@fitlab-ai/agent-infra 0.9.7 → 0.9.9

package/dist/lib/task/delegation-receipts.js

@@ -1,5 +1,246 @@
 import { randomUUID } from 'node:crypto';
+import { isAgentClientId } from '../agent-clients/types.js';
 import { normalizeAgentToken } from '../agent-clients/tokens.js';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, required, optional = []) {
+    if (!isRecord(value))
+        return false;
+    const keys = Object.keys(value);
+    const allowed = new Set([...required, ...optional]);
+    return required.every((key) => Object.prototype.hasOwnProperty.call(value, key))
+        && keys.every((key) => allowed.has(key));
+}
+function exactText(value) {
+    return typeof value === 'string' && value.length > 0 && value.trim() === value;
+}
+function nullableText(value) {
+    return value === null || exactText(value);
+}
+function nullableSafeInteger(value) {
+    return value === null || (Number.isSafeInteger(value) && value >= 0);
+}
+const LIFECYCLE_PROVENANCE_KEYS = [
+    'protocolVersion', 'packageVersion', 'internalExecutableBuildHash', 'lifecycleContractHash',
+    'hookDefinitionHash', 'hookSource', 'hookSourcePathDigest', 'hookSourceHash',
+    'capabilitySessionId', 'capabilityTurnId', 'capabilityToolUseId',
+    'controllerInstanceDigest', 'controlGeneration'
+];
+function isDelegationLifecycleProvenance(value) {
+    if (!hasExactKeys(value, LIFECYCLE_PROVENANCE_KEYS))
+        return false;
+    return Number.isSafeInteger(value.protocolVersion)
+        && value.protocolVersion > 0
+        && exactText(value.packageVersion)
+        && exactText(value.internalExecutableBuildHash)
+        && exactText(value.lifecycleContractHash)
+        && exactText(value.hookDefinitionHash)
+        && ['project', 'managed', 'isolated-user'].includes(value.hookSource)
+        && exactText(value.hookSourcePathDigest)
+        && exactText(value.hookSourceHash)
+        && exactText(value.capabilitySessionId)
+        && exactText(value.capabilityTurnId)
+        && exactText(value.capabilityToolUseId)
+        && nullableText(value.controllerInstanceDigest)
+        && nullableText(value.controlGeneration);
+}
+const HOST_EVIDENCE_REQUIRED_KEYS = [
+    'kind', 'hookDefinitionHash', 'startRevision', 'stopRevision', 'consumer', 'consumedAt'
+];
+const HOST_EVIDENCE_OPTIONAL_KEYS = [
+    'protocolVersion', 'packageVersion', 'internalExecutableBuildHash', 'lifecycleContractHash',
+    'hookSource', 'hookSourcePathDigest', 'hookSourceHash', 'capabilitySessionId',
+    'capabilityTurnId', 'capabilityToolUseId', 'spawnToolUseId', 'spawnObservedAt',
+    'controllerInstanceDigest', 'controlGeneration'
+];
+function isDelegationHostEvidence(value) {
+    if (!hasExactKeys(value, HOST_EVIDENCE_REQUIRED_KEYS, HOST_EVIDENCE_OPTIONAL_KEYS))
+        return false;
+    if (!['codex-lifecycle-v1', 'codex-lifecycle-v2'].includes(value.kind))
+        return false;
+    if (!exactText(value.hookDefinitionHash)
+        || !Number.isSafeInteger(value.startRevision) || value.startRevision < 1
+        || !nullableSafeInteger(value.stopRevision)
+        || !nullableText(value.consumer)
+        || !nullableText(value.consumedAt))
+        return false;
+    if (value.kind === 'codex-lifecycle-v1')
+        return true;
+    return Number.isSafeInteger(value.protocolVersion)
+        && value.protocolVersion > 0
+        && exactText(value.packageVersion)
+        && exactText(value.internalExecutableBuildHash)
+        && exactText(value.lifecycleContractHash)
+        && ['project', 'managed', 'isolated-user'].includes(value.hookSource)
+        && exactText(value.hookSourcePathDigest)
+        && exactText(value.hookSourceHash)
+        && exactText(value.capabilitySessionId)
+        && exactText(value.capabilityTurnId)
+        && exactText(value.spawnToolUseId)
+        && exactText(value.spawnObservedAt)
+        && nullableText(value.controllerInstanceDigest)
+        && nullableText(value.controlGeneration);
+}
+function hasCurrentCodexEvidence(receipt) {
+    const provenance = receipt.lifecycleProvenance;
+    if (!provenance)
