Put a verdict out of date when its trunk moves, and refuse a merge on one

A merge check's verdict now names the trunk commit it judged (novox/hq ADR
0323, issue 341), but the forge kept it green after another merge moved the
trunk, the merge tool merged on it, and mesh-delivery kept the delivery ready.
The forge's holder puts both statuses of every open pull request into a moved
trunk back to pending with the reason and runs nothing; the merge tool compares
the verdict's trunk commit with the trunk's head, asks the check once and never
merges by itself; mesh-delivery sends a ready delivery back to proposed, counts
only a verdict for the trunk's head, and composes a group again for a rebased
member instead of holding it.

modules/gitea/client.ts

@@ -341,6 +341,33 @@ export class GiteaClient {
     return out;
   }
 
+  /** **Every open pull request of a repository**, page by page (novox/hq ADR 0323 §4): what a trunk's move puts out of
+   *  date, however many are open — not the twenty most recently updated a pass announces from. Bounded at 20 pages
+   *  of 50; a repository with more is said, and the rest are left to the merge tool's own comparison. */
+  async listOpenPulls(owner: string, repo: string): Promise<GiteaPull[]> {
+    const out: GiteaPull[] = [];
+    for (let page = 1; page <= 20; page++) {
+      const batch = await this.listPullRequests(owner, repo, { state: "open", limit: "50", page: String(page) });
+      out.push(...batch);
+      if (batch.length < 50) return out;
+    }
+    console.error(`[gitea] ${owner}/${repo} has more than 1000 open pull requests; only the first 1000 are read`);
+    return out;
+  }
+
+  /** The commit a branch is at now: a trunk's head (novox/hq ADR 0323). */
+  async branchHead(owner: string, repo: string, branch: string): Promise<string> {
+    const b = await this.request<any>(`${repoPath(owner, repo)}/branches/${pathSegments("branch", branch)}`);
+    const sha = String(b?.commit?.id ?? "");
+    if (!/^[0-9a-f]{40,64}$/i.test(sha)) throw new Error(`the forge named no commit for ${owner}/${repo}'s ${branch}`);
+    return sha;
+  }
+
+  /** One repository, as the forge holds it: its clone URL above all, for an announcement. */
+  async getRepo(owner: string, repo: string): Promise<GiteaRepo> {
+    return GiteaClient.mapRepo(await this.request<any>(repoPath(owner, repo)));
+  }
+
   async getPullRequest(owner: string, repo: string, index: number): Promise<GiteaPull> {
     indexOf(index);
     return GiteaClient.mapPull(await this.request<any>(`${repoPath(owner, repo)}/pulls/${index}`));

modules/gitea/gate.ts

@@ -18,7 +18,7 @@
 // restart, when the check was opened is read from the forge's own history of the gate.
 
 import { CHECK_CONTEXT, pendingWords } from "./pulls.js";
-import type { CommitStatus } from "./client.js";
+import type { CommitStatus, HeadCheck } from "./client.js";
 
 /** The build seat's `started`, as mesh-controller's link.BuildStart publishes it. */
 export interface BuildStarted {
@@ -37,6 +37,8 @@ export interface GateForge {
   gateOf(owner: string, repo: string, sha: string): Promise<{ state: string; updated_at?: string } | undefined>;
   /** The head's mesh/merge-gate statuses, every one the forge keeps, newest first (novox/hq issue 456). */
   gateHistory(owner: string, repo: string, sha: string): Promise<GateStatus[]>;
+  /** The head's statuses by context, the newest of each, with their words (novox/hq ADR 0323). */
+  headChecks(owner: string, repo: string, sha: string): Promise<Record<string, HeadCheck>>;
 }
 
 /** One status of a head's gate as the forge keeps it: its state, its words, and when it was set. */
@@ -174,6 +176,26 @@ export class GateWriter {
     });
   }
 
+  /**
+   * **A trunk's move puts the head's verdict out of date** (novox/hq ADR 0323 §4): its merge check statuses are put back
+   * to pending, with the reason, in their turn after every write of the head already asked for — a verdict in flight
+   * lands first. What is written is decided in the turn, from the statuses the forge holds then (`decide`, trunk.ts's
+   * outOfDateStatuses): a check on its way, or a verdict already judged against the trunk's head, is left as it is. It
+   * opens no check — nothing is asked — so a verdict of a check asked before it keeps its weight. Answers what it wrote;
+   * a write that fails fails the caller, and the move is weighed again on the next pass.
+   */
+  outOfDate(owner: string, repo: string, sha: string, decide: (checks: Record<string, HeadCheck>) => CommitStatus[],
+    target?: string): Promise<CommitStatus[]> {
+    const h = this.head(owner, repo, sha);
+    const written: CommitStatus[] = [];
+    return this.turn(h, async () => {
+      for (const s of decide(await this.forge.headChecks(owner, repo, sha))) {
+        await this.forge.setCommitStatus(owner, repo, sha, target ? { ...s, target_url: target } : s);
+        written.push(s);
+      }
+    }).then(() => written);
+  }
+
   /**
    * A build machine took an ask of this head: said while no verdict was heard, and only for the check now pending —
    * a start from before the pending words were set (a run before a recheck, the stream's history) is not this check's.

modules/gitea/index.ts

@@ -17,6 +17,11 @@
 // Consumes node-build-agent.started — a build machine took an ask — and says, on the head a pending check is of,
 // which machine builds it since when (novox/hq issue 446). This module is the one writer of mesh/merge-gate.
 //
+// **A trunk's move puts every open verdict into it out of date** (novox/hq ADR 0323 §4, trunk.ts): each pass reads the
+// head of every trunk an open pull request merges into, and when one moved, the merge check statuses of every open pull
+// request into it go back to pending with the reason. Nothing is run for it. A verdict that lands judged against a trunk
+// commit that is no longer the trunk's head is said out of date in place of its pass or failure.
+//
 // Serves gitea_commit_status from this bundle, not the tools', so a recheck's pending reaches that one writer
 // (novox/hq issue 456).
 //
@@ -38,6 +43,7 @@ import { GiteaClient, movedSince } from "./client.js";
 import { CHECK_CONTEXT, REPO_CHECK_CONTEXT, commentFor, headsToAnnounce, statusesFor, type Announced, type Checked,
   type RepoCheckFacts, reposToLook } from "./pulls.js";
 import { GateWriter, clonedAs, type BuildStarted } from "./gate.js";
+import { announcementOf, keepTook, outOfDateWords, sameCommit, tookFile, weighTrunks } from "./trunk.js";
 
