Merge the release fix/1921-zero-version-builds into the registry group: every producer of a build at a group's heads takes its versions from sdk/grouppackages (issue 1921, issue 1966)

grouppackages is the Delivery SDK's (ADR 0634) and imports sdk/buildstep and sdk/trunk, not the deleted mesh-sdk/go/delivery.
The checker's packagesFor lays the group's tagged versions (design 51) over grouppackages.Heads, so a heard tag still stands
before a member's head; the composer and the trunk's manifest validator are built with no tags. Fetches carry the versions
in buildstep.Fetch.Packages, so withPackages is gone; the group's fetch names no beside ref, so the test of the node-engine
member beside reads its commit alone.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go

@@ -271,6 +271,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	// The indexer's packages state (ADR 0593 §2), so a Go check builds every mesh package at its published version: read
 	// once the first views are answered, before any check starts (afterFirstViews).
 	published := &publishedPackages{}
+	compositions.Published = published
 	ch.Runs = repos // the node-engine a check reads beside at its running commit (ADR 0548 §6)
 	// A group's tagged versions (design 51 *Tagged versions*): tag-wanted on the checker's stream asks, and the package
 	// registry seats' published heard on the checker's durable consumer of the shared events stream. Where that consumer is

modules/mesh-delivery-checker/internal/check/beside.go

@@ -50,8 +50,9 @@ var besideRules = map[string][]string{
 	"novox/mesh-delivery": {SDKRepository, catalogueRepository},
 }
 
-// besideFor are the siblings a pull request's tests read (ADR 0484 clause 4): the node-engine at the commit the mesh runs
-// (the commit of the indexer's module mesh-host, its trunk head when none is known); any other sibling, the catalogue
+// besideFor are the siblings a pull request's tests read (ADR 0484 clause 4): the node-engine at the head of the group's pull
+// request for it when the group holds one, else at the commit the mesh runs (the commit of the indexer's module mesh-host,
+// its trunk head when none is known); any other sibling, the catalogue
 // included, at the head of the group's pull request for it when the group holds one, else at its trunk, since a group's
 // check judges each member against the group's heads (ADR 0482 §2, ADR 0573 §4; issue 1126: a judge a group changed was
 // judged against the catalogue's trunk). And first, the change's own repository at the trunk it is merged onto, so a test
@@ -68,6 +69,12 @@ func (j *Examiner) besideFor(ctx context.Context, c *Case, p Pull) ([]BesideRef,
 	}
 	for _, repo := range besideRules[p.Repository] {
 		switch {
+		case repo == nodeEngineRepo && c.member(repo) != nil:
+			// A group's check judges each member against the group's heads (ADR 0573 §4, ADR 0482 §2), and the group's
+			// node-engine is what runs after its merge: it is placed at the member's head, as any member is. Neither atTrunk
+			// nor runs, so no move of the trunk or of the running commit puts the verdict out of date (besideAtTrunk).
+			member := c.member(repo)
+			out = append(out, BesideRef{Repository: repo, Commit: member.Head, Ref: refOf(member.Number)})
 		case repo == nodeEngineRepo:
 			commit := ""
 			if j.Runs != nil {

modules/mesh-delivery-checker/internal/check/engines.go

@@ -59,7 +59,12 @@ type EngineCompositions struct {
 	// Manifests are the indexer's trunk manifest digests by module, and Verdicts its refusals of them: the catalogue the
 	// sandbox composes with, before the case's own manifests are laid over.
 	Manifests TrunkManifests
-	Verdicts  func() map[string]meshcatalog.VerdictsByDigestValue
+	// Published names the latest published version of every mesh package (Examiner.Published): the composer is built
+	// against them and the group's heads, as a check is (issue 1921); nil names the group's heads alone.
+	Published interface {
+		LatestPackages() buildstep.PackageVersions
+	}
+	Verdicts func() map[string]meshcatalog.VerdictsByDigestValue
 }
 
