diff --git a/controller/app/src/main/java/org/appdevforall/k2go/InstallGuard.java b/controller/app/src/main/java/org/appdevforall/k2go/InstallGuard.java
index ad24a25a..2d869b4a 100644
--- a/controller/app/src/main/java/org/appdevforall/k2go/InstallGuard.java
+++ b/controller/app/src/main/java/org/appdevforall/k2go/InstallGuard.java
@@ -31,6 +31,12 @@
  * (a dead launch) — and folds the three scattered in-memory "is the planter still running" checks into
  * one durable fact.
  *
+ * <p><b>K2GO-384: a fourth reading, {@link #isDamaged DAMAGED}</b> (a sentinel token, {@link #markDamaged}).
+ * A dead-launch marker is <em>inferred</em> damage — the base might be fine, so it is tried. A destructive
+ * write force-cancelled mid-rootfs (a restore extract) is <em>known</em> damage — a distinct token says so,
+ * so the one reader that would otherwise try to boot it ({@code isSystemInstalled}) does not. It still reads
+ * {@code isInterrupted}, so recovery owns it with no other change. See ADR-5343c.
+ *
  * <p><b>Deliberately NOT self-healing like {@link org.appdevforall.k2go.env.EnvironmentLock}.</b>
  * EnvironmentLock deletes a stale marker on read, because a killed <em>coordination</em> lock means no
  * op is running so the lock must not stay held. InstallGuard also carries a <em>damage</em> job: a
@@ -44,6 +50,14 @@ public final class InstallGuard {
 
     private static final String MARKER = ".install_in_progress";
 
+    /**
+     * K2GO-384: the sentinel token for KNOWN damage — a destructive write (today: a force-cancelled restore
+     * extract) that deliberately abandoned a half-applied rootfs. Not a per-launch UUID, so it can never
+     * equal a {@link ProcessSession#ID}: it reads as not-{@link #isLive}, still {@link #isInterrupted}
+     * (recovery owns it, unchanged), and additionally {@link #isDamaged}. See ADR-5343c.
+     */
+    private static final String DAMAGED_TOKEN = "DAMAGED";
+
     private InstallGuard() {
     }
 
@@ -69,6 +83,24 @@ public static void end(Context ctx) {
         marker(ctx).delete();
     }
 
+    /**
+     * K2GO-384: downgrade the marker to KNOWN-DAMAGED. Written by the owner of a destructive write that has
+     * decided to abandon a half-applied rootfs (today: a force-cancelled restore extract, {@code
+     * DeepOpService}). It overwrites the LIVE token this launch planted at the extract boundary, so the base
+     * stops reading as "an install running now" — the {@code k2go_busy_install} gate lifts and the box is no
+     * longer held down by a live-install holder. The marker stays present and reads {@link #isInterrupted},
+     * so the entire recovery/verdict path owns it exactly as it owns a dead-launch marker — the only added
+     * fact is {@link #isDamaged} (see it for the one reader that treats known damage differently). Overwrites,
+     * like {@link #begin}.
+     */
+    public static void markDamaged(Context ctx) {
+        try (FileWriter w = new FileWriter(marker(ctx), false)) {
+            w.write(DAMAGED_TOKEN);
+        } catch (IOException ignored) {
+            // Best-effort: a marker left LIVE still recovers next launch (token mismatch -> INTERRUPTED).
+        }
+    }
+
     /**
      * A marker planted by THIS process launch — an install is running now, in this process. The
      * coordination readers (is-installed, the holder, the toggle gate, canStartServer) read this: only a
@@ -90,6 +122,20 @@ public static boolean isInterrupted(Context ctx) {
         return token != null && !ProcessSession.ID.equals(token);
     }
 
+    /**
+     * K2GO-384: a marker a destructive op left after deliberately abandoning a half-applied rootfs — KNOWN
+     * damage, as opposed to the {@link #isInterrupted} state's INFERRED damage (a dead launch's token, which
+     * might be a perfectly fine base). A known-damaged marker also reads {@code isInterrupted} (so recovery
+     * owns it unchanged); the one place the distinction matters is {@code
+     * SystemStateEvaluator.isSystemInstalled}: an interrupted base falls through to {@code rootfsPresent} and
+     * is <em>tried</em> — booting it is how recovery tells a fine base from a damaged one (ADFA-5330) — but a
+     * known-damaged base is <em>not installed</em> and must not be booted at all (there is nothing to learn
+     * from trying; it would only flap the reconciler on a torn rootfs). See ADR-5343c. Never deletes.
+     */
+    public static boolean isDamaged(Context ctx) {
+        return DAMAGED_TOKEN.equals(read(ctx));
+    }
+
     /**
      * The marker exists at all — a LIVE or an INTERRUPTED install, regardless of which launch planted it.
      * The right query where an interrupted install must count the same as a live one: "is anything here or
diff --git a/controller/app/src/main/java/org/appdevforall/k2go/SystemStateEvaluator.java b/controller/app/src/main/java/org/appdevforall/k2go/SystemStateEvaluator.java
index 5c1ae7c0..e2b6c672 100644
--- a/controller/app/src/main/java/org/appdevforall/k2go/SystemStateEvaluator.java
+++ b/controller/app/src/main/java/org/appdevforall/k2go/SystemStateEvaluator.java
@@ -54,6 +54,14 @@ public static boolean isSystemInstalled(Context ctx) {
         if (InstallGuard.isLive(ctx)) {
             return false;
         }
+        // K2GO-384 (ADR-5343c): KNOWN damage — a destructive write (a force-cancelled restore extract) left a
+        // half-applied rootfs and said so with a sentinel token. Unlike an INTERRUPTED marker (a dead launch,
+        // maybe-fine → falls through to rootfsPresent so the reconciler may TRY to boot it, ADFA-5330), this
+        // base is not installed: there is nothing to learn from booting a rootfs we tore ourselves. Forcing
+        // false keeps desired=DOWN (no flap on the torn base); recovery still owns it via isInterrupted.
+        if (InstallGuard.isDamaged(ctx)) {
+            return false;
+        }
         return rootfsPresent(ctx);
     }
 
diff --git a/controller/app/src/main/java/org/appdevforall/k2go/TarExtractor.java b/controller/app/src/main/java/org/appdevforall/k2go/TarExtractor.java
index f9ce3420..d84d22b2 100644
--- a/controller/app/src/main/java/org/appdevforall/k2go/TarExtractor.java
+++ b/controller/app/src/main/java/org/appdevforall/k2go/TarExtractor.java
@@ -61,8 +61,35 @@ default void onProgress(int percent, long done, long total, String line) { }
          * callers on the non-gzip path (e.g. .xz restores) keep the member-count behavior.
          */
         default void onExtractPhase(Phase phase, int passPercent, long etaSeconds, String line) { }
+
+        /**
+         * K2GO-384: the extract phase is about to write its first byte over the destination -- the
+         * point of no return. Fires once, after verify and every fail-closed check pass and after the
+         * cancel check, BEFORE any write. The restore plants its destructive recovery marker here,
+         * decoupled from the progress callbacks. Default no-op.
+         */
+        default void onExtractStarting() { }
+
+        /**
+         * K2GO-384: extraction was cancelled in the pre-destructive zone (copy/verify or the
+         * verify->extract boundary) -- nothing was written to the destination. Restore-only; other
+         * callers pass no cancel token and never see this. Default no-op.
+         */
+        default void onCancelled() { }
+
+        /**
+         * K2GO-384: the user pressed Cancel DURING verify and is still deciding. The `tar -t` was killed
+         * for responsiveness, but nothing was written and the copied archive is intact, so the caller HOLDS
+         * (keeps the temp) and offers Keep (re-run this same pass) or Cancel (abort). Restore-only; other
+         * callers pass no hold token and never see this. Default no-op.
+         */
+        default void onHeldForDecision() { }
     }
 
+    /** K2GO-384: thrown when verify is stopped for a still-undecided Cancel -- distinct from a confirmed
+     *  cancel so the caller can HOLD (keep the temp) and re-run this pass, rather than abort. */
+    private static final class HeldForDecisionException extends RuntimeException { }
+
     /** ADFA-5118: counts bytes pulled from the underlying (compressed) stream, so the feeders can
      *  measure progress against the archive size on disk without a sidecar. */
     private static final class CountingInputStream extends java.io.FilterInputStream {
@@ -89,6 +116,29 @@ public void startExtraction(Context context, String archivePath, String destDir,
      *        archive to look like a rootfs of THIS app's architecture before extracting.
      */
     public void startExtraction(Context context, String archivePath, String destDir, boolean validateRootfs, ExtractionListener listener) {
+        startExtraction(context, archivePath, destDir, validateRootfs, null, null, null, listener);
+    }
+
+    /**
+     * K2GO-384: as above, plus three tokens with strictly separated zones (ADR-5343c de-aliasing):
+     * <ul>
+     *   <li>{@code cancelledBeforeExtract} — a confirmed abort in the SAFE zone. Read ONLY during copy/verify
+     *       and at the verify->extract boundary; aborts before any byte is written ({@link
+     *       ExtractionListener#onCancelled}). It is NOT read once the extract is writing.</li>
+     *   <li>{@code pauseAtBoundary} — HOLD at the verify->extract boundary (verify done, nothing written)
+     *       until it clears (resume -> extract) or a cancel is confirmed.</li>
+     *   <li>{@code forceCancelDuringExtract} — an ACKNOWLEDGED destructive kill. Read ONLY by the extract
+     *       feeder (past the point of no return); kills tar mid-write, leaving the rootfs torn. Kept separate
+     *       from {@code cancelledBeforeExtract} so a safe-zone abort can never reach the feeder and damage the
+     *       system.</li>
+     * </ul>
+     * {@code null} tokens = never cancellable (the import/install paths).
+     */
+    public void startExtraction(Context context, String archivePath, String destDir, boolean validateRootfs,
+                                java.util.concurrent.atomic.AtomicBoolean cancelledBeforeExtract,
+                                java.util.concurrent.atomic.AtomicBoolean pauseAtBoundary,
+                                java.util.concurrent.atomic.AtomicBoolean forceCancelDuringExtract,
+                                ExtractionListener listener) {
         if (isExtracting) return;
 
         new Thread(() -> {
@@ -135,7 +185,7 @@ public void startExtraction(Context context, String archivePath, String destDir,
                     }
                 }
 
-                List<String> entries = listEntries(tarBinary, archivePath, isGzip, listener);
+                List<String> entries = listEntries(tarBinary, archivePath, isGzip, cancelledBeforeExtract, pauseAtBoundary, listener);
                 for (String entry : entries) {
                     if (ArchiveEntry.escapesRoot(entry)) {
                         throw new Exception("Unsafe archive entry (path traversal): " + entry);
@@ -161,6 +211,16 @@ public void startExtraction(Context context, String archivePath, String destDir,
                     }
                 }
 
+                // K2GO-384: the point of no return. Verify and every fail-closed check have passed and
+                // nothing has been written yet. A cancel confirmed during verify (or in the tiny window at
+                // this boundary) aborts here with the destination untouched. Otherwise announce the
+                // destructive phase (the caller plants its recovery marker) and proceed -- from the first
+                // write on, cancel is ignored.
+                if (cancelledBeforeExtract != null && cancelledBeforeExtract.get()) {
+                    throw new java.util.concurrent.CancellationException("cancelled before extract");
+                }
+                listener.onExtractStarting();
+
                 // 2. BUILD THE COMMAND
                 List<String> command = new ArrayList<>();
                 command.add(tarBinary);
@@ -185,12 +245,10 @@ public void startExtraction(Context context, String archivePath, String destDir,
                 // ADFA-4544: retain the last output lines (stderr is merged) for diagnostics.
                 final java.util.concurrent.ConcurrentLinkedDeque<String> tarTail = new java.util.concurrent.ConcurrentLinkedDeque<>();
                 final Handler uiHandler = new Handler(Looper.getMainLooper());
-                // ADFA-5118: EXTRACT-pass byte progress. The current member comes from the reader
-                // thread (below); the compressed byte count comes from the feeder (further below),
-                // measured against the archive size on disk — the same currency as the VERIFY pass.
-                final String[] lastExtractFile = {""};
+                // K2GO-384: EXTRACT-pass progress + ETA are driven by MEMBERS WRITTEN, tracked in the
+                // reader thread below (tar -v emits one line per member as it lands on disk). extractStartMs
+                // is the pass clock that thread uses for the rate/ETA.
                 final long extractStartMs = SystemClock.elapsedRealtime();
-                final long compressedTotalBytes = new File(archivePath).length();
                 Thread readerThread = new Thread(() -> {
                     long[] lastEmit = {0L};
                     long[] lastLog = {0L};
@@ -202,7 +260,6 @@ public void startExtraction(Context context, String archivePath, String destDir,
                             // it does not flood logcat and get dropped "over proc quota" (ADFA-4544).
                             tarTail.addLast(line);
                             while (tarTail.size() > 20) tarTail.pollFirst();
-                            lastExtractFile[0] = line;   // ADFA-5118: current member for the byte-based emit
                             long now = System.currentTimeMillis();
                             if (now - lastLog[0] >= 250) {
                                 lastLog[0] = now;
@@ -218,6 +275,14 @@ public void startExtraction(Context context, String archivePath, String destDir,
                                     listener.onProgress(l);
                                     listener.onProgress(pct, d, totalMembers, l);
                                 });
+                                // K2GO-384: the unified EXTRACT bar + ETA track MEMBERS WRITTEN (one tar -v
+                                // line per member as it lands on disk), not compressed bytes read from the
+                                // .gz. The byte count saturated at ~99% the instant the archive was fully
+                                // piped into tar, freezing the bar and reading "under a min" for minutes
+                                // while tar was still writing the (much larger) rootfs. Members track the
+                                // real work, so the bar keeps moving and the ETA reads honest minutes.
+                                emitPhase(listener, uiHandler, Phase.EXTRACT,
+                                        d, totalMembers, SystemClock.elapsedRealtime() - extractStartMs, l);
                             }
                         }
                     } catch (Exception ignored) {
@@ -234,24 +299,29 @@ public void startExtraction(Context context, String archivePath, String destDir,
                     // try-with-resources): once tar dies its stdin flush/close re-throws EPIPE,
                     // which would escape to the outer catch and hide tar's real cause (ADFA-4544).
                     OutputStream tarInput = tarProcess.getOutputStream();
-                    long lastByteEmit = 0L;
-                    // ADFA-5118: count compressed bytes pulled from disk for the EXTRACT-pass bar; cis
-                    // lives in the try-with-resources so it closes even if GZIPInputStream throws.
-                    try (CountingInputStream cis = new CountingInputStream(new FileInputStream(archivePath));
-                         GZIPInputStream gis = new GZIPInputStream(cis)) {
+                    // K2GO-384: this feeder only decompresses the .gz into tar's stdin now; the EXTRACT-pass
+                    // bar/ETA are emitted from the reader thread (members written), which is what actually
+                    // tracks tar writing the rootfs to disk. (VERIFY still counts bytes read — there,
+                    // reading the archive IS the work, so that measure is honest.)
+                    try (FileInputStream fis = new FileInputStream(archivePath);
+                         GZIPInputStream gis = new GZIPInputStream(fis)) {
 
                         byte[] buffer = new byte[8192]; // 8KB RAM chunk
                         int bytesRead;
                         while ((bytesRead = gis.read(buffer)) != -1) {
+                            // K2GO-384 (ADR-5343c): force-cancel DURING extract (acknowledged destructive).
+                            // Reads its OWN token, never cancelledBeforeExtract -- a safe-zone abort must not be
+                            // able to reach here and tear the rootfs. Kill tar mid-write; InstallGuard was
+                            // planted at extract start, so recovery reinstalls. The non-zero tar exit surfaces
+                            // via onError, which the caller maps to the "damaged" message.
+                            if (forceCancelDuringExtract != null && forceCancelDuringExtract.get()) {
+                                tarProcess.destroy();
+                                pipeBroke = true;
+                                break;
+                            }
                             try {
                                 tarInput.write(buffer, 0, bytesRead);
                                 totalWritten += bytesRead;
-                                long now = SystemClock.elapsedRealtime();
-                                if (compressedTotalBytes > 0L && now - lastByteEmit >= 200) {
-                                    lastByteEmit = now;
-                                    emitPhase(listener, uiHandler, Phase.EXTRACT,
-                                            cis.count, compressedTotalBytes, now - extractStartMs, lastExtractFile[0]);
-                                }
                             } catch (java.io.IOException pipe) {
                                 // ADFA-4544: tar (the pipe reader) closed its stdin early -> it
                                 // failed or was killed. Don't report a generic decompression error;
@@ -303,6 +373,18 @@ public void startExtraction(Context context, String archivePath, String destDir,
                     }
                 });
 
