Check database dump privileges before stopping applications

lib/common.sh

@@ -197,6 +197,11 @@ preflight() {
     need "$DB_DUMP_BIN"; need "$DB_CLIENT_BIN"
     for i in "${!DB_LABELS[@]}"; do
       "$DB_CLIENT_BIN" --defaults-extra-file="${DB_CNFS[i]}" --database="${DB_NAMES[i]}" --execute='SELECT 1' >/dev/null
+      # Restore uses different privileges; this prerequisite belongs to dumps.
+      # Metadata only: never briefly lock the live database during --check.
+      if [[ $OPERATION == backup ]]; then
+        helper db-privileges "$DB_CLIENT_BIN" "${DB_CNFS[i]}" "${DB_NAMES[i]}"
+      fi
     done
   fi
   if [[ $ENABLE_NEXTCLOUD == true ]]; then need sudo; need php; [[ -f $NC_DIR/occ ]] || die "Nextcloud occ missing"; fi
@@ -262,7 +267,9 @@ stop_service() {
       # Record intent before stop: a failed/partial stop still needs recovery.
       STOPPED_SERVICES+=("$1")
       save_recovery
+      echo "-- Stopping service: $1 (waiting for systemd)"
       systemctl stop "$1"
+      echo "-- Service stopped: $1"
       ;;
     inactive|failed) ;;
     *) die "Unknown/transitioning service state for $1: $state" ;;
@@ -278,7 +285,7 @@ quiesce() {
       if [[ $NC_WAS_ON == false ]]; then NC_CHANGED=true; save_recovery; occ maintenance:mode --on; fi
     else echo "WARNING: Nextcloud maintenance disabled; consistency depends on external writer shutdown"; fi
   fi
-  # Include application cron/worker services in this array; crond itself is not stopped.
+  # Cron daemons are included only if explicitly configured by the operator.
   for p in "${QUIESCE_SERVICES[@]}"; do stop_service "$p"; done
   if [[ $ENABLE_WORDPRESS == true || $ENABLE_NEXTCLOUD == true ]]; then
     if [[ $ENABLE_HTTPD_STOP == true ]]; then stop_service "$HTTPD_SERVICE_NAME"; fi
@@ -294,7 +301,9 @@ quiesce() {
   if [[ $ENABLE_NEXTCLOUD == true ]]; then
     # Cron daemons may leave an already launched PHP child running after stop.
     # Wait for direct cron.php / occ processes to finish; never kill them blindly.
+    echo '-- Waiting for remaining Nextcloud writers'
     helper wait-nextcloud "$NC_DIR" "${WRITER_DRAIN_TIMEOUT:=300}"
+    echo '-- Nextcloud writers finished'
   fi
 }
 # Survives SIGKILL/power loss, which Bash traps cannot handle. This is an
@@ -317,7 +326,11 @@ resume_services() {
   fi
   for ((i=${#STOPPED_SERVICES[@]}-1; i>=0; i--)); do
     [[ -n ${STOPPED_SERVICES[i]} ]] || continue
-    if systemctl start "${STOPPED_SERVICES[i]}"; then STOPPED_SERVICES[i]=''; else failed=1; fi
+    echo "-- Starting service: ${STOPPED_SERVICES[i]} (waiting for systemd)"
+    if systemctl start "${STOPPED_SERVICES[i]}"; then
+      echo "-- Service started: ${STOPPED_SERVICES[i]}"
+      STOPPED_SERVICES[i]=''
+    else failed=1; fi
   done
   if (( failed == 0 )); then
     rm -f -- "$WORKDIR/recovery-$RUN_ID.json"