 // composerHead is the node-engine member's head of a case, or empty.
@@ -237,7 +242,7 @@ func (e EngineCompositions) inSandbox(ctx context.Context, c *Case, head, node s
 	if err != nil {
 		return a, err
 	}
-	job := buildstep.ComposeJob{Fetch: buildstep.Fetch{Repository: nodeEngineRepo, Commit: head}, Dir: meshcatalogclient.RootPath,
+	job := buildstep.ComposeJob{Fetch: buildstep.Fetch{Repository: nodeEngineRepo, Commit: head, Packages: packagesFor(e.Published, c, nil, nodeEngineRepo)}, Dir: meshcatalogclient.RootPath,
 		Package: composer.Package, Request: raw, Reader: "the node-engine head of " + c.Group}
 	verdict, err := e.Sandbox.Compose(ctx, job)
 	if err != nil {

modules/mesh-delivery-checker/internal/check/engines_test.go

@@ -18,6 +18,7 @@ import (
 	"git.novox.be/novox/mesh-delivery/contracts/go/seats/meshwants"
 	"git.novox.be/novox/mesh-delivery/sdk/buildstep"
 	"git.novox.be/novox/mesh-delivery/sdk/composer"
+	"git.novox.be/novox/mesh-delivery/sdk/trunk"
 )
 
 // fakeEngines answers compose-candidate by node from memory; a node it holds no answer for never answers.
@@ -157,7 +158,7 @@ func TestTheCompositionIsMadeFromTheEnginesAnswers(t *testing.T) {
 				Machines: map[string]composer.Machine{node: {Composes: false, Reason: "the new composer refuses it"}}}}}
 		}}
 		ec := EngineCompositions{Asker: e, Placed: func() ([]string, error) { return []string{"anchor"}, nil }, Bound: time.Second,
-			Sandbox: sb, Manifests: digests{"web": "sha256:" + strings.Repeat("c", 64)}}
+			Sandbox: sb, Manifests: digests{"web": "sha256:" + strings.Repeat("c", 64)}, Published: published{}}
 		v, err := ec.Compose(context.Background(), host)
 		if err != nil {
 			t.Fatal(err)
@@ -172,6 +173,10 @@ func TestTheCompositionIsMadeFromTheEnginesAnswers(t *testing.T) {
 			string(req.Input) != `{"nodes":[{"name":"anchor"}]}` || req.Cases[0].Manifests["web"].Digest == "" {
 			t.Errorf("job = %+v, request %+v", job, req)
 		}
+		// Issue 1921: the composer is built at the group's heads, also a member that publishes no package yet.
+		if pkgs := job.Fetch.Packages; len(pkgs) != 1 || pkgs[trunk.ForgeModulePrefix+"mesh-delivery"] != head1 {
+			t.Errorf("the composer is fetched with the packages %v, want the group's mesh-delivery member at its head %s alone", pkgs, head1)
+		}
 		if v.State != meshdeliverycheckerclient.CompositionFail || v.Sdk != head2 || !strings.Contains(v.Words, "the new composer refuses it") {
 			t.Errorf("verdict = %+v", v)
 		}