+            } catch (HeldForDecisionException held) {
+                // K2GO-384: verify stopped for an undecided Cancel -- nothing written, the copied temp is
+                // intact. The caller holds and offers re-run / abort.
+                isExtracting = false;
+                Log.d(TAG, "Verify held for a pending cancel decision");
+                new Handler(Looper.getMainLooper()).post(listener::onHeldForDecision);
+            } catch (java.util.concurrent.CancellationException ce) {
+                // K2GO-384: cancelled in the pre-destructive zone -- nothing was written, so this is not
+                // a failure. The destination rootfs is untouched and no InstallGuard marker was planted.
+                isExtracting = false;
+                Log.d(TAG, "Extraction cancelled before any write");
+                new Handler(Looper.getMainLooper()).post(listener::onCancelled);
             } catch (Exception e) {
                 isExtracting = false;
                 Log.e(TAG, "Fatal Extraction Error", e);
@@ -337,6 +419,8 @@ private static void emitPhase(ExtractionListener listener, Handler uiHandler, Ph
      * member name, so the current file is surfaced too — symmetric with the extract pass.
      */
     private List<String> listEntries(String tarBinary, String archivePath, boolean isGzip,
+                                     java.util.concurrent.atomic.AtomicBoolean cancelledBeforeExtract,
+                                     java.util.concurrent.atomic.AtomicBoolean pauseAtBoundary,
                                      ExtractionListener listener) throws Exception {
         List<String> names = new ArrayList<>();
         List<String> listCmd = new ArrayList<>();
@@ -386,6 +470,18 @@ private List<String> listEntries(String tarBinary, String archivePath, boolean i
         try (BufferedReader reader = new BufferedReader(new InputStreamReader(listProcess.getInputStream()))) {
             String line;
             while ((line = reader.readLine()) != null) {
+                // K2GO-384: Cancel during verify. A confirmed cancel aborts (kill the lister -> onCancelled).
+                // A still-undecided Cancel (pauseAtBoundary) kills the lister too -- for responsiveness --
+                // but unwinds to onHeldForDecision so the caller keeps the copied temp and can re-run this
+                // pass. Both act before any write.
+                if (cancelledBeforeExtract != null && cancelledBeforeExtract.get()) {
+                    listProcess.destroy();
+                    throw new java.util.concurrent.CancellationException("cancelled during verify");
+                }
+                if (pauseAtBoundary != null && pauseAtBoundary.get()) {
+                    listProcess.destroy();
+                    throw new HeldForDecisionException();
+                }
                 names.add(line);
                 lastFile[0] = line;   // ADFA-5118: the member tar -t is listing right now
             }
diff --git a/controller/app/src/main/java/org/appdevforall/k2go/deepop/DeepOpProgressRepository.java b/controller/app/src/main/java/org/appdevforall/k2go/deepop/DeepOpProgressRepository.java
index db805a31..51d886a0 100644
--- a/controller/app/src/main/java/org/appdevforall/k2go/deepop/DeepOpProgressRepository.java
+++ b/controller/app/src/main/java/org/appdevforall/k2go/deepop/DeepOpProgressRepository.java
@@ -40,9 +40,10 @@ public DeepOpState current() {
     public boolean isRunning() { return current().isRunning(); }
 
     // All posts are thread-safe (callable from the DeepOpService worker thread).
-    public void postRunning(EnvironmentLock.Owner owner, String step, int percent) { post(DeepOpState.running(owner, step, percent)); }
+    public void postRunning(EnvironmentLock.Owner owner, String step, int percent, long etaSeconds, DeepOpState.CancelKind cancelKind) { post(DeepOpState.running(owner, step, percent, etaSeconds, cancelKind)); }
     public void postSuccess(EnvironmentLock.Owner owner, String message) { post(DeepOpState.success(owner, message)); }
     public void postFailed(EnvironmentLock.Owner owner, String message) { post(DeepOpState.failed(owner, message)); }
+    public void postCancelled(EnvironmentLock.Owner owner) { post(DeepOpState.cancelled(owner)); }
     public void postIdle() { post(DeepOpState.idle()); }
 
     private synchronized void post(DeepOpState s) {
diff --git a/controller/app/src/main/java/org/appdevforall/k2go/deepop/DeepOpService.java b/controller/app/src/main/java/org/appdevforall/k2go/deepop/DeepOpService.java
index 629d69db..b3a5fd28 100644
--- a/controller/app/src/main/java/org/appdevforall/k2go/deepop/DeepOpService.java
+++ b/controller/app/src/main/java/org/appdevforall/k2go/deepop/DeepOpService.java
@@ -72,6 +72,10 @@ public final class DeepOpService extends Service {
     public static final String ACTION_BACKUP = "org.iiab.controller.DEEPOP_BACKUP";
     public static final String ACTION_RESTORE = "org.iiab.controller.DEEPOP_RESTORE";
     public static final String ACTION_CANCEL = "org.iiab.controller.DEEPOP_CANCEL";
+    // K2GO-384: the pausable-copy handshake -- Cancel pauses the copy, then the confirm dialog resolves it.
+    public static final String ACTION_RESUME = "org.iiab.controller.DEEPOP_RESUME";
+    public static final String ACTION_CANCEL_CONFIRM = "org.iiab.controller.DEEPOP_CANCEL_CONFIRM";
+    public static final String ACTION_FORCE_CANCEL = "org.iiab.controller.DEEPOP_FORCE_CANCEL";   // K2GO-384: acknowledged cancel DURING extract
     public static final String EXTRA_URI = "uri";     // backup: SAF dest; restore: SAF source
 
     /** K2GO-372: a restore is one run of three passes — stage the file, verify it, extract it — so they
@@ -89,6 +93,29 @@ public final class DeepOpService extends Service {
     private volatile boolean done = false;       // terminal reached (cancel OR natural) — clean up once
     private EnvironmentLock.Owner owner;
     private String stepText = "";
+    /** K2GO-384 (ADR-5343c): a CONFIRMED abort in the SAFE zone (copy / verify / the verify->extract
+     *  boundary). The copy loop and TarExtractor's verify + boundary read it and abort with the rootfs
+     *  untouched. It is NEVER read by the extract feeder -- a safe-zone abort must not be able to tear the
+     *  rootfs (that is {@link #forceExtractCancel}'s job). Set only while currentCancelKind == CANCELLABLE. */
+    private final java.util.concurrent.atomic.AtomicBoolean cancelBeforeExtract = new java.util.concurrent.atomic.AtomicBoolean(false);
+    /** K2GO-384 (ADR-5343c): an ACKNOWLEDGED destructive kill, read ONLY by the extract feeder (past the
+     *  point of no return). Set only while currentCancelKind == DESTRUCTIVE. Kept separate from
+     *  cancelBeforeExtract so the two cancel intents can never alias across the verify->extract boundary. */
+    private final java.util.concurrent.atomic.AtomicBoolean forceExtractCancel = new java.util.concurrent.atomic.AtomicBoolean(false);
+    /** K2GO-384: the owner of "one verify+extract pass at a time". Set when a pass starts, cleared at every
+     *  pass outcome (complete / error / cancelled / held). Guards the re-callable attemptVerifyAndExtract so a
+     *  "Keep restoring" cannot start a second pass over the same temp while one is running. */
+    private volatile boolean passRunning = false;
+    /** K2GO-384: true while the user is deciding on a paused COPY (Cancel pressed). The copy loop blocks on
+     *  it; ACTION_RESUME clears it (continue), ACTION_CANCEL_CONFIRM sets cancelBeforeExtract and clears it
+     *  (abort). Only the copy is pausable -- verify/extract are external tar processes. */
+    private final java.util.concurrent.atomic.AtomicBoolean pauseRequested = new java.util.concurrent.atomic.AtomicBoolean(false);
+    /** K2GO-384: what cancelling the current restore pass means -- set from the real phase, published in
+     *  DeepOpState so the UI shows the right dialog without guessing from the step text. */
+    private volatile DeepOpState.CancelKind currentCancelKind = DeepOpState.CancelKind.NONE;
+    /** K2GO-384: non-null while a verify pass is HELD for an undecided Cancel -- carries the copied temp so
+     *  ACTION_RESUME can re-run verify+extract on it (no re-copy) and ACTION_CANCEL_CONFIRM can delete it. */
+    private volatile String heldTempPath = null;
 
     /** Start a backup: stream a gzip'd tar of the rootfs to the SAF destination. */
     public static void startBackup(Context ctx, Uri dest) {
@@ -118,6 +145,35 @@ public int onStartCommand(Intent intent, int flags, int startId) {
         if (intent == null) { stopSelf(); return START_NOT_STICKY; }
         final String action = intent.getAction();
         if (ACTION_CANCEL.equals(action)) { if (started) cancel(); else stopSelf(); return START_NOT_STICKY; }
+        // K2GO-384: resolve a paused COPY -- resume (keep restoring) or confirm the cancel (abort).
+        if (ACTION_RESUME.equals(action)) {
+            // K2GO-384: keep restoring. A paused COPY just resumes; a HELD verify re-runs on the same temp
+            // (verify + extract, no re-copy).
+            pauseRequested.set(false);
+            final String held = heldTempPath;
+            if (held != null) { heldTempPath = null; attemptVerifyAndExtract(held); }
+            return START_NOT_STICKY;
+        }
+        if (ACTION_CANCEL_CONFIRM.equals(action)) {
+            // K2GO-384 (ADR-5343c): the reversible abort applies ONLY in the safe zone. Guarding on the
+            // service's own currentCancelKind (not the UI's lagging copy) means a confirm that races past the
+            // verify->extract boundary is ignored here -- the extract simply finishes -- rather than reaching
+            // the feeder. The system is never torn by a "system unchanged" confirm.
+            if (started && currentCancelKind == DeepOpState.CancelKind.CANCELLABLE) {
+                cancelBeforeExtract.set(true);   // a paused COPY bails on this; stageThenRestore then cleans up
+                pauseRequested.set(false);
+                final String held = heldTempPath;
+                if (held != null) { heldTempPath = null; main.post(() -> endRestore(held, false, "")); }
+            }
+            return START_NOT_STICKY;
+        }
+        // K2GO-384 (ADR-5343c): acknowledged cancel DURING extract -- kill tar mid-write via its OWN token.
+        // Guarded on DESTRUCTIVE so it acts only past the point of no return; InstallGuard stays planted so
+        // recovery reinstalls.
+        if (ACTION_FORCE_CANCEL.equals(action)) {
+            if (started && currentCancelKind == DeepOpState.CancelKind.DESTRUCTIVE) forceExtractCancel.set(true);
+            return START_NOT_STICKY;
+        }
         if (started) return START_NOT_STICKY;   // one op per service instance
         started = true;
 
@@ -195,6 +251,7 @@ private void stageThenRestore(final String uriStr) {
                     endRestore(temp.getAbsolutePath(), false, outcome);
                     return;
                 }
+                currentCancelKind = DeepOpState.CancelKind.CANCELLABLE;   // K2GO-384: stopping -- cancellable
                 setStep(getString(R.string.k2go_br_status_stopping), -1);
                 EnvironmentControl.stop(this, this::log, () -> runRestore(temp.getAbsolutePath()));
             });
@@ -278,8 +335,19 @@ private String stageArchive(Uri src, File temp, long size) {
             if (in == null) throw new IOException("The picked file could not be opened");
             byte[] buf = new byte[1 << 16];
             long copied = 0L, lastEmit = 0L;
+            final long startMs = android.os.SystemClock.elapsedRealtime();
+            currentCancelKind = DeepOpState.CancelKind.CANCELLABLE;   // K2GO-384: copy -- cancellable (pauses here)
             int n;
             while ((n = in.read(buf)) != -1) {   // a 0-length read is not end of stream
+                // K2GO-384: Cancel during the copy PAUSES here (our native loop). Block while paused; a
+                // confirmed cancel sets cancelBeforeExtract and we bail (endRestore deletes the temp, the
+                // rootfs untouched); resume just continues. The empty return is never shown -- a cancel
+                // returns the screen to the bifurcation.
+                if (cancelBeforeExtract.get()) return "";
+                while (pauseRequested.get() && !cancelBeforeExtract.get()) {
+                    try { Thread.sleep(120L); } catch (InterruptedException e) { return ""; }
+                }
+                if (cancelBeforeExtract.get()) return "";
                 out.write(buf, 0, n);
                 copied += n;
                 long now = android.os.SystemClock.elapsedRealtime();
@@ -288,7 +356,13 @@ private String stageArchive(Uri src, File temp, long size) {
                     final int pct = org.appdevforall.k2go.deploy.domain.ExtractProgress
                             .unifiedPercent(org.appdevforall.k2go.deploy.domain.ExtractProgress
                                     .percent(copied, size), COPY_PASS, RESTORE_PASSES);
-                    main.post(() -> setStep(getString(R.string.k2go_br_status_copying), pct));
+                    // K2GO-384: the copy is the restore's first pass; give it the same live per-pass ETA
+                    // the extract/verify passes already report (TarExtractor computes theirs the same way).
+                    final long rate = org.appdevforall.k2go.system.domain.TransferRate
+                            .perSecond(copied, now - startMs);
+                    final long eta = org.appdevforall.k2go.deploy.domain.ExtractProgress
+                            .etaSeconds(copied, size, rate);
+                    main.post(() -> setStep(getString(R.string.k2go_br_status_copying), pct, eta));
                 }
             }
             out.flush();
@@ -323,13 +397,63 @@ private void runRestore(final String path) {
         // thrown away what the user asked for over an operation that never happened.
         org.appdevforall.k2go.system.data.ContentStateInvalidator.replacementStarting(this,
                 org.appdevforall.k2go.system.domain.SystemReplacement.Cause.RESTORE);
+        attemptVerifyAndExtract(path);
+    }
+
+    /**
+     * K2GO-384: run (or RE-run) the verify + extract on the already-staged {@code path}. Re-callable so a
+     * "Keep restoring" after a Cancel raised during verify re-runs just this pass -- verify (`tar -t`) then
+     * extract -- on the copied temp, WITHOUT re-copying. The copy above is never repeated.
+     */
+    private void attemptVerifyAndExtract(final String path) {
+        if (done || passRunning) return;   // K2GO-384: one verify+extract pass at a time (service is the owner)
+        passRunning = true;
+        currentCancelKind = DeepOpState.CancelKind.CANCELLABLE;   // K2GO-384: verify -- cancellable (kill + hold)
         setStep(getString(R.string.k2go_br_status_checking), 0);
         final File destParent = new File(getFilesDir(), "rootfs");
         new TarExtractor().startExtraction(this, path, destParent.getAbsolutePath(), true,
+                cancelBeforeExtract, pauseRequested, forceExtractCancel,
                 new TarExtractor.ExtractionListener() {
-                    @Override public void onComplete(String destDir) { main.post(() -> endRestore(path, true, null)); }
-                    @Override public void onError(String error) { main.post(() -> endRestore(path, false, error)); }
+                    @Override public void onComplete(String destDir) { passRunning = false; main.post(() -> endRestore(path, true, null)); }
+                    @Override public void onError(String error) {
+                        passRunning = false;
+                        // K2GO-384 (ADR-5343c): "known damage" is owned by "the extract began and did not
+                        // complete", not by the cancel button. isLive == true means onExtractStarting planted
+                        // the marker, i.e. the rootfs was being written and is now torn (a force-cancel OR a
+                        // real mid-write failure). Mark it DAMAGED so isLive drops (the k2go_busy_install gate
+                        // lifts, unblocking a fresh restore) and desired stays DOWN (isSystemInstalled=false, no
+                        // flap on the torn base); isInterrupted stays true so recovery owns it next launch/return.
+                        final boolean torn = InstallGuard.isLive(DeepOpService.this);
+                        if (torn) InstallGuard.markDamaged(DeepOpService.this);
+                        // forced only picks the MESSAGE: our own acknowledged kill -> the damaged line; a real
+                        // failure keeps its diagnostic (the system is still marked damaged above).
+                        final boolean forced = forceExtractCancel.get();
+                        main.post(() -> endRestore(path, false,
+                                forced ? getString(R.string.k2go_br_restore_damaged) : error));
+                    }
                     @Override public void onProgress(String line) { }
+                    // K2GO-384: the point of no return -- fired once at the verify->extract boundary, BEFORE
+                    // the first write, on the extractor thread. Plant the destructive marker here (decoupled
+                    // from the progress emits) so an ungraceful kill during the write is recovered next launch.
+                    @Override public void onExtractStarting() {
+                        currentCancelKind = DeepOpState.CancelKind.DESTRUCTIVE;   // K2GO-384: past the point of no return
+                        InstallGuard.begin(DeepOpService.this);
+                    }
+                    // K2GO-384: cancelled before any write (Option B) -- the rootfs is untouched and no marker
+                    // was planted. Delete the staged temp and end (the screen returns to the bifurcation, so
+                    // no terminal message is shown -- an empty reason keeps endRestore's cleanup path).
+                    @Override public void onCancelled() {
+                        passRunning = false;
+                        main.post(() -> endRestore(path, false, ""));
+                    }
+                    // K2GO-384: Cancel pressed during verify, still undecided -- `tar -t` was killed but the
+                    // copied temp is intact. HOLD: keep the temp and wait. ACTION_RESUME re-runs this pass on
+                    // the same temp (no re-copy); ACTION_CANCEL_CONFIRM aborts (deletes the temp, bifurcation).
+                    // passRunning drops here too: the extractor thread has exited, so a Keep may start a fresh pass.
+                    @Override public void onHeldForDecision() {
+                        passRunning = false;
+                        main.post(() -> heldTempPath = path);
+                    }
 
