fix(deploy): treat finalized manifests as clean no-op

server-tools/lake-lamp-authz/architecture-provision-broker.test.js

@@ -35,6 +35,22 @@ test("architecture deployment defaults to the current Fifth Domain code channel"
   assert.doesNotMatch(source, /ARCHITECTURE_PROVISION_REPO_URL \|\| "https:\/\/guanghulab\.com\/fifth-domain\//);
 });
 
+test("a completed architecture manifest is distinguished from an invalid pending state", () => {
+  const completed = manifest();
+  completed.status = "DEPLOYED_RUNNING_COMPANION · STAGE_B_BOUNDED_RESTART_PROVEN";
+  assert.throws(
+    () => validateManifest(completed, { requestId, commit }),
+    /manifest_already_finalized/,
+  );
+
+  const invalid = manifest();
+  invalid.status = "UNKNOWN";
+  assert.throws(
+    () => validateManifest(invalid, { requestId, commit }),
+    /manifest_not_pending/,
+  );
+});
+
 test("unit requires non-root systemd hardening and release placeholder", () => {
   const unit = "[Service]\nUser=guanghu\nGroup=guanghu\nNoNewPrivileges=true\nPrivateTmp=true\nProtectSystem=strict\nProtectHome=true\nExecStart=/usr/bin/node __RELEASE_ROOT__/server.js\n";
   assert.equal(validateUnit(unit), unit);