From 643ec7cd916b2ff29f59198ac7e3de4a4ef8104f Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Thu, 5 Nov 2026 23:35:23 +0100
Subject: [PATCH] A check names a group member that publishes no package yet at
 its head by its root module path (issue 1921)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../internal/check/pins.go                    | 23 +++++++++++++++++++
 .../internal/check/pins_test.go               | 15 ++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/modules/mesh-delivery-checker/internal/check/pins.go b/modules/mesh-delivery-checker/internal/check/pins.go
index c8db7338..368bea05 100644
--- a/modules/mesh-delivery-checker/internal/check/pins.go
+++ b/modules/mesh-delivery-checker/internal/check/pins.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"maps"
+	"strings"
 
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
@@ -58,6 +59,28 @@ func (st *state) packagesOf(repository string) delivery.PackageVersions {
 			delete(versions, pkg)
 		}
 	}
+	// A package of a member that no indexer state publishes yet (a repository whose packages are all new) is in no list above,
+	// and the build would look for it as the trunk's latest version, which does not exist (issue 1921). The member's root
+	// module path stands for its repository: the build module takes the head of a repository from any package of it.
+	for _, m := range st.c.Pulls {
+		if delivery.SameRepository(m.Repository, repository) || len(m.Head) != 40 {
+			continue
+		}
+		name := strings.TrimPrefix(m.Repository, "novox/")
+		if m.Repository == name {
+			continue
+		}
+		held := false
+		for pkg := range versions {
+			if repo, _, ok := delivery.PackageRepository(pkg); ok && repo == m.Repository {
+				held = true
+				break
+			}
+		}
+		if !held {
+			versions[delivery.ForgeModulePrefix+name] = m.Head
+		}
+	}
 	if len(versions) == 0 {
 		return nil
 	}
diff --git a/modules/mesh-delivery-checker/internal/check/pins_test.go b/modules/mesh-delivery-checker/internal/check/pins_test.go
index 5c61971e..d121e0d3 100644
--- a/modules/mesh-delivery-checker/internal/check/pins_test.go
+++ b/modules/mesh-delivery-checker/internal/check/pins_test.go
@@ -197,3 +197,18 @@ func TestAMeshLabHeadGetsACheck(t *testing.T) {
 		t.Fatalf("mesh-lab was not fetched: %+v", fetched)
 	}
 }
+
+// A member whose packages are not published yet is still named at its head: the build would otherwise look for the trunk's
+// latest version of a package that has none (issue 1921). Its root module path stands for it; a member with a published
+// package is named by that package alone, and the checked repository by none.
+func TestAMemberWithNoPublishedPackageIsNamedAtItsHead(t *testing.T) {
+	b := newBench(t)
+	b.ex.Published = published{}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf("novox/mesh-host", 8, head2))).Verdict
+	if v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if got := packagesOfFetch(t, b, repoA); len(got) != 1 || got["git.novox.be/novox/mesh-host"] != head2 {
+		t.Errorf("the member's packages = %v, want the unpublished member's root at its head %s alone", got, head2)
+	}
+}