                     /**
                      * K2GO-372: a restore reads the whole archive three times — the copy above, the
@@ -343,23 +467,18 @@ private void runRestore(final String path) {
                     public void onExtractPhase(TarExtractor.Phase phase, int passPercent,
                                                long etaSeconds, String line) {
                         final boolean extracting = phase == TarExtractor.Phase.EXTRACT;
-                        // K2GO-372: the destructive window opens here, at the first byte written over the
-                        // rootfs. The marker used to be planted when the service started, which also
-                        // covered the copy and the whole verify pass — phases where a kill damages
-                        // nothing, so an ungraceful exit in them declared a false DAMAGED, and an archive
-                        // the extractor rejects would have left the system marked damaged untouched.
-                        // isLive() reads the marker itself, so knowing it is already planted needs no
-                        // second flag here.
-                        if (extracting && !InstallGuard.isLive(DeepOpService.this)) {
-                            InstallGuard.begin(DeepOpService.this);
-                        }
+                        // K2GO-384: the destructive marker (InstallGuard.begin) is now planted in
+                        // onExtractStarting() -- once, at the verify->extract boundary, before the first
+                        // write and decoupled from these progress emits -- so it no longer rides on the
+                        // first extract progress callback.
                         final int unified = org.appdevforall.k2go.deploy.domain.ExtractProgress
                                 .unifiedPercent(passPercent, extracting ? EXTRACT_PASS : VERIFY_PASS,
                                         RESTORE_PASSES);
                         final String label = getString(extracting
                                 ? R.string.k2go_br_status_restoring
                                 : R.string.k2go_br_status_checking);
-                        main.post(() -> setStep(label, unified));
+                        // K2GO-384: pass through the per-pass ETA TarExtractor already computed (was dropped).
+                        main.post(() -> setStep(label, unified, etaSeconds));
                     }
                 });
     }
@@ -374,6 +493,14 @@ private void endRestore(String tempPath, boolean ok, String failMessage) {
         }
         File temp = new File(tempPath);
         if (temp.exists()) temp.delete();
+        // K2GO-384 (ADR-5343c): an empty reason means a user cancel in the SAFE zone (copy/verify) -- terminal
+        // but not a failure. Route it to a CANCELLED terminal (the screen returns to the bifurcation, decided
+        // by phase so it survives a config change), not a "Restore failed" screen. A real failure or the
+        // acknowledged-damaged message (both non-empty) goes to FAILED.
+        if (!ok && (failMessage == null || failMessage.trim().isEmpty())) {
+            finishCancelled();
+            return;
+        }
         // K2GO-372: the extractor already produces the exact reason (wrong architecture, not a rootfs);
         // it used to be discarded here and replaced by a generic "Restore failed".
         finishJob(ok, getString(R.string.k2go_br_restore_done),
@@ -403,6 +530,21 @@ private void finishJob(boolean ok, String okMsg, String failMsg) {
         teardown();
     }
 
+    /**
+     * K2GO-384 (ADR-5343c): terminal for a user cancel in the safe zone (copy/verify). Same teardown as
+     * finishJob's failed path -- re-enable desired and drop the lock -- but posts a CANCELLED phase (not
+     * FAILED) and never touches InstallGuard: a pre-destructive cancel planted no marker, so there is nothing
+     * to end and nothing damaged.
+     */
+    private void finishCancelled() {
+        if (done) return;
+        done = true;
+        new org.appdevforall.k2go.Preferences(this).setWatchdogEnable(true);
+        EnvironmentLock.release(this);
+        DeepOpProgressRepository.get().postCancelled(owner);
+        teardown();
+    }
+
     /**
      * Notification "Cancel" — offered only for BACKUP (read-only, safe to abandon). Restore has no
      * Cancel action (destructive, hard gate). The in-flight backup stream sees {@code done} and no-ops
@@ -411,8 +553,16 @@ private void finishJob(boolean ok, String okMsg, String failMsg) {
     private void cancel() {
         if (owner == EnvironmentLock.Owner.BACKUP) {
             finishJob(false, "", getString(R.string.k2go_br_backup_failed));
+            return;
+        }
+        // K2GO-384: a Cancel on any pre-destructive pass (CANCELLABLE) HOLDS the run and waits for the
+        // confirm dialog. pauseRequested pauses the copy loop AND blocks the verify->extract boundary, so
+        // whether we are mid-copy or mid-verify nothing advances into the destructive extract while the user
+        // decides. ACTION_RESUME continues; ACTION_CANCEL_CONFIRM aborts. DESTRUCTIVE (extract) is not
+        // handled here -- it takes the acknowledged force-cancel path.
+        if (currentCancelKind == DeepOpState.CancelKind.CANCELLABLE) {
+            pauseRequested.set(true);
         }
-        // A stray CANCEL for restore (which has no cancel action) is ignored — the extract must finish.
     }
 
     private void teardown() {
@@ -423,14 +573,19 @@ private void teardown() {
     }
 
     // ---- progress ----
-    private void setStep(String step, int percent) {
+    private void setStep(String step, int percent) { setStep(step, percent, -1L); }
+
+    /** K2GO-384: overload carrying the current pass's ETA (seconds; {@code -1} = unknown/hidden). */
+    private void setStep(String step, int percent, long etaSeconds) {
         stepText = step;
         updateNotification(step);
-        post(step, percent);
+        post(step, percent, etaSeconds);
     }
 
-    private void post(String step, int percent) {
-        DeepOpProgressRepository.get().postRunning(owner, step, percent);
+    private void post(String step, int percent) { post(step, percent, -1L); }
+
+    private void post(String step, int percent, long etaSeconds) {
+        DeepOpProgressRepository.get().postRunning(owner, step, percent, etaSeconds, currentCancelKind);
     }
 
     private void log(String line) { Log.d(TAG, line); }
diff --git a/controller/app/src/main/java/org/appdevforall/k2go/deepop/DeepOpState.java b/controller/app/src/main/java/org/appdevforall/k2go/deepop/DeepOpState.java
index 0632fa45..db0ad00d 100644
--- a/controller/app/src/main/java/org/appdevforall/k2go/deepop/DeepOpState.java
+++ b/controller/app/src/main/java/org/appdevforall/k2go/deepop/DeepOpState.java
@@ -16,42 +16,68 @@
 
 public final class DeepOpState {
 
-    public enum Phase { IDLE, RUNNING, SUCCESS, FAILED }
+    // K2GO-384: CANCELLED is a terminal distinct from FAILED — a user cancel in the pre-destructive zone
+    // (copy/verify) is not an error. It lives on the state (not a fragment flag) so the "return to the
+    // bifurcation, not a failure screen" decision survives a config change (mirrors InstallState.Phase).
+    public enum Phase { IDLE, RUNNING, SUCCESS, FAILED, CANCELLED }
+
+    /**
+     * K2GO-384: what cancelling the CURRENT restore pass would do -- the single source the UI reads to
+     * pick the right dialog, owned by the service's real phase (never derived from the step text).
+     *   NONE        - not cancellable here (e.g. backup, or no op).
+     *   CANCELLABLE - a pre-destructive pass (copy / stopping / verify): tap Cancel HOLDS the run (the copy
+     *                 pauses mid-loop; verify runs to completion and holds at the verify->extract boundary,
+     *                 before any write) and asks -- Keep restoring (continue) or Cancel (abort, system
+     *                 unchanged). Reversible.
+     *   DESTRUCTIVE - the extract (`tar -x`, writing the rootfs): cancelling leaves the system damaged ->
+     *                 recovery reinstalls; needs the strong red + acknowledgement confirm.
+     */
+    public enum CancelKind { NONE, CANCELLABLE, DESTRUCTIVE }
 
     public final Phase phase;
     /** Which deep-env op this state belongs to (BACKUP / RESTORE / CLONE); null only when IDLE. */
     public final EnvironmentLock.Owner owner;
     public final int percent;      // 0..100, or -1 for indeterminate
+    public final long etaSeconds;  // K2GO-384: seconds left for the current pass, or -1 when unknown/hidden
+    public final CancelKind cancelKind;  // K2GO-384: what a Cancel here means (drives the UI's dialog)
     public final String step;      // resolved status label, e.g. "Backing up"
     public final String message;   // terminal message / error text
     public final long seq;         // assigned by the repository; identifies terminal events
 
-    private DeepOpState(Phase phase, EnvironmentLock.Owner owner, int percent, String step, String message, long seq) {
+    private DeepOpState(Phase phase, EnvironmentLock.Owner owner, int percent, long etaSeconds, CancelKind cancelKind, String step, String message, long seq) {
         this.phase = phase;
         this.owner = owner;
         this.percent = percent;
+        this.etaSeconds = etaSeconds;
+        this.cancelKind = cancelKind != null ? cancelKind : CancelKind.NONE;
         this.step = step != null ? step : "";
         this.message = message != null ? message : "";
         this.seq = seq;
     }
 
     public boolean isRunning() { return phase == Phase.RUNNING; }
-    public boolean isTerminal() { return phase == Phase.SUCCESS || phase == Phase.FAILED; }
+    public boolean isTerminal() { return phase == Phase.SUCCESS || phase == Phase.FAILED || phase == Phase.CANCELLED; }
 
     /** Returns a copy with the given sequence number (the repository assigns it). */
-    DeepOpState withSeq(long seq) { return new DeepOpState(phase, owner, percent, step, message, seq); }
+    DeepOpState withSeq(long seq) { return new DeepOpState(phase, owner, percent, etaSeconds, cancelKind, step, message, seq); }
 
-    public static DeepOpState idle() { return new DeepOpState(Phase.IDLE, null, 0, "", "", 0L); }
+    public static DeepOpState idle() { return new DeepOpState(Phase.IDLE, null, 0, -1L, CancelKind.NONE, "", "", 0L); }
 
-    public static DeepOpState running(EnvironmentLock.Owner owner, String step, int percent) {
-        return new DeepOpState(Phase.RUNNING, owner, percent, step, "", 0L);
+    public static DeepOpState running(EnvironmentLock.Owner owner, String step, int percent, long etaSeconds, CancelKind cancelKind) {
+        return new DeepOpState(Phase.RUNNING, owner, percent, etaSeconds, cancelKind, step, "", 0L);
     }
 
     public static DeepOpState success(EnvironmentLock.Owner owner, String message) {
-        return new DeepOpState(Phase.SUCCESS, owner, 0, "", message, 0L);
+        return new DeepOpState(Phase.SUCCESS, owner, 0, -1L, CancelKind.NONE, "", message, 0L);
     }
 
     public static DeepOpState failed(EnvironmentLock.Owner owner, String message) {
-        return new DeepOpState(Phase.FAILED, owner, 0, "", message, 0L);
+        return new DeepOpState(Phase.FAILED, owner, 0, -1L, CancelKind.NONE, "", message, 0L);
+    }
+
+    /** K2GO-384: a user cancel in the pre-destructive zone — terminal, but not a failure (no message; the
+     *  screen returns to the bifurcation). */
+    public static DeepOpState cancelled(EnvironmentLock.Owner owner) {
+        return new DeepOpState(Phase.CANCELLED, owner, 0, -1L, CancelKind.NONE, "", "", 0L);
     }
 }
diff --git a/controller/app/src/main/java/org/appdevforall/k2go/env/domain/ServerReconcile.java b/controller/app/src/main/java/org/appdevforall/k2go/env/domain/ServerReconcile.java
index 2ae86d93..b66d4ff6 100644
--- a/controller/app/src/main/java/org/appdevforall/k2go/env/domain/ServerReconcile.java
+++ b/controller/app/src/main/java/org/appdevforall/k2go/env/domain/ServerReconcile.java
@@ -64,6 +64,12 @@ public enum Intent {
      * marker-derived is ever added (e.g. a structural rootfs check), this invariant must be revisited —
      * desired would then have a reason to gate on health again.</b>
      *
+     * <p><b>K2GO-384 (ADR-5343c) added exactly such a signal — KNOWN damage from a force-cancelled restore
+     * ({@code InstallGuard.isDamaged}) — and kept this invariant intact.</b> Rather than teach {@code desired}
+     * to read health, a known-damaged base is folded into {@code installed=false} (in {@code
+     * SystemStateEvaluator.isSystemInstalled}, the same lever a LIVE install already uses), so {@code desired}
+     * stays DOWN through its existing {@code installed} argument. Desired still does not read {@code healthy}.
+     *
      * @param installed   a rootfs is present and no LIVE install is running over it.
      * @param userWantsOn the persisted user intent (today {@code Preferences.WatchdogEnable}).
      * @param holderClass the execution class of the current environment holder
diff --git a/controller/app/src/main/java/org/appdevforall/k2go/redesign/BackupJobFragment.java b/controller/app/src/main/java/org/appdevforall/k2go/redesign/BackupJobFragment.java
index e57a7c8d..88c3cb70 100644
--- a/controller/app/src/main/java/org/appdevforall/k2go/redesign/BackupJobFragment.java
+++ b/controller/app/src/main/java/org/appdevforall/k2go/redesign/BackupJobFragment.java
@@ -67,6 +67,12 @@ public static BackupJobFragment newInstance(String mode) {
     private View progressRow;
     private com.google.android.material.progressindicator.LinearProgressIndicator progress;
     private TextView progressPct;
+    /** K2GO-384: per-pass ETA caption next to the percent; blank when the pass can't estimate yet. */
+    private TextView progressEta;
+    /** K2GO-384: on-screen Cancel, shown only while a RESTORE is running and still before the extract. */
+    private View cancel;
+    /** K2GO-384: the current pass's cancel semantics (single source = DeepOpState.cancelKind). */
+    private DeepOpState.CancelKind lastCancelKind = DeepOpState.CancelKind.NONE;
     private org.appdevforall.k2go.util.EllipsisAnimator statusDots;
     private boolean running = false;
     private long lastSeq = -1L;
@@ -102,6 +108,8 @@ public View onCreateView(@NonNull LayoutInflater inflater, @Nullable ViewGroup c
         progressRow = v.findViewById(R.id.k2go_bj_progress_row);
         progress = v.findViewById(R.id.k2go_bj_progress);
         progressPct = v.findViewById(R.id.k2go_bj_progress_pct);
+        progressEta = v.findViewById(R.id.k2go_bj_progress_eta);
+        cancel = v.findViewById(R.id.k2go_bj_cancel);
         finish = v.findViewById(R.id.k2go_bj_finish);
         waitCard = v.findViewById(R.id.k2go_bj_wait_card);
         // ADFA-4947 fixed-width mode: this status line is centred, so variable-width dots slide the
@@ -111,6 +119,7 @@ public View onCreateView(@NonNull LayoutInflater inflater, @Nullable ViewGroup c
         title.setText(getString(isRestore() ? R.string.k2go_br_restore_title : R.string.k2go_br_backup_title));
         sub.setText(getString(isRestore() ? R.string.k2go_br_restore_sub : R.string.k2go_br_backup_sub));
         finish.setOnClickListener(x -> popToIntro(true));
+        cancel.setOnClickListener(x -> onCancelTapped());
 
         // Hard gate: while the op runs, back is consumed with a styled snackbar (module-index behavior).
         backGate = new androidx.activity.OnBackPressedCallback(false) {
@@ -147,7 +156,10 @@ public View onCreateView(@NonNull LayoutInflater inflater, @Nullable ViewGroup c
             beginRunning();                                   // deep-link / recreation into a live op
             setStatusAnimated(cur.step);
         } else if (s != null && cur.owner == myOwner() && cur.isTerminal()) {
-            showTerminal(cur.phase == DeepOpState.Phase.SUCCESS, cur.message);   // recreated at the result
+            // K2GO-384: a CANCELLED terminal returns to the bifurcation even when the fragment is recreated
+            // exactly at it (config change) -- the decision lives on the phase, not a fragment flag.
+            if (cur.phase == DeepOpState.Phase.CANCELLED) v.post(() -> popToIntro(false));
+            else showTerminal(cur.phase == DeepOpState.Phase.SUCCESS, cur.message);   // recreated at the result
         } else if (s == null) {
             v.post(this::launchPicker);                       // fresh entry: the intro card is the Start
         }
@@ -209,7 +221,7 @@ private void prepareRestore(Uri uri) {
      * <p>A negative percent means the step cannot say how far along it is, and a bar frozen at zero
      * reads as a stall — worse than no bar. Those steps keep the animation above instead.
      */
-    private void showProgress(int percent) {
+    private void showProgress(int percent, long etaSeconds) {
         if (progressRow == null) return;
         final boolean measurable = percent >= 0;
         progressRow.setVisibility(measurable ? View.VISIBLE : View.GONE);
@@ -217,6 +229,14 @@ private void showProgress(int percent) {
             progress.setProgressCompat(percent, true);
             progressPct.setText(percent + "%");   // matches the module-install and maps screens
         }
+        // K2GO-384: the per-pass ETA ("~2 min"), reusing the install screens' EtaText so the wording
+        // lives in one place. Blank (unknown, or not measurable yet) leaves the slot empty rather than
+        // showing a stale estimate — the bar and % already carry the progress.
+        if (progressEta != null) {
+            progressEta.setText(measurable
+                    ? org.appdevforall.k2go.install.presentation.EtaText.of(requireContext(), etaSeconds)
+                    : "");
+        }
     }
 
     // ---- observe the app-scoped op state (DeepOpService is the writer) ----
@@ -225,10 +245,17 @@ private void onDeepOpState(DeepOpState st) {
         if (st.isRunning()) {
             if (!running) beginRunning();
             setStatusAnimated(st.step);
-            showProgress(st.percent);
+            showProgress(st.percent, st.etaSeconds);
+            lastCancelKind = st.cancelKind;   // K2GO-384: track the current pass's cancel semantics
+            updateCancelVisibility();
         } else if (st.isTerminal() && st.seq > lastSeq) {
             lastSeq = st.seq;
-            showProgress(-1);   // K2GO-372: a finished op has no bar to keep filling
+            showProgress(-1, -1L);   // K2GO-372: a finished op has no bar to keep filling
+            // K2GO-384: a user cancel in the safe zone is its own terminal (CANCELLED) -- return to the
+            // bifurcation, not a "something went wrong" screen. The service owns that distinction now (the
+            // phase), so it holds across a config change. FAILED (a real error, or the acknowledged
+            // destructive cancel's "damaged" message) and SUCCESS both show a terminal.
+            if (st.phase == DeepOpState.Phase.CANCELLED) { popToIntro(false); return; }
             showTerminal(st.phase == DeepOpState.Phase.SUCCESS, st.message);
         }
     }
@@ -240,10 +267,12 @@ private void beginRunning() {
         finish.setVisibility(View.GONE);
         if (waitCard != null) waitCard.setVisibility(View.VISIBLE);
         if (anim != null) anim.playAnimation();
+        updateCancelVisibility();
     }
 
     private void showTerminal(boolean ok, String message) {
         running = false;
+        if (cancel != null) cancel.setVisibility(View.GONE);   // K2GO-384: no cancel once the op has ended
         if (backGate != null) backGate.setEnabled(false);   // done → back / Finish returns to the bifurcation
         if (statusDots != null) statusDots.stop();
         if (anim != null) anim.pauseAnimation();
@@ -261,6 +290,104 @@ private void setStatusAnimated(String text) {
         if (statusDots != null) statusDots.start(text);
     }
 