+        return false;
+    const activated = ['activated', 'stage-completed', 'sealed', 'consumed'].includes(receipt.status);
+    if (!activated)
+        return receipt.hostEvidence === null;
+    const host = receipt.hostEvidence;
+    if (host?.kind !== 'codex-lifecycle-v2'
+        || host.protocolVersion !== provenance.protocolVersion
+        || host.packageVersion !== provenance.packageVersion
+        || host.internalExecutableBuildHash !== provenance.internalExecutableBuildHash
+        || host.lifecycleContractHash !== provenance.lifecycleContractHash
+        || host.hookDefinitionHash !== provenance.hookDefinitionHash
+        || host.hookSource !== provenance.hookSource
+        || host.hookSourcePathDigest !== provenance.hookSourcePathDigest
+        || host.hookSourceHash !== provenance.hookSourceHash
+        || host.capabilitySessionId !== provenance.capabilitySessionId
+        || host.capabilityTurnId !== provenance.capabilityTurnId
+        || host.controllerInstanceDigest !== provenance.controllerInstanceDigest
+        || host.controlGeneration !== provenance.controlGeneration
+        || receipt.parentId !== provenance.capabilitySessionId
+        || host.spawnToolUseId === provenance.capabilityToolUseId)
+        return false;
+    const spawnObservedAt = Date.parse(host.spawnObservedAt ?? '');
+    const spawnDispatchedAt = Date.parse(receipt.spawnDispatchedAt ?? '');
+    const activationDeadlineAt = Date.parse(receipt.activationDeadlineAt ?? '');
+    if (!Number.isFinite(spawnObservedAt)
+        || !Number.isFinite(spawnDispatchedAt)
+        || !Number.isFinite(activationDeadlineAt)
+        || spawnObservedAt < spawnDispatchedAt
+        || spawnObservedAt > activationDeadlineAt)
+        return false;
+    if (['sealed', 'consumed'].includes(receipt.status)) {
+        return Number.isSafeInteger(host.stopRevision)
+            && host.stopRevision > host.startRevision
+            && host.consumer === receipt.id
+            && exactText(host.consumedAt);
+    }
+    return host.stopRevision === null && host.consumer === null && host.consumedAt === null;
+}
+const RECEIPT_KEYS = [
+    'id', 'taskId', 'runId', 'role', 'stage', 'round', 'artifact', 'client',
+    'requestedModel', 'requestedReasoningEffort', 'actualModel', 'actualReasoningEffort',
+    'modelFallbackReason', 'reasoningEffortFallbackReason', 'parentId', 'childId',
+    'spawnMode', 'agent', 'status', 'workspaceSnapshotScope', 'lifecycleProvenance',
+    'hostEvidence', 'beforeFingerprint', 'afterFingerprint', 'changedPaths', 'createdAt',
+    'preparedMonotonicMs', 'spawnDispatchMonotonicMs', 'activationDeadlineMonotonicMs',
+    'spawnDispatchedAt', 'activationDeadlineAt', 'startEvidenceMonotonicMs',
+    'activatedMonotonicMs', 'activatedAt', 'sealedAt', 'consumedAt'
+];
+function hasStatusBoundEvidence(receipt) {
+    const dispatchFields = [
+        receipt.spawnDispatchMonotonicMs,
+        receipt.activationDeadlineMonotonicMs,
+        receipt.spawnDispatchedAt,
+        receipt.activationDeadlineAt
+    ];
+    const dispatchEmpty = dispatchFields.every((field) => field === null);
+    const dispatchComplete = dispatchFields.every((field) => field !== null);
+    if (!dispatchEmpty && !dispatchComplete)
+        return false;
+    const beforeActivation = ['prepared', 'aborted', 'expired'].includes(receipt.status);
+    if (beforeActivation) {
+        return receipt.parentId === null
+            && receipt.childId === null
+            && receipt.spawnMode === null
+            && receipt.actualModel === null
+            && receipt.actualReasoningEffort === null
+            && receipt.modelFallbackReason === null
+            && receipt.reasoningEffortFallbackReason === null
+            && receipt.agent === null
+            && receipt.hostEvidence === null
+            && receipt.startEvidenceMonotonicMs === null
+            && receipt.activatedMonotonicMs === null
+            && receipt.activatedAt === null
+            && receipt.afterFingerprint === null
+            && receipt.changedPaths.length === 0
