security watch: remember a notice per group — a catalog pin and a DooPlex pin of one image no longer share one memory entry (old entries copied once, no re-mail); W13

scripts/test_security_watch.py

@@ -20,11 +20,14 @@ What is pinned, each by its consequence (the mail or the class), not by its mech
       failure; the result is cached by digest (a second night reads nothing); main() wires the reader
   W12 the DooPlex (homelab) group (R-1328): read from its list file; a DooPlex advisory names the homelab session, never
       the catalog's lane; a DooPlex image in a private registry is NOT CHECKED with the reason; its own weekly block
+  W13 one image in the catalog AND on DooPlex (R-1333): a new notice is mailed for both pins; the memory keeps one
+      entry per group; an old shared key is copied, so nothing is mailed twice; a clean DooPlex pin forgets only its own
   W11 ghcr.io tag lists are PAGED (Link: rel="next"): every page is read, so a newer tag on page 2 is seen
 Red-proofs (2026-10-26): W5 with the `k not in known` test removed (every night mails) -> W5 fails; W6 with the streak
 threshold at 1 -> W6 fails; W2 with FEED_DAYS check removed -> W2's old-item case fails; W4 with SourceError swallowed
 -> W4 fails. W9 (2026-10-27, R-1310) was seen failing before its two rules existed (2 of 4 checks red, the two
 controls green).
+W13 (2026-10-28, R-1333) was seen failing on the image-only key (4 of 5 checks red; the clean-DooPlex-pin check green).
 """
 import datetime
 import json
@@ -440,10 +443,38 @@ def t_dooplex():
     check("W12 the weekly mail has its own DooPlex block", "DooPlex (homelab)" in wk["text"], wk["text"][:300])
 
 
+def t_two_groups():
+    print("-- W13: one image in the catalog AND on DooPlex (R-1333)")
+    cat = dict(adv_item("rommapp/romm", "CVE-2026-111497", group="app"), tag="5.4.1")
+    dpx = dict(adv_item("rommapp/romm", "CVE-2026-111497", group="dooplex"), tag="5.4.0")
+    m1, st, _ = w.plan([cat, dpx], {"weekly_last": TODAY.isoformat()}, TODAY)
+    adv = [m for m in m1 if m["kind"] == "advisory"]
+    check("W13 a new notice on both pins is mailed for BOTH (the catalog's 5.4.1 and DooPlex's 5.4.0)",
+          len(adv) == 1 and "5.4.1" in adv[0]["text"] and "5.4.0" in adv[0]["text"] and "homelab" in adv[0]["text"],
+          adv[0]["text"][-500:] if adv else kinds(m1))
+    check("W13 the memory keeps one entry per group", sorted(st["advisories"]) ==
+          ["dooplex:rommapp/romm|CVE-2026-111497", "rommapp/romm|CVE-2026-111497"], sorted(st["advisories"]))
+    # a memory written before R-1333 holds ONE shared key: the first night after the change mails nothing again
+    old = {"weekly_last": TODAY.isoformat(), "advisories": {"rommapp/romm|CVE-2026-111497": {
+        "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "rommapp/romm 5.4.0 (x)", "summary": "s"}}}
+    m2, st2, _ = w.plan([cat, dpx], old, TODAY)
+    check("W13 the old shared key is copied to the DooPlex key: no mail again", kinds(m2, "advisory") == [] and
+          st2["advisories"].get("dooplex:rommapp/romm|CVE-2026-111497", {}).get("first") == "2026-10-27", (kinds(m2), st2["advisories"]))
+    m3, st3, _ = w.plan([dpx], dict(old), TODAY)
+    check("W13 a shared key whose catalog pin is gone moves to the DooPlex key (no stale twin, no mail)",
+          sorted(st3["advisories"]) == ["dooplex:rommapp/romm|CVE-2026-111497"] and kinds(m3, "advisory") == [],
+          (sorted(st3["advisories"]), kinds(m3)))
+    dclean = dict(clean("rommapp/romm"), group="dooplex")
+    _, st4, _ = w.plan([cat, dclean], st, TODAY)
+    check("W13 DooPlex's pin checked clean forgets only DooPlex's entry", sorted(st4["advisories"]) ==
+          ["rommapp/romm|CVE-2026-111497"], sorted(st4["advisories"]))
+
+
 def main():
     t_ranges()
     t_classes()
     t_memory()
+    t_two_groups()
     t_inventory()
     for t in (t_runtime, t_ghcr_pages, t_dooplex):
         try: