Apps burndown (controller 0.321.0 released): R-1097, R-1102, R-1101, R-1095, R-1098 closed; R-1103 opened; build-hub.sh 1.25.0

build-hub.sh refuses an existing tag and an unanswered registry (test_build_hub_push_once.sh, red-proved).
Register 179 -> 175. R-1067 stays BLOCKED: Tester-2 reports 0.292.0. Design notes in 02 and 07; STATUS;
evidence audits/burndown-apps-2026-10-16/; REPORT-burndown-apps-2026-10-16.md.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/build-hub.sh

@@ -19,7 +19,7 @@
 # =============================================================================
 set -euo pipefail
 
-SCRIPT_VERSION="1.24.0"
+SCRIPT_VERSION="1.25.0"
 
 # --- Configuration (edit these if your paths differ) ---
 # FELHOM_HUB_REPO_DIR builds from another clone (a session's own clean clone; the script's own test) — the same
@@ -56,6 +56,32 @@ if ! command -v docker &>/dev/null; then
     exit 1
 fi
 
+# =========================================================================
+# Step 0: a version number is pushed ONCE (R-1098, v1.25.0) — the controller build.sh's check, word for word in effect
+# =========================================================================
+# A box (and the hub's floor) compares VERSIONS; two images under one number mean a pod can run either and nobody can
+# tell (`09-update-architecture.md` §0: controller 0.315.0 was pushed three times). The check runs BEFORE the build, so
+# a refusal costs no minutes. An unreachable registry is a REFUSAL too: the point is to prove the tag is new, and
+# "I could not ask" is not that proof. Local builds (no --push) are unaffected. `docker manifest inspect` is the probe,
+# so a test puts a fake `docker` on PATH: scripts/test_build_hub_push_once.sh.
+if [[ "${ACTION}" == "--push" || "${ACTION}" == "--multiarch" ]]; then
+    step "0/3 — Checking the registry: is ${VERSION} already published?"
+    probe_rc=0
+    probe_out=$(docker manifest inspect "${IMAGE}:${VERSION}" 2>&1) || probe_rc=$?
+    if [[ ${probe_rc} -eq 0 ]]; then
+        error "${IMAGE}:${VERSION} already exists in the registry — bump the version."
+        error "A version number is pushed once. If this is a fix for something already pushed, release it as the next"
+        error "patch version instead."
+        exit 1
+    fi
+    if ! grep -qiE 'no such manifest|manifest unknown|not found|does not exist|NAME_UNKNOWN|MANIFEST_UNKNOWN' <<<"${probe_out}"; then
+        error "Could not establish whether ${IMAGE}:${VERSION} exists — refusing to build."
+        error "The registry answered: ${probe_out}"
+        exit 1
+    fi
+    info "${VERSION} is not present in the registry — proceeding."
+fi
+
 # =========================================================================
 # Step 1: the clean-tree gate (R-1021) — fetch, pull, and REFUSE a stale or dirty tree
 # =========================================================================