Register only from a protected trunk of the same repository, and mark the serving controller never the terminal

A source repository's name is not its identity, and a trunk anyone may push
to makes the trunk rule mean nothing (the review of 2026-10-09). Through any
verb a module now registers only from a repository on the mesh's forge whose
trunk refuses direct pushes, requires a status and lets no administrator
merge past one, asked of the forge's own tools; and only from the repository
by the forge's id, recorded at registration (migration 0084), so one deleted
and made again under the name is refused. The serving controller marks its
environment, so nothing it runs or starts reads as the terminal, and a
terminal request covers only the repository and path it asked.

internal/inventory/catalogue.go

@@ -169,6 +169,25 @@ func (i *Inventory) RegisterModule(ctx context.Context, m catalogue.Manifest, fr
 	return nil
 }
 
+// SourceIdentity is the forge's id of the repository a module is registered from, 0 when none is recorded.
+func (i *Inventory) SourceIdentity(ctx context.Context, module string) (int64, error) {
+	var id *int64
+	err := i.store.Pool().QueryRow(ctx, `select source_repo_id from module where name = $1`, module).Scan(&id)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return 0, fmt.Errorf("%w: %s", ErrNoSuchModule, module)
+	}
+	if err != nil || id == nil {
+		return 0, err
+	}
+	return *id, nil
+}
+
+// SetSourceIdentity records the forge's id of the repository a module is registered from; 0 records none.
+func (i *Inventory) SetSourceIdentity(ctx context.Context, module string, id int64) error {
+	_, err := i.store.Pool().Exec(ctx, `update module set source_repo_id = nullif($2::bigint, 0) where name = $1`, module, id)
+	return err
+}
+
 // hasModule is whether the catalogue holds a module of that name.
 func (i *Inventory) hasModule(ctx context.Context, name string) (bool, error) {
 	var one int

internal/inventory/migrations/0084-a-build-asked-at-the-terminal-says-so.sql

@@ -9,3 +9,10 @@
 -- request kept by a `build` or `replay --register` run at the terminal, never through a verb (whoever may
 -- call a verb includes agents). False for every request kept before this column existed.
 alter table build_request add column at_terminal boolean not null default false;
+
+-- And which repository a module is registered from, by the forge's own id for it (novox/hq ADR 0266): a name
+-- is not an identity. A repository deleted and made again under the same name is another repository, with
+-- none of the protection the first had until someone sets it; its outcome must not register as the module's.
+-- Recorded when a build of it is registered from the mesh's own forge; null until then, and for a source the
+-- forge does not hold.
+alter table module add column source_repo_id bigint;

internal/inventory/pending.go

@@ -88,16 +88,17 @@ func (i *Inventory) RecordBuildRequest(ctx context.Context, a BuildRequest) erro
 	return err
 }
 
-// AskedAtTheTerminal says whether the build of this id was kept as asked at the controller's terminal (novox/hq
-// ADR 0266). False for a build no request was kept for — a check, a dry run, an outcome nobody here asked for —
-// and for every request asked through a verb.
-func (i *Inventory) AskedAtTheTerminal(ctx context.Context, id string) (bool, error) {
-	var at bool
-	err := i.store.Pool().QueryRow(ctx, `select at_terminal from build_request where id = $1`, id).Scan(&at)
+// BuildRequestByID is the build request kept under this id, and whether one was kept.
+func (i *Inventory) BuildRequestByID(ctx context.Context, id string) (BuildRequest, bool, error) {
+	var a BuildRequest
+	err := i.store.Pool().QueryRow(ctx,
+		`select id, repository, seat, source_path, ref, commit_hash, asked_for, at_terminal, asked_at
+		   from build_request where id = $1`, id).Scan(&a.ID, &a.Repository, &a.Seat, &a.Path, &a.Ref, &a.Commit,
+		&a.For, &a.AtTerminal, &a.At)
 	if errors.Is(err, pgx.ErrNoRows) {
-		return false, nil
+		return BuildRequest{}, false, nil
 	}
-	return at, err
+	return a, err == nil, err
 }
 
 // MarkNotAsked says a kept build request was never handed over: the words are kept, unless its outcome was