chati-dev 4.5.16 → 4.5.27

package/node_modules/@chati/tracking-clickup/src/index.js

@@ -1,5 +1,11 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import {
+  closeSync, constants, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync,
+  openSync, readSync, readdirSync, renameSync, unlinkSync, writeSync,
+} from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
+import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from 'node:path';
+import { performance } from 'node:perf_hooks';
 import { ContractError, canonicalize, sha256 } from '@chati/core';
 
 const RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
@@ -7,10 +13,46 @@ const DELIVERY_STATES = new Set(['pending', 'sent_unconfirmed', 'confirmed', 're
 const RECONCILIATION_STATES = new Set(['not_due', 'pending', 'reconciled', 'drift_detected', 'blocked']);
 const OPERATIONS = new Set(['create', 'update', 'close']);
 export const HOURLY_WATCHER_INTERVAL_MS = 60 * 60 * 1000;
+const OUTBOX_LOCK_TIMEOUT_MS = 5_000;
+const OUTBOX_LOCK_WAIT = new Int32Array(new SharedArrayBuffer(4));
+const OUTBOX_LOCK_STALE_MS = 30_000;
+const OUTBOX_MAX_BYTES = 64 * 1024 * 1024;
+const CLICKUP_STATE_AUTHORITY_CAPABILITIES = new WeakMap();
+const SIGNED_OUTBOX_KEYS = new Set([
+  'schema_version', 'state_revision', 'previous_state_digest', 'authority_context',
+  'projections', 'authority_id', 'authority_signature',
+]);
+const UNSIGNED_OUTBOX_KEYS = new Set(['schema_version', 'projections']);
 
