Put a verdict out of date when its trunk moves, and refuse a merge on one

A merge check's verdict now names the trunk commit it judged (novox/hq ADR
0323, issue 341), but the forge kept it green after another merge moved the
trunk, the merge tool merged on it, and mesh-delivery kept the delivery ready.
The forge's holder puts both statuses of every open pull request into a moved
trunk back to pending with the reason and runs nothing; the merge tool compares
the verdict's trunk commit with the trunk's head, asks the check once and never
merges by itself; mesh-delivery sends a ready delivery back to proposed, counts
only a verdict for the trunk's head, and composes a group again for a rebased
member instead of holding it.

modules/gitea/test/guard.test.ts

@@ -7,7 +7,9 @@
 import { test, after, beforeEach } from "node:test";
 import assert from "node:assert/strict";
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
-import { readFileSync } from "node:fs";
+import { mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 
 import { GiteaClient } from "../dist/client.js";
 import { ConfiguredToken } from "../dist/token.js";
@@ -21,7 +23,11 @@ interface Sent { method: string; path: string; body: any }
 const state = {
   sent: [] as Sent[],
   asked: [] as string[],
-  statuses: [] as { context: string; state: string }[],
+  statuses: [] as { context: string; state: string; description?: string; updated_at?: string }[],
+  // The trunk's head (novox/hq ADR 0323): what the merge tool compares the verdict's trunk commit with.
+  trunk: "",
+  // What the tools said on the bus.
+  emitted: [] as { type: string; body: any }[],
   rules: [] as any[],
   lastCommit: "2026-01-01T00:00:00Z",
   // The pull request's head; the head the merge commit joined (the same, unless a test says otherwise) — the forge's
@@ -36,13 +42,21 @@ const state = {
   commitsFail: 0,
 };
 const REVIEWED = "abc1234def5678901234567890abcdef12345678";
+const TRUNK = "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b";
+const MOVED = "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d";
+// A verdict judged against a trunk commit, as both statuses say it (novox/hq ADR 0323 §3).
+const judgedAt = (trunk: string, state = "success") => [
+  { context: "mesh/merge-gate", state, description: `head ${REVIEWED.slice(0, 12)} merged into trunk ${trunk.slice(0, 12)} — pass: x` },
+  { context: "mesh/repo-check", state, description: `head ${REVIEWED.slice(0, 12)} merged into trunk ${trunk.slice(0, 12)} — pass: y` }];
 const protectedMain = () => ({ rule_name: "main", enable_push: false, enable_status_check: true,
   status_check_contexts: ["mesh/merge-gate", "mesh/repo-check"], block_admin_merge_override: true });
 
 beforeEach(() => {
   state.sent = [];
   state.asked = [];
-  state.statuses = [{ context: "mesh/merge-gate", state: "success" }, { context: "mesh/repo-check", state: "success" }];
+  state.statuses = judgedAt(TRUNK);
+  state.trunk = TRUNK;
+  state.emitted = [];
   state.rules = [protectedMain()];
   state.head = REVIEWED;
   state.landed = "";
@@ -73,6 +87,15 @@ const server = createServer(async (req, res) => {
   const repo = "/repos/novox/mesh-catalog";
   if (method === "GET" && path === repo) return json(res, 200, { full_name: "novox/mesh-catalog", default_branch: "main" });
   if (method === "GET" && path === `${repo}/branch_protections`) return json(res, 200, state.rules);
+  if (method === "GET" && path === `${repo}/branches/main`) return json(res, 200, { name: "main", commit: { id: state.trunk } });
+  if (method === "GET" && path === `${repo}/pulls/7/files`) {
+    return json(res, 200, url.searchParams.get("page") === "1" ? [{ filename: "modules/gitea/x.ts", status: "modified" }] : []);
+  }
+  if (method === "POST" && path === `${repo}/statuses/${state.head}`) {
+    // Kept as the forge keeps them: the newest of a context first.
+    state.statuses = [{ ...body, updated_at: new Date().toISOString() }, ...state.statuses.filter((s) => s.context !== body.context)];
+    return json(res, 201, body);
+  }
   if (method === "GET" && path === "/user") return json(res, 200, { login: "mesh-admin" });
   if (method === "GET" && path === "/repos/mesh-admin/scratch/branch_protections") return json(res, 200, []);
   if (method === "GET" && /^\/repos\/[^/]+\/[^/]+\/commits$/.test(path)) {
@@ -102,7 +125,9 @@ after(() => new Promise<void>((r) => server.close(() => r())));
 const { port } = server.address() as { port: number };
 const client = new GiteaClient(`http://127.0.0.1:${port}`, new ConfiguredToken("t"));
 // gitea_commit_status is served from the watcher's bundle, beside the merge check's one writer (novox/hq issue 456).