+    /**
+     * K2GO-384: on a cancellable pass (copy / stopping / verify) Cancel HOLDS the run -- the service pauses
+     * the copy loop or blocks the verify->extract boundary, so nothing advances into the destructive extract
+     * while the user decides -- and shows a light M3 dialog: Keep restoring (continue) / Cancel restore
+     * (abort, system unchanged). During the DESTRUCTIVE extract, Cancel instead shows the acknowledged
+     * force-cancel dialog (red + checkbox), which leaves the system damaged for recovery.
+     */
+    private void onCancelTapped() {
+        if (!isAdded()) return;
+        if (lastCancelKind == DeepOpState.CancelKind.DESTRUCTIVE) { showDestructiveCancelDialog(); return; }
+        if (lastCancelKind != DeepOpState.CancelKind.CANCELLABLE) return;
+        sendToService(DeepOpService.ACTION_CANCEL);   // hold the run while the user decides (no race)
+        // K2GO-384: non-cancelable -- the run is HELD (copy paused / verify blocked at the boundary) the moment
+        // this shows, so the user MUST resolve it. A scrim/Back dismiss would leave pauseRequested set and hang
+        // the restore forever; forcing a Keep/Cancel choice closes that lifecycle gap.
+        new BrandDialog(requireContext())
+                .setCancelable(false)
+                .setTitle(getString(R.string.k2go_br_cancel_title))
+                .setMessage(getString(R.string.k2go_br_cancel_body))
+                .setPositive(R.string.k2go_br_cancel_confirm, () -> {
+                    if (cancel != null) cancel.setEnabled(false);
+                    sendToService(DeepOpService.ACTION_CANCEL_CONFIRM);   // abort -> CANCELLED terminal -> bifurcation
+                })
+                .setNegative(R.string.k2go_br_cancel_keep, () -> sendToService(DeepOpService.ACTION_RESUME))
+                .show();
+    }
+
+    private void sendToService(String action) {
+        if (!isAdded()) return;
+        requireContext().startService(
+                new android.content.Intent(requireContext(), DeepOpService.class).setAction(action));
+    }
+
+    /**
+     * K2GO-384: cancelling DURING the extract is destructive -- the rootfs is being overwritten. A strong
+     * M3 dialog: RED confirm (colorError) gated by an acknowledgement checkbox. Confirming force-cancels the
+     * extract (kills tar mid-write); the system is left torn and reinstalls itself on next boot (InstallGuard).
+     * Unlike the trivial cancel, this keeps a terminal so the user is told the system will be reinstalled.
+     */
+    private void showDestructiveCancelDialog() {
+        if (!isAdded()) return;
+        final float density = getResources().getDisplayMetrics().density;
+        // ADFA-5339 pattern: a MaterialCheckBox as a dialog's custom view sits flush-left; a holder padded by
+        // dialogPreferredPadding (the title/message inset) with the checkbox's own left padding at 0 lines it
+        // up with the text above.
+        final com.google.android.material.checkbox.MaterialCheckBox box =
+                new com.google.android.material.checkbox.MaterialCheckBox(requireContext());
+        box.setText(R.string.k2go_br_cancel_extract_ack);
+        box.setCompoundDrawablePadding(Math.round(8 * density));
+        final int pad = dialogContentPadding();
+        final android.widget.FrameLayout holder = new android.widget.FrameLayout(requireContext());
+        holder.setPadding(pad, Math.round(8 * density), pad, 0);
+        holder.addView(box);
+        final androidx.appcompat.app.AlertDialog d =
+                new com.google.android.material.dialog.MaterialAlertDialogBuilder(requireContext())
+                        .setTitle(R.string.k2go_br_cancel_title)
+                        .setMessage(R.string.k2go_br_cancel_extract_body)
+                        .setView(holder)
+                        .setPositiveButton(R.string.k2go_br_cancel_confirm, null)   // click set below to gate dismiss
+                        .setNegativeButton(R.string.k2go_br_cancel_keep, null)
+                        .show();
+        final android.widget.Button confirm = d.getButton(androidx.appcompat.app.AlertDialog.BUTTON_POSITIVE);
+        confirm.setTextColor(ContextCompat.getColor(requireContext(), R.color.btn_danger));   // same red as BrandDialog DESTRUCTIVE
+        // K2GO-384: keep the button ENABLED and validate on click -- an inert disabled button gives no
+        // feedback; a snackbar tells the user why nothing happened until they acknowledge.
+        confirm.setOnClickListener(v -> {
+            if (!box.isChecked()) {
+                Snackbars.make(requireActivity().findViewById(android.R.id.content),
+                        R.string.k2go_br_cancel_extract_need_ack).show();
+                return;
+            }
+            // K2GO-384: the destructive kill ends as FAILED with the "damaged" message (non-empty), so the
+            // terminal shows -- the user sees "the next launch will start recovery" (no CANCELLED short-circuit).
+            if (cancel != null) cancel.setEnabled(false);
+            sendToService(DeepOpService.ACTION_FORCE_CANCEL);
+            d.dismiss();
+        });
+    }
+
+    /** The dialog's horizontal content inset (title/message use it); a custom view must match it to line up
+     *  (ADFA-5339). */
+    private int dialogContentPadding() {
+        android.util.TypedValue tv = new android.util.TypedValue();
+        if (requireContext().getTheme().resolveAttribute(androidx.appcompat.R.attr.dialogPreferredPadding, tv, true)) {
+            return android.util.TypedValue.complexToDimensionPixelSize(tv.data, getResources().getDisplayMetrics());
+        }
+        return Math.round(24 * getResources().getDisplayMetrics().density);   // Material default
+    }
+
+    /** K2GO-384: Cancel is shown while the current pass is cancellable (PAUSABLE copy or ABORTABLE
+     *  verify/stopping). It hides at the destructive extract and when there is nothing to cancel. */
+    private void updateCancelVisibility() {
+        if (cancel == null || !isAdded()) return;
+        boolean show = running && (lastCancelKind == DeepOpState.CancelKind.CANCELLABLE
+                || lastCancelKind == DeepOpState.CancelKind.DESTRUCTIVE);
+        cancel.setVisibility(show ? View.VISIBLE : View.GONE);
+    }
+
     /** Return to the bifurcation (BackupRestoreFragment). When {@code fromFinish}, arm the intro's
      *  index-style "returning to Home" countdown. */
     private void popToIntro(boolean fromFinish) {
diff --git a/controller/app/src/main/res/layout/fragment_k2go_backup_job.xml b/controller/app/src/main/res/layout/fragment_k2go_backup_job.xml
index 5d987046..1a7d695b 100644
--- a/controller/app/src/main/res/layout/fragment_k2go_backup_job.xml
+++ b/controller/app/src/main/res/layout/fragment_k2go_backup_job.xml
@@ -115,27 +115,42 @@
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
             android:layout_marginTop="12dp"
-            android:gravity="center_vertical"
-            android:orientation="horizontal"
+            android:orientation="vertical"
             android:visibility="gone">
 
             <com.google.android.material.progressindicator.LinearProgressIndicator
                 android:id="@+id/k2go_bj_progress"
-                android:layout_width="0dp"
+                android:layout_width="match_parent"
                 android:layout_height="wrap_content"
-                android:layout_weight="1"
                 android:indeterminate="false"
+                app:trackCornerRadius="4dp"
                 android:max="100" />
 
-            <TextView
-                android:id="@+id/k2go_bj_progress_pct"
-                android:layout_width="wrap_content"
+            <!-- K2GO-384: the % and the per-pass ETA sit on their own line BELOW the full-width bar
+                 (mirrors the module-install / maps Preparing rows) so the ETA never shortens the bar.
+                 ETA reuses the install screens' EtaText; blank when the pass can't estimate yet. -->
+            <LinearLayout
+                android:layout_width="match_parent"
                 android:layout_height="wrap_content"
-                android:layout_marginStart="12dp"
-                android:minWidth="44dp"
-                android:gravity="end"
-                android:textAppearance="?attr/textAppearanceLabelMedium"
-                android:textColor="@color/k2go_muted" />
+                android:layout_marginTop="6dp"
+                android:orientation="horizontal">
+
+                <TextView
+                    android:id="@+id/k2go_bj_progress_pct"
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:textAppearance="?attr/textAppearanceLabelMedium"
+                    android:textColor="@color/k2go_muted" />
+
+                <TextView
+                    android:id="@+id/k2go_bj_progress_eta"
+                    android:layout_width="0dp"
+                    android:layout_height="wrap_content"
+                    android:layout_weight="1"
+                    android:gravity="end"
+                    android:textAppearance="?attr/textAppearanceLabelMedium"
+                    android:textColor="@color/k2go_muted" />
+            </LinearLayout>
         </LinearLayout>
 
         <!-- "this takes time" info card, matching the module install / maps Preparing screens. -->
@@ -206,6 +221,19 @@
                 android:textIsSelectable="true" />
         </ScrollView>
 