+            && receipt.sealedAt === null
+            && receipt.consumedAt === null;
+    }
+    if (!dispatchComplete
+        || !exactText(receipt.parentId)
+        || !exactText(receipt.childId)
+        || receipt.parentId === receipt.childId
+        || receipt.startEvidenceMonotonicMs === null
+        || receipt.activatedMonotonicMs === null
+        || !exactText(receipt.activatedAt))
+        return false;
+    if (receipt.status === 'activated') {
+        return receipt.agent === null
+            && receipt.afterFingerprint === null
+            && receipt.changedPaths.length === 0
+            && receipt.sealedAt === null
+            && receipt.consumedAt === null;
+    }
+    if (!exactText(receipt.agent)
+        || normalizeAgentToken(receipt.agent) !== normalizeAgentToken(receipt.client))
+        return false;
+    if (receipt.status === 'stage-completed') {
+        return receipt.afterFingerprint === null
+            && receipt.changedPaths.length === 0
+            && receipt.sealedAt === null
+            && receipt.consumedAt === null;
+    }
+    if (!exactText(receipt.afterFingerprint) || !exactText(receipt.sealedAt))
+        return false;
+    return receipt.status === 'sealed'
+        ? receipt.consumedAt === null
+        : receipt.status === 'consumed' && exactText(receipt.consumedAt);
+}
+function isDelegationReceipt(value) {
+    if (!hasExactKeys(value, RECEIPT_KEYS))
+        return false;
+    const structurallyValid = exactText(value.id)
+        && exactText(value.taskId)
+        && exactText(value.runId)
+        && ['executor', 'reviewer'].includes(value.role)
+        && ['analysis', 'review-analysis', 'plan', 'review-plan', 'code', 'review-code', 'commit'].includes(value.stage)
+        && Number.isSafeInteger(value.round)
+        && value.round > 0
+        && exactText(value.artifact)
+        && isAgentClientId(value.client)
+        && exactText(value.requestedModel)
+        && exactText(value.requestedReasoningEffort)
+        && nullableText(value.actualModel)
+        && nullableText(value.actualReasoningEffort)
+        && nullableText(value.modelFallbackReason)
+        && nullableText(value.reasoningEffortFallbackReason)
+        && nullableText(value.parentId)
+        && nullableText(value.childId)
+        && nullableText(value.spawnMode)
+        && nullableText(value.agent)
+        && ['prepared', 'activated', 'stage-completed', 'sealed', 'consumed', 'aborted', 'expired'].includes(value.status)
+        && value.workspaceSnapshotScope === 'task'
+        && (value.lifecycleProvenance === null || isDelegationLifecycleProvenance(value.lifecycleProvenance))
+        && (value.hostEvidence === null || isDelegationHostEvidence(value.hostEvidence))
+        && exactText(value.beforeFingerprint)
+        && nullableText(value.afterFingerprint)
+        && Array.isArray(value.changedPaths)
+        && value.changedPaths.every(exactText)
+        && exactText(value.createdAt)
+        && nullableSafeInteger(value.preparedMonotonicMs)
+        && value.preparedMonotonicMs !== null
+        && nullableSafeInteger(value.spawnDispatchMonotonicMs)
+        && nullableSafeInteger(value.activationDeadlineMonotonicMs)
+        && nullableText(value.spawnDispatchedAt)
+        && nullableText(value.activationDeadlineAt)
+        && nullableSafeInteger(value.startEvidenceMonotonicMs)
+        && nullableSafeInteger(value.activatedMonotonicMs)
+        && nullableText(value.activatedAt)
+        && nullableText(value.sealedAt)
+        && nullableText(value.consumedAt);
+    if (!structurallyValid)
+        return false;
+    const receipt = value;
+    return hasStatusBoundEvidence(receipt)
+        && (receipt.client !== 'codex' || hasCurrentCodexEvidence(receipt));
+}
 const MANAGED_AGENTS = {
     'agent-infra-lifecycle-executor': 'executor',
     'agent-infra-lifecycle-reviewer': 'reviewer'
@@ -10,6 +251,10 @@ function managedDelegationRole(nativeAgent) {
 function fail(code, message) {
     return { ok: false, code, message };
 }
+// 空白串折叠为 null，保持"缺失即 null"的单一表示（Start/Stop 两处共用，避免任一入口把 "   " 当成已观察到的值入账）