modules/mesh-delivery-checker/internal/check/examiner_test.go

@@ -1215,7 +1215,8 @@ func TestTheIndexersJudgeJudgesTheChangesManifests(t *testing.T) {
 		}
 		p.Modules = []string{"web"}
 		p.Fps = map[string]meshcatalog.CandidatesByGroupValuePullsItemFpsValue{"web": {Fp2: "src2:" + strings.Repeat("f", 64), Manifest: web}}
-		cs := caseOf(t, p)
+		// Issue 1921: the judge is built at the group's heads too, also a member that publishes no package yet.
+		cs := caseOf(t, p, pullOf("novox/mesh-networking", 9, head2))
 		if row.try {
 			cs = TryCase("try-1", Try{Members: []TryMember{{Repository: repoA, Head: head1, Trunk: trunkA}}}, nil)
 			b.ex.Candidates = &fakeTryCandidates{cand: meshcatalog.CandidatesByGroupValue{Fpset: "fps", Pulls: []meshcatalog.CandidatesByGroupValuePullsItem{p}}}
@@ -1243,11 +1244,34 @@ func TestTheIndexersJudgeJudgesTheChangesManifests(t *testing.T) {
 			}
 			continue
 		}
+		// Issue 1921: the judge of the change is built at the group's heads (also a member that publishes no package yet), but
+		// the trunk's manifest validator that rules on a new indexer is built at the latest published versions alone, never
+		// at a group's head (ADR 0633 clause 6): a group with a member of its own then judges the indexer a second time.
+		trunkRuns := 0
+		if row.indexer != "" && row.indexer != "heldplain" && (row.ownJudge || !row.try) {
+			trunkRuns = 1
+		}
+		if want := 1 + trunkRuns; len(judged) != want {
+			t.Fatalf("%s: %d judge asks %+v, want %d", row.name, len(judged), judged, want)
+		}
+		for i, j := range judged {
+			pkgs := j.Fetch.Packages
+			atGroup := pkgs["git.novox.be/novox/mesh-networking"] == head2
+			switch trunkRun := trunkRuns == 1 && i == len(judged)-1; {
+			case row.try:
+			case trunkRun && atGroup:
+				t.Errorf("%s: the trunk's manifest validator is built with the group's head: %v", row.name, pkgs)
+			case !trunkRun && !atGroup:
+				t.Errorf("%s: the judge at %v is fetched with the packages %v, want the group's mesh-networking member at its head %s", row.name, j.Fetch.Commit, pkgs, head2)
+			}
+		}
 		if row.ownJudge && (len(judged) != 2 || judged[0].Fetch.Commit != head1 || judged[1].Fetch.Commit != trunk) {
 			t.Fatalf("%s: judged %+v, want the head's judge and then the trunk's", row.name, judged)
 		}
 		if row.ownJudge {
 			judged = judged[1:]
+		} else if trunkRuns == 1 {
+			judged = judged[1:] // the group's run; the trunk's is the one read below
 		}
 		if len(judged) != 1 || judged[0].Fetch.Repository != DeliveryRepository || judged[0].Fetch.Commit != trunk ||
 			judged[0].Package != JudgePackage || judged[0].Dir != JudgeDir {

modules/mesh-delivery-checker/internal/check/manifests_judge.go

@@ -139,7 +139,7 @@ func (st *state) judgeManifests(ctx context.Context) *meshdeliverychecker.Verdic
 		}
 		req.Seats = seats
 	}
-	cv, trunkCase, v := st.runJudge(ctx, req, touched, commit, at)
+	cv, trunkCase, v := st.runJudge(ctx, req, touched, commit, at, st.packagesOf(DeliveryRepository))
 	if v != nil {
 		return v
 	}
@@ -196,12 +196,12 @@ func (st *state) judgeManifests(ctx context.Context) *meshdeliverychecker.Verdic
 
