Route a recheck's pending through the gitea module's one writer of mesh/merge-gate

The recheck's pending was written from the tools' bundle, its own process, past the
writer's per-head chain: the first run's verdict mark stayed set, so a rechecked head
never said where its new run builds, and an old run's verdict in flight or redelivered
could land over the pending. The status tool is now served from the watcher's bundle
and writes the merge check's pending through the writer, and a verdict whose ask
(checked.id) predates the check now pending is dropped, weighed after a restart against
the forge's own history of the gate (novox/hq issue 456).

modules/gitea/gate.ts

@@ -8,6 +8,14 @@
 // between its read and its write. So this module is the one writer of mesh/merge-gate, and every write of one head's
 // gate goes through one chain: a verdict is marked the moment it is heard, before it waits its turn, and a "building"
 // still waiting behind or taking its turn after that mark is dropped, never written.
+//
+// **A recheck's pending is written here too** (novox/hq issue 456). mesh-delivery's recheck puts the gate back to
+// pending through the gitea_commit_status tool, which this module serves from the watcher's own bundle so that it
+// reaches this writer: the pending clears the verdict mark, so the new run's "building" is said, and queues behind an
+// old verdict in flight, so that verdict lands first. A verdict is weighed by the ask it answers — the controller's
+// checked.id, `build-<unix nanoseconds>` of when the check was asked — against when the check now pending was opened:
+// an older run's verdict, redelivered after its write failed, is dropped, never written over the pending. After a
+// restart, when the check was opened is read from the forge's own history of the gate.
 
 import { CHECK_CONTEXT, pendingWords } from "./pulls.js";
 import type { CommitStatus } from "./client.js";
@@ -27,15 +35,53 @@ export interface GateForge {
   setCommitStatus(owner: string, repo: string, sha: string, status: CommitStatus): Promise<void>;
   /** The head's mesh/merge-gate, newest: its state and when it was set; undefined when it has none. */
   gateOf(owner: string, repo: string, sha: string): Promise<{ state: string; updated_at?: string } | undefined>;
+  /** The head's mesh/merge-gate statuses, every one the forge keeps, newest first (novox/hq issue 456). */
+  gateHistory(owner: string, repo: string, sha: string): Promise<GateStatus[]>;
+}
+
+/** One status of a head's gate as the forge keeps it: its state, its words, and when it was set. */
+export interface GateStatus {
+  state: string;
+  description?: string;
+  updated_at?: string;
+}
+
+/**
+ * When a check was asked, from its id as mesh-controller's link.NewBuildID writes it: `build-<unix nanoseconds>`.
+ * Undefined for an id of any other shape, whose ask time is not known (novox/hq issue 456).
+ */
+export function askedAt(id: string | undefined): number | undefined {
+  const m = /^build-(\d{1,20})$/.exec(String(id ?? ""));
+  if (!m) return undefined;
+  const ms = Number(BigInt(m[1]) / 1_000_000n);
+  return ms > 0 ? ms : undefined;
+}
+
+/**
+ * When the check now pending on a head was opened, from the gate's history, newest first: the newest status, past the
+ * "building" words this writer says only inside an open check, when it is pending; undefined when the gate holds a
+ * verdict, holds nothing, or its time cannot be read (novox/hq issue 456).
+ */
+export function openedAt(history: GateStatus[]): number | undefined {
+  for (const s of history) {
+    if (s.state !== "pending") return undefined;
+    if ((s.description ?? "").startsWith(BUILDING)) continue;
+    const t = Date.parse(s.updated_at ?? "");
+    return Number.isNaN(t) ? undefined : t;
+  }
+  return undefined;
 }
 
 /** How far a build machine's clock may stand behind this one's when a start is weighed against the pending words. */
 const CLOCK_SLACK_MS = 60_000;
 
+/** How the words of a check a machine is running begin. */
+const BUILDING = "building on ";
+
 /** The words of a check a machine is running, in the time the operator reads. */
 export function buildingWords(on: string, at: Date): string {
   const two = (n: number) => String(n).padStart(2, "0");
-  return `building on ${on} since ${two(at.getHours())}:${two(at.getMinutes())}`;
+  return `${BUILDING}${on} since ${two(at.getHours())}:${two(at.getMinutes())}`;
 }
 
