D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

controller/internal/backup/offbox_reconstitute.go

@@ -494,6 +494,14 @@ func (m *Manager) captureLiveDefinition(stack string) (*liveDefinition, error) {
 		for k, v := range m.stackProvider.RecoverStackSecrets(stack, info.SecretEnvVars) {
 			d.env[k] = v
 		}
+		// D47: a put-back writes the live definition back through the same writer as a restore, which takes the
+		// install identity from the folder's app.yaml — so the live install keeps its own (no env, no secret here).
+		if info.InstallID != "" {
+			if wErr := os.WriteFile(filepath.Join(dir, "app.yaml"), []byte("install_id: "+info.InstallID+"\n"), 0o600); wErr != nil {
+				d.cleanup()
+				return nil, wErr
+			}
+		}
 	}
 	return d, nil
 }