+        <!-- K2GO-384: Cancel, shown only while a RESTORE is running and still before the destructive
+             extract (the fragment gates it on InstallGuard.isLive). Low-emphasis text button; shares the
+             slot with Finish (mutually exclusive by state). GONE until shown. -->
+        <com.google.android.material.button.MaterialButton
+            android:id="@+id/k2go_bj_cancel"
+            style="@style/Widget.Material3.Button.TextButton"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="12dp"
+            android:visibility="gone"
+            android:text="@string/k2go_cancel"
+            android:gravity="center" />
+
         <!-- Terminal action: the module index owns this navigation; here the screen does. GONE until done.
              A styled TextView-as-button (like Clone's) so the custom background isn't overridden by
              MaterialButton's backgroundTint. -->
diff --git a/controller/app/src/main/res/values-ar/strings.xml b/controller/app/src/main/res/values-ar/strings.xml
index 8f4d6728..3a642751 100644
--- a/controller/app/src/main/res/values-ar/strings.xml
+++ b/controller/app/src/main/res/values-ar/strings.xml
@@ -638,6 +638,14 @@
     <string name="k2go_br_restore_confirm">استبدال النظام</string>
     <string name="k2go_br_restore_done">تمت استعادة النظام</string>
     <string name="k2go_br_restore_failed">فشلت الاستعادة</string>
+    <string name="k2go_br_cancel_title">إلغاء الاستعادة?</string>
+    <string name="k2go_br_cancel_body">نظامك الحالي دون تغيير. يمكنك بدء الاستعادة مرة أخرى في أي وقت.</string>
+    <string name="k2go_br_cancel_confirm">إلغاء الاستعادة</string>
+    <string name="k2go_br_cancel_keep">متابعة الاستعادة</string>
+    <string name="k2go_br_cancel_extract_body">تتم كتابة نظامك الآن. سيؤدي الإلغاء إلى جعله غير قابل للاستخدام حتى تتم إعادة تثبيته تلقائيًا.</string>
+    <string name="k2go_br_cancel_extract_ack">أفهم أن الإلغاء الآن قد يترك نظامي تالفًا أو غير قابل للاستخدام.</string>
+    <string name="k2go_br_restore_damaged">تم إلغاء الاستعادة. سيبدأ نظامك في وضع الاسترداد عند التشغيل التالي.</string>
+    <string name="k2go_br_cancel_extract_need_ack">حدد المربع لتأكيد فهمك.</string>
     <string name="k2go_br_restore_unreadable">تعذّرت قراءة الملف المحدد، لذا لم يتغيّر أي شيء.</string>
     <string name="deepop_channel_name">النسخ الاحتياطي والاستعادة</string>
     <string name="deepop_channel_desc">يُبقي عملية نسخ احتياطي أو استعادة قيد التشغيل بأمان في الخلفية</string>
diff --git a/controller/app/src/main/res/values-az/strings.xml b/controller/app/src/main/res/values-az/strings.xml
index fabaee95..b6ee64bc 100644
--- a/controller/app/src/main/res/values-az/strings.xml
+++ b/controller/app/src/main/res/values-az/strings.xml
@@ -658,6 +658,14 @@
     <string name="k2go_br_restore_confirm">Sistemi əvəz et</string>
     <string name="k2go_br_restore_done">Sistem bərpa olundu</string>
     <string name="k2go_br_restore_failed">Bərpa alınmadı</string>
+    <string name="k2go_br_cancel_title">Bərpanı ləğv edilsin?</string>
+    <string name="k2go_br_cancel_body">Cari sisteminiz dəyişməyib. Bərpanı istənilən vaxt yenidən başlada bilərsiniz.</string>
+    <string name="k2go_br_cancel_confirm">Bərpanı ləğv et</string>
+    <string name="k2go_br_cancel_keep">Bərpanı davam etdir</string>
+    <string name="k2go_br_cancel_extract_body">Sisteminiz indi yazılır. Ləğv etmək onu özünü yenidən quraşdırana qədər yararsız hala salacaq.</string>
+    <string name="k2go_br_cancel_extract_ack">İndi ləğv etməyin sistemimi zədələnmiş və ya yararsız qoya biləcəyini başa düşürəm.</string>
+    <string name="k2go_br_restore_damaged">Bərpa ləğv edildi. Sisteminiz növbəti işə salınmada bərpa rejimində başlayacaq.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Başa düşdüyünüzü təsdiqləmək üçün qutunu işarələyin.</string>
     <string name="k2go_br_restore_unreadable">Seçilmiş fayl oxuna bilmədi, ona görə heç nə dəyişdirilmədi.</string>
     <string name="deepop_channel_name">Ehtiyat nüsxə &amp; bərpa</string>
     <string name="deepop_channel_desc">Ehtiyat nüsxə və ya bərpanı arxa planda təhlükəsiz işlədir</string>
diff --git a/controller/app/src/main/res/values-bg/strings.xml b/controller/app/src/main/res/values-bg/strings.xml
index 6e58e643..40d9349b 100644
--- a/controller/app/src/main/res/values-bg/strings.xml
+++ b/controller/app/src/main/res/values-bg/strings.xml
@@ -645,6 +645,14 @@
     <string name="k2go_br_restore_confirm">Замени системата</string>
     <string name="k2go_br_restore_done">Системата е възстановена</string>
     <string name="k2go_br_restore_failed">Неуспешно възстановяване</string>
+    <string name="k2go_br_cancel_title">Отказ на възстановяването?</string>
+    <string name="k2go_br_cancel_body">Текущата ви система е непроменена. Можете да стартирате възстановяването отново по всяко време.</string>
+    <string name="k2go_br_cancel_confirm">Отказ на възстановяването</string>
+    <string name="k2go_br_cancel_keep">Продължи възстановяването</string>
+    <string name="k2go_br_cancel_extract_body">Системата ви се записва в момента. Отказът ще я направи неизползваема, докато не се преинсталира сама.</string>
+    <string name="k2go_br_cancel_extract_ack">Разбирам, че отказът сега може да остави системата ми повредена или неизползваема.</string>
+    <string name="k2go_br_restore_damaged">Възстановяването е отказано. Системата ви ще стартира в режим на възстановяване при следващото стартиране.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Отметнете полето, за да потвърдите, че разбирате.</string>
     <string name="k2go_br_restore_unreadable">Избраният файл не можа да бъде прочетен, затова нищо не беше променено.</string>
     <string name="deepop_channel_name">Резервно копие и възстановяване</string>
     <string name="deepop_channel_desc">Поддържа безопасното изпълнение на резервно копие или възстановяване във фонов режим</string>
diff --git a/controller/app/src/main/res/values-bn/strings.xml b/controller/app/src/main/res/values-bn/strings.xml
index cdfd2570..35ce5781 100644
--- a/controller/app/src/main/res/values-bn/strings.xml
+++ b/controller/app/src/main/res/values-bn/strings.xml
@@ -651,6 +651,14 @@
     <string name="k2go_br_restore_confirm">সিস্টেম প্রতিস্থাপন করুন</string>
     <string name="k2go_br_restore_done">সিস্টেম পুনরুদ্ধার হয়েছে</string>
     <string name="k2go_br_restore_failed">পুনরুদ্ধার ব্যর্থ হয়েছে</string>
+    <string name="k2go_br_cancel_title">পুনরুদ্ধার বাতিল করবেন?</string>
+    <string name="k2go_br_cancel_body">আপনার বর্তমান সিস্টেম অপরিবর্তিত আছে। আপনি যেকোনো সময় আবার পুনরুদ্ধার শুরু করতে পারেন।</string>
+    <string name="k2go_br_cancel_confirm">পুনরুদ্ধার বাতিল করুন</string>
+    <string name="k2go_br_cancel_keep">পুনরুদ্ধার চালিয়ে যান</string>
+    <string name="k2go_br_cancel_extract_body">আপনার সিস্টেম এখন লেখা হচ্ছে। বাতিল করলে এটি নিজে থেকে পুনরায় ইনস্টল না হওয়া পর্যন্ত ব্যবহারের অযোগ্য থাকবে।</string>
+    <string name="k2go_br_cancel_extract_ack">আমি বুঝি যে এখন বাতিল করলে আমার সিস্টেম ক্ষতিগ্রস্ত বা ব্যবহারের অযোগ্য হয়ে যেতে পারে।</string>
+    <string name="k2go_br_restore_damaged">পুনরুদ্ধার বাতিল করা হয়েছে। পরবর্তী চালুতে আপনার সিস্টেম রিকভারি মোডে শুরু হবে।</string>
+    <string name="k2go_br_cancel_extract_need_ack">আপনি বুঝেছেন তা নিশ্চিত করতে বাক্সটি চেক করুন।</string>
     <string name="k2go_br_restore_unreadable">নির্বাচিত ফাইলটি পড়া যায়নি, তাই কিছুই পরিবর্তন করা হয়নি।</string>
     <string name="deepop_channel_name">ব্যাকআপ ও পুনরুদ্ধার</string>
     <string name="deepop_channel_desc">ব্যাকআপ বা পুনরুদ্ধার ব্যাকগ্রাউন্ডে নিরাপদে চালু রাখে</string>
diff --git a/controller/app/src/main/res/values-cs/strings.xml b/controller/app/src/main/res/values-cs/strings.xml
index 0d79e433..967a6ec9 100644
--- a/controller/app/src/main/res/values-cs/strings.xml
+++ b/controller/app/src/main/res/values-cs/strings.xml
@@ -645,6 +645,14 @@
     <string name="k2go_br_restore_confirm">Nahradit systém</string>
     <string name="k2go_br_restore_done">Systém obnoven</string>
     <string name="k2go_br_restore_failed">Obnova selhala</string>
+    <string name="k2go_br_cancel_title">Zrušit obnovení?</string>
+    <string name="k2go_br_cancel_body">Váš aktuální systém zůstává nezměněn. Obnovení můžete kdykoli spustit znovu.</string>
+    <string name="k2go_br_cancel_confirm">Zrušit obnovení</string>
+    <string name="k2go_br_cancel_keep">Pokračovat v obnovení</string>
+    <string name="k2go_br_cancel_extract_body">Váš systém se právě zapisuje. Zrušení jej ponechá nepoužitelný, dokud se sám znovu nenainstaluje.</string>
+    <string name="k2go_br_cancel_extract_ack">Rozumím, že zrušení nyní může můj systém poškodit nebo učinit nepoužitelným.</string>
+    <string name="k2go_br_restore_damaged">Obnovení zrušeno. Váš systém se při příštím spuštění spustí v režimu obnovy.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Zaškrtnutím políčka potvrďte, že rozumíte.</string>
     <string name="k2go_br_restore_unreadable">Vybraný soubor se nepodařilo přečíst, takže se nic nezměnilo.</string>
     <string name="deepop_channel_name">Záloha &amp; obnova</string>
     <string name="deepop_channel_desc">Udržuje zálohu nebo obnovu bezpečně spuštěnou na pozadí</string>
diff --git a/controller/app/src/main/res/values-de/strings.xml b/controller/app/src/main/res/values-de/strings.xml
index cd919f93..f46aa1af 100644
--- a/controller/app/src/main/res/values-de/strings.xml
+++ b/controller/app/src/main/res/values-de/strings.xml
@@ -638,6 +638,14 @@
     <string name="k2go_br_restore_confirm">System ersetzen</string>
     <string name="k2go_br_restore_done">System wiederhergestellt</string>
     <string name="k2go_br_restore_failed">Wiederherstellung fehlgeschlagen</string>
+    <string name="k2go_br_cancel_title">Wiederherstellung abbrechen?</string>
+    <string name="k2go_br_cancel_body">Ihr aktuelles System bleibt unverändert. Sie können die Wiederherstellung jederzeit erneut starten.</string>
+    <string name="k2go_br_cancel_confirm">Wiederherstellung abbrechen</string>
+    <string name="k2go_br_cancel_keep">Wiederherstellung fortsetzen</string>
+    <string name="k2go_br_cancel_extract_body">Ihr System wird gerade geschrieben. Ein Abbruch macht es unbrauchbar, bis es sich selbst neu installiert.</string>
+    <string name="k2go_br_cancel_extract_ack">Ich verstehe, dass ein Abbruch jetzt mein System beschädigen oder unbrauchbar machen kann.</string>
+    <string name="k2go_br_restore_damaged">Wiederherstellung abgebrochen. Ihr System startet beim nächsten Start im Wiederherstellungsmodus.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Aktivieren Sie das Kontrollkästchen, um zu bestätigen, dass Sie es verstanden haben.</string>
     <string name="k2go_br_restore_unreadable">Die ausgewählte Datei konnte nicht gelesen werden, daher wurde nichts geändert.</string>
     <string name="deepop_channel_name">Sichern &amp; wiederherstellen</string>
     <string name="deepop_channel_desc">Hält ein Backup oder eine Wiederherstellung sicher im Hintergrund am Laufen</string>
diff --git a/controller/app/src/main/res/values-el/strings.xml b/controller/app/src/main/res/values-el/strings.xml
index 5853cae6..867c0bf0 100644
--- a/controller/app/src/main/res/values-el/strings.xml
+++ b/controller/app/src/main/res/values-el/strings.xml
@@ -645,6 +645,14 @@
     <string name="k2go_br_restore_confirm">Αντικατάσταση συστήματος</string>
     <string name="k2go_br_restore_done">Το σύστημα επαναφέρθηκε</string>
     <string name="k2go_br_restore_failed">Αποτυχία επαναφοράς</string>
+    <string name="k2go_br_cancel_title">Ακύρωση επαναφοράς?</string>
+    <string name="k2go_br_cancel_body">Το τρέχον σύστημά σας παραμένει αμετάβλητο. Μπορείτε να ξεκινήσετε ξανά την επαναφορά οποιαδήποτε στιγμή.</string>
+    <string name="k2go_br_cancel_confirm">Ακύρωση επαναφοράς</string>
+    <string name="k2go_br_cancel_keep">Συνέχεια επαναφοράς</string>
+    <string name="k2go_br_cancel_extract_body">Το σύστημά σας εγγράφεται τώρα. Η ακύρωση θα το αφήσει άχρηστο μέχρι να επανεγκατασταθεί μόνο του.</string>
+    <string name="k2go_br_cancel_extract_ack">Καταλαβαίνω ότι η ακύρωση τώρα μπορεί να αφήσει το σύστημά μου κατεστραμμένο ή άχρηστο.</string>
+    <string name="k2go_br_restore_damaged">Η επαναφορά ακυρώθηκε. Το σύστημά σας θα ξεκινήσει σε λειτουργία ανάκτησης κατά την επόμενη εκκίνηση.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Επιλέξτε το πλαίσιο για να επιβεβαιώσετε ότι καταλαβαίνετε.</string>
     <string name="k2go_br_restore_unreadable">Δεν ήταν δυνατή η ανάγνωση του επιλεγμένου αρχείου, επομένως δεν άλλαξε τίποτα.</string>
     <string name="deepop_channel_name">Αντίγραφο ασφαλείας &amp; επαναφορά</string>
     <string name="deepop_channel_desc">Διατηρεί ένα αντίγραφο ασφαλείας ή μια επαναφορά σε ασφαλή εκτέλεση στο παρασκήνιο</string>
diff --git a/controller/app/src/main/res/values-es/strings.xml b/controller/app/src/main/res/values-es/strings.xml
index 30c768e9..5550364d 100644
--- a/controller/app/src/main/res/values-es/strings.xml
+++ b/controller/app/src/main/res/values-es/strings.xml
@@ -714,6 +714,14 @@
     <string name="k2go_br_restore_confirm">Reemplazar sistema</string>
     <string name="k2go_br_restore_done">Sistema restaurado</string>
     <string name="k2go_br_restore_failed">La restauración falló</string>
+    <string name="k2go_br_cancel_title">¿Cancelar la restauración?</string>
+    <string name="k2go_br_cancel_body">Tu sistema actual no ha cambiado. Puedes iniciar la restauración de nuevo en cualquier momento.</string>
+    <string name="k2go_br_cancel_confirm">Cancelar restauración</string>
+    <string name="k2go_br_cancel_keep">Continuar restaurando</string>
+    <string name="k2go_br_cancel_extract_body">Tu sistema se está escribiendo ahora. Cancelar lo dejará inutilizable hasta que se reinstale por sí solo.</string>
+    <string name="k2go_br_cancel_extract_ack">Entiendo que cancelar ahora puede dejar mi sistema dañado o inutilizable.</string>
+    <string name="k2go_br_restore_damaged">Restauración cancelada. Tu sistema se iniciará en modo de recuperación en el próximo arranque.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Marca la casilla para confirmar que lo entiendes.</string>
     <string name="k2go_br_restore_unreadable">No se pudo leer el archivo seleccionado, así que no se cambió nada.</string>
     <string name="deepop_channel_name">Copia de seguridad y restauración</string>
     <string name="deepop_channel_desc">Mantiene una copia o restauración ejecutándose de forma segura en segundo plano</string>
diff --git a/controller/app/src/main/res/values-fa/strings.xml b/controller/app/src/main/res/values-fa/strings.xml
index fecb922d..85dcd518 100644
--- a/controller/app/src/main/res/values-fa/strings.xml
+++ b/controller/app/src/main/res/values-fa/strings.xml
@@ -638,6 +638,14 @@
     <string name="k2go_br_restore_confirm">جایگزینی سیستم</string>
     <string name="k2go_br_restore_done">سیستم بازیابی شد</string>
     <string name="k2go_br_restore_failed">بازیابی ناموفق بود</string>
+    <string name="k2go_br_cancel_title">لغو بازیابی?</string>
+    <string name="k2go_br_cancel_body">سیستم فعلی شما بدون تغییر است. می‌توانید بازیابی را در هر زمان دوباره شروع کنید.</string>
+    <string name="k2go_br_cancel_confirm">لغو بازیابی</string>
+    <string name="k2go_br_cancel_keep">ادامه بازیابی</string>
+    <string name="k2go_br_cancel_extract_body">سیستم شما در حال نوشته شدن است. لغو کردن آن را تا زمانی که خودش را دوباره نصب کند غیرقابل استفاده می‌کند.</string>
+    <string name="k2go_br_cancel_extract_ack">می‌فهمم که لغو کردن اکنون ممکن است سیستم من را آسیب‌دیده یا غیرقابل استفاده کند.</string>
+    <string name="k2go_br_restore_damaged">بازیابی لغو شد. سیستم شما در راه‌اندازی بعدی در حالت بازیابی شروع می‌شود.</string>
+    <string name="k2go_br_cancel_extract_need_ack">برای تأیید اینکه متوجه شدید، کادر را علامت بزنید.</string>
     <string name="k2go_br_restore_unreadable">فایل انتخاب‌شده خوانده نشد، بنابراین چیزی تغییر نکرد.</string>
     <string name="deepop_channel_name">پشتیبان‌گیری و بازیابی</string>
     <string name="deepop_channel_desc">پشتیبان‌گیری یا بازیابی را با ایمنی در پس‌زمینه اجرا نگه می‌دارد</string>
diff --git a/controller/app/src/main/res/values-fr/strings.xml b/controller/app/src/main/res/values-fr/strings.xml
index 549cdd34..a6d3f650 100644
--- a/controller/app/src/main/res/values-fr/strings.xml
+++ b/controller/app/src/main/res/values-fr/strings.xml
@@ -716,6 +716,14 @@
     <string name="k2go_br_restore_confirm">Remplacer le système</string>
     <string name="k2go_br_restore_done">Système restauré</string>
     <string name="k2go_br_restore_failed">Échec de la restauration</string>
+    <string name="k2go_br_cancel_title">Annuler la restauration?</string>
+    <string name="k2go_br_cancel_body">Votre système actuel est inchangé. Vous pouvez relancer la restauration à tout moment.</string>
+    <string name="k2go_br_cancel_confirm">Annuler la restauration</string>
+    <string name="k2go_br_cancel_keep">Continuer la restauration</string>
+    <string name="k2go_br_cancel_extract_body">Votre système est en cours d\'écriture. L\'annulation le rendra inutilisable jusqu\'à ce qu\'il se réinstalle.</string>
+    <string name="k2go_br_cancel_extract_ack">Je comprends que l\'annulation maintenant peut laisser mon système endommagé ou inutilisable.</string>
+    <string name="k2go_br_restore_damaged">Restauration annulée. Votre système démarrera en mode récupération au prochain lancement.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Cochez la case pour confirmer que vous avez compris.</string>
