D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

controller/internal/backup/tier2.go

@@ -449,6 +449,10 @@ func (m *Manager) RunTier2(stackName string) error {
 	} else if m.restoreRunningFor(stackName) {
 		m.logger.Printf("[WARN] [backup] Tier 2 %s stopped before the unit leg — a restore of it began (R-1180)", stackName)
 		return nil
+	} else if gErr := m.guardUnitDir(stackName, destUnit, target.NamespaceRoot, "second-drive copy of the unit"); gErr != nil {
+		// D47: the second drive's copy of an EARLIER install's unit is set aside whole before this install's is
+		// mirrored — or the leg is skipped and that copy stays as it is.
+		warns = append(warns, m.note("note.tier2.unit_other_install_kept"))
 	} else if err := mirror(unitDir, destUnit); err != nil {
 		m.recordTier2Failure(stackName, target, err)
 		if m.tier2Notify != nil {