v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

controller/internal/stacks/delete.go

@@ -171,15 +171,17 @@ func hddNoteFor(removeHDDData bool, mounts, missing, userdataKept []string) stri
 // userdataKept lists the folders the app binds through ${USERDATA_PATH} that exist on its drive — the household's own
 // files (books, videos, photos it sees in the file browser). No remove deletes them (`09` §3 decision 67, R-800): the
 // removal reads ${HDD_PATH} binds only, and ProtectedHDDPaths guards the roots. This list exists so the dialog and the
-// result can SAY so, by name. USERDATA_PATH is <HDD_PATH>/userdata (withUserdataPath at deploy). Pinned by
-// TestRemoveStack_R800_UserdataKeptIsNamed.
+// result can SAY so, by name. USERDATA_PATH is <namespace root of HDD_PATH>/userdata (withPathVars at deploy) — on
+// the system-data fallback that root is <HDD_PATH>/felhom-data, so the bare HDD_PATH is never passed to UserdataDir
+// (R-203 shape, found by the R-1017 guard). Pinned by TestRemoveStack_R800_UserdataKeptIsNamed and
+// TestRemoveStack_R800_UserdataKeptOnSystemDrive.
 func (m *Manager) userdataKept(name, composePath string) []HDDPath {
 	out := []HDDPath{}
 	hddPath, declared := m.appHDDPath(name)
 	if !declared {
 		return out
 	}
-	for _, p := range ParseComposeUserdataMounts(composePath, appbackup.UserdataDir(hddPath)) {
+	for _, p := range ParseComposeUserdataMounts(composePath, appbackup.UserdataDir(appbackup.NamespaceRootFor(hddPath, m.sysDataPath))) {
 		clean := filepath.Clean(p)
 		info, err := os.Stat(clean)
 		if err != nil || !info.IsDir() {