Judge the one protection rule the forge applies, and keep a recorded repository id

The forge applies the rule named for a branch, else the first glob covering
it; the judge passed a branch whose applied rule let pushes when a later rule
happened to guard it. And a registration whose id the forge could not give
cleared the id already recorded (the confirmation review of 2026-10-09).

internal/inventory/catalogue.go

@@ -182,9 +182,11 @@ func (i *Inventory) SourceIdentity(ctx context.Context, module string) (int64, e
 	return *id, nil
 }
 
-// SetSourceIdentity records the forge's id of the repository a module is registered from; 0 records none.
+// SetSourceIdentity records the forge's id of the repository a module is registered from. 0 — the forge could not
+// say, at the terminal — keeps the id already recorded: an unknown is never a reason to forget what was known.
 func (i *Inventory) SetSourceIdentity(ctx context.Context, module string, id int64) error {
-	_, err := i.store.Pool().Exec(ctx, `update module set source_repo_id = nullif($2::bigint, 0) where name = $1`, module, id)
+	_, err := i.store.Pool().Exec(ctx,
+		`update module set source_repo_id = coalesce(nullif($2::bigint, 0), source_repo_id) where name = $1`, module, id)
 	return err
 }