 // Without a way to a token — configured, or mintable with the admin account (token.ts) — there is
 // nothing to watch; log and stay quiet rather than crash the runtime. With one, the first poll mints
@@ -250,37 +256,8 @@ async function pollPulls(client: GiteaClient): Promise<void> {
       const key = `${repo.full_name}#${pull.number}`;
       const fresh = primedPulls || (!!pull.updated_at && pull.updated_at > dayAgo);
       if (fresh) {
-        const files = await client.listPullFiles(repo.owner, repo.name, pull.number);
-        const head = String(pull.head_sha);
-        // What the controller maps the change onto the mesh's module graph with (novox/hq ADR 0237 as
-        // amended): which changed directories hold a module at the head — the merge's rule (issue 278) —
-        // and whether the head holds the repository's own merge-check.sh. Not said when it could not be
-        // read; the controller then reads the change as touching everything built from the repository.
-        let moduleDirs: string[] | null = null;
-        let mergeCheck: boolean | null = null;
-        try {
-          if (!files.truncated) moduleDirs = await client.moduleDirsAt(repo.owner, repo.name, head, files.paths);
-          mergeCheck = await client.holdsFile(repo.owner, repo.name, head, "merge-check.sh");
-        } catch (err) {
-          console.error(`[gitea] ${key}: what the head holds could not be read — ${err instanceof Error ? err.message : err}`);
-        }
-        await emit("pull.updated", {
-          owner: repo.owner,
-          repo: repo.name,
-          number: pull.number,
-          title: pull.title,
-          body: pull.body,
-          base: pull.base,
-          head: pull.head,
-          head_sha: pull.head_sha,
-          clone_url: repo.clone_url,
-          html_url: pull.html_url,
-          paths: files.paths,
-          paths_truncated: files.truncated,
-          removed: files.removed,
-          ...(moduleDirs ? { module_dirs: moduleDirs, module_dirs_said: true } : {}),
-          ...(mergeCheck !== null ? { merge_check: mergeCheck, merge_check_said: true } : {}),
-        });
+        // The announcement the merge tool makes too when it asks a check (trunk.ts, novox/hq ADR 0323 §5).
+        await emit("pull.updated", await announcementOf(client, repo.owner, repo.name, repo.clone_url, pull));
         // Said, so an operator knows the mesh was asked to check it.
         console.log(`[gitea] announced ${key} at ${String(pull.head_sha).slice(0, 8)} to be checked before it merges`);
         // Pending until the verdict comes, so the pull request says a check is running rather than nothing — and
@@ -290,17 +267,52 @@ async function pollPulls(client: GiteaClient): Promise<void> {
       heads[key] = String(pull.head_sha);
       changed = true;
     }
+    if (await trunksMoved(client, repo.owner, repo.name)) changedTrunks = true;
   }
   if (!primedPulls || changed) keepHeads();
+  if (changedTrunks) keepTrunks();
+  changedTrunks = false;
   primedPulls = true;
   lastPullLook = began;
 }
 
+// **The trunks' heads, as this module last read them** (novox/hq ADR 0323 §4), by `owner/repo:branch`: kept beside the
+// other records, so a move made while this module was away is weighed on its first pass back. With no record — the
+// first pass after this rolls out — a trunk's head is taken as it is and nothing is put out of date: the verdicts
+// then standing are weighed on the trunk's next move, and the merge tool compares commits whatever this holds.
+const trunksRecord = process.env.MESH_GITEA_STATE_DIR ? join(process.env.MESH_GITEA_STATE_DIR, "trunks-seen.json") : null;
+let trunks: Record<string, string> = {};
+let changedTrunks = false;
+if (trunksRecord && existsSync(trunksRecord)) {
+  try {
+    trunks = (JSON.parse(readFileSync(trunksRecord, "utf8")) as { trunks: Record<string, string> }).trunks ?? {};
+  } catch {
+    // An unreadable record is no record: the next pass takes each trunk's head as it is.
+  }
+}
+function keepTrunks(): void {
+  if (!trunksRecord) return;
+  mkdirSync(join(trunksRecord, ".."), { recursive: true });
+  const tmp = trunksRecord + ".tmp";
+  writeFileSync(tmp, JSON.stringify({ trunks }));
+  renameSync(tmp, trunksRecord);
+}
+
+/** Whether a trunk of one repository moved, weighed with this module's forge and its one writer (trunk.ts). */
+function trunksMoved(client: GiteaClient, owner: string, name: string): Promise<boolean> {
+  return weighTrunks(client, gates, trunks, owner, name);
+}
+
 // **The verdict, set where the pull request shows it.** Every verdict is the head commit's status; one
 // that is not a pass also leaves the check's own account as a comment, so the reason is read where the
 // change is reviewed. An error — the check could not run — is the forge's `error`, never a success.
 async function setVerdict(client: GiteaClient, event: { body: unknown }): Promise<void> {
   const c = (event.body ?? {}) as Checked;
+  if (!c.group && c.owner && c.repo && c.took) {
+    // How long it took, for the merge tool to say how long the next one may (novox/hq ADR 0323 §5).
+    keepTook(tookFile(process.env.MESH_GITEA_STATE_DIR), `${c.owner}/${c.repo}`,
+      { took: c.took, at: new Date().toISOString(), head: c.commit });
+  }
   if (c.group) {
     // A delivery group's composed check (novox/hq ADR 0239): its verdict is the group owner's to say, on each
     // member's head, as mesh/delivery-group — never this head's merge gate.
@@ -318,6 +330,23 @@ async function setVerdict(client: GiteaClient, event: { body: unknown }): Promis
     target = pull?.html_url || undefined;
     base = pull?.base || undefined;
   }
+  // **A verdict judged against a trunk commit that is no longer the trunk's head is out of date when it lands**
+  // (novox/hq ADR 0323 §4): a check asked before the trunk moved. It is said so, pending with the reason, in place of
+  // its pass or failure; a trunk that cannot be read lets the verdict stand, and the merge tool compares the commits.
+  const trunk = base ?? c.plan?.base;
+  if (c.trunk && trunk) {
+    const head = await client.branchHead(c.owner, c.repo, trunk).catch(() => undefined);
+    if (head && !sameCommit(c.trunk, head)) {
+      const description = outOfDateWords(c.trunk, head);
+      for (const context of [CHECK_CONTEXT, ...(c["repo-check"] ? [REPO_CHECK_CONTEXT] : [])]) {
+        await client.setCommitStatus(c.owner, c.repo, c.commit, { state: "pending", context, description,
+          ...(target ? { target_url: target } : {}) });
+      }
+      console.log(`[gitea] ${c.owner}/${c.repo}#${c.number ?? "?"} at ${c.commit.slice(0, 8)}: merge check ${c.verdict}, ` +
+        `${description}`);
+      return;
+    }
+  }
   const facts = await repoCheckFacts(client, c, base ?? c.plan?.base);
   for (const status of statusesFor(c, facts)) {
     await client.setCommitStatus(c.owner, c.repo, c.commit, target ? { ...status, target_url: target } : status);
@@ -350,6 +379,7 @@ const gates = new GateWriter({
   setCommitStatus: (owner, repo, sha, status) => (gitea as GiteaClient).setCommitStatus(owner, repo, sha, status),
   gateOf: async (owner, repo, sha) => (await (gitea as GiteaClient).headChecks(owner, repo, sha))[CHECK_CONTEXT],
   gateHistory: (owner, repo, sha) => (gitea as GiteaClient).contextHistory(owner, repo, sha, CHECK_CONTEXT),
+  headChecks: (owner, repo, sha) => (gitea as GiteaClient).headChecks(owner, repo, sha),
 });
 
 // **The status tool is served here, beside the writer** (novox/hq issue 456): the runtime starts each bundle as its own

modules/gitea/pulls.ts

@@ -59,6 +59,12 @@ export interface Checked {
   plan?: ChangePlan;
   /** Set on a delivery group's composed check (novox/hq ADR 0239): not this head's merge gate. */
   group?: string;
+  /** The trunk commit the head was merged into and judged as, twelve characters (novox/hq ADR 0323 §3); absent from a
+   *  controller whose build seat judged the head alone. Beside are the other repositories' commits the check read,
+   *  by directory; took how long it ran. */
+  trunk?: string;
+  beside?: Record<string, string>;
+  took?: string;
 }
 
