12 files changed, 955 insertions, 15 deletions

diff --git a/claude-templates/.ai/scripts/cj-remove-block.py b/claude-templates/.ai/scripts/cj-remove-block.py
index 71c7b3d..d5137a3 100755
--- a/claude-templates/.ai/scripts/cj-remove-block.py
+++ b/claude-templates/.ai/scripts/cj-remove-block.py
@@ -16,8 +16,12 @@ Companion to the /respond-to-cj-comments skill and to cj-scan.py.
 from __future__ import annotations
 
 import argparse
+import os
 import re
+import shutil
 import sys
+import tempfile
+from datetime import datetime
 from pathlib import Path
 
 SRC_OPEN_RE = re.compile(r"^\s*#\+begin_src\s+cj:", re.IGNORECASE)
@@ -57,12 +61,83 @@ def looks_like_cj_range(lines: list[str], start: int, end: int) -> tuple[bool, s
             f"Line {end} does not look like a #+end_src closing fence "
             f"(got: {last[:60]!r})"
         )
+
+    # The range must hold exactly ONE block. Checking only the first and last
+    # lines let a drifted range run from one block's opener to a *later* block's
+    # closer: validation passed and the removal silently deleted everything
+    # between, prose and headings included. Drift is the case this check exists
+    # for, so it has to look inside the range, not just at its ends.
+    for offset, line in enumerate(lines[start:end - 1], start=start + 1):
+        if SRC_CLOSE_RE.match(line):
+            return False, (
+                f"Range {start}..{end} covers more than one cj block — "
+                f"a #+end_src appears at line {offset}, before the range ends. "
+                f"Re-scan for current line numbers; removing this range would "
+                f"delete everything between the two blocks."
+            )
+        if SRC_OPEN_RE.match(line):
+            return False, (
+                f"Range {start}..{end} covers more than one cj block — "
+                f"a second #+begin_src cj: appears at line {offset}. "
+                f"Re-scan for current line numbers."
+            )
     return True, ""
 
 
+def _backup(path: Path) -> Path:
+    """Copy path to /tmp before mutating it, mirroring lint-org.el's convention.
+
+    These are Craig's org files. lint-org.el, the other tool that rewrites them,
+    leaves a /tmp copy before touching anything; this matches it so a bad edit is
+    always recoverable without reaching for git (which only reaches the last
+    commit, losing intra-session work).
+    """
+    stamp = datetime.now().strftime("%Y%m%d-%H%M%S")
+    base = Path(tempfile.gettempdir()) / f"{path.name}.before-cj-remove.{stamp}"
+    # Never overwrite an earlier backup. The skill removes several annotations
+    # in quick succession, so a second-resolution stamp collides and the later
+    # copy would replace the earlier one with already-mutated content — losing
+    # the pre-session original the backup exists to preserve.
+    dest = base
+    n = 2
+    while dest.exists():
+        dest = base.with_name(f"{base.name}-{n}")
+        n += 1
+    shutil.copy2(path, dest)
+    return dest
+
+
+def _atomic_write(path: Path, text: str) -> None:
+    """Write text to path via a temp sibling and os.replace.
+
+    A bare write_text truncates the target on open, so a mid-write failure left
+    the org file truncated with no complete copy on disk. Writing a temp sibling
+    and renaming means the file is either its old content or its new content,
+    never a partial.
+    """
+    # Follow a symlink to the file it names. os.replace would otherwise swap the
+    # symlink itself for a regular file, leaving the real target holding the old
+    # content — the edit silently goes nowhere. Resolving also puts the temp
+    # sibling on the same filesystem as the real file, which os.replace needs.
+    path = path.resolve()
+    fd, tmp = tempfile.mkstemp(dir=path.parent, prefix=f".{path.name}.", suffix=".tmp")
+    os.close(fd)
+    tmp_path = Path(tmp)
+    # Carry the original's permissions across. mkstemp creates 0600, and
+    # defaulting to the umask instead widened a deliberately-restricted file
+    # (a 0600 org file came back 0644).
+    shutil.copymode(path, tmp_path)
+    try:
+        tmp_path.write_text(text, encoding="utf-8")
+        os.replace(tmp_path, path)
+    except BaseException:
+        tmp_path.unlink(missing_ok=True)
+        raise
+
+
 def remove_range(path: Path, start: int, end: int) -> None:
     """Read path, validate range looks like cj content, remove the range, write back."""
-    text = path.read_text()
+    text = path.read_text(encoding="utf-8")
     had_trailing_newline = text.endswith("\n")
     lines = text.splitlines(keepends=False)
 
@@ -77,7 +152,9 @@ def remove_range(path: Path, start: int, end: int) -> None:
         new_text += "\n"
     elif not new_lines and had_trailing_newline:
         new_text = ""
-    path.write_text(new_text)
+
+    _backup(path)
+    _atomic_write(path, new_text)
 
 
 def main() -> int:
diff --git a/claude-templates/.ai/scripts/inbox-send.py b/claude-templates/.ai/scripts/inbox-send.py
index 1ebb636..663efcb 100755
--- a/claude-templates/.ai/scripts/inbox-send.py
+++ b/claude-templates/.ai/scripts/inbox-send.py
@@ -31,6 +31,7 @@ import os
 import re
 import shutil
 import sys
+import tempfile
 from datetime import datetime
 from pathlib import Path
 
@@ -48,7 +49,7 @@ def resolve_roots() -> list[Path]:
     config = Path.home() / ".claude" / "inbox-roots.txt"
     if config.is_file():
         paths: list[Path] = []
-        for line in config.read_text().splitlines():
+        for line in config.read_text(encoding="utf-8").splitlines():
             line = line.strip()
             if line and not line.startswith("#"):
                 paths.append(Path(line).expanduser())
@@ -69,17 +70,28 @@ def discover_projects(roots: list[Path]) -> list[Path]:
     a specific project root (included directly if it qualifies).
     """
     projects: list[Path] = []
+    seen: set[Path] = set()
+
+    def _add(p: Path) -> None:
+        # Dedupe on the resolved path: a roots config naming both a parent and
+        # one of its children would otherwise list the child project twice, at
+        # two different indices.
+        key = p.resolve()
+        if key not in seen:
+            seen.add(key)
+            projects.append(p)
+
     for root in roots:
         if not root.is_dir():
             continue
         if _is_project(root):
-            projects.append(root)
+            _add(root)
             continue
         for child in sorted(root.iterdir()):
             if not child.is_dir():
                 continue
             if _is_project(child):
-                projects.append(child)
+                _add(child)
     return projects
 
