ClickUp: the portal creates, never edits or deletes

Alex, 18 Sep 2026: "be very careful not to turn off any tasks, do not move anything and do not delete anything." The workspace is live and in daily use, and ClickUp issues no scoped token.

So two modules, two guarantees, each held by a test that reads the source:

• src/lib/clickup/client.ts issues GET only. It is how the nightly mirror reads everything.
• src/lib/clickup/build.ts issues POST only, to three paths: a Space under the workspace, a Folder under a Space it created, a List under a Folder it created. It refuses a parent id it did not create itself or find in clickup_created, so the existing "Clients" Space is unreachable. It refuses to create a Space whose name already exists, so a rerun cannot make a twin.

No module may issue PUT, PATCH or DELETE to ClickUp. If a future need appears to require one, the answer is a person in the GUI, not a fourth module. Every created id is written to clickup_created with what it is, what it is under and which client it belongs to.