K2GO-395 feat(networkpolicy): bank-before-gate prompt at the Books commit point

Same shape as startZimDownload: startBooksDownload banks the wishlist first, then
gates only the drain + navigation, so a declined/offline order is queued not lost.
Its drain was already held by the ContentAdmission cost gate; this adds the
interactive prompt. ADR-395 updated (Kolibri prompt remains -- async flow).

Author: luisguzman-adfa

controller/app/src/main/java/org/appdevforall/k2go/redesign/SetupLibraryActivity.java

@@ -524,20 +524,25 @@ public void startBooksDownload() {
                     v != null && v.length > 2 ? v[2] : "");
         }
         selection().booksCart().clear();
-        // ADFA-5074: through the wishlist, like ZIM and Courses. Books was the last door still
-        // calling its service directly, and that had a real consequence beyond symmetry: the
-        // service registers its session asynchronously in onStartCommand, so for a moment nothing
-        // was pending and nothing was in session. The index reads exactly that pair to decide the
-        // run is over — nothingToStart() plus an empty orchestrateStep — and could declare a
-        // just-started download complete and count down to the Library. Writing the wishlist first
-        // makes hasPending true synchronously, before the index is even launched, so that window
-        // does not exist. It also makes Books queue behind a busy line instead of overwriting.
-        BooksProvisioner.drain(this);
-        // ADFA-4988: go to the progress screen instead of returning to Get More and downloading
-        // invisibly. ADFA-5074: to the index, not the books detail. The hint that used to open the
-        // detail "when books is the only stream" made the landing depend on state the user cannot
-        // see, and the index is what ends the run.
-        startActivity(new Intent(this, SetupProgressActivity.class));
+        // K2GO-395 (ADR-395 sec.10): the order is banked above; gate only the drain + navigation, so
+        // a declined or offline order stays queued (ContentAdmission also holds it on metered-without-
+        // consent). Same shape as startZimDownload.
+        org.appdevforall.k2go.networkpolicy.presentation.NetworkPolicyGate.guardHeavyStart(this, () -> {
+            // ADFA-5074: through the wishlist, like ZIM and Courses. Books was the last door still
+            // calling its service directly, and that had a real consequence beyond symmetry: the
+            // service registers its session asynchronously in onStartCommand, so for a moment nothing
+            // was pending and nothing was in session. The index reads exactly that pair to decide the
+            // run is over — nothingToStart() plus an empty orchestrateStep — and could declare a
+            // just-started download complete and count down to the Library. Writing the wishlist first
+            // makes hasPending true synchronously, before the index is even launched, so that window
+            // does not exist. It also makes Books queue behind a busy line instead of overwriting.
+            BooksProvisioner.drain(this);
+            // ADFA-4988: go to the progress screen instead of returning to Get More and downloading
+            // invisibly. ADFA-5074: to the index, not the books detail. The hint that used to open the
+            // detail "when books is the only stream" made the landing depend on state the user cannot
+            // see, and the index is what ends the run.
+            startActivity(new Intent(this, SetupProgressActivity.class));
+        });
     }
 
     /** ADFA-4850: Books landing -> the download manager screen (per-book checklist + retry). */

controller/docs/ADR-395-network-cost-consent.md

@@ -170,15 +170,16 @@ Landed as a compiling, tested starting point for the implementer:
 - Enforcement (headless): `ContentAdmission.canStart` defers when
   `NetworkCostAdmission.allowsHeavyStartNow` is false, so the ZIM, Books and
   Kolibri drains all HOLD a banked order on metered-without-consent (sec.10).
-- Wiring: observer started in `IIABApplication`; the ZIM commit point
-  (`SetupLibraryActivity.startZimDownload`) banks first, then gates the drain, so
-  a declined/offline order is queued, not lost.
+- Wiring: observer started in `IIABApplication`; the ZIM and Books commit points
+  (`SetupLibraryActivity.startZimDownload` / `startBooksDownload`) bank first, then
+  gate the drain, so a declined/offline order is queued, not lost.
 - Strings translated to all 33 locales (machine-generated, pending human review)
   in `values*/strings_networkpolicy.xml`; `strings_untranslated.xml` is clear.
 
-Remaining to finish the contract: the Books/Kolibri commit-point prompts (their
-drains are already held), the Maps seam (re-locate post K2GO-394), the
-DownloadManager seam, and the two-`hasInternet` fold. (l10n done pending review.)
+Remaining to finish the contract: the Kolibri commit-point prompt (its drain is
+already held; the ask needs care because the flow is async), the Maps seam
+(re-locate post K2GO-394), the DownloadManager seam, and the two-`hasInternet`
+fold. (l10n done pending review.)
 
 ## 6. Device evidence appendix (dark surfaces flattened)
 
@@ -303,7 +304,7 @@ happens BEFORE the gate (`SetupLibraryActivity.startZimDownload` banks, then gat
 the drain), so a declined or offline order is queued, not lost. This removes the
 commit-point special case rather than adding one.
 
-Still open as follow-ups: the Books/Kolibri commit-point prompts (their drains are
-already held by the ContentAdmission change; only the interactive ask is missing),
-the Maps seam (K2GO-394 reworked Maps; re-locate it), DownloadManager (OTA/portal),
-and the two-`hasInternet` fold.
+The ZIM and Books commit points now bank-then-prompt. Still open as follow-ups:
+the Kolibri commit-point prompt (its drain is already held; the ask needs care
+because the flow banks on a background thread), the Maps seam (K2GO-394 reworked
+Maps; re-locate it), DownloadManager (OTA/portal), and the two-`hasInternet` fold.