 /** A change plan, as the controller says it (mesh-controller internal/link, ChangePlan). */
@@ -199,17 +205,25 @@ export function statusFor(c: Checked): CommitStatus {
   const description = builds(c.plan)
     ? described(gate.verdict, `${c.plan!.summary}; ${gate.summary}`)
     : described(gate.verdict, gate.summary, gate.modules, gate.dependents);
-  return { state: stateOf(gate.verdict), context: CHECK_CONTEXT, description };
+  return judgedFirst(c, { state: stateOf(gate.verdict), context: CHECK_CONTEXT, description });
 }
 
 /** Every status a verdict sets: the gate's, and the repository's own check's when it was said. */
 export function statusesFor(c: Checked, facts: RepoCheckFacts = {}): CommitStatus[] {
   const out = [statusFor(c)];
   const repo = c["repo-check"];
-  if (repo) out.push(repoStatus(repo, facts));
+  if (repo) out.push(judgedFirst(c, repoStatus(repo, facts)));
   return out;
 }
 
+/** **A status names what its verdict judged, first** (novox/hq ADR 0323 §3): "head 1a2b3c4d5e6f merged into trunk
+ *  7a8b9c0d1e2f — pass: …", so the forge's 140 characters never clip it away; the trunk's move is weighed by it. A
+ *  verdict that names no trunk commit is said as before. */
+function judgedFirst(c: Checked, status: CommitStatus): CommitStatus {
+  if (!c.trunk) return status;
+  return { ...status, description: clipped(`head ${c.commit.slice(0, 12)} merged into trunk ${c.trunk.slice(0, 12)} — ${status.description}`) };
+}
+
 /** The comment a verdict leaves on its pull request, with the check's own account: the change plan of a
  *  change that builds something (novox/hq ADR 0238), and why, when the gate is not a pass or the
  *  repository's own check failed or could not run. A repository with no merge-check.sh, touching nothing,
@@ -220,6 +234,12 @@ export function commentFor(c: Checked, facts: RepoCheckFacts = {}): string | nul
   const wrong = repoWrong(repo, facts);
   if (gate.verdict === "pass" && !wrong && !builds(c.plan)) return null;
   const lines = [`**Merge check** at \`${c.commit.slice(0, 8)}\``, ""];
+  if (c.trunk) {
+    // What was judged (novox/hq ADR 0323 §3): the head merged into the trunk commit, and what was read beside it.
+    const beside = Object.entries(c.beside ?? {}).map(([d, sha]) => `${d} \`${sha}\``).join(", ");
+    lines.splice(1, 0, `Judged: head \`${c.commit.slice(0, 12)}\` merged into trunk \`${c.trunk.slice(0, 12)}\`` +
+      (beside ? `; read beside it: ${beside}` : ""));
+  }
   lines.push(`- \`${CHECK_CONTEXT}\`: **${saidAs(gate.verdict).toUpperCase()}** — ${gate.summary}` +
     (gate.modules?.length ? ` (modules: ${gate.modules.join(", ")}` +
       (gate.dependents?.length ? `; built after them: ${gate.dependents.join(", ")}` : "") + ")" : ""));

modules/gitea/test/guard.test.ts

@@ -7,7 +7,9 @@
 import { test, after, beforeEach } from "node:test";
 import assert from "node:assert/strict";
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
-import { readFileSync } from "node:fs";
+import { mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 
 import { GiteaClient } from "../dist/client.js";
 import { ConfiguredToken } from "../dist/token.js";
@@ -21,7 +23,11 @@ interface Sent { method: string; path: string; body: any }
 const state = {
   sent: [] as Sent[],
   asked: [] as string[],
-  statuses: [] as { context: string; state: string }[],
+  statuses: [] as { context: string; state: string; description?: string; updated_at?: string }[],
+  // The trunk's head (novox/hq ADR 0323): what the merge tool compares the verdict's trunk commit with.
+  trunk: "",
+  // What the tools said on the bus.
+  emitted: [] as { type: string; body: any }[],
   rules: [] as any[],
   lastCommit: "2026-01-01T00:00:00Z",
   // The pull request's head; the head the merge commit joined (the same, unless a test says otherwise) — the forge's
@@ -36,13 +42,21 @@ const state = {
   commitsFail: 0,
 };
 const REVIEWED = "abc1234def5678901234567890abcdef12345678";
+const TRUNK = "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b";
+const MOVED = "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d";
+// A verdict judged against a trunk commit, as both statuses say it (novox/hq ADR 0323 §3).
+const judgedAt = (trunk: string, state = "success") => [
+  { context: "mesh/merge-gate", state, description: `head ${REVIEWED.slice(0, 12)} merged into trunk ${trunk.slice(0, 12)} — pass: x` },
+  { context: "mesh/repo-check", state, description: `head ${REVIEWED.slice(0, 12)} merged into trunk ${trunk.slice(0, 12)} — pass: y` }];
 const protectedMain = () => ({ rule_name: "main", enable_push: false, enable_status_check: true,
   status_check_contexts: ["mesh/merge-gate", "mesh/repo-check"], block_admin_merge_override: true });
 
 beforeEach(() => {
   state.sent = [];
   state.asked = [];
-  state.statuses = [{ context: "mesh/merge-gate", state: "success" }, { context: "mesh/repo-check", state: "success" }];
+  state.statuses = judgedAt(TRUNK);
+  state.trunk = TRUNK;
+  state.emitted = [];
   state.rules = [protectedMain()];
   state.head = REVIEWED;
   state.landed = "";
@@ -73,6 +87,15 @@ const server = createServer(async (req, res) => {
   const repo = "/repos/novox/mesh-catalog";
   if (method === "GET" && path === repo) return json(res, 200, { full_name: "novox/mesh-catalog", default_branch: "main" });
   if (method === "GET" && path === `${repo}/branch_protections`) return json(res, 200, state.rules);
+  if (method === "GET" && path === `${repo}/branches/main`) return json(res, 200, { name: "main", commit: { id: state.trunk } });
+  if (method === "GET" && path === `${repo}/pulls/7/files`) {
+    return json(res, 200, url.searchParams.get("page") === "1" ? [{ filename: "modules/gitea/x.ts", status: "modified" }] : []);
+  }
+  if (method === "POST" && path === `${repo}/statuses/${state.head}`) {
+    // Kept as the forge keeps them: the newest of a context first.
+    state.statuses = [{ ...body, updated_at: new Date().toISOString() }, ...state.statuses.filter((s) => s.context !== body.context)];
+    return json(res, 201, body);
+  }
   if (method === "GET" && path === "/user") return json(res, 200, { login: "mesh-admin" });
   if (method === "GET" && path === "/repos/mesh-admin/scratch/branch_protections") return json(res, 200, []);
   if (method === "GET" && /^\/repos\/[^/]+\/[^/]+\/commits$/.test(path)) {
@@ -102,7 +125,9 @@ after(() => new Promise<void>((r) => server.close(() => r())));
 const { port } = server.address() as { port: number };
 const client = new GiteaClient(`http://127.0.0.1:${port}`, new ConfiguredToken("t"));
 // gitea_commit_status is served from the watcher's bundle, beside the merge check's one writer (novox/hq issue 456).
-const tools = [...getGiteaTools(client), commitStatusTool({
+const stateDir = mkdtempSync(join(tmpdir(), "gitea-tools-"));
+const tools = [...getGiteaTools(client, { stateDir, emit: async (type, body) => { state.emitted.push({ type, body }); },
+  now: () => new Date(2026, 9, 12, 15, 1) }), commitStatusTool({
   setCommitStatus: (o, r, sha, s) => client.setCommitStatus(o, r, sha, s),
   gates: new GateWriter({ setCommitStatus: (o, r, sha, s) => client.setCommitStatus(o, r, sha, s),
     gateOf: async () => undefined, gateHistory: async () => [] }),
@@ -189,15 +214,15 @@ test("gitea_branch_protection_set only strengthens", async () => {
 test("gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head", async () => {
   const merge = () => tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7,
     head: REVIEWED });
-  state.statuses = [{ context: "mesh/merge-gate", state: "success" }, { context: "mesh/repo-check", state: "failure" }];
+  state.statuses = [judgedAt(TRUNK)[0], judgedAt(TRUNK, "failure")[1]];
   await assert.rejects(merge(), /not merged: .*mesh\/repo-check \(failure\)/);
-  state.statuses = [{ context: "mesh/merge-gate", state: "success" }];
+  state.statuses = [judgedAt(TRUNK)[0]];
   await assert.rejects(merge(), /mesh\/repo-check \(missing\)/);
   await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7,
     head: REVIEWED, method: "manually-merged" }), /not a merge method/);
   assert.deepEqual(writes(), []);
   // The operator said yes and the checks passed: the flow that stays.
-  state.statuses = [{ context: "mesh/merge-gate", state: "success" }, { context: "mesh/repo-check", state: "success" }];
+  state.statuses = judgedAt(TRUNK);
   await merge();
   const sent = state.sent.find((s) => s.path.endsWith("/pulls/7/merge"))!;
   assert.equal(sent.body.force_merge, false);
@@ -205,6 +230,72 @@ test("gitea_merge_pull_request merges only a head whose required statuses all su
 });
 
