Merge main into feat/r4g-finish (#453)

internal/inventory/chain_builds.go

@@ -658,9 +658,11 @@ func (i *Inventory) chainBuildByID(ctx context.Context, c *chain.Chain, id strin
 	if err != nil || !ok {
 		return Build{}, false, err
 	}
+	// **The fingerprint read back with the rest** (novox/hq issue 1938): the controller's grants are keyed by it
+	// (grants.go currentFingerprints), and a build read without it wrote no grant at all from 2026-10-18 on.
 	b := fromChainBuild(rec)
 	return Build{ID: b.ID, Repository: b.Repository, Ref: b.Ref, Module: b.Module, Commit: b.Commit, On: b.On,
-		Failed: b.Failed, Made: b.Made, Path: b.Path, Asked: b.Asked, At: b.At}, true, nil
+		Failed: b.Failed, Made: b.Made, Path: b.Path, Asked: b.Asked, At: b.At, SourceFingerprint: b.SourceFingerprint}, true, nil
 }
 
 func (i *Inventory) chainBuiltAgainst(ctx context.Context, c *chain.Chain) (map[string][]string, error) {

internal/inventory/chain_store_test.go

@@ -26,6 +26,7 @@ func TestBuildsOnTheBusAreReadBackByEveryReader(t *testing.T) {
 	first.ReuseKey = "rk-1"
 	second := aBuild("build-2", "notes", "")
 	second.Commit = "c2"
+	second.SourceFingerprint = "src2:" + strings.Repeat("2", 64)
 	failed := aBuild("build-3", "notes", "compile error")
 	other := aBuild("build-4", "wiki", "")
 	for _, b := range []Build{first, second, failed, other, first} {
@@ -48,6 +49,10 @@ func TestBuildsOnTheBusAreReadBackByEveryReader(t *testing.T) {
 	if err != nil || !found || one.Commit != "c2" || one.Module != "notes" {
 		t.Fatalf("build-2 reads as %+v %v %v", one, found, err)
 	}
+	// 1938: the fingerprint is read back, which the controller's grants are keyed by.
+	if one.SourceFingerprint != second.SourceFingerprint {
+		t.Errorf("build-2 reads back the fingerprint %q; want %q", one.SourceFingerprint, second.SourceFingerprint)
+	}
 	if _, found, _ := inv.BuildByID(ctx, "build-nope"); found {
 		t.Fatal("a build nobody recorded was found")
 	}