Guard writer units against activation and fix backup cancellation

usr-local-sbin/app-backup.sh

@@ -39,6 +39,7 @@ printf 'format=2\ncompressor=%s\n' "$COMPRESSOR" > "$STAGING_DIR/meta/format.txt
 quiesce
 
 for i in "${!DB_LABELS[@]}"; do
+  assert_services_quiescent
   label=${DB_LABELS[i]}
   out="$STAGING_DIR/db/${label#db-}.sql"
   echo "-- Dump: ${DB_NAMES[i]}"
@@ -47,11 +48,13 @@ for i in "${!DB_LABELS[@]}"; do
   "$DB_DUMP_BIN" --defaults-extra-file="${DB_CNFS[i]}" --lock-all-tables \
     --quick --routines --events --triggers --hex-blob --default-character-set=utf8mb4 \
     "${DB_NAMES[i]}" > "$out.partial"
+  assert_services_quiescent
   [[ -s $out.partial ]] || die "Empty database dump: $label"
   mv -- "$out.partial" "$out"
   printf '%s\t%s\n' "$label" "${DB_NAMES[i]}" >> "$PLAN"
 done
 for i in "${!LABELS[@]}"; do
+  assert_services_quiescent
   label=${LABELS[i]}; src=${SOURCES[i]}; root=${ROOTS[i]}
   check_space "$STAGING_ROOT"
   mkdir -p -- "$STAGING_DIR/$root"
@@ -60,10 +63,13 @@ for i in "${!LABELS[@]}"; do
   # Never accept vanished-file (24) or partial-copy (23) as success.
   # Parent retains both locks; rsync itself needs neither inherited descriptor.
   rsync -aHAX --numeric-ids "${EXCLUDES[@]}" -- "$src/" "$STAGING_DIR/$root/" 8>&- 9>&-
+  assert_services_quiescent
   printf '%s\t%s\n' "$label" "$src" >> "$PLAN"
 done
 # The full consistency window includes all dumps AND copies. Compression/upload
 # use this frozen private staging tree, so application downtime ends here.
+assert_services_quiescent
+echo '-- Copy window complete; writer guards verified'
 resume_services || die 'Failed to resume original service state'
 
 while IFS=$'\t' read -r label _; do