     <string name="k2go_br_restore_unreadable">Le fichier sélectionné n\'a pas pu être lu, donc rien n\'a été modifié.</string>
     <string name="deepop_channel_name">Sauvegarde &amp; restauration</string>
     <string name="deepop_channel_desc">Maintient une sauvegarde ou une restauration en cours en toute sécurité en arrière-plan</string>
diff --git a/controller/app/src/main/res/values-gu/strings.xml b/controller/app/src/main/res/values-gu/strings.xml
index d499fae9..d82fc630 100644
--- a/controller/app/src/main/res/values-gu/strings.xml
+++ b/controller/app/src/main/res/values-gu/strings.xml
@@ -651,6 +651,14 @@
     <string name="k2go_br_restore_confirm">સિસ્ટમ બદલો</string>
     <string name="k2go_br_restore_done">સિસ્ટમ રિસ્ટોર થઈ</string>
     <string name="k2go_br_restore_failed">રિસ્ટોર નિષ્ફળ</string>
+    <string name="k2go_br_cancel_title">પુનઃસ્થાપન રદ કરવું છે?</string>
+    <string name="k2go_br_cancel_body">તમારી વર્તમાન સિસ્ટમ યથાવત છે. તમે કોઈપણ સમયે ફરીથી પુનઃસ્થાપન શરૂ કરી શકો છો.</string>
+    <string name="k2go_br_cancel_confirm">પુનઃસ્થાપન રદ કરો</string>
+    <string name="k2go_br_cancel_keep">પુનઃસ્થાપન ચાલુ રાખો</string>
+    <string name="k2go_br_cancel_extract_body">તમારી સિસ્ટમ હમણાં લખાઈ રહી છે. રદ કરવાથી તે પોતાને ફરીથી ઇન્સ્ટોલ ન કરે ત્યાં સુધી બિનઉપયોગી રહેશે.</string>
+    <string name="k2go_br_cancel_extract_ack">હું સમજું છું કે હમણાં રદ કરવાથી મારી સિસ્ટમ ક્ષતિગ્રસ્ત અથવા બિનઉપયોગી થઈ શકે છે.</string>
+    <string name="k2go_br_restore_damaged">પુનઃસ્થાપન રદ થયું. તમારી સિસ્ટમ આગલા લોન્ચ પર રિકવરી મોડમાં શરૂ થશે.</string>
+    <string name="k2go_br_cancel_extract_need_ack">તમે સમજ્યા છો તેની પુષ્ટિ કરવા બોક્સ પર ટિક કરો.</string>
     <string name="k2go_br_restore_unreadable">પસંદ કરેલી ફાઇલ વાંચી શકાઈ નહીં, તેથી કંઈ બદલાયું નથી.</string>
     <string name="deepop_channel_name">બૅકઅપ &amp; રિસ્ટોર</string>
     <string name="deepop_channel_desc">બૅકઅપ કે રિસ્ટોરને બૅકગ્રાઉન્ડમાં સુરક્ષિત રીતે ચાલુ રાખે છે</string>
diff --git a/controller/app/src/main/res/values-hi/strings.xml b/controller/app/src/main/res/values-hi/strings.xml
index 1ebd30ba..994a63d2 100644
--- a/controller/app/src/main/res/values-hi/strings.xml
+++ b/controller/app/src/main/res/values-hi/strings.xml
@@ -715,6 +715,14 @@
     <string name="k2go_br_restore_confirm">सिस्टम बदलें</string>
     <string name="k2go_br_restore_done">सिस्टम पुनर्स्थापित हुआ</string>
     <string name="k2go_br_restore_failed">पुनर्स्थापना विफल</string>
+    <string name="k2go_br_cancel_title">पुनर्स्थापना रद्द करें?</string>
+    <string name="k2go_br_cancel_body">आपका वर्तमान सिस्टम अपरिवर्तित है। आप कभी भी पुनर्स्थापना फिर से शुरू कर सकते हैं।</string>
+    <string name="k2go_br_cancel_confirm">पुनर्स्थापना रद्द करें</string>
+    <string name="k2go_br_cancel_keep">पुनर्स्थापना जारी रखें</string>
+    <string name="k2go_br_cancel_extract_body">आपका सिस्टम अभी लिखा जा रहा है। रद्द करने पर यह तब तक अनुपयोगी रहेगा जब तक यह खुद को फिर से इंस्टॉल न कर ले।</string>
+    <string name="k2go_br_cancel_extract_ack">मैं समझता हूँ कि अभी रद्द करने से मेरा सिस्टम क्षतिग्रस्त या अनुपयोगी हो सकता है।</string>
+    <string name="k2go_br_restore_damaged">पुनर्स्थापना रद्द कर दी गई। आपका सिस्टम अगली बार शुरू होने पर रिकवरी मोड में शुरू होगा।</string>
+    <string name="k2go_br_cancel_extract_need_ack">पुष्टि करने के लिए बॉक्स को चेक करें कि आप समझते हैं।</string>
     <string name="k2go_br_restore_unreadable">चुनी गई फ़ाइल पढ़ी नहीं जा सकी, इसलिए कुछ भी नहीं बदला गया।</string>
     <string name="deepop_channel_name">बैकअप और पुनर्स्थापना</string>
     <string name="deepop_channel_desc">बैकअप या पुनर्स्थापना को बैकग्राउंड में सुरक्षित रूप से चलाए रखता है</string>
diff --git a/controller/app/src/main/res/values-hu/strings.xml b/controller/app/src/main/res/values-hu/strings.xml
index bc783bc3..65934e49 100644
--- a/controller/app/src/main/res/values-hu/strings.xml
+++ b/controller/app/src/main/res/values-hu/strings.xml
@@ -638,6 +638,14 @@
     <string name="k2go_br_restore_confirm">Rendszer cseréje</string>
     <string name="k2go_br_restore_done">A rendszer visszaállítva</string>
     <string name="k2go_br_restore_failed">A visszaállítás nem sikerült</string>
+    <string name="k2go_br_cancel_title">Megszakítod a visszaállítást?</string>
+    <string name="k2go_br_cancel_body">A jelenlegi rendszered változatlan. A visszaállítást bármikor újraindíthatod.</string>
+    <string name="k2go_br_cancel_confirm">Visszaállítás megszakítása</string>
+    <string name="k2go_br_cancel_keep">Visszaállítás folytatása</string>
+    <string name="k2go_br_cancel_extract_body">A rendszered éppen íródik. A megszakítás használhatatlanná teszi, amíg újra nem telepíti magát.</string>
+    <string name="k2go_br_cancel_extract_ack">Megértem, hogy a mostani megszakítás sérültté vagy használhatatlanná teheti a rendszeremet.</string>
+    <string name="k2go_br_restore_damaged">Visszaállítás megszakítva. A rendszered a következő indításkor helyreállítási módban indul.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Jelöld be a négyzetet a megerősítéshez.</string>
     <string name="k2go_br_restore_unreadable">A kiválasztott fájlt nem sikerült beolvasni, ezért semmi sem változott.</string>
     <string name="deepop_channel_name">Biztonsági mentés &amp; visszaállítás</string>
     <string name="deepop_channel_desc">Biztonságosan futtatja a mentést vagy visszaállítást a háttérben</string>
diff --git a/controller/app/src/main/res/values-in/strings.xml b/controller/app/src/main/res/values-in/strings.xml
index b2cc705f..ed385f4c 100644
--- a/controller/app/src/main/res/values-in/strings.xml
+++ b/controller/app/src/main/res/values-in/strings.xml
@@ -645,6 +645,14 @@
     <string name="k2go_br_restore_confirm">Ganti sistem</string>
     <string name="k2go_br_restore_done">Sistem dipulihkan</string>
     <string name="k2go_br_restore_failed">Pemulihan gagal</string>
+    <string name="k2go_br_cancel_title">Batalkan pemulihan?</string>
+    <string name="k2go_br_cancel_body">Sistem Anda saat ini tidak berubah. Anda dapat memulai pemulihan lagi kapan saja.</string>
+    <string name="k2go_br_cancel_confirm">Batalkan pemulihan</string>
+    <string name="k2go_br_cancel_keep">Lanjutkan pemulihan</string>
+    <string name="k2go_br_cancel_extract_body">Sistem Anda sedang ditulis sekarang. Membatalkan akan membuatnya tidak dapat digunakan hingga menginstal ulang dirinya sendiri.</string>
+    <string name="k2go_br_cancel_extract_ack">Saya memahami bahwa membatalkan sekarang dapat membuat sistem saya rusak atau tidak dapat digunakan.</string>
+    <string name="k2go_br_restore_damaged">Pemulihan dibatalkan. Sistem Anda akan memulai dalam mode pemulihan pada peluncuran berikutnya.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Centang kotak untuk mengonfirmasi bahwa Anda memahami.</string>
     <string name="k2go_br_restore_unreadable">Berkas yang dipilih tidak dapat dibaca, jadi tidak ada yang diubah.</string>
     <string name="deepop_channel_name">Cadangkan &amp; pulihkan</string>
     <string name="deepop_channel_desc">Menjaga pencadangan atau pemulihan berjalan aman di latar belakang</string>
diff --git a/controller/app/src/main/res/values-it/strings.xml b/controller/app/src/main/res/values-it/strings.xml
index 7d4d1cbf..6a15d397 100644
--- a/controller/app/src/main/res/values-it/strings.xml
+++ b/controller/app/src/main/res/values-it/strings.xml
@@ -638,6 +638,14 @@
     <string name="k2go_br_restore_confirm">Sostituisci sistema</string>
     <string name="k2go_br_restore_done">Sistema ripristinato</string>
     <string name="k2go_br_restore_failed">Ripristino non riuscito</string>
+    <string name="k2go_br_cancel_title">Annullare il ripristino?</string>
+    <string name="k2go_br_cancel_body">Il tuo sistema attuale è invariato. Puoi riavviare il ripristino in qualsiasi momento.</string>
+    <string name="k2go_br_cancel_confirm">Annulla ripristino</string>
+    <string name="k2go_br_cancel_keep">Continua il ripristino</string>
+    <string name="k2go_br_cancel_extract_body">Il tuo sistema è in fase di scrittura. L\'annullamento lo renderà inutilizzabile finché non si reinstalla da solo.</string>
+    <string name="k2go_br_cancel_extract_ack">Capisco che annullare ora potrebbe lasciare il mio sistema danneggiato o inutilizzabile.</string>
+    <string name="k2go_br_restore_damaged">Ripristino annullato. Il tuo sistema si avvierà in modalità di ripristino al prossimo avvio.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Seleziona la casella per confermare di aver capito.</string>
     <string name="k2go_br_restore_unreadable">Non è stato possibile leggere il file selezionato, quindi non è stato modificato nulla.</string>
     <string name="deepop_channel_name">Backup &amp; ripristino</string>
     <string name="deepop_channel_desc">Mantiene un backup o ripristino in esecuzione in modo sicuro in background</string>
diff --git a/controller/app/src/main/res/values-ja/strings.xml b/controller/app/src/main/res/values-ja/strings.xml
index bb00b365..682f9856 100644
--- a/controller/app/src/main/res/values-ja/strings.xml
+++ b/controller/app/src/main/res/values-ja/strings.xml
@@ -639,6 +639,14 @@
     <string name="k2go_br_restore_confirm">システムを置き換え</string>
     <string name="k2go_br_restore_done">システムを復元しました</string>
     <string name="k2go_br_restore_failed">復元に失敗しました</string>
+    <string name="k2go_br_cancel_title">復元をキャンセルしますか?</string>
+    <string name="k2go_br_cancel_body">現在のシステムは変更されていません。いつでも復元を再開できます。</string>
+    <string name="k2go_br_cancel_confirm">復元をキャンセル</string>
+    <string name="k2go_br_cancel_keep">復元を続ける</string>
+    <string name="k2go_br_cancel_extract_body">システムは現在書き込み中です。キャンセルすると、システムが自動的に再インストールされるまで使用できなくなります。</string>
+    <string name="k2go_br_cancel_extract_ack">今キャンセルすると、システムが破損したり使用できなくなったりする可能性があることを理解しています。</string>
+    <string name="k2go_br_restore_damaged">復元をキャンセルしました。次回の起動時にシステムはリカバリーモードで起動します。</string>
+    <string name="k2go_br_cancel_extract_need_ack">理解したことを確認するにはチェックボックスをオンにしてください。</string>
     <string name="k2go_br_restore_unreadable">選択したファイルを読み取れなかったため、何も変更されていません。</string>
     <string name="deepop_channel_name">バックアップと復元</string>
     <string name="deepop_channel_desc">バックアップや復元をバックグラウンドで安全に実行し続けます</string>
diff --git a/controller/app/src/main/res/values-ko/strings.xml b/controller/app/src/main/res/values-ko/strings.xml
index 38a8f807..897ed539 100644
--- a/controller/app/src/main/res/values-ko/strings.xml
+++ b/controller/app/src/main/res/values-ko/strings.xml
@@ -639,6 +639,14 @@
     <string name="k2go_br_restore_confirm">시스템 대체</string>
     <string name="k2go_br_restore_done">시스템 복원됨</string>
     <string name="k2go_br_restore_failed">복원 실패</string>
+    <string name="k2go_br_cancel_title">복원을 취소하시겠습니까?</string>
+    <string name="k2go_br_cancel_body">현재 시스템은 변경되지 않았습니다. 언제든지 복원을 다시 시작할 수 있습니다.</string>
+    <string name="k2go_br_cancel_confirm">복원 취소</string>
+    <string name="k2go_br_cancel_keep">복원 계속하기</string>
+    <string name="k2go_br_cancel_extract_body">시스템을 지금 기록하는 중입니다. 취소하면 시스템이 자동으로 재설치될 때까지 사용할 수 없게 됩니다.</string>
+    <string name="k2go_br_cancel_extract_ack">지금 취소하면 시스템이 손상되거나 사용할 수 없게 될 수 있음을 이해합니다.</string>
+    <string name="k2go_br_restore_damaged">복원이 취소되었습니다. 다음 실행 시 시스템이 복구 모드로 시작됩니다.</string>
+    <string name="k2go_br_cancel_extract_need_ack">이해했음을 확인하려면 확인란을 선택하세요.</string>
     <string name="k2go_br_restore_unreadable">선택한 파일을 읽을 수 없어 아무것도 변경되지 않았습니다.</string>
     <string name="deepop_channel_name">백업 및 복원</string>
     <string name="deepop_channel_desc">백업 또는 복원을 백그라운드에서 안전하게 계속 실행합니다</string>
diff --git a/controller/app/src/main/res/values-lt/strings.xml b/controller/app/src/main/res/values-lt/strings.xml
index 1b1f0501..1b01fe3c 100644
--- a/controller/app/src/main/res/values-lt/strings.xml
+++ b/controller/app/src/main/res/values-lt/strings.xml
@@ -646,6 +646,14 @@
     <string name="k2go_br_restore_confirm">Pakeisti sistemą</string>
     <string name="k2go_br_restore_done">Sistema atkurta</string>
     <string name="k2go_br_restore_failed">Nepavyko atkurti</string>
+    <string name="k2go_br_cancel_title">Atšaukti atkūrimą?</string>
+    <string name="k2go_br_cancel_body">Jūsų dabartinė sistema nepakeista. Atkūrimą galite pradėti iš naujo bet kada.</string>
+    <string name="k2go_br_cancel_confirm">Atšaukti atkūrimą</string>
+    <string name="k2go_br_cancel_keep">Tęsti atkūrimą</string>
+    <string name="k2go_br_cancel_extract_body">Jūsų sistema dabar įrašoma. Atšaukus ji liks netinkama naudoti, kol pati iš naujo neįsidiegs.</string>
+    <string name="k2go_br_cancel_extract_ack">Suprantu, kad atšaukus dabar mano sistema gali likti sugadinta arba netinkama naudoti.</string>
+    <string name="k2go_br_restore_damaged">Atkūrimas atšauktas. Kito paleidimo metu jūsų sistema pasileis atkūrimo režimu.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Pažymėkite langelį, kad patvirtintumėte, jog suprantate.</string>
     <string name="k2go_br_restore_unreadable">Nepavyko perskaityti pasirinkto failo, todėl niekas nebuvo pakeista.</string>
     <string name="deepop_channel_name">Atsarginė kopija ir atkūrimas</string>
     <string name="deepop_channel_desc">Saugiai vykdo atsarginės kopijos kūrimą ar atkūrimą fone</string>
diff --git a/controller/app/src/main/res/values-nl/strings.xml b/controller/app/src/main/res/values-nl/strings.xml
index 7642952c..c3d688d2 100644
--- a/controller/app/src/main/res/values-nl/strings.xml
+++ b/controller/app/src/main/res/values-nl/strings.xml
@@ -638,6 +638,14 @@
     <string name="k2go_br_restore_confirm">Systeem vervangen</string>
     <string name="k2go_br_restore_done">Systeem hersteld</string>
     <string name="k2go_br_restore_failed">Herstel mislukt</string>
+    <string name="k2go_br_cancel_title">Herstel annuleren?</string>
+    <string name="k2go_br_cancel_body">Uw huidige systeem is ongewijzigd. U kunt het herstel op elk moment opnieuw starten.</string>
+    <string name="k2go_br_cancel_confirm">Herstel annuleren</string>
+    <string name="k2go_br_cancel_keep">Doorgaan met herstellen</string>
+    <string name="k2go_br_cancel_extract_body">Uw systeem wordt nu geschreven. Annuleren maakt het onbruikbaar totdat het zichzelf opnieuw installeert.</string>
+    <string name="k2go_br_cancel_extract_ack">Ik begrijp dat annuleren nu mijn systeem beschadigd of onbruikbaar kan achterlaten.</string>
+    <string name="k2go_br_restore_damaged">Herstel geannuleerd. Uw systeem start bij de volgende keer opstarten in de herstelmodus.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Vink het vakje aan om te bevestigen dat u het begrijpt.</string>
     <string name="k2go_br_restore_unreadable">Het geselecteerde bestand kon niet worden gelezen, dus er is niets gewijzigd.</string>
     <string name="deepop_channel_name">Back-up &amp; herstel</string>
     <string name="deepop_channel_desc">Houdt een back-up of herstel veilig actief op de achtergrond</string>
diff --git a/controller/app/src/main/res/values-no/strings.xml b/controller/app/src/main/res/values-no/strings.xml
index 8a11d084..0e6afb09 100644
--- a/controller/app/src/main/res/values-no/strings.xml
+++ b/controller/app/src/main/res/values-no/strings.xml
@@ -639,6 +639,14 @@
     <string name="k2go_br_restore_confirm">Erstatt system</string>
     <string name="k2go_br_restore_done">System gjenopprettet</string>
     <string name="k2go_br_restore_failed">Gjenoppretting mislyktes</string>
+    <string name="k2go_br_cancel_title">Avbryte gjenopprettingen?</string>
+    <string name="k2go_br_cancel_body">Det nåværende systemet ditt er uendret. Du kan starte gjenopprettingen på nytt når som helst.</string>
+    <string name="k2go_br_cancel_confirm">Avbryt gjenoppretting</string>
+    <string name="k2go_br_cancel_keep">Fortsett gjenoppretting</string>
+    <string name="k2go_br_cancel_extract_body">Systemet ditt skrives nå. Å avbryte vil gjøre det ubrukelig til det installerer seg selv på nytt.</string>
+    <string name="k2go_br_cancel_extract_ack">Jeg forstår at å avbryte nå kan gjøre systemet mitt skadet eller ubrukelig.</string>
+    <string name="k2go_br_restore_damaged">Gjenoppretting avbrutt. Systemet ditt starter i gjenopprettingsmodus ved neste oppstart.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Kryss av i boksen for å bekrefte at du forstår.</string>
     <string name="k2go_br_restore_unreadable">Den valgte filen kunne ikke leses, så ingenting ble endret.</string>
     <string name="deepop_channel_name">Sikkerhetskopiering &amp; gjenoppretting</string>
     <string name="deepop_channel_desc">Holder en sikkerhetskopiering eller gjenoppretting trygt i gang i bakgrunnen</string>
diff --git a/controller/app/src/main/res/values-pl/strings.xml b/controller/app/src/main/res/values-pl/strings.xml
index 5f5a6494..f9ea4b7d 100644
--- a/controller/app/src/main/res/values-pl/strings.xml
+++ b/controller/app/src/main/res/values-pl/strings.xml
@@ -639,6 +639,14 @@
     <string name="k2go_br_restore_confirm">Zastąp system</string>
     <string name="k2go_br_restore_done">System przywrócony</string>
     <string name="k2go_br_restore_failed">Przywracanie nie powiodło się</string>
+    <string name="k2go_br_cancel_title">Anulować przywracanie?</string>
+    <string name="k2go_br_cancel_body">Twój obecny system pozostaje bez zmian. Możesz ponownie rozpocząć przywracanie w dowolnym momencie.</string>
+    <string name="k2go_br_cancel_confirm">Anuluj przywracanie</string>
+    <string name="k2go_br_cancel_keep">Kontynuuj przywracanie</string>
