D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

controller/cmd/controller/main.go

@@ -3286,9 +3286,23 @@ func (a *stackAdapter) GetStackRecoveryInfo(name string) (backup.RecoveryInfo, b
 		InstalledImages:       installedRefs(s.AppConfig),
 		// R-1057 (v0.314.0): the gate as it stands at this backup — read from the file, the record of truth.
 		SetupGate: gateAtCapture(&meta, stackDir),
+		InstallID: installIDOf(stackDir), // D47: whose data this is — the unit records it
 	}, true
 }
 
+// installIDOf reads the app's install identity (D47) from its app.yaml on disk; "" when absent or unreadable.
+func installIDOf(stackDir string) string {
+	if cfg := stacks.LoadAppConfig(stackDir); cfg != nil {
+		return cfg.InstallID
+	}
+	return ""
+}
+
+// EnsureInstallID (D47) mints and saves an install identity for an app installed before D47 (backup.installIdentity).
+func (a *stackAdapter) EnsureInstallID(name string) (string, error) {
+	return a.mgr.EnsureInstallID(name)
+}
+
 // gateAtCapture reads the app's setup-gate record from its app.yaml on disk for the backup (stacks.GateCapture).
 func gateAtCapture(meta *stacks.Metadata, stackDir string) *backup.GateState {
 	var rec *stacks.SetupGateRecord