v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A)

internal/privpolicy checks the RENDERED compose (privileged, cap_add, devices, host namespaces, security_opt,
sysctls, volumes_from, build/include/extends, env_file/config files outside the stack dir, aliasing named volumes,
binds outside the box's data roots, the Docker socket, propagation, ${VAR} in a privileged key) against an
allow-list compiled into the controller (one entry: homepage's read-only socket). Asked before every compose
write: the 15-minute sync, the guarded update/ladder step, the install, both settings changes, both restores
(before the stop). A refusal writes nothing, keeps the app on its last good compose, raises the operator-only
event app_definition_refused once per definition and puts one line on the app page. The sync never copies a
template named like a controller infra stack. Structural guard TestAllowList_IsWiredIntoEveryComposeWriter.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/pin.go

@@ -348,6 +348,18 @@ func (m *Manager) advancePinTo(name, stackDir, src, metaSrc string) error {
 
 	// v0.269.0 (`09` §6.4 part 6): run EXACTLY the tested images — the ladder entry's digests for these refs.
 	data = RenderWithLadderDigests(filepath.Dir(m.CatalogTemplatePath(name, "docker-compose.yml")), data)
+	// R-971: the new definition must pass the box's allow-list before anything is stored — a refused update leaves
+	// the app on its last good compose, running.
+	var env map[string]string
+	if dec := LoadAppConfigDecrypted(stackDir, m.encKey); dec != nil {
+		env = dec.Env
+	}
+	if env == nil {
+		env = map[string]string{}
+	}
+	if err := m.admitCompose(name, data, env); err != nil {
+		return err
+	}
 	live := ComposePathIn(stackDir)
 	if err := StoreAppliedDefinition(stackDir, data); err != nil {
 		return fmt.Errorf("storing the new applied definition for %s: %w", name, err)