-const tools = [...getGiteaTools(client), commitStatusTool({
+const stateDir = mkdtempSync(join(tmpdir(), "gitea-tools-"));
+const tools = [...getGiteaTools(client, { stateDir, emit: async (type, body) => { state.emitted.push({ type, body }); },
+  now: () => new Date(2026, 9, 12, 15, 1) }), commitStatusTool({
   setCommitStatus: (o, r, sha, s) => client.setCommitStatus(o, r, sha, s),
   gates: new GateWriter({ setCommitStatus: (o, r, sha, s) => client.setCommitStatus(o, r, sha, s),
     gateOf: async () => undefined, gateHistory: async () => [] }),
@@ -189,15 +214,15 @@ test("gitea_branch_protection_set only strengthens", async () => {
 test("gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head", async () => {
   const merge = () => tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7,
     head: REVIEWED });
-  state.statuses = [{ context: "mesh/merge-gate", state: "success" }, { context: "mesh/repo-check", state: "failure" }];
+  state.statuses = [judgedAt(TRUNK)[0], judgedAt(TRUNK, "failure")[1]];
   await assert.rejects(merge(), /not merged: .*mesh\/repo-check \(failure\)/);
-  state.statuses = [{ context: "mesh/merge-gate", state: "success" }];
+  state.statuses = [judgedAt(TRUNK)[0]];
   await assert.rejects(merge(), /mesh\/repo-check \(missing\)/);
   await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7,
     head: REVIEWED, method: "manually-merged" }), /not a merge method/);
   assert.deepEqual(writes(), []);
   // The operator said yes and the checks passed: the flow that stays.
-  state.statuses = [{ context: "mesh/merge-gate", state: "success" }, { context: "mesh/repo-check", state: "success" }];
+  state.statuses = judgedAt(TRUNK);
   await merge();
   const sent = state.sent.find((s) => s.path.endsWith("/pulls/7/merge"))!;
   assert.equal(sent.body.force_merge, false);
@@ -205,6 +230,72 @@ test("gitea_merge_pull_request merges only a head whose required statuses all su
 });
 
 
+// **The merge tool refuses a verdict whose trunk commit is not the trunk's head, and asks the check itself** (novox/hq
+// ADR 0323 §5, issue 341): node-engine #66 merged at 00:54 on a verdict of 00:49 that judged its head alone, after #65
+// had moved the trunk. Both commits are named; one check is asked, the announcement a new head makes, and not a second
+// while it is on its way; the refusal says how long the last check of the repository took; and once the verdict judges
+// the trunk's head and passes, the merge goes through — asked again, never by itself.
+test("gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once", async () => {
+  const merge = () => tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED });
+  const { keepTook, tookFile } = await import("../dist/trunk.js");
+  keepTook(tookFile(stateDir), "novox/mesh-catalog", { took: "4m31s", at: "2026-10-12T14:49:00Z" });
+
+  state.trunk = MOVED; // another merge moved the trunk after the verdict
+  await assert.rejects(merge(), (err: Error) => {
+    assert.match(err.message, /is not merged: its verdict was judged against trunk 7a8b9c0d1e2f, and main is now 3c4d5e6f7a8b/);
+    assert.match(err.message, /check of head abc1234def56 merged into trunk 3c4d5e6f7a8b was asked/);
+    assert.match(err.message, /the last check of novox\/mesh-catalog took 4m31s/);
+    assert.match(err.message, /never merges by itself/);
+    return true;
+  });
+  assert.equal(state.merged, false);
+  assert.equal(state.emitted.length, 1, "one check asked");
+  assert.equal(state.emitted[0].type, "pull.updated");
+  assert.equal(state.emitted[0].body.head_sha, REVIEWED);
+  assert.equal(state.emitted[0].body.base, "main");
+  assert.deepEqual(state.emitted[0].body.paths, ["modules/gitea/x.ts"]);
+  const gate = state.statuses.find((s) => s.context === "mesh/merge-gate")!;
+  assert.equal(gate.state, "pending");
+  assert.match(gate.description!, /^waiting in the build queue since 15:01: asked by the merge tool against trunk 3c4d5e6f7a8b/);
+  assert.equal(state.statuses.find((s) => s.context === "mesh/repo-check")!.state, "pending");
+
+  // Asked again while that check is on its way: refused, and nothing is asked a second time.