 function fail(code, message, details = {}) { throw new ContractError(code, message, details); }
 function string(value, code, label) { if (typeof value !== 'string' || value.trim() === '') fail(code, `${label} must be a non-empty string`); }
 function object(value, code, label) { if (!value || typeof value !== 'object' || Array.isArray(value)) fail(code, `${label} must be an object`); }
+function exactKeys(value, expected, code, label) {
+  object(value, code, label);
+  const keys = Object.keys(value);
+  if (keys.length !== expected.size || keys.some((key) => !expected.has(key))) {
+    fail(code, `${label} has an invalid closed schema`);
+  }
+}
+function assertProjectId(value) {
+  string(value, 'INVALID_PROJECT_ID', 'project_id');
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value)) {
+    fail('INVALID_PROJECT_ID', 'project_id must be one path-inert identifier component');
+  }
+  return value;
+}
+function projectEvolutionPath(root, id, digest) {
+  const safeId = assertProjectId(id);
+  const evolutionRoot = resolve(root);
+  const projectDirectory = resolve(evolutionRoot, safeId);
+  const projectRelative = relative(evolutionRoot, projectDirectory);
+  if (!projectRelative || projectRelative.startsWith(`..${sep}`) || projectRelative === '..' || isAbsolute(projectRelative)) {
+    fail('INVALID_PROJECT_ID', 'project_id must remain inside the configured Project Evolution directory');
+  }
+  const path = resolve(projectDirectory, `${digest}.json`);
+  if (dirname(path) !== projectDirectory) fail('INVALID_PROJECT_ID', 'Project Evolution path escaped its project directory');
+  return path;
+}
 function timestamp(clock) {
   if (typeof clock !== 'function') fail('MISSING_CLOCK', 'a deterministic clock function is required');
   const result = clock();
@@ -18,18 +60,326 @@ function timestamp(clock) {
   if (typeof value !== 'string' || !RFC3339.test(value) || Number.isNaN(Date.parse(value))) fail('INVALID_CLOCK', 'clock must return a valid RFC3339 timestamp or Date');
   return value;
 }
-function writeAtomic(path, data) {
-  mkdirSync(dirname(path), { recursive: true });
-  const temporary = `${path}.${process.pid}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(canonicalize(data), null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-  renameSync(temporary, path);
+
+function outboxCore(value) {
+  return canonicalize({
+    schema_version: value.schema_version,
+    state_revision: value.state_revision,
+    previous_state_digest: value.previous_state_digest,
+    authority_context: value.authority_context,
+    projections: value.projections,
+  });
+}
+
+function outboxIsAuthenticated(value) {
+  return value && typeof value === 'object'
+    && Object.hasOwn(value, 'authority_id')
+    && Object.hasOwn(value, 'authority_signature');
+}
+
+/** Host-backed capability for authenticating mutable ClickUp outbox snapshots. */
+export class ClickUpStateAuthority {
+  constructor({ sign, verify } = {}) {
+    if (typeof sign !== 'function' || typeof verify !== 'function') {
+      fail('INVALID_CLICKUP_STATE_AUTHORITY', 'ClickUp state authority requires sign and verify callbacks');
+    }
+    CLICKUP_STATE_AUTHORITY_CAPABILITIES.set(this, Object.freeze({ sign, verify }));
+    Object.freeze(this);
+  }
+}
+
+function assertAuthorityContext(actual, expected) {
+  if (!expected) return;
+  object(actual, 'CLICKUP_STATE_CONTEXT_MISMATCH', 'ClickUp outbox authority_context');
+  if (sha256(actual) !== sha256(expected)) {
+    fail('CLICKUP_STATE_CONTEXT_MISMATCH', 'ClickUp outbox belongs to another project or installation');
+  }
+}
+
+function verifyAuthenticatedOutbox(data, {
+  stateAuthority = null, requireAuthenticatedState = false, authorityContext = null,
+} = {}) {
+  const authenticated = outboxIsAuthenticated(data);
+  if (!authenticated) {
+    exactKeys(data, UNSIGNED_OUTBOX_KEYS, 'OUTBOX_CORRUPT', 'unsigned ClickUp outbox');
+    if (requireAuthenticatedState) {
+      fail('UNAUTHENTICATED_CLICKUP_STATE', 'production ClickUp outbox requires host authentication');
+    }
+    return { data, digest: 'GENESIS' };
+  }
+  exactKeys(data, SIGNED_OUTBOX_KEYS, 'OUTBOX_CORRUPT', 'authenticated ClickUp outbox');
+  if (!Number.isSafeInteger(data.state_revision) || data.state_revision < 1
+    || (data.previous_state_digest !== 'GENESIS' && !/^[a-f0-9]{64}$/.test(data.previous_state_digest))) {
+    fail('OUTBOX_CORRUPT', 'authenticated ClickUp outbox revision chain is invalid');
+  }
+  assertAuthorityContext(data.authority_context, authorityContext);
+  const capability = CLICKUP_STATE_AUTHORITY_CAPABILITIES.get(stateAuthority);
+  if (!capability) fail('CLICKUP_STATE_AUTHORITY_REQUIRED', 'authenticated ClickUp outbox requires its host authority');
+  string(data.authority_id, 'OUTBOX_CORRUPT', 'ClickUp outbox authority_id');
+  string(data.authority_signature, 'OUTBOX_CORRUPT', 'ClickUp outbox authority_signature');
+  const core = outboxCore(data);
+  if (capability.verify(core, {
+    authority_id: data.authority_id,
+    authority_signature: data.authority_signature,
+  }) !== true) {
+    fail('INVALID_CLICKUP_STATE_SIGNATURE', 'ClickUp outbox host signature is invalid');
+  }
+  return { data, digest: sha256(core) };
 }
-function readOutbox(path) {
-  if (!existsSync(path)) return { schema_version: 1, projections: [] };
+function sameIdentity(left, right) {
+  return left?.dev === right?.dev && left?.ino === right?.ino;
+}
+
+function sameSnapshot(left, right) {
+  return sameIdentity(left, right)
+    && left?.mode === right?.mode
+    && left?.uid === right?.uid
+    && left?.gid === right?.gid
+    && left?.nlink === right?.nlink
+    && left?.size === right?.size
+    && left?.mtimeMs === right?.mtimeMs
+    && left?.ctimeMs === right?.ctimeMs;
+}
+
+function runSecurityTestHook(name, payload) {
+  const hook = globalThis[Symbol.for('chati.tracking-clickup.security-test-hooks')]?.[name];
+  if (typeof hook === 'function') hook(payload);
+}
+
+function readDescriptorBounded(descriptor, maxBytes) {
+  const bytes = Buffer.allocUnsafe(maxBytes + 1);
+  let offset = 0;
+  while (offset < bytes.length) {
+    const count = readSync(descriptor, bytes, offset, bytes.length - offset, null);
+    if (count === 0) break;
+    offset += count;
+  }
+  return bytes.subarray(0, offset);
+}
+
+function openPinnedTrackingDirectory(path, { create = false } = {}) {
+  if (process.platform !== 'linux') fail('UNSUPPORTED_TRACKING_STORAGE_PLATFORM', 'tracking authority storage requires Linux descriptor-relative filesystem operations');
+  const absolute = resolve(path);
+  const root = parse(absolute).root;
+  let descriptor = openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+  try {
+    for (const segment of absolute.slice(root.length).split(sep).filter(Boolean)) {
+      const childPath = join(`/proc/self/fd/${descriptor}`, segment);
+      let child;
+      try { child = openSync(childPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0)); }
+      catch (error) {
+        if (error?.code !== 'ENOENT' || !create) {
+          if (['ELOOP', 'ENOTDIR'].includes(error?.code)) fail('UNSAFE_OUTBOX_DIRECTORY', 'tracking directory chain must contain only real directories');
+          throw error;
+        }
+        try { mkdirSync(childPath, { mode: 0o700 }); }
+        catch (mkdirError) { if (mkdirError?.code !== 'EEXIST') throw mkdirError; }
+        child = openSync(childPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+      }
+      const stat = fstatSync(child);
+      if (!stat.isDirectory()) {
+        closeSync(child);
+        fail('UNSAFE_OUTBOX_DIRECTORY', 'tracking directory chain must contain only real directories');
+      }
+      closeSync(descriptor);
+      descriptor = child;
+    }
+    return Object.freeze({ absolute, descriptor, identity: fstatSync(descriptor), reference: `/proc/self/fd/${descriptor}` });
+  } catch (error) {
+    closeSync(descriptor);
+    throw error;
+  }
+}
+
+function trackingEntry(directory, name) {
+  if (basename(name) !== name || name === '.' || name === '..') fail('UNSAFE_OUTBOX_FILE', 'tracking entry must be one path segment');
+  return join(directory.reference, name);
+}
+
+function assertPinnedTrackingDirectory(directory) {
+  const pinned = fstatSync(directory.descriptor);
+  if (!pinned.isDirectory() || !sameIdentity(pinned, directory.identity)) fail('UNSAFE_OUTBOX_DIRECTORY', 'pinned tracking directory changed');
+  let current;
+  try { current = openPinnedTrackingDirectory(directory.absolute); }
+  catch (error) {
+    if (error?.code === 'UNSAFE_OUTBOX_DIRECTORY') throw error;
+    fail('UNSAFE_OUTBOX_DIRECTORY', 'tracking directory chain changed during storage');
+  }
+  try {
+    if (!sameIdentity(current.identity, directory.identity)) fail('UNSAFE_OUTBOX_DIRECTORY', 'tracking directory chain changed during storage');
+  } finally { closeSync(current.descriptor); }
+}
+
+function readRegular(path, { allowMissing = false, maxBytes = OUTBOX_MAX_BYTES, directory = null } = {}) {
+  let activeDirectory = directory;
+  const ownedDirectory = activeDirectory === null;
+  if (ownedDirectory) {
+    try { activeDirectory = openPinnedTrackingDirectory(dirname(path)); }
+    catch (error) { if (allowMissing && error?.code === 'ENOENT') return null; throw error; }
+  }
+  const entry = trackingEntry(activeDirectory, basename(path));
+  let descriptor;
+  try {
+    descriptor = openSync(entry, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+  } catch (error) {
+    if (ownedDirectory) closeSync(activeDirectory.descriptor);
+    if (allowMissing && error?.code === 'ENOENT') return null;
+    if (['ELOOP', 'ENXIO', 'EISDIR'].includes(error?.code)) fail('UNSAFE_OUTBOX_FILE', 'tracking state must not be a symlink, FIFO or directory');
+    throw error;
+  }
+  try {
+    const before = fstatSync(descriptor);
+    if (!before.isFile() || before.nlink !== 1) fail('UNSAFE_OUTBOX_FILE', 'tracking state must be a regular single-link file');
+    if (before.size > maxBytes) fail('OUTBOX_SIZE_LIMIT', `tracking state exceeds the ${maxBytes}-byte safety limit`);
+    runSecurityTestHook('afterTrackingStateStat', { path, descriptor });
+    const content = readDescriptorBounded(descriptor, maxBytes);
+    if (content.length > maxBytes) fail('OUTBOX_SIZE_LIMIT', `tracking state exceeds the ${maxBytes}-byte safety limit`);
+    const after = fstatSync(descriptor);
+    if (!after.isFile() || after.nlink !== 1 || !sameSnapshot(before, after)) {
+      fail('OUTBOX_STORAGE_CONFLICT', 'tracking state changed while it was being read');
+    }
+    assertPinnedTrackingDirectory(activeDirectory);
+    return { content: content.toString('utf8'), stat: after };
+  } finally {
+    closeSync(descriptor);
+    if (ownedDirectory) closeSync(activeDirectory.descriptor);
+  }
+}
+
+function writeAtomic(path, data, maxBytes = OUTBOX_MAX_BYTES, { directory = null } = {}) {
+  const content = `${JSON.stringify(canonicalize(data), null, 2)}\n`;
+  const bytes = Buffer.from(content);
+  if (bytes.length > maxBytes) fail('OUTBOX_SIZE_LIMIT', `tracking state exceeds the ${maxBytes}-byte safety limit`);
+  const activeDirectory = directory ?? openPinnedTrackingDirectory(dirname(path), { create: true });
+  const ownedDirectory = directory === null;
+  const temporary = trackingEntry(activeDirectory, `${basename(path)}.${process.pid}.${randomUUID()}.tmp`);
+  const destination = trackingEntry(activeDirectory, basename(path));
+  let temporaryDescriptor;
+  try {
+    const existing = readRegular(path, { allowMissing: true, maxBytes, directory: activeDirectory });
+    temporaryDescriptor = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    let offset = 0;
+    while (offset < bytes.length) offset += writeSync(temporaryDescriptor, bytes, offset, bytes.length - offset);
+    fsyncSync(temporaryDescriptor);
+    closeSync(temporaryDescriptor);
+    temporaryDescriptor = undefined;
+    assertPinnedTrackingDirectory(activeDirectory);
+    let current = null;
+    try { current = lstatSync(destination); } catch (error) { if (error?.code !== 'ENOENT') throw error; }
+    if ((existing === null && current !== null)
+      || (existing !== null && (!current || current.isSymbolicLink() || !current.isFile()
+        || current.nlink !== 1 || !sameIdentity(current, existing.stat)))) {
+      fail('OUTBOX_STORAGE_CONFLICT', 'tracking state changed during atomic persistence');
+    }
+    renameSync(temporary, destination);
+    fsyncSync(activeDirectory.descriptor);
+    assertPinnedTrackingDirectory(activeDirectory);
+  } finally {
+    if (temporaryDescriptor !== undefined) closeSync(temporaryDescriptor);
+    try { unlinkSync(temporary); } catch { /* leave an unverified temporary untouched */ }
+    if (ownedDirectory) closeSync(activeDirectory.descriptor);
+  }
+}
+export function readClickUpOutbox(path, {
+  directory = null, state_authority = null, require_authenticated_state = false,
+  authority_context = null, allow_missing_authenticated_state = false,
+} = {}) {
+  let stored;
+  try { stored = readRegular(path, { allowMissing: true, directory }); }
+  catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+    stored = null;
+  }
+  if (stored === null) {
+    if (require_authenticated_state && !allow_missing_authenticated_state) {
+      fail('MISSING_CLICKUP_STATE', 'authenticated ClickUp outbox is missing');
+    }
+    return authority_context
+      ? { schema_version: 1, state_revision: 0, previous_state_digest: 'GENESIS', authority_context: canonicalize(authority_context), projections: [] }
+      : { schema_version: 1, projections: [] };
+  }
   let data;
-  try { data = JSON.parse(readFileSync(path, 'utf8')); } catch { fail('OUTBOX_CORRUPT', 'outbox JSON is malformed'); }
+  try { data = JSON.parse(stored.content); } catch { fail('OUTBOX_CORRUPT', 'outbox JSON is malformed'); }
   if (data?.schema_version !== 1 || !Array.isArray(data.projections)) fail('OUTBOX_CORRUPT', 'outbox schema is invalid');
-  return data;
+  return verifyAuthenticatedOutbox(data, {
+    stateAuthority: state_authority,
+    requireAuthenticatedState: require_authenticated_state,
+    authorityContext: authority_context,
+  }).data;
+}
+
+export function readClickUpDocument(path, { allowMissing = false, maxBytes = OUTBOX_MAX_BYTES } = {}) {
+  const stored = readRegular(path, { allowMissing, maxBytes });
+  if (stored === null) return null;
+  try { return JSON.parse(stored.content); }
+  catch { return fail('OUTBOX_CORRUPT', 'tracking JSON document is malformed'); }
+}
+
+export function persistImmutableClickUpDocument(path, data, { maxBytes = OUTBOX_MAX_BYTES } = {}) {
+  const content = `${JSON.stringify(canonicalize(data), null, 2)}\n`;
+  const bytes = Buffer.from(content);
+  if (bytes.length > maxBytes) fail('OUTBOX_SIZE_LIMIT', `tracking document exceeds the ${maxBytes}-byte safety limit`);
+  const directory = openPinnedTrackingDirectory(dirname(path), { create: true });
+  const temporary = trackingEntry(directory, `${basename(path)}.${process.pid}.${randomUUID()}.tmp`);
+  const destination = trackingEntry(directory, basename(path));
+  let temporaryDescriptor;
+  try {
+    const existing = readRegular(path, { allowMissing: true, maxBytes, directory });
+    if (existing !== null) {
+      if (existing.content !== content) fail('OUTBOX_STORAGE_CONFLICT', 'immutable tracking document already contains different material');
+      return Object.freeze({ written: false, path });
+    }
+    runSecurityTestHook('beforeTrackingDocumentTempOpen', { path, temporary, directory: directory.absolute });
+    temporaryDescriptor = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    runSecurityTestHook('afterTrackingDocumentTempOpen', { path, temporary, directory: directory.absolute });
+    let offset = 0;
+    while (offset < bytes.length) offset += writeSync(temporaryDescriptor, bytes, offset, bytes.length - offset);
+    fsyncSync(temporaryDescriptor);
+    closeSync(temporaryDescriptor);
+    temporaryDescriptor = undefined;
+    assertPinnedTrackingDirectory(directory);
+    try { linkSync(temporary, destination); }
+    catch (error) {
+      if (error?.code !== 'EEXIST') throw error;
+      const raced = readRegular(path, { maxBytes, directory });
+      if (raced.content !== content) fail('OUTBOX_STORAGE_CONFLICT', 'immutable tracking document raced with different material');
+      return Object.freeze({ written: false, path });
+    }
+    fsyncSync(directory.descriptor);
+    assertPinnedTrackingDirectory(directory);
+    return Object.freeze({ written: true, path });
+  } finally {
+    if (temporaryDescriptor !== undefined) closeSync(temporaryDescriptor);
+    try { unlinkSync(temporary); } catch { /* leave an unverified temporary untouched */ }
+    closeSync(directory.descriptor);
+  }
+}
+
+export function listClickUpDocumentPaths(directoryPath) {
+  const directory = openPinnedTrackingDirectory(directoryPath);
+  try {
+    const names = readdirSync(directory.reference).filter((name) => /^[A-Za-z0-9._-]+\.json$/.test(name)).sort();
+    assertPinnedTrackingDirectory(directory);
+    return names.map((name) => join(directory.absolute, name));
+  } finally { closeSync(directory.descriptor); }
+}
+
+export function removeImmutableClickUpDocument(path, { maxBytes = OUTBOX_MAX_BYTES } = {}) {
+  const directory = openPinnedTrackingDirectory(dirname(path));
+  const destination = trackingEntry(directory, basename(path));
+  try {
+    const existing = readRegular(path, { allowMissing: true, maxBytes, directory });
+    if (existing === null) return false;
+    const current = lstatSync(destination);
+    if (!current.isFile() || current.isSymbolicLink() || current.nlink !== 1 || !sameIdentity(current, existing.stat)) {
+      fail('OUTBOX_STORAGE_CONFLICT', 'tracking document changed before removal');
+    }
+    assertPinnedTrackingDirectory(directory);
+    unlinkSync(destination);
+    fsyncSync(directory.descriptor);
+    assertPinnedTrackingDirectory(directory);
+    return true;
+  } finally { closeSync(directory.descriptor); }
 }
 function closureMutation(payload) {
   const status = typeof payload.status === 'string' ? payload.status.trim().toLowerCase() : '';
@@ -37,6 +387,69 @@ function closureMutation(payload) {
     || Object.hasOwn(payload, 'end_date') || Object.hasOwn(payload, 'endDate');
 }
 
