Refuse the replays without a judge cache rather than run them from a volume

A check's own volume is no place for the replays: the store replay binds a
directory it makes there into other containers by path, which the container
runtime would create on the build node's own disk (review 12308). Without the
build agent's judge cache the replays are refused and the gate says so as an
error; replays the runtime cannot start are the check's error, not the
change's; and an id that cannot name a place in the judge cache is refused
(hq issue 709, issue 704).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/builder/release_branch_test.go

@@ -131,7 +131,6 @@ case "$cmd" in
 ps|rm|exec) exit 0 ;;
 volume)
   if [ -n "$VOLUMES" ]; then echo "$*" >> "$VOLUMES"; fi
-  if [ "$1" = rm ] && [ -n "$REPLAY_MOUNT" ]; then rm -rf "$REPLAY_MOUNT"; fi
   exit 0 ;;
 port) echo "` + bus.Addr().String() + `"; exit 0 ;;
 run)
@@ -151,6 +150,9 @@ run)
   shift
   if [ "$1" = go ]; then echo "GOCACHE=$GOCACHE GOENV=$GOENV $*" >> "` + built + `"; fi
   if [ "$1" = go ] && [ "$2" = build ] && [ -n "$JUDGE_HOMES" ]; then echo "$HOME" >> "$JUDGE_HOMES"; fi
+  if [ "$1" = go ] && [ "$2" = test ] && [ -n "$REPLAYS_CANNOT_START" ]; then
+    echo "docker: Error response from daemon: invalid mount config for type bind" >&2; exit 125
+  fi
   if [ "$1" = go ] && [ "$2" = test ] && [ -n "$REPLAYS" ]; then
     echo "HOME=$HOME GOCACHE=$GOCACHE GOMODCACHE=$GOMODCACHE GOENV=$GOENV GOFLAGS=$GOFLAGS DIR=$workdir" >> "$REPLAYS"
   fi
@@ -744,13 +746,13 @@ func aSelfJudgingControllerThatWritesIntoTheReplays(t *testing.T, marker string)
 	return aPullRequestInto(t, files, "main", map[string]string{"cmd/x.txt": "x"})
 }
 
