v0.329.0: each app reaches only its own appdata folder; empty allow-list; drive retirement asks the agent first; plain no-durable-id refusal; :latest only for a release

R-1142: the HDD_PATH root is appdata/<own folder>, with a compiled-in folder map (paperless-ngx ->
paperless). R-981: the allow-list is empty (homepage's socket served no Felhom feature). R-1063:
finalizeDecommissionWith asks the agent before it marks the drive or moves the default; the 403/409
come back typed and reach the household as a plain 409. R-1069: the agent's no-durable-id format
refusal is ErrNoDurableID and a plain sentence. R-1143: build.sh carries :latest only for x.y.z.
Each pinned by a red-proofed test. MinAgent 0.158.1.

controller/scripts/test_build_push_once.sh

@@ -47,7 +47,10 @@ run_build() {
     local mode="$1"; shift
     local tmp; tmp="$(mktemp -d)"
     make_fake_docker "$tmp/bin"
-    FAKE_MODE="$mode" PATH="$tmp/bin:$PATH" bash "$BUILD_SH" "$@" >"$tmp/out" 2>&1
+    # build.sh is run from a COPY in the throwaway dir, as the build dir runs it (through its symlink): its workspace
+    # is <its own dir>/workspace, and run in place that is inside the source it copies (cp: into itself, 2026-10-18).
+    cp "$BUILD_SH" "$tmp/build.sh"
+    FAKE_MODE="$mode" PATH="$tmp/bin:$PATH" bash "$tmp/build.sh" "$@" >"$tmp/out" 2>&1
     rc=$?
     out="$(cat "$tmp/out")"
     rm -rf "$tmp"
@@ -118,7 +121,8 @@ run_build_in() {   # $1 = mode, $2 = repo dir, rest = args
     local mode="$1" repo="$2"; shift 2
     local tmp; tmp="$(mktemp -d)"
     make_fake_docker "$tmp/bin"
-    FAKE_MODE="$mode" FELHOM_REPO_DIR="$repo" PATH="$tmp/bin:$PATH" bash "$BUILD_SH" "$@" >"$tmp/out" 2>&1
+    cp "$BUILD_SH" "$tmp/build.sh"
+    FAKE_MODE="$mode" FELHOM_REPO_DIR="$repo" PATH="$tmp/bin:$PATH" bash "$tmp/build.sh" "$@" >"$tmp/out" 2>&1
     rc=$?; out="$(cat "$tmp/out")"; rm -rf "$tmp"; return $rc
 }
 
@@ -142,6 +146,18 @@ run_build_in absent "$NOT_A_REPO" 0.999.0 --push
 check "not a git checkout -> refuses" 1 "not a git checkout" "FAKE-DOCKER-REACHED"
 rm -rf "$NOT_A_REPO"
 
+# ── :latest MOVES WITH A RELEASE ONLY (R-1143, 2026-10-18) ──────────────────────────────────────────
+# rc.1–rc.5 of 0.328.0 each moved :latest. --print-tags prints the very TAGS array the push and multiarch legs use.
+# RED-PROOF: with the release-tag condition removed (every build adds :latest), the two rc/dev cases fail.
+for v in 0.999.0-rc.1 0.999.0-rc.12 dev 0.999; do
+    run_build absent "$v" --print-tags
+    check "--print-tags $v -> no :latest" 0 "felhom-controller:$v" "felhom-controller:latest"
+done
+run_build absent 0.999.0 --print-tags
+check "--print-tags 0.999.0 (a release) -> :latest too" 0 "felhom-controller:latest" ""
+grep -q 'docker push "${IMAGE}:latest"' "$BUILD_SH" && { fails=$((fails+1)); echo "  FAIL a push of :latest outside the TAGS array"; }
+ran=$((ran+1))
+
 echo
 if [[ $fails -eq 0 ]]; then
     echo "all $ran cases behaved — a pushed version cannot be overwritten"