAST_REVIEWED: 2026-07-23\n:END:\n"
+                                    "Body.\n")))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-task-last-reviewed-accepts-org-timestamp ()
+  "The org-native [YYYY-MM-DD Day] form counts, matching the staleness script."
+  (let* ((out (lo-test--run (concat "* Open Work\n** TODO [#B] A task :feature:\n"
+                                    ":PROPERTIES:\n:LAST_REVIEWED: [2026-07-23 Thu]\n:END:\n")))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-done-task-without-last-reviewed-is-clean ()
+  "Completed tasks leave the review pool, so they are never flagged."
+  (let* ((out (lo-test--run (concat "* Open Work\n** DONE [#B] A task :feature:\n"
+                                    "CLOSED: [2026-07-23 Thu]\n")))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-subtask-without-last-reviewed-is-clean ()
+  "Only level-2 tasks are in the review pool; deeper headings are not."
+  (let* ((out (lo-test--run (concat "* Open Work\n** TODO [#B] Parent :feature:\n"
+                                    ":PROPERTIES:\n:LAST_REVIEWED: 2026-07-23\n:END:\n"
+                                    "*** TODO A sub-task\n")))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-cookieless-task-without-last-reviewed-is-clean ()
+  "The staleness script selects on a priority cookie, so match that scope."
+  (let* ((out (lo-test--run "* Open Work\n** TODO Manual testing and validation\n"))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-verify-task-without-last-reviewed-is-judgment ()
+  "VERIFY is in the review pool too."
+  (let* ((out (lo-test--run "* Open Work\n** VERIFY [#B] Waiting on Craig\n"))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+;;; ---------------------------------------------------------------------------
+;;; todo-format checkers skip docs/specs/ files (claude-rules/todo-format.md)
+;;
+;; The four todo-format-family checkers encode todo.org completion conventions.
+;; A spec legitimately uses ** DONE <decision> with no CLOSED cookie and
+;; ** <dated> — <who> review-history headings, so those checkers misfire on
+;; every spec. They must skip any file under a docs/specs/ path segment.
+
+(defun lo-test--run-at (relpath content)
+  "Write CONTENT to <tmpdir>/RELPATH, run lint on it, return :issues.
+RELPATH is a relative path (may contain slashes) so a docs/specs/ segment
+can be exercised — the checkers key on the file's path, not just its name."
+  (let* ((root (make-temp-file "lo-test-root-" t))
+         (file (expand-file-name relpath root)))
+    (make-directory (file-name-directory file) t)
+    (unwind-protect
+        (progn
+          (with-temp-file file (insert content))
+          (lo-test--reset)
+          (lo-process-file file)
+          (prog1 (list :issues lo-issues)
+            (lo-test--drop-buffer file)))
+      (delete-directory root t))))
+
+(defconst lo-test--spec-decisions
+  "* Decisions [1/1]\n** DONE Some decision\n- Context: x\n"
+  "A spec Decisions section: a level-2 DONE with no CLOSED cookie.")
+
+(defconst lo-test--spec-history
+  "* Review history\n** 2026-07-14 Tue @ 02:03:28 -0500 — Claude — responder\n- What: x\n"
+  "A spec review-history section: a level-2 dated header.")
+
+(ert-deftest lo-todo-checkers-fire-on-a-normal-org-file ()
+  "Baseline: the checkers DO fire on a non-spec path (the bug is scope, not silence)."
