refresh_server's up-to-date short-circuit ignores package identity #165

Found during board review of #163. Pre-existing and distinct from the version-comparability work that PR does, so filed rather than folded in.

What

refresh_server's "already up to date" short-circuit compares only version values. It never checks that the cached entry describes the same package:

cached  = old-package @ 1.0.0
config  = new-package @ 1.0.0     (same server name)
-> versions match -> "up to date" -> the OLD package's descriptions are returned

The short-circuit block never references existing_cache.package, and pkg_name is not resolved until after it (refresher.py, "Determine package info", below the early return).

refresh_all compounds it by looking up cache entries by server name only, so a server repointed at a different package keeps serving the previous package's tool descriptions indefinitely — there is no version change to trigger a refresh.

Why it is separate from #163

#163 fixes whether two versions can be ordered. This is about whether they describe the same thing in the first place. are_versions_comparable correctly answers "can 1.0.0 and 1.0.0 be compared?" — yes. The defect is that comparing them is meaningless when the packages differ.

The cross-ecosystem instance (npm cache vs docker config) is fixed by #163, because a version and a digest are incomparable. The same-ecosystem instance above is not, because both sides parse fine.

Fix sketch

Gate the short-circuit on package identity before comparing versions — resolve detect_package_type(...) / pkg_name above the early return and require it to match existing_cache.package. A mismatch should force a refresh, not a comparison.

Worth checking at the same time whether refresh_all's by-name cache lookup should carry the package identity too, so the check cannot be bypassed by a caller that assembles the pair itself.

Related

• fix: close the four #155 follow-ups (#156) #163 — version comparability (the ordering half)
• Version comparison should be tri-state, not a fail-closed boolean #164 — replacing the fail-closed boolean with a tri-state