Carry mesh package versions in build asks and fingerprints

ADR 0573 §2 has every module build against the latest published version of
each mesh package it uses, chosen by the planner and written by the build,
never pinned by hand (issue 1585, S4). The ask, the fetch request and the
merge preview now carry the packages and their versions, and the new-form
fingerprint takes each version, so a package's trunk merge changes every
dependent's fingerprint. A module using no package keeps its fingerprint.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

go/delivery/source.go

@@ -284,6 +284,10 @@ type CandidateModule struct {
 	// Paths are, of a module whose every artifact names its paths, each named path's git object id at the preview
 	// (novox/hq ADR 0499 clause 2), so the builder's fetch request for the candidate names them. Absent otherwise.
 	Paths map[string]string `json:"paths,omitempty"`
+	// Packages are the versions of the mesh packages FP2 was computed with (novox/hq ADR 0573 §2, §4): the latest
+	// published version of each, or the head of the candidate's pull request that publishes it, so a group's candidate
+	// builds against the group's own package. Absent for none.
+	Packages PackageVersions `json:"packages,omitempty"`
 }
 
 func (m CandidateModule) check() error {
@@ -296,6 +300,9 @@ func (m CandidateModule) check() error {
 	if err := checkPathObjects(m.Paths); err != nil {
 		return err
 	}
+	if err := m.Packages.Check(); err != nil {
+		return err
+	}
 	return checkNewForm(m.FP2, m.Manifest)
 }
 
@@ -415,6 +422,10 @@ type Module struct {
 	// so the checker tells whether a change touches an artifact's build source without reading a manifest (the lead's
 	// decision L8 of R4e). Absent for an artifact that names none, and in a value written before.
 	ArtifactPaths map[string][]string `json:"paths,omitempty"`
+	// Packages are the versions of the mesh packages FP2 was computed with (novox/hq ADR 0573 §2): the trunk merge the
+	// indexer held for each package of Inputs2.Packages. A builder builds the fingerprint against exactly these
+	// (StepAsk.Packages). Empty when FP2 is empty or the module uses no mesh package.
+	Packages PackageVersions `json:"packages,omitempty"`
 }
 
 // RootPath is Module.Path of a module whose manifest is its repository's root.
@@ -433,6 +444,10 @@ type KeptInputs2 struct {
 	// computation from kept inputs gives the merge's value (novox/hq ADR 0499 clause 2). Absent for every other module,
 	// whose Tree is its directory's tree, and in a value written before.
 	Paths map[string]string `json:"paths,omitempty"`
+	// Packages are the mesh packages the module's lock file names (MeshPackagesOf, novox/hq ADR 0573 §2): the
+	// fingerprint takes the latest published version of each (Module.Packages). Absent for none, and in a value written
+	// before.
+	Packages []string `json:"packages,omitempty"`
 }
 
 // checkPathObjects refuses a named path that is not clean and relative to the module's directory, or names no object.
@@ -469,6 +484,19 @@ func (k KeptInputs2) With(module string, toolchains map[string]Toolchain2) Sourc
 		Locks: k.Locks, Toolchains: toolchains}
 }
 
+// WithPackages is With and the version of each package the module uses (Packages), as PackageVersionsOf read them: a
+// package with no version enters with none, and the fingerprint is then none (SourceFingerprint2).
+func (k KeptInputs2) WithPackages(module string, toolchains map[string]Toolchain2, versions PackageVersions) SourceInputs2 {
+	in := k.With(module, toolchains)
+	if len(k.Packages) > 0 {
+		in.Packages = map[string]string{}
+		for _, p := range k.Packages {
+			in.Packages[p] = versions[p]
+		}
+	}
+	return in
+}
+
 func (m Module) check() error {
 	switch {
 	case m.FP != "" && m.None != "":
@@ -485,6 +513,9 @@ func (m Module) check() error {
 			return fmt.Errorf("delivery: the module's toolchain of %q needs its version and its recipe version", language)
 		}
 	}
+	if err := m.Packages.Check(); err != nil {
+		return err
+	}
 	if m.Inputs2 != nil && m.Manifest == "" {
 		return fmt.Errorf("delivery: a module keeps new-form inputs but has no manifest digest")
 	}
@@ -534,9 +565,13 @@ type Forge struct {
 	// id at the same commit as its manifest, by path relative to the directory (novox/hq ADR 0499 clause 3). The
 	// indexer names the paths; a message without them gives such a module none. Older writers send none.
 	Paths map[string]map[string]string `json:"paths,omitempty"`
-	Act   string                       `json:"act,omitempty"`
-	Words string                       `json:"words,omitempty"`
-	Open  []OpenPull                   `json:"open,omitempty"`
+	// Packages are, of each module directory, the mesh packages its lock file names (MeshPackagesOf; novox/hq ADR 0573
+	// §2): the indexer keeps them in the module's inputs and takes each one's latest published version into its
+	// fingerprint. Absent for a directory that uses none, and from an older writer.
+	Packages map[string][]string `json:"packages,omitempty"`
+	Act      string              `json:"act,omitempty"`
+	Words    string              `json:"words,omitempty"`
+	Open     []OpenPull          `json:"open,omitempty"`
 	// RetiredPlacements is the placement files a bridge before ADR 0567 carried (ADR 0549 §2, ADR 0559 §2): placement is
 	// the seat mesh-placement's state now and no repository holds it (ADR 0567 §11), so a message carrying them is
 	// refused, loudly, rather than read with them dropped.