Enclosure 1.21.0

Added

• make validated strict input the sole trust boundary across Records, Projects, Diagrams, and Scaffoldings
• pass complete request schemas through controllers and adapt them once in owning application facades
• persist project mutations through typed candidates or explicit values instead of loose mutation mappings
• add public REST, Siren, and MCP attack/recovery coverage for structural rejection, state preservation, and version allocation

Corrected

• reject invalid diagram commands and batches before snapshots or revisions can change
• reject invalid scaffolding specifications and rendering inputs before catalogue or filesystem effects
• project record summaries as typed service values without output-side Manager probing or fallback
• prevent rejected architecture publications and operating-contract revisions from consuming versions

Verification

• CI passed with 216 general Python tests, 34 health tests, and 65 browser tests
• registered Enclosure health passed all four gates with zero failures and zero advisories
• architecture attestation: c980595b7254a97575a73d41c2638c05e3108222c0c4e93f7ad54a679af728a7

This release completes the #237 delivery series: #238, #239, #240, #241, #242, and #244.