record whether an agent's config sets privateUsers in its closure record

swarm-controller/src/cache_miss.rs

@@ -288,12 +288,13 @@ async fn rebuild(world: &impl World, agent: &str, stored: Stored) -> Outcome {
             return Outcome::Unavailable;
         }
     };
-    let (out_path, system, cached) = match reply {
+    let (out_path, system, cached, private_users) = match reply {
         FromMetaReply::Built {
             out_path,
             system,
             cached,
-        } => (out_path, system, cached),
+            private_users,
+        } => (out_path, system, cached, private_users),
         FromMetaReply::Failed { error_tail } => {
             tracing::warn!(%agent, %meta_rev, %error_tail, "cache miss: the rebuild failed");
             return Outcome::Failed;
@@ -321,6 +322,7 @@ async fn rebuild(world: &impl World, agent: &str, stored: Stored) -> Outcome {
         system,
         built_unix: unix_now(),
         cached: true,
+        private_users,
     };
     match replace_if_current(world, agent, &now).await {
         Ok(true) => Outcome::PathChanged,
@@ -558,6 +560,7 @@ mod tests {
             system: "x86_64-linux".to_owned(),
             built_unix: 7,
             cached,
+            private_users: false,
         }
     }
 
@@ -644,6 +647,7 @@ mod tests {
             out_path: out_path.to_owned(),
             system: "x86_64-linux".to_owned(),
             cached,
+            private_users: false,
         }
     }
 
@@ -888,6 +892,32 @@ mod tests {
         );
     }
 
+    /// The record a rebuild at another path writes carries what the builder
+    /// answered about the user namespace, not what the old record held.
+    #[tokio::test]
+    async fn the_replacement_record_carries_the_rebuilds_private_users_answer() {
+        let other = path("iris-other");
+        let FromMetaReply::Built {
+            out_path,
+            system,
+            cached,
+            ..
+        } = built(&other, true)
+        else {
+            unreachable!()
+        };
+        let answer = FromMetaReply::Built {
+            out_path,
+            system,
+            cached,
+            private_users: true,
+        };
+        let world = Fake::missing(&["iris"]).answering("iris", answer);
+        pass_at(&world, &mut Backoff::default(), Instant::now()).await;
+        let writes = world.writes();
+        assert_eq!(writes.len(), 1);
+        assert!(writes[0].1.private_users);
+    }
     #[tokio::test]
     async fn another_path_leaves_a_record_that_moved_on() {
         let world = Fake::missing(&["iris"]).answering("iris", built(&path("iris-other"), true));