v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

The unit's data files are stamped with the versions that wrote them; the capture keeps the
definition the data belongs to; a restore never starts data under another version's
definition (unit restores refuse a mismatch; the off-site restore writes the snapshot's
definition); every tier's time is its data's; the conversion-copy release needs a dump on
the new engine. File-browser sync single-flight + no empty kept folder (R-695); the kept
view joins the folder's owning group, language switch resyncs (R-691); a restore-generated
login is not shown as the password (R-694). Red-proofs in
felhom.eu/documentation/audits/version-travel-2026-09-26/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/ladder_test.go

@@ -214,3 +214,34 @@ func mustWriteMk(t *testing.T, p, body string) {
 	}
 	mustWrite(t, p, body)
 }
+
+// TestA3_RestoredVersionPosition — after a restore brought an app back at an older pin: behind, and
+// climbable only when a tested ladder step leads on from that pin (the automatic leg's own rule:
+// LegSkipOlderThanLadder). A pin at the catalog's version is not behind; digests do not count.
+func TestA3_RestoredVersionPosition(t *testing.T) {
+	m, _, _, _, _ := ladderManager(t, true)
+	set := func(pin string) {
+		m.mu.Lock()
+		st := m.stacks["nextcloud"]
+		st.CatalogImages = map[string]string{"web": ladderC}
+		if st.AppConfig == nil {
+			st.AppConfig = &AppConfig{}
+		}
+		st.AppConfig.PinnedImages = map[string]string{"web": pin}
+		m.mu.Unlock()
+	}
+	for _, c := range []struct {
+		pin               string
+		behind, climbable bool
+	}{
+		{ladderA, true, true},                    // on the ladder: the leg climbs it
+		{"nextcloud:20.0.0-apache", true, false}, // older than the ladder: the leg will not
+		{ladderC, false, false},                  // at the catalog's version
+		{ladderC + "@sha256:0123", false, false}, // a digest is not a version
+	} {
+		set(c.pin)
+		if b, cl := m.RestoredVersionPosition("nextcloud"); b != c.behind || cl != c.climbable {
+			t.Errorf("pin %s: behind=%v climbable=%v, want %v %v", c.pin, b, cl, c.behind, c.climbable)
+		}
+	}
+}