D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

controller/internal/backup/tier2_kept.go

@@ -39,7 +39,7 @@ func (m *Manager) keepCopy(kind, source, drive, reason, destBase, path string) {
 		m.logger.Printf("[WARN] [backup] kept copy %s could not be recorded (the copy itself is kept): %v", path, err)
 		return
 	}
-	m.logger.Printf("[INFO] [backup] second-drive copy KEPT (source gone: %s): %s %q at %s", reason, kind, source, path)
+	m.logger.Printf("[INFO] [backup] copy KEPT (%s): %s %q at %s", reason, kind, source, path)
 }
 
 // releaseKeptCopy forgets the record of path because its source is back (the run mirrored it again). Data untouched.