 
+// **The merge tool refuses a verdict whose trunk commit is not the trunk's head, and asks the check itself** (novox/hq
+// ADR 0323 §5, issue 341): node-engine #66 merged at 00:54 on a verdict of 00:49 that judged its head alone, after #65
+// had moved the trunk. Both commits are named; one check is asked, the announcement a new head makes, and not a second
+// while it is on its way; the refusal says how long the last check of the repository took; and once the verdict judges
+// the trunk's head and passes, the merge goes through — asked again, never by itself.
+test("gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once", async () => {
+  const merge = () => tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED });
+  const { keepTook, tookFile } = await import("../dist/trunk.js");
+  keepTook(tookFile(stateDir), "novox/mesh-catalog", { took: "4m31s", at: "2026-10-12T14:49:00Z" });
+
+  state.trunk = MOVED; // another merge moved the trunk after the verdict
+  await assert.rejects(merge(), (err: Error) => {
+    assert.match(err.message, /is not merged: its verdict was judged against trunk 7a8b9c0d1e2f, and main is now 3c4d5e6f7a8b/);
+    assert.match(err.message, /check of head abc1234def56 merged into trunk 3c4d5e6f7a8b was asked/);
+    assert.match(err.message, /the last check of novox\/mesh-catalog took 4m31s/);
+    assert.match(err.message, /never merges by itself/);
+    return true;
+  });
+  assert.equal(state.merged, false);
+  assert.equal(state.emitted.length, 1, "one check asked");
+  assert.equal(state.emitted[0].type, "pull.updated");
+  assert.equal(state.emitted[0].body.head_sha, REVIEWED);
+  assert.equal(state.emitted[0].body.base, "main");
+  assert.deepEqual(state.emitted[0].body.paths, ["modules/gitea/x.ts"]);
+  const gate = state.statuses.find((s) => s.context === "mesh/merge-gate")!;
+  assert.equal(gate.state, "pending");
+  assert.match(gate.description!, /^waiting in the build queue since 15:01: asked by the merge tool against trunk 3c4d5e6f7a8b/);
+  assert.equal(state.statuses.find((s) => s.context === "mesh/repo-check")!.state, "pending");
+
+  // Asked again while that check is on its way: refused, and nothing is asked a second time.
+  await assert.rejects(merge(), /already asked and not yet answered .*not asked again; the last check of novox\/mesh-catalog took 4m31s/);
+  assert.equal(state.emitted.length, 1, "no second check while one is on its way");
+  state.statuses = [{ ...gate, description: "building on ace since 15:02" }, ...state.statuses.slice(1)];
+  await assert.rejects(merge(), /not asked again/);
+  assert.equal(state.emitted.length, 1);
+
+  // A verdict put out of date by the trunk's move is asked too, once.
+  state.statuses = judgedAt(TRUNK).map((s) => ({ ...s, state: "pending",
+    description: "out of date: judged against trunk 7a8b9c0d1e2f, the trunk is now 3c4d5e6f7a8b; judged again on a recheck or when it is merged" }));
+  await assert.rejects(merge(), /was judged against trunk 7a8b9c0d1e2f, and main is now 3c4d5e6f7a8b\. The check .* was asked/);
+  assert.equal(state.emitted.length, 2);
+
+  // A verdict that names no trunk commit — a build seat from before the rule — is not taken as the trunk's head.
+  state.statuses = [{ context: "mesh/merge-gate", state: "success", description: "pass: x" },
+    { context: "mesh/repo-check", state: "success", description: "pass: y" }];
+  await assert.rejects(merge(), /names no trunk commit it was judged against, and main is now 3c4d5e6f7a8b/);
+  assert.equal(state.emitted.length, 3);
+  assert.equal(state.merged, false);
+
+  // An ask that cannot be announced puts the statuses back to out of date, so the next ask asks again.
+  state.statuses = judgedAt(TRUNK);
+  const failing = getGiteaTools(client, { stateDir, emit: async () => { throw new Error("the bus is away"); } })
+    .find((t) => t.name === "gitea_merge_pull_request")!;
+  await assert.rejects(failing.run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED }),
+    /its check could not be asked: the bus is away\. Nothing was merged/);
+  assert.match(state.statuses.find((s) => s.context === "mesh/merge-gate")!.description!, /^out of date: /);
+  await assert.rejects(merge(), /was asked/);
+  assert.equal(state.emitted.length, 4, "asked again after the announcement failed");
+
+  // The check judged the merge into the trunk's head and passed: asked again at the reviewed head, it merges.
+  state.statuses = judgedAt(MOVED);
+  const done = (await merge()) as Record<string, unknown>;
+  assert.equal(done.merged, true);
+  assert.equal(state.emitted.length, 4, "a merge asks no check");
+});
+
 // A merge lands only the head that was reviewed (novox/hq issue 381): mesh-controller#197 was reviewed at one head,
 // force-pushed, checked green at the new one, and merged there, because the tool merged whatever the head was.
 test("gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head", async () => {