+    <string name="k2go_br_cancel_extract_body">Twój system jest teraz zapisywany. Anulowanie sprawi, że będzie bezużyteczny, dopóki nie zainstaluje się ponownie.</string>
+    <string name="k2go_br_cancel_extract_ack">Rozumiem, że anulowanie teraz może pozostawić mój system uszkodzony lub bezużyteczny.</string>
+    <string name="k2go_br_restore_damaged">Przywracanie anulowane. Twój system uruchomi się w trybie odzyskiwania przy następnym uruchomieniu.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Zaznacz pole, aby potwierdzić, że rozumiesz.</string>
     <string name="k2go_br_restore_unreadable">Nie udało się odczytać wybranego pliku, więc nic nie zostało zmienione.</string>
     <string name="deepop_channel_name">Kopia zapasowa &amp; przywracanie</string>
     <string name="deepop_channel_desc">Utrzymuje bezpieczne działanie kopii lub przywracania w tle</string>
diff --git a/controller/app/src/main/res/values-pt/strings.xml b/controller/app/src/main/res/values-pt/strings.xml
index 84b48f01..cba2d95f 100644
--- a/controller/app/src/main/res/values-pt/strings.xml
+++ b/controller/app/src/main/res/values-pt/strings.xml
@@ -717,6 +717,14 @@
     <string name="k2go_br_restore_confirm">Substituir sistema</string>
     <string name="k2go_br_restore_done">Sistema restaurado</string>
     <string name="k2go_br_restore_failed">O restauro falhou</string>
+    <string name="k2go_br_cancel_title">Cancelar o restauro?</string>
+    <string name="k2go_br_cancel_body">O seu sistema atual permanece inalterado. Pode iniciar o restauro novamente a qualquer momento.</string>
+    <string name="k2go_br_cancel_confirm">Cancelar restauro</string>
+    <string name="k2go_br_cancel_keep">Continuar o restauro</string>
+    <string name="k2go_br_cancel_extract_body">O seu sistema está a ser escrito agora. Cancelar deixá-lo-á inutilizável até que se reinstale sozinho.</string>
+    <string name="k2go_br_cancel_extract_ack">Compreendo que cancelar agora pode deixar o meu sistema danificado ou inutilizável.</string>
+    <string name="k2go_br_restore_damaged">Restauro cancelado. O seu sistema iniciará em modo de recuperação no próximo arranque.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Marque a caixa para confirmar que compreende.</string>
     <string name="k2go_br_restore_unreadable">Não foi possível ler o ficheiro selecionado, por isso nada foi alterado.</string>
     <string name="deepop_channel_name">Cópia de segurança &amp; restauro</string>
     <string name="deepop_channel_desc">Mantém uma cópia de segurança ou restauro a decorrer com segurança em segundo plano</string>
diff --git a/controller/app/src/main/res/values-ro/strings.xml b/controller/app/src/main/res/values-ro/strings.xml
index d3144a9d..f299f5c7 100644
--- a/controller/app/src/main/res/values-ro/strings.xml
+++ b/controller/app/src/main/res/values-ro/strings.xml
@@ -638,6 +638,14 @@
     <string name="k2go_br_restore_confirm">Înlocuiește sistemul</string>
     <string name="k2go_br_restore_done">Sistem restaurat</string>
     <string name="k2go_br_restore_failed">Restaurarea a eșuat</string>
+    <string name="k2go_br_cancel_title">Anulați restaurarea?</string>
+    <string name="k2go_br_cancel_body">Sistemul dvs. actual rămâne neschimbat. Puteți reîncepe restaurarea oricând.</string>
+    <string name="k2go_br_cancel_confirm">Anulează restaurarea</string>
+    <string name="k2go_br_cancel_keep">Continuă restaurarea</string>
+    <string name="k2go_br_cancel_extract_body">Sistemul dvs. este scris acum. Anularea îl va lăsa inutilizabil până când se reinstalează singur.</string>
+    <string name="k2go_br_cancel_extract_ack">Înțeleg că anularea acum îmi poate lăsa sistemul deteriorat sau inutilizabil.</string>
+    <string name="k2go_br_restore_damaged">Restaurare anulată. Sistemul dvs. va porni în modul de recuperare la următoarea lansare.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Bifați caseta pentru a confirma că înțelegeți.</string>
     <string name="k2go_br_restore_unreadable">Fișierul selectat nu a putut fi citit, așa că nu s-a schimbat nimic.</string>
     <string name="deepop_channel_name">Copie de rezervă &amp; restaurare</string>
     <string name="deepop_channel_desc">Menține o copie de rezervă sau o restaurare rulând în siguranță în fundal</string>
diff --git a/controller/app/src/main/res/values-ru-rRU/strings.xml b/controller/app/src/main/res/values-ru-rRU/strings.xml
index 0d53269b..e25dcf74 100644
--- a/controller/app/src/main/res/values-ru-rRU/strings.xml
+++ b/controller/app/src/main/res/values-ru-rRU/strings.xml
@@ -714,6 +714,14 @@
     <string name="k2go_br_restore_confirm">Заменить систему</string>
     <string name="k2go_br_restore_done">Система восстановлена</string>
     <string name="k2go_br_restore_failed">Не удалось восстановить</string>
+    <string name="k2go_br_cancel_title">Отменить восстановление?</string>
+    <string name="k2go_br_cancel_body">Ваша текущая система не изменена. Вы можете начать восстановление заново в любое время.</string>
+    <string name="k2go_br_cancel_confirm">Отменить восстановление</string>
+    <string name="k2go_br_cancel_keep">Продолжить восстановление</string>
+    <string name="k2go_br_cancel_extract_body">Ваша система сейчас записывается. Отмена сделает её непригодной для использования, пока она не переустановится сама.</string>
+    <string name="k2go_br_cancel_extract_ack">Я понимаю, что отмена сейчас может привести к повреждению или непригодности моей системы.</string>
+    <string name="k2go_br_restore_damaged">Восстановление отменено. При следующем запуске ваша система запустится в режиме восстановления.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Установите флажок, чтобы подтвердить, что вы понимаете.</string>
     <string name="k2go_br_restore_unreadable">Не удалось прочитать выбранный файл, поэтому ничего не изменилось.</string>
     <string name="deepop_channel_name">Резервное копирование и восстановление</string>
     <string name="deepop_channel_desc">Позволяет безопасно выполнять резервное копирование или восстановление в фоне</string>
diff --git a/controller/app/src/main/res/values-sk/strings.xml b/controller/app/src/main/res/values-sk/strings.xml
index a1835fe2..a99e7518 100644
--- a/controller/app/src/main/res/values-sk/strings.xml
+++ b/controller/app/src/main/res/values-sk/strings.xml
@@ -645,6 +645,14 @@
     <string name="k2go_br_restore_confirm">Nahradiť systém</string>
     <string name="k2go_br_restore_done">Systém obnovený</string>
     <string name="k2go_br_restore_failed">Obnova zlyhala</string>
+    <string name="k2go_br_cancel_title">Zrušiť obnovenie?</string>
+    <string name="k2go_br_cancel_body">Váš aktuálny systém zostáva nezmenený. Obnovenie môžete kedykoľvek spustiť znova.</string>
+    <string name="k2go_br_cancel_confirm">Zrušiť obnovenie</string>
+    <string name="k2go_br_cancel_keep">Pokračovať v obnovení</string>
+    <string name="k2go_br_cancel_extract_body">Váš systém sa práve zapisuje. Zrušenie ho ponechá nepoužiteľný, kým sa sám znova nenainštaluje.</string>
+    <string name="k2go_br_cancel_extract_ack">Rozumiem, že zrušenie teraz môže môj systém poškodiť alebo urobiť nepoužiteľným.</string>
+    <string name="k2go_br_restore_damaged">Obnovenie zrušené. Váš systém sa pri ďalšom spustení spustí v režime obnovy.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Začiarknutím políčka potvrďte, že rozumiete.</string>
     <string name="k2go_br_restore_unreadable">Vybraný súbor sa nepodarilo prečítať, takže sa nič nezmenilo.</string>
     <string name="deepop_channel_name">Zálohovanie &amp; obnova</string>
     <string name="deepop_channel_desc">Udržiava zálohovanie alebo obnovu bezpečne bežiace na pozadí</string>
diff --git a/controller/app/src/main/res/values-sr/strings.xml b/controller/app/src/main/res/values-sr/strings.xml
index 2bd36211..50dacbfb 100644
--- a/controller/app/src/main/res/values-sr/strings.xml
+++ b/controller/app/src/main/res/values-sr/strings.xml
@@ -651,6 +651,14 @@
     <string name="k2go_br_restore_confirm">Замени систем</string>
     <string name="k2go_br_restore_done">Систем враћен</string>
     <string name="k2go_br_restore_failed">Враћање није успело</string>
+    <string name="k2go_br_cancel_title">Отказати враћање?</string>
+    <string name="k2go_br_cancel_body">Ваш тренутни систем је непромењен. Враћање можете поново да покренете у било ком тренутку.</string>
+    <string name="k2go_br_cancel_confirm">Откажи враћање</string>
+    <string name="k2go_br_cancel_keep">Настави враћање</string>
+    <string name="k2go_br_cancel_extract_body">Ваш систем се сада уписује. Отказивање ће га учинити неупотребљивим док се сам поново не инсталира.</string>
+    <string name="k2go_br_cancel_extract_ack">Разумем да отказивање сада може оставити мој систем оштећеним или неупотребљивим.</string>
+    <string name="k2go_br_restore_damaged">Враћање је отказано. Ваш систем ће се при следећем покретању покренути у режиму опоравка.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Означите поље да бисте потврдили да разумете.</string>
     <string name="k2go_br_restore_unreadable">Изабрана датотека није могла да се прочита, па ништа није промењено.</string>
     <string name="deepop_channel_name">Резервна копија и враћање</string>
     <string name="deepop_channel_desc">Одржава прављење резервне копије или враћање безбедно у позадини</string>
diff --git a/controller/app/src/main/res/values-sw/strings.xml b/controller/app/src/main/res/values-sw/strings.xml
index cad06eb6..9b326334 100644
--- a/controller/app/src/main/res/values-sw/strings.xml
+++ b/controller/app/src/main/res/values-sw/strings.xml
@@ -658,6 +658,14 @@
     <string name="k2go_br_restore_confirm">Badilisha mfumo</string>
     <string name="k2go_br_restore_done">Mfumo umerejeshwa</string>
     <string name="k2go_br_restore_failed">Urejeshaji umeshindwa</string>
+    <string name="k2go_br_cancel_title">Ghairi urejeshaji?</string>
+    <string name="k2go_br_cancel_body">Mfumo wako wa sasa haujabadilika. Unaweza kuanza urejeshaji tena wakati wowote.</string>
+    <string name="k2go_br_cancel_confirm">Ghairi urejeshaji</string>
+    <string name="k2go_br_cancel_keep">Endelea kurejesha</string>
+    <string name="k2go_br_cancel_extract_body">Mfumo wako unaandikwa sasa. Kughairi kutauacha usiofaa kutumika hadi ujisakinishe upya wenyewe.</string>
+    <string name="k2go_br_cancel_extract_ack">Ninaelewa kuwa kughairi sasa kunaweza kuacha mfumo wangu ukiwa umeharibika au usiofaa kutumika.</string>
+    <string name="k2go_br_restore_damaged">Urejeshaji umeghairiwa. Mfumo wako utaanza katika hali ya urejeshaji wakati wa kuzindua ujao.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Weka alama kwenye kisanduku ili kuthibitisha kuwa unaelewa.</string>
     <string name="k2go_br_restore_unreadable">Faili uliyochagua haikuweza kusomwa, kwa hivyo hakuna kilichobadilishwa.</string>
     <string name="deepop_channel_name">Hifadhi &amp; rejesha</string>
     <string name="deepop_channel_desc">Huweka nakala rudufu au urejeshaji ukiendelea kwa usalama chinichini</string>
diff --git a/controller/app/src/main/res/values-ta/strings.xml b/controller/app/src/main/res/values-ta/strings.xml
index 143f3763..c6070fb0 100644
--- a/controller/app/src/main/res/values-ta/strings.xml
+++ b/controller/app/src/main/res/values-ta/strings.xml
@@ -658,6 +658,14 @@
     <string name="k2go_br_restore_confirm">அமைப்பை மாற்று</string>
     <string name="k2go_br_restore_done">அமைப்பு மீட்டமைக்கப்பட்டது</string>
     <string name="k2go_br_restore_failed">மீட்பு தோல்வியடைந்தது</string>
+    <string name="k2go_br_cancel_title">மீட்பை ரத்து செய்யவா?</string>
+    <string name="k2go_br_cancel_body">உங்கள் தற்போதைய கணினி மாறாமல் உள்ளது. நீங்கள் எந்த நேரத்திலும் மீட்பை மீண்டும் தொடங்கலாம்.</string>
+    <string name="k2go_br_cancel_confirm">மீட்பை ரத்து செய்</string>
+    <string name="k2go_br_cancel_keep">மீட்பைத் தொடரவும்</string>
+    <string name="k2go_br_cancel_extract_body">உங்கள் கணினி இப்போது எழுதப்படுகிறது. ரத்து செய்தால், அது தானாகவே மீண்டும் நிறுவப்படும் வரை பயன்படுத்த முடியாததாக இருக்கும்.</string>
+    <string name="k2go_br_cancel_extract_ack">இப்போது ரத்து செய்தால் எனது கணினி சேதமடையலாம் அல்லது பயன்படுத்த முடியாததாக மாறலாம் என்பதை நான் புரிந்துகொள்கிறேன்.</string>
+    <string name="k2go_br_restore_damaged">மீட்பு ரத்து செய்யப்பட்டது. அடுத்த முறை தொடங்கும்போது உங்கள் கணினி மீட்பு பயன்முறையில் தொடங்கும்.</string>
+    <string name="k2go_br_cancel_extract_need_ack">நீங்கள் புரிந்துகொண்டதை உறுதிப்படுத்த பெட்டியில் தேர்வு செய்யவும்.</string>
     <string name="k2go_br_restore_unreadable">தேர்ந்தெடுத்த கோப்பைப் படிக்க முடியவில்லை, எனவே எதுவும் மாற்றப்படவில்லை.</string>
     <string name="deepop_channel_name">காப்புப்பிரதி &amp; மீட்பு</string>
     <string name="deepop_channel_desc">காப்புப்பிரதி அல்லது மீட்பை பின்னணியில் பாதுகாப்பாக இயக்கி வைக்கிறது</string>
diff --git a/controller/app/src/main/res/values-tr/strings.xml b/controller/app/src/main/res/values-tr/strings.xml
index 54d4af83..0061dd7d 100644
--- a/controller/app/src/main/res/values-tr/strings.xml
+++ b/controller/app/src/main/res/values-tr/strings.xml
@@ -638,6 +638,14 @@
     <string name="k2go_br_restore_confirm">Sistemi değiştir</string>
     <string name="k2go_br_restore_done">Sistem geri yüklendi</string>
     <string name="k2go_br_restore_failed">Geri yükleme başarısız</string>
+    <string name="k2go_br_cancel_title">Geri yükleme iptal edilsin mi?</string>
+    <string name="k2go_br_cancel_body">Mevcut sisteminiz değişmedi. Geri yüklemeyi istediğiniz zaman yeniden başlatabilirsiniz.</string>
+    <string name="k2go_br_cancel_confirm">Geri yüklemeyi iptal et</string>
+    <string name="k2go_br_cancel_keep">Geri yüklemeye devam et</string>
+    <string name="k2go_br_cancel_extract_body">Sisteminiz şu anda yazılıyor. İptal etmek, kendini yeniden yükleyene kadar onu kullanılamaz hale getirir.</string>
+    <string name="k2go_br_cancel_extract_ack">Şimdi iptal etmenin sistemimi hasarlı veya kullanılamaz bırakabileceğini anlıyorum.</string>
+    <string name="k2go_br_restore_damaged">Geri yükleme iptal edildi. Sisteminiz bir sonraki başlatmada kurtarma modunda başlayacak.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Anladığınızı onaylamak için kutuyu işaretleyin.</string>
     <string name="k2go_br_restore_unreadable">Seçilen dosya okunamadı, bu yüzden hiçbir şey değiştirilmedi.</string>
     <string name="deepop_channel_name">Yedekle &amp; geri yükle</string>
     <string name="deepop_channel_desc">Bir yedekleme veya geri yüklemeyi arka planda güvenle çalışır durumda tutar</string>
diff --git a/controller/app/src/main/res/values-uk/strings.xml b/controller/app/src/main/res/values-uk/strings.xml
index d49f3a63..1137dd41 100644
--- a/controller/app/src/main/res/values-uk/strings.xml
+++ b/controller/app/src/main/res/values-uk/strings.xml
@@ -638,6 +638,14 @@
     <string name="k2go_br_restore_confirm">Замінити систему</string>
     <string name="k2go_br_restore_done">Систему відновлено</string>
     <string name="k2go_br_restore_failed">Помилка відновлення</string>
+    <string name="k2go_br_cancel_title">Скасувати відновлення?</string>
+    <string name="k2go_br_cancel_body">Ваша поточна система не змінена. Ви можете розпочати відновлення знову будь-коли.</string>
+    <string name="k2go_br_cancel_confirm">Скасувати відновлення</string>
+    <string name="k2go_br_cancel_keep">Продовжити відновлення</string>
+    <string name="k2go_br_cancel_extract_body">Ваша система зараз записується. Скасування зробить її непридатною до використання, доки вона не перевстановиться сама.</string>
+    <string name="k2go_br_cancel_extract_ack">Я розумію, що скасування зараз може залишити мою систему пошкодженою або непридатною до використання.</string>
+    <string name="k2go_br_restore_damaged">Відновлення скасовано. Під час наступного запуску ваша система запуститься в режимі відновлення.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Позначте прапорець, щоб підтвердити, що ви розумієте.</string>
     <string name="k2go_br_restore_unreadable">Не вдалося прочитати вибраний файл, тому нічого не змінено.</string>
     <string name="deepop_channel_name">Резервне копіювання та відновлення</string>
     <string name="deepop_channel_desc">Безпечно виконує резервне копіювання чи відновлення у фоні</string>
diff --git a/controller/app/src/main/res/values-vi/strings.xml b/controller/app/src/main/res/values-vi/strings.xml
index f3e85bd9..6cc3b4aa 100644
--- a/controller/app/src/main/res/values-vi/strings.xml
+++ b/controller/app/src/main/res/values-vi/strings.xml
@@ -638,6 +638,14 @@
     <string name="k2go_br_restore_confirm">Thay thế hệ thống</string>
     <string name="k2go_br_restore_done">Đã khôi phục hệ thống</string>
     <string name="k2go_br_restore_failed">Khôi phục thất bại</string>
+    <string name="k2go_br_cancel_title">Hủy khôi phục?</string>
+    <string name="k2go_br_cancel_body">Hệ thống hiện tại của bạn không thay đổi. Bạn có thể bắt đầu khôi phục lại bất cứ lúc nào.</string>
+    <string name="k2go_br_cancel_confirm">Hủy khôi phục</string>
+    <string name="k2go_br_cancel_keep">Tiếp tục khôi phục</string>
+    <string name="k2go_br_cancel_extract_body">Hệ thống của bạn đang được ghi. Việc hủy sẽ khiến hệ thống không sử dụng được cho đến khi nó tự cài đặt lại.</string>
+    <string name="k2go_br_cancel_extract_ack">Tôi hiểu rằng việc hủy bây giờ có thể khiến hệ thống của tôi bị hỏng hoặc không sử dụng được.</string>
+    <string name="k2go_br_restore_damaged">Đã hủy khôi phục. Hệ thống của bạn sẽ khởi động ở chế độ khôi phục trong lần khởi chạy tiếp theo.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Chọn ô để xác nhận rằng bạn hiểu.</string>
