Land feature 57's controller work on its release branch

The controller plans config, templates and moved providers' provisions,
hands bus accounts to the vault and judges the new manifest words, on the
feature's SDK and node-engine validator (feature 57, config and provisioning).

internal/builder/builder.go

@@ -173,6 +173,10 @@ type Reuse struct {
 	// keyFirst is a check's build (§1): its key is taken before anything is built, and a module with none is not
 	// built at all — nothing could ever take it.
 	keyFirst bool
+	// pull and head are the check's own pull request and the head it judged (novox/hq issue 703): it keeps only a
+	// build an earlier check of the same pull request at the same head made.
+	pull PullRef
+	head string
 }
 
 // errNoKey is a check's build of a module whose source does not pin it: not built (ADR 0350 §1).
@@ -414,7 +418,7 @@ func build(ctx context.Context, run Runner, publish Publisher,
 		// only when asked — a check, a dry run, `build --ref` and `rebuild` never are. Its key is taken by the same
 		// steps a build takes, stopped before anything is built; what it takes is copied by digest.
 		if reuse != nil && reuse.keyFirst {
-			_, key, err := keyFor(ctx, run, publish, manifest, within, workspace, commit, credentials, artifacts, args,
+			keyed, key, err := keyFor(ctx, run, publish, manifest, within, workspace, commit, credentials, artifacts, args,
 				held, npmrcPath, npmrc, seatBases, src, say)
 			if err == nil && key.Key == "" {
 				err = fmt.Errorf("%w: %s", errNoKey, key.Why)
@@ -423,6 +427,11 @@ func build(ctx context.Context, run Runner, publish Publisher,
 				say("reuse", "not built for the merge: %v", err)
 				return Result{Commit: commit, NoKey: err.Error()}, err
 			}
+			// **A check keeps a build of the same key a verdict names** (novox/hq issue 703): asked again when only
+			// the trunk moved, it builds nothing the earlier check built of an unchanged source.
+			if kept := keptCheckBuild(ctx, *reuse, manifest.Module, key.Key, len(artifacts), say); kept != nil {
+				built, src, reused = kept.Made, keyed, kept
+			}
 		} else if reuse != nil && reuse.Scratch != nil {
 			taken, keyed, why := takeACheckBuild(ctx, run, publish, *reuse, manifest, within, workspace, commit,
 				credentials, artifacts, args, held, npmrcPath, npmrc, seatBases, src, onTrunk, say)
@@ -553,6 +562,47 @@ func takeACheckBuild(ctx context.Context, run Runner, publish Publisher, reuse R
 	return taken, keyed, ""
 }
 
+// keptCheckBuild is the build a check keeps instead of building (novox/hq issue 703): the one kept under the
+// module's key by an earlier check of the same pull request at the same head — only the trunk moved — when a verdict
+// of the build seat names its key and every digest — the record alone is never trusted (ADR 0350 §2) — and it holds
+// every artifact the module declares. Another pull request's build, or an earlier head's, is never kept. Nil, and
+// the check builds, otherwise.
+func keptCheckBuild(ctx context.Context, reuse Reuse, module, key string, artifacts int,
+	say func(step, format string, args ...any)) *Reused {
+	if reuse.Scratch == nil || reuse.head == "" {
+		return nil
+	}
+	var same []NamedBuild
+	for _, n := range reuse.Named {
+		if n.Pull == reuse.pull {
+			same = append(same, n)
+		}
+	}
+	if len(same) == 0 {
+		return nil
+	}
+	found, ok, err := reuse.Scratch.Find(ctx, module, key)
+	switch {
+	case err != nil:
+		say("reuse", "the scratch namespace could not be read, so the check builds: %v", err)
+		return nil
+	case !ok:
+		return nil
+	case found.Pull != reuse.pull || found.Head == "" || twelve(found.Head) != twelve(reuse.head):
+		say("reuse", "the build kept under %s is %s, not this pull request's at this head: built", twelve(key[3:]),
+			found.Said())
+		return nil
+	case unnamed(same, module, key, found) != "":
+		say("reuse", "a build is kept under %s and no verdict names it with its digests: built", twelve(key[3:]))
+		return nil
+	case len(found.Made) != artifacts:
+		return nil
+	}
+	kept := &Reused{From: found, Made: found.Made}
+	say("reuse", "kept, not built: %s", strings.Replace(kept.Words(), "reused from", "the build of", 1))
+	return kept
+}
+
 // keyFor takes a build's reuse key by the steps a build takes, each artifact stopped before anything is built or
 // published (ADR 0350 §2): its own copy of the source inputs, so the build's are untouched.
 func keyFor(ctx context.Context, run Runner, publish Publisher, manifest catalogue.Manifest,