v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

The unit's data files are stamped with the versions that wrote them; the capture keeps the
definition the data belongs to; a restore never starts data under another version's
definition (unit restores refuse a mismatch; the off-site restore writes the snapshot's
definition); every tier's time is its data's; the conversion-copy release needs a dump on
the new engine. File-browser sync single-flight + no empty kept folder (R-695); the kept
view joins the folder's owning group, language switch resyncs (R-691); a restore-generated
login is not shown as the password (R-694). Red-proofs in
felhom.eu/documentation/audits/version-travel-2026-09-26/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/kept.go

@@ -304,6 +304,12 @@ func (m *Manager) ListKept(drives []string) []KeptItem {
 					continue
 				}
 				dir := filepath.Join(d, KeptDirName, a.Name(), s.Name())
+				// R-695 (v0.275.0): an EMPTY dated folder is not kept data — it is what Docker leaves when a
+				// file-browser bind outlives a Delete (it recreates the missing source, empty, as root).
+				// Listed, it was bound again, and the bind recreated it: a loop. Never listed, never bound.
+				if !dirHasEntries(dir) {
+					continue
+				}
 				it := KeptItem{App: a.Name(), DisplayName: a.Name(), Path: dir, Drive: d, Kind: KeptKindDated,
 					Marker: readKeptMarker(dir), SizeBytes: sizeFn(dir)}
 				if st, ok := m.GetStack(a.Name()); ok && st.Meta.DisplayName != "" {