From a4c9c0a6c7025c945042e2691784b7c1b6744d63 Mon Sep 17 00:00:00 2001
From: doxa-maps-88655c70
 <88627970+doxa-maps-88655c70@users.noreply.github.com>
Date: Fri, 25 Sep 2026 02:25:53 +0000
Subject: [PATCH] gates: refuse to measure a tree that is not this checkout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Answers 200" and "is serving this build" are different questions, and my two
browser gates only ever asked the first. Point either at a stale server and it
measures the OLD build and reports PASS, with nothing in the output naming which
tree it saw.

★ THAT IS NOT HYPOTHETICAL — I DID IT FOR SEVENTEEN TICKS. The published site was
many merges behind while I ran these gates against it and reported the results
as live verification. They were confident measurements of a tree that was not
mine. The country-posters defect they eventually caught was only visible once
the publish made live and local agree; before that, a stale copy would have
passed either way and I would not have known the difference.

bundler-2 found this class first (BUG-BROWSER-GATES-CAN-MEASURE-ANOTHER-WORKTREES-TREE:
port 4173 on this box was held by a different worktree, and a gate reported three
confident runs about code nobody had changed) and wrote _serves-this-tree.mjs,
which hashes the served manifest.json against the one on disk. Eight gates use
it; mine did not. This adds it to the two of mine that drive a browser.

⚠ NOT MEASURED, NOT SKIP, and the distinction carries the meaning. A SKIP reads
as "nothing to check here". This is "I could not attribute what I saw", which is
a different and louder fact. Exit 2, so a caller can tell it from a pass (0) and
from a real failure (1).

A useful side effect: these gates now refuse to measure live whenever the
publish is stale, turning the silent failure mode I lived with into a loud one
at the point of use.

VERIFIED BOTH DIRECTIONS on both gates: against this checkout they measure and
pass as before (15 width x locale combinations; 195 polys · 27/27 zones · 2107
pins on both leaves); against a host serving a different build they print NOT
MEASURED and exit 2 instead of passing.

The other 26 browser gates that lack this belong to bundler-2's chain, which
owns them — reported, not converted.
---
 internal/check-poster-card-fits.mjs     | 34 +++++++++++++++++++++++++
 internal/check-upg-map-data-painted.mjs | 23 +++++++++++++++++
 2 files changed, 57 insertions(+)

diff --git a/internal/check-poster-card-fits.mjs b/internal/check-poster-card-fits.mjs
index 426710210..cafdeed38 100644
--- a/internal/check-poster-card-fits.mjs
+++ b/internal/check-poster-card-fits.mjs
@@ -21,7 +21,11 @@
  * Usage: node internal/check-poster-card-fits.mjs [leafUrl] — SKIPs when nothing is served.
  */
 import { chromium } from 'playwright'
+import { resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { servesThisTree } from './_serves-this-tree.mjs'
 
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 const DEFAULT_LEAF = (process.env.BASE_URL || 'http://127.0.0.1:4173')
   + '/doxa-maps/my-upg-100-list/upg-100-mfe/index.html'
 const LEAF = process.argv[2] || DEFAULT_LEAF
@@ -55,6 +59,36 @@ if (!reachable) {
   process.exit(0)
 }
 
