gitea: gate and judge every trunk the gate's source names, not main alone

The operator, 2026-10-28: the gates and trunk_rule apply to every trunk,
the branches the mesh installs from, and later there may be more than
main. The trunks are read at the call from mesh-delivery-gate's source,
in one function (trunksOf), and fall back to main, said, only when it
names none. A force-push onto any trunk is refused, and trunk_rule says
whether the branch asked is a trunk.

modules/gitea/protectfull.ts

@@ -182,7 +182,12 @@ function controllerCovers(rule: string, branch: string): boolean {
  *  cmd/mesh-controller/build_source.go does (ADR 0534 §6): the rule named for the branch, else the first glob rule that
  *  covers it; it takes no push, its merge whitelist names mesh-tools and no agent-<node>, and no administrator merges
  *  past it. A mirror, not the judge: the controller's own verdict is the one that counts. */
-export function trunkRule(rules: BranchProtection[], branch: string): { holds: boolean; why: string } {
+export function trunkRule(rules: BranchProtection[], branch: string, trunks: string[] = [MAIN_BRANCH]): { holds: boolean; why: string; is_trunk: boolean } {
+  const judged = judgedTrunkRule(rules, branch);
+  return { ...judged, is_trunk: trunks.includes(branch) };
+}
+
+function judgedTrunkRule(rules: BranchProtection[], branch: string): { holds: boolean; why: string } {
   const all = rules.map(asControllerRule);
   const r = all.find((x) => x.rule === branch) ?? all.find((x) => controllerCovers(x.rule, branch));
   const no = (why: string) => ({ holds: false, why });
@@ -201,15 +206,52 @@ export function trunkRule(rules: BranchProtection[], branch: string): { holds: b
   return { holds: true, why: `the rule ${r.rule} takes no push, only ${r.merge_whitelist.join(", ")} merge, and no administrator merges past it` };
 }
 
-/** Why a call is the operator's, or null: it lets a force-push onto a rule covering main (the operator, 2026-10-28
- *  16:4x: a call waits for their Approve only if it removes branch protection or allows a force-push to main). No tool of
- *  this module can ask for that Approve yet, so such a call is refused with nothing sent. */
-export function forcePushToMain(rule: string, body: Record<string, unknown>): string | null {
-  if (!ruleCovers(rule, MAIN_BRANCH)) return null;
+/** The gate's source as it is read: one key per trunk, each with the heads of the repositories installed from it. */
+export type SourceRead = () => Promise<Record<string, unknown>>;
+
+/** The state the trunks are read from: mesh-delivery-gate's source, whose key `main` is today's one trunk of each
+ *  repository it names (each repository's trunk head the checker judges on); a later trunk is a key of its own. */
+export const TRUNK_SOURCE = "mesh-delivery-gate.source";
+
+/** A repository's trunks, the branches the mesh installs from (the operator, 2026-10-28 16:5x): each key of the gate's
+ *  source whose heads name the repository. "main" only when the source names none of its trunks or cannot be read, and
+ *  `from` says which. The one place trunks are read: several trunks later change only this. */
+export async function trunksOf(owner: string, repo: string, read: SourceRead): Promise<{ names: string[]; from: string }> {
+  const full = `${owner}/${repo}`;
+  let src: Record<string, unknown>;
+  try {
+    src = await read();
+  } catch (err) {
+    return { names: [MAIN_BRANCH], from: `${TRUNK_SOURCE} could not be read (${err instanceof Error ? err.message : String(err)}): ${MAIN_BRANCH} assumed` };
+  }
+  const names = Object.keys(src).filter((k) => {
+    const heads = (src[k] as { heads?: Record<string, unknown> } | null)?.heads;
+    return !!heads && typeof heads === "object" && full in heads;
+  }).sort();
+  if (names.length) return { names, from: TRUNK_SOURCE };
+  return { names: [MAIN_BRANCH], from: `${TRUNK_SOURCE} names no trunk of ${full}: ${MAIN_BRANCH} assumed` };
+}
+
+/** The gate's source read from the bus, every key and its value (the tools bundle's state channel). */
+export function sourceFromBus(get: (name: string) => { keys(): Promise<string[]>; get(k: string): Promise<{ value: unknown } | null> }): SourceRead {
+  return async () => {
+    const st = get(TRUNK_SOURCE);
+    const out: Record<string, unknown> = {};
+    for (const k of await st.keys()) out[k] = (await st.get(k))?.value ?? null;
+    return out;
+  };
+}
+
+/** Why a call is the operator's, or null: it lets a force-push onto a rule covering a trunk (the operator, 2026-10-28
+ *  16:4x: a call waits for their Approve only if it removes branch protection or allows a force-push to a trunk). No
+ *  tool of this module can ask for that Approve yet, so such a call is refused with nothing sent. */
+export function forcePushToTrunk(rule: string, body: Record<string, unknown>, trunks: string[]): string | null {
+  const covered = trunks.filter((t) => ruleCovers(rule, t));
+  if (!covered.length) return null;
   const opens = body.enable_force_push === true || body.force_push_allowlist_deploy_keys === true ||
     (["force_push_allowlist_usernames", "force_push_allowlist_teams"] as const).some((k) => Array.isArray(body[k]) && (body[k] as unknown[]).length > 0);
   if (!opens) return null;
-  return `the rule ${rule} covers ${MAIN_BRANCH}, and this call lets a force-push onto it: a force-push to main is the ` +
-    `operator's Approve (the operator, 2026-10-28), and no tool of this module can ask it yet, so it is the operator's at ` +
-    `the forge. Nothing was sent`;
+  return `the rule ${rule} covers ${covered.join(", ")}, and this call lets a force-push onto it: a force-push to a trunk is ` +
+    `the operator's Approve (the operator, 2026-10-28), and no tool of this module can ask it yet, so it is the operator's ` +
+    `at the forge. Nothing was sent`;
 }