 // runJudge asks the Go build seat to build the judge at the commit and run it over the request, and reads its change and
 // trunk cases; a failed verdict when it cannot be asked or does not answer.
-func (st *state) runJudge(ctx context.Context, req composer.Request, touched []string, commit, at string) (change, trunk composer.CaseVerdict, v *meshdeliverychecker.VerdictsByGroupHeadsValue) {
+func (st *state) runJudge(ctx context.Context, req composer.Request, touched []string, commit, at string, versions buildstep.PackageVersions) (change, trunk composer.CaseVerdict, v *meshdeliverychecker.VerdictsByGroupHeadsValue) {
 	raw, err := json.Marshal(req)
 	if err != nil {
 		return change, trunk, fail(goModule, err.Error())
 	}
-	job := buildstep.ComposeJob{Fetch: buildstep.Fetch{Repository: DeliveryRepository, Commit: commit}, Dir: JudgeDir,
+	job := buildstep.ComposeJob{Fetch: buildstep.Fetch{Repository: DeliveryRepository, Commit: commit, Packages: versions}, Dir: JudgeDir,
 		Package: JudgePackage, Request: raw, Reader: "the indexer's judge at " + at}
 	a := buildstep.StepAsk{ID: buildstep.NewID(), Kind: buildstep.AskCheck, Language: buildstep.AskGo, Asker: CheckerModule,
 		At: st.j.now().UTC(), Compose: &job}
@@ -251,7 +251,10 @@ func (st *state) refuseUnmovableIndexer(ctx context.Context, req composer.Reques
 	if indexer == "" {
 		return nil
 	}
-	if st.judgeHead != "" {
+	// The validator the running parts hold is the trunk's, built at the latest published versions alone, never at the group's
+	// heads (ADR 0633 clause 6): a group's mesh-sdk or mesh-contracts head must not change the validator that judges the new
+	// indexer. The head's run is reused when it was that validator already.
+	if trunkVersions := st.trunkJudgeVersions(); st.judgeHead != "" || !maps.Equal(st.packagesOf(DeliveryRepository), trunkVersions) {
 		trunk := ""
 		if st.j.Trunks != nil {
 			trunk = st.j.Trunks.Heads()[DeliveryRepository]
@@ -261,7 +264,7 @@ func (st *state) refuseUnmovableIndexer(ctx context.Context, req composer.Reques
 		}
 		var v *meshdeliverychecker.VerdictsByGroupHeadsValue
 		judgedAt = "mesh-delivery's trunk " + trunk
-		if cv, _, v = st.runJudge(ctx, req, touched, trunk, judgedAt); v != nil {
+		if cv, _, v = st.runJudge(ctx, req, touched, trunk, judgedAt, trunkVersions); v != nil {
 			return v
 		}
 	}
@@ -420,3 +423,9 @@ func (st *state) knownPackages(ctx context.Context) []string {
 	slices.Sort(known)
 	return slices.Compact(known)
 }
+
+// trunkJudgeVersions are the versions the trunk's manifest validator is built at: the latest published version of each
+// package, with no group member's head (ADR 0633 clause 6).
+func (st *state) trunkJudgeVersions() buildstep.PackageVersions {
+	return packagesFor(st.j.Published, &Case{}, nil, DeliveryRepository)
+}

modules/mesh-delivery-checker/internal/check/pins.go

@@ -4,9 +4,9 @@ import (
 	"context"
 	"errors"
 	"maps"
-	"strings"
 
 	"git.novox.be/novox/mesh-delivery/sdk/buildstep"
+	"git.novox.be/novox/mesh-delivery/sdk/grouppackages"
 	"git.novox.be/novox/mesh-delivery/sdk/trunk"
 )
 
@@ -33,64 +33,45 @@ type Forge interface {
 	File(ctx context.Context, repository, path, ref string) (string, error)
 }
 
