D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

controller/internal/web/handlers.go

@@ -1342,7 +1342,13 @@ func (s *Server) backupsRestoreHandler(w http.ResponseWriter, r *http.Request) {
 	if s.backupMgr != nil {
 		data["OffsiteRestoreCopies"] = s.backupMgr.ListOffsiteRestoreCopies()
 		// D25: second-drive copies whose source is gone — kept until the household removes one.
-		data["KeptCopies"] = s.keptCopyRows(s.langFor(r))
+		rows := s.keptCopyRows(s.langFor(r))
+		data["KeptCopies"] = rows
+		for _, k := range rows {
+			if k.Restorable {
+				data["KeptUnitRestorable"] = true // D47: the confirm script only when a row offers „Visszaállítás"
+			}
+		}
 		// R-487: removed apps whose unit was kept join the local restore picker.
 		data["RemovedApps"] = s.backupMgr.ListRemovedAppUnits()
 	}
@@ -1909,6 +1915,12 @@ func (s *Server) backupRestoreHandler(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/backups/restore?"+flashQuery("flash", "flash.restore.started"), http.StatusFound)
 }
 
+// restoreFailedNote is the household's sentence for a restore that returned an error: key's „…sikertelen: %s"
+// around the error's own sentence.
+func (s *Server) restoreFailedNote(key string, err error) string {
+	return s.note(key, s.noteErr(err))
+}
+
 // unitRestoreOutcomeMsg builds the OUTCOME sentence for a completed LOCAL recovery-unit restore. Pure,
 // so the wording is unit-testable — this string is the customer's only evidence that the operation did
 // what its label promised.