D47 follow-up: a set-aside tells the operator once (backup_run_failures, leg unit-set-aside, both identities, own run id). Red-proved. Commit only.

controller/internal/backup/unit_owner_test.go

@@ -302,3 +302,21 @@ func TestD47_OwnerVerdict(t *testing.T) {
 		}
 	}
 }
+
+// D47 follow-up (brief 2026-10-26 Part 5.2): a set-aside tells the operator once — the box's own households must not
+// set units aside silently after the floor. COMPANION RED-PROOF: drop the notify call → this fails.
+func TestD47_ASetAsideTellsTheOperatorOnce(t *testing.T) {
+	r := d47Setup(t, "aaaa000000000001")
+	var got []string
+	r.m.SetUnitSetAsideNotify(func(stack, unitID, liveID, dest string) { got = append(got, stack+" "+unitID+" "+liveID) })
+	r.reinstall("bbbb000000000002")
+	if err := r.m.captureRecoveryUnit("tandoor", false); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.m.captureRecoveryUnit("tandoor", false); err != nil { // the next refresh: nothing more to set aside
+		t.Fatal(err)
+	}
+	if len(got) != 1 || got[0] != "tandoor aaaa000000000001 bbbb000000000002" {
+		t.Fatalf("the operator hears once, with both identities: %v", got)
+	}
+}