backlog:start-task never checks the ticket belongs to the given project: wrong-project agent spawned, ticket flipped to in_progress

In v1.207.0 (Linux), the backlog:start-task IPC handler resolves the working project from the caller's projectId/projectPath, then marks the ticket in_progress with PATCH /api/backlog/${taskId} (by taskId only) and creates the agent in that project's agents-local.json. It never verifies that taskId belongs to projectId.

Observed: a ticket owned by project "GIA Consumer" with agentId: "role:devops" was started, and the temporary agent (role devops, backlogTaskId = that ticket, launchBriefKey = backlog:<id>) was created in project "AI Layers - Frontend" instead. The ticket's updatedAt precedes the agent id timestamp by 0.6s. Both projects have a saved devops agent, so role:devops silently resolved to the wrong one. The agent got the wrong project's CLAUDE.md, memory and repository, and could not do the task.

Expected: refuse to start when the ticket's project differs from the target project (or resolve the project from the ticket), and do not flip the status before that check passes.

Not affected: the backlog_start_next MCP path, which reads the ticket and the project path from the same project.

Not confirmed: which UI surface sent the mismatched projectId. I did not find the renderer call site.

AgentsRoom diagnostics

• App version: 1.207.0
• OS: linux 7.0.0-38-generic (x64)
• Agent CLI: claude
• App language: system

Expected behavior

Start is refused (or the project is taken from the ticket) when ticket project != target project; status unchanged on refusal.

Actual behavior

Ticket of project A became in_progress and its agent was created in project B, with B's context.

Steps to reproduce

1. Project A has ticket T with agentId role:devops. 2) Project B also has a saved devops agent. 3) Start T so that backlog:start-task receives B's projectId/projectPath. 4) T goes in_progress and the temp agent appears under B.

Version or build

1.207.0 (Linux)