Take only a check build its verdict names, and keep a build another check still names

The artifact store takes writes from anything on its network, so a record
planted under another merge's key could have been registered: the walk now
takes a scratch build only when the build seat's own verdict for one of its
pull requests names its key and digests. Deleting by digest also took builds
another check shared (review of #311; novox/hq ADR 0350).

internal/builder/reuse_test.go

@@ -124,6 +124,19 @@ func aCheckBuilt(t *testing.T, scratch *aScratch, tree string) CheckBuilt {
 	return built[0]
 }
 
+// named is the walk's leave naming what a check's verdict says it built, as the controller reads it.
+func named(c CheckBuilt) []NamedBuild {
+	n := NamedBuild{Pull: aPull, Check: "build-1", Module: c.Module, Key: c.Key, Digests: map[string]string{}}
+	for _, m := range c.Made {
+		d := m.Digest
+		if d == "" {
+			d = DigestOf(m.Reference)
+		}
+		n.Digests[m.Name] = d
+	}
+	return []NamedBuild{n}
+}
+
 func withVersion(t *testing.T, v string) {
 	t.Helper()
 	was := Version
@@ -139,7 +152,7 @@ func TestAWalkWhoseKeyIsItsChecksBuildsNothingAndRegistersTheChecksDigest(t *tes
 	checked := aCheckBuilt(t, scratch, "tree-one")
 
 	r, run, workspace := aModuleAt(t, "tree-one")
-	got, err := BuildReusing(t.Context(), run, r, Reuse{Scratch: scratch, Pulls: []PullRef{aPull}},
+	got, err := BuildReusing(t.Context(), run, r, Reuse{Scratch: scratch, Pulls: []PullRef{aPull}, Named: named(checked)},
 		"https://forge.invalid/meshboard.git", "mod", "main", workspace, nil, Npmrc{}, GitCredential{}, nil)
 	if err != nil {
 		t.Fatal(err)
@@ -176,14 +189,47 @@ func TestAWalkWhoseKeyIsItsChecksBuildsNothingAndRegistersTheChecksDigest(t *tes
 	}
 }
 
+// A record no verdict names is refused and built instead, and the walk says so: the store takes writes from anything
+// on its network, so a record planted under another merge's key is never registered.
+func TestARecordNoVerdictNamesIsRefusedAndBuilt(t *testing.T) {
+	withVersion(t, "builder-1")
+	scratch := newScratch()
+	checked := aCheckBuilt(t, scratch, "tree-one")
+	for name, leave := range map[string][]NamedBuild{
+		"no verdict": nil,
+		"another digest": func() []NamedBuild {
+			n := named(checked)
+			n[0].Digests["server"] = "sha256:" + strings.Repeat("e", 64)
+			return n
+		}(),
+		"another check": func() []NamedBuild { n := named(checked); n[0].Check = "build-9"; return n }(),
+	} {
+		t.Run(name, func(t *testing.T) {
+			scratch.took = nil
+			r, run, workspace := aModuleAt(t, "tree-one")
+			got, err := BuildReusing(t.Context(), run, r, Reuse{Scratch: scratch, Pulls: []PullRef{aPull}, Named: leave},
+				"https://forge.invalid/meshboard.git", "mod", "main", workspace, nil, Npmrc{}, GitCredential{}, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got.Reused != nil || len(scratch.took) > 0 || !dockerBuilt(r) {
+				t.Fatalf("a record no verdict names was taken: %+v, copied %v", got.Reused, scratch.took)
+			}
+			if !strings.Contains(got.Why, "no check verdict of the walk's pull requests names it") {
+				t.Fatalf("the walk says %q", got.Why)
+			}
+		})
+	}
+}
+
 // A differing key builds, and says which part differs.
 func TestAWalkWhoseKeyDiffersBuildsAndSaysWhy(t *testing.T) {
 	withVersion(t, "builder-1")
 	scratch := newScratch()
-	aCheckBuilt(t, scratch, "tree-one")
+	checked := aCheckBuilt(t, scratch, "tree-one")
 
 	r, run, workspace := aModuleAt(t, "tree-two")
-	got, err := BuildReusing(t.Context(), run, r, Reuse{Scratch: scratch, Pulls: []PullRef{aPull}},
+	got, err := BuildReusing(t.Context(), run, r, Reuse{Scratch: scratch, Pulls: []PullRef{aPull}, Named: named(checked)},
 		"https://forge.invalid/meshboard.git", "mod", "main", workspace, nil, Npmrc{}, GitCredential{}, nil)
 	if err != nil {
 		t.Fatal(err)
@@ -198,7 +244,7 @@ func TestAWalkWhoseKeyDiffersBuildsAndSaysWhy(t *testing.T) {
 	// And a builder of another version builds too, saying so.
 	withVersion(t, "builder-2")
 	r, run, workspace = aModuleAt(t, "tree-one")
-	got, err = BuildReusing(t.Context(), run, r, Reuse{Scratch: scratch, Pulls: []PullRef{aPull}},
+	got, err = BuildReusing(t.Context(), run, r, Reuse{Scratch: scratch, Pulls: []PullRef{aPull}, Named: named(checked)},
 		"https://forge.invalid/meshboard.git", "mod", "main", workspace, nil, Npmrc{}, GitCredential{}, nil)
 	if err != nil {
 		t.Fatal(err)
@@ -220,11 +266,11 @@ func TestAWalkWhoseKeyDiffersBuildsAndSaysWhy(t *testing.T) {
 func TestAFailedCopyOfAChecksBuildFallsBackToBuilding(t *testing.T) {
 	withVersion(t, "builder-1")
 	scratch := newScratch()
-	aCheckBuilt(t, scratch, "tree-one")
+	checked := aCheckBuilt(t, scratch, "tree-one")
 	scratch.failTake = true
 