+  await assert.rejects(merge(), /already asked and not yet answered .*not asked again; the last check of novox\/mesh-catalog took 4m31s/);
+  assert.equal(state.emitted.length, 1, "no second check while one is on its way");
+  state.statuses = [{ ...gate, description: "building on ace since 15:02" }, ...state.statuses.slice(1)];
+  await assert.rejects(merge(), /not asked again/);
+  assert.equal(state.emitted.length, 1);
+
+  // A verdict put out of date by the trunk's move is asked too, once.
+  state.statuses = judgedAt(TRUNK).map((s) => ({ ...s, state: "pending",
+    description: "out of date: judged against trunk 7a8b9c0d1e2f, the trunk is now 3c4d5e6f7a8b; judged again on a recheck or when it is merged" }));
+  await assert.rejects(merge(), /was judged against trunk 7a8b9c0d1e2f, and main is now 3c4d5e6f7a8b\. The check .* was asked/);
+  assert.equal(state.emitted.length, 2);
+
+  // A verdict that names no trunk commit — a build seat from before the rule — is not taken as the trunk's head.
+  state.statuses = [{ context: "mesh/merge-gate", state: "success", description: "pass: x" },
+    { context: "mesh/repo-check", state: "success", description: "pass: y" }];
+  await assert.rejects(merge(), /names no trunk commit it was judged against, and main is now 3c4d5e6f7a8b/);
+  assert.equal(state.emitted.length, 3);
+  assert.equal(state.merged, false);
+
+  // An ask that cannot be announced puts the statuses back to out of date, so the next ask asks again.
+  state.statuses = judgedAt(TRUNK);
+  const failing = getGiteaTools(client, { stateDir, emit: async () => { throw new Error("the bus is away"); } })
+    .find((t) => t.name === "gitea_merge_pull_request")!;
+  await assert.rejects(failing.run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED }),
+    /its check could not be asked: the bus is away\. Nothing was merged/);
+  assert.match(state.statuses.find((s) => s.context === "mesh/merge-gate")!.description!, /^out of date: /);
+  await assert.rejects(merge(), /was asked/);
+  assert.equal(state.emitted.length, 4, "asked again after the announcement failed");
+
+  // The check judged the merge into the trunk's head and passed: asked again at the reviewed head, it merges.
+  state.statuses = judgedAt(MOVED);
+  const done = (await merge()) as Record<string, unknown>;
+  assert.equal(done.merged, true);
+  assert.equal(state.emitted.length, 4, "a merge asks no check");
+});
+
 // A merge lands only the head that was reviewed (novox/hq issue 381): mesh-controller#197 was reviewed at one head,
 // force-pushed, checked green at the new one, and merged there, because the tool merged whatever the head was.
 test("gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head", async () => {

modules/gitea/test/trunk.test.ts

@@ -0,0 +1,153 @@
+// **A merge check's verdict holds for the trunk commit it judged** (novox/hq ADR 0323, issue 341): both statuses name
+// the head and the trunk commit; a trunk's move puts the merge check of every open pull request into that trunk — and
+// of none into another — back to pending with the reason, and runs nothing; a verdict that lands judged against a trunk
+// that has moved since is said out of date.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import { checkOnItsWay, outOfDateStatuses, outOfDateWords, trunkNamed, verdictAtTrunk, weighTrunks } from "../dist/trunk.js";
+import { GateWriter } from "../dist/gate.js";
+import { statusesFor, commentFor } from "../dist/pulls.js";
+
+const HEAD = "dfb1415aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+const TRUNK = "a2c2c35bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+const MOVED = "d28ca95ccccccccccccccccccccccccccccccccc";
+
+test("both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length", () => {
+  const c = { owner: "novox", repo: "mesh-host", number: 66, commit: HEAD, verdict: "pass", summary: "x", id: "build-1",
+    trunk: TRUNK.slice(0, 12), beside: { "mesh-catalog": "0123456789ab", "mesh-lab": "ba9876543210" },
+    gate: { verdict: "pass", summary: "4 of 4 compose ".repeat(20) },
+    "repo-check": { verdict: "fail", summary: "its merge-check.sh failed: internal/store/store.go:145:2: Declared redeclared" } };
+  const [gate, repo] = statusesFor(c);
+  for (const s of [gate, repo]) {
+    assert.ok(s.description.startsWith("head dfb1415aaaaa merged into trunk a2c2c35bbbbb — "), s.description);
+    assert.ok(s.description.length <= 140, `${s.description.length} characters`);
+    assert.equal(trunkNamed(s.description), "a2c2c35bbbbb");
+  }
+  assert.equal(gate.state, "success");
+  assert.equal(repo.state, "failure");
+  const comment = commentFor(c)!;
+  assert.match(comment, /Judged: head `dfb1415aaaaa` merged into trunk `a2c2c35bbbbb`; read beside it: mesh-catalog `0123456789ab`, mesh-lab `ba9876543210`/);
+
+  // A verdict of a build seat from before the rule names no trunk, and is said as before.
