v0.329.0: each app reaches only its own appdata folder; empty allow-list; drive retirement asks the agent first; plain no-durable-id refusal; :latest only for a release

R-1142: the HDD_PATH root is appdata/<own folder>, with a compiled-in folder map (paperless-ngx ->
paperless). R-981: the allow-list is empty (homepage's socket served no Felhom feature). R-1063:
finalizeDecommissionWith asks the agent before it marks the drive or moves the default; the 403/409
come back typed and reach the household as a plain 409. R-1069: the agent's no-durable-id format
refusal is ErrNoDurableID and a plain sentence. R-1143: build.sh carries :latest only for x.y.z.
Each pinned by a red-proofed test. MinAgent 0.158.1.

controller/scripts/i18n_go_keys.json

@@ -274,7 +274,10 @@
     "filebrowser.reset_not_operator": "BORN AS A KEY (v0.320.0, 2026-10-16) -- the new-password press refused because the box already knows the file manager's password. Pinned by web TestFileBrowserResetEndpoint_Refusals.",
     "filebrowser.reset_failed": "BORN AS A KEY (v0.320.0, 2026-10-16) -- the new-password press failed (apply or verify); the state stays operator. Pinned by stacks TestFileBrowserReset_FailedVerifyKeepsOperator.",
     "note.tier2.no_space_ssd": "REWORDED (v0.321.0, 2026-10-16) -- plain words on the app page's Data tab: no 'off-drive', no 'DB/konfiguracio'. Pinned by web TestAppData_OneBackupSection.",
-    "note.tier2.reason_no_second": "REWORDED (v0.321.0, 2026-10-16) -- plain words on the app page's Data tab: no 'off-drive', no 'DB/konfiguracio'. Pinned by web TestAppData_OneBackupSection."
+    "note.tier2.reason_no_second": "REWORDED (v0.321.0, 2026-10-16) -- plain words on the app page's Data tab: no 'off-drive', no 'DB/konfiguracio'. Pinned by web TestAppData_OneBackupSection.",
+    "disk.err.no_durable_id": "BORN AS A KEY (R-1069, 2026-10-18) -- the plain refusal for a disk the agent cannot bind a format to (a virtio disk without a serial); replaces the agent's raw English text. Pinned by internal/web TestR1069_NoDurableIDIsAPlainRefusal.",
+    "err.web.decommission_backup_target": "BORN AS A KEY (R-1063, 2026-10-18) -- the agent's 409 to a drive retirement (the drive holds the system backup), in plain words; nothing changed. Pinned by internal/web TestFinalizeDecommission_AgentRefusalChangesNothing.",
+    "err.web.decommission_protected": "BORN AS A KEY (R-1063, 2026-10-18) -- the agent's 403 to a drive retirement (a protected system/backup disk), in plain words; nothing changed. Pinned by internal/web TestFinalizeDecommission_AgentRefusalChangesNothing."
   },
   "flash.share.already_on": "A megosztás már be van kapcsolva.",
   "flash.share.enable_failed": "A megosztás bekapcsolása nem sikerült.",

controller/scripts/test_build_push_once.sh

@@ -47,7 +47,10 @@ run_build() {
     local mode="$1"; shift
     local tmp; tmp="$(mktemp -d)"
     make_fake_docker "$tmp/bin"
-    FAKE_MODE="$mode" PATH="$tmp/bin:$PATH" bash "$BUILD_SH" "$@" >"$tmp/out" 2>&1
+    # build.sh is run from a COPY in the throwaway dir, as the build dir runs it (through its symlink): its workspace
+    # is <its own dir>/workspace, and run in place that is inside the source it copies (cp: into itself, 2026-10-18).
+    cp "$BUILD_SH" "$tmp/build.sh"
+    FAKE_MODE="$mode" PATH="$tmp/bin:$PATH" bash "$tmp/build.sh" "$@" >"$tmp/out" 2>&1
     rc=$?
     out="$(cat "$tmp/out")"
     rm -rf "$tmp"
@@ -118,7 +121,8 @@ run_build_in() {   # $1 = mode, $2 = repo dir, rest = args
     local mode="$1" repo="$2"; shift 2
     local tmp; tmp="$(mktemp -d)"
     make_fake_docker "$tmp/bin"
-    FAKE_MODE="$mode" FELHOM_REPO_DIR="$repo" PATH="$tmp/bin:$PATH" bash "$BUILD_SH" "$@" >"$tmp/out" 2>&1
+    cp "$BUILD_SH" "$tmp/build.sh"
+    FAKE_MODE="$mode" FELHOM_REPO_DIR="$repo" PATH="$tmp/bin:$PATH" bash "$tmp/build.sh" "$@" >"$tmp/out" 2>&1
     rc=$?; out="$(cat "$tmp/out")"; rm -rf "$tmp"; return $rc
 }
 
@@ -142,6 +146,18 @@ run_build_in absent "$NOT_A_REPO" 0.999.0 --push
 check "not a git checkout -> refuses" 1 "not a git checkout" "FAKE-DOCKER-REACHED"
 rm -rf "$NOT_A_REPO"
 
+# ── :latest MOVES WITH A RELEASE ONLY (R-1143, 2026-10-18) ──────────────────────────────────────────
+# rc.1–rc.5 of 0.328.0 each moved :latest. --print-tags prints the very TAGS array the push and multiarch legs use.
+# RED-PROOF: with the release-tag condition removed (every build adds :latest), the two rc/dev cases fail.
+for v in 0.999.0-rc.1 0.999.0-rc.12 dev 0.999; do
+    run_build absent "$v" --print-tags
+    check "--print-tags $v -> no :latest" 0 "felhom-controller:$v" "felhom-controller:latest"
+done
+run_build absent 0.999.0 --print-tags
+check "--print-tags 0.999.0 (a release) -> :latest too" 0 "felhom-controller:latest" ""
+grep -q 'docker push "${IMAGE}:latest"' "$BUILD_SH" && { fails=$((fails+1)); echo "  FAIL a push of :latest outside the TAGS array"; }
+ran=$((ran+1))
+
 echo
 if [[ $fails -eq 0 ]]; then
     echo "all $ran cases behaved — a pushed version cannot be overwritten"