+function processIsAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; } catch (error) { return error?.code === 'EPERM'; }
+}
+
+function readOutboxLock(path) {
+  let descriptor;
+  try {
+    descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+    const before = fstatSync(descriptor);
+    if (!before.isFile() || before.nlink !== 1 || before.size > 16 * 1024) return null;
+    const content = readDescriptorBounded(descriptor, 16 * 1024);
+    const after = fstatSync(descriptor);
+    if (content.length > 16 * 1024 || !after.isFile() || after.nlink !== 1 || !sameSnapshot(before, after)) return null;
+    const owner = JSON.parse(content.toString('utf8'));
+    return owner && typeof owner === 'object' && typeof owner.token === 'string' ? owner : null;
+  } catch { return null; }
+  finally { if (descriptor !== undefined) closeSync(descriptor); }
+}
+
+
+function recoverStaleOutboxLock(path) {
+  let stat;
+  try { stat = lstatSync(path); } catch (error) { return error?.code === 'ENOENT'; }
+  if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1) return false;
+  const owner = readOutboxLock(path);
+  if (owner?.hostname === hostname() && processIsAlive(owner.pid)) return false;
+  // A process on another host cannot be proven dead from this host. Keep the
+  // lock until an operator explicitly reconciles it.
+  if (owner?.hostname && owner.hostname !== hostname()) return false;
+  if (!owner && Date.now() - stat.mtimeMs < OUTBOX_LOCK_STALE_MS) return false;
+  const recoveryPath = `${path}.recovery`;
+  let recoveryFd;
+  try {
+    recoveryFd = openSync(recoveryPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    const bytes = Buffer.from(JSON.stringify({ pid: process.pid, hostname: hostname(), token: randomUUID() }));
+    writeSync(recoveryFd, bytes, 0, bytes.length);
+    fsyncSync(recoveryFd);
+  } catch {
+    if (recoveryFd !== undefined) closeSync(recoveryFd);
+    return false;
+  }
+  const quarantine = `${path}.stale.${process.pid}.${randomUUID()}`;
+  try {
+    const current = lstatSync(path);
+    const currentOwner = readOutboxLock(path);
+    if (!sameIdentity(stat, current) || currentOwner?.token !== owner?.token) return false;
+    renameSync(path, quarantine);
+    const quarantined = lstatSync(quarantine);
+    const quarantinedOwner = readOutboxLock(quarantine);
+    if (!sameIdentity(stat, quarantined) || quarantinedOwner?.token !== owner?.token) {
+      try { if (!existsSync(path)) renameSync(quarantine, path); } catch { /* preserve quarantine fail-closed */ }
+      return false;
+    }
+    unlinkSync(quarantine);
+    return true;
+  } catch (error) { return error?.code === 'ENOENT'; }
+  finally {
+    if (recoveryFd !== undefined) closeSync(recoveryFd);
+    try { unlinkSync(recoveryPath); } catch { /* fail closed if recovery ownership changed */ }
+  }
+}
+
 /**
  * C-07 local projection authority. It intentionally has no ClickUp SDK,
  * credentials, network client, timer or knowledge-store integration. A caller
@@ -53,8 +466,19 @@ export class TrackingClickUp {
   #preflight;
   #watcherIntervalMs;
   #state;
+  #stateAuthority;
+  #requireAuthenticatedState;
+  #authorityContext;
+  #stateDigest = 'GENESIS';
+  #lockDepth = 0;
+  #activeDirectory;
 