-// packagesOf is the version of each mesh package a Go check of repository builds against (ADR 0573 §2, §4, as ADR 0607
-// §5 changes §4): the latest published version of each package the mesh's modules use (Published); for a package a
-// member of the case publishes, the group's tagged version of it once the check heard it (design 51 *Tagged versions*,
-// also a package new in the group, which has no published version yet), else that member's head (mesh-sdk's Go module
-// whenever mesh-sdk is a member). A package of repository itself comes with the tree the check fetched, and is left out.
-// Nil for none.
+// packagesOf is the version of each mesh package a Go build of repository (a check ask, the judge, the composer) builds
+// against (ADR 0573 §2, §4, as ADR 0607 §5 changes §4): packagesFor over the latest published version of each package the
+// mesh's modules use (Published), the heads of the case's pull requests and the group's tagged versions the check heard
+// (design 51 *Tagged versions*). Nil for none.
 func (st *state) packagesOf(repository string) buildstep.PackageVersions {
-	versions := buildstep.PackageVersions{}
-	if st.j.Published != nil {
-		maps.Copy(versions, st.j.Published.LatestPackages())
+	return packagesFor(st.j.Published, st.c, st.tags.goPackages, repository)
+}
+
+// packagesFor is packagesOf for a case, the published versions and the tagged ones: every producer of a build at a group's
+// heads takes its versions from here, so none leaves a member out (issue 1921). grouppackages.Heads names each package at
+// its member's head, also a member that publishes no package yet; then, for a package a member of the case publishes, the
+// group's tagged version of it once heard stands instead of the head, also for a package new in the group, which has no
+// published version yet. A package of repository itself comes with the tree the build fetched, and is left out.
+func packagesFor(published interface {
+	LatestPackages() buildstep.PackageVersions
+}, c *Case, tagged buildstep.PackageVersions, repository string) buildstep.PackageVersions {
+	latest := buildstep.PackageVersions{}
+	if published != nil {
+		maps.Copy(latest, published.LatestPackages())
 	}
-	if st.c.member(SDKRepository) != nil {
-		if _, named := versions[SDKModulePath]; !named {
-			versions[SDKModulePath] = ""
+	for pkg := range tagged {
+		if _, named := latest[pkg]; !named {
+			latest[pkg] = ""
 		}
 	}
-	for pkg := range st.tags.goPackages {
-		versions[pkg] = ""
+	heads := map[string]string{}
+	for _, m := range c.Pulls {
+		heads[m.Repository] = m.Head
 	}
-	for pkg := range versions {
+	versions := grouppackages.Heads(latest, heads, repository)
+	for pkg, tag := range tagged {
 		repo, _, ok := trunk.PackageRepository(pkg)
-		if !ok || trunk.SameRepository(repo, repository) {
-			delete(versions, pkg)
+		if tag == "" || !ok || trunk.SameRepository(repo, repository) {
 			continue
 		}
-		if tagged := st.tags.goPackages[pkg]; tagged != "" {
-			versions[pkg] = tagged
-		} else if m := st.c.member(repo); m != nil && len(m.Head) == 40 {
-			versions[pkg] = m.Head
+		if versions == nil {
+			versions = buildstep.PackageVersions{}
 		}
-		if versions[pkg] == "" {
-			delete(versions, pkg)
-		}
-	}
-	// A package of a member that no indexer state publishes yet (a repository whose packages are all new) is in no list above,
-	// and the build would look for it as the trunk's latest version, which does not exist (issue 1921). The member's root
-	// module path stands for its repository: the build module takes the head of a repository from any package of it.
-	for _, m := range st.c.Pulls {
-		if trunk.SameRepository(m.Repository, repository) || len(m.Head) != 40 {
-			continue
-		}
-		name := strings.TrimPrefix(m.Repository, "novox/")
-		if m.Repository == name {
-			continue
-		}
-		held := false
-		for pkg := range versions {
-			if repo, _, ok := trunk.PackageRepository(pkg); ok && repo == m.Repository {
-				held = true
-				break
-			}
-		}
-		if !held {
-			versions[trunk.ForgeModulePrefix+name] = m.Head
-		}
-	}
-	if len(versions) == 0 {
-		return nil
+		versions[pkg] = tag
 	}
 	return versions
 }