+function foldBlankToNull(value) {
+    return value?.trim() ? value : null;
+}
 function prepareDelegation(input, options = {}) {
     const monotonic = (options.monotonicNow ?? (() => Number(process.hrtime.bigint() / 1000000n)))();
     return Object.freeze({
@@ -49,7 +294,7 @@ function dispatchDelegation(receipt, options = {}) {
     }
     const monotonic = (options.monotonicNow ?? (() => Number(process.hrtime.bigint() / 1000000n)))();
     const dispatchedAt = (options.now ?? (() => new Date().toISOString()))();
-    const window = options.activationWindowMs ?? 15_000;
+    const window = options.activationWindowMs ?? 60_000;
     return { ok: true, receipt: Object.freeze({
             ...receipt,
             spawnDispatchMonotonicMs: monotonic,
@@ -82,30 +327,43 @@ function activateDelegation(receipt, event, options = {}) {
     if (!event.parentId || (receipt.parentId !== null && event.parentId !== receipt.parentId) || !event.childId || event.childId === event.parentId) {
         return fail('DELEGATION_IDENTITY_INVALID', 'native parent/child identity does not match the prepared delegation');
     }
-    if (event.spawnMode !== 'fresh')
+    // spawnMode 的必需性按 client 判断：claude-code 宿主结构上不提供该字段，跳过；其余 client 维持硬校验
+    if (receipt.client !== 'claude-code' && event.spawnMode !== 'fresh') {
         return fail('DELEGATION_FORK_FORBIDDEN', `spawn mode '${event.spawnMode}' is not fresh`);
-    const actualModel = event.actualModel;
-    if (!actualModel || actualModel.trim() !== actualModel) {
-        return fail('DELEGATION_MODEL_IDENTITY_MISSING', 'native start event must provide a non-empty actual model identity');
     }
-    if (actualModel !== receipt.requestedModel && (!event.modelFallbackReason || event.modelFallbackReason.trim() === '')) {
-        return fail('DELEGATION_MODEL_FALLBACK_UNRECORDED', 'actual model differs from requested model without a fallback reason');
+    // model/effort 维度：claude-code 如实记录、不做门禁；其余 client 维持现状硬校验（HDR-2）
+    const actualModel = foldBlankToNull(event.actualModel);
+    const actualReasoningEffort = foldBlankToNull(event.actualReasoningEffort);
+    if (receipt.client !== 'claude-code') {
+        if (!actualModel || actualModel.trim() !== actualModel) {
+            return fail('DELEGATION_MODEL_IDENTITY_MISSING', 'native start event must provide a non-empty actual model identity');
+        }
+    }
+    if (actualModel !== null && actualModel !== receipt.requestedModel) {
+        if (receipt.client !== 'claude-code' && (!event.modelFallbackReason || event.modelFallbackReason.trim() === '')) {
+            return fail('DELEGATION_MODEL_FALLBACK_UNRECORDED', 'actual model differs from requested model without a fallback reason');
+        }
     }
-    const actualReasoningEffort = event.actualReasoningEffort;
-    if (!actualReasoningEffort || actualReasoningEffort.trim() !== actualReasoningEffort) {
-        return fail('DELEGATION_REASONING_EFFORT_MISSING', 'native start event must provide a non-empty actual reasoning effort');
+    if (receipt.client !== 'claude-code') {
+        if (!actualReasoningEffort || actualReasoningEffort.trim() !== actualReasoningEffort) {
+            return fail('DELEGATION_REASONING_EFFORT_MISSING', 'native start event must provide a non-empty actual reasoning effort');
+        }
     }
     if (receipt.client === 'codex'
         && event.hostEvidence?.kind !== 'codex-lifecycle-v2')
         return fail('DELEGATION_HOST_EVIDENCE_REQUIRED', 'Codex activation requires trusted lifecycle-v2 host evidence');
-    if (actualReasoningEffort !== receipt.requestedReasoningEffort
-        && (!event.reasoningEffortFallbackReason || event.reasoningEffortFallbackReason.trim() === '')) {
-        return fail('DELEGATION_REASONING_EFFORT_FALLBACK_UNRECORDED', 'actual reasoning effort differs from requested effort without a fallback reason');
+    if (actualReasoningEffort !== null && actualReasoningEffort !== receipt.requestedReasoningEffort) {
+        if (receipt.client !== 'claude-code' && (!event.reasoningEffortFallbackReason || event.reasoningEffortFallbackReason.trim() === '')) {