 /** Whether a repository as the mesh clones it (`http://forge/novox/hq.git`) is owner/repo. */
@@ -50,6 +96,8 @@ interface Head {
   pendingAt?: number;
   /** A verdict was heard for the head: nothing pending is written after it. */
   verdict: boolean;
+  /** Which verdict set the mark: one dropped in its turn takes the mark back only while it is still its own. */
+  mark?: object;
   /** The chain the head's writes take their turns on. */
   chain: Promise<void>;
 }
@@ -94,12 +142,38 @@ export class GateWriter {
   pending(owner: string, repo: string, sha: string): Promise<void> {
     const h = this.head(owner, repo, sha);
     const at = this.now();
-    h.pendingAt = at.getTime();
-    h.verdict = false;
+    this.opened(h, at);
     return this.said(h, `${owner}/${repo}@${sha.slice(0, 8)}: could not say a check is pending`, () =>
       this.forge.setCommitStatus(owner, repo, sha, { state: "pending", context: CHECK_CONTEXT, description: pendingWords(at) }));
   }
 
+  /** A new check of the head opened now: no verdict heard for it yet, and nothing older than it is its own. */
+  private opened(h: Head, at: Date): void {
+    h.pendingAt = at.getTime();
+    h.verdict = false;
+    h.mark = undefined;
+  }
+
+  /**
+   * A recheck's pending, asked through the gitea_commit_status tool (novox/hq issue 456): on mesh/merge-gate it opens
+   * a new check of the head — the verdict mark cleared, so the new run's "building" is said — and takes its turn
+   * after every write already asked for, an old verdict in flight included, so it lands over that verdict. Any
+   * other status of the merge check (mesh/repo-check, which the verdict also writes) takes its turn on the same
+   * chain. A write that fails fails the caller, and the head is as it was before it.
+   */
+  rechecked(owner: string, repo: string, sha: string, status: CommitStatus): Promise<void> {
+    const h = this.head(owner, repo, sha);
+    const write = () => this.forge.setCommitStatus(owner, repo, sha, status);
+    if (status.context !== CHECK_CONTEXT || status.state !== "pending") return this.turn(h, write);
+    const before = { pendingAt: h.pendingAt, verdict: h.verdict, mark: h.mark };
+    const at = this.now();
+    this.opened(h, at);
+    return this.turn(h, write).catch((err) => {
+      if (h.pendingAt === at.getTime() && !h.verdict) Object.assign(h, before);
+      throw err;
+    });
+  }
+
   /**
    * A build machine took an ask of this head: said while no verdict was heard, and only for the check now pending —
    * a start from before the pending words were set (a run before a recheck, the stream's history) is not this check's.
@@ -130,10 +204,46 @@ export class GateWriter {
   /**
    * The verdict: marked at once, so no pending word is written after it, then written in its turn — last. A write
    * that fails fails the caller, so the event is offered again.
+   *
+   * `id` is the ask it answers (checked.id): a verdict of a check asked before the check now pending was opened is
+   * an older run's — redelivered after its write failed, or heard late — and is dropped, never written over the
+   * pending (novox/hq issue 456). When this process opened no check of the head (it restarted since), the opening
+   * is read from the forge's history of the gate in the verdict's turn; a history that cannot be read writes the
+   * verdict, as one with no readable id is: a verdict is never lost to what cannot be weighed.
    */
-  verdict(owner: string, repo: string, sha: string, write: () => Promise<void>): Promise<void> {
+  verdict(owner: string, repo: string, sha: string, write: () => Promise<void>, id?: string): Promise<void> {
     const h = this.head(owner, repo, sha);
+    const asked = askedAt(id);
+    const head = `${owner}/${repo}@${sha.slice(0, 8)}`;
+    if (asked !== undefined && h.pendingAt !== undefined && older(asked, h.pendingAt)) {
+      console.log(`[gitea] ${head}: the verdict of ${id} is an older run's than the check now pending; not written`);
+      return Promise.resolve();
+    }
+    const before = h.verdict;
+    const mark = {};
     h.verdict = true;
-    return this.turn(h, write);
+    h.mark = mark;
+    return this.turn(h, async () => {
+      if (asked !== undefined && h.pendingAt === undefined) {
+        let opened: number | undefined;
+        try {
+          opened = openedAt(await this.forge.gateHistory(owner, repo, sha));
+        } catch (err) {
+          console.error(`[gitea] ${head}: the gate's history could not be read, so the verdict of ${id} is written ` +
+            `unweighed — ${err instanceof Error ? err.message : err}`);
+        }
+        if (opened !== undefined && older(asked, opened)) {
+          if (h.mark === mark) h.verdict = before;
+          console.log(`[gitea] ${head}: the verdict of ${id} is an older run's than the check the forge holds pending; not written`);
+          return;
+        }
+      }
+      await write();
+    });
   }
 }
+
+/** Whether a check asked at `asked` was asked before a check opened at `opened`, past what the clocks may differ by. */
+function older(asked: number, opened: number): boolean {
+  return asked < opened - CLOCK_SLACK_MS;
+}