modules/mesh-delivery-checker/internal/check/pins_test.go

@@ -15,6 +15,7 @@ import (
 	"git.novox.be/novox/mesh-delivery/contracts/go/seats/meshcatalog"
 	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-delivery/sdk/buildstep"
+	"git.novox.be/novox/mesh-delivery/sdk/grouppackages"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
@@ -77,6 +78,39 @@ func TestAGroupMemberIsBuiltAgainstTheSDKMembersHeadWhateverItsGoModNames(t *tes
 	if got := packagesOfFetch(t, b, repoA); len(got) != 1 || got["git.novox.be/novox/mesh-host"] != head2 {
 		t.Errorf("the member's packages = %v, want the unpublished member's root at its head %s alone", got, head2)
 	}
+	// The function every producer takes the versions from (issue 1921): rows for what a build at a group's heads is asked.
+	h := func(c string) string { return strings.Repeat(c, 40) }
+	const (
+		contractsPkg = "git.novox.be/novox/mesh-contracts/go/clients/assignerclient"
+		toolsPkg     = "git.novox.be/novox/mesh-tools/go/x"
+	)
+	for _, tc := range []struct {
+		name   string
+		latest buildstep.PackageVersions
+		heads  map[string]string
+		own    string
+		want   buildstep.PackageVersions
+	}{
+		{"none", nil, nil, "novox/mesh-host", nil},
+		{"trunk latest alone", buildstep.PackageVersions{toolsPkg: h("a")}, nil, "novox/mesh-host", buildstep.PackageVersions{toolsPkg: h("a")}},
+		{"a member at its head replaces the latest", buildstep.PackageVersions{SDKModulePath: h("a")}, map[string]string{SDKRepository: h("b")}, "novox/mesh-host",
+			buildstep.PackageVersions{SDKModulePath: h("b")}},
+		{"a member that publishes no package yet is named by its root module", buildstep.PackageVersions{SDKModulePath: h("a")},
+			map[string]string{"novox/mesh-contracts": h("c")}, "novox/mesh-host",
+			buildstep.PackageVersions{SDKModulePath: h("a"), "git.novox.be/novox/mesh-contracts": h("c")}},
+		{"mesh-sdk is named by its go module before any package of it is known", nil, map[string]string{SDKRepository: h("b")}, "novox/mesh-host",
+			buildstep.PackageVersions{SDKModulePath: h("b")}},
+		{"a member whose packages are known gets no root", buildstep.PackageVersions{contractsPkg: h("a")},
+			map[string]string{"novox/mesh-contracts": h("c")}, "novox/mesh-host", buildstep.PackageVersions{contractsPkg: h("c")}},
+		{"the build's own repository is left out", buildstep.PackageVersions{contractsPkg: h("a")},
+			map[string]string{"novox/mesh-contracts": h("c")}, "novox/mesh-contracts", nil},
+		{"a head that is no full commit names nothing", nil, map[string]string{"novox/mesh-contracts": "abc"}, "novox/mesh-host", nil},
+	} {
+		got := grouppackages.Heads(tc.latest, tc.heads, tc.own)
+		if !maps.Equal(got, tc.want) {
+			t.Errorf("%s: got %v, want %v", tc.name, got, tc.want)
+		}
+	}
 
 	// Design 51 *Tagged versions* (DLV-C3): a group's check says tag-wanted for each package a member declares and builds no
 	// member before its published; a lone pull request asks nothing; no published within the bound fails naming the package.
@@ -336,6 +370,18 @@ func TestACatalogueChangeHasTheCatalogueBesideItAtItsTrunk(t *testing.T) {
 	if h := got[nodeEngineRepo]; h.Commit != hostRuns {
 		t.Errorf("the node-engine beside a catalogue change = %+v, want the commit the mesh runs %s", h, hostRuns)
 	}
+	// A group that holds the node-engine is judged against its head, which is what runs after its merge, never the commit
+	// the mesh runs now; the verdict names it in no carry (it is a member, not read at a trunk or a running commit).
+	b = newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{catalogueRepository: trunkA, SDKRepository: trunkS, nodeEngineRepo: trunkA2})
+	b.ex.Runs = runsAt{nodeEngineModule: hostRuns}
+	out = b.judge(t, caseOf(t, pullOf(catalogueRepository, 12, head1), pullOf(nodeEngineRepo, 8, head2)))
+	if h := besideOf(t, b, catalogueRepository)[nodeEngineRepo]; h.Commit != head2 {
+		t.Errorf("the node-engine beside a catalogue change in a group holding it = %+v, want the member's head %s", h, head2)
+	}
+	if out.Beside[nodeEngineRepo] != "" {
+		t.Errorf("the verdict names the member node-engine in its carry: %v", out.Beside)
+	}
 }
 
