Take only a check build its verdict names, and keep a build another check still names

The artifact store takes writes from anything on its network, so a record
planted under another merge's key could have been registered: the walk now
takes a scratch build only when the build seat's own verdict for one of its
pull requests names its key and digests. Deleting by digest also took builds
another check shared (review of #311; novox/hq ADR 0350).

internal/builder/reuse.go

@@ -442,11 +442,17 @@ func (r Registry) blobSize(ctx context.Context, repository, digest string) (int6
 // Forget lets go of every check build of a pull request (§5): what each check built in the scratch namespace, the
 // record under its key when it is still that check's, and the check's document.
 func (r Registry) Forget(ctx context.Context, pull PullRef) (int, error) {
-	checks, err := r.checks(ctx, []PullRef{pull})
+	all, err := r.checks(ctx, nil)
 	if err != nil {
 		return 0, err
 	}
-	return r.letGo(ctx, checks)
+	mine := map[string]checkIndex{}
+	for tag, c := range all {
+		if c.Pull == pull {
+			mine[tag] = c
+		}
+	}
+	return r.letGo(ctx, mine, all)
 }
 
 // Expire lets go of every check older than the bound (§5).
@@ -461,19 +467,36 @@ func (r Registry) Expire(ctx context.Context, older time.Duration, now time.Time
 			old[tag] = c
 		}
 	}
-	return r.letGo(ctx, old)
+	return r.letGo(ctx, old, checks)
 }
 
 // Discard lets go of builds no check document names.
 func (r Registry) Discard(ctx context.Context, builds []CheckBuild) error {
-	_, err := r.letGo(ctx, map[string]checkIndex{"": {Builds: builds}})
+	all, err := r.checks(ctx, nil)
+	if err != nil {
+		return err
+	}
+	_, err = r.letGo(ctx, map[string]checkIndex{"": {Builds: builds}}, all)
 	return err
 }
 
 // letGo lets go of each check's builds, then its document; a check whose builds could not all be let go of keeps
-// its document, so the next sweep asks again.
-func (r Registry) letGo(ctx context.Context, checks map[string]checkIndex) (int, error) {
+// its document, so the next sweep asks again. **A build another check still names stays**: deletion is by digest,
+// and two checks that built one digest in one repository — a check asked again, a dependent two pull requests move —
+// share it; it goes with the last check that names it. all are every check kept, the ones going among them.
+func (r Registry) letGo(ctx context.Context, checks, all map[string]checkIndex) (int, error) {
 	store := r.store()
+	stays := map[string]bool{}
+	for tag, c := range all {
+		if _, going := checks[tag]; going {
+			continue
+		}
+		for _, b := range c.Builds {
+			for _, m := range b.Made {
+				stays[catalogue.Recorded(m.Reference)] = true
+			}
+		}
+	}
 	gone := 0
 	var failed []string
 	for tag, c := range checks {
@@ -484,6 +507,9 @@ func (r Registry) letGo(ctx context.Context, checks map[string]checkIndex) (int,
 				if path, kept := catalogue.InArtifactStore(reference); !kept || !strings.HasPrefix(path, ScratchPrefix) {
 					continue // never anything outside the scratch namespace
 				}
+				if stays[reference] {
+					continue // another check still names it
+				}
 				if err := store.LetGo(ctx, reference); err != nil && !errors.Is(err, artifacts.Gone) {
 					ok = false
 					failed = append(failed, fmt.Sprintf("%s: %v", m.Reference, err))
@@ -537,3 +563,46 @@ func (r Reused) Words() string {
 	}
 	return "reused from " + r.From.Said() + ": " + strings.Join(digests, ", ")
 }
+
+// NamedBuild is a build a check's verdict names (ADR 0350 §2): its module, key and each artifact's digest.
+type NamedBuild struct {
+	Pull    PullRef
+	Check   string
+	Module  string
+	Key     string
+	Digests map[string]string
+}
+
+// DigestOf is the digest a reference names: an image's after `@`, an archive's after `/blobs/`.
+func DigestOf(reference string) string {
+	if _, d, ok := strings.Cut(reference, "/blobs/"); ok {
+		return d
+	}
+	if _, d, ok := strings.Cut(reference, "@"); ok {
+		return d
+	}
+	return ""
+}
+
+// unnamed is why a record found under a key is not taken: no verdict of the walk's pull requests names that module,
+// key and every one of its digests. Empty when one does.
+func unnamed(named []NamedBuild, module, key string, found CheckBuild) string {
+	for _, n := range named {
+		if n.Module != module || n.Key != key || n.Check != found.Check || len(n.Digests) != len(found.Made) {
+			continue
+		}
+		same := true
+		for _, m := range found.Made {
+			d := m.Digest
+			if d == "" {
+				d = DigestOf(m.Reference)
+			}
+			same = same && d != "" && n.Digests[m.Name] == d
+		}
+		if same {
+			return ""
+		}
+	}
+	return "a build is kept under this key, and no check verdict of the walk's pull requests names it with its " +
+		"digests: not taken"
+}