controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/undo_test.go

@@ -34,6 +34,7 @@ type fakeCopier struct {
 	cutOff     bool // every copy is made WITHOUT its finished-marker (a copy container killed mid-way)
 	restoreErr error
 	bytes      int64
+	unlabeled  map[string]bool // volumes Docker holds WITHOUT the compose label (a pre-v0.268.0 restore, R-658)
 }
 
 func newFakeCopier(vols map[string]string) *fakeCopier {
@@ -46,11 +47,19 @@ func (f *fakeCopier) ProjectVolumes(string) ([]string, error) {
 	defer f.mu.Unlock()
 	var out []string
 	for v := range f.vols {
-		out = append(out, v)
+		if !f.unlabeled[v] {
+			out = append(out, v)
+		}
 	}
 	sort.Strings(out)
 	return out, nil
 }
+func (f *fakeCopier) VolumeExists(v string) (bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	_, ok := f.vols[v]
+	return ok, nil
+}
 func (f *fakeCopier) VolumeBytes(string) (int64, error) { return f.bytes, nil }
 func (f *fakeCopier) Copy(src, dst, _ string) error {
 	f.mu.Lock()
@@ -542,8 +551,13 @@ func TestUndo_EveryPinWriterRecordsTheProbe(t *testing.T) {
 			t.Errorf("%s.%s must call storeAppliedMetaFrom", file, fn)
 		}
 	}
-	if !funcCalls(t, "pin.go", "advancePinToCatalog", "storeAppliedMetaFrom") {
-		t.Error("advancePinToCatalog must call storeAppliedMetaFrom")
+	// v0.268.0: the guarded update pins through advancePinTo (the ladder names the definition);
+	// advancePinToCatalog is its catalog-head wrapper. The writer is advancePinTo.
+	if !funcCalls(t, "pin.go", "advancePinTo", "storeAppliedMetaFrom") {
+		t.Error("advancePinTo must call storeAppliedMetaFrom")
+	}
+	if !funcCalls(t, "update.go", "runGuardedUpdate", "advancePinTo") {
+		t.Error("runGuardedUpdate must pin through advancePinTo")
 	}
 }