R-1270 follow-up (found live on 9202): remove with „delete its backups too” deletes the app's restore-undo folder too — a not-started restore's kept copy outlived the remove; the wiring test also pins the D47 set-aside removal. Red-proved. Commit only.

controller/internal/api/r474_remove_wiring_test.go

@@ -33,7 +33,10 @@ func TestR474_RemoveHandlerDeletesUnitMirrorAndPrefs(t *testing.T) {
 		})
 	}
 	joined := " " + strings.Join(sel, " ") + " "
-	for _, want := range []string{"RecoveryUnitPath", "Tier2MirrorDirsForApp", "RemoveTier2Mirrors", "DeleteAppBackupPrefs"} {
+	// 2026-10-25: the set-aside units of earlier installs (D47) and the restore's kept undo copy (found live on 9202: a
+	// not-started restore's copy outlived the app's remove with its backups) go too.
+	for _, want := range []string{"RecoveryUnitPath", "Tier2MirrorDirsForApp", "RemoveTier2Mirrors", "DeleteAppBackupPrefs",
+		"SetAsideDirsForApp", "RemoveSetAsideUnits", "RestoreUndoDir"} {
 		if !strings.Contains(joined, " "+want+" ") {
 			t.Errorf("removeStack must call %s", want)
 		}

controller/internal/api/router.go

@@ -1054,7 +1054,8 @@ func (r *Router) removeStack(w http.ResponseWriter, req *http.Request, name stri
 	if body.RemoveBackups && r.backupMgr != nil {
 		nsRoot := r.backupMgr.AppNamespaceRoot(name)
 		if nsRoot != "" {
-			backupPaths = append(backupPaths, backup.RecoveryUnitPath(nsRoot, name), backup.AppDBDumpPath(nsRoot, name))
+			backupPaths = append(backupPaths, backup.RecoveryUnitPath(nsRoot, name), backup.AppDBDumpPath(nsRoot, name),
+				backup.RestoreUndoDir(nsRoot, name)) // a restore's kept undo copy is a backup of the app too (2026-10-25)
 		}
 		mirrorDirs = r.backupMgr.Tier2MirrorDirsForApp(name)
 		// D47: the units of earlier installs set aside for this app are its backups too (the D25 kept-copy rule).