 
@@ -194,6 +206,39 @@ def uniquify(dest: Path) -> Path:
         n += 1
 
 
+def _atomic_write(dest: Path, writer) -> None:
+    """Write to a temp file in dest's directory, then rename it into place.
+
+    dest is another project's inbox/, and a direct write truncates the target
+    on open, so any mid-write failure (a full disk, an encoding error, an
+    interrupted process) leaves a zero-byte .org there. inbox-status counts
+    that phantom as a pending handoff and blocks a turn in the receiving
+    project over a file with no content and no sender (2026-07-23). Writing to
+    a temp sibling and os.replace-ing means the inbox only ever sees a complete
+    file. os.replace is atomic within one filesystem, and the temp sits in the
+    same directory as dest, so it is.
+
+    `writer` receives the open temp path and fills it. On any failure the temp
+    is removed and the error re-raised, so a caught error never leaves debris.
+    """
+    fd, tmp = tempfile.mkstemp(
+        dir=dest.parent, prefix=".inbox-send-", suffix=dest.suffix
+    )
+    os.close(fd)
+    tmp_path = Path(tmp)
+    # mkstemp creates the temp 0600; give the delivered file the umask-default
+    # mode the old direct write produced, so inbox files stay readable as before.
+    umask = os.umask(0)
+    os.umask(umask)
+    os.chmod(tmp_path, 0o666 & ~umask)
+    try:
+        writer(tmp_path)
+        os.replace(tmp_path, dest)
+    except BaseException:
+        tmp_path.unlink(missing_ok=True)
+        raise
+
+
 def send_text(
     target_inbox: Path,
     message: str,
@@ -209,7 +254,8 @@ def send_text(
         raise ValueError(f"could not derive a slug from text: {message!r}")
     filename = f"{now.strftime(TS_FILENAME_FMT)}-from-{source_name}-{slug}.org"
     dest = uniquify(target_inbox / filename)
-    dest.write_text(build_text_org(message, source_name, now.strftime(TS_DOC_FMT)))
+    body = build_text_org(message, source_name, now.strftime(TS_DOC_FMT))
+    _atomic_write(dest, lambda p: p.write_text(body, encoding="utf-8"))
     return dest
 
 
@@ -229,7 +275,7 @@ def send_file(
     ext = src_path.suffix
     filename = f"{now.strftime(TS_FILENAME_FMT)}-from-{source_name}-{slug}{ext}"
     dest = uniquify(target_inbox / filename)
-    shutil.copy2(src_path, dest)
+    _atomic_write(dest, lambda p: shutil.copyfile(src_path, p))
     return dest
 
 
@@ -310,7 +356,10 @@ def main() -> int:
         else:
             assert args.file is not None
             dest = send_file(target_inbox, args.file, source_name, args.name, now)
-    except (ValueError, FileNotFoundError) as exc:
+    except (ValueError, OSError) as exc:
+        # OSError covers FileNotFoundError (missing source), PermissionError
+        # (unreadable source), and any atomic-write failure — all should
+        # surface as the clean "inbox-send: <message>" error, never a traceback.
         print(f"inbox-send: {exc}", file=sys.stderr)
         return 1
 
diff --git a/claude-templates/.ai/scripts/inbox-status b/claude-templates/.ai/scripts/inbox-status
index b917144..17031af 100755
--- a/claude-templates/.ai/scripts/inbox-status
+++ b/claude-templates/.ai/scripts/inbox-status
@@ -35,6 +35,7 @@ mapfile -t pending < <(find inbox -maxdepth 1 -type f \
     ! -name '.gitkeep' \
     ! -name 'lint-followups.org' \
     ! -name 'PROCESSED-*' \
+    ! -name '.inbox-send-*' \
     -printf '%f\n' 2>/dev/null | sort)
 
 n=${#pending[@]}
diff --git a/claude-templates/.ai/scripts/lint-org.el b/claude-templates/.ai/scripts/lint-org.el
index 47e8bf1..33dc52f 100644
--- a/claude-templates/.ai/scripts/lint-org.el
+++ b/claude-templates/.ai/scripts/lint-org.el
@@ -38,6 +38,7 @@
 ;;   empty-heading                     bare stars with no title
 ;;   malformed-priority-cookie         [#x]-shaped token org rejected
 ;;   level2-done-without-closed        completed level-2 task with no CLOSED
+;;   task-missing-last-reviewed        open level-2 task with no :LAST_REVIEWED:
 ;;   subtask-done-not-dated            level-3+ done sub-task still a DONE keyword
 ;;   dated-log-heading-active-timestamp  dated-log heading with a live SCHEDULED/DEADLINE
 ;;   (anything else)                   surfaced as judgment with checker name
@@ -75,6 +76,18 @@ The CLI defaults this to t (a linter reports, it doesn't write);
 `--fix' is what enables writes on a command-line run.")
 (defvar lo-current-file nil
   "Path of the file currently being processed.")
+
+(defun lo--spec-file-p ()
+  "Non-nil when the current file lives under a docs/specs/ directory.
+The four todo-format-family checkers encode todo.org completion conventions
+and misfire on a spec: a spec's Decisions section legitimately carries a
+level-2 DONE with no CLOSED cookie, and its review-history section carries
+level-2 dated headings.  docs/specs/ is the canonical spec home per the
+docs-lifecycle rule, so a path segment match is the scope test.  Link,
+table, and structural checks still run on specs — only the todo-format
+family is scoped out."
+  (and lo-current-file
+       (string-match-p "/docs/specs/" (expand-file-name lo-current-file))))
 (defvar lo-followups-file nil
   "When non-nil, after a non-check run any judgment items are appended to this
 path as an org section dated today.  The file is created if missing.")
@@ -293,6 +306,52 @@ Craig-specific annotation marker rather than Babel src-block syntax."
     (lo--goto-line line)
     (looking-at-p "^[ \t]*#\\+begin_src[ \t]+cj:")))
 
+(defvar-local lo--matched-blocks-cache nil
+  "Cons of (TICK . REGIONS) memoizing `lo--matched-block-regions'.
+TICK is the `buffer-chars-modified-tick' the regions were computed at, so a
+fix applied mid-pass invalidates them.")
+
+(defun lo--matched-block-regions ()
+  "Return ((BEGIN-LINE . END-LINE) ...) for every correctly paired block.
+Scans lines directly rather than asking org, because org's own parser is what
+mis-reads these blocks: a heading-shaped line inside a verbatim body reads as a
+structural break and loses the open block.  The scan applies org's real rule —
+once a block is open, only its own `#+end_TYPE' closes it, so a nested
+`#+begin_' or a foreign `#+end_' in the body is just text."
+  (let ((tick (buffer-chars-modified-tick)))
+    (if (eql (car lo--matched-blocks-cache) tick)
+        (cdr lo--matched-blocks-cache)
+      (let ((case-fold-search t)
+            (regions nil) (open-type nil) (open-line nil) (line 0))
+        (save-excursion
+          (goto-char (point-min))
+          (while (not (eobp))
+            (setq line (1+ line))
+            (let ((text (buffer-substring-no-properties
+                         (line-beginning-position) (line-end-position))))
+              (cond
+               (open-type
+                (when (string-match
+                       (format "\\`[ \t]*#\\+end_%s[ \t]*\\'"
+                               (regexp-quote open-type))
+                       text)
+                  (push (cons open-line line) regions)
+                  (setq open-type nil open-line nil)))
+               ((string-match "\\`[ \t]*#\\+begin_\\([^ \t\n]+\\)" text)
+                (setq open-type (match-string 1 text)
+                      open-line line))))
+            (forward-line 1)))
+        (setq lo--matched-blocks-cache (cons tick (nreverse regions)))
+        (cdr lo--matched-blocks-cache)))))
+
+(defun lo--in-matched-block-p (line)
+  "Non-nil when LINE sits within a correctly paired block, delimiters included.
+org-lint reports `invalid-block' at the delimiter lines themselves, so the
+range has to be inclusive for the suppression to reach them."
+  (cl-some (lambda (region)
+             (and (>= line (car region)) (<= line (cdr region))))
+           (lo--matched-block-regions)))
+
 (defun lo--handle-item (item)
   (let ((name (lo--checker-name item))
         (line (lo--line item))
@@ -305,6 +364,13 @@ Craig-specific annotation marker rather than Babel src-block syntax."
                         wrong-header-argument))
            (lo--cj-comment-block-opener-p line))
       nil)
+     ;; `invalid-block' on a block that is in fact correctly paired — the
+     ;; checker is org-lint's own, so this filters its output rather than
+     ;; fixing a local checker.  A genuinely unterminated block isn't in any
+     ;; matched region, so it still reports.
+     ((and (eq name 'invalid-block)
+           (lo--in-matched-block-p line))
+      nil)
      ((eq name 'item-number)
       (lo--apply-or-preview name line msg #'lo-fix-item-number))
      ((eq name 'missing-language-in-src-block)
@@ -526,6 +592,42 @@ the live file on the next `task-sorted'."
                "level-2 DONE/CANCELLED has no CLOSED date — add CLOSED: [YYYY-MM-DD Day]; task-sorted's aging step archives an undated completed task immediately"))))))))
 
