CHANGELOG: v0.274.0

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,36 @@
+## v0.274.0 — kept data: a choice at reinstall, a list, a read-only view, a load (2026-09-25, `09` §3 decision 36); R-690, R-692
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: yes (hu + en). **A second release
+in this session, allowed by the brief:** v0.273.0 (the PostgreSQL conversion) was released first because Part D needed
+the floor before this part was ready.
+
+- **Kept data — `09` §3 decision 36 (Part E).** A reinstall over an app's kept drive folder asks the household:
+  „A megőrzött adataimat használom" / "Use my kept data" (a load from the newest copy of THIS drive's install — own
+  unit or second-drive mirror — then the template's `after_load:`) or „Tiszta lappal kezdem" / "Start fresh" (the
+  folder is renamed into `<drive>/kept/<app>/<date>/`, with the removed app's unit; nothing is deleted). The install
+  API answers 409 `kept_data_choice` until one is chosen; `DeployStack` refuses too (`ErrKeptDataChoice`). New page
+  „Megőrzött adatok" / "Kept data" (`/kept-data`, linked from Tárhely): app, date, size, which copy can bring it back;
+  Load / Look / Delete (typed confirmation — the only deletion of kept data; the box deletes none by itself, D3 open).
+  FileBrowser gains a read-only „Megőrzött adatok" source (one `:ro` bind per item). The drive-full warning names the
+  kept folders and sizes. `<drive>/kept` is in `ProtectedHDDPaths` and outside every backup leg. `.felhom.yml`
+  `after_load:` (nextcloud: `occ files:scan --all`, catalog `9cc829c`).
+- **R-690 fixed** — the removed-app restore (R-487) never found a unit on a DATA drive: `primaryUnitDirFor` and
+  `ListRestorePoints` asked `GetStackComposePath` (true for every catalog app), so nextcloud came back with no env,
+  no database and its files bound on the guest's root disk (measured on 0.272.0, `E/E1-README.md`). Now
+  `isStackDeployed`; pinned by a production-shaped provider (the R-487 fake answered it for deployed apps only).
+- Red-proofs (each seen failing, tree restored): R-690 ×2, kept rules 1–4, the install guard, the install API,
+  the copy's drive check, the `:ro` bind — `E/redproofs/`. Parity: 7 Hungarian fixtures regenerated, the only
+  removed lines are the two edited deploy-page lines; 2 new (`kept_data_full`, `kept_data_empty`).
+- **R-692 fixed before release** (found live on 9202, `0.274.0-rc1`): the list named romm's and paperless's leftovers
+  „Filebrowser" — the read-only view's own binds made the file browser look like their owner. An owner is now an app
+  that binds the folder through `${HDD_PATH}` (the folder or one inside it), never a protected stack.
+  `TestKept_OwnerIsNeverTheFileBrowser`, red-proofed.
+- Proven live on 9202 (`0.274.0-rc2`, endpoint level, both languages): ask → start fresh → a unit → a file after it →
+  remove keeping data → „use" (the unit on the DATA drive, the rescan ran, the account and both files back) → start
+  fresh again → Load refused while a leftover occupies the folder → Delete refused for a wrong name and for an
+  unlisted path → Delete → Load (files moved back, database loaded, rescan) → a write into the read-only view refused
+  (`felhom.eu/documentation/audits/night-2026-09-26/E/E5-*`).
+
 ## v0.273.0 — the box converts a PostgreSQL major, docmost first (2026-09-25, `09` §3 decisions 35–38, §6.4 part 10); R-687
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: yes (hu + en, three keys).