diff --git a/CHANGELOG.md b/CHANGELOG.md
index bb84e5c7..20a0870a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - **COOP header console warning on HTTP deployments:** Helmet sends `Cross-Origin-Opener-Policy: same-origin` by default, which browsers silently ignore over HTTP but log as a console error. Disabled via `crossOriginOpenerPolicy: false` — same rationale as the existing HSTS and COEP disables.
 - **Inline script CSP violation from Vite module-preload polyfill:** Vite's production build injects a small inline `<script>` for the module-preload polyfill that was blocked by `script-src 'self'`. Disabled via `build.modulePreload.polyfill: false` in `vite.config.ts` — all modern browsers support `<link rel="modulepreload">` natively.
+- **Managed container count wrong when stacks launched from COMPOSE_DIR root:** The `GET /api/stats` endpoint classified containers as managed by matching `com.docker.compose.project` against known stack directory names. When stacks are launched from the COMPOSE_DIR root (rather than each subdirectory), Docker assigns the root folder name as the project name for all of them — causing every such container to appear as "external". Fixed by classifying via `com.docker.compose.project.working_dir`: a container is managed if its working directory falls within COMPOSE_DIR, regardless of the project name.
 - **Blank page on HTTP deployments (root cause — Helmet 8 default CSP):** Helmet 8 merges custom `directives` with its built-in defaults, which include `upgrade-insecure-requests`. The previous fix (PR #59) omitted the directive from the custom object, but Helmet silently re-added it from defaults. The correct fix is `upgradeInsecureRequests: null`, which is the Helmet 8 API for explicitly removing a default directive.
 - **Login loop caused by remote node auth failure:** When a configured remote node had an expired or invalid API token, every proxied request to that node returned 401. Both `apiFetch` and `fetchForNode` treated any 401 as a user session failure and dispatched `sencho-unauthorized`, immediately logging the user out and sending them back to the login page — even after a successful login. Fixed by adding a `proxyRes` handler that stamps all remote-proxied responses with `x-sencho-proxy: 1`; the frontend now only fires `sencho-unauthorized` when this header is absent (i.e., it's a genuine local session failure).
 - **Missing `authMiddleware` on notifications endpoints:** `GET /api/notifications`, `POST /api/notifications/read`, `DELETE /api/notifications/:id`, `DELETE /api/notifications`, and `POST /api/notifications/test` were all missing `authMiddleware`, violating the default-deny policy. Added to all five.
diff --git a/backend/src/index.ts b/backend/src/index.ts
index de844985..41dbb6dd 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -1159,24 +1159,25 @@ app.post('/api/convert', async (req: Request, res: Response) => {
 // Get all containers stats for dashboard
 app.get('/api/stats', async (req: Request, res: Response) => {
   try {
-    const [dockerController, knownStacks] = [
-      DockerController.getInstance(req.nodeId),
-      await FileSystemService.getInstance(req.nodeId).getStacks(),
-    ];
-    const allContainers = await dockerController.getAllContainers();
-    const knownSet = new Set(knownStacks);
+    const composeDir = path.resolve(NodeRegistry.getInstance().getComposeDir(req.nodeId));
+    const allContainers = await DockerController.getInstance(req.nodeId).getAllContainers();
+
+    // A container is "managed" if Docker started it from within COMPOSE_DIR.
+    // We use com.docker.compose.project.working_dir rather than project name because
+    // stacks launched from the COMPOSE_DIR root (not a subdirectory) all share the
+    // project name of the root folder — causing false "external" classification.
+    const isManagedByComposeDir = (c: any): boolean => {
+      const workingDir: string | undefined = c.Labels?.['com.docker.compose.project.working_dir'];
+      if (!workingDir) return false;
+      const resolved = path.resolve(workingDir);
+      return resolved === composeDir || resolved.startsWith(composeDir + path.sep);
+    };
 
     const active = allContainers.filter((c: any) => c.State === 'running').length;
     const exited = allContainers.filter((c: any) => c.State === 'exited').length;
     const total = allContainers.length;
-    const managed = allContainers.filter((c: any) => {
-      const project: string | undefined = c.Labels?.['com.docker.compose.project'];
-      return project && knownSet.has(project) && c.State === 'running';
-    }).length;
-    const unmanaged = allContainers.filter((c: any) => {
-      const project: string | undefined = c.Labels?.['com.docker.compose.project'];
-      return project && !knownSet.has(project) && c.State === 'running';
-    }).length;
+    const managed = allContainers.filter((c: any) => c.State === 'running' && isManagedByComposeDir(c)).length;
+    const unmanaged = allContainers.filter((c: any) => c.State === 'running' && !isManagedByComposeDir(c)).length;
 
     res.json({ active, managed, unmanaged, exited, total });
   } catch (error) {