 ;;; ---------------------------------------------------------------------------
+;;; task-missing-last-reviewed check (claude-rules/todo-format.md)
+;;
+;; A task is stamped `:LAST_REVIEWED:' when it is *created*, not a review cycle
+;; later.  An agent filing a task has just written its body and graded its
+;; priority, which is a review by any honest reading — so a fresh task that
+;; carries no stamp reads as "never reviewed" and lands at the top of the next
+;; staleness batch, where re-reviewing it is pure ceremony.  Every task filed
+;; during the 2026-07-23 sweep hit exactly that, which is what prompted the rule.
+;;
+;; Judgment-only, deliberately.  The stamp's whole value is that its date is
+;; true, and nothing here can know when an unstamped task was actually last
+;; looked at.  Auto-stamping today's date would convert a "nobody has reviewed
+;; this" signal into a false "reviewed today" one — worse than the gap it
+;; closes.  Flag it; a human or the filing workflow supplies the honest date.
+;;
+;; Scope matches `task-review-staleness.sh' exactly (level-2, open keyword,
+;; priority cookie), so the checker and the staleness count never disagree
+;; about which headings are in the review pool.
+
+(defun lo--check-task-missing-last-reviewed ()
+  "Flag an open level-2 task with a priority cookie and no `:LAST_REVIEWED:'."
+  (save-excursion
+    (goto-char (point-min))
+    (let ((case-fold-search nil))
+      (while (re-search-forward "^\\*\\* \\(TODO\\|DOING\\|VERIFY\\) \\[#[A-D]\\]" nil t)
+        (let ((hline (line-number-at-pos))
+              (entry-end (save-excursion (outline-next-heading) (point))))
+          (save-excursion
+            (forward-line 1)
+            (unless (re-search-forward "^[ \t]*:LAST_REVIEWED:[ \t]*[[0-9]"
+                                       entry-end t)
+              (lo--emit-judgment
+               'task-missing-last-reviewed hline
+               "task has no :LAST_REVIEWED: — stamp it at creation with today's date (a task you just wrote and graded is reviewed); otherwise it enters the next staleness batch as never-reviewed"))))))))
+
+;;; ---------------------------------------------------------------------------
 ;;; level-3+ dated-header check (claude-rules/todo-format.md)
 ;;
 ;; The inverse of the level-2 check above.  A completed sub-task — a heading at
@@ -620,15 +722,22 @@ left unmodified and mechanical entries are recorded with :preview t."
           ;; After org-lint items: the custom table-standard scan. Runs on the
           ;; post-fix buffer; judgment-only, so order doesn't perturb fixes.
           (lo--check-tables)
-          ;; Same shape: flag level-2 dated headers (completion defects).
-          (lo--check-level2-dated-headers)
-          ;; Structural heading defects org-lint doesn't cover.
+          ;; Structural heading defects org-lint doesn't cover. These run on
+          ;; every org file, specs included.
           (lo--check-indented-headings)
           (lo--check-empty-headings)
           (lo--check-malformed-priority-cookies)
-          (lo--check-level2-done-without-closed)
-          (lo--check-subtask-done-not-dated)
-          (lo--check-dated-log-active-timestamp)
+          ;; The todo-format family encodes todo.org completion conventions and
+          ;; misfires on a spec (a Decisions section's undated DONE, a
+          ;; review-history dated heading, a phases task with no LAST_REVIEWED).
+          ;; Scope them out of docs/specs/; link, table, and structural checks
+          ;; above still run there.
+          (unless (lo--spec-file-p)
+            (lo--check-level2-dated-headers)
+            (lo--check-level2-done-without-closed)
+            (lo--check-task-missing-last-reviewed)
+            (lo--check-subtask-done-not-dated)
+            (lo--check-dated-log-active-timestamp))
           (when (and (not lo-check-only) (buffer-modified-p))
             (save-buffer)))
       (with-current-buffer buf (set-buffer-modified-p nil))
diff --git a/claude-templates/.ai/scripts/route_recommend.py b/claude-templates/.ai/scripts/route_recommend.py
index 7b36405..12ab132 100644
--- a/claude-templates/.ai/scripts/route_recommend.py
+++ b/claude-templates/.ai/scripts/route_recommend.py
@@ -71,6 +71,15 @@ def recommend(item: str, projects: list[str]) -> tuple[str | None, str]:
     if not projects:
         return (None, "none")
 
+    # Collapse identical names first. Projects are addressed by bare basename, so
+    # two projects sharing one across roots (~/code/notes, ~/projects/notes) arrive
+    # twice; both literal-match, and the tie test below then read that as ambiguity
+    # and downgraded a correct strong match to weak. Deduping here rather than in
+    # discover_destination_names protects every caller of the pure core, not just
+    # the CLI path. Order-preserving, and it collapses only identical names — two
+    # *different* projects matching is real ambiguity and still downgrades.
+    projects = list(dict.fromkeys(projects))
+
     item_lower = item.lower()
     item_tokens = _tokens(item)
 
diff --git a/claude-templates/.ai/scripts/tests/inbox-status.bats b/claude-templates/.ai/scripts/tests/inbox-status.bats
index bc8a734..27a497e 100644
--- a/claude-templates/.ai/scripts/tests/inbox-status.bats
+++ b/claude-templates/.ai/scripts/tests/inbox-status.bats
@@ -45,6 +45,18 @@ teardown() {
     [[ "$output" == *"0 pending"* ]]
 }
 
+@test "inbox-status: ignores an in-flight .inbox-send-* temp file" {
+    mkdir "$TMP/inbox"
+    # inbox-send writes to a .inbox-send-* temp then renames it into place;
+    # during that window the temp must not read as a pending handoff, or a
+    # concurrent boundary check blocks on a file that's about to become real.
+    touch "$TMP/inbox/.inbox-send-abc123.org"
+    cd "$TMP"
+    run "$SCRIPT"
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"0 pending"* ]]
+}
+
 @test "inbox-status: -q suppresses the per-item lines" {
     mkdir "$TMP/inbox"
     echo body > "$TMP/inbox/handoff.org"
diff --git a/claude-templates/.ai/scripts/tests/test-lint-org.el b/claude-templates/.ai/scripts/tests/test-lint-org.el
index 30a79bd..ceee209 100644
--- a/claude-templates/.ai/scripts/tests/test-lint-org.el
+++ b/claude-templates/.ai/scripts/tests/test-lint-org.el
@@ -193,6 +193,65 @@ real suspicious-language warning here
 #+end_src
 ")
 
