v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

controller/internal/stacks/delete_r442_test.go

@@ -456,6 +456,31 @@ func TestRemoveStack_R800_UserdataKeptIsNamed(t *testing.T) {
 	}
 }
 
+// R-1017 / R-203 shape: an app on the SYSTEM-DATA fallback has USERDATA_PATH = <HDD_PATH>/felhom-data/userdata (the
+// deploy's withPathVars), so its kept folders live there — not under <HDD_PATH>/userdata. The dialog must name them.
+// COMPANION RED-PROOF: pass the bare hddPath to UserdataDir in userdataKept again → userdata_kept is empty.
+func TestRemoveStack_R800_UserdataKeptOnSystemDrive(t *testing.T) {
+	sys := t.TempDir()
+	compose := "services:\n" +
+		"  app:\n" +
+		"    image: nginx:1.27\n" +
+		"    volumes:\n" +
+		"      - ${USERDATA_PATH}/media/app:/downloads\n"
+	m, _, _ := newR442Manager(t, "app", compose, driveAppYAML(sys), sys)
+	m.sysDataPath = sys
+	m.cfg.Paths.SystemDataPath = sys
+	kept := filepath.Join(sys, "felhom-data", "userdata", "media", "app")
+	plantFile(t, filepath.Join(kept, "clip.mp4"))
+
+	hd, err := m.GetStackHDDData("app")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(hd.UserdataKept) != 1 || hd.UserdataKept[0].Path != kept {
+		t.Fatalf("hdd-data userdata_kept = %+v, want [%s] — on the system drive the household's folder sits under felhom-data", hd.UserdataKept, kept)
+	}
+}
+
 // An SSD app: userdata_kept serialises as [] (never null), the "no drive data" note is unchanged.
 func TestRemoveStack_R800_SSDAppUserdataKeptEmpty(t *testing.T) {
 	m, _, _ := newR442Manager(t, "app", ssdCompose, "deployed: true\nenv: {}\n", "")