+  const [old] = statusesFor({ ...c, trunk: undefined, gate: { verdict: "pass", summary: "every machine composes" } });
+  assert.equal(old.description, "pass: every machine composes");
+  assert.equal(trunkNamed(old.description), undefined);
+});
+
+test("a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way", () => {
+  const verdict = (trunk: string, state = "success") => ({
+    "mesh/merge-gate": { state, description: `head ${HEAD.slice(0, 12)} merged into trunk ${trunk.slice(0, 12)} — pass: x` },
+    "mesh/repo-check": { state, description: `head ${HEAD.slice(0, 12)} merged into trunk ${trunk.slice(0, 12)} — pass: y` } });
+  const put = outOfDateStatuses(verdict(TRUNK), MOVED);
+  assert.deepEqual(put.map((s) => [s.context, s.state]), [["mesh/merge-gate", "pending"], ["mesh/repo-check", "pending"]]);
+  assert.equal(put[0].description, "out of date: judged against trunk a2c2c35bbbbb, the trunk is now d28ca95ccccc; " +
+    "judged again on a recheck or when it is merged");
+  assert.equal(put[0].description, outOfDateWords(TRUNK, MOVED));
+  assert.equal(trunkNamed(put[0].description), "a2c2c35bbbbb", "an out-of-date status still names what it judged");
+  // A failure is out of date too: it judged another merge.
+  assert.equal(outOfDateStatuses(verdict(TRUNK, "failure"), MOVED).length, 2);
+  // Already judged against the trunk's head; a check on its way or already out of date; no check yet: left alone.
+  assert.deepEqual(outOfDateStatuses(verdict(MOVED), MOVED), []);
+  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": { state: "pending", description: "building on ace since 14:02" } }, MOVED), []);
+  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": { state: "pending", description: put[0].description } }, MOVED), []);
+  assert.deepEqual(outOfDateStatuses({}, MOVED), []);
+  // A head with no repository check of its own gets no pending one a verdict would never set.
+  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": verdict(TRUNK)["mesh/merge-gate"] }, MOVED).map((s) => s.context),
+    ["mesh/merge-gate"]);
+  // A verdict naming no trunk, of a build seat from before the rule, judged an earlier trunk.
+  assert.match(outOfDateStatuses({ "mesh/merge-gate": { state: "success", description: "pass: x" } }, MOVED)[0].description,
+    /judged against a trunk it does not name, the trunk is now d28ca95ccccc/);
+
+  assert.ok(checkOnItsWay({ state: "pending", description: "waiting in the build queue since 14:00" }));
+  assert.ok(checkOnItsWay({ state: "pending", description: "checking again: a person asked" }));
+  assert.ok(!checkOnItsWay({ state: "pending", description: put[0].description }));
+  assert.deepEqual(verdictAtTrunk(verdict(MOVED), MOVED), { current: true, onItsWay: false, judged: "d28ca95ccccc" });
+  assert.equal(verdictAtTrunk(verdict(TRUNK), MOVED).current, false);
+});
+
+/** A forge holding open pull requests into two branches, each head's statuses, and what was written. */
+function aForge(pulls: { number: number; base: string; head: string }[], heads: Record<string, string>) {
+  const statuses = new Map<string, Record<string, { state: string; description?: string }>>();
+  const writes: string[] = [];
+  const verdict = (trunk: string) => ({
+    "mesh/merge-gate": { state: "success", description: `head x merged into trunk ${trunk.slice(0, 12)} — pass` },
+    "mesh/repo-check": { state: "success", description: `head x merged into trunk ${trunk.slice(0, 12)} — pass` } });
+  for (const p of pulls) statuses.set(p.head, verdict(heads[p.base]));
+  const forge = {
+    listOpenPulls: async () => pulls.map((p) => ({ number: p.number, title: "t", state: "open", merged: false, base: p.base,
+      head: "feat", head_sha: p.head, html_url: `http://forge/pulls/${p.number}` })),
+    branchHead: async (_o: string, _r: string, branch: string) => heads[branch],
+    setCommitStatus: async (_o: string, _r: string, sha: string, s: { context: string; state: string; description: string }) => {
+      writes.push(`${sha} ${s.context} ${s.state}`);
+      statuses.set(sha, { ...statuses.get(sha), [s.context]: { state: s.state, description: s.description } });
+    },
+    gateOf: async () => undefined,
+    gateHistory: async () => [],
+    headChecks: async (_o: string, _r: string, sha: string) => statuses.get(sha) ?? {},
+  };
+  return { forge, writes, statuses };
+}
+
+test("a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another", async () => {
+  const heads: Record<string, string> = { main: TRUNK, release: "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee" };
+  const pulls = Array.from({ length: 25 }, (_, i) => ({ number: i + 1, base: "main", head: `${String(i).padStart(2, "0")}`.repeat(20) }));
+  pulls.push({ number: 99, base: "release", head: "9".repeat(40) });
+  const { forge, writes, statuses } = aForge(pulls, heads);
+  const gates = new GateWriter(forge);
+  const trunks: Record<string, string> = {};
+
+  // First sight: each trunk is taken as it is, and nothing is put out of date.
