ADFA-4971: don't misread a live restore as a killed install + confine…

controller/app/src/main/java/org/iiab/controller/redesign/BackupJobFragment.java

@@ -70,6 +70,7 @@ public static BackupJobFragment newInstance(String mode) {
     private org.iiab.controller.util.EllipsisAnimator statusDots;
     private boolean running = false;
     private long lastSeq = -1L;
+    private boolean leaveWarned = false;   // ADFA-4971: first Back reassures, later Backs background the app
     private androidx.activity.OnBackPressedCallback backGate;
 
     private final ActivityResultLauncher<String> createDoc =
@@ -108,12 +109,26 @@ public View onCreateView(@NonNull LayoutInflater inflater, @Nullable ViewGroup c
         // Hard gate: while the op runs, back is consumed with a styled snackbar (module-index behavior).
         backGate = new androidx.activity.OnBackPressedCallback(false) {
             @Override public void handleOnBackPressed() {
-                // ADFA-4961 (B): the op keeps running in DeepOpService, so leaving doesn't interrupt it.
-                // Show a soft, mode-specific hint (anchored to the activity so it survives the pop) and
-                // return to the bifurcation — no hard block. The notification brings the user back.
-                Snackbars.make(requireActivity().findViewById(android.R.id.content),
-                        isRestore() ? R.string.k2go_br_leave_restore : R.string.k2go_br_leave_backup).show();
-                popToIntro(false);
+                // ADFA-4971: confine like the module index (SetupProgressActivity.onBackPressed) — but
+                // only once the SERVICE owns the op (there is a notification and the work survives
+                // backgrounding). Then the op runs with the server stopped, and walking Back to a
+                // server-down Home is what triggered the false "reinstall" recovery: first Back
+                // reassures with the soft hint, every Back after sends the app to the background — never
+                // in-app nav to Home. During the pre-service copy+validate phase (restore) there's no
+                // notification yet and nothing is destructive, so a Back there just cancels to the
+                // bifurcation.
+                DeepOpState cur = DeepOpProgressRepository.get().current();
+                if (cur.owner == myOwner() && cur.isRunning()) {
+                    if (!leaveWarned) {
+                        leaveWarned = true;
+                        Snackbars.make(requireActivity().findViewById(android.R.id.content),
+                                isRestore() ? R.string.k2go_br_leave_restore : R.string.k2go_br_leave_backup).show();
+                    } else {
+                        requireActivity().moveTaskToBack(true);
+                    }
+                } else {
+                    popToIntro(false);
+                }
             }
         };
         requireActivity().getOnBackPressedDispatcher().addCallback(getViewLifecycleOwner(), backGate);
@@ -212,6 +227,7 @@ private void onDeepOpState(DeepOpState st) {
 
     private void beginRunning() {
         running = true;
+        leaveWarned = false;   // ADFA-4971: each op's first Back re-warns before backgrounding
         if (backGate != null) backGate.setEnabled(true);
         finish.setVisibility(View.GONE);
         if (anim != null) anim.playAnimation();

controller/app/src/main/java/org/iiab/controller/redesign/LibraryActivity.java

@@ -153,7 +153,13 @@ public android.graphics.Typeface fetchFont(String fontFamily) {
         recovering = !installing
                 && org.iiab.controller.InstallGuard.inProgress(this)
                 && !InstallProgressRepository.get().current().isRunning()
-                && !org.iiab.controller.install.presentation.ModuleQueueRepository.get().isRunning();
+                && !org.iiab.controller.install.presentation.ModuleQueueRepository.get().isRunning()
+                // ADFA-4971: a LIVE deep-env op (backup/restore, clone-receive) legitimately holds
+                // InstallGuard. Without this it was mistaken for a killed install → false "reinstall"
+                // dialog, and (via the !recovering guard) it blocked the return-to-op routing so a
+                // reopen fell to the boot gate instead of the op screen. ownerHeld self-heals after a
+                // true kill, so a genuinely interrupted restore still enters recovery.
+                && !org.iiab.controller.env.EnvironmentLock.ownerHeld(this);
         android.util.Log.i("K2Go-Recover", "onCreate recovering=" + recovering
                 + " marker=" + org.iiab.controller.InstallGuard.inProgress(this)
                 + " systemInstalled=" + systemInstalled