Well, the check-valve idea in the last post didn't work well.
Looks like the valve doesn't work well with minimal ambient air pressure differential.
That bit of air leakage meant that, in normal pumping operation, the pump would never build up enough back pressure to shut down.
So, I got rid of the whole check-valve section.
Now, filling from a pressurized city source only feeds the lower tank port, and using the pump to fill the tank from an unpressurized source only feeds the upper tank port.
All is tested and, so far, works leak free.
Here are the revised diagram and photo.