+  (let* ((out (lo-test--run-at "todo.org" lo-test--spec-decisions))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should (memq 'level2-done-without-closed cs))))
+
+(ert-deftest lo-level2-done-without-closed-skips-specs ()
+  (let* ((out (lo-test--run-at "docs/specs/2026-07-14-x-spec.org" lo-test--spec-decisions))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should-not (memq 'level2-done-without-closed cs))))
+
+(ert-deftest lo-level2-dated-header-skips-specs ()
+  (let* ((out (lo-test--run-at "docs/specs/2026-07-14-x-spec.org" lo-test--spec-history))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should-not (memq 'level-2-dated-header cs))))
+
+(ert-deftest lo-dated-log-active-timestamp-skips-specs ()
+  (let* ((c "* History\n** 2026-07-14 Tue @ 02:03:28 -0500 — did a thing\nSCHEDULED: <2026-07-20 Mon>\n")
+         (out (lo-test--run-at "docs/specs/2026-07-14-x-spec.org" c))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should-not (memq 'dated-log-heading-active-timestamp cs))))
+
+(ert-deftest lo-subtask-done-not-dated-skips-specs ()
+  (let* ((c "* Work\n** TODO Parent\n*** DONE A sub-decision\n")
+         (out (lo-test--run-at "docs/specs/2026-07-14-x-spec.org" c))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should-not (memq 'subtask-done-not-dated cs))))
+
+(ert-deftest lo-link-checks-still-fire-on-specs ()
+  "Only the todo-format family is scoped out; a broken link in a spec still flags."
+  (let* ((c "* X\n[[file:does-not-exist-xyz.org][link]]\n")
+         (out (lo-test--run-at "docs/specs/2026-07-14-x-spec.org" c))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should (memq 'link-to-local-file cs))))
+
+(ert-deftest lo-task-missing-last-reviewed-skips-specs ()
+  "The fifth todo-format checker (added 2026-07-23) skips specs too — a spec's
+phases section may carry ** TODO [#x] items that aren't backlog tasks."
+  (let* ((c "* Implementation phases\n** TODO [#B] Phase one\nBody.\n")
+         (out (lo-test--run-at "docs/specs/2026-07-14-x-spec.org" c))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should-not (memq 'task-missing-last-reviewed cs)))
+  ;; And still fires on a normal file.
+  (let* ((c "* Work\n** TODO [#B] Real backlog task\nBody.\n")
+         (out (lo-test--run-at "todo.org" c))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should (memq 'task-missing-last-reviewed cs))))
diff --git a/.ai/scripts/tests/test-todo-cleanup.el b/.ai/scripts/tests/test-todo-cleanup.el
index 838913f..a92d238 100644
--- a/.ai/scripts/tests/test-todo-cleanup.el
+++ b/.ai/scripts/tests/test-todo-cleanup.el
@@ -516,6 +516,12 @@ gitignore todo.org, then run `--archive-done' aging with the DEFAULT archive pat
 .gitignore contents or nil), :archive-ignored (whether git ignores the archive),
 :archive-exists."
   (let* ((root (make-temp-file "tc-git-" t))
+         ;; Private backup dir: this helper writes a file literally named
+         ;; todo.org and runs a real (non-check) pass, so without this its
+         ;; backup lands in the shared temp dir under the exact production
+         ;; name and is indistinguishable from a real one.
+         (temporary-file-directory
+          (file-name-as-directory (make-temp-file "tc-git-bk-" t)))
          (todo (expand-file-name "todo.org" root))
          (archive (expand-file-name "archive/task-archive.org" root))
          (gi (expand-file-name ".gitignore" root)))
@@ -536,7 +542,8 @@ gitignore todo.org, then run `--archive-done' aging with the DEFAULT archive pat
                 :archive-ignored
                 (eq 0 (call-process "git" nil nil nil "check-ignore" "-q" archive))
                 :archive-exists (file-readable-p archive)))
-      (delete-directory root t))))
+      (delete-directory root t)
+      (delete-directory temporary-file-directory t))))
 
 (ert-deftest tc-age-self-protect-gitignores-archive-when-todo-ignored ()
   "When the todo file is gitignored, the aged-out archive is added to .gitignore
@@ -1073,3 +1080,97 @@ line) is left untouched — the strip stops at the first non-planning line."
 
 (provide 'test-todo-cleanup)
 ;;; test-todo-cleanup.el ends here
+
+;;; ---------------------------------------------------------------------------
+;;; Backup before mutating (parity with lint-org.el / wrap-org-table.el)
+;;
+;; todo-cleanup rewrites todo.org in place and left no copy behind, while both
+;; sibling org-mutators back up to /tmp first. It is also the one that runs most
+;; often (every wrap, every sentry fire). Emacs's own backup does not fire under
+;; --batch -q, so there was genuinely no undo short of git.