modules/gitea/test/trunk.test.ts

@@ -0,0 +1,153 @@
+// **A merge check's verdict holds for the trunk commit it judged** (novox/hq ADR 0323, issue 341): both statuses name
+// the head and the trunk commit; a trunk's move puts the merge check of every open pull request into that trunk — and
+// of none into another — back to pending with the reason, and runs nothing; a verdict that lands judged against a trunk
+// that has moved since is said out of date.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import { checkOnItsWay, outOfDateStatuses, outOfDateWords, trunkNamed, verdictAtTrunk, weighTrunks } from "../dist/trunk.js";
+import { GateWriter } from "../dist/gate.js";
+import { statusesFor, commentFor } from "../dist/pulls.js";
+
+const HEAD = "dfb1415aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+const TRUNK = "a2c2c35bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+const MOVED = "d28ca95ccccccccccccccccccccccccccccccccc";
+
+test("both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length", () => {
+  const c = { owner: "novox", repo: "mesh-host", number: 66, commit: HEAD, verdict: "pass", summary: "x", id: "build-1",
+    trunk: TRUNK.slice(0, 12), beside: { "mesh-catalog": "0123456789ab", "mesh-lab": "ba9876543210" },
+    gate: { verdict: "pass", summary: "4 of 4 compose ".repeat(20) },
+    "repo-check": { verdict: "fail", summary: "its merge-check.sh failed: internal/store/store.go:145:2: Declared redeclared" } };
+  const [gate, repo] = statusesFor(c);
+  for (const s of [gate, repo]) {
+    assert.ok(s.description.startsWith("head dfb1415aaaaa merged into trunk a2c2c35bbbbb — "), s.description);
+    assert.ok(s.description.length <= 140, `${s.description.length} characters`);
+    assert.equal(trunkNamed(s.description), "a2c2c35bbbbb");
+  }
+  assert.equal(gate.state, "success");
+  assert.equal(repo.state, "failure");
+  const comment = commentFor(c)!;
+  assert.match(comment, /Judged: head `dfb1415aaaaa` merged into trunk `a2c2c35bbbbb`; read beside it: mesh-catalog `0123456789ab`, mesh-lab `ba9876543210`/);
+
+  // A verdict of a build seat from before the rule names no trunk, and is said as before.
+  const [old] = statusesFor({ ...c, trunk: undefined, gate: { verdict: "pass", summary: "every machine composes" } });
+  assert.equal(old.description, "pass: every machine composes");
+  assert.equal(trunkNamed(old.description), undefined);
+});
+
+test("a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way", () => {
+  const verdict = (trunk: string, state = "success") => ({
+    "mesh/merge-gate": { state, description: `head ${HEAD.slice(0, 12)} merged into trunk ${trunk.slice(0, 12)} — pass: x` },
+    "mesh/repo-check": { state, description: `head ${HEAD.slice(0, 12)} merged into trunk ${trunk.slice(0, 12)} — pass: y` } });
+  const put = outOfDateStatuses(verdict(TRUNK), MOVED);
+  assert.deepEqual(put.map((s) => [s.context, s.state]), [["mesh/merge-gate", "pending"], ["mesh/repo-check", "pending"]]);
+  assert.equal(put[0].description, "out of date: judged against trunk a2c2c35bbbbb, the trunk is now d28ca95ccccc; " +
+    "judged again on a recheck or when it is merged");
+  assert.equal(put[0].description, outOfDateWords(TRUNK, MOVED));
+  assert.equal(trunkNamed(put[0].description), "a2c2c35bbbbb", "an out-of-date status still names what it judged");
+  // A failure is out of date too: it judged another merge.
+  assert.equal(outOfDateStatuses(verdict(TRUNK, "failure"), MOVED).length, 2);
+  // Already judged against the trunk's head; a check on its way or already out of date; no check yet: left alone.
+  assert.deepEqual(outOfDateStatuses(verdict(MOVED), MOVED), []);
+  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": { state: "pending", description: "building on ace since 14:02" } }, MOVED), []);
+  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": { state: "pending", description: put[0].description } }, MOVED), []);
+  assert.deepEqual(outOfDateStatuses({}, MOVED), []);
+  // A head with no repository check of its own gets no pending one a verdict would never set.
+  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": verdict(TRUNK)["mesh/merge-gate"] }, MOVED).map((s) => s.context),
+    ["mesh/merge-gate"]);
+  // A verdict naming no trunk, of a build seat from before the rule, judged an earlier trunk.
+  assert.match(outOfDateStatuses({ "mesh/merge-gate": { state: "success", description: "pass: x" } }, MOVED)[0].description,
+    /judged against a trunk it does not name, the trunk is now d28ca95ccccc/);
+
+  assert.ok(checkOnItsWay({ state: "pending", description: "waiting in the build queue since 14:00" }));
+  assert.ok(checkOnItsWay({ state: "pending", description: "checking again: a person asked" }));
+  assert.ok(!checkOnItsWay({ state: "pending", description: put[0].description }));
+  assert.deepEqual(verdictAtTrunk(verdict(MOVED), MOVED), { current: true, onItsWay: false, judged: "d28ca95ccccc" });
+  assert.equal(verdictAtTrunk(verdict(TRUNK), MOVED).current, false);
+});
+
+/** A forge holding open pull requests into two branches, each head's statuses, and what was written. */
+function aForge(pulls: { number: number; base: string; head: string }[], heads: Record<string, string>) {
+  const statuses = new Map<string, Record<string, { state: string; description?: string }>>();
+  const writes: string[] = [];
+  const verdict = (trunk: string) => ({
+    "mesh/merge-gate": { state: "success", description: `head x merged into trunk ${trunk.slice(0, 12)} — pass` },
+    "mesh/repo-check": { state: "success", description: `head x merged into trunk ${trunk.slice(0, 12)} — pass` } });
+  for (const p of pulls) statuses.set(p.head, verdict(heads[p.base]));
+  const forge = {
+    listOpenPulls: async () => pulls.map((p) => ({ number: p.number, title: "t", state: "open", merged: false, base: p.base,
+      head: "feat", head_sha: p.head, html_url: `http://forge/pulls/${p.number}` })),
+    branchHead: async (_o: string, _r: string, branch: string) => heads[branch],
+    setCommitStatus: async (_o: string, _r: string, sha: string, s: { context: string; state: string; description: string }) => {
+      writes.push(`${sha} ${s.context} ${s.state}`);
+      statuses.set(sha, { ...statuses.get(sha), [s.context]: { state: s.state, description: s.description } });
+    },
+    gateOf: async () => undefined,
+    gateHistory: async () => [],
+    headChecks: async (_o: string, _r: string, sha: string) => statuses.get(sha) ?? {},
+  };
+  return { forge, writes, statuses };
+}
+
+test("a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another", async () => {
+  const heads: Record<string, string> = { main: TRUNK, release: "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee" };
+  const pulls = Array.from({ length: 25 }, (_, i) => ({ number: i + 1, base: "main", head: `${String(i).padStart(2, "0")}`.repeat(20) }));
+  pulls.push({ number: 99, base: "release", head: "9".repeat(40) });
+  const { forge, writes, statuses } = aForge(pulls, heads);
+  const gates = new GateWriter(forge);
+  const trunks: Record<string, string> = {};
+
+  // First sight: each trunk is taken as it is, and nothing is put out of date.
+  assert.equal(await weighTrunks(forge, gates, trunks, "novox", "mesh-host"), true);
+  assert.deepEqual(writes, []);
+  assert.equal(trunks["novox/mesh-host:main"], TRUNK);
+  // Nothing moved: nothing read past the trunks, nothing written.
+  assert.equal(await weighTrunks(forge, gates, trunks, "novox", "mesh-host"), false);
+
+  heads.main = MOVED;
+  assert.equal(await weighTrunks(forge, gates, trunks, "novox", "mesh-host"), true);
+  assert.equal(writes.length, 50, "both statuses of each of the 25 pull requests into main");
+  for (const p of pulls.filter((p) => p.base === "main")) {
+    const s = statuses.get(p.head)!;
+    assert.equal(s["mesh/merge-gate"].state, "pending");
+    assert.match(s["mesh/merge-gate"].description!, /judged against trunk a2c2c35bbbbb, the trunk is now d28ca95ccccc/);
+    assert.equal(s["mesh/repo-check"].state, "pending");
+  }
+  assert.equal(statuses.get("9".repeat(40))!["mesh/merge-gate"].state, "success", "a pull request into another branch is left");
+  assert.equal(trunks["novox/mesh-host:main"], MOVED);
+
+  // Weighed again, nothing more: the move was taken once, and the out-of-date statuses are left as they are.
+  writes.length = 0;
+  heads.main = "f".repeat(40);
+  await weighTrunks(forge, gates, trunks, "novox", "mesh-host");
+  assert.deepEqual(writes, [], "a check already out of date is not written again");
+});
+
+test("a trunk that cannot be read is weighed again on the next pass, never recorded half", async () => {
+  const heads: Record<string, string> = { main: TRUNK };
+  const { forge } = aForge([{ number: 1, base: "main", head: "1".repeat(40) }], heads);
+  const trunks: Record<string, string> = { "novox/mesh-host:main": TRUNK };
+  heads.main = MOVED;
+  const failing = { ...forge, setCommitStatus: async () => { throw new Error("the forge is away"); } };
+  assert.equal(await weighTrunks(failing, new GateWriter(failing), trunks, "novox", "mesh-host"), false);
+  assert.equal(trunks["novox/mesh-host:main"], TRUNK, "not recorded: the next pass weighs it again");
+});
+
+test("the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then", async () => {
+  const heads: Record<string, string> = { main: TRUNK };
+  const { forge, statuses } = aForge([{ number: 1, base: "main", head: HEAD }], heads);
+  const gates = new GateWriter(forge);
+  // A verdict judged against the trunk's new head, in flight when the move is weighed: it lands first, and is left.
+  let release!: () => void;
+  const held = new Promise<void>((r) => (release = r));
+  const verdictLanded = gates.verdict("novox", "mesh-host", HEAD, async () => {
+    await held;
+    statuses.set(HEAD, { "mesh/merge-gate": { state: "success", description: `head x merged into trunk ${MOVED.slice(0, 12)} — pass` } });
+  });
+  const moved = gates.outOfDate("novox", "mesh-host", HEAD, (checks) => outOfDateStatuses(checks, MOVED));
+  release();
+  await verdictLanded;
+  assert.deepEqual(await moved, [], "a verdict judged against the trunk's head is not put out of date");
+  assert.equal(statuses.get(HEAD)!["mesh/merge-gate"].state, "success");
+});

