v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

The unit's data files are stamped with the versions that wrote them; the capture keeps the
definition the data belongs to; a restore never starts data under another version's
definition (unit restores refuse a mismatch; the off-site restore writes the snapshot's
definition); every tier's time is its data's; the conversion-copy release needs a dump on
the new engine. File-browser sync single-flight + no empty kept folder (R-695); the kept
view joins the folder's owning group, language switch resyncs (R-691); a restore-generated
login is not shown as the password (R-694). Red-proofs in
felhom.eu/documentation/audits/version-travel-2026-09-26/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/server.go

@@ -51,6 +51,10 @@ type Server struct {
 	tmplByLang   map[string]*template.Template
 	i18n         *i18n.Bundle
 
+	// versionPosition (v0.275.0) — where a just-restored app stands against the catalog; nil → the stack
+	// manager's RestoredVersionPosition. A seam so the restore sentence is testable without a catalog.
+	versionPosition func(app string) (behind, climbable bool)
+
 	sessions       map[string]*session
 	sessionsMu     sync.RWMutex
 	loginAttempts  map[string]*loginAttempt
@@ -73,6 +77,15 @@ type Server struct {
 
 	// Guard for FileBrowser sync — prevents concurrent file writes (H5 fix)
 	fileBrowserMu sync.Mutex
+	// fbReqMu guards the file-browser sync's single-flight counters (R-695, v0.275.0): fbReqGen counts
+	// requests, fbDoneGen is the newest request a finished sync is known to have covered.
+	fbReqMu   sync.Mutex
+	fbReqGen  uint64
+	fbDoneGen uint64
+	// syncFileBrowserHook replaces the sync's body in tests (the single-flight is the unit under test).
+	syncFileBrowserHook func()
+	// langSwitchSync replaces the language switch's file-browser sync in tests (R-691).
+	langSwitchSync func()
 
 	// Shared agent local-API client (built once, reused). cfg.LocalAPI is static per process (a
 	// config-apply triggers a graceful self-restart), so the client is memoized via agentCliOnce —