+
+(ert-deftest tc-backup-written-before-a-real-mutation ()
+  "A real (non-check) run leaves a copy holding the pre-edit content.
+
+`temporary-file-directory' is rebound to a private dir for the duration: the
+backup name derives from the *file's* basename, and the real todo.org shares
+that basename, so a live sentry run writing /tmp/todo.org.before-todo-cleanup.*
+would otherwise be indistinguishable from this test's own artifact. The first
+version of this test globbed the shared /tmp and passed only until a real run
+created one (2026-07-24)."
+  (let* ((dir (make-temp-file "tc-backup-" t))
+         (bdir (file-name-as-directory (make-temp-file "tc-bk-" t)))
+         (file (expand-file-name "todo.org" dir))
+         (before "* P Open Work\n** TODO [#B] parent\n*** DONE a subtask\nCLOSED: [2026-07-01 Tue]\n"))
+    (unwind-protect
+        (progn
+          (with-temp-file file (insert before))
+          (let ((tc-check-only nil)
+                (tc-convert-subtasks t)
+                (temporary-file-directory bdir))
+            (tc-process-file file))
+          (let ((backups (file-expand-wildcards
+                          (concat bdir "todo.org.before-todo-cleanup.*"))))
+            (should backups)
+            (should (string-match-p
+                     "a subtask"
+                     (with-temp-buffer (insert-file-contents (car backups))
+                                       (buffer-string))))))
+      (delete-directory dir t)
+      (delete-directory bdir t))))
+
+(ert-deftest tc-no-backup-in-check-mode ()
+  "--check writes nothing, so it must not leave a backup either.
+Uses a private `temporary-file-directory' for the same isolation reason."
+  (let* ((dir (make-temp-file "tc-backup-" t))
+         (bdir (file-name-as-directory (make-temp-file "tc-bk-" t)))
+         (file (expand-file-name "todo.org" dir)))
+    (unwind-protect
+        (progn
+          (with-temp-file file
+            (insert "* P Open Work\n** TODO [#B] parent\n*** DONE sub\nCLOSED: [2026-07-01 Tue]\n"))
+          (let ((tc-check-only t)
+                (tc-convert-subtasks t)
+                (temporary-file-directory bdir))
+            (tc-process-file file))
+          (should-not (file-expand-wildcards
+                       (concat bdir "todo.org.before-todo-cleanup.*"))))
+      (delete-directory dir t)
+      (delete-directory bdir t))))
+
+(ert-deftest tc-backup-never-overwrites-an-earlier-one ()
+  "Two invocations in the same second must not collapse to one backup.
+
+open-tasks.org runs --convert-subtasks then --archive-done back to back, each
+a sub-second batch run. With a second-resolution stamp and copy-file's
+OK-IF-ALREADY-EXISTS, the second invocation overwrote the first's backup with
+already-mutated content, so the true pre-session original was unrecoverable —
+the exact state the backup exists to preserve (found 2026-07-24 in review)."
+  (let* ((dir (make-temp-file "tc-collide-" t))
+         (bdir (file-name-as-directory (make-temp-file "tc-cbk-" t)))
+         (file (expand-file-name "todo.org" dir))
+         (original (concat "* P Open Work\n** TODO [#B] parent\n*** DONE sub\n"
+                           "CLOSED: [2026-07-01 Tue]\n"
+                           "* P Resolved\n** DONE [#C] old\nCLOSED: [2025-01-01 Wed]\n")))
+    (unwind-protect
+        (progn
+          (with-temp-file file (insert original))
+          ;; Two back-to-back invocations, as the shipped workflow does.
+          (let ((temporary-file-directory bdir))
+            (let ((tc-check-only nil) (tc-convert-subtasks t))
+              (tc-process-file file))
+            (let ((tc-check-only nil) (tc-convert-subtasks nil) (tc-archive-done t)
+                  (tc-archive-retain-days nil))
+              (tc-process-file file)))
+          (let ((backups (file-expand-wildcards
+                          (concat bdir "todo.org.before-todo-cleanup.*"))))
+            ;; Both invocations kept their own backup.