-// **Without a judge cache, the replays still never read what a pull request wrote** (issue 709, review 12303): the
-// copy of mesh-lab, its home and throwaway caches are in a container volume of the check's own, made before anything
-// of the change runs and removed after — never the workspace. With a judge cache, under it. In both: a self-judging
-// controller pull request writing a test into the replays beside the check, a planted GOFLAGS hook and a poisoned
-// cache entry in the workspace neither run nor are read.
-func TestTheReplaysNeverReadWhatAPullRequestWroteWithOrWithoutAJudgeCache(t *testing.T) {
-	for _, withCache := range []bool{false, true} {
+// **The replays never read what a pull request wrote** (issue 709, reviews 12303 and 12308): with a judge cache they
+// run from a copy under it, and a self-judging controller pull request writing a test into the replays beside the
+// check, a planted GOFLAGS hook and a poisoned cache entry in the workspace neither run nor are read. Without one the
+// replays are refused — the gate an error that says why, never a pass, never the workspace — they never start, and
+// nothing is made on the host.
+func TestTheReplaysNeverReadWhatAPullRequestWroteAndNeedAJudgeCache(t *testing.T) {
+	for _, withCache := range []bool{true, false} {
 		t.Run(fmt.Sprintf("judge cache %v", withCache), func(t *testing.T) {
 			aRuntimeThatBuildsTheJudge(t)
 			replays, volumes := filepath.Join(t.TempDir(), "replays"), filepath.Join(t.TempDir(), "volumes")
@@ -758,11 +760,6 @@ func TestTheReplaysNeverReadWhatAPullRequestWroteWithOrWithoutAJudgeCache(t *tes
 			t.Setenv("VOLUMES", volumes)
 			tmp := t.TempDir()
 			t.Setenv("TMPDIR", tmp)
-			mount := filepath.Join(t.TempDir(), "mesh-replays")
-			t.Setenv("REPLAY_MOUNT", mount)
-			was := ReplayMount
-			ReplayMount = mount
-			t.Cleanup(func() { ReplayMount = was })
 			registry := aFactsRegistry(t)
 			workspace, ran := aPlantedWorkspace(t)
 			if err := os.MkdirAll(filepath.Join(workspace, "go-cache"), 0o755); err != nil {
@@ -786,9 +783,6 @@ func TestTheReplaysNeverReadWhatAPullRequestWroteWithOrWithoutAJudgeCache(t *tes
 			if err != nil {
 				t.Fatal(err)
 			}
-			if v.Gate == nil || v.Gate.Verdict != "pass" || !strings.Contains(v.Report, "--- the replays") {
-				t.Fatalf("the replays did not run and pass: %+v\n%s", v.Gate, v.Report)
-			}
 			if _, err := os.Stat(evilRan + ".wrote"); err != nil {
 				t.Fatalf("the self-judging pull request did not write into the replays beside it, so this proves nothing: %v", err)
 			}
@@ -800,27 +794,70 @@ func TestTheReplaysNeverReadWhatAPullRequestWroteWithOrWithoutAJudgeCache(t *tes
 			}
 			body, _ := os.ReadFile(replays)
 			said := strings.TrimSpace(string(body))
-			if said == "" || strings.Contains(said, workspace) || !strings.Contains(said, "GOENV=off ") {
-				t.Fatalf("the replays ran with something of the workspace, or not at all: %q", said)
-			}
-			base := mount
-			if withCache {
-				base = filepath.Join(cache, "homes", "check-709-self-replays")
-			}
-			if !strings.Contains(said, "DIR="+filepath.Join(base, "mesh-lab", "replays")) {
-				t.Fatalf("the replays did not run from the copy under %s: %s", base, said)
-			}
-			vols, _ := os.ReadFile(volumes)
-			if !withCache && (!strings.Contains(string(vols), "create --label "+BuildLabel+"=check-709-self") ||
-				!strings.Contains(string(vols), "rm --force mesh-check-check-709-self-replays")) {
-				t.Fatalf("the check's own replay volume was not made and removed: %q", vols)
-			}
-			if _, err := os.Stat(base); err == nil {
-				t.Fatalf("the replays' place %s was left after the check", base)
+			if vols, _ := os.ReadFile(volumes); len(vols) != 0 {
+				t.Fatalf("the check made a container volume: %q", vols)
 			}
 			if left, _ := os.ReadDir(tmp); len(left) != 0 {
 				t.Fatalf("a check left %d entr(ies) in the temporary directory", len(left))
 			}
+			if !withCache {
+				if v.Gate == nil || v.Gate.Verdict != "error" || !strings.Contains(v.Gate.Summary, replaysNeedTheJudgeCache) ||
+					v.Verdict != "error" {
+					t.Fatalf("without a judge cache the gate said %+v, not an error saying the replays need it", v.Gate)
+				}
+				if said != "" {
+					t.Fatalf("without a judge cache the replays started: %s", said)
+				}
+				return
+			}
+			if v.Gate == nil || v.Gate.Verdict != "pass" || !strings.Contains(v.Report, "--- the replays") {
+				t.Fatalf("the replays did not run and pass: %+v\n%s", v.Gate, v.Report)
+			}
+			base := filepath.Join(cache, "homes", "check-709-self-replays")
+			if said == "" || strings.Contains(said, workspace) || !strings.Contains(said, "GOENV=off ") ||
+				!strings.Contains(said, "DIR="+filepath.Join(base, "mesh-lab", "replays")) {
+				t.Fatalf("the replays did not run from the copy under %s, apart from the workspace: %q", base, said)
+			}
+			if _, err := os.Stat(base); err == nil {
+				t.Fatalf("the replays' place %s was left after the check", base)
+			}
 		})
 	}
 }
+
+// **Replays the container runtime could not start are the check's error, never the change's failure**, said in the
+// build's log (review 12308); and a check whose id cannot name a place in the judge cache is refused, never given a
+// shared one.
+func TestReplaysThatCannotStartAreAnErrorAndAnUnsafeIDIsRefused(t *testing.T) {
+	aRuntimeThatBuildsTheJudge(t)
+	t.Setenv("REPLAYS_CANNOT_START", "1")
+	registry := aFactsRegistry(t)
+	controller, controllerMain, _ := aRepositoryWithARelease(t, aJudgeOf("the controller the mesh runs"), nil)
+	lab, labMain := aLabWithReplays(t)
+	catalogue, head := aPullRequestInto(t, map[string]string{"modules/gitea/module.json": `{"module":"gitea"}`,
+		CheckScript: "true\n"}, "main", map[string]string{"modules/gitea/index.ts": "x"})
+	spec := CheckSpec{ID: "check-709-start", Repository: catalogue, Ref: head, Owner: "novox", Repo: "mesh-catalog",
+		Number: 1, Base: "main", JudgeCache: t.TempDir(), Paths: []string{"modules/gitea/index.ts"},
+		Modules: []string{"gitea"}, Toolchain: "golang", Beside: map[string]Beside{
+			"mesh-controller": {Repository: controller, Ref: controllerMain}, "mesh-lab": {Repository: lab, Ref: labMain}}}
+	var logged []string
+	v, err := Check(t.Context(), Command, spec, t.TempDir(), registry, GitCredential{}, func(step, message string) {
+		logged = append(logged, message)
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if v.Gate == nil || v.Gate.Verdict != "error" || !strings.Contains(v.Gate.Summary, "could not be started") ||
+		!strings.Contains(v.Gate.Summary, "invalid mount config") {
+		t.Fatalf("replays that could not start were said %+v, not an error naming why", v.Gate)
+	}
+	if !strings.Contains(strings.Join(logged, "\n"), "the replays could not be started") {
+		t.Fatalf("the build's log does not say what failed:\n%s", strings.Join(logged, "\n"))
+	}
+
+	spec.ID = "Check 1/../../x"
+	if _, err := Check(t.Context(), Command, spec, t.TempDir(), registry, GitCredential{}, nil); err == nil ||
+		!strings.Contains(err.Error(), "cannot name its place in the judge cache") {
+		t.Fatalf("a check with an unsafe id was taken: %v", err)
+	}
+}