+;; invalid-block, false-positive case — a correctly paired example block whose
+;; body holds a heading-shaped line.  org's parser reads the `** ' inside the
+;; verbatim body as a structural break, loses the open block, and flags BOTH
+;; delimiters as "Possible incomplete block".
+(defconst lo-test--verbatim-heading-block "\
+* Heading
+
+#+begin_example
+** Feature Name or Topic
+Body line.
+#+end_example
+
+Trailing prose.
+")
+
+;; invalid-block, literal-delimiter case — a paired src block whose body holds
+;; a literal `#+end_example' plus a heading-shaped line.  Only `#+end_src'
+;; closes a src block, so all three findings here are false.
+(defconst lo-test--literal-end-in-src "\
+* Heading
+
+#+begin_src text
+#+end_example
+** heading shaped
+#+end_src
+")
+
+;; invalid-block, uppercase-delimiter case — org accepts #+BEGIN_/#+END_ in
+;; either case, and the pre-fix script flagged both delimiters here too.
+(defconst lo-test--uppercase-verbatim-block "\
+* Heading
+
+#+BEGIN_EXAMPLE
+** heading shaped
+#+END_EXAMPLE
+")
+
+;; invalid-block, genuine case — a block that really is never closed.  The
+;; suppression must not reach this one.
+(defconst lo-test--unterminated-block "\
+* Heading
+
+#+begin_example
+truly unterminated block body
+")
+
+;; A genuinely unterminated block *after* a correctly paired one — verifies the
+;; suppression is scoped per block rather than per file.
+(defconst lo-test--paired-then-unterminated "\
+* Heading
+
+#+begin_example
+** heading shaped
+#+end_example
+
+#+begin_example
+never closed
+")
+
 ;; Mixed fixture — each category once.
 (defconst lo-test--mixed "\
 * Mixed
@@ -392,6 +451,55 @@ suspicious-language judgment."
     (should (= 1 suspicious))))
 
 ;;; ---------------------------------------------------------------------------
+;;; invalid-block — false positives on correctly paired verbatim blocks
+
+(ert-deftest lo-verbatim-heading-block-emits-no-invalid-block ()
+  "Normal: a paired example block containing a heading-shaped body line emits
+no invalid-block judgment.  Both delimiters are flagged by org-lint because the
+parser treats the `** ' inside the verbatim body as a structural break."
+  (let* ((out (lo-test--run lo-test--verbatim-heading-block))
+         (res (plist-get out :result))
+         (judgments (lo-test--judgments (plist-get out :issues))))
+    ;; File untouched, no fixes applied — suppression only, never a rewrite.
+    (should (equal lo-test--verbatim-heading-block res))
+    (should (= 0 (plist-get out :fixes)))
+    (should-not (member 'invalid-block (lo-test--checkers judgments)))))
+
+(ert-deftest lo-literal-end-delimiter-in-src-emits-no-invalid-block ()
+  "Boundary: a paired src block whose body holds a literal `#+end_example' and
+a heading-shaped line emits no invalid-block judgment.  Only `#+end_src' closes
+a src block, so the interior delimiter is body text."
+  (let* ((out (lo-test--run lo-test--literal-end-in-src))
+         (judgments (lo-test--judgments (plist-get out :issues))))
+    (should-not (member 'invalid-block (lo-test--checkers judgments)))))
+
+(ert-deftest lo-uppercase-verbatim-block-emits-no-invalid-block ()
+  "Boundary: block delimiters are case-insensitive in org, so an uppercase
+`#+BEGIN_EXAMPLE' pair is suppressed the same as a lowercase one."
+  (let* ((out (lo-test--run lo-test--uppercase-verbatim-block))
+         (judgments (lo-test--judgments (plist-get out :issues))))
+    (should-not (member 'invalid-block (lo-test--checkers judgments)))))
+
+(ert-deftest lo-unterminated-block-still-emits-invalid-block ()
+  "Error: a block that is never closed still emits its invalid-block judgment.
+This is the finding the checker exists for — the suppression must not mask it."
+  (let* ((out (lo-test--run lo-test--unterminated-block))
+         (judgments (lo-test--judgments (plist-get out :issues))))
+    (should (member 'invalid-block (lo-test--checkers judgments)))))
+
+(ert-deftest lo-invalid-block-suppression-is-scoped-per-block ()
+  "Boundary: a paired block and an unterminated block in the same file — the
+paired one is suppressed and the unterminated one still reports.  Exactly one
+invalid-block judgment, and it points at the unterminated opener (line 7)."
+  (let* ((out (lo-test--run lo-test--paired-then-unterminated))
+         (judgments (lo-test--judgments (plist-get out :issues)))
+         (invalid (cl-remove-if-not
+                   (lambda (i) (eq (plist-get i :checker) 'invalid-block))
+                   judgments)))
+    (should (= 1 (length invalid)))
+    (should (= 7 (plist-get (car invalid) :line)))))
+
+;;; ---------------------------------------------------------------------------
 ;;; --check mode
 
 (ert-deftest lo-check-mode-does-not-modify-file ()
@@ -859,3 +967,134 @@ heading, so it is not flagged — only two-or-more indented stars are."
 
