v0.329.0: each app reaches only its own appdata folder; empty allow-list; drive retirement asks the agent first; plain no-durable-id refusal; :latest only for a release

R-1142: the HDD_PATH root is appdata/<own folder>, with a compiled-in folder map (paperless-ngx ->
paperless). R-981: the allow-list is empty (homepage's socket served no Felhom feature). R-1063:
finalizeDecommissionWith asks the agent before it marks the drive or moves the default; the 403/409
come back typed and reach the household as a plain 409. R-1069: the agent's no-durable-id format
refusal is ErrNoDurableID and a plain sentence. R-1143: build.sh carries :latest only for x.y.z.
Each pinned by a red-proofed test. MinAgent 0.158.1.

CHANGELOG.md

@@ -1,3 +1,45 @@
+## v0.329.0 — each app reaches only its own data folder; homepage loses the Docker socket; a refused drive retirement changes nothing; a plain message for a virtual disk without a serial; `:latest` only for a release (R-1142, R-981, R-1063, R-1069, R-1143) (2026-10-18)
+
+**MinAgent: 0.158.1** — the floor's, carried. Nothing here calls a new agent route. No golden (`09` §3 decision 250).
+Task: the night brief of 2026-10-17 (felhom.eu `REPORT-night-2026-10-18.md`). **CATALOG ORDER:** the catalog commit that
+drops homepage's socket and carries the new list copy is pushed FIRST — this controller refuses the old homepage
+template (the socket has no exception any more); an older controller accepts the new template.
+
+- **R-1142 — the data root under `${HDD_PATH}` is the app's OWN folder.** `privpolicy` judges a bind under
+  `${HDD_PATH}/appdata/<folder>/` only, `<folder>` being the app's name or its entry in the list's new
+  `appdata_folders` map (one entry: `paperless-ngx` → `paperless`; the survey of every template, the drill catalog and
+  the three test boxes found no other slug ≠ folder — felhom.eu `audits/night-2026-10-18/P1/`). The map is compiled in
+  with the list (`allowlist.json` v2), because the catalog is the threat and must not name the folder. An app with no
+  usable name gets no `HDD_PATH` root (fail closed). `Check` now takes the app. Tests:
+  `TestAdmit_AnotherAppsAppdataFolderIsRefused` (app A binding app B's folder, the whole `appdata/`, a look-alike
+  name, the slug where a folder is listed, a literal path to another app → refused; own folder, sub-folder, listed
+  folder → admitted), `TestAllowList_AppdataFolderMustBeOneName`. Red-proof: root back at `${HDD_PATH}/appdata` → six
+  cases admitted.
+- **R-981 — the allow-list is EMPTY.** Homepage's read-only Docker socket served no Felhom feature: on demo-hp its
+  rendered `docker.yaml` is empty and no container carries `homepage.*` labels (`audits/night-2026-10-18/P1/
+  r981-homepage-before.txt`). The catalog template drops the mount; the list drops the entry, so the socket is refused
+  for every app. The entry-binding rules (image, start, healthcheck) stay pinned on a test list
+  (`withTestAllowList`), so a future entry is held to them. `TestAllowList_HasNoExceptionAndRefusesHomepagesSocket`;
+  red-proof: the old one-entry list compiled in → fails.
+- **R-1063 — „Végleges leszerelés" asks the agent FIRST.** `finalizeDecommissionWith` marks the drive decommissioned and
+  moves the default only after the agent's yes. The agent's 403 (protected role) and 409 (the drive holds the system
+  backup) come back typed (`agentapi.DecommissionRefusedError`) and reach the household as a 409 with a plain sentence
+  (`err.web.decommission_protected`, `err.web.decommission_backup_target`, HU + EN): nothing changed, and what to do.
+  `TestFinalizeDecommission_AgentRefusalChangesNothing` (403, 409, a transport failure), `TestDecommission_
+  PolicyRefusalsAreTyped` (a fake agent over TLS). Red-proof: the old order → the drive reads decommissioned, the
+  default moved.
+- **R-1069 — a virtual disk without a serial gets a plain refusal.** The agent's anti-retarget refusal of a blank
+  format („device has no durable id …", 409) is `agentapi.ErrNoDurableID`; the format endpoint, the drive init and the
+  wipe say `disk.err.no_durable_id` (HU + EN: the dashboard cannot format it, the disk did not change, the operator or
+  whoever set up the virtual machine can give it a serial number or a SATA bus). The agent's rule is unchanged.
+  `TestR1069_NoDurableIDIsAPlainRefusal`, `TestFormatDisk_NoDurableIDIsTyped`. No page changed: the text travels in
+  the JSON answer, so no new fixture.
+- **R-1143 — `build.sh` moves `:latest` only for a release tag (x.y.z).** One `TAGS` array feeds the build, the push and
+  the multiarch leg; `--print-tags` prints it and stops. `scripts/test_build_push_once.sh` (16 cases): rc/dev/`0.999`
+  carry no `:latest`, `0.999.0` does; the test now runs a COPY of `build.sh` (in place, its workspace was inside the
+  source it copies — the „local build" case failed on HEAD too). Red-proof: every build adding `:latest` → 4 cases fail.
+- i18n: three keys born as keys (`scripts/i18n_go_keys.json`); every page fixture byte-identical.
+
 ## v0.328.0 — the catalog allow-list: the box refuses container rights a template asks for and the box does not give (R-971, operator decision D2 = A) (2026-10-17)
 
 **MinAgent: 0.158.1** — the floor's, carried. Nothing here calls a new agent route. No golden (`09` §3 decision 250).