Apps burndown (controller 0.321.0 released): R-1097, R-1102, R-1101, R-1095, R-1098 closed; R-1103 opened; build-hub.sh 1.25.0

build-hub.sh refuses an existing tag and an unanswered registry (test_build_hub_push_once.sh, red-proved).
Register 179 -> 175. R-1067 stays BLOCKED: Tester-2 reports 0.292.0. Design notes in 02 and 07; STATUS;
evidence audits/burndown-apps-2026-10-16/; REPORT-burndown-apps-2026-10-16.md.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 2026-10-16 — build-hub.sh 1.25.0: a version number is pushed once (R-1098)
+
+`scripts/build-hub.sh` refuses `--push`/`--multiarch` of a tag the registry already has, and refuses when the registry
+cannot say (unreachable, auth failure) — before the build, the controller `build.sh` rule (`09-update-architecture.md`
+§0). Local builds are unaffected. Test: `scripts/test_build_hub_push_once.sh` (6 cases, the real script, a fake
+`docker`), red-proved: with the check removed, 5 cases fail. The tree-gate test still passes. No hub image change.
+
 ## 2026-10-16 — felhom-host-install.sh 1.33.0: the data volume by the ruled table; the internal data place (step 5b)
 
 `architecture/16-storage-physical-identity.md` §5, §7 (sizes ruled by the operator 2026-10-16 after the build B space check,

scripts/build-hub.sh

@@ -19,7 +19,7 @@
 # =============================================================================
 set -euo pipefail
 
-SCRIPT_VERSION="1.24.0"
+SCRIPT_VERSION="1.25.0"
 
 # --- Configuration (edit these if your paths differ) ---
 # FELHOM_HUB_REPO_DIR builds from another clone (a session's own clean clone; the script's own test) — the same
@@ -56,6 +56,32 @@ if ! command -v docker &>/dev/null; then
     exit 1
 fi
 
+# =========================================================================
+# Step 0: a version number is pushed ONCE (R-1098, v1.25.0) — the controller build.sh's check, word for word in effect
+# =========================================================================
+# A box (and the hub's floor) compares VERSIONS; two images under one number mean a pod can run either and nobody can
+# tell (`09-update-architecture.md` §0: controller 0.315.0 was pushed three times). The check runs BEFORE the build, so
+# a refusal costs no minutes. An unreachable registry is a REFUSAL too: the point is to prove the tag is new, and
+# "I could not ask" is not that proof. Local builds (no --push) are unaffected. `docker manifest inspect` is the probe,
+# so a test puts a fake `docker` on PATH: scripts/test_build_hub_push_once.sh.
+if [[ "${ACTION}" == "--push" || "${ACTION}" == "--multiarch" ]]; then
+    step "0/3 — Checking the registry: is ${VERSION} already published?"
+    probe_rc=0
+    probe_out=$(docker manifest inspect "${IMAGE}:${VERSION}" 2>&1) || probe_rc=$?
+    if [[ ${probe_rc} -eq 0 ]]; then
+        error "${IMAGE}:${VERSION} already exists in the registry — bump the version."
+        error "A version number is pushed once. If this is a fix for something already pushed, release it as the next"
+        error "patch version instead."
+        exit 1
+    fi
+    if ! grep -qiE 'no such manifest|manifest unknown|not found|does not exist|NAME_UNKNOWN|MANIFEST_UNKNOWN' <<<"${probe_out}"; then
+        error "Could not establish whether ${IMAGE}:${VERSION} exists — refusing to build."
+        error "The registry answered: ${probe_out}"
+        exit 1
+    fi
+    info "${VERSION} is not present in the registry — proceeding."
+fi
+
 # =========================================================================
 # Step 1: the clean-tree gate (R-1021) — fetch, pull, and REFUSE a stale or dirty tree
 # =========================================================================

