Build for the merge from a copy its tests never touch, and keep or take only the same head's build

The gate and the repository's check mount the workspace read-write, so a
build from that tree could hold what the tests wrote under a key that
describes the merge. A check now clones the merge outside the workspace
before anything of the change runs, and builds from that. A check keeps,
and a walk takes, only a build an earlier check of the same pull request
at the same head made: another pull request's build, or an earlier
head's, is never registered. The walk reads the verdicts once
(novox/hq issue 703, review of #328).

cmd/mesh-controller/release_plan.go

@@ -9,6 +9,7 @@ import (
 	"slices"
 	"sort"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/nats-io/nats.go"
@@ -386,30 +387,73 @@ var checkedBuildsOf = func(ctx context.Context, pulls []link.PullRef) ([]link.Ch
 	return link.ReadCheckBuilds(ctx, js, buildSeatHeld(ctx), pulls, time.Now().Add(-builder.CheckBuildsKept))
 }
 
-// checkedBuildsOfModules are the builds the build seat's checks of any pull request said they made, or kept, of
-// those modules within the week check builds are kept (novox/hq issue 703): what a check may keep instead of
-// building. A variable so a test needs no bus.
-var checkedBuildsOfModules = func(ctx context.Context, modules []string) ([]link.CheckedBuild, error) {
-	if len(modules) == 0 {
-		return nil, nil
+// mergedHeadsOf are the head commits the walk's merges merged, by pull request (novox/hq issue 703): a pull request
+// merged twice in one walk, or whose head the announcement did not say, has none, and takes no check's build.
+func mergedHeadsOf(p *inventory.Plan) map[link.PullRef]string {
+	heads := map[link.PullRef]string{}
+	if p.Delivery == nil {
+		return heads
 	}
-	js, err := aBus()
-	if err != nil {
-		return nil, err
+	seen := map[link.PullRef]bool{}
+	for _, m := range p.Delivery.Merges {
+		pull, ok := pullOf(m)
+		if !ok {
+			continue
+		}
+		if seen[pull] && heads[pull] != m.Head {
+			heads[pull] = ""
+			continue
+		}
+		seen[pull] = true
+		heads[pull] = m.Head
 	}
-	defer js.Close()
-	return link.ReadCheckBuildsOf(ctx, js, buildSeatHeld(ctx), modules, time.Now().Add(-builder.CheckBuildsKept))
+	return heads
+}
+
+// walkVerdicts are the checks' builds a walk read, by the walk's plan: read once per walk (novox/hq issue 649), not
+// once per module it asks for. Kept a day; a walk lasts minutes.
+var walkVerdicts = struct {
+	sync.Mutex
+	read map[string]verdictsRead
+}{read: map[string]verdictsRead{}}
+
+type verdictsRead struct {
+	at     time.Time
+	builds []link.CheckedBuild
 }
 
 // reuseWithVerdicts is a walk's leave with the builds its pull requests' verdicts name: the only builds the builder
-// may take (ADR 0350 §2). When they cannot be read the leave names none, and the walk builds, saying why.
-func reuseWithVerdicts(ctx context.Context, r *link.ReuseAsk) *link.ReuseAsk {
-	builds, err := checkedBuildsOf(ctx, r.Pulls)
-	if err != nil {
-		fmt.Printf("  the checks' builds of %d pull request(s) could not be read, so the walk builds: %v\n", len(r.Pulls), err)
-		return r
+// may take (ADR 0350 §2), and **only those of a check of the head each merge merged** (novox/hq issue 703): a build
+// a check made at an earlier head of the same pull request is never registered. Read once per walk. When they
+// cannot be read the leave names none, and the walk builds, saying why.
+func reuseWithVerdicts(ctx context.Context, walk string, r *link.ReuseAsk, heads map[link.PullRef]string) *link.ReuseAsk {
+	walkVerdicts.Lock()
+	read, known := walkVerdicts.read[walk]
+	walkVerdicts.Unlock()
+	if !known || walk == "" {
+		builds, err := checkedBuildsOf(ctx, r.Pulls)
+		if err != nil {
+			fmt.Printf("  the checks' builds of %d pull request(s) could not be read, so the walk builds: %v\n", len(r.Pulls), err)
+			return r
+		}
+		read = verdictsRead{at: time.Now(), builds: builds}
+		if walk != "" {
+			walkVerdicts.Lock()
+			for id, w := range walkVerdicts.read {
+				if time.Since(w.at) > 24*time.Hour {
+					delete(walkVerdicts.read, id)
+				}
+			}
+			walkVerdicts.read[walk] = read
+			walkVerdicts.Unlock()
+		}
+	}
+	r.Builds = nil
+	for _, b := range read.builds {
+		if link.SameHead(b.Head, heads[b.Pull]) {
+			r.Builds = append(r.Builds, b)
+		}
 	}
-	r.Builds = builds
 	return r
 }
 
@@ -452,7 +496,8 @@ func askModule(ctx context.Context, p *inventory.Plan, name string, byName map[s
 	}
 	// **The walk takes the check's build of the same key** (novox/hq ADR 0350 §2): its ask says so, with the pull
 	// requests it answers, whose checks name the part of a differing key.
-	id, err := askABuild(withReuse(ctx, reuseWithVerdicts(ctx, reuseAskOf(p))), source, e.Source.Path, ref)
+	id, err := askABuild(withReuse(ctx, reuseWithVerdicts(ctx, p.ID, reuseAskOf(p), mergedHeadsOf(p))), source,
+		e.Source.Path, ref)
 	if err != nil {
 		state.State = "failed"
 		state.Why = err.Error()