delivery, catalogue: the node-engine's compose-candidate verb, compositions carrying their plan or refusal, the kept import form and a build's imports on its key, so the engine alone composes and the indexer switches form without a rebuild (ADR 0593 §4, §6, §7)

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

go/delivery/source.go

@@ -472,6 +472,11 @@ type KeptInputs2 struct {
 	// the fingerprint takes each one's content digest (PublishedPackages) instead of Packages' versions. Absent for a
 	// module with no reported import set, which keeps the version line, and in a value written before.
 	Imports []string `json:"imports,omitempty"`
+	// ImportForm is the import-form fingerprint (src2: and 64 hex digits) of the inputs the build that reported Imports
+	// was built from (novox/hq ADR 0593 §4): set by the indexer when it keeps a build's Imports, while FP2 is still the
+	// form that build was asked at. A recompute whose import-form fingerprint equals it keeps FP2 as it is (the build
+	// stands); one that differs writes the import form. Absent with no Imports, and in a value written before.
+	ImportForm string `json:"import-form,omitempty"`
 }
 
 // checkPathObjects refuses a named path that is not clean and relative to the module's directory, or names no object.
@@ -557,6 +562,9 @@ func (m Module) check() error {
 		if err := CheckImports(m.Inputs2.Imports); err != nil {
 			return err
 		}
+		if f := m.Inputs2.ImportForm; f != "" && (len(m.Inputs2.Imports) == 0 || !strings.HasPrefix(f, SourcePrefix2) || !isHex64(f[len(SourcePrefix2):])) {
+			return fmt.Errorf("delivery: the kept import form %q is set only with imports, and is %s and 64 hex digits", f, SourcePrefix2)
+		}
 		if err := checkNamed(m.Inputs2.Tree, m.Manifest, m.Inputs2.Paths, "the module's kept inputs"); err != nil {
 			return err
 		}