 (provide 'test-lint-org)
 ;;; test-lint-org.el ends here
+
+;;; ---------------------------------------------------------------------------
+;;; task-missing-last-reviewed (claude-rules/todo-format.md)
+
+(ert-deftest lo-task-without-last-reviewed-is-judgment ()
+  "An open level-2 task with no :LAST_REVIEWED: is flagged."
+  (let* ((out (lo-test--run "* Open Work\n** TODO [#B] A task :feature:\nBody.\n"))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-task-with-last-reviewed-is-clean ()
+  "A task carrying the property is not flagged."
+  (let* ((out (lo-test--run (concat "* Open Work\n** TODO [#B] A task :feature:\n"
+                                    ":PROPERTIES:\n:LAST_REVIEWED: 2026-07-23\n:END:\n"
+                                    "Body.\n")))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-task-last-reviewed-accepts-org-timestamp ()
+  "The org-native [YYYY-MM-DD Day] form counts, matching the staleness script."
+  (let* ((out (lo-test--run (concat "* Open Work\n** TODO [#B] A task :feature:\n"
+                                    ":PROPERTIES:\n:LAST_REVIEWED: [2026-07-23 Thu]\n:END:\n")))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-done-task-without-last-reviewed-is-clean ()
+  "Completed tasks leave the review pool, so they are never flagged."
+  (let* ((out (lo-test--run (concat "* Open Work\n** DONE [#B] A task :feature:\n"
+                                    "CLOSED: [2026-07-23 Thu]\n")))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-subtask-without-last-reviewed-is-clean ()
+  "Only level-2 tasks are in the review pool; deeper headings are not."
+  (let* ((out (lo-test--run (concat "* Open Work\n** TODO [#B] Parent :feature:\n"
+                                    ":PROPERTIES:\n:LAST_REVIEWED: 2026-07-23\n:END:\n"
+                                    "*** TODO A sub-task\n")))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-cookieless-task-without-last-reviewed-is-clean ()
+  "The staleness script selects on a priority cookie, so match that scope."
+  (let* ((out (lo-test--run "* Open Work\n** TODO Manual testing and validation\n"))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-verify-task-without-last-reviewed-is-judgment ()
+  "VERIFY is in the review pool too."
+  (let* ((out (lo-test--run "* Open Work\n** VERIFY [#B] Waiting on Craig\n"))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+;;; ---------------------------------------------------------------------------
+;;; todo-format checkers skip docs/specs/ files (claude-rules/todo-format.md)
+;;
+;; The four todo-format-family checkers encode todo.org completion conventions.
+;; A spec legitimately uses ** DONE <decision> with no CLOSED cookie and
+;; ** <dated> — <who> review-history headings, so those checkers misfire on
+;; every spec. They must skip any file under a docs/specs/ path segment.
+
+(defun lo-test--run-at (relpath content)
+  "Write CONTENT to <tmpdir>/RELPATH, run lint on it, return :issues.
+RELPATH is a relative path (may contain slashes) so a docs/specs/ segment
+can be exercised — the checkers key on the file's path, not just its name."
+  (let* ((root (make-temp-file "lo-test-root-" t))
+         (file (expand-file-name relpath root)))
+    (make-directory (file-name-directory file) t)
+    (unwind-protect
+        (progn
+          (with-temp-file file (insert content))
+          (lo-test--reset)
+          (lo-process-file file)
+          (prog1 (list :issues lo-issues)
+            (lo-test--drop-buffer file)))
+      (delete-directory root t))))
+
+(defconst lo-test--spec-decisions
+  "* Decisions [1/1]\n** DONE Some decision\n- Context: x\n"
+  "A spec Decisions section: a level-2 DONE with no CLOSED cookie.")
+
+(defconst lo-test--spec-history
+  "* Review history\n** 2026-07-14 Tue @ 02:03:28 -0500 — Claude — responder\n- What: x\n"
+  "A spec review-history section: a level-2 dated header.")
+
+(ert-deftest lo-todo-checkers-fire-on-a-normal-org-file ()
+  "Baseline: the checkers DO fire on a non-spec path (the bug is scope, not silence)."
+  (let* ((out (lo-test--run-at "todo.org" lo-test--spec-decisions))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should (memq 'level2-done-without-closed cs))))
+
+(ert-deftest lo-level2-done-without-closed-skips-specs ()
+  (let* ((out (lo-test--run-at "docs/specs/2026-07-14-x-spec.org" lo-test--spec-decisions))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should-not (memq 'level2-done-without-closed cs))))
+
+(ert-deftest lo-level2-dated-header-skips-specs ()
+  (let* ((out (lo-test--run-at "docs/specs/2026-07-14-x-spec.org" lo-test--spec-history))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should-not (memq 'level-2-dated-header cs))))
+
+(ert-deftest lo-dated-log-active-timestamp-skips-specs ()
+  (let* ((c "* History\n** 2026-07-14 Tue @ 02:03:28 -0500 — did a thing\nSCHEDULED: <2026-07-20 Mon>\n")
+         (out (lo-test--run-at "docs/specs/2026-07-14-x-spec.org" c))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should-not (memq 'dated-log-heading-active-timestamp cs))))
+
+(ert-deftest lo-subtask-done-not-dated-skips-specs ()
+  (let* ((c "* Work\n** TODO Parent\n*** DONE A sub-decision\n")
+         (out (lo-test--run-at "docs/specs/2026-07-14-x-spec.org" c))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should-not (memq 'subtask-done-not-dated cs))))
+
+(ert-deftest lo-link-checks-still-fire-on-specs ()
+  "Only the todo-format family is scoped out; a broken link in a spec still flags."
+  (let* ((c "* X\n[[file:does-not-exist-xyz.org][link]]\n")
+         (out (lo-test--run-at "docs/specs/2026-07-14-x-spec.org" c))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should (memq 'link-to-local-file cs))))
+
+(ert-deftest lo-task-missing-last-reviewed-skips-specs ()
+  "The fifth todo-format checker (added 2026-07-23) skips specs too — a spec's
+phases section may carry ** TODO [#x] items that aren't backlog tasks."
+  (let* ((c "* Implementation phases\n** TODO [#B] Phase one\nBody.\n")
+         (out (lo-test--run-at "docs/specs/2026-07-14-x-spec.org" c))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should-not (memq 'task-missing-last-reviewed cs)))
+  ;; And still fires on a normal file.
+  (let* ((c "* Work\n** TODO [#B] Real backlog task\nBody.\n")
+         (out (lo-test--run-at "todo.org" c))
+         (cs (lo-test--checkers (lo-test--judgments (plist-get out :issues)))))
+    (should (memq 'task-missing-last-reviewed cs))))
diff --git a/claude-templates/.ai/scripts/tests/test-todo-cleanup.el b/claude-templates/.ai/scripts/tests/test-todo-cleanup.el
index 838913f..a92d238 100644
--- a/claude-templates/.ai/scripts/tests/test-todo-cleanup.el
+++ b/claude-templates/.ai/scripts/tests/test-todo-cleanup.el
@@ -516,6 +516,12 @@ gitignore todo.org, then run `--archive-done' aging with the DEFAULT archive pat
 .gitignore contents or nil), :archive-ignored (whether git ignores the archive),
 :archive-exists."
   (let* ((root (make-temp-file "tc-git-" t))
+         ;; Private backup dir: this helper writes a file literally named
+         ;; todo.org and runs a real (non-check) pass, so without this its
+         ;; backup lands in the shared temp dir under the exact production
+         ;; name and is indistinguishable from a real one.
+         (temporary-file-directory
+          (file-name-as-directory (make-temp-file "tc-git-bk-" t)))
          (todo (expand-file-name "todo.org" root))
          (archive (expand-file-name "archive/task-archive.org" root))
          (gi (expand-file-name ".gitignore" root)))
@@ -536,7 +542,8 @@ gitignore todo.org, then run `--archive-done' aging with the DEFAULT archive pat
                 :archive-ignored
                 (eq 0 (call-process "git" nil nil nil "check-ignore" "-q" archive))
                 :archive-exists (file-readable-p archive)))
-      (delete-directory root t))))
+      (delete-directory root t)
+      (delete-directory temporary-file-directory t))))
 
 (ert-deftest tc-age-self-protect-gitignores-archive-when-todo-ignored ()
   "When the todo file is gitignored, the aged-out archive is added to .gitignore
@@ -1073,3 +1080,97 @@ line) is left untouched — the strip stops at the first non-planning line."
 
