fix(ci): stop a held mesh axis deleting priority rows

The pin narrowed the cross product after the axis was resolved, so a row
pinned against an enforced or disabled run lost every combination and left
the matrix entirely -- while a regular row with the same pin was simply moved
onto the held side. A priority row now takes the same precedence a regular
row already took: the run's axis first, the pin second.

tests/unit/python/utils/github/variant/test_axes.py

@@ -376,6 +376,32 @@ class TestPinnedAxes(unittest.TestCase):
         )
         self.assertEqual(len(self._entries(row)), 1)
 
+    def test_a_held_mesh_axis_overrides_a_priority_rows_pin(self) -> None:
+        """A run that holds the axis must not delete the rows that fight it.
+
+        The pin narrows a cross product, so a conflicting one removes every
+        combination and the row leaves the matrix entirely -- while a regular
+        row with the same pin is simply moved onto the held side.
+        """
+        row = _row(
+            "web-app-b", 0, ("swarm",), priority=True, pin_mode="swarm", pin_vpn=False
+        )
+        entries = _assign(
+            [row],
+            sweep=0,
+            tor_mode="auto",
+            variants_per_app=_VARIANTS,
+            vpn_mode="enforced",
+        )
+        self.assertNotEqual(entries, [])
+        self.assertEqual({e["vpn"] for e in entries}, {"true"})
+
+    def test_a_priority_rows_pin_still_narrows_a_rotating_axis(self) -> None:
+        row = _row(
+            "web-app-b", 0, ("swarm",), priority=True, pin_mode="swarm", pin_vpn=False
+        )
+        self.assertEqual({e["vpn"] for e in self._entries(row)}, {"false"})
+
     def test_an_unoffered_mode_aborts_the_matrix(self) -> None:
         row = _row("web-app-b", 0, ("compose",), pin_mode="swarm")
         with self.assertRaises(SystemExit):

utils/github/variant/axes.py

@@ -63,8 +63,8 @@ from utils.github.variant.tor import (
 )
 from utils.github.variant.vpn import (
     MESH_GLYPH_MODES,
+    pinned_vpn_states,
     rotated_vpn,
-    vpn_states,
 )
 from utils.roles.display import VARIANT_SEPARATOR, display_names
 from utils.symbol_glossary import to_emoji
@@ -293,8 +293,7 @@ def assign(
                     offered, capable=capable, tor_mode=tor_mode
                 )
                 if pin_mode in (None, mode) and pin_tor in (None, state)
-                for meshed in vpn_states(mode, vpn_mode=vpn_mode)
-                if pin_vpn in (None, meshed)
+                for meshed in pinned_vpn_states(mode, pin=pin_vpn, vpn_mode=vpn_mode)
             ]
         else:
             mode = pin_mode or pick_mode(

utils/github/variant/vpn.py

@@ -55,6 +55,26 @@ def vpn_states(mode: str, *, vpn_mode: str = "auto") -> list[bool]:
     return [False, True]
 
 
+def pinned_vpn_states(
+    mode: str, *, pin: bool | None = None, vpn_mode: str = "auto"
+) -> list[bool]:
+    """The mesh states a priority row takes, global axis ahead of the pin.
+
+    Same precedence :func:`rotated_vpn` gives a regular row: a run that holds
+    the axis overrides the pin instead of filtering the row out of the matrix,
+    so a held sweep keeps every row it would otherwise have run.
+
+    Args:
+        mode: the deploy mode of the row.
+        pin: the state the row asked for, or None for every state.
+        vpn_mode: the run's axis mode.
+    """
+    states = vpn_states(mode, vpn_mode=vpn_mode)
+    if vpn_mode in ("enforced", "disabled") or pin is None:
+        return states
+    return [state for state in states if state == pin]
+
+
 def wants_vpn(position: int, sweep: int) -> bool:
     """Whether a swarm row carries the mesh this sweep.