     <string name="k2go_br_restore_unreadable">Không thể đọc tệp đã chọn, nên không có gì bị thay đổi.</string>
     <string name="deepop_channel_name">Sao lưu &amp; khôi phục</string>
     <string name="deepop_channel_desc">Giữ quá trình sao lưu hoặc khôi phục chạy an toàn ở chế độ nền</string>
diff --git a/controller/app/src/main/res/values-yo/strings.xml b/controller/app/src/main/res/values-yo/strings.xml
index 0b2cd7e3..20bf6b1a 100644
--- a/controller/app/src/main/res/values-yo/strings.xml
+++ b/controller/app/src/main/res/values-yo/strings.xml
@@ -658,6 +658,14 @@
     <string name="k2go_br_restore_confirm">Rọ́pò ẹ̀rọ</string>
     <string name="k2go_br_restore_done">A ti mú ẹ̀rọ padà</string>
     <string name="k2go_br_restore_failed">Ìmúpadà kùnà</string>
+    <string name="k2go_br_cancel_title">Fagilee ìmúpadà?</string>
+    <string name="k2go_br_cancel_body">Ẹ̀rọ rẹ lọ́wọ́lọ́wọ́ kò yí padà. O le bẹ̀rẹ̀ ìmúpadà lẹ́ẹ̀kansi nígbàkúgbà.</string>
+    <string name="k2go_br_cancel_confirm">Fagilee ìmúpadà</string>
+    <string name="k2go_br_cancel_keep">Tẹ̀síwájú ìmúpadà</string>
+    <string name="k2go_br_cancel_extract_body">Ẹ̀rọ rẹ ń kọ báyìí. Fífagilee yóò jẹ́ kí ó máṣe wúlò títí yóò fi tún ara rẹ̀ fi sori ẹrọ.</string>
+    <string name="k2go_br_cancel_extract_ack">Mo ye mi pé fífagilee báyìí lè mú kí ẹ̀rọ mi bàjẹ́ tàbí kí ó máṣe wúlò.</string>
+    <string name="k2go_br_restore_damaged">A ti fagilee ìmúpadà. Ẹ̀rọ rẹ yóò bẹ̀rẹ̀ ní ipo ìgbàpadà ní ìfilọlẹ̀ tó kàn.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Sàmì sí àpótí náà láti jẹ́rìí sí i pé o ye ọ́.</string>
     <string name="k2go_br_restore_unreadable">A kò lè ka fáìlì tí a yàn, nítorí náà kò sí ohun tí ó yípadà.</string>
     <string name="deepop_channel_name">Àfẹ̀yìntì &amp; ìmúpadà</string>
     <string name="deepop_channel_desc">Ń jẹ́ kí àfẹ̀yìntì tàbí ìmúpadà máa ṣiṣẹ́ láìséwu lẹ́yìn ẹ̀rọ</string>
diff --git a/controller/app/src/main/res/values-zh-rCN/strings.xml b/controller/app/src/main/res/values-zh-rCN/strings.xml
index 271211a9..3d184859 100644
--- a/controller/app/src/main/res/values-zh-rCN/strings.xml
+++ b/controller/app/src/main/res/values-zh-rCN/strings.xml
@@ -639,6 +639,14 @@
     <string name="k2go_br_restore_confirm">替换系统</string>
     <string name="k2go_br_restore_done">系统已恢复</string>
     <string name="k2go_br_restore_failed">恢复失败</string>
+    <string name="k2go_br_cancel_title">取消恢复?</string>
+    <string name="k2go_br_cancel_body">您当前的系统保持不变。您可以随时重新开始恢复。</string>
+    <string name="k2go_br_cancel_confirm">取消恢复</string>
+    <string name="k2go_br_cancel_keep">继续恢复</string>
+    <string name="k2go_br_cancel_extract_body">您的系统正在写入。取消将使其无法使用，直到它自行重新安装。</string>
+    <string name="k2go_br_cancel_extract_ack">我明白现在取消可能会使我的系统损坏或无法使用。</string>
+    <string name="k2go_br_restore_damaged">恢复已取消。您的系统将在下次启动时进入恢复模式。</string>
+    <string name="k2go_br_cancel_extract_need_ack">勾选此框以确认您已了解。</string>
     <string name="k2go_br_restore_unreadable">无法读取所选文件，因此未做任何更改。</string>
     <string name="deepop_channel_name">备份与恢复</string>
     <string name="deepop_channel_desc">使备份或恢复在后台安全运行</string>
diff --git a/controller/app/src/main/res/values/strings.xml b/controller/app/src/main/res/values/strings.xml
index 3ee8aae9..5e7ec71e 100644
--- a/controller/app/src/main/res/values/strings.xml
+++ b/controller/app/src/main/res/values/strings.xml
@@ -782,6 +782,16 @@
     <string name="k2go_br_restore_confirm">Replace system</string>
     <string name="k2go_br_restore_done">System restored</string>
     <string name="k2go_br_restore_failed">Restore failed</string>
+    <!-- K2GO-384: confirm before cancelling a restore (safe: nothing is written before the extract). -->
+    <string name="k2go_br_cancel_title">Cancel restore?</string>
+    <string name="k2go_br_cancel_body">Your current system is unchanged. You can start the restore again anytime.</string>
+    <string name="k2go_br_cancel_confirm">Cancel restore</string>
+    <string name="k2go_br_cancel_keep">Keep restoring</string>
+    <!-- K2GO-384: cancelling DURING the extract is destructive (the rootfs is being overwritten), so it needs an acknowledgement. -->
+    <string name="k2go_br_cancel_extract_body">Your system is being written now. Cancelling will leave it unusable until it reinstalls itself.</string>
+    <string name="k2go_br_cancel_extract_ack">I understand that cancelling now may leave my system damaged or unusable.</string>
+    <string name="k2go_br_restore_damaged">Restore cancelled. Your system will start in recovery on the next launch.</string>
+    <string name="k2go_br_cancel_extract_need_ack">Check the box to confirm you understand.</string>
     <string name="k2go_br_restore_unreadable">The selected file could not be read, so nothing was changed.</string>
     <string name="deepop_channel_name">Backup &amp; restore</string>
     <string name="deepop_channel_desc">Keeps a backup or restore running safely in the background</string>
diff --git a/controller/docs/ADR-5343c-known-damage-from-cancelled-restore.md b/controller/docs/ADR-5343c-known-damage-from-cancelled-restore.md
new file mode 100644
index 00000000..133939dc
--- /dev/null
+++ b/controller/docs/ADR-5343c-known-damage-from-cancelled-restore.md
@@ -0,0 +1,170 @@
+# ADR-5343c — KNOWN damage from a force-cancelled restore (delta to ADR-5343)
+
+**Status:** Implemented under K2GO-384 (restore Cancel slice); maintainer sign-off + device verification pending.
+**Date:** 2026-09-04.
+**Deciders:** the maintainer.
+**Ticket:** K2GO-384 (standardize backup & restore: bar / % / ETA + **Cancel**), Epic ADFA-1028. Extends
+**ADR-5343** (`controller/docs/ADR-5343-server-lifecycle-reconciler.md`) and its Phase-5 delta **ADR-5343b**
+(`ADR-5343b-installguard-token-and-recovery-residue.md`, the InstallGuard session token / three-state marker).
+Sibling to **ADR-5343a** (flap recovery). Everything in ADR-5343 / 5343b stands.
+
+> Why this lives in K2GO-384 and not its own ticket: restore is a **data-touching** operation, so the lifecycle
+> of the artifact it damages is part of the same deliverable. The reduction gate (ADR-5343 §8) binds: **no new
+> source of truth, no new "who may act" special-case, no compensating flag.** This delta adds one *reading* on
+> the existing marker and one *lever* on an existing owner — the counts do not go up.
+
+---
+
+## 1. The gap
+
+The restore Cancel slice added an acknowledged **force-cancel during the destructive extract**: the user checks
+"I understand this may leave my system damaged", we kill `tar -x` mid-write, and the rootfs is now half
+overwritten. The destructive marker (`InstallGuard.begin`, planted at the verify→extract boundary) was left
+**LIVE** — the same launch's token, never `end()`ed on the failed path.
+
+A LIVE marker is the wrong fact for an *abandoned* write, and it produced three bad outcomes, all observed on
+device:
+
+1. **A fresh restore was blocked** with *"An install is in progress. Please wait for it to finish"*
+   (`k2go_busy_install`). Source: `EnvironmentLock.currentHolder → Holder.INSTALL` because
+   `InstallGuard.isLive` is true (`EnvironmentLock.java:216`). But nothing is installing — the op is over.
+2. **No in-session recovery.** The deep-op terminal fell into the retry/bifurcation screen, not the damaged
+   dialog. The in-session "damaged" path (`LibraryActivity` install observer, `:323-338`) only fires for the
+   *install* repository, not a deep-op restore.
+3. Recovery only arrived on a **relaunch** (token mismatch → INTERRUPTED → `LibraryActivity.recovering`), and a
+   LIVE marker in-session held the box down as `Holder.INSTALL` (desired=DOWN), so the reconciler never reached
+   the try-boot that the interrupted-install verdict needs — a deadlock until the process was restarted.
+
+The user's decision: a force-cancel should present as **damaged** and route to the existing recovery, and must
+**not** leave a blocking "install in progress" marker.
+
+## 2. The distinction — inferred vs known damage
+
+ADR-5343b/ADFA-5330 deliberately made an **INTERRUPTED** marker (a dead launch's token) fall through to
+`rootfsPresent` in `SystemStateEvaluator.isSystemInstalled`, so the reconciler **tries** to boot the base: a
+killed *module* install usually left a fine rootfs, and *whether it boots* is what separates a fine base from a
+damaged one. Booting is the diagnostic.
+
+A force-cancelled restore is different in one decisive way: **the damage is known, not inferred.** We tore the
+rootfs ourselves, mid-extract. There is nothing to learn from booting it — trying would only flap the reconciler
+(`desired=UP` every tick) on a base that cannot come up, which is precisely the "half-cooked" failure mode this
+project avoids. So known damage must keep the box **down** and go straight to recovery.
+
+That is exactly the case `ServerReconcile.desired`'s own invariant note anticipated:
+
+> *"If a health signal that is NOT marker-derived is ever added (e.g. a structural rootfs check), this invariant
+> must be revisited — desired would then have a reason to gate on health again."*
+
+We honor it **without** re-adding a health gate to `desired` (see §4).
+
+## 3. Decision — a fourth reading on the same marker
+
+`InstallGuard` gains a sentinel token `"DAMAGED"` (never a per-launch UUID) and two members: `markDamaged(ctx)`
+(overwrite the marker with the sentinel) and `isDamaged(ctx)` (token == sentinel). One marker, one new *reading* —
+no second file, no new flag.
+
+| Reading | Marker token | Meaning | `isLive` | `isInterrupted` | `isDamaged` | `isSystemInstalled` |
+|---|---|---|---|---|---|---|
+| ABSENT | (none) | nothing in progress | — | — | — | `rootfsPresent` |
+| LIVE | this launch's UUID | an install runs now, this process | ✓ | — | — | **false** |
+| INTERRUPTED | another launch's UUID | inferred damage (maybe fine) | — | ✓ | — | `rootfsPresent` (try-boot) |
+| **DAMAGED** | `"DAMAGED"` sentinel | **known** damage (torn on purpose) | — | ✓ | ✓ | **false** (never boot) |
+
+The design collapses to a single insight: **DAMAGED reads `isInterrupted` too**, so the entire recovery/verdict
+path (`LibraryActivity.recovering :235`, `evaluateRecovery :917`, `SystemFactsReader.verdict :108`,
+`SetupProgressActivity :186`) owns it with **zero changes**. The known-vs-inferred difference surfaces in exactly
+**one** reader — `SystemStateEvaluator.isSystemInstalled`, which forces `false` for DAMAGED as it already does
+for LIVE — and nowhere else. That single lever keeps `desired=DOWN` (no flap) while `isLive=false` lifts the
+`k2go_busy_install` gate so a fresh restore is allowed.
+
+The producer is one call site: `DeepOpService`'s extract `onError`. **Known damage is owned by "the extract
+began and did not complete", not by the cancel button** — so the guard is `InstallGuard.isLive` (the marker was
+planted at `onExtractStarting`, i.e. the rootfs was being written and is now torn), which covers *both* an
+acknowledged force-cancel *and* a real mid-write failure (disk full, tar crash). Both leave a torn rootfs, so
+both must drop out of the "install running" state and route to recovery. The `forced` flag only picks the
+user-facing *message* (the "damaged, next launch recovers" line vs. the raw diagnostic).
+
+### 3.1 Two cancel intents must not alias (the safe-zone / feeder split)
+
+The restore has a **safe zone** (copy + verify + the verify→extract boundary, where an abort touches nothing)
+and a **destructive zone** (the extract feeder, past the point of no return). These are two different cancel
+intents and must be **two separate tokens**, or a "system unchanged" confirm can reach the feeder and tear the
+rootfs across the boundary window:
+
+- `cancelBeforeExtract` — a confirmed abort, read **only** in the safe zone (copy loop, verify listing, boundary
+  check). Never read by the feeder.
+- `forceExtractCancel` — an acknowledged destructive kill, read **only** by the extract feeder.
+
+Both service→extractor tokens are passed explicitly to `TarExtractor.startExtraction`. And the service is the
+**authority** on which zone it is in: `ACTION_CANCEL_CONFIRM` sets `cancelBeforeExtract` only while
+`currentCancelKind == CANCELLABLE`, and `ACTION_FORCE_CANCEL` sets `forceExtractCancel` only while
+`DESTRUCTIVE` — so a UI action that races a phase change (the fragment's `cancelKind` is a lagging copy) is
+ignored by the service rather than misapplied. A confirm that arrives after the boundary simply lets the extract
+finish; the system is never torn by a dialog that told the user it was safe.
+
+### 3.2 A safe-zone cancel is a terminal of its own (CANCELLED)
+
+A user cancel in the safe zone is **not a failure**. `DeepOpState` gains a `CANCELLED` phase (mirroring
+`InstallState.Phase.CANCELLED`); the service posts it from a dedicated `finishCancelled()` terminal (release the
+lock, re-enable desired, never touch InstallGuard — nothing was planted). The screen returns to the bifurcation
+by branching on that phase, so the decision lives on the op's state and **survives a config change** — it is no
+longer a fragment-local flag that a recreation would drop.
+
+## 4. Why the reduction gate still holds
+
+- **No new source of truth.** The one marker file remains the single durable fact. `isDamaged` is a *reading* of
+  it, like `isLive`/`isInterrupted`.
+- **No new "who may act" special-case.** Recovery ownership is unchanged: `LibraryActivity` still owns it, still
+  keyed on `isInterrupted`.
+- **The `desired` invariant is intact.** `desired` still does **not** read `healthy`. Known damage is expressed
+  as `installed=false` — the argument `desired` already takes — via the same `isSystemInstalled` lever a LIVE
+  install uses. We did not give `desired` a new reason to gate on health; we told the existing `installed` fact
+  the truth (a rootfs we tore is not an installed system).
+- **Prefer removing over adding:** the change *removes* a false state (a LIVE marker over a finished op) and
+  replaces it with the honest one, rather than adding a flag to compensate for the false one.
+
+## 5. Lifecycle (who sets it, who clears it, what if the process dies)
+
+- **Sets DAMAGED:** `DeepOpService` extract `onError`, whenever `InstallGuard.isLive` (the destructive marker was
+  planted at the boundary, so the rootfs was being written and is now torn) — covering both an acknowledged
+  force-cancel and a real mid-write failure. A cancel *before* any write never planted a marker (`onCancelled`
+  path) and never reaches here.
+- **Clears it:** identical to INTERRUPTED. The recovery route's reinstall calls `InstallGuard.begin` (overwrites
+  the sentinel with a live token, then `end()` on success); a base that unexpectedly boots clears it via the
+  server-alive observer (`LibraryActivity:284`); an OK verdict clears it (`:936`). No new clearer.
+- **Process dies mid-cancel:** if `markDamaged` already wrote, the sentinel persists → next launch reads
+  DAMAGED (still `isInterrupted`) → recovery. If it died *before* `markDamaged`, the marker is still LIVE with a
+  now-dead token → next launch reads INTERRUPTED → recovery. Either way recovery fires; there is no deadlock and
+  no orphaned blocking state.
+
+## 6. What changed
+
+- `InstallGuard.java` — `DAMAGED_TOKEN` sentinel; `markDamaged(ctx)`; `isDamaged(ctx)`; class + `isInterrupted`
+  javadoc note the fourth reading.
+- `SystemStateEvaluator.isSystemInstalled` — force `false` on `isDamaged` (the single divergence).
+- `deepop/DeepOpService.java` — extract `onError` marks DAMAGED whenever `isLive` (extract began and failed);
+  a **separate** `forceExtractCancel` token for the feeder (de-aliased from `cancelBeforeExtract`, §3.1);
+  `ACTION_CANCEL_CONFIRM` / `ACTION_FORCE_CANCEL` guarded on the service's own `currentCancelKind`; a `passRunning`
+  guard so the re-callable verify+extract runs one pass at a time; a `finishCancelled()` terminal.
+- `deepop/DeepOpState.java` + `DeepOpProgressRepository.java` — a `CANCELLED` phase + `cancelled()`/`postCancelled()`
+  (§3.2), so a safe-zone cancel is a terminal that survives a config change.
+- `TarExtractor.java` — `startExtraction` takes the third `forceCancelDuringExtract` token; only the feeder reads
+  it (safe-zone tokens can never reach the destructive write).
+- `redesign/BackupJobFragment.java` — the safe-zone cancel dialog is non-cancelable (closes the pause-hang
+  lifecycle gap); the terminal branches on `CANCELLED` (the fragment-local `cancelling` flag is removed).
+- `env/domain/ServerReconcile.java` — the invariant note records that this signal was added without breaking it.
+- Terminal string `k2go_br_restore_damaged` = *"Restore cancelled. Your system will start in recovery on the next
+  launch."* (states the consequence, not an accusation of damage).
+
+## 7. Device verification (the real gate)
+
+On the test device (arm64 + a 32-bit build for ABI coverage), force-cancel a restore during the extract pass and
+confirm, without a relaunch:
+
+1. The terminal shows the *damaged* message (not retry/bifurcation).
+2. A fresh restore is **no longer blocked** by "An install is in progress".
+3. The box does **not** flap (no repeated `pdsm start` on the torn rootfs in the reconciler log; `desired=DOWN`).
+4. Returning to the library **or** relaunching lands on the damaged-recovery dialog; Recover → reinstall
+   repairs the system.
+5. Repeat with a force-cancel that races the very first extract write (boundary), and with a normal (non-forced)
+   extract error, to confirm the non-forced path is unchanged.