D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

controller/internal/stacks/restore_gate.go

@@ -29,6 +29,9 @@ type GateAtBackup struct {
 	Known    bool   // the backup carries a record
 	Closed   bool   // the gate was closed (the first setup not done)
 	OpenedBy string // who opened it, when open
+	// InstallID (D47) is the install the backup's data belongs to — the unit's app.yaml `install_id:`. "" = not
+	// recorded (a unit written before D47). Independent of Known (which is about the gate).
+	InstallID string
 }
 
 // GateCapture is the record a backup writes for an app: nil for a template with no gate. An app whose template gates
@@ -53,11 +56,15 @@ func ReadGateAtBackup(appYamlPath string) GateAtBackup {
 	}
 	var doc struct {
 		SetupGate *appbackup.GateState `yaml:"setup_gate"`
+		InstallID string               `yaml:"install_id"`
 	}
-	if yaml.Unmarshal(b, &doc) != nil || doc.SetupGate == nil {
+	if yaml.Unmarshal(b, &doc) != nil {
 		return GateAtBackup{}
 	}
-	return GateAtBackup{Known: true, Closed: doc.SetupGate.State != SetupGateOpen, OpenedBy: doc.SetupGate.OpenedBy}
+	if doc.SetupGate == nil {
+		return GateAtBackup{InstallID: doc.InstallID}
+	}
+	return GateAtBackup{Known: true, Closed: doc.SetupGate.State != SetupGateOpen, OpenedBy: doc.SetupGate.OpenedBy, InstallID: doc.InstallID}
 }
 
 // applyGateAtBackup decides the restored app's gate (R-1057). removed = the app had no app.yaml before this restore.