D47 follow-up: a set-aside tells the operator once (backup_run_failures, leg unit-set-aside, both identities, own run id). Red-proved. Commit only.

controller/cmd/controller/main.go

@@ -1543,6 +1543,14 @@ func main() {
 		})
 		// R-893 option A (D20 = A): a failed off-site restore that was PUT BACK — the live volumes and definition poured
 		// back and the app started. The same operator-tier event as the hold above (no new event type), its own leg.
+		// D47 follow-up: a unit of an earlier install was set aside whole — the operator sees it (its own leg).
+		backupMgr.SetUnitSetAsideNotify(func(stack, unitID, liveID, dest string) {
+			d := notify.BackupRunFailuresDetails{RunID: "unit-set-aside-" + stack + "-" + filepath.Base(dest), RunKind: "backup", Failed: 1, Attempted: 1}
+			d.Apps = append(d.Apps, notify.RunFailureDetail{App: stack, Leg: "unit-set-aside", Reason: "the backup of an earlier install was set aside whole (D47)"})
+			msg := fmt.Sprintf("App %q: its backup belonged to an earlier install (%s; this install %s), so it was SET ASIDE whole at %s (D47) "+
+				"and listed on the restore page. Expected after a reinstall; not expected on an upgrade — look if no one reinstalled the app.", stack, unitID, liveID, dest)
+			notifier.NotifyBackupRunFailures(msg, d)
+		})
 		// D48: a restore refused BEFORE anything was touched because an image of the backup's version could not be
 		// downloaded — the operator line that tells a deleted version (R-698, R-933) from a busy registry.
 		backupMgr.SetRestorePullRefusedNotify(func(stack, ref string, cause error) {