D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

controller/README.md

@@ -1680,6 +1680,18 @@ present folder is not mirrored over a copy that holds files: the run warns and k
 never chosen as the target (R-1179). Code: `internal/backup/tier2_kept.go`, `internal/settings/kept_copies.go`,
 `internal/web/kept_copies.go`.
 
+### An earlier install's backup is set aside, never rewritten (D47, operator ruling 2026-10-25; R-1269)
+
+Every install has an identity (`app.yaml` `install_id:` — minted at a fresh install and at an import, taken from the unit
+by a restore, minted once for an older app). The recovery unit records it. Before any backup writes into an app's unit —
+the capture and its five-minute refresh, the database and volume dumps, the update's pre-backup, the second drive's unit
+copy, the stale-drive prune — it asks whose unit it is. A unit of another install (a reinstall after „remove, keep
+backups") is moved whole to `<namespace>/backups/set-aside/<app>/<UTC stamp>/` and listed on the restore page under
+„Megőrzött másolatok" with „Visszaállítás" (it restores with its own database password) and „Eltávolítás"; the new
+install then gets its own unit. A move that cannot be done refuses the write and leaves the old unit as it is (an ERROR
+line names both identities). Remove with „delete its backups too" deletes the set-aside units as well. Code:
+`internal/backup/unit_owner.go`, `internal/web/kept_copies.go`.
+
 ### Off-site content proof (v0.231.0, R-87)
 
 **What it is:** every night the box restores ONE app's newest off-site snapshot into a throwaway