 (provide 'test-todo-cleanup)
 ;;; test-todo-cleanup.el ends here
+
+;;; ---------------------------------------------------------------------------
+;;; Backup before mutating (parity with lint-org.el / wrap-org-table.el)
+;;
+;; todo-cleanup rewrites todo.org in place and left no copy behind, while both
+;; sibling org-mutators back up to /tmp first. It is also the one that runs most
+;; often (every wrap, every sentry fire). Emacs's own backup does not fire under
+;; --batch -q, so there was genuinely no undo short of git.
+
+(ert-deftest tc-backup-written-before-a-real-mutation ()
+  "A real (non-check) run leaves a copy holding the pre-edit content.
+
+`temporary-file-directory' is rebound to a private dir for the duration: the
+backup name derives from the *file's* basename, and the real todo.org shares
+that basename, so a live sentry run writing /tmp/todo.org.before-todo-cleanup.*
+would otherwise be indistinguishable from this test's own artifact. The first
+version of this test globbed the shared /tmp and passed only until a real run
+created one (2026-07-24)."
+  (let* ((dir (make-temp-file "tc-backup-" t))
+         (bdir (file-name-as-directory (make-temp-file "tc-bk-" t)))
+         (file (expand-file-name "todo.org" dir))
+         (before "* P Open Work\n** TODO [#B] parent\n*** DONE a subtask\nCLOSED: [2026-07-01 Tue]\n"))
+    (unwind-protect
+        (progn
+          (with-temp-file file (insert before))
+          (let ((tc-check-only nil)
+                (tc-convert-subtasks t)
+                (temporary-file-directory bdir))
+            (tc-process-file file))
+          (let ((backups (file-expand-wildcards
+                          (concat bdir "todo.org.before-todo-cleanup.*"))))
+            (should backups)
+            (should (string-match-p
+                     "a subtask"
+                     (with-temp-buffer (insert-file-contents (car backups))
+                                       (buffer-string))))))
+      (delete-directory dir t)
+      (delete-directory bdir t))))
+
+(ert-deftest tc-no-backup-in-check-mode ()
+  "--check writes nothing, so it must not leave a backup either.
+Uses a private `temporary-file-directory' for the same isolation reason."
+  (let* ((dir (make-temp-file "tc-backup-" t))
+         (bdir (file-name-as-directory (make-temp-file "tc-bk-" t)))
+         (file (expand-file-name "todo.org" dir)))
+    (unwind-protect
+        (progn
+          (with-temp-file file
+            (insert "* P Open Work\n** TODO [#B] parent\n*** DONE sub\nCLOSED: [2026-07-01 Tue]\n"))
+          (let ((tc-check-only t)
+                (tc-convert-subtasks t)
+                (temporary-file-directory bdir))
+            (tc-process-file file))
+          (should-not (file-expand-wildcards
+                       (concat bdir "todo.org.before-todo-cleanup.*"))))
+      (delete-directory dir t)
+      (delete-directory bdir t))))
+
+(ert-deftest tc-backup-never-overwrites-an-earlier-one ()
+  "Two invocations in the same second must not collapse to one backup.
+
+open-tasks.org runs --convert-subtasks then --archive-done back to back, each
+a sub-second batch run. With a second-resolution stamp and copy-file's
+OK-IF-ALREADY-EXISTS, the second invocation overwrote the first's backup with
+already-mutated content, so the true pre-session original was unrecoverable —
+the exact state the backup exists to preserve (found 2026-07-24 in review)."
+  (let* ((dir (make-temp-file "tc-collide-" t))
+         (bdir (file-name-as-directory (make-temp-file "tc-cbk-" t)))
+         (file (expand-file-name "todo.org" dir))
+         (original (concat "* P Open Work\n** TODO [#B] parent\n*** DONE sub\n"
+                           "CLOSED: [2026-07-01 Tue]\n"
+                           "* P Resolved\n** DONE [#C] old\nCLOSED: [2025-01-01 Wed]\n")))
+    (unwind-protect
+        (progn
+          (with-temp-file file (insert original))
+          ;; Two back-to-back invocations, as the shipped workflow does.
+          (let ((temporary-file-directory bdir))
+            (let ((tc-check-only nil) (tc-convert-subtasks t))
+              (tc-process-file file))
+            (let ((tc-check-only nil) (tc-convert-subtasks nil) (tc-archive-done t)
+                  (tc-archive-retain-days nil))
+              (tc-process-file file)))
+          (let ((backups (file-expand-wildcards
+                          (concat bdir "todo.org.before-todo-cleanup.*"))))
+            ;; Both invocations kept their own backup.
+            (should (= (length backups) 2))
+            ;; And one of them still holds the true original.
+            (should (cl-some (lambda (b)
+                               (string= original
+                                        (with-temp-buffer (insert-file-contents b)
+                                                          (buffer-string))))
+                             backups))))
+      (delete-directory dir t)
+      (delete-directory bdir t))))
diff --git a/claude-templates/.ai/scripts/tests/test_cj_remove_block.py b/claude-templates/.ai/scripts/tests/test_cj_remove_block.py
index 2c8dade..3cdee46 100644
--- a/claude-templates/.ai/scripts/tests/test_cj_remove_block.py
+++ b/claude-templates/.ai/scripts/tests/test_cj_remove_block.py
@@ -14,6 +14,34 @@ import pytest
 SCRIPT = Path(__file__).parent.parent / "cj-remove-block.py"
 
