fix: require claimed status before dispatch

Author: devkade

src/domain/task-graph.ts

@@ -418,6 +418,7 @@ export function dispatchClaimedTask(state: WorkerExecutionState, request: { task
   if (worker.state !== "ready") throw new Error(`worker ${worker.id} is not ready`);
   if (worker.readinessNonce && request.readinessNonce !== worker.readinessNonce) throw new Error(`worker ${worker.id} readiness nonce mismatch`);
   const task = findTask(state.graph, request.taskId);
+  if (task.status !== "claimed") throw new Error(`task ${task.id} is not claimed`);
   const claim = requireActiveClaim(task, request.claimToken, now);
   if (claim.workerId !== request.workerId) throw new Error(`task ${task.id} is claimed by ${claim.workerId}`);
   if (state.dispatches.some((dispatch) => dispatch.taskId === task.id && dispatch.claimToken === request.claimToken)) throw new Error(`task ${task.id} claim is already dispatched`);

test/task-graph.test.ts

@@ -254,6 +254,15 @@ test("worker execution dispatches claimed parallel tasks and completes only from
   assert.equal(stale.find((worker) => worker.id === "w2")?.state, "unhealthy");
 });
 
+test("worker dispatch rejects non-claimed tasks with active claims without mutation", () => {
+  const graph = { tasks: [{ id: "done", status: "completed" as const, dependencies: [], assignedWorker: "w1", claim: { token: "tok", workerId: "w1", claimedAt: "2026-01-01T00:00:00.000Z", expiresAt: "2026-01-01T00:20:00.000Z" } }] };
+  const state: WorkerExecutionState = { graph, workers: [{ id: "w1", state: "ready", lastHeartbeatAt: "2026-01-01T00:01:00.000Z" }], dispatches: [], reports: [] };
+
+  assert.throws(() => dispatchClaimedTask(state, { taskId: "done", workerId: "w1", claimToken: "tok", now: "2026-01-01T00:02:00.000Z" }), /not claimed/);
+  assert.equal(state.graph.tasks[0]?.status, "completed");
+  assert.deepEqual(state.dispatches, []);
+});
+
 test("stale worker reports cannot mutate expired or recovered claims", () => {
   const state: WorkerExecutionState = {
     graph: { tasks: [{ id: "build", status: "in_progress" as const, dependencies: [], assignedWorker: "w1", claim: { token: "old", workerId: "w1", claimedAt: "2026-01-01T00:00:00.000Z", expiresAt: "2026-01-01T00:10:00.000Z" } }] },
@@ -269,7 +278,10 @@ test("stale worker reports cannot mutate expired or recovered claims", () => {
   assert.deepEqual(state.reports, []);
 
   const recovered = recoverExpiredClaim(state.graph, { taskId: "build", workerId: "w2", token: "new", now: "2026-01-01T00:11:00.000Z", leaseExpiresAt: "2026-01-01T00:20:00.000Z" });
-  assert.throws(() => captureWorkerReport({ ...state, graph: recovered }, { ...report, reportedAt: "2026-01-01T00:12:00.000Z" }), /matching claim token/);
+  const recoveredState = { ...state, graph: recovered };
+  assert.throws(() => captureWorkerReport(recoveredState, { ...report, reportedAt: "2026-01-01T00:12:00.000Z" }), /matching claim token/);
+  assert.equal(recoveredState.workers[0]?.state, "busy");
+  assert.deepEqual(recoveredState.reports, []);
 });
 
 test("worker heartbeat stale detection and terminal retention are modeled", () => {