[lukisch]

Two simultaneous clipboard materializations could choose the same apparently free filename and overwrite each other. A failed text/image/copy write also left an incomplete output behind.

Text, Markdown, HTML, images and file copies now write to a private exclusive stage, then reserve the final name with O_CREAT | O_EXCL. Existing names, directories and dangling symlinks advance the normal _2, _3 suffix. Before os.replace, the converter verifies both entries against identities captured from its own file descriptors. Cleanup removes only files with a proven owned identity and handles readonly attributes copied onto its stage. Successful earlier files in a batch remain available if a later copy fails. naming.unique_path retains its existing suggestion-only API.

Validation: 113 tests passed and one native Windows symlink test skipped for missing privilege (1314). Native checks include a real Qt PNG encoder, readonly sources/stages, existing directories, a foreign hardlink replacing the reservation, parallel writers for all five output forms, cleanup/reporting failures and partial batches. The initial 12 regression cases produce 9 failures, 2 passes and the same 1 skip on original main. Pyright checks package and tests with zero errors. Independent review is pending; documentation states placeholder visibility, crash/TOCTOU limits and separately scoped config/recent/retention behavior.

The canonical clone's existing CONTRIBUTING.md edit is excluded and preserved. No executable release, real clipboard/tray acceptance or model/network access is claimed.