 // 1887/A12: a mesh-lab head gets a check: with its trunk known it is judged like any repository, its Go fetch finding

modules/mesh-delivery-indexer/internal/index/previews.go

@@ -12,6 +12,7 @@ import (
 	"git.novox.be/novox/mesh-delivery/contracts/go/seats/meshcatalog"
 	"git.novox.be/novox/mesh-delivery/contracts/go/seats/meshdeliverychecker"
 	sdkstep "git.novox.be/novox/mesh-delivery/sdk/buildstep"
+	"git.novox.be/novox/mesh-delivery/sdk/grouppackages"
 	"git.novox.be/novox/mesh-delivery/sdk/trunk"
 
 	"mesh-delivery-indexer/internal/fingerprint"
@@ -342,7 +343,10 @@ func (ix *Indexer) candidateModule(ctx context.Context, m, dir string, pv meshde
 		out.None2 = none
 		return out
 	}
-	out.Fp2, out.Packages = fp, versions
+	// The ask of the candidate's build names every member of the group at its head, also one the module names no package of
+	// (a member that publishes none yet, or one the module reaches through mesh-sdk): the fingerprint stays the trunk's, so
+	// the build is the one the merge keeps (grouppackages.Heads, issue 1921).
+	out.Fp2, out.Packages = fp, grouppackages.Heads(versions, members, pv.Repository)
 	if len(inputs.Paths) > 0 {
 		out.Paths = inputs.Paths // the builder's fetch for the candidate names them (ADR 0499 clause 4)
 	}

modules/mesh-delivery-indexer/internal/index/previews_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"maps"
 	"os"
 	"runtime"
 	"slices"
@@ -113,6 +114,42 @@ func TestACandidatesModuleGetsTheFingerprintATrunkModuleOfTheSameTreeHas(t *test
 		t.Errorf("candidate base = %d, want the source revision 5 its preview was read onto", c.Base)
 	}
 	written(t, writtenCandidate{Source: sourceRev{Rev: 5, Heads: map[string]string{catalogueRepo: trunkNow}}, Candidate: c})
+	// Issue 1921: a candidate's build is asked every member of the group at its head, also one that publishes no package yet
+	// and one the module names no package of; the fingerprint stays the trunk's, so the build is the one the merge keeps.
+	for _, tc := range []struct {
+		name    string
+		members map[string]string // the other pull requests of the group: repository, head
+		want    sdkstep.PackageVersions
+	}{
+		{"a group of one names nothing", nil, nil},
+		{"a member that publishes no package yet", map[string]string{"novox/mesh-contracts": h2},
+			sdkstep.PackageVersions{"git.novox.be/novox/mesh-contracts": h2}},
+		{"mesh-sdk by its go module", map[string]string{"novox/mesh-sdk": h2, "novox/mesh-contracts": h3},
+			sdkstep.PackageVersions{"git.novox.be/novox/mesh-sdk/go": h2, "git.novox.be/novox/mesh-contracts": h3}},
+	} {
+		ix, mods, cands := previewBed(t, true)
+		trunk, _ := moduleOf(t, mods, "avahi")
+		if err := ix.Apply(context.Background(), avahiPull(t, h1)); err != nil {
+			t.Fatal(err)
+		}
+		for repository, head := range tc.members {
+			other := forgemsg.Forge{V: forgemsg.Version, Kind: forgemsg.ForgePull, Repository: repository, Branch: "feat/x", Number: 7, Head: head,
+				Action: forgemsg.PullUpdated}
+			if err := ix.Apply(context.Background(), other); err != nil {
+				t.Fatal(err)
+			}
+		}
+		applyPreview(t, ix, avahiPreview(t, trunkNow, h1))
+		var got meshcatalog.CandidatesByGroupValuePullsItemFpsValue
+		for _, p := range candidateOf(t, cands).Pulls {
+			if p.Repository == catalogueRepo {
+				got = p.Fps["avahi"]
+			}
+		}
+		if got.Fp2 != trunk.Fp2 || !maps.Equal(got.Packages, tc.want) {
+			t.Errorf("%s: candidate avahi = %+v, want the trunk's fingerprint %s and the packages %v", tc.name, got, trunk.Fp2, tc.want)
+		}
+	}
 	// Another tree gives another fingerprint.
 	pv := avahiPreview(t, trunkNow, h1)
 	m := pv.Modules["modules/avahi"]

