jochen
6327f297ea
Merge order on a protected trunk was the whole proof; the review asked for ancestry. The gitea module gains gitea_contains, a read-only compare of two commits (total_commits 0 is contained), and mesh-delivery asks it once per pair, off the lock like its plan ask, keeping the answer on the delivery. A forge that cannot say leaves the merge held, not covered. Merge order stays the cheap first filter. A later delivery now carries a module only when its own check passed (so a merge held without a passing check is closed only by one that passed), its walk is of its own merge commit on the same trunk, and its steps say the module reached every machine running it, not one. The words say what is known: a later merge that contains it was delivered.