-  constructor({ outbox_path, project_evolution_dir, clock, transport = null, verify_completion, verify_reference, resolve_reference, preflight = null, watcher_interval_ms = HOURLY_WATCHER_INTERVAL_MS } = {}) {
+  constructor({
+    outbox_path, project_evolution_dir, clock, transport = null,
+    verify_completion, verify_reference, resolve_reference, preflight = null,
+    watcher_interval_ms = HOURLY_WATCHER_INTERVAL_MS,
+    state_authority = null, require_authenticated_state = false, authority_context = null,
+  } = {}) {
     string(outbox_path, 'INVALID_OUTBOX_PATH', 'outbox_path');
     string(project_evolution_dir, 'INVALID_EVOLUTION_DIR', 'project_evolution_dir');
     if (transport !== null && (!transport || typeof transport.send !== 'function')) fail('INVALID_TRANSPORT', 'transport.send must be a function');
@@ -72,7 +496,23 @@ export class TrackingClickUp {
     this.#resolveReference = resolve_reference;
     this.#preflight = preflight;
     this.#watcherIntervalMs = watcher_interval_ms;
-    this.#state = readOutbox(outbox_path);
+    if (state_authority !== null && !CLICKUP_STATE_AUTHORITY_CAPABILITIES.has(state_authority)) {
+      fail('INVALID_CLICKUP_STATE_AUTHORITY', 'state_authority must be a minted ClickUpStateAuthority');
+    }
+    if (authority_context !== null) {
+      object(authority_context, 'INVALID_CLICKUP_STATE_CONTEXT', 'authority_context');
+      for (const field of ['project_id', 'installation_artifact_id']) {
+        string(authority_context[field], 'INVALID_CLICKUP_STATE_CONTEXT', `authority_context.${field}`);
+      }
+      assertProjectId(authority_context.project_id);
+      this.#authorityContext = canonicalize(authority_context);
+    } else this.#authorityContext = null;
+    this.#stateAuthority = state_authority;
+    this.#requireAuthenticatedState = require_authenticated_state === true;
+    if (this.#requireAuthenticatedState && (!this.#stateAuthority || !this.#authorityContext)) {
+      fail('CLICKUP_STATE_AUTHORITY_REQUIRED', 'production ClickUp state requires a host authority and project context');
+    }
+    this.#loadState({ allowMissing: true });
     // Project Evolution is a derivative, never the only copy of evidence.
     // Rebuild it after an interrupted outbox/evolution write sequence.
     for (const projectId of new Set(this.#state.projections.map((item) => item.project_id))) this.#evolve(projectId);
@@ -82,7 +522,124 @@ export class TrackingClickUp {
   get outboxPath() { return this.#outboxPath; }
   get watcherConfig() { return Object.freeze({ interval_ms: this.#watcherIntervalMs, mode: 'external-one-shot-scheduler' }); }
 