+            (should (= (length backups) 2))
+            ;; And one of them still holds the true original.
+            (should (cl-some (lambda (b)
+                               (string= original
+                                        (with-temp-buffer (insert-file-contents b)
+                                                          (buffer-string))))
+                             backups))))
+      (delete-directory dir t)
+      (delete-directory bdir t))))
diff --git a/.ai/scripts/tests/test_cj_remove_block.py b/.ai/scripts/tests/test_cj_remove_block.py
index 2c8dade..3cdee46 100644
--- a/.ai/scripts/tests/test_cj_remove_block.py
+++ b/.ai/scripts/tests/test_cj_remove_block.py
@@ -14,6 +14,34 @@ import pytest
 SCRIPT = Path(__file__).parent.parent / "cj-remove-block.py"
 
 
+@pytest.fixture(autouse=True)
+def isolated_tmpdir(tmp_path, monkeypatch):
+    """Give every test in this module a private TMPDIR.
+
+    The script backs up to the system temp dir under a name derived from the
+    edited file's BASENAME. The real todo.org shares that basename, so any test
+    operating on a fixture named todo.org writes something indistinguishable
+    from a production backup — and an earlier version of this file globbed the
+    shared /tmp and unlinked every match, so a routine `make test` destroyed
+    Craig's real backups (found in review, 2026-07-24).
+
+    Isolating at module scope rather than per-test is deliberate: the same bug
+    was fixed once in the elisp sibling and left here, so relying on each new
+    test to remember is exactly how it recurred. Autouse makes it structural.
+    """
+    d = tmp_path / "_tmpdir"
+    d.mkdir()
+    # TMPDIR covers subprocess invocations of the script.
+    monkeypatch.setenv("TMPDIR", str(d))
+    # tempfile.gettempdir() caches its answer on first call, so a test that
+    # loads the module in-process would keep writing to the real /tmp no matter
+    # what TMPDIR says. Override the cache too — this is the gap that made the
+    # env-var-only version still leak one backup per suite run.
+    import tempfile as _tempfile
+    monkeypatch.setattr(_tempfile, "tempdir", str(d))
+    return d
+
+
 @pytest.fixture
 def run_remove(tmp_path):
     """Write content to a temp org file, run cj-remove-block, return new contents."""
@@ -155,3 +183,142 @@ class TestCjRemoveBlockSafety:
         err, post_content = run_remove_expecting_failure(original, start=4, end=2)
         assert err.returncode != 0
         assert post_content == original
+
+
+class TestMultiBlockRangeRefused:
+    """The validation exists to catch a drifted range, but it only checked the
+    first and last lines of that range. A span from one block's opening fence to
+    a LATER block's closing fence passed, and the removal silently deleted every
+    line between — real prose, headings, whole tasks — with a zero exit. Drift is
+    the skill's normal operating mode (respond-to-cj-comments edits the file as it
+    processes, and a file under cj review usually holds several blocks), so this
+    is the exact scenario the check was written for. Reproduced 2026-07-24."""
+
+    TWO_BLOCKS = (
+        "* Alpha\n"
+        "#+begin_src cj:\n"
+        "note A\n"
+        "#+end_src\n"
+        "KEEP THIS LINE\n"
+        "* Beta\n"
+        "#+begin_src cj:\n"
+        "note B\n"
+        "#+end_src\n"
+    )
+
+    def test_range_spanning_two_blocks_is_refused(self, run_remove_expecting_failure):
+        # Lines 2..9: block one's opener through block two's closer.
+        err, content = run_remove_expecting_failure(self.TWO_BLOCKS, 2, 9)
+        assert err.returncode == 1
+        assert "KEEP THIS LINE" in content, "content between the blocks was destroyed"
+        assert "* Beta" in content, "a heading between the blocks was destroyed"
+
+    def test_refusal_names_the_reason(self, run_remove_expecting_failure):
+        err, _ = run_remove_expecting_failure(self.TWO_BLOCKS, 2, 9)
+        assert "more than one" in err.stderr.decode().lower()
+
+    def test_a_correct_single_block_range_still_removes(self, run_remove):
+        # The fix must not over-tighten: the legitimate range still works.