+  assert.equal(await weighTrunks(forge, gates, trunks, "novox", "mesh-host"), true);
+  assert.deepEqual(writes, []);
+  assert.equal(trunks["novox/mesh-host:main"], TRUNK);
+  // Nothing moved: nothing read past the trunks, nothing written.
+  assert.equal(await weighTrunks(forge, gates, trunks, "novox", "mesh-host"), false);
+
+  heads.main = MOVED;
+  assert.equal(await weighTrunks(forge, gates, trunks, "novox", "mesh-host"), true);
+  assert.equal(writes.length, 50, "both statuses of each of the 25 pull requests into main");
+  for (const p of pulls.filter((p) => p.base === "main")) {
+    const s = statuses.get(p.head)!;
+    assert.equal(s["mesh/merge-gate"].state, "pending");
+    assert.match(s["mesh/merge-gate"].description!, /judged against trunk a2c2c35bbbbb, the trunk is now d28ca95ccccc/);
+    assert.equal(s["mesh/repo-check"].state, "pending");
+  }
+  assert.equal(statuses.get("9".repeat(40))!["mesh/merge-gate"].state, "success", "a pull request into another branch is left");
+  assert.equal(trunks["novox/mesh-host:main"], MOVED);
+
+  // Weighed again, nothing more: the move was taken once, and the out-of-date statuses are left as they are.
+  writes.length = 0;
+  heads.main = "f".repeat(40);
+  await weighTrunks(forge, gates, trunks, "novox", "mesh-host");
+  assert.deepEqual(writes, [], "a check already out of date is not written again");
+});
+
+test("a trunk that cannot be read is weighed again on the next pass, never recorded half", async () => {
+  const heads: Record<string, string> = { main: TRUNK };
+  const { forge } = aForge([{ number: 1, base: "main", head: "1".repeat(40) }], heads);
+  const trunks: Record<string, string> = { "novox/mesh-host:main": TRUNK };
+  heads.main = MOVED;
+  const failing = { ...forge, setCommitStatus: async () => { throw new Error("the forge is away"); } };
+  assert.equal(await weighTrunks(failing, new GateWriter(failing), trunks, "novox", "mesh-host"), false);
+  assert.equal(trunks["novox/mesh-host:main"], TRUNK, "not recorded: the next pass weighs it again");
+});
+
+test("the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then", async () => {
+  const heads: Record<string, string> = { main: TRUNK };
+  const { forge, statuses } = aForge([{ number: 1, base: "main", head: HEAD }], heads);
+  const gates = new GateWriter(forge);
+  // A verdict judged against the trunk's new head, in flight when the move is weighed: it lands first, and is left.
+  let release!: () => void;
+  const held = new Promise<void>((r) => (release = r));
+  const verdictLanded = gates.verdict("novox", "mesh-host", HEAD, async () => {
+    await held;
+    statuses.set(HEAD, { "mesh/merge-gate": { state: "success", description: `head x merged into trunk ${MOVED.slice(0, 12)} — pass` } });
+  });
+  const moved = gates.outOfDate("novox", "mesh-host", HEAD, (checks) => outOfDateStatuses(checks, MOVED));
+  release();
+  await verdictLanded;
+  assert.deepEqual(await moved, [], "a verdict judged against the trunk's head is not put out of date");
+  assert.equal(statuses.get(HEAD)!["mesh/merge-gate"].state, "success");
+});