-  #persist() { writeAtomic(this.#outboxPath, this.#state); }
+  #validateLoadedState() {
+    const ids = new Set();
+    const idempotencyKeys = new Set();
+    let priorCreatedAt = Number.NEGATIVE_INFINITY;
+    for (const projection of this.#state.projections) {
+      validateProjection(projection);
+      if (this.#authorityContext && projection.project_id !== this.#authorityContext.project_id) {
+        fail('CLICKUP_STATE_CONTEXT_MISMATCH', 'ClickUp outbox contains a projection from another project');
+      }
+      if (projection.payload_hash !== sha256(projection.payload)) {
+        fail('OUTBOX_SEMANTIC_CORRUPTION', 'ClickUp projection payload_hash does not match its payload');
+      }
+      if (ids.has(projection.projection_id) || idempotencyKeys.has(projection.idempotency_key)) {
+        fail('OUTBOX_SEMANTIC_CORRUPTION', 'ClickUp outbox contains duplicate projection identities');
+      }
+      ids.add(projection.projection_id);
+      idempotencyKeys.add(projection.idempotency_key);
+      const createdAt = Date.parse(projection.created_at);
+      if (!Number.isFinite(createdAt) || createdAt < priorCreatedAt) {
+        fail('OUTBOX_SEMANTIC_CORRUPTION', 'ClickUp outbox projection order is not chronological');
+      }
+      priorCreatedAt = createdAt;
+    }
+  }
+
+  #loadState({ directory = null, allowMissing = false } = {}) {
+    this.#state = readClickUpOutbox(this.#outboxPath, {
+      directory,
+      state_authority: this.#stateAuthority,
+      require_authenticated_state: this.#requireAuthenticatedState,
+      authority_context: this.#authorityContext,
+      allow_missing_authenticated_state: allowMissing,
+    });
+    this.#stateDigest = outboxIsAuthenticated(this.#state) ? sha256(outboxCore(this.#state)) : 'GENESIS';
+    this.#validateLoadedState();
+  }
+
+  #exclusive(action) {
+    if (this.#lockDepth > 0) return action();
+    const directory = openPinnedTrackingDirectory(dirname(this.#outboxPath), { create: true });
+    const path = trackingEntry(directory, `${basename(this.#outboxPath)}.lock`);
+    let descriptor;
+    let token;
+    try {
+      const lockDeadline = performance.now() + OUTBOX_LOCK_TIMEOUT_MS;
+      while (performance.now() < lockDeadline) {
+        let candidate;
+        try {
+          candidate = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+        } catch (error) {
+          if (error?.code !== 'EEXIST') throw error;
+          if (recoverStaleOutboxLock(path)) continue;
+          Atomics.wait(OUTBOX_LOCK_WAIT, 0, 0, 4);
+          continue;
+        }
+        token = randomUUID();
+        try {
+          const bytes = Buffer.from(JSON.stringify({ schema_version: 1, pid: process.pid, hostname: hostname(), token, acquired_at: new Date().toISOString() }));
+          writeSync(candidate, bytes, 0, bytes.length);
+          fsyncSync(candidate);
+          fsyncSync(directory.descriptor);
+          descriptor = candidate;
+          break;
+        } catch (error) {
+          closeSync(candidate);
+          try { unlinkSync(path); } catch { /* acquisition failed closed */ }
+          throw error;
+        }
+      }
+      if (descriptor === undefined) fail('OUTBOX_LOCK_BUSY', 'outbox mutation lock is already held');
+      this.#lockDepth = 1;
+      this.#activeDirectory = directory;
+      assertPinnedTrackingDirectory(directory);
+      this.#loadState({ directory, allowMissing: true });
+      return action();
+    } finally {
+      this.#lockDepth = 0;
+      this.#activeDirectory = undefined;
+      try {
+        if (descriptor !== undefined) {
+          closeSync(descriptor);
+          assertPinnedTrackingDirectory(directory);
+          if (readOutboxLock(path)?.token === token) { unlinkSync(path); fsyncSync(directory.descriptor); }
+        }
+      } finally {
+        closeSync(directory.descriptor);
+      }
+    }
+  }
+
+  #persist() {
+    if (this.#stateAuthority) {
+      const capability = CLICKUP_STATE_AUTHORITY_CAPABILITIES.get(this.#stateAuthority);
+      const core = canonicalize({
+        schema_version: 1,
+        state_revision: (this.#state.state_revision ?? 0) + 1,
+        previous_state_digest: this.#stateDigest,
+        authority_context: this.#authorityContext,
+        projections: this.#state.projections,
+      });
+      const receipt = capability.sign(core);
+      object(receipt, 'INVALID_CLICKUP_STATE_AUTHORITY', 'ClickUp state authority receipt');
+      string(receipt.authority_id, 'INVALID_CLICKUP_STATE_AUTHORITY', 'ClickUp state authority receipt.authority_id');
+      string(receipt.authority_signature, 'INVALID_CLICKUP_STATE_AUTHORITY', 'ClickUp state authority receipt.authority_signature');
+      if (capability.verify(core, receipt) !== true) {
+        fail('INVALID_CLICKUP_STATE_AUTHORITY', 'ClickUp state authority did not verify its own receipt');
+      }
+      this.#state = {
+        ...core,
+        projections: this.#state.projections,
+        ...canonicalize(receipt),
+      };
+      this.#stateDigest = sha256(core);
+    } else {
+      this.#state = { schema_version: 1, projections: this.#state.projections };
+    }
+    writeAtomic(this.#outboxPath, this.#state, OUTBOX_MAX_BYTES, { directory: this.#activeDirectory });
+  }
   #find(projectionId) {
     string(projectionId, 'INVALID_PROJECTION_ID', 'projection_id');
     const projection = this.#state.projections.find((item) => item.projection_id === projectionId);
@@ -90,13 +647,18 @@ export class TrackingClickUp {
     return projection;
   }
   #evolve(projectId) {
-    const relevant = this.#state.projections.filter((item) => item.project_id === projectId);
+    const safeProjectId = assertProjectId(projectId);
+    const relevant = this.#state.projections.filter((item) => item.project_id === safeProjectId);
     const latestByTask = new Map();
     for (const item of relevant) latestByTask.set(item.task_id, item);
-    const sourceProjections = relevant.map(({ project_evolution_ref, ...source }) => source);
+    const sourceProjections = relevant.map((item) => {
+      const source = { ...item };
+      delete source.project_evolution_ref;
+      return source;
+    });
     const snapshot = canonicalize({
       schema_version: 1,
-      project_id: projectId,
+      project_id: safeProjectId,
       current_phase: [...latestByTask.values()].at(-1)?.handoff_view.phase ?? 'unknown',
       tasks: [...latestByTask.values()].map((item) => ({ task_id: item.task_id, attempt_id: item.attempt_id, phase: item.handoff_view.phase, canonical_state: item.journal_view.task_state, blockers: item.journal_view.blockers, delivery_state: item.delivery_state, reconciliation_state: item.reconciliation_state })),
       decisions: [...new Map(relevant.flatMap((item) => item.decisions.map((decision) => [decision.decision_ref, decision]))).values()],
@@ -108,9 +670,9 @@ export class TrackingClickUp {
       source_outbox_hash: sha256({ schema_version: 1, projections: sourceProjections }),
     });
     const digest = sha256(snapshot);
-    const path = join(this.#evolutionDir, projectId, `${digest}.json`);
+    const path = projectEvolutionPath(this.#evolutionDir, safeProjectId, digest);
     writeAtomic(path, snapshot);
-    return Object.freeze({ project_evolution_ref: `project-evolution://${projectId}/${digest}`, path, digest });
+    return Object.freeze({ project_evolution_ref: `project-evolution://${safeProjectId}/${digest}`, path, digest });
   }
   #setEvolution(projection) {
     const evolution = this.#evolve(projection.project_id);
@@ -125,10 +687,15 @@ export class TrackingClickUp {
   }
 
