v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

The unit's data files are stamped with the versions that wrote them; the capture keeps the
definition the data belongs to; a restore never starts data under another version's
definition (unit restores refuse a mismatch; the off-site restore writes the snapshot's
definition); every tier's time is its data's; the conversion-copy release needs a dump on
the new engine. File-browser sync single-flight + no empty kept folder (R-695); the kept
view joins the folder's owning group, language switch resyncs (R-691); a restore-generated
login is not shown as the password (R-694). Red-proofs in
felhom.eu/documentation/audits/version-travel-2026-09-26/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/capture_floor_test.go

@@ -112,7 +112,7 @@ func TestFloor_RefusesTheAppAndLeavesItsPreviousUnitByteIdentical(t *testing.T)
 	}
 	before := checksumFile(t, prev)
 
-	h.m.captureAllRecoveryUnits()
+	h.m.captureAllRecoveryUnits(false)
 
 	// The refused app must NOT have been attempted at all — the floor is checked BEFORE any write.
 	for _, hit := range h.prov.infoHits {
@@ -170,7 +170,7 @@ func TestFloor_NeverDeletesAnotherAppsUnit(t *testing.T) {
 	}
 	before := checksumFile(t, keep)
 
-	h.m.captureAllRecoveryUnits()
+	h.m.captureAllRecoveryUnits(false)
 
 	if _, err := os.Stat(keep); err != nil {
 		t.Fatalf("another app's unit was DELETED to make room: %v — nothing here is generational, so "+
@@ -190,7 +190,7 @@ func TestFloor_LargeUnitWithAmpleSpaceIsCaptured(t *testing.T) {
 	// A huge app on a huge, mostly-empty filesystem: 40% used, 600 GB free.
 	h.usage["immich"] = &UnitSpace{Path: h.dir, UsedPercent: 40, AvailGB: 600, TotalGB: 1000, UsedGB: 400}
 
-	h.m.captureAllRecoveryUnits()
+	h.m.captureAllRecoveryUnits(false)
 
 	if len(h.events) != 0 {
 		t.Fatalf("a capture was refused on a filesystem with 600 GB free (%+v) — the floor has become "+
@@ -209,7 +209,7 @@ func TestFloor_TheOld20GCeilingIsGone(t *testing.T) {
 	// deliberately far above 20 so that a literal `UsedGB > 20` cap cannot survive this test: a
 	// fixture sitting exactly on the old boundary would pass under the very shape it forbids.
 	h.usage["immich"] = &UnitSpace{Path: h.dir, UsedPercent: 40, AvailGB: 180, TotalGB: 300, UsedGB: 120}
-	h.m.captureAllRecoveryUnits()
+	h.m.captureAllRecoveryUnits(false)
 	if len(h.events) != 0 {
 		t.Fatalf("refused with 180 GB free: %+v — a fixed per-area limit survives somewhere", h.events)
 	}
@@ -258,7 +258,7 @@ func TestFloor_UnreadableFilesystemNeitherRefusesNorWarns(t *testing.T) {
 	h := newFloorHarness(t, "immich")
 	// No entry → the injected reader returns nil, which is what system.GetDiskUsage does on error.
 
-	h.m.captureAllRecoveryUnits()
+	h.m.captureAllRecoveryUnits(false)
 
 	if len(h.events) != 0 {
 		t.Fatalf("an UNREADABLE filesystem produced %d alert(s): %+v — an absent, unmounted or "+
@@ -275,7 +275,7 @@ func TestFloor_UnreadableFilesystemNeitherRefusesNorWarns(t *testing.T) {
 func TestErrCaptureFloor_IsMatchable(t *testing.T) {
 	h := newFloorHarness(t, "immich")
 	h.setSpace("immich", 99, 0.2)
-	h.m.captureAllRecoveryUnits()
+	h.m.captureAllRecoveryUnits(false)
 	if len(h.events) != 1 {
 		t.Fatalf("want 1 event, got %d", len(h.events))
 	}