 
+@pytest.fixture(autouse=True)
+def isolated_tmpdir(tmp_path, monkeypatch):
+    """Give every test in this module a private TMPDIR.
+
+    The script backs up to the system temp dir under a name derived from the
+    edited file's BASENAME. The real todo.org shares that basename, so any test
+    operating on a fixture named todo.org writes something indistinguishable
+    from a production backup — and an earlier version of this file globbed the
+    shared /tmp and unlinked every match, so a routine `make test` destroyed
+    Craig's real backups (found in review, 2026-07-24).
+
+    Isolating at module scope rather than per-test is deliberate: the same bug
+    was fixed once in the elisp sibling and left here, so relying on each new
+    test to remember is exactly how it recurred. Autouse makes it structural.
+    """
+    d = tmp_path / "_tmpdir"
+    d.mkdir()
+    # TMPDIR covers subprocess invocations of the script.
+    monkeypatch.setenv("TMPDIR", str(d))
+    # tempfile.gettempdir() caches its answer on first call, so a test that
+    # loads the module in-process would keep writing to the real /tmp no matter
+    # what TMPDIR says. Override the cache too — this is the gap that made the
+    # env-var-only version still leak one backup per suite run.
+    import tempfile as _tempfile
+    monkeypatch.setattr(_tempfile, "tempdir", str(d))
+    return d
+
+
 @pytest.fixture
 def run_remove(tmp_path):
     """Write content to a temp org file, run cj-remove-block, return new contents."""
@@ -155,3 +183,142 @@ class TestCjRemoveBlockSafety:
         err, post_content = run_remove_expecting_failure(original, start=4, end=2)
         assert err.returncode != 0
         assert post_content == original
+
+
+class TestMultiBlockRangeRefused:
+    """The validation exists to catch a drifted range, but it only checked the
+    first and last lines of that range. A span from one block's opening fence to
+    a LATER block's closing fence passed, and the removal silently deleted every
+    line between — real prose, headings, whole tasks — with a zero exit. Drift is
+    the skill's normal operating mode (respond-to-cj-comments edits the file as it
+    processes, and a file under cj review usually holds several blocks), so this
+    is the exact scenario the check was written for. Reproduced 2026-07-24."""
+
+    TWO_BLOCKS = (
+        "* Alpha\n"
+        "#+begin_src cj:\n"
+        "note A\n"
+        "#+end_src\n"
+        "KEEP THIS LINE\n"
+        "* Beta\n"
+        "#+begin_src cj:\n"
+        "note B\n"
+        "#+end_src\n"
+    )
+
+    def test_range_spanning_two_blocks_is_refused(self, run_remove_expecting_failure):
+        # Lines 2..9: block one's opener through block two's closer.
+        err, content = run_remove_expecting_failure(self.TWO_BLOCKS, 2, 9)
+        assert err.returncode == 1
+        assert "KEEP THIS LINE" in content, "content between the blocks was destroyed"
+        assert "* Beta" in content, "a heading between the blocks was destroyed"
+
+    def test_refusal_names_the_reason(self, run_remove_expecting_failure):
+        err, _ = run_remove_expecting_failure(self.TWO_BLOCKS, 2, 9)
+        assert "more than one" in err.stderr.decode().lower()
+
+    def test_a_correct_single_block_range_still_removes(self, run_remove):
+        # The fix must not over-tighten: the legitimate range still works.
+        out = run_remove(self.TWO_BLOCKS, 2, 4)
+        assert "note A" not in out
+        assert "KEEP THIS LINE" in out
+        assert "note B" in out, "the second block must be untouched"
+
+    def test_a_nested_end_src_inside_the_range_is_refused(self, run_remove_expecting_failure):
+        # Any #+end_src before the final line means the range covers >1 block.
+        content = (
+            "#+begin_src cj:\n"
+            "a\n"
+            "#+end_src\n"
+            "middle\n"
+            "#+begin_src cj:\n"
+            "b\n"
+            "#+end_src\n"
+        )
+        err, after = run_remove_expecting_failure(content, 1, 7)
+        assert err.returncode == 1
+        assert "middle" in after
+
+
+class TestSafeMutation:
+    """The script rewrites Craig's org files (todo.org, notes.org). It wrote with
+    a bare write_text, which truncates the target on open, and took no backup —
+    so a mid-write failure left the file truncated with no copy to recover from.
+    lint-org.el, the other tool that mutates these files, backs up to a temp dir
+    first. Match that, and make the write atomic.
+
+    Every test here redirects TMPDIR to a private directory. The backup name
+    derives from the file's basename, and the real todo.org shares it, so a test
+    globbing the shared temp dir cannot tell its own artifact from a genuine
+    backup — and an earlier version of this class globbed /tmp and unlinked every
+    match, so a routine `make test` destroyed real backups (found in review,
+    2026-07-24). Never glob or delete across the shared temp dir."""
+
+    ONE_BLOCK = "* T\n#+begin_src cj:\nnote\n#+end_src\nkeep\n"
+
+    def test_a_backup_is_written_before_mutating(self, tmp_path):
+        import subprocess, glob, os
+        bdir = tmp_path / "bk"
+        bdir.mkdir()
+        f = tmp_path / "todo.org"
+        f.write_text(self.ONE_BLOCK)
+        subprocess.run(
+            ["python3", str(SCRIPT), "--file", str(f), "--start", "2", "--end", "4"],
+            check=True, capture_output=True,
+            env={**os.environ, "TMPDIR": str(bdir)},
+        )
+        backups = glob.glob(str(bdir / "todo.org.before-cj-remove.*"))
+        assert backups, "no backup was written before mutating the org file"
+        assert "note" in Path(max(backups)).read_text()
+
+    def test_no_partial_file_when_the_write_fails(self, tmp_path, monkeypatch):
+        import importlib.util
+        spec = importlib.util.spec_from_file_location("crb", SCRIPT)
+        mod = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(mod)
+        bdir = tmp_path / "bk"
+        bdir.mkdir()
+        monkeypatch.setenv("TMPDIR", str(bdir))
+        f = tmp_path / "todo.org"
+        f.write_text(self.ONE_BLOCK)
+        def boom(*a, **k):
+            raise OSError("disk full")
+        monkeypatch.setattr(mod.os, "replace", boom)
+        with pytest.raises(OSError):
+            mod.remove_range(f, 2, 4)
+        # The original survives intact — no truncation, no partial.
+        assert f.read_text() == self.ONE_BLOCK
+
+
+class TestBackupNeverOverwrites:
+    """Same defect class as todo-cleanup's, and more reachable here: the
+    respond-to-cj-comments skill removes several annotations in quick
+    succession, so a second-resolution stamp collides and the later backup
+    overwrote the earlier one with already-mutated content."""
+
+    TWO_BLOCKS = (
+        "* A\n#+begin_src cj:\nfirst\n#+end_src\n"
+        "* B\n#+begin_src cj:\nsecond\n#+end_src\n"
+    )
+
+    def test_consecutive_removals_each_keep_a_backup(self, tmp_path, monkeypatch):
+        import subprocess, glob
+        bdir = tmp_path / "bk"
+        bdir.mkdir()
+        monkeypatch.setenv("TMPDIR", str(bdir))
+        f = tmp_path / "todo.org"
+        f.write_text(self.TWO_BLOCKS)
+        original = f.read_text()
+        # Remove the second block, then the first — back to back, same second.
+        subprocess.run(["python3", str(SCRIPT), "--file", str(f),
+                        "--start", "6", "--end", "8"],
+                       check=True, capture_output=True,
+                       env={**__import__("os").environ, "TMPDIR": str(bdir)})
+        subprocess.run(["python3", str(SCRIPT), "--file", str(f),
+                        "--start", "2", "--end", "4"],
+                       check=True, capture_output=True,
+                       env={**__import__("os").environ, "TMPDIR": str(bdir)})
+        backups = glob.glob(str(bdir / "todo.org.before-cj-remove.*"))
+        assert len(backups) == 2, f"expected 2 backups, got {len(backups)}"
+        contents = [Path(b).read_text() for b in backups]
+        assert original in contents, "no backup holds the true original"
diff --git a/claude-templates/.ai/scripts/tests/test_inbox_send.py b/claude-templates/.ai/scripts/tests/test_inbox_send.py
index f75d7a1..9b0a8c6 100644
--- a/claude-templates/.ai/scripts/tests/test_inbox_send.py
+++ b/claude-templates/.ai/scripts/tests/test_inbox_send.py
@@ -476,3 +476,117 @@ class TestFilenameCollisions:
         assert len(files) == 2
         bodies = "".join(f.read_text() for f in files)
         assert "message one" in bodies and "message two" in bodies
+
+
+class TestAtomicWrite:
+    """A send wrote straight to the destination path in another project's
+    inbox/, and write_text truncates on open, so any mid-write failure left a
+    zero-byte .org there. inbox-status counts that phantom as a pending
+    handoff, blocking a turn in the receiving project over a file with no
+    content (2026-07-23). The write must be atomic: the inbox sees a complete
+    file or nothing."""
+
+    def test_send_text_writes_utf8(self, tmp_path):
+        from datetime import datetime
+        mod = _load_module()
+        inbox = tmp_path / "inbox"
+        inbox.mkdir()
+        now = datetime(2026, 7, 23, 4, 36, 0)
+        # An em dash and an accented char — both non-ASCII.
+        dest = mod.send_text(inbox, "accent café and dash — here", "src", None, now)
+        # Reading as utf-8 must round-trip; a locale-encoded write would raise
+        # under a C locale, and reading back proves the bytes are utf-8.
+        assert "—" in dest.read_text(encoding="utf-8")
+
+    def test_send_text_no_partial_on_write_failure(self, tmp_path, monkeypatch):
+        from datetime import datetime
+        mod = _load_module()
+        inbox = tmp_path / "inbox"
+        inbox.mkdir()
+        now = datetime(2026, 7, 23, 4, 36, 0)
+        # Force the atomic finalize to fail after the temp file is written.
+        def boom(*a, **k):
+            raise OSError("disk full")
+        monkeypatch.setattr(mod.os, "replace", boom)
+        with pytest.raises(OSError):
+            mod.send_text(inbox, "a message that should never half-land", "src", None, now)
+        # No phantom, no leftover temp: the inbox is empty.
+        assert list(inbox.iterdir()) == []
+
+    def test_send_text_leaves_no_temp_on_success(self, tmp_path):
+        from datetime import datetime
+        mod = _load_module()
+        inbox = tmp_path / "inbox"
+        inbox.mkdir()
+        now = datetime(2026, 7, 23, 4, 36, 0)
+        dest = mod.send_text(inbox, "clean send", "src", None, now)
+        assert list(inbox.iterdir()) == [dest]
+
+    def test_send_file_no_partial_on_write_failure(self, tmp_path, monkeypatch):
+        from datetime import datetime
+        mod = _load_module()
+        inbox = tmp_path / "inbox"
+        inbox.mkdir()
+        src = tmp_path / "note.org"
+        src.write_text("body")
+        now = datetime(2026, 7, 23, 4, 36, 0)
+        def boom(*a, **k):
+            raise OSError("disk full")
+        monkeypatch.setattr(mod.os, "replace", boom)
+        with pytest.raises(OSError):
+            mod.send_file(inbox, src, "src", None, now)
+        assert list(inbox.iterdir()) == []
+
+    def test_send_file_leaves_no_temp_on_success(self, tmp_path):
+        from datetime import datetime
+        mod = _load_module()
+        inbox = tmp_path / "inbox"
+        inbox.mkdir()
+        src = tmp_path / "note.org"
+        src.write_text("payload")
+        now = datetime(2026, 7, 23, 4, 36, 0)
+        dest = mod.send_file(inbox, src, "src", None, now)
+        assert list(inbox.iterdir()) == [dest]
+        assert dest.read_text() == "payload"
+
+
+class TestSmallerDefects:
+    """Two low-severity defects found reading inbox-send during the 2026-07-23
+    sweep: an unreadable source raised an uncaught traceback instead of the
+    clean error every other failure path produces, and a roots config naming
+    both a parent and one of its children listed the same project twice."""
+
+    def test_unreadable_source_gives_clean_error_not_traceback(
+        self, project_root, run_script, tmp_path
+    ):
+        project_root("sender")
+        project_root("receiver")
+        roots = [tmp_path / "projects"]
+        src = tmp_path / "secret.bin"
+        src.write_text("x")
+        src.chmod(0o000)
+        try:
+            result = run_script(
+                ["receiver", "--file", str(src)],
+                cwd=tmp_path / "projects" / "sender",
+                roots=roots,
+                expect_failure=True,
+            )
+        finally:
+            src.chmod(0o644)
+        assert result.returncode == 1
+        # The clean "inbox-send: <message>" shape, not a Python traceback.
+        assert result.stderr.startswith("inbox-send:")
+        assert "Traceback" not in result.stderr
+
+    def test_discover_projects_dedupes_parent_and_child_root(self, tmp_path):
+        mod = _load_module()
+        # A project directory, reachable both as a child of its parent root and
+        # as a root in its own right.
+        parent = tmp_path / "projects"
+        proj = parent / "app"
+        (proj / ".ai").mkdir(parents=True)
+        (proj / "inbox").mkdir()
+        found = mod.discover_projects([parent, proj])
+        resolved = [p.resolve() for p in found]
+        assert resolved.count(proj.resolve()) == 1
diff --git a/claude-templates/.ai/scripts/tests/test_route_recommend.py b/claude-templates/.ai/scripts/tests/test_route_recommend.py
index acc4755..2ec900a 100644
--- a/claude-templates/.ai/scripts/tests/test_route_recommend.py
+++ b/claude-templates/.ai/scripts/tests/test_route_recommend.py
@@ -122,3 +122,31 @@ def test_cli_exclude_drops_current_project(tmp_path):
     r = _run(["--exclude", "foo"], roots=[tmp_path / "projects"], item="fix the foo widget")
     assert r.returncode == 0
     assert r.stdout.strip() == "none"
+
+
+# ----------------------------------------------------------------------
+# Duplicate candidate names
+#
+# Projects are collapsed to bare basenames, so two projects sharing a basename
+# across roots (~/code/notes and ~/projects/notes) appear twice in the candidate
+# list. Both literal-match, recommend read len(strong) > 1 as an ambiguous tie,
+# and a correct strong match was downgraded to weak. Latent when discovered
+# 2026-07-24 (27 projects, 27 distinct basenames) but real.
+# ----------------------------------------------------------------------
+
+def test_duplicate_candidate_name_keeps_strong_confidence():
+    assert rr.recommend("fix the notes thing", ["notes", "other"]) == ("notes", "strong")
+    # The same name twice must not read as a tie.
+    assert rr.recommend("fix the notes thing", ["notes", "notes", "other"]) == ("notes", "strong")
+
+
+def test_genuine_ambiguity_still_downgrades():
+    # Two DIFFERENT projects both matching is a real tie and stays weak — the
+    # dedupe must collapse identical names only, never real ambiguity.
+    dest, conf = rr.recommend("notes and other both", ["notes", "other"])
+    assert conf == "weak"
+
+
+def test_duplicates_do_not_change_the_chosen_destination():
+    dest, _ = rr.recommend("fix the notes thing", ["notes", "notes"])
+    assert dest == "notes"
diff --git a/claude-templates/.ai/scripts/todo-cleanup.el b/claude-templates/.ai/scripts/todo-cleanup.el
index c4a87de..cb333e2 100644
--- a/claude-templates/.ai/scripts/todo-cleanup.el
+++ b/claude-templates/.ai/scripts/todo-cleanup.el
@@ -100,6 +100,12 @@
 ;;   --check-child-priority is the report-only alias for --sync-child-priority
 ;;   --check.
 