+        out = run_remove(self.TWO_BLOCKS, 2, 4)
+        assert "note A" not in out
+        assert "KEEP THIS LINE" in out
+        assert "note B" in out, "the second block must be untouched"
+
+    def test_a_nested_end_src_inside_the_range_is_refused(self, run_remove_expecting_failure):
+        # Any #+end_src before the final line means the range covers >1 block.
+        content = (
+            "#+begin_src cj:\n"
+            "a\n"
+            "#+end_src\n"
+            "middle\n"
+            "#+begin_src cj:\n"
+            "b\n"
+            "#+end_src\n"
+        )
+        err, after = run_remove_expecting_failure(content, 1, 7)
+        assert err.returncode == 1
+        assert "middle" in after
+
+
+class TestSafeMutation:
+    """The script rewrites Craig's org files (todo.org, notes.org). It wrote with
+    a bare write_text, which truncates the target on open, and took no backup —
+    so a mid-write failure left the file truncated with no copy to recover from.
+    lint-org.el, the other tool that mutates these files, backs up to a temp dir
+    first. Match that, and make the write atomic.
+
+    Every test here redirects TMPDIR to a private directory. The backup name
+    derives from the file's basename, and the real todo.org shares it, so a test
+    globbing the shared temp dir cannot tell its own artifact from a genuine
+    backup — and an earlier version of this class globbed /tmp and unlinked every
+    match, so a routine `make test` destroyed real backups (found in review,
+    2026-07-24). Never glob or delete across the shared temp dir."""
+
+    ONE_BLOCK = "* T\n#+begin_src cj:\nnote\n#+end_src\nkeep\n"
+
+    def test_a_backup_is_written_before_mutating(self, tmp_path):
+        import subprocess, glob, os
+        bdir = tmp_path / "bk"
+        bdir.mkdir()
+        f = tmp_path / "todo.org"
+        f.write_text(self.ONE_BLOCK)
+        subprocess.run(
+            ["python3", str(SCRIPT), "--file", str(f), "--start", "2", "--end", "4"],
+            check=True, capture_output=True,
+            env={**os.environ, "TMPDIR": str(bdir)},
+        )
+        backups = glob.glob(str(bdir / "todo.org.before-cj-remove.*"))
+        assert backups, "no backup was written before mutating the org file"
+        assert "note" in Path(max(backups)).read_text()
+
+    def test_no_partial_file_when_the_write_fails(self, tmp_path, monkeypatch):
+        import importlib.util
+        spec = importlib.util.spec_from_file_location("crb", SCRIPT)
+        mod = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(mod)
+        bdir = tmp_path / "bk"
+        bdir.mkdir()
+        monkeypatch.setenv("TMPDIR", str(bdir))
+        f = tmp_path / "todo.org"
+        f.write_text(self.ONE_BLOCK)
+        def boom(*a, **k):
+            raise OSError("disk full")
+        monkeypatch.setattr(mod.os, "replace", boom)
+        with pytest.raises(OSError):
+            mod.remove_range(f, 2, 4)
+        # The original survives intact — no truncation, no partial.
+        assert f.read_text() == self.ONE_BLOCK
+
+
+class TestBackupNeverOverwrites:
+    """Same defect class as todo-cleanup's, and more reachable here: the
+    respond-to-cj-comments skill removes several annotations in quick
+    succession, so a second-resolution stamp collides and the later backup
+    overwrote the earlier one with already-mutated content."""
+
+    TWO_BLOCKS = (
+        "* A\n#+begin_src cj:\nfirst\n#+end_src\n"
+        "* B\n#+begin_src cj:\nsecond\n#+end_src\n"
+    )
+
+    def test_consecutive_removals_each_keep_a_backup(self, tmp_path, monkeypatch):
+        import subprocess, glob
+        bdir = tmp_path / "bk"
+        bdir.mkdir()
+        monkeypatch.setenv("TMPDIR", str(bdir))
+        f = tmp_path / "todo.org"
+        f.write_text(self.TWO_BLOCKS)
+        original = f.read_text()
+        # Remove the second block, then the first — back to back, same second.