+// ★ "ANSWERS 200" AND "IS SERVING THIS BUILD" ARE DIFFERENT QUESTIONS, and only the first was
+// asked above. This gate reports on geometry it cannot attribute: point it at a stale server and
+// it measures the OLD build and says PASS, with nothing in the output naming which tree it saw.
+//
+// THAT IS NOT HYPOTHETICAL — I DID IT FOR SEVENTEEN TICKS. The published site was many merges
+// behind while I ran this gate against it and recorded the results as live verification. They were
+// measurements of a tree that was not mine. The defect that finally surfaced (country-posters
+// previews 404ing) was only visible once the publish made live and local agree; before that, this
+// gate would have passed on the stale copy either way.
+//
+// bundler-2 found this class first (BUG-BROWSER-GATES-CAN-MEASURE-ANOTHER-WORKTREES-TREE: :4173 on
+// this box was held by a different worktree) and wrote _serves-this-tree.mjs. Its comment is the
+// rule: "A gate that can report on the wrong tree is worse than no gate — it produces confident
+// findings about code nobody changed, and hides real ones."
+//
+// ⚠ NOT MEASURED, NOT SKIP, and the distinction is the point. A SKIP reads as "nothing to check
+// here"; this is "I could not attribute what I saw", which is a different and louder fact. Exit 2
+// so a caller can tell it apart from both a pass (0) and a real failure (1).
+// The helper wants the tree's BASE, not a leaf URL — it fetches <base>/doxa-maps/manifest.json.
+// LEAF is `<base>/doxa-maps/<bundle>/<profile>/index.html`, so cut at the /doxa-maps/ segment.
+const TREE_BASE = LEAF.split('/doxa-maps/')[0]
+const treeCheck = await servesThisTree(TREE_BASE, ROOT)
+if (!treeCheck.ok) {
+  console.error('POSTER-CARD-FITS: NOT MEASURED — the server is not serving this checkout.')
+  console.error(`  ${treeCheck.why}`)
+  console.error('  Every number below would describe someone else\'s build. Point BASE_URL at a')
+  console.error('  server for THIS tree, or publish first if you meant to measure live.')
+  process.exit(2)
+}
+
 const WALK = `(root, out) => { out = out || []; const rec = (r) => { for (const e of r.querySelectorAll('*')) { out.push(e); if (e.shadowRoot) rec(e.shadowRoot) } }; rec(root); return out }`
 
 const browser = await chromium.launch({ args: ['--use-gl=swiftshader', '--enable-unsafe-swiftshader'] })
diff --git a/internal/check-upg-map-data-painted.mjs b/internal/check-upg-map-data-painted.mjs
index aff5ba9e9..a10ced5f6 100644
--- a/internal/check-upg-map-data-painted.mjs
+++ b/internal/check-upg-map-data-painted.mjs
@@ -32,6 +32,11 @@
  *   diverge, and conflating them cost a whole tick of wrong diagnoses.
  */
 import { chromium } from 'playwright'
+import { resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { servesThisTree } from './_serves-this-tree.mjs'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 
 const BASE = process.env.BASE || 'http://127.0.0.1:4173/doxa-maps'
 const DEFAULT = [
@@ -58,6 +63,24 @@ if (!reachable) {
   process.exit(0)
 }
 
+// ★ "ANSWERS 200" AND "IS SERVING THIS BUILD" ARE DIFFERENT QUESTIONS. This gate reads the counter
+// the profile writes when it adds its layers — a number that means nothing unless you know WHICH
+// build produced it. Pointed at a stale server it would report someone else's polygons as proof
+// that this checkout works.
+// See _serves-this-tree.mjs (bundler-2, BUG-BROWSER-GATES-CAN-MEASURE-ANOTHER-WORKTREES-TREE):
+// :4173 on this box was once held by a different worktree and a gate reported three confident runs
+// about code nobody had changed.
+// ⚠ NOT MEASURED rather than SKIP, exit 2: "nothing to check here" and "I cannot attribute what I
+// saw" are different facts, and only the second one should stop you trusting the numbers.
+const TREE_BASE = String(urls[0]).split('/doxa-maps/')[0]
+const treeCheck = await servesThisTree(TREE_BASE, ROOT)
+if (!treeCheck.ok) {
+  console.error('UPG-MAP-DATA: NOT MEASURED — the server is not serving this checkout.')
+  console.error(`  ${treeCheck.why}`)
+  console.error('  The polygon and pin counts below would describe someone else\'s build.')
+  process.exit(2)
+}
+
 const WALK = `(root) => { const o = []; const rec = (r) => { for (const e of r.querySelectorAll('*')) { o.push(e); if (e.shadowRoot) rec(e.shadowRoot) } }; rec(root); return o }`
 
 const browser = await chromium.launch({ args: ['--use-gl=swiftshader', '--enable-unsafe-swiftshader'] })