- add() refuses to create an id that load() would reject; the CLI reports it - save() creates the temp file with the real file's mode (and O_EXCL), so a private list is never briefly world-readable; one stat call; symlink resolution inlined; comment states the rename trade-offs - CLI rejects ids with leading zeros and id 0 - Tests for trimming, the bare 'todo' default, and the id limit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>