Put a verdict out of date when its trunk moves, and refuse a merge on one

A merge check's verdict now names the trunk commit it judged (novox/hq ADR
0323, issue 341), but the forge kept it green after another merge moved the
trunk, the merge tool merged on it, and mesh-delivery kept the delivery ready.
The forge's holder puts both statuses of every open pull request into a moved
trunk back to pending with the reason and runs nothing; the merge tool compares
the verdict's trunk commit with the trunk's head, asks the check once and never
merges by itself; mesh-delivery sends a ready delivery back to proposed, counts
only a verdict for the trunk's head, and composes a group again for a rebased
member instead of holding it.

modules/gitea/pulls.ts

@@ -59,6 +59,12 @@ export interface Checked {
   plan?: ChangePlan;
   /** Set on a delivery group's composed check (novox/hq ADR 0239): not this head's merge gate. */
   group?: string;
+  /** The trunk commit the head was merged into and judged as, twelve characters (novox/hq ADR 0323 §3); absent from a
+   *  controller whose build seat judged the head alone. Beside are the other repositories' commits the check read,
+   *  by directory; took how long it ran. */
+  trunk?: string;
+  beside?: Record<string, string>;
+  took?: string;
 }
 
 /** A change plan, as the controller says it (mesh-controller internal/link, ChangePlan). */
@@ -199,17 +205,25 @@ export function statusFor(c: Checked): CommitStatus {
   const description = builds(c.plan)
     ? described(gate.verdict, `${c.plan!.summary}; ${gate.summary}`)
     : described(gate.verdict, gate.summary, gate.modules, gate.dependents);
-  return { state: stateOf(gate.verdict), context: CHECK_CONTEXT, description };
+  return judgedFirst(c, { state: stateOf(gate.verdict), context: CHECK_CONTEXT, description });
 }
 
 /** Every status a verdict sets: the gate's, and the repository's own check's when it was said. */
 export function statusesFor(c: Checked, facts: RepoCheckFacts = {}): CommitStatus[] {
   const out = [statusFor(c)];
   const repo = c["repo-check"];
-  if (repo) out.push(repoStatus(repo, facts));
+  if (repo) out.push(judgedFirst(c, repoStatus(repo, facts)));
   return out;
 }
 
+/** **A status names what its verdict judged, first** (novox/hq ADR 0323 §3): "head 1a2b3c4d5e6f merged into trunk
+ *  7a8b9c0d1e2f — pass: …", so the forge's 140 characters never clip it away; the trunk's move is weighed by it. A
+ *  verdict that names no trunk commit is said as before. */
+function judgedFirst(c: Checked, status: CommitStatus): CommitStatus {
+  if (!c.trunk) return status;
+  return { ...status, description: clipped(`head ${c.commit.slice(0, 12)} merged into trunk ${c.trunk.slice(0, 12)} — ${status.description}`) };
+}
+
 /** The comment a verdict leaves on its pull request, with the check's own account: the change plan of a
  *  change that builds something (novox/hq ADR 0238), and why, when the gate is not a pass or the
  *  repository's own check failed or could not run. A repository with no merge-check.sh, touching nothing,
@@ -220,6 +234,12 @@ export function commentFor(c: Checked, facts: RepoCheckFacts = {}): string | nul
   const wrong = repoWrong(repo, facts);
   if (gate.verdict === "pass" && !wrong && !builds(c.plan)) return null;
   const lines = [`**Merge check** at \`${c.commit.slice(0, 8)}\``, ""];
+  if (c.trunk) {
+    // What was judged (novox/hq ADR 0323 §3): the head merged into the trunk commit, and what was read beside it.
+    const beside = Object.entries(c.beside ?? {}).map(([d, sha]) => `${d} \`${sha}\``).join(", ");
+    lines.splice(1, 0, `Judged: head \`${c.commit.slice(0, 12)}\` merged into trunk \`${c.trunk.slice(0, 12)}\`` +
+      (beside ? `; read beside it: ${beside}` : ""));
+  }
   lines.push(`- \`${CHECK_CONTEXT}\`: **${saidAs(gate.verdict).toUpperCase()}** — ${gate.summary}` +
     (gate.modules?.length ? ` (modules: ${gate.modules.join(", ")}` +
       (gate.dependents?.length ? `; built after them: ${gate.dependents.join(", ")}` : "") + ")" : ""));