fix(deploy): treat finalized manifests as clean no-op

server-tools/lake-lamp-authz/deployment-event-worker.test.js

@@ -14,6 +14,34 @@ test("resident deployment agent consumes only an explicit immutable event and wr
     assert.equal(JSON.parse(fs.readFileSync(path.join(receipts, "event-1.json"))).diagnostic_code, "deployment_succeeded");
   } finally { fs.rmSync(root, { recursive: true, force: true }); }
 });
+test("a finalized manifest produces a clean no-deployment receipt", async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-deploy-noop-"));
+  const queue = path.join(root, "queue"), receipts = path.join(root, "receipts"), sha = "c".repeat(40);
+  fs.mkdirSync(queue);
+  fs.writeFileSync(path.join(queue, "event.json"), JSON.stringify({
+    schema: "guanghu.deployment-event/v1",
+    event_id: "event-finalized",
+    state: "queued_for_resident_agent",
+    repo: "bingshuo/guanghu-ice-heart",
+    branch: "main",
+    commit_sha: sha,
+    workorder_id: "order-finalized",
+    resource: `GLS-FINALIZED-DEPLOY@${sha}`,
+    manifest: "deployment/requests/GLS-FINALIZED-DEPLOY.json",
+  }));
+  try {
+    const result = await processOne({
+      queueDir: queue,
+      receiptsDir: receipts,
+      registry: { "bingshuo/guanghu-ice-heart": { repo_url: "https://example.invalid/code.git" } },
+      provisionFn: async () => ({ ok: false, error: "manifest_already_finalized" }),
+    });
+    assert.equal(result.ok, true);
+    assert.equal(result.state, "NO_DEPLOYMENT_REQUIRED");
+    assert.equal(result.receipt.diagnostic_code, "manifest_already_finalized");
+    assert.equal(fs.existsSync(path.join(queue, "event.json.processing.done")), true);
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});
 test("resident agent rechecks source ownership before deployment", async () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-source-policy-"));
   const queue = path.join(root, "queue"), receipts = path.join(root, "receipts"), sha = "b".repeat(40);