fix addressed registry recovery invariants

backend/test/registry-addressed-invariants.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { mkdtemp } from "node:fs/promises";
+import { join } from "node:path";
+import { RegistryAddressedPublicationStore } from "../src/workspaces/registry-publication.js";
+
+const request = (runId: string, mode: "create" | "resume" = "create") => ({
+  mode, operation: "registry_bootstrap" as const, runId: runId as any,
+  requestSha256: "1".repeat(64) as any, installationIdentitySha256: "2".repeat(64) as any,
+  repositoryIdentitySha256: "3".repeat(64) as any, expectedBaseCommit: null,
+  remoteRefIdentitySha256: "4".repeat(64) as any,
+});
+
+describe("addressed registry invariants", () => {
+  it("pins one immutable target OID through fetch and plan", async () => {
+    const store = new RegistryAddressedPublicationStore(await mkdtemp(join(process.env.TMPDIR ?? "/tmp", "thoth-reg-")));
+    const runId = "a".repeat(32);
+    await store.claim(request(runId), null);
+    await store.transition(runId as any, "target_advertised", { advertisedTargetCommit: "1".repeat(40) as any, immutableTargetRef: `refs/thoth/addressed-runs/${runId}/target` });
+    await expect(store.transition(runId as any, "target_fetched", { fetchedTargetCommit: "2".repeat(40) as any })).rejects.toThrow();
+  });
+
+  it("requires resume to find an existing run and rejects create replay", async () => {
+    const store = new RegistryAddressedPublicationStore(await mkdtemp(join(process.env.TMPDIR ?? "/tmp", "thoth-reg-")));
+    const runId = "b".repeat(32);
+    await expect(store.claim(request(runId, "resume"), null)).rejects.toThrow();
+    await store.claim(request(runId), null);
+    await expect(store.claim(request(runId), null)).rejects.toThrow();
+  });
+});