+;; Before any modification a backup is copied to
+;;   /tmp/<basename>.before-todo-cleanup.<YYYYMMDD-HHMMSS>
+;; matching lint-org.el and wrap-org-table.el. Skipped under --check, which
+;; writes nothing.
+;;
+
 (require 'org)
 (require 'cl-lib)
 (require 'calendar)
@@ -832,9 +838,37 @@ event-log entry, pulling the timestamp from its CLOSED cookie.  Honors
 ;;; ---------------------------------------------------------------------------
 ;;; Driver + reporting
 
+(defun tc--backup (file)
+  "Copy FILE to /tmp before any modification.  Skipped in --check mode.
+
+Matches `lint-org.el' and `wrap-org-table.el', the other tools that rewrite
+these org files. todo-cleanup runs the most often of the three (every wrap,
+every sentry fire), and Emacs's own backup does not fire under --batch -q, so
+without this a mechanical rewrite has no undo short of git — which recovers
+only to the last commit and loses intra-session work."
+  (let* ((base (format "%s%s.before-todo-cleanup.%s"
+                       temporary-file-directory
+                       (file-name-nondirectory file)
+                       (format-time-string "%Y%m%d-%H%M%S")))
+         (backup base)
+         (n 2))
+    ;; Never overwrite an earlier backup. A second-resolution stamp collides
+    ;; when two invocations run back to back, which the shipped workflow does
+    ;; (open-tasks.org runs --convert-subtasks then --archive-done, each a
+    ;; sub-second batch run). Overwriting there replaces the true pre-session
+    ;; original with already-mutated content — losing exactly what the backup
+    ;; exists to preserve. Suffix instead, so every invocation keeps its own.
+    (while (file-exists-p backup)
+      (setq backup (format "%s-%d" base n))
+      (setq n (1+ n)))
+    (copy-file file backup nil)
+    backup))
+
 (defun tc-process-file (file)
   (setq tc-current-file (file-name-nondirectory file))
   (setq tc-current-dir (file-name-directory (expand-file-name file)))
+  (unless tc-check-only
+    (tc--backup file))
   (with-current-buffer (find-file-noselect file)
     (org-mode)
     (cond