compose validate flags a service with no healthcheck and a defined-but-unused named volume

src/lib/components/CheckUpdatesButton.svelte

@@ -133,7 +133,7 @@
 			// Semver suggestions are independent of digest updates: a container can be
 			// digest-current yet run an outdated version tag.
 			const newerVersions: NewerVersionItem[] = data.results
-				.filter((r: any) => r.newerVersion)
+				.filter((r: any) => r.newerVersion && !r.systemContainer && !r.updateDisabled)
 				.map((r: any) => ({ containerId: r.containerId, newerVersion: r.newerVersion }));
 
 			// A newer version tag is a real result even when no digest update exists,

src/routes/api/containers/check-updates/+server.ts

@@ -150,9 +150,15 @@ export const POST: RequestHandler = async ({ url, cookies, request }) => {
 
 				const result = await checkImageUpdateAvailable(imageName, currentImageId, envIdNum);
 
+				// System containers (Dockhand itself, Hawser) have their own update path and are
+				// never shown/counted as a container update, so skip the extra registry call and
+				// never emit a newerVersion for them - otherwise the "found updates" notification
+				// counts a suggestion the UI deliberately hides (#1466).
+				const systemContainer = isSystemContainer(imageName) || null;
+
 				// Newer-version-tag detection (opt-in). Skips instantly for floating tags,
 				// so it only hits the registry for pinned versions. Never throws.
-				const newerVersion = semverEnabled
+				const newerVersion = semverEnabled && !systemContainer
 					? await checkNewerVersion(imageName, {
 							...semverOptions,
 							versionPattern: getVersionPatternOverride(inspectData.Config?.Labels)
@@ -168,7 +174,7 @@ export const POST: RequestHandler = async ({ url, cookies, request }) => {
 					newDigest: result.registryDigest,
 					error: result.error,
 					isLocalImage: result.isLocalImage,
-					systemContainer: isSystemContainer(imageName) || null,
+					systemContainer,
 					updateDisabled,
 					newerVersion: newerVersion ?? undefined
 				};