modules/gitea/tools/index.ts

@@ -13,6 +13,8 @@ import { emit } from "@novox/mesh-sdk/events";
 import { GiteaClient, type BranchProtection } from "../client.js";
 import { appendNote, run, viewBody, viewComment } from "../delivery.js";
 import { containedFrom, isCommit, mergeableUnder, newestByContext } from "../checks.js";
+import { CHECK_CONTEXT, REPO_CHECK_CONTEXT } from "../pulls.js";
+import { announcementOf, askedWords, outOfDateWords, tookFile, tookWords, twelve, verdictAtTrunk } from "../trunk.js";
 import {
   MERGE_METHODS, Refused, checkName, judgeApiCall, judgeContentsWrite, judgeDelete, judgeProtectionChange, pathSegments, routedPath, sentQuery,
   ruleCovers,
@@ -59,11 +61,19 @@ function namesChecked(tools: ToolDefinition[]): ToolDefinition[] {
   }));
 }
 
-export function getGiteaTools(gitea: GiteaClient): ToolDefinition[] {
-  return namesChecked(allGiteaTools(gitea));
+/** What the tools reach beside the forge: how an event is said, the module's state directory, and the clock. */
+export interface ToolDeps {
+  emit?: (type: string, body: unknown) => Promise<void>;
+  stateDir?: string;
+  now?: () => Date;
 }
 
-function allGiteaTools(gitea: GiteaClient): ToolDefinition[] {
+export function getGiteaTools(gitea: GiteaClient, deps: ToolDeps = {}): ToolDefinition[] {
+  return namesChecked(allGiteaTools(gitea, { emit: deps.emit ?? emit, stateDir: deps.stateDir ?? process.env.MESH_GITEA_STATE_DIR,
+    now: deps.now ?? (() => new Date()) }));
+}
+
+function allGiteaTools(gitea: GiteaClient, deps: Required<Pick<ToolDeps, "emit" | "now">> & ToolDeps): ToolDefinition[] {
   return [
     // ---- Repositories ----
     {
@@ -267,8 +277,11 @@ function allGiteaTools(gitea: GiteaClient): ToolDefinition[] {
       name: "gitea_merge_pull_request",
       description: "Merge a pull request at the head you name — the commit you reviewed — when that is still its head " +
         "and every status its base branch's protection requires succeeded there (mesh/merge-gate, mesh/repo-check), " +
-        "optionally deleting the source branch afterwards. Refused otherwise, with nothing merged: no tool merges past " +
-        "a check, and none merges a head that moved after it was reviewed.",
+        "judged against the trunk's head as it is now, optionally deleting the source branch afterwards. Refused " +
+        "otherwise, with nothing merged: no tool merges past a check, and none merges a head that moved after it was " +
+        "reviewed. A verdict judged against an earlier trunk commit is refused, naming both, and the head's check against " +
+        "the trunk's head is asked once, with how long the last check of the repository took: ask again at the same head " +
+        "once it passes — the tool never merges by itself.",
       input: {
         owner: { type: "string", description: "the repository owner" },
         repo: { type: "string", description: "the repository name" },
@@ -319,6 +332,47 @@ function allGiteaTools(gitea: GiteaClient): ToolDefinition[] {
           throw new Refused(`${owner}/${repo}#${number} merges into ${pull.base}, which no protection rule requiring ` +
             `the checks guards: a tool merges only into such a branch (novox/hq ADR 0266). Nothing was merged`);
         }
+        // **The verdict must be judged against the trunk's head** (novox/hq ADR 0323 §5, issue 341): a check judges the
+        // head merged into a named trunk commit, and a merge of another trunk is not the one that check judged. Compared
+        // here at the moment the merge is asked, not left to the statuses the trunk's move resets a pass later. When they
+        // differ nothing is merged, and the head's check against the trunk's head is asked once — the announcement a new
+        // head makes — never again while one is on its way. The caller asks again at the reviewed head once it passes.
+        const trunkHead = await gitea.branchHead(owner, repo, pull.base);
+        const checks = await gitea.headChecks(owner, repo, pull.head_sha);
+        const at = verdictAtTrunk(checks, trunkHead);
+        if (!at.current) {
+          const judged = at.judged ? `was judged against trunk ${twelve(at.judged)}` : "names no trunk commit it was judged against";
+          const took = tookWords(tookFile(deps.stateDir), `${owner}/${repo}`);
+          const head = twelve(pull.head_sha), now = twelve(trunkHead);
+          if (at.onItsWay) {
+            throw new Refused(`${owner}/${repo}#${number} is not merged: its verdict ${judged}, and ${pull.base} is now ` +
+              `${now}. Its check is already asked and not yet answered (${checks[CHECK_CONTEXT]?.description}), so it is not ` +
+              `asked again; ${took}. Ask again at ${head} once both statuses pass: this tool never merges by itself ` +
+              `(novox/hq ADR 0323). Nothing was merged`);
+          }
+          // Pending first, so a second ask finds the check on its way; then the head is announced as a new head is. An
+          // announcement that cannot be made puts the statuses back to out of date, so the next ask asks again rather
+          // than wait for ever on a check nobody asked.
+          const contexts = [CHECK_CONTEXT, ...(checks[REPO_CHECK_CONTEXT] ? [REPO_CHECK_CONTEXT] : [])];
+          const say = async (description: string) => {
+            for (const context of contexts) {
+              await gitea.setCommitStatus(owner, repo, pull.head_sha, { state: "pending", context, description,
+                ...(pull.html_url ? { target_url: pull.html_url } : {}) });
+            }
+          };
+          await say(askedWords(deps.now(), trunkHead));
+          try {
+            const cloneURL = (await gitea.getRepo(owner, repo)).clone_url;
+            await deps.emit("pull.updated", await announcementOf(gitea, owner, repo, cloneURL, pull));
+          } catch (err) {
+            await say(outOfDateWords(at.judged, trunkHead)).catch(() => {});
+            throw new Error(`${owner}/${repo}#${number} is not merged: its verdict ${judged}, and ${pull.base} is now ` +
+              `${now}, and its check could not be asked: ${err instanceof Error ? err.message : err}. Nothing was merged`);
+          }
+          throw new Refused(`${owner}/${repo}#${number} is not merged: its verdict ${judged}, and ${pull.base} is now ` +
+            `${now}. The check of head ${head} merged into trunk ${now} was asked; ${took}. Ask again at ${head} once both ` +
+            `statuses pass: this tool never merges by itself (novox/hq ADR 0323). Nothing was merged`);
+        }
         const statuses = newestByContext((await gitea.combinedStatus(owner, repo, pull.head_sha)).statuses);
         const verdict = mergeableUnder(pull.base, rule, statuses);
         if (verdict.mergeable !== true) {
@@ -714,7 +768,7 @@ function allGiteaTools(gitea: GiteaClient): ToolDefinition[] {
 // way, gitea contributes none rather than failing the whole runtime, and says why.
 registerModuleTools("gitea", (env) => {
   try {
-    return getGiteaTools(GiteaClient.fromEnv(env));
+    return getGiteaTools(GiteaClient.fromEnv(env), { stateDir: env.MESH_GITEA_STATE_DIR });
   } catch (err) {
     console.log(`[gitea] no tools — ${err instanceof Error ? err.message : String(err)}`);
     return [];