+        subprocess.run(["python3", str(SCRIPT), "--file", str(f),
+                        "--start", "6", "--end", "8"],
+                       check=True, capture_output=True,
+                       env={**__import__("os").environ, "TMPDIR": str(bdir)})
+        subprocess.run(["python3", str(SCRIPT), "--file", str(f),
+                        "--start", "2", "--end", "4"],
+                       check=True, capture_output=True,
+                       env={**__import__("os").environ, "TMPDIR": str(bdir)})
+        backups = glob.glob(str(bdir / "todo.org.before-cj-remove.*"))
+        assert len(backups) == 2, f"expected 2 backups, got {len(backups)}"
+        contents = [Path(b).read_text() for b in backups]
+        assert original in contents, "no backup holds the true original"
diff --git a/.ai/scripts/tests/test_inbox_send.py b/.ai/scripts/tests/test_inbox_send.py
index f75d7a1..9b0a8c6 100644
--- a/.ai/scripts/tests/test_inbox_send.py
+++ b/.ai/scripts/tests/test_inbox_send.py
@@ -476,3 +476,117 @@ class TestFilenameCollisions:
         assert len(files) == 2
         bodies = "".join(f.read_text() for f in files)
         assert "message one" in bodies and "message two" in bodies
+
+
+class TestAtomicWrite:
+    """A send wrote straight to the destination path in another project's
+    inbox/, and write_text truncates on open, so any mid-write failure left a
+    zero-byte .org there. inbox-status counts that phantom as a pending
+    handoff, blocking a turn in the receiving project over a file with no
+    content (2026-07-23). The write must be atomic: the inbox sees a complete
+    file or nothing."""
+
+    def test_send_text_writes_utf8(self, tmp_path):
+        from datetime import datetime
+        mod = _load_module()
+        inbox = tmp_path / "inbox"
+        inbox.mkdir()
+        now = datetime(2026, 7, 23, 4, 36, 0)
+        # An em dash and an accented char — both non-ASCII.
+        dest = mod.send_text(inbox, "accent café and dash — here", "src", None, now)
+        # Reading as utf-8 must round-trip; a locale-encoded write would raise
+        # under a C locale, and reading back proves the bytes are utf-8.
+        assert "—" in dest.read_text(encoding="utf-8")
+
+    def test_send_text_no_partial_on_write_failure(self, tmp_path, monkeypatch):
+        from datetime import datetime
+        mod = _load_module()
+        inbox = tmp_path / "inbox"
+        inbox.mkdir()
+        now = datetime(2026, 7, 23, 4, 36, 0)
+        # Force the atomic finalize to fail after the temp file is written.
+        def boom(*a, **k):
+            raise OSError("disk full")
+        monkeypatch.setattr(mod.os, "replace", boom)
+        with pytest.raises(OSError):
+            mod.send_text(inbox, "a message that should never half-land", "src", None, now)
+        # No phantom, no leftover temp: the inbox is empty.
+        assert list(inbox.iterdir()) == []
+
+    def test_send_text_leaves_no_temp_on_success(self, tmp_path):
+        from datetime import datetime
+        mod = _load_module()
+        inbox = tmp_path / "inbox"
+        inbox.mkdir()
+        now = datetime(2026, 7, 23, 4, 36, 0)
+        dest = mod.send_text(inbox, "clean send", "src", None, now)
+        assert list(inbox.iterdir()) == [dest]
+
+    def test_send_file_no_partial_on_write_failure(self, tmp_path, monkeypatch):
+        from datetime import datetime
+        mod = _load_module()
+        inbox = tmp_path / "inbox"
+        inbox.mkdir()
+        src = tmp_path / "note.org"
+        src.write_text("body")
+        now = datetime(2026, 7, 23, 4, 36, 0)
+        def boom(*a, **k):
+            raise OSError("disk full")
+        monkeypatch.setattr(mod.os, "replace", boom)
+        with pytest.raises(OSError):
+            mod.send_file(inbox, src, "src", None, now)
+        assert list(inbox.iterdir()) == []
+
+    def test_send_file_leaves_no_temp_on_success(self, tmp_path):
+        from datetime import datetime
+        mod = _load_module()
+        inbox = tmp_path / "inbox"
+        inbox.mkdir()
+        src = tmp_path / "note.org"
+        src.write_text("payload")
+        now = datetime(2026, 7, 23, 4, 36, 0)
+        dest = mod.send_file(inbox, src, "src", None, now)
+        assert list(inbox.iterdir()) == [dest]
+        assert dest.read_text() == "payload"
+
+
+class TestSmallerDefects:
+    """Two low-severity defects found reading inbox-send during the 2026-07-23
+    sweep: an unreadable source raised an uncaught traceback instead of the
+    clean error every other failure path produces, and a roots config naming
+    both a parent and one of its children listed the same project twice."""
