v0.331.0: a removal deletes the volumes still labelled with the app's project that its definition no longer declares (R-1117)

compose down --volumes removes only the current definition's volumes; a volume a template dropped (or an older restore
re-created) survived 'remove with data' on 9202 (nextcloud_nextcloud_redis_data). Red-proofed.

controller/README.md

@@ -1055,7 +1055,7 @@ The `/apps/{slug}` page renders hero section, screenshots, setup guide, and opti
 | Stop | `docker compose stop` (blocked for protected stacks) |
 | Restart | `docker compose restart` |
 | Update | `docker compose pull` + `docker compose up -d` |
-| Remove | `docker compose down --volumes` + remove `app.yaml` + optional HDD/backup cleanup; template preserved for redeploy |
+| Remove | `docker compose down --volumes`, then every volume still labelled with the app's compose project (one a template dropped or an older restore re-created — v0.331.0, R-1117) + remove `app.yaml` + optional HDD/backup cleanup; template preserved for redeploy |
 | Delete | `docker compose down --rmi local --volumes` + optional HDD data cleanup (orphaned stacks only) |
 
 **Remove vs Delete**: "Eltávolítás" (Remove) is for deployed catalog stacks — it reverts the stack to "Nincs telepítve" state while keeping the template for easy redeployment. "Törlés" (Delete) is for orphaned stacks — it removes the entire stack directory including templates. Both require stopping the stack first.

controller/internal/stacks/delete.go

@@ -756,6 +756,17 @@ func (m *Manager) RemoveStack(name string, removeHDDData bool, backupPathsToRemo
 	if n := m.RemoveUndoCopies(name); n > 0 {
 		m.logger.Printf("[INFO] [stacks] RemoveStack %s: removed %d undo copy volume(s)", name, n)
 	}
+	// R-1117: `down --volumes` removes only what the CURRENT definition declares. A volume a template dropped (or a
+	// restore re-created from an older unit) still carries the app's project label and outlived the removal (measured
+	// on 9202, 2026-10-18: nextcloud_nextcloud_redis_data). The removal removes volumes, so those go too — by name, and
+	// only the ones labelled with THIS project. Pinned by TestR1117_RemoveDeletesALabelledVolumeTheDefinitionNoLongerDeclares.
+	for _, v := range m.projectVolumes(name) {
+		if out, err := m.execCommand("docker", "volume", "rm", v); err != nil {
+			m.logger.Printf("[WARN] [stacks] RemoveStack %s: leftover volume %s not removed: %v (%s)", name, v, err, strings.TrimSpace(out))
+		} else {
+			m.logger.Printf("[INFO] [stacks] RemoveStack %s: removed leftover volume %s (the app's project label; not in its definition — R-1117)", name, v)
+		}
+	}
 
 	// Step 3: the volumes that are gone now — `[]` when none, never null (R-489).
 	resp.VolumesRemoved = removedVolumes(volsBefore, m.appVolumeSet(name, stackDir))

controller/internal/stacks/r1117_leftover_volume_test.go

@@ -0,0 +1,78 @@
+package stacks
+
+import (
+	"sort"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// R-1117: a template that drops a volume leaves the old one on an installed box, still carrying the app's compose project
+// label (and a restore re-creates it with that label). `compose down --volumes` removes only the volumes the CURRENT
+// definition declares, so before this fix the removal listed it and kept it — measured on scratch 9202, 2026-10-18:
+// Nextcloud removed „with data", `nextcloud_nextcloud_redis_data` still there. The consequence pinned: after the
+// removal no volume with the app's project label is left, and a volume of another project is never touched.
+// RED-PROOF: delete the leftover loop in RemoveStack → "left behind: [app_app_redis_data]".
+func TestR1117_RemoveDeletesALabelledVolumeTheDefinitionNoLongerDeclares(t *testing.T) {
+	drive := t.TempDir()
+	m, _, _ := newR442Manager(t, "app", ssdCompose, driveAppYAML(drive), drive)
+	var mu sync.Mutex
+	// project label per volume: the app's own (declared or not), and another app's.
+	vols := map[string]string{"app_app_redis_data": "app", "other_app_data": "other"}
+	var removedByRm []string
+	m.execFn = func(name string, args ...string) (string, error) {
+		mu.Lock()
+		defer mu.Unlock()
+		a := strings.Join(args, " ")
+		switch {
+		case strings.HasPrefix(a, "volume ls --filter label=com.docker.compose.project="):
+			p := strings.TrimPrefix(strings.Fields(a)[3], "label=com.docker.compose.project=")
+			var out []string
+			for v, proj := range vols {
+				if proj == p {
+					out = append(out, v)
+				}
+			}
+			sort.Strings(out)
+			return strings.Join(out, "\n"), nil
+		case a == "volume ls -q":
+			var out []string
+			for v := range vols {
+				out = append(out, v)
+			}
+			sort.Strings(out)
+			return strings.Join(out, "\n"), nil
+		case strings.HasPrefix(a, "volume rm "):
+			v := strings.Fields(a)[len(strings.Fields(a))-1]
+			delete(vols, v)
+			removedByRm = append(removedByRm, v)
+			return v, nil
+		}
+		return "", nil
+	}
+	resp, err := m.RemoveStack("app", false, nil)
+	if err != nil {
+		t.Fatalf("RemoveStack: %v", err)
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	var left []string
+	for v, proj := range vols {
+		if proj == "app" {
+			left = append(left, v)
+		}
+	}
+	if len(left) > 0 {
+		t.Fatalf("left behind: %v — a volume with the app's project label outlived its removal", left)
+	}
+	if _, ok := vols["other_app_data"]; !ok {
+		t.Fatalf("another app's volume was removed (rm calls: %v)", removedByRm)
+	}
+	found := false
+	for _, v := range resp.VolumesRemoved {
+		found = found || v == "app_app_redis_data"
+	}
+	if !found {
+		t.Errorf("volumes_removed = %v, want it to name app_app_redis_data", resp.VolumesRemoved)
+	}
+}