   enqueue(input = {}) {
+    return this.#exclusive(() => {
     object(input, 'INVALID_PROJECTION', 'projection');
     const { projection_id, idempotency_key, canonical_event_id, task_id, clickup_ref, operation, payload, project_id, handoff_ref, journal_ref } = input;
     const attempt_id = input.attempt_id ?? `project:${project_id}:no-attempt`;
     for (const [name, value] of Object.entries({ projection_id, idempotency_key, canonical_event_id, task_id, clickup_ref, project_id })) string(value, 'INVALID_PROJECTION', name);
+    assertProjectId(project_id);
+    if (this.#authorityContext && project_id !== this.#authorityContext.project_id) {
+      fail('CLICKUP_STATE_CONTEXT_MISMATCH', 'projection belongs to another project than the authenticated outbox');
+    }
     string(attempt_id, 'INVALID_PROJECTION', 'attempt_id');
     if (!OPERATIONS.has(operation)) fail('INVALID_PROJECTION_OPERATION', 'operation must be create, update, or close');
     object(payload, 'INVALID_PROJECTION', 'payload');
@@ -170,17 +737,25 @@ export class TrackingClickUp {
     this.#setEvolution(projection);
     this.#persist();
     return Object.freeze(canonicalize(projection));
+    });
   }
 