sdk/grouppackages/grouppackages.go

@@ -0,0 +1,65 @@
+// Package grouppackages is the one place that names the versions a build at a delivery group's heads uses (novox/hq
+// ADR 0573 §2, §4; issue 1921). A build writes into its workspace the version of every mesh package it is asked, whatever
+// its go.mod names; a requirement at the zero version that no ask names a commit for cannot be fetched. So every part
+// that asks a build for a check, a try or a candidate (the checker's check, judge and compose asks, the indexer's
+// candidate modules) takes the versions from Heads, and a member of the group that publishes no package yet is named too.
+package grouppackages
+
+import (
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/sdkversion"
+
+	"git.novox.be/novox/mesh-delivery/sdk/buildstep"
+	"git.novox.be/novox/mesh-delivery/sdk/trunk"
+)
+
+// rootOf is the module a member of repo stands for when no package of it is known: its root module path, or for the
+// repository of mesh-sdk its Go module (sdkversion.Module, which is not at the root).
+func rootOf(repo string) (string, bool) {
+	if sdkRepo, _, ok := trunk.PackageRepository(sdkversion.Module); ok && trunk.SameRepository(repo, sdkRepo) {
+		return sdkversion.Module, true
+	}
+	name, found := strings.CutPrefix(repo, "novox/")
+	if !found || name == "" {
+		return "", false
+	}
+	return trunk.ForgeModulePrefix + name, true
+}
+
+// Heads is the version of each mesh package a build of own builds against: latest (the latest published version of each
+// package the mesh's modules use, nil for none) with every package of a group member at that member's head (heads, by
+// repository <owner>/<name>, a full commit each), and for a member of which latest holds no package, the member's root
+// module path (mesh-sdk's Go module for mesh-sdk) at its head: the build module takes the head of a
+// repository from any package of it. A package of own comes with the tree the build fetched, and is left out, as is a
+// package no version is known of. Nil for none. latest is not changed.
+func Heads(latest buildstep.PackageVersions, heads map[string]string, own string) buildstep.PackageVersions {
+	versions := buildstep.PackageVersions{}
+	held := map[string]bool{}
+	for pkg, version := range latest {
+		repo, _, ok := trunk.PackageRepository(pkg)
+		if !ok || trunk.SameRepository(repo, own) {
+			continue
+		}
+		if head := heads[repo]; len(head) == 40 {
+			version = head
+		}
+		if version == "" {
+			continue
+		}
+		versions[pkg] = version
+		held[repo] = true
+	}
+	for repo, head := range heads {
+		if trunk.SameRepository(repo, own) || len(head) != 40 || held[repo] {
+			continue
+		}
+		if root, ok := rootOf(repo); ok {
+			versions[root] = head
+		}
+	}
+	if len(versions) == 0 {
+		return nil
+	}
+	return versions
+}