+            return fail('DELEGATION_REASONING_EFFORT_FALLBACK_UNRECORDED', 'actual reasoning effort differs from requested effort without a fallback reason');
+        }
     }
-    if (actualModel === receipt.requestedModel && event.modelFallbackReason) {
+    // "无关 fallback 理由"检查对所有 client 保持不变——防止编造理由的红线，不属于 HDR-2 放宽范围
+    // actualModel/actualReasoningEffort 为 null（未观察到）时同样没有"实际不同"这回事，理由一样是无关的
+    if ((actualModel === null || actualModel === receipt.requestedModel) && event.modelFallbackReason) {
         return fail('DELEGATION_MODEL_FALLBACK_INVALID', 'model fallback reason is only valid when actual model differs');
     }
-    if (actualReasoningEffort === receipt.requestedReasoningEffort && event.reasoningEffortFallbackReason) {
+    if ((actualReasoningEffort === null || actualReasoningEffort === receipt.requestedReasoningEffort)
+        && event.reasoningEffortFallbackReason) {
         return fail('DELEGATION_REASONING_EFFORT_FALLBACK_INVALID', 'reasoning-effort fallback reason is only valid when actual effort differs');
     }
     if (event.hostEvidence
@@ -145,7 +403,7 @@ function activateDelegation(receipt, event, options = {}) {
             status: 'activated',
             parentId: event.parentId,
             childId: event.childId,
-            spawnMode: event.spawnMode,
+            spawnMode: event.spawnMode ?? null,
             actualModel,
             actualReasoningEffort,
             modelFallbackReason: event.modelFallbackReason ?? null,
@@ -213,6 +471,10 @@ function sealDelegation(receipt, event, options = {}) {
             status: 'sealed',
             afterFingerprint: event.afterFingerprint,
             changedPaths: Object.freeze([...event.changedPaths]),
+            actualModel: receipt.actualModel ?? foldBlankToNull(event.actualModel),
+            actualReasoningEffort: receipt.actualReasoningEffort ?? foldBlankToNull(event.actualReasoningEffort),
+            modelFallbackReason: receipt.modelFallbackReason ?? event.modelFallbackReason ?? null,
+            reasoningEffortFallbackReason: receipt.reasoningEffortFallbackReason ?? event.reasoningEffortFallbackReason ?? null,
             hostEvidence: event.hostEvidence && receipt.hostEvidence ? Object.freeze({
                 ...receipt.hostEvidence,
                 ...event.hostEvidence
@@ -231,5 +493,5 @@ function consumeDelegation(receipt, options = {}) {
             consumedAt: (options.now ?? (() => new Date().toISOString()))()
         }) };
 }
-export { activateDelegation, abortPreparedDelegation, completeDelegationStage, consumeDelegation, dispatchDelegation, managedDelegationRole, prepareDelegation, sealDelegation };
+export { activateDelegation, abortPreparedDelegation, completeDelegationStage, consumeDelegation, dispatchDelegation, foldBlankToNull, isDelegationReceipt, managedDelegationRole, prepareDelegation, sealDelegation };
 //# sourceMappingURL=delegation-receipts.js.map

package/dist/lib/task/events.js

@@ -12,6 +12,7 @@ import { validateLifecycleExecution } from './lifecycle-execution.js';
 import { commitOrchestrationStageCompletion } from './orchestration.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { captureTaskWriteMetadata, writeTask } from './write.js';
+import { allowsManualOverride } from './guard-override.js';
 const eventCatalog = [
     'analyze.started', 'analyze.awaiting-input', 'analyze.completed',
     'review-analysis.started', 'review-analysis.completed',
@@ -22,7 +23,7 @@ const eventCatalog = [
     'manual-validation.started', 'manual-validation.completed',
     'validation-run.started', 'validation-run.completed'
 ];
-const BASE_FIELDS = new Set(['taskRef', 'event', 'agent', 'dryRun']);
+const BASE_FIELDS = new Set(['taskRef', 'event', 'agent', 'dryRun', 'overrideTicket', 'overrideTarget', 'overrideScope']);
 const SCHEMAS = {
     'analyze.started': { optional: ['round'] },
     'analyze.awaiting-input': { required: ['question'] },
@@ -331,7 +332,8 @@ function applyTaskEventUnlocked(request, options = {}) {
     const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