   deliver({ projection_id } = {}) {
+    return this.#exclusive(() => {
     const projection = this.#find(projection_id);
     if (!this.#transport) fail('TRANSPORT_NOT_CONFIGURED', 'no authorized projection transport is configured');
     if (projection.delivery_state === 'confirmed') return Object.freeze(canonicalize(projection));
     if (projection.delivery_state === 'permanent_failure') fail('PERMANENT_FAILURE', 'permanently failed projection cannot be retried');
-    if (projection.delivery_state === 'sent_unconfirmed') fail('UNCONFIRMED_DELIVERY_REQUIRES_LOOKUP', 'unconfirmed delivery must be resolved by idempotency lookup before resend');
+    if (['sent_unconfirmed', 'retryable_failure'].includes(projection.delivery_state)) fail('UNCONFIRMED_DELIVERY_REQUIRES_LOOKUP', 'uncertain delivery must be resolved by idempotency lookup before resend');
     this.#preflightTransport(projection);
     projection.attempts += 1;
     projection.last_attempt_at = timestamp(this.#clock);
+    // Persist uncertainty before crossing the external side-effect boundary.
+    // A lost response must be reconciled by lookup, never blindly resent.
+    projection.delivery_state = 'sent_unconfirmed';
+    delete projection.failure_code;
+    this.#setEvolution(projection);
+    this.#persist();
     try {
       const response = this.#transport.send(Object.freeze(canonicalize(projection)));
       object(response, 'INVALID_TRANSPORT_RECEIPT', 'transport response');
@@ -190,20 +765,52 @@ export class TrackingClickUp {
         projection.delivery_state = 'confirmed';
         projection.receipt_ref = response.receipt_ref;
         projection.reconciliation_state = 'pending';
-      } else projection.delivery_state = 'sent_unconfirmed';
+      }
     } catch (error) {
-      projection.delivery_state = error?.permanent === true ? 'permanent_failure' : 'retryable_failure';
+      if (error?.permanent === true) projection.delivery_state = 'permanent_failure';
       projection.failure_code = typeof error?.code === 'string' ? error.code : 'TRANSPORT_FAILURE';
     }
     this.#setEvolution(projection);
     this.#persist();
     return Object.freeze(canonicalize(projection));
+    });
+  }
+
+  /** Persists uncertainty before a separately authorized MCP caller sends. */
+  prepareExternalDelivery({ projection_id } = {}) {
+    return this.#exclusive(() => {
+      const projection = this.#find(projection_id);
+      if (projection.delivery_state === 'confirmed') return Object.freeze(canonicalize(projection));
+      if (projection.delivery_state === 'permanent_failure') fail('PERMANENT_FAILURE', 'permanently failed projection cannot be retried');
+      if (['sent_unconfirmed', 'retryable_failure'].includes(projection.delivery_state)) {
+        fail('UNCONFIRMED_DELIVERY_REQUIRES_LOOKUP', 'uncertain delivery must be resolved by idempotency lookup before resend');
+      }
+      validateProjection(projection);
+      projection.attempts += 1;
+      projection.last_attempt_at = timestamp(this.#clock);
+      projection.delivery_state = 'sent_unconfirmed';
+      delete projection.failure_code;
+      this.#setEvolution(projection);
+      this.#persist();
+      return Object.freeze(canonicalize(projection));
+    });
   }
 
   /** Records a receipt produced by an independently authorized MCP boundary. */
-  confirmExternalDelivery({ projection_id, receipt_ref } = {}) {
+  confirmExternalDelivery({
+    projection_id, receipt_ref, expected_delivery_attempt, expected_delivery_attempted_at,
+  } = {}) {
+    return this.#exclusive(() => {
     const projection = this.#find(projection_id);
     string(receipt_ref, 'INVALID_TRANSPORT_RECEIPT', 'receipt_ref');
+    if (!Number.isInteger(expected_delivery_attempt) || expected_delivery_attempt < 1) {
+      fail('INVALID_TRANSPORT_RECEIPT', 'expected_delivery_attempt must be a positive integer');
+    }
+    string(expected_delivery_attempted_at, 'INVALID_TRANSPORT_RECEIPT', 'expected_delivery_attempted_at');
+    if (projection.attempts !== expected_delivery_attempt
+      || projection.last_attempt_at !== expected_delivery_attempted_at) {
+      fail('STALE_EXTERNAL_DELIVERY_RESULT', 'external delivery receipt does not match the current delivery attempt');
+    }
     if (this.#verifyReference(receipt_ref, 'receipt') !== true) {
       fail('UNVERIFIED_RECEIPT', 'external delivery receipt must be an immutable verified reference');
     }
@@ -212,17 +819,59 @@ export class TrackingClickUp {
       if (projection.receipt_ref !== receipt_ref) fail('RECEIPT_CONFLICT', 'projection is already confirmed by a different receipt');
       return Object.freeze(canonicalize(projection));
     }
+    if (!['sent_unconfirmed', 'retryable_failure'].includes(projection.delivery_state)) {
+      fail('DELIVERY_INTENT_REQUIRED', 'external delivery must be marked sent_unconfirmed before it can be confirmed');
+    }
     projection.delivery_state = 'confirmed';
     projection.receipt_ref = receipt_ref;
     projection.reconciliation_state = 'pending';
-    projection.last_attempt_at = timestamp(this.#clock);
-    projection.attempts += 1;
+    projection.last_attempt_at ??= timestamp(this.#clock);
     this.#setEvolution(projection);
     this.#persist();
     return Object.freeze(canonicalize(projection));
+    });
+  }
+
+  /** Applies an immutable lookup result supplied by an authorized MCP caller. */
+  resolveExternalLookup({
+    projection_id, result, evidence_ref, expected_delivery_attempt, expected_delivery_attempted_at,
+  } = {}) {
+    return this.#exclusive(() => {
+      const projection = this.#find(projection_id);
+      if (!Number.isInteger(expected_delivery_attempt) || expected_delivery_attempt < 1) {
+        fail('INVALID_LOOKUP_RESULT', 'expected_delivery_attempt must be a positive integer');
+      }
+      string(expected_delivery_attempted_at, 'INVALID_LOOKUP_RESULT', 'expected_delivery_attempted_at');
+      if (projection.attempts !== expected_delivery_attempt
+        || projection.last_attempt_at !== expected_delivery_attempted_at) {
+        fail('STALE_EXTERNAL_DELIVERY_RESULT', 'lookup result does not match the current delivery attempt');
+      }
+      if (!['sent_unconfirmed', 'retryable_failure'].includes(projection.delivery_state)) {
+        fail('NOT_SENT_UNCONFIRMED', 'idempotency lookup only applies to uncertain delivery');
+      }
+      object(result, 'INVALID_LOOKUP_RESULT', 'idempotency lookup result');
+      string(evidence_ref, 'INVALID_LOOKUP_RESULT', 'lookup evidence_ref');
+      if (this.#verifyReference(evidence_ref, 'receipt') !== true) fail('UNVERIFIED_RECEIPT', 'lookup evidence must be an immutable verified reference');
+      if (result.receipt_ref !== undefined) {
+        string(result.receipt_ref, 'INVALID_LOOKUP_RESULT', 'receipt_ref');
+        if (this.#verifyReference(result.receipt_ref, 'receipt') !== true) fail('UNVERIFIED_RECEIPT', 'lookup receipt must be an immutable verified reference');
+        projection.delivery_state = 'confirmed';
+        projection.receipt_ref = result.receipt_ref;
+        projection.reconciliation_state = 'pending';
+      } else if (result.state === 'not_found') {
+        projection.delivery_state = 'pending';
+      } else if (result.state !== 'unknown') {
+        fail('INVALID_LOOKUP_RESULT', 'lookup requires receipt_ref, not_found, or unknown');
+      }
+      projection.lookup_evidence_ref = evidence_ref;
+      this.#setEvolution(projection);
+      this.#persist();
+      return Object.freeze(canonicalize(projection));
+    });
   }
 
