v0.329.0: each app reaches only its own appdata folder; empty allow-list; drive retirement asks the agent first; plain no-durable-id refusal; :latest only for a release

R-1142: the HDD_PATH root is appdata/<own folder>, with a compiled-in folder map (paperless-ngx ->
paperless). R-981: the allow-list is empty (homepage's socket served no Felhom feature). R-1063:
finalizeDecommissionWith asks the agent before it marks the drive or moves the default; the 403/409
come back typed and reach the household as a plain 409. R-1069: the agent's no-durable-id format
refusal is ErrNoDurableID and a plain sentence. R-1143: build.sh carries :latest only for x.y.z.
Each pinned by a red-proofed test. MinAgent 0.158.1.

controller/build.sh

@@ -12,6 +12,9 @@
 #   ./build.sh 0.1.0              # Build with version tag
 #   ./build.sh 0.1.0 --push       # Build + push to Gitea registry
 #   ./build.sh 0.1.0 --multiarch  # Build amd64+arm64 + push
+#   ./build.sh 0.1.0 --print-tags # Print the tags a build would carry, and stop (the R-1143 test)
+#
+# :latest is carried ONLY by a release tag (x.y.z). An -rc, dev or any other tag never moves it (R-1143).
 # =============================================================================
 set -euo pipefail
 
@@ -41,6 +44,21 @@ warn()  { echo -e "${YELLOW}[WARN]${NC}  $*"; }
 error() { echo -e "${RED}[ERROR]${NC} $*"; }
 step()  { echo -e "${CYAN}[STEP]${NC}  $*"; }
 
+# --- The tags this build carries (R-1143, 2026-10-18) ---
+# Until v0.328.0 every build moved :latest, release candidates included (rc.1–rc.5 each did on 2026-10-17). Nothing
+# current pulls :latest — the update button takes the highest x.y.z tag — but a legacy-shaped box following it would
+# have taken an rc. So :latest moves with a RELEASE only. Pinned by scripts/test_build_push_once.sh.
+TAGS=("${IMAGE}:${VERSION}")
+if [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    TAGS+=("${IMAGE}:latest")
+fi
+TAG_ARGS=()
+for t in "${TAGS[@]}"; do TAG_ARGS+=(-t "$t"); done
+if [[ "${ACTION}" == "--print-tags" ]]; then
+    printf '%s\n' "${TAGS[@]}"
+    exit 0
+fi
+
 # --- Pre-flight checks ---
 if [[ ! -d "${CONTROLLER_SRC}" ]]; then
     error "Controller source not found: ${CONTROLLER_SRC}"
@@ -243,14 +261,10 @@ BUILD_ARGS=(
 case "${ACTION}" in
     --push)
         info "Building for current platform + pushing..."
-        docker build "${BUILD_ARGS[@]}" \
-            -t "${IMAGE}:${VERSION}" \
-            -t "${IMAGE}:latest" \
-            .
+        docker build "${BUILD_ARGS[@]}" "${TAG_ARGS[@]}" .
 
         info "Pushing..."
-        docker push "${IMAGE}:${VERSION}"
-        docker push "${IMAGE}:latest"
+        for t in "${TAGS[@]}"; do docker push "$t"; done
         ;;
 
     --multiarch)
@@ -266,18 +280,14 @@ case "${ACTION}" in
 
         docker buildx build "${BUILD_ARGS[@]}" \
             --platform linux/amd64,linux/arm64 \
-            -t "${IMAGE}:${VERSION}" \
-            -t "${IMAGE}:latest" \
+            "${TAG_ARGS[@]}" \
             --push \
             .
         ;;
 
     *)
         info "Building for current platform (local only)..."
-        docker build "${BUILD_ARGS[@]}" \
-            -t "${IMAGE}:${VERSION}" \
-            -t "${IMAGE}:latest" \
-            .
+        docker build "${BUILD_ARGS[@]}" "${TAG_ARGS[@]}" .
         ;;
 esac