From eaa16e261a4e1d200bf0e56c75555751ab1c9c51 Mon Sep 17 00:00:00 2001
From: iceteaSA <171169159+iceteaSA@users.noreply.github.com>
Date: Thu, 17 Sep 2026 16:26:21 +0200
Subject: [PATCH] gate: name the commit the floor ratchet resolved, not just
 the ref

`origin/master` means a different commit depending on who runs this. A contributor
working from a fork has `origin` pointing at their own fork, whose master can lag the
real merge target arbitrarily -- so the comparison runs against a stale floor and
PASSES. A false green, which is the worse direction: the refusal path is loud, this one
is silent.

Printing the resolved SHA does not fix the staleness and is not meant to. It makes it
legible. Before, a stale fork and the real target both printed `origin/master` and were
indistinguishable in the log:

  workspace floor 614 >= origin/master 614 at 5b761ed     <- real target
  workspace floor 614 >= 6817148 610 at 6817148           <- stale, now visibly older

Applied to all four output paths -- the pass line, both UNCHECKED lines, and the
refusal -- because a reader who sees a ref name in one and a SHA in another has to work
out which is which. The unresolvable case prints `(unresolved)` rather than omitting the
field, so the shape does not change between arms.

Four arms re-run on the merged tree rather than cited from the pre-merge branch: real
target passes naming 5b761ed, a stale target passes naming 6817148 and its older floor,
an unresolvable target reports UNCHECKED and carries it to the verdict line, and a
lowered floor exits 1 naming both numbers and the resolved SHA.
---
 scripts/gate.sh | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/scripts/gate.sh b/scripts/gate.sh
index 59be3b2..8501602 100755
--- a/scripts/gate.sh
+++ b/scripts/gate.sh
@@ -256,6 +256,16 @@ assert_floor_not_lowered() {
   local file="$1" target="${CK_GATE_FLOOR_TARGET:-origin/master}"
   local ours theirs target_file
 
+  # NAME THE RESOLVED SHA, NOT JUST THE REF. `origin/master` means a DIFFERENT COMMIT
+  # depending on who runs this: a fork contributor's `origin` is their own fork, whose
+  # master can lag the real merge target arbitrarily. The comparison then runs against a
+  # stale number and PASSES -- a false green rather than a refusal, which is the worse
+  # direction. Printing the resolved SHA does not fix the staleness, but it makes it
+  # legible: a four-week-old commit beside today's is visible where a bare ref name is
+  # not. Set CK_GATE_FLOOR_TARGET to compare against the real upstream ref instead.
+  local target_sha
+  target_sha=$(git rev-parse --short "$target" 2>/dev/null || echo 'unresolved')
+
   ours=$(grep -m1 -oE 'run_expect [0-9]+ "workspace' "$file" | grep -oE '[0-9]+')
   if [ -z "$ours" ]; then
     fail "floor ratchet: cannot read this tree's workspace floor from $file"
@@ -265,7 +275,7 @@ assert_floor_not_lowered() {
   if ! target_file=$(git show "$target:scripts/gate.sh" 2>/dev/null); then
     GATE_UNCHECKED="${GATE_UNCHECKED:-}floor ratchet (cannot resolve $target) "
     printf '\n=== floor ratchet: UNCHECKED ===\n'
-    printf 'cannot resolve %s — no comparison made (this is not a pass)\n' "$target"
+    printf 'cannot resolve %s (%s) — no comparison made (this is not a pass)\n' "$target" "$target_sha"
     return
   fi
 
@@ -273,7 +283,7 @@ assert_floor_not_lowered() {
   if [ -z "$theirs" ]; then
     GATE_UNCHECKED="${GATE_UNCHECKED:-}floor ratchet (no floor in $target) "
     printf '\n=== floor ratchet: UNCHECKED ===\n'
-    printf 'cannot read a workspace floor from %s — no comparison made (this is not a pass)\n' "$target"
+    printf 'cannot read a workspace floor from %s (%s) — no comparison made (this is not a pass)\n' "$target" "$target_sha"
     return
   fi
 
@@ -283,12 +293,12 @@ assert_floor_not_lowered() {
       printf 'this tree %s < %s %s — reason: %s\n' "$ours" "$target" "$theirs" "$CK_GATE_FLOOR_LOWER_REASON"
       return
     fi
-    fail "floor ratchet: this tree's workspace floor is $ours but $target carries $theirs — a branch forked before a raise lowers it silently and every gate still passes; rebase and re-measure on the merged tree, or set CK_GATE_FLOOR_LOWER_REASON"
+    fail "floor ratchet: this tree's workspace floor is $ours but $target ($target_sha) carries $theirs — a branch forked before a raise lowers it silently and every gate still passes; rebase and re-measure on the merged tree, or set CK_GATE_FLOOR_LOWER_REASON"
     return
   fi
 
   printf '\n=== floor ratchet ===\n'
-  printf 'workspace floor %s >= %s %s\n' "$ours" "$target" "$theirs"
+  printf 'workspace floor %s >= %s %s at %s\n' "$ours" "$target" "$theirs" "$target_sha"
 }
 
 # The floor is the MEASURED total, not a round number below it. A floor with slack