+
+    def test_unreadable_source_gives_clean_error_not_traceback(
+        self, project_root, run_script, tmp_path
+    ):
+        project_root("sender")
+        project_root("receiver")
+        roots = [tmp_path / "projects"]
+        src = tmp_path / "secret.bin"
+        src.write_text("x")
+        src.chmod(0o000)
+        try:
+            result = run_script(
+                ["receiver", "--file", str(src)],
+                cwd=tmp_path / "projects" / "sender",
+                roots=roots,
+                expect_failure=True,
+            )
+        finally:
+            src.chmod(0o644)
+        assert result.returncode == 1
+        # The clean "inbox-send: <message>" shape, not a Python traceback.
+        assert result.stderr.startswith("inbox-send:")
+        assert "Traceback" not in result.stderr
+
+    def test_discover_projects_dedupes_parent_and_child_root(self, tmp_path):
+        mod = _load_module()
+        # A project directory, reachable both as a child of its parent root and
+        # as a root in its own right.
+        parent = tmp_path / "projects"
+        proj = parent / "app"
+        (proj / ".ai").mkdir(parents=True)
+        (proj / "inbox").mkdir()
+        found = mod.discover_projects([parent, proj])
+        resolved = [p.resolve() for p in found]
+        assert resolved.count(proj.resolve()) == 1
diff --git a/.ai/scripts/tests/test_route_recommend.py b/.ai/scripts/tests/test_route_recommend.py
index acc4755..2ec900a 100644
--- a/.ai/scripts/tests/test_route_recommend.py
+++ b/.ai/scripts/tests/test_route_recommend.py
@@ -122,3 +122,31 @@ def test_cli_exclude_drops_current_project(tmp_path):
     r = _run(["--exclude", "foo"], roots=[tmp_path / "projects"], item="fix the foo widget")
     assert r.returncode == 0
     assert r.stdout.strip() == "none"
+
+
+# ----------------------------------------------------------------------
+# Duplicate candidate names
+#
+# Projects are collapsed to bare basenames, so two projects sharing a basename
+# across roots (~/code/notes and ~/projects/notes) appear twice in the candidate
+# list. Both literal-match, recommend read len(strong) > 1 as an ambiguous tie,
+# and a correct strong match was downgraded to weak. Latent when discovered
+# 2026-07-24 (27 projects, 27 distinct basenames) but real.
+# ----------------------------------------------------------------------
+
+def test_duplicate_candidate_name_keeps_strong_confidence():
+    assert rr.recommend("fix the notes thing", ["notes", "other"]) == ("notes", "strong")
+    # The same name twice must not read as a tie.
+    assert rr.recommend("fix the notes thing", ["notes", "notes", "other"]) == ("notes", "strong")
+
+
+def test_genuine_ambiguity_still_downgrades():
+    # Two DIFFERENT projects both matching is a real tie and stays weak — the
+    # dedupe must collapse identical names only, never real ambiguity.
+    dest, conf = rr.recommend("notes and other both", ["notes", "other"])
+    assert conf == "weak"
+
+
+def test_duplicates_do_not_change_the_chosen_destination():
+    dest, _ = rr.recommend("fix the notes thing", ["notes", "notes"])
+    assert dest == "notes"