scripts/test_build_hub_push_once.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# test_build_hub_push_once.sh — build-hub.sh refuses to push a version the registry already has (R-1098).
+#
+# Same shape as felhom-controller/controller/scripts/test_build_push_once.sh: a fake `docker` first on PATH answers
+# `manifest inspect` as FAKE_MODE says and reports any build/push it is asked for, so nothing is ever built or pushed.
+# The REAL build-hub.sh runs (a copy next to a scratch clean clone, so its workspace/ is scratch too) — the test cannot
+# pass with the check deleted, which is the red-proof.
+#   tag present            -> refused, "already exists", no build reached
+#   tag absent             -> "is not present", proceeds
+#   registry unreachable   -> refused, "Could not establish"
+#   auth failure           -> refused, "Could not establish"
+#   --multiarch, present   -> refused
+#   local build, present   -> not refused (the check does not run)
+# Run: bash scripts/test_build_hub_push_once.sh   (exit 0 all cases right · 1 a case wrong)
+set -uo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+WS="$(mktemp -d)"
+trap 'rm -rf "${WS:?}"' EXIT
+fails=0; ran=0
+
+mkdir -p "$WS/bin" "$WS/build"
+cat > "$WS/bin/docker" <<'FAKE'
+#!/bin/bash
+case "$1 $2" in
+  "manifest inspect")
+    case "${FAKE_MODE}" in
+      present) echo '{"schemaVersion":2}'; exit 0 ;;
+      absent)  echo "manifest unknown: manifest unknown" >&2; exit 1 ;;
+      down)    echo "Get \"https://gitea.dooplex.hu/v2/\": dial tcp: connection refused" >&2; exit 1 ;;
+      denied)  echo "unauthorized: authentication required" >&2; exit 1 ;;
+    esac ;;
+  "build "*|"buildx "*|"push "*) echo "FAKE-DOCKER-REACHED: $*"; exit 0 ;;
+esac
+exit 0
+FAKE
+chmod +x "$WS/bin/docker"
+cp "$HERE/build-hub.sh" "$WS/build/build.sh"
+
+git init -q --bare -b main "$WS/origin.git"
+git clone -q "$WS/origin.git" "$WS/clone" 2>/dev/null
+(cd "$WS/clone" && mkdir -p hub/cmd/hub hub/internal/api hub/internal/store hub/internal/web \
+    && printf 'module x\n\ngo 1.22\n' > hub/go.mod && echo a > hub/cmd/hub/a.txt \
+    && git add -A && git -c user.name=t -c user.email=t@t commit -q -m init && git push -q origin main)
+
+run() {  # name, mode, expected rc ("any" = do not assert), required fragment, forbidden fragment, args...
+    local name="$1" mode="$2" want="$3" need="$4" forbid="$5"; shift 5
+    local out rc
+    out=$(cd "$WS/build" && FAKE_MODE="$mode" PATH="$WS/bin:$PATH" FELHOM_HUB_REPO_DIR="$WS/clone" bash ./build.sh "$@" 2>&1); rc=$?
+    ran=$((ran+1))
+    if [[ "$want" != "any" && "$rc" != "$want" ]]; then
+        fails=$((fails+1)); echo "  FAIL $name: exit $rc, want $want"; echo "$out" | tail -5 | sed 's/^/        /'; return
+    fi
+    if [[ -n "$need" ]] && ! grep -qi -- "$need" <<<"$out"; then
+        fails=$((fails+1)); echo "  FAIL $name: no '$need'"; echo "$out" | tail -5 | sed 's/^/        /'; return
+    fi
+    if [[ -n "$forbid" ]] && grep -qi -- "$forbid" <<<"$out"; then
+        fails=$((fails+1)); echo "  FAIL $name: contains '$forbid'"; echo "$out" | tail -5 | sed 's/^/        /'; return
+    fi
+    echo "  ok   $name"
+}
+
+echo "build-hub.sh — a version number is pushed once"
+run "--push, tag present -> refuses"          present 1   "already exists in the registry" "FAKE-DOCKER-REACHED" 9.9.9 --push
+run "--push, tag absent -> proceeds"          absent  any "is not present in the registry" "already exists"      9.9.9 --push
+run "--multiarch, tag present -> refuses"     present 1   "already exists in the registry" "FAKE-DOCKER-REACHED" 9.9.9 --multiarch
+run "--push, registry unreachable -> refuses" down    1   "Could not establish whether"    "FAKE-DOCKER-REACHED" 9.9.9 --push
+run "--push, auth failure -> refuses"         denied  1   "Could not establish whether"    "FAKE-DOCKER-REACHED" 9.9.9 --push
+run "local build, tag present -> not refused" present any ""                               "already exists in the registry" 9.9.9
+
+echo
+if [[ $fails -eq 0 ]]; then echo "all $ran cases behaved"; exit 0; fi
+echo "$fails of $ran cases FAILED"; exit 1