D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

controller/internal/appbackup/appdata.go

@@ -91,6 +91,9 @@ type RecoveryInfo struct {
 	// „open" (and by whom). Nil for an app whose template has no gate. The restore applies it, so a backup made before
 	// the household's first setup never comes back open (`09` §3 decision 253).
 	SetupGate *GateState
+	// InstallID (D47, R-1269) is the install the app's data belongs to (app.yaml `install_id:`); "" for an app installed
+	// before D47. The unit records it, and a backup of another install never writes into that unit (backup/unit_owner.go).
+	InstallID string
 }
 
 // GateState is the setup gate as a backup records it (the unit's app.yaml `setup_gate:`). The same two keys as the