Guard writer units against activation and fix backup cancellation

usr-local-sbin/app-backup.sh

@@ -39,6 +39,7 @@ printf 'format=2\ncompressor=%s\n' "$COMPRESSOR" > "$STAGING_DIR/meta/format.txt
 quiesce
 
 for i in "${!DB_LABELS[@]}"; do
+  assert_services_quiescent
   label=${DB_LABELS[i]}
   out="$STAGING_DIR/db/${label#db-}.sql"
   echo "-- Dump: ${DB_NAMES[i]}"
@@ -47,11 +48,13 @@ for i in "${!DB_LABELS[@]}"; do
   "$DB_DUMP_BIN" --defaults-extra-file="${DB_CNFS[i]}" --lock-all-tables \
     --quick --routines --events --triggers --hex-blob --default-character-set=utf8mb4 \
     "${DB_NAMES[i]}" > "$out.partial"
+  assert_services_quiescent
   [[ -s $out.partial ]] || die "Empty database dump: $label"
   mv -- "$out.partial" "$out"
   printf '%s\t%s\n' "$label" "${DB_NAMES[i]}" >> "$PLAN"
 done
 for i in "${!LABELS[@]}"; do
+  assert_services_quiescent
   label=${LABELS[i]}; src=${SOURCES[i]}; root=${ROOTS[i]}
   check_space "$STAGING_ROOT"
   mkdir -p -- "$STAGING_DIR/$root"
@@ -60,10 +63,13 @@ for i in "${!LABELS[@]}"; do
   # Never accept vanished-file (24) or partial-copy (23) as success.
   # Parent retains both locks; rsync itself needs neither inherited descriptor.
   rsync -aHAX --numeric-ids "${EXCLUDES[@]}" -- "$src/" "$STAGING_DIR/$root/" 8>&- 9>&-
+  assert_services_quiescent
   printf '%s\t%s\n' "$label" "$src" >> "$PLAN"
 done
 # The full consistency window includes all dumps AND copies. Compression/upload
 # use this frozen private staging tree, so application downtime ends here.
+assert_services_quiescent
+echo '-- Copy window complete; writer guards verified'
 resume_services || die 'Failed to resume original service state'
 
 while IFS=$'\t' read -r label _; do

usr-local-sbin/app-restore.sh

@@ -164,6 +164,7 @@ quiesce
 MUTATION_STARTED=true
 save_recovery
 for i in "${!SELECTED[@]}"; do
+  assert_services_quiescent
   label=${SELECTED[i]}
   source_path="$STAGING_DIR/extracted/$label/${SELECTED_ROOTS[i]}"
   if [[ ${IS_DB[i]} == true ]]; then
@@ -175,6 +176,7 @@ for i in "${!SELECTED[@]}"; do
     rsync -aHAX --numeric-ids "${EXCLUDES[@]}" -- "$source_path/" "${TARGETS[i]}/" 8>&- 9>&-
   fi
 done
+assert_services_quiescent
 # A backup captured maintenance=true. Enforce the recorded pre-restore state even
 # if the existing installation already was in maintenance mode.
 if [[ " ${SELECTED[*]} " == *' nextcloud '* || " ${SELECTED[*]} " == *' db-nextcloud '* ]]; then