modules/gitea/trunk.ts

@@ -0,0 +1,236 @@
+// **A merge check's verdict holds for the trunk commit it judged** (novox/hq ADR 0323, issue 341).
+//
+// The build seat checks a pull request's head merged into its trunk's head at that moment — the verdict's trunk
+// commit — and the verdict names both: "head 1a2b3c4d5e6f merged into trunk 7a8b9c0d1e2f", in both statuses'
+// descriptions. When the trunk moves, every open pull request's verdict into it is out of date:
+//
+//   - **the forge's holder** (index.ts) hears the move on its own — it reads each trunk's head on every pass that
+//     looks at the repository, never through mesh-delivery (ADR 0239 §36) — and sets mesh/merge-gate and
+//     mesh/repo-check on the head of every open pull request into that trunk back to pending, with the reason.
+//     Nothing is run for it: a recheck, a new head, or the merge tool asks the check again;
+//   - **the merge tool** (tools/index.ts) compares the trunk commit the head's verdict names with the trunk's head at
+//     the moment it is asked, merges nothing when they differ, asks the head's check once — the same announcement a
+//     new head makes — and says how long the last check of that repository took. It never merges by itself after.
+//
+// Pure functions and two small files of the module's own state, so this is tested without a forge.
+
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import type { CommitStatus, GiteaClient, GiteaPull, HeadCheck } from "./client.js";
+import { CHECK_CONTEXT, REPO_CHECK_CONTEXT } from "./pulls.js";
+
+/** A commit as a verdict names it: its first twelve characters. */
+export function twelve(sha: string | undefined): string {
+  return String(sha ?? "").slice(0, 12).toLowerCase();
+}
+
+/** Whether two commits are one, however either is abbreviated (seven characters at least). */
+export function sameCommit(a: string | undefined, b: string | undefined): boolean {
+  const x = String(a ?? "").toLowerCase(), y = String(b ?? "").toLowerCase();
+  if (x.length < 7 || y.length < 7) return false;
+  return x.length <= y.length ? y.startsWith(x) : x.startsWith(y);
+}
+
+/** What a verdict judged, as both statuses' descriptions begin (ADR 0323 §3). */
+export function judgedWords(head: string, trunk: string): string {
+  return `head ${twelve(head)} merged into trunk ${twelve(trunk)}`;
+}
+
+/** The trunk commit a merge check's status names: the one its verdict judged ("merged into trunk …"), or, for a
+ *  verdict put out of date, the one it had judged ("judged against trunk …"). Undefined when it names none, as a
+ *  verdict of a build seat from before ADR 0323 does. */
+export function trunkNamed(description: string | undefined): string | undefined {
+  const m = /(?:merged into|judged against) trunk ([0-9a-f]{7,64})\b/i.exec(description ?? "");
+  return m ? m[1].toLowerCase() : undefined;
+}
+
+/** A verdict out of date, as its statuses say it (ADR 0323 §4). */
+export function outOfDateWords(judged: string | undefined, now: string): string {
+  const was = judged ? `judged against trunk ${twelve(judged)}` : "judged against a trunk it does not name";
+  return `out of date: ${was}, the trunk is now ${twelve(now)}; judged again on a recheck or when it is merged`;
+}
+
+/** Whether a pending gate says a check of the head is asked and not yet answered: waiting in the build queue,
+ *  building on a machine (gate.ts), or asked again by a recheck (mesh-delivery). Such a check is not asked again. */
+export function checkOnItsWay(gate: HeadCheck | undefined): boolean {
+  if (!gate || gate.state !== "pending") return false;
+  const d = gate.description ?? "";
+  return d.startsWith("waiting in the build queue") || d.startsWith("building on ") || d.startsWith("checking again");
+}
+
+/**
+ * The statuses a trunk's move puts back to pending on one open pull request's head, from what the forge holds on it
+ * now: none when it has no merge check yet, when a check is pending (on its way, or already out of date — its
+ * verdict is weighed against the trunk when it lands), or when its verdict judged the trunk's head. Otherwise the
+ * gate, and the repository's own check when the head has one — a pending repo-check a verdict will not set would
+ * stand for ever (novox/hq issue 305's rule).
+ */
+export function outOfDateStatuses(checks: Record<string, HeadCheck>, trunkHead: string): CommitStatus[] {
+  const gate = checks[CHECK_CONTEXT];
+  if (!gate || gate.state === "pending") return [];
+  const judged = trunkNamed(gate.description);
+  if (judged && sameCommit(judged, trunkHead)) return [];
+  const description = outOfDateWords(judged, trunkHead);
+  const out: CommitStatus[] = [{ state: "pending", context: CHECK_CONTEXT, description }];
+  if (checks[REPO_CHECK_CONTEXT]) out.push({ state: "pending", context: REPO_CHECK_CONTEXT, description });
+  return out;
+}
+
+/** Where the merge tool stands with a head's verdict and the trunk's head (ADR 0323 §5). */
+export interface VerdictAtTrunk {
+  /** The verdict judged the trunk's head: the required statuses decide, as before. */
+  current: boolean;
+  /** A check of the head is asked and not yet answered: nothing is asked again. */
+  onItsWay: boolean;
+  /** The trunk commit the verdict names, when it names one. */
+  judged?: string;
+}
+
+export function verdictAtTrunk(checks: Record<string, HeadCheck>, trunkHead: string): VerdictAtTrunk {
+  const gate = checks[CHECK_CONTEXT];
+  const judged = trunkNamed(gate?.description);
+  if (checkOnItsWay(gate)) return { current: false, onItsWay: true, judged };
+  return { current: !!gate && gate.state !== "pending" && !!judged && sameCommit(judged, trunkHead), onItsWay: false, judged };
+}
+
+/** The pending words the merge tool's ask of a check is said with: in the build queue from now, as an announced head's. */
+export function askedWords(at: Date, trunkHead: string): string {
+  const two = (n: number) => String(n).padStart(2, "0");
+  return `waiting in the build queue since ${two(at.getHours())}:${two(at.getMinutes())}: asked by the merge tool ` +
+    `against trunk ${twelve(trunkHead)}`;
+}
+
+// --- a trunk's move, weighed --------------------------------------------------------------------------------------
+
+/** What weighing a trunk's move reads of the forge. */
+export interface TrunkForge {
+  listOpenPulls(owner: string, repo: string): Promise<GiteaPull[]>;
