kept data: the choice at reinstall, the list, the read-only view, the load (09 decision 36); R-690 fixed

An install over an app's kept drive folder (appdata/<app> non-empty) asks the household:
"use my kept data" (a load from the newest copy of THIS drive's install, own unit or
second-drive mirror, then the template's after_load) or "start fresh" (the folder is
renamed into <drive>/kept/<app>/<date>/ with the removed app's unit; nothing deleted).
The install API answers 409 kept_data_choice until one is chosen; DeployStack refuses
too. New page Megorzott adatok / Kept data (/kept-data): Load / Look / Delete (typed
confirmation, the only deletion of kept data). FileBrowser gets a read-only source.
The drive-full warning names the kept folders. <drive>/kept is protected and outside
every backup leg.

R-690: the removed-app restore (R-487) never found a unit on a DATA drive — it asked
GetStackComposePath (true for every catalog app) and restored nextcloud with no env.
Now isStackDeployed; pinned with a production-shaped provider.

Red-proofs: audits/night-2026-09-26/E/redproofs/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/fillwatch/fillwatch.go

@@ -142,6 +142,9 @@ type Watcher struct {
 	usage func(path string) *Usage
 	// notify pushes the customer event. Nil-safe.
 	notify func(Event)
+	// extra appends a sentence to the warning for one target — the kept folders on it the household
+	// can delete (`09` §3 decision 36). Nil-safe; "" appends nothing.
+	extra func(Target) string
 
 	mu    sync.Mutex
 	bands map[string]Band
@@ -164,6 +167,9 @@ func New(statePath string, logger *log.Logger, targets func() []Target, usage fu
 // SetNotify wires the customer event push. INIT-ONLY — call once at startup.
 func (w *Watcher) SetNotify(fn func(Event)) { w.notify = fn }
 
+// SetExtra wires the kept-data sentence (main.go). INIT-ONLY.
+func (w *Watcher) SetExtra(fn func(Target) string) { w.extra = fn }
+
 // classify decides the band from a reading AND the previous band, which is what makes the hysteresis
 // work: between the clear and warn thresholds the previous band is HELD rather than recomputed.
 //
@@ -231,6 +237,11 @@ func (w *Watcher) Check() error {
 		}
 
 		msg := Message(t, *u, next)
+		if w.extra != nil {
+			if x := w.extra(t); x != "" {
+				msg += " " + x
+			}
+		}
 		w.logger.Printf("[WARN] [fillwatch] %s (%q): %s → %s — %.0f%% used, %.1f GB free of %.1f GB; notifying the customer",
 			t.Path, t.Label, prev, next, u.UsedPercent, u.AvailGB, u.TotalGB)
 		emitted++