   reconcile({ projection_id } = {}) {
+    return this.#exclusive(() => {
     const projection = this.#find(projection_id);
     if (!this.#transport || typeof this.#transport.reconcile !== 'function') fail('RECONCILIATION_NOT_CONFIGURED', 'no authorized reconciliation transport is configured');
     if (projection.delivery_state !== 'confirmed') fail('RECEIPT_REQUIRED', 'reconciliation requires confirmed delivery receipt');
@@ -235,11 +884,13 @@ export class TrackingClickUp {
     this.#setEvolution(projection);
     this.#persist();
     return Object.freeze(canonicalize(projection));
+    });
   }
 
   resolveSentUnconfirmed({ projection_id } = {}) {
+    return this.#exclusive(() => {
     const projection = this.#find(projection_id);
-    if (projection.delivery_state !== 'sent_unconfirmed') fail('NOT_SENT_UNCONFIRMED', 'idempotency lookup only applies to sent_unconfirmed delivery');
+    if (!['sent_unconfirmed', 'retryable_failure'].includes(projection.delivery_state)) fail('NOT_SENT_UNCONFIRMED', 'idempotency lookup only applies to uncertain delivery');
     if (!this.#transport || typeof this.#transport.lookup !== 'function') fail('IDEMPOTENCY_LOOKUP_NOT_CONFIGURED', 'sent_unconfirmed requires an idempotency lookup transport');
     this.#preflightTransport(projection);
     const result = this.#transport.lookup(Object.freeze(canonicalize(projection)));
@@ -255,27 +906,33 @@ export class TrackingClickUp {
     this.#setEvolution(projection);
     this.#persist();
     return Object.freeze(canonicalize(projection));
+    });
   }
 
   watchOnce() {
+    return this.#exclusive(() => {
     // Intentionally one-shot: a host scheduler may invoke this hourly. No timer is created.
     const replayed = [];
     for (const projection of this.#state.projections) {
-      if (projection.delivery_state === 'sent_unconfirmed') {
+      if (['sent_unconfirmed', 'retryable_failure'].includes(projection.delivery_state)) {
         const resolved = this.resolveSentUnconfirmed({ projection_id: projection.projection_id });
         if (resolved.delivery_state === 'pending') replayed.push(this.deliver({ projection_id: projection.projection_id }));
-      } else if (['pending', 'retryable_failure'].includes(projection.delivery_state)) replayed.push(this.deliver({ projection_id: projection.projection_id }));
+      } else if (projection.delivery_state === 'pending') replayed.push(this.deliver({ projection_id: projection.projection_id }));
     }
     return Object.freeze(replayed);
+    });
   }
 
   rederiveProjectEvolution({ project_id } = {}) {
-    string(project_id, 'INVALID_PROJECT_ID', 'project_id');
+    return this.#exclusive(() => {
+    assertProjectId(project_id);
     if (!this.#state.projections.some((item) => item.project_id === project_id)) fail('PROJECT_NOT_FOUND', 'project has no durable projections', { project_id });
     return this.#evolve(project_id);
+    });
   }
 
   recordMetrics({ projection_id, actual_human_effort, actual_ai_processing, rework_cycles, rework_review_refs, completion } = {}) {
+    return this.#exclusive(() => {
     const projection = this.#find(projection_id);
     object(actual_human_effort, 'INVALID_HUMAN_EFFORT', 'actual_human_effort');
     object(actual_ai_processing, 'INVALID_AI_PROCESSING', 'actual_ai_processing');
@@ -293,7 +950,8 @@ export class TrackingClickUp {
     // No wall-clock value exists here. Provenance is durable with the metric.
     const metricMaterial = canonicalize({ actual_human_effort, actual_ai_processing, rework_cycles, rework_review_refs, completion_id: completion.completion_id });
     if (projection.metrics) {
-      const { recorded_at: _recordedAt, ...existingMaterial } = projection.metrics;
+      const existingMaterial = { ...projection.metrics };
+      delete existingMaterial.recorded_at;
       if (sha256(existingMaterial) !== sha256(metricMaterial)) fail('METRICS_ALREADY_RECORDED', 'projection metrics are immutable');
       return Object.freeze(canonicalize(projection));
     }
@@ -301,12 +959,14 @@ export class TrackingClickUp {
     this.#setEvolution(projection);
     this.#persist();
     return Object.freeze(canonicalize(projection));
+    });
   }
 }
 
 export function validateProjection(projection) {
   object(projection, 'INVALID_PROJECTION', 'projection');
   for (const field of ['projection_id', 'idempotency_key', 'canonical_event_id', 'task_id', 'clickup_ref', 'project_id', 'payload_hash']) string(projection[field], 'INVALID_PROJECTION', field);
+  assertProjectId(projection.project_id);
   if (!OPERATIONS.has(projection.operation)) fail('INVALID_PROJECTION_OPERATION', 'operation is invalid');
   if (!DELIVERY_STATES.has(projection.delivery_state)) fail('INVALID_DELIVERY_STATE', 'delivery_state is invalid');
   if (!RECONCILIATION_STATES.has(projection.reconciliation_state)) fail('INVALID_RECONCILIATION_STATE', 'reconciliation_state is invalid');