v0.316.4: build.sh refuses a push from a dirty or unpushed tree

An admission and its mechanism. Building 0.316.3 published another session's work: the shared
DooPlex clone held 31 uncommitted files, and the build directory's build.sh is a symlink into that
clone's WORKING COPY — which predated the FELHOM_REPO_DIR override, so the override was ignored and
the build copied the shared tree. The banner printed 'Commit: 0225255' and no 'Repo:' line; the
evidence was on screen and the image was already pushed. Nobody deployed it, which is luck, not a
control.

The clean-tree rule has been a sentence in a runbook all along. A rule without a mechanism is a
wish, so it is now two questions the build asks and refuses on: is every tracked file committed,
and is HEAD what origin/main has. A directory that is not a git checkout is refused too — a build
whose source cannot be identified is not reproducible.

Four new cases in the test (ten in total), each driving the real script; red-proved by deleting the
gate, which fails all four.

0.316.3 must never be deployed. It is not re-pushed or deleted: a version number is pushed once,
and that applies to a number I spoiled.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y

controller/scripts/test_build_push_once.sh

@@ -72,7 +72,7 @@ check() {
     echo "  ok   $name"
 }
 
-echo "build.sh — a version number is pushed once"
+echo "build.sh — a version number is pushed once, from a clean tree"
 
 # 1. The tag is already in the registry -> refuse, before building, and push nothing.
 run_build present 0.999.0 --push
@@ -102,6 +102,46 @@ check "--push, auth failure -> refuses" 1 "Could not establish whether" "FAKE-DO
 run_build present 0.999.0
 check "local build, tag present -> not refused" 0 "" "already exists in the registry"
 
+# ── THE SOURCE TREE MUST BE CLEAN AND PUSHED (v0.316.4) ─────────────────────────────────────────
+# Earned the same evening: a build from the shared clone, which held 31 files of another session's
+# work in progress, published their unreleased code under this repo's version number.
+scratch_repo() {
+    local d; d="$(mktemp -d)"
+    git -C "$d" init -q 2>/dev/null
+    git -C "$d" config user.email t@t; git -C "$d" config user.name t
+    mkdir -p "$d/controller"; echo x > "$d/controller/f"
+    git -C "$d" add -A >/dev/null; git -C "$d" commit -qm one >/dev/null
+    git -C "$d" update-ref refs/remotes/origin/main HEAD
+    echo "$d"
+}
+run_build_in() {   # $1 = mode, $2 = repo dir, rest = args
+    local mode="$1" repo="$2"; shift 2
+    local tmp; tmp="$(mktemp -d)"
+    make_fake_docker "$tmp/bin"
+    FAKE_MODE="$mode" FELHOM_REPO_DIR="$repo" PATH="$tmp/bin:$PATH" bash "$BUILD_SH" "$@" >"$tmp/out" 2>&1
+    rc=$?; out="$(cat "$tmp/out")"; rm -rf "$tmp"; return $rc
+}
+
+CLEAN_REPO="$(scratch_repo)"
+run_build_in absent "$CLEAN_REPO" 0.999.0 --push
+check "clean + at origin/main -> proceeds" "$rc" "Source tree is clean and at origin/main" "refusing to push"
+
+echo "dirt" > "$CLEAN_REPO/controller/uncommitted"
+run_build_in absent "$CLEAN_REPO" 0.999.0 --push
+check "dirty tree -> refuses" 1 "uncommitted change" "FAKE-DOCKER-REACHED"
+rm -f "$CLEAN_REPO/controller/uncommitted"
+
+echo y > "$CLEAN_REPO/controller/f2"
+git -C "$CLEAN_REPO" add -A >/dev/null; git -C "$CLEAN_REPO" commit -qm two >/dev/null
+run_build_in absent "$CLEAN_REPO" 0.999.0 --push
+check "ahead of origin/main -> refuses" 1 "not at origin/main" "FAKE-DOCKER-REACHED"
+rm -rf "$CLEAN_REPO"
+
+NOT_A_REPO="$(mktemp -d)"; mkdir -p "$NOT_A_REPO/controller"
+run_build_in absent "$NOT_A_REPO" 0.999.0 --push
+check "not a git checkout -> refuses" 1 "not a git checkout" "FAKE-DOCKER-REACHED"
+rm -rf "$NOT_A_REPO"
+
 echo
 if [[ $fails -eq 0 ]]; then
     echo "all $ran cases behaved — a pushed version cannot be overwritten"