[fortmarek]

Summary

The tests (macos-latest) job intermittently fails with rustc archive errors such as failed to build archive at .once/out/rustls-0.23.40/librustls-RUSTLS_0_23_40.rlib: failed to map object file: memory map must have a non-zero length (run 42652108237, on a tree identical to a passing commit).

The test schedule runs several once test processes in one workspace. Cache-miss actions were serialized by a lock keyed on the action digest, but a Rust crate's out-dir is keyed by its label. When two processes compute different digests for the same crate, both rustc runs write the same out-dir at once and delete or truncate each other's object files.

The failed run's evidence shows how the digests diverged:

• The aws-lc-sys build-script action was a cache hit in one process and a miss in another, which re-ran it and produced different bytes, so every downstream digest (including rustls) differed.
• One batch was analysed with a different PATH, giving a third set of digests.

Non-reproducible inputs will keep producing such splits, so this change locks each declared output path instead of the digest. Actions without declared outputs still lock their digest. Identical actions still contend and reuse the cached result after waiting, because the same digest implies the same outputs. The locks are taken all-or-none, so a waiter never holds one lock while waiting for another.

Testing

• New regression test: two concurrent builds whose actions write the same output under different digests. It fails with the digest-keyed lock and passes with this change.
• cargo test -p once-cli --bins graph::analysis::actions (116 passed), cargo clippy -p once-cli --all-targets -- -D warnings, cargo fmt --all -- --check.