compose-candidate reads the indexer's candidate by its group key, not the check's key

The checker asks by the composition key, <group>.<heads hash> (ADR 0593 §7), but the
indexer keys a candidate by its group alone (delivery.CandidatesKey). The node-engine
read the ask's key as the bucket key, so every check's composition was refused on
every node with "the indexer holds no candidate" (mesh-catalog #599, 2026-11-02).

It now parses the ask, reads CandidatesKey(group), and answers unready when the
group's candidate has moved to other heads. Both tests' fixtures had captured the
wrong key; they now key by group, with a slash in the group name.

Quick fix: this lookup. Thorough fix (a shared SDK reader that takes a composition
key and returns the candidate at those heads) not taken: one reader, one repository.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

internal/selfcompose/candidate_test.go

@@ -29,21 +29,24 @@ func TestTheNodeComposesACandidateOnAsk(t *testing.T) {
 		key, _ := delivery.ManifestsKey(d)
 		b.kv[delivery.ManifestsBucket+"/"+key] = man
 	}
-	candidateOf := func(manifest string) string {
+	// The indexer keys a candidate by its group alone (delivery.CandidatesKey, the branch name escaped, a slash
+	// allowed), its heads hash inside the value; the checker asks by the composition key, `<group>.<heads hash>`.
+	candidateOf := func(group, manifest string) string {
 		head := delivery.Head{Repository: "novox/x", Number: 7, Head: "c0ffee" + manifest[len(manifest)-6:]}
 		heads, _ := delivery.HeadsHash([]delivery.Head{head})
 		pulls := []delivery.CandidatePull{{Head: head, Modules: []string{"lemurs"},
 			Fps: map[string]delivery.CandidateModule{"lemurs": {FP2: fpNew, Manifest: manifest}}}}
-		raw, err := delivery.EncodeCandidate(delivery.Candidate{Group: "novox/x#7", HeadsHash: heads, Pulls: pulls,
+		raw, err := delivery.EncodeCandidate(delivery.Candidate{Group: group, HeadsHash: heads, Pulls: pulls,
 			FPSet: delivery.FingerprintSet(pulls)})
 		if err != nil {
 			t.Fatal(err)
 		}
-		key, _ := delivery.CompositionKey("novox/x#7", heads)
-		b.kv[delivery.CandidatesBucket+"/"+key] = raw
+		ckey, _ := delivery.CandidatesKey(group)
+		b.kv[delivery.CandidatesBucket+"/"+ckey] = raw
+		key, _ := delivery.CompositionKey(group, heads)
 		return key
 	}
-	accepted, refusedKey := candidateOf(digest2), ""
+	accepted, refusedKey := candidateOf("fix/940-no-retire-on-partial-read", digest2), ""
 	{
 		// The same change, its manifest refused by the indexer's judge.
 		refusedMan := strings.Replace(lemurs2, `"version":"2"`, `"version":"3"`, 1)
@@ -58,7 +61,7 @@ func TestTheNodeComposesACandidateOnAsk(t *testing.T) {
 			t.Fatal(err)
 		}
 		b.kv[delivery.VerdictsBucket+"/"+vkey] = v
-		refusedKey = candidateOf(d3)
+		refusedKey = candidateOf("fix/941-refused", d3)
 	}
 
 	env := b.env()
@@ -114,6 +117,13 @@ func TestTheNodeComposesACandidateOnAsk(t *testing.T) {
 	if m := s.ComposeCandidate(ctx, delivery.ComposeCandidateAsk{Candidate: missing}); !strings.Contains(m.Refused, "holds no candidate") {
 		t.Errorf("a candidate the indexer does not hold answered %+v", m)
 	}
+	// The group's candidate moved to other heads since the ask: the node composes not the one asked, and answers
+	// unready (no answer), naming the heads it holds.
+	moved, _ := delivery.CompositionKey("fix/940-no-retire-on-partial-read", "0123456789ab")
+	if m := s.ComposeCandidate(ctx, delivery.ComposeCandidateAsk{Candidate: moved}); m.Verdict != delivery.ComposeCandidateUnready ||
+		!strings.Contains(m.Refused, "heads") {
+		t.Errorf("a candidate at other heads answered %+v", m)
+	}
 	ended, end := context.WithCancel(ctx)
 	end()
 	if e := s.ComposeCandidate(ended, delivery.ComposeCandidateAsk{Candidate: accepted}); e.Verdict != delivery.ComposeCandidateUnready {