 	r, run, workspace := aModuleAt(t, "tree-one")
-	got, err := BuildReusing(t.Context(), run, r, Reuse{Scratch: scratch, Pulls: []PullRef{aPull}},
+	got, err := BuildReusing(t.Context(), run, r, Reuse{Scratch: scratch, Pulls: []PullRef{aPull}, Named: named(checked)},
 		"https://forge.invalid/meshboard.git", "mod", "main", workspace, nil, Npmrc{}, GitCredential{}, nil)
 	if err != nil {
 		t.Fatalf("a failed copy failed the walk: %v", err)
@@ -247,7 +293,7 @@ func TestAFailedCopyOfAChecksBuildFallsBackToBuilding(t *testing.T) {
 func TestOnlyAWalkOfATrunkCommitTakesAChecksBuild(t *testing.T) {
 	withVersion(t, "builder-1")
 	scratch := newScratch()
-	aCheckBuilt(t, scratch, "tree-one")
+	checked := aCheckBuilt(t, scratch, "tree-one")
 
 	r, run, workspace := aModuleAt(t, "tree-one")
 	if _, err := Build(t.Context(), run, r, "https://forge.invalid/meshboard.git", "mod", "main", workspace, nil,
@@ -259,7 +305,7 @@ func TestOnlyAWalkOfATrunkCommitTakesAChecksBuild(t *testing.T) {
 	}
 
 	r, _, workspace = aModuleAt(t, "tree-one") // no trunk said: off it
-	got, err := BuildReusing(t.Context(), r.run, r, Reuse{Scratch: scratch}, "https://forge.invalid/meshboard.git",
+	got, err := BuildReusing(t.Context(), r.run, r, Reuse{Scratch: scratch, Named: named(checked)}, "https://forge.invalid/meshboard.git",
 		"mod", "main", workspace, nil, Npmrc{}, GitCredential{}, nil)
 	if err != nil {
 		t.Fatal(err)
@@ -539,3 +585,43 @@ func TestAChecksBuildIsCopiedByDigestIntoTheModulesNamespace(t *testing.T) {
 		t.Fatalf("the archive was copied as %+v", got)
 	}
 }
+
+// Two checks that built one digest in one repository share it: letting go of one check's builds keeps it while the
+// other still names it, and the last to go takes it.
+func TestABuildTwoChecksShareGoesWithTheLastOfThem(t *testing.T) {
+	m := &aTaggingRegistry{aRegistryOfRepositories: newRegistryOfRepositories(), tags: map[string]map[string]string{}}
+	server := httptest.NewServer(m.serve())
+	defer server.Close()
+	address := strings.TrimPrefix(server.URL, "http://")
+	registry := Registry{Address: address}
+	ctx := t.Context()
+	now := time.Date(2026, 10, 13, 20, 0, 0, 0, time.UTC)
+
+	body := `{"mediaType":"` + mediaManifestOCI + `","layers":[]}`
+	digest := digestOf([]byte(body))
+	m.manifests["scratch/meshboard/server@"+digest] = []byte(body)
+	reference := address + "/scratch/meshboard/server@" + digest
+	other := PullRef{Owner: "novox", Repo: "meshboard", Number: 8}
+	for i, pull := range []PullRef{aPull, other} {
+		id := "build-" + strconv.Itoa(i+1)
+		b := CheckBuild{Key: "r1:" + strings.Repeat(strconv.Itoa(i+1), 64), Module: "meshboard", Pull: pull, Check: id,
+			At: now, Made: []catalogue.Built{{Name: "server", Kind: "image", Reference: reference}}}
+		if err := registry.Keep(ctx, pull, id, now, []CheckBuild{b}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	held := func() bool { _, ok := m.manifests["scratch/meshboard/server@"+digest]; return ok }
+
+	if n, err := registry.Forget(ctx, aPull); err != nil || n != 1 {
+		t.Fatalf("forgot %d (%v)", n, err)
+	}
+	if !held() {
+		t.Fatal("letting go of one check's builds took a build another check still names")
+	}
+	if n, err := registry.Forget(ctx, other); err != nil || n != 1 {
+		t.Fatalf("forgot %d (%v)", n, err)
+	}
+	if held() {
+		t.Fatal("the build stayed after the last check naming it went")
+	}
+}