+  branchHead(owner: string, repo: string, branch: string): Promise<string>;
+}
+
+/** What it writes with: the merge check's one writer (gate.ts), which decides in the head's own turn. */
+export interface OutOfDateWriter {
+  outOfDate(owner: string, repo: string, sha: string, decide: (checks: Record<string, HeadCheck>) => CommitStatus[],
+    target?: string): Promise<CommitStatus[]>;
+}
+
+/**
+ * Every trunk of one repository that an open pull request merges into, read; for one that moved since it was last read
+ * (`trunks`, by `owner/repo:branch`, which this keeps current), the merge check of every open pull request into it put
+ * out of date (ADR 0323 §4). A trunk first seen is recorded as it is and nothing is put out of date. Bounded however
+ * many are open: one listing of the open pull requests (paged), one read of each trunk, then per open pull request into
+ * a trunk that moved one read and at most two writes, one at a time. A trunk that could not be weighed whole is not
+ * recorded, so the next pass weighs it again. Answers whether the record changed.
+ */
+export async function weighTrunks(forge: TrunkForge, gates: OutOfDateWriter, trunks: Record<string, string>, owner: string,
+  name: string): Promise<boolean> {
+  let changed = false;
+  try {
+    const open = (await forge.listOpenPulls(owner, name)).filter((p) => p.state === "open" && !!p.head_sha && !!p.base);
+    for (const base of new Set(open.map((p) => String(p.base)))) {
+      const key = `${owner}/${name}:${base}`.toLowerCase();
+      const head = await forge.branchHead(owner, name, base);
+      const before = trunks[key];
+      if (before && sameCommit(before, head)) continue;
+      if (before) {
+        let put = 0;
+        for (const pull of open.filter((p) => p.base === base)) {
+          const written = await gates.outOfDate(owner, name, String(pull.head_sha), (checks) => outOfDateStatuses(checks, head),
+            pull.html_url || undefined);
+          if (written.length) put++;
+        }
+        console.log(`[gitea] ${owner}/${name}'s ${base} moved from ${twelve(before)} to ${twelve(head)}: ${put} open pull ` +
+          `request(s) into it put out of date, nothing run (novox/hq ADR 0323)`);
+      }
+      trunks[key] = head;
+      changed = true;
+    }
+  } catch (err) {
+    console.error(`[gitea] ${owner}/${name}: whether a trunk moved could not be weighed, so it is weighed again on the next ` +
+      `pass — ${err instanceof Error ? err.message : err}`);
+  }
+  return changed;
+}
+
+// --- how long the last check of a repository took -------------------------------------------------------------
+
+/** How long one repository's last check took, and when it was heard: kept by the watcher, read by the merge tool. */
+export interface Took {
+  took: string;
+  at: string;
+  head?: string;
+}
+
+/** The file the watcher keeps each repository's last check's duration in, beside its other records. */
+export function tookFile(stateDir: string | undefined): string | null {
+  return stateDir ? `${stateDir.replace(/\/+$/, "")}/checks-took.json` : null;
+}
+
+function readTookAll(file: string | null): Record<string, Took> {
+  if (!file || !existsSync(file)) return {};
+  try {
+    return JSON.parse(readFileSync(file, "utf8")) as Record<string, Took>;
+  } catch {
+    return {};
+  }
+}
+
+/** Keep how long a repository's check took. A record that cannot be written is said, never fatal to the verdict. */
+export function keepTook(file: string | null, repository: string, took: Took): void {
+  if (!file || !took.took) return;
+  try {
+    const all = readTookAll(file);
+    all[repository.toLowerCase()] = took;
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file + ".tmp", JSON.stringify(all));
+    renameSync(file + ".tmp", file);
+  } catch (err) {
+    console.error(`[gitea] how long ${repository}'s check took could not be kept — ${err instanceof Error ? err.message : err}`);
+  }
+}
+
+/** How long a repository's last check took, in words for the merge tool's refusal. */
+export function tookWords(file: string | null, repository: string): string {
+  const t = readTookAll(file)[repository.toLowerCase()];
+  if (!t) return `how long a check of ${repository} takes is not known yet: no verdict of it was heard since this was kept`;
+  return `the last check of ${repository} took ${t.took} (heard ${t.at})`;
+}
+
+// --- the announcement of a head, shared by the watcher and the merge tool ---------------------------------------
+
+/** `pull.updated` for one open pull request's head: what the controller asks the build seat to check (novox/hq to-be
+ *  45 §9). The merge tool's ask is this same announcement (ADR 0323 §5). */
+export async function announcementOf(client: GiteaClient, owner: string, name: string, cloneURL: string | undefined,
+  pull: GiteaPull): Promise<Record<string, unknown>> {
+  const files = await client.listPullFiles(owner, name, pull.number);
+  const head = String(pull.head_sha);
+  // What the controller maps the change onto the mesh's module graph with (novox/hq ADR 0237 as amended): which
+  // changed directories hold a module at the head — the merge's rule (issue 278) — and whether the head holds the
+  // repository's own merge-check.sh. Not said when it could not be read; the controller then reads the change as
+  // touching everything built from the repository.
+  let moduleDirs: string[] | null = null;
+  let mergeCheck: boolean | null = null;
+  try {
+    if (!files.truncated) moduleDirs = await client.moduleDirsAt(owner, name, head, files.paths);
+    mergeCheck = await client.holdsFile(owner, name, head, "merge-check.sh");
+  } catch (err) {
+    console.error(`[gitea] ${owner}/${name}#${pull.number}: what the head holds could not be read — ${err instanceof Error ? err.message : err}`);
+  }
+  return {
+    owner,
+    repo: name,
+    number: pull.number,
+    title: pull.title,
+    body: pull.body,
+    base: pull.base,
+    head: pull.head,
+    head_sha: pull.head_sha,
+    clone_url: cloneURL,
+    html_url: pull.html_url,
+    paths: files.paths,
+    paths_truncated: files.truncated,
+    removed: files.removed,
+    ...(moduleDirs ? { module_dirs: moduleDirs, module_dirs_said: true } : {}),
+    ...(mergeCheck !== null ? { merge_check: mergeCheck, merge_check_said: true } : {}),
+  };
+}