     if (!resolved.ok)
         return failed(request, { code: resolved.code, message: resolved.message }, { taskId: resolved.taskId });
-    if (resolved.state !== 'active')
+    const stateOverride = allowsManualOverride(options.manualOverride, 'task-event', 'TASK_STATE_MISMATCH');
+    if (resolved.state !== 'active' && !stateOverride)
         return failed(request, { code: 'TASK_STATE_MISMATCH', message: `task ${resolved.taskId} is ${resolved.state}, expected active` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath });
     let content;
     try {
@@ -403,7 +405,7 @@ function applyTaskEventUnlocked(request, options = {}) {
         return successNoOp(normalized, resolved.taskId, resolved.taskMdPath, currentStep, eventIdentity, done.done, frontmatter, artifactContext);
     if (eventIdentity.phase === 'completed' && completedRows.length > 0 && openRows.length === 0)
         return failed(normalized, { code: 'EVENT_LOG_CONFLICT', message: 'event identity is already completed with a different payload' }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
-    if (eventIdentity.phase === 'completed' && !row?.started)
+    if (eventIdentity.phase === 'completed' && !row?.started && !allowsManualOverride(options.manualOverride, 'task-event', 'EVENT_START_MISSING'))
         return failed(normalized, { code: 'EVENT_START_MISSING', message: 'completion requires one open matching started event' }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
     if (eventIdentity.phase === 'completed') {
         const validated = validateCompletedArtifact(resolved.taskDir, FAMILY[eventIdentity.family].artifact, normalized.artifact, normalized.round);
@@ -416,7 +418,7 @@ function applyTaskEventUnlocked(request, options = {}) {
         return successNoOp(normalized, resolved.taskId, resolved.taskMdPath, currentStep, eventIdentity, existing.time, frontmatter, artifactContext);
     }
     const allowed = FAMILY[eventIdentity.family][eventIdentity.phase === 'started' ? 'started' : 'completed'];
-    if (!allowed.includes(currentStep))
+    if (!allowed.includes(currentStep) && !allowsManualOverride(options.manualOverride, 'task-event', 'EVENT_TRANSITION_INVALID'))
         return failed(normalized, { code: 'EVENT_TRANSITION_INVALID', message: `${normalized.event} is not allowed from '${currentStep}'` }, { taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, fromStep: currentStep, toStep: currentStep, action: eventIdentity.action, phase: eventIdentity.phase });
     const findingCountError = validateReviewFindingCounts(normalized, content, eventIdentity.family, completedArtifact?.path ?? null);
     if (findingCountError)
@@ -528,7 +530,7 @@ function applyTaskEventUnlocked(request, options = {}) {
         });
     }
     mutations.push({ kind: 'section', aliases: ['活动日志', 'Activity Log'], heading: section.heading, body });
-    const result = writeTask({ taskRef: normalized.taskRef, expectedState: 'active', dryRun: normalized.dryRun, mutations }, { ...options, metadataProvider: () => metadata });
+    const result = writeTask({ taskRef: normalized.taskRef, expectedState: stateOverride ? resolved.state : 'active', dryRun: normalized.dryRun, mutations }, { ...options, metadataProvider: () => metadata });
     if (result.status === 'failed')
         return failed(normalized, result.error, { taskId: result.taskId, taskMdPath: result.taskMdPath, fromStep: currentStep, toStep: step, action: eventIdentity.action, phase: eventIdentity.phase, timestamp: result.timestamp, agentInfraVersion: result.agentInfraVersion, operations: result.operations, artifactContext });
     if (!normalized.dryRun && orchestrationCompletion) {
@@ -568,6 +570,8 @@ function applyTaskEvent(request, options = {}) {
     if (invalid)
         return failed(request, invalid);
     const parts = eventParts(request.event);
+    if (options.lockAlreadyHeld)
+        return applyTaskEventUnlocked(request, options);
     if (request.dryRun || parts.phase !== 'completed' || parts.family === 'manual-validation') {
         return applyTaskEventUnlocked(request, options);
     }