v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

The unit's data files are stamped with the versions that wrote them; the capture keeps the definition the data belongs to; a restore never starts data under another version's definition (unit restores refuse a mismatch; the off-site restore writes the snapshot's definition); every tier's time is its data's; the conversion-copy release needs a dump on the new engine. File-browser sync single-flight + no empty kept folder (R-695); the kept view joins the folder's owning group, language switch resyncs (R-691); a restore-generated login is not shown as the password (R-694). Red-proofs in felhom.eu/documentation/audits/version-travel-2026-09-26/. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-26 10:35:22 +02:00
parent fb2bcdd5d6
commit b6810f14ff
47 changed files with 3771 additions and 135 deletions
@@ -83,6 +83,10 @@ type RecoveryInfo struct {
 	// 0600 app.yaml.
 	PortableSecretEnvVars []string
 	PortableSecrets       map[string]string
+	// InstalledImages (v0.275.0, R-696) is what each compose service is RUNNING — app.yaml's
+	// `installed_images`, as `ref@digest` (the plain ref when no digest was recorded). Stamped beside each
+	// data file the backup writes, so the data says which versions wrote it. Nil = unknown, never current.
+	InstalledImages map[string]string
 }

 // ParseComposeImages extracts the pinned image references (`image: repo:tag`) from a