Bump version to 1.2.19

Also fixes a stale usage-text assertion in package_archive_test.sh that
still expected the old <MARIADB_VERSION> <PORT> form (install_db_cli_test.sh
was already updated for the now-optional PORT, but this archive-level
check was missed until repackaging surfaced it against fresh content).

docs/superpowers/specs/2026-07-05-native-port-takeover-design.md

@@ -0,0 +1,214 @@
+# Design: Native MariaDB Port Takeover for alt-mariadb on Port 3306
+
+Date: 2026-07-05
+Status: Approved by user, ready for implementation planning
+
+## Goal
+
+Let `install_db.sh` install `alt-mariadb` on the standard MySQL/MariaDB port (3306) by
+first moving DirectAdmin's existing CustomBuild-managed native MariaDB off that port, so
+that any tool or script that assumes the default port can reach `alt-mariadb` without
+custom port configuration.
+
+## Background
+
+`install_db.sh` currently requires `alt-mariadb`'s port as a mandatory CLI argument
+(defaulting nowhere, e.g. `install_db.sh 10.11 33033`), and its own `validate_paths()`
+explicitly rejects a port that matches DirectAdmin's native engine's port. Native MariaDB
+(installed and managed by CustomBuild) occupies 3306 today.
+
+Earlier in this project's design work, a different port-3306 proposal was considered and
+rejected: pointing DirectAdmin's own `mysql.conf` *at* `alt-mariadb` itself. That failed
+because DirectAdmin's legacy-code-base license enforces a hard MariaDB-version ceiling
+(10.6) at login time, independent of CustomBuild settings, and `alt-mariadb` intentionally
+runs newer versions.
+
+This design is different and does not hit that problem: DirectAdmin keeps talking to the
+*same* native engine, on the *same* version — only the TCP port that engine listens on
+changes. The freed port 3306 then goes to `alt-mariadb`.
+
+The user confirmed empirically, on the actual target server, that setting
+`mysql_inst=no` in CustomBuild's `options.conf` and then changing the native port in
+`/etc/my.cnf` survives a `./build rewrite_confs` run — i.e., once MySQL/MariaDB is marked
+as externally-managed, CustomBuild's config-regeneration sweep no longer touches it. This
+is the key fact that makes a manual, persistent port change safe here (CustomBuild's
+per-service `rewrite_confs` logic is gated on it considering that service "managed").
+
+## Scope
+
+- Applies only to a **fresh `alt-mariadb` install** (`install_db.sh`'s normal use case) —
+  not to migrating an already-running `alt-mariadb` instance to a new port. Native MariaDB
+  is always already running at the time `install_db.sh` runs (DirectAdmin itself is
+  already installed), so the "live service surgery" risk is entirely on the native side,
+  never the `alt-mariadb` side.
+- Runs only on **AlmaLinux 8 or 9**. CloudLinux, Rocky, CentOS, plain RHEL, and AlmaLinux
+  outside 8/9 are explicitly refused before anything is touched — a stricter, separate
+  check from `install_db.sh`'s own permissive `detect_os()`, because this script touches a
+  live, DA-critical service rather than just installing an additional one.
+- This is a materially one-way decision: `mysql_inst=no` has no clean, officially
+  documented path back to CustomBuild-managed MySQL once other things start depending on
+  the new arrangement. The design rolls back cleanly on failure *during the takeover
+  itself*, but is not meant to be casually reversed afterward.
+
+## CLI change to `install_db.sh`
+
+`PORT` becomes optional. Usage becomes `install_db.sh <MARIADB_VERSION> [PORT]`:
+
+- `install_db.sh 10.11` — `PORT` defaults to `3306`, triggering the native takeover.
+- `install_db.sh 10.11 3306` — same as above; the trigger is the *resolved* port value,
+  not whether it was typed explicitly.
+- `install_db.sh 10.11 33033` — explicit non-3306 port, no takeover, today's behavior is
+  unchanged.
+
+`apply_cli_args` changes from requiring exactly 2 arguments to accepting 1 or 2 (still
+requires at least `MARIADB_VERSION`). Usage text and examples must reflect the new
+optional-port form.
+
+## Architecture
+
+A new, independent script, `scripts/setup/native_mariadb_port_takeover.sh`, holds all
+logic for moving native MariaDB off 3306. `install_db.sh` calls it once, early in
+`main()`, only when the resolved `PORT` is `3306` — before `load_da_credentials`, so that
+by the time DA's credentials are read, `mysql.conf` already reflects the *new* native port
+and the existing "alt port must differ from DA's port" check in `validate_paths()` passes
+naturally with no changes needed there.
+
+This mirrors how every other multi-step, risk-bearing operation in this plugin is
+isolated into its own file (`da_restore_native_staging_to_alt_mysql.sh`,
+`alt_mysql_native_backup_restore.sh`, `mysql_upgrade.sh`) rather than growing the already
+large `install_db.sh` further, and keeps this logic independently testable with fake
+command stubs.
+
+## Configuration
+
+Top-of-file variables in the new script, in the same "hand-editable config block"
+convention already used by `install_db.sh` (e.g. `MARIADB_TARBALL_URL`):
+
+- `NATIVE_MY_CNF` (default `/etc/my.cnf`)
+- `NATIVE_MY_CNF_D` (default `/etc/my.cnf.d`)
+- `NATIVE_MYSQL_CONF` (default `/usr/local/directadmin/conf/mysql.conf`)
+- `NEW_NATIVE_PORT` (default `3307`)
+
+## Sequencing
+
+### Step 0: OS guard
+
+Read `/etc/os-release`. Require `ID=almalinux` and `VERSION_ID` starting with `8` or `9`.
+Anything else: `die()` immediately, before any other action.
+
+### Step 1: Baseline check
+
+Read DA's current native port/socket/credentials from `NATIVE_MYSQL_CONF` (reuse the
+`mysql.conf` parsing convention already used elsewhere in this plugin). Confirm the native
+engine is actually reachable right now using those credentials — abort before touching
+anything if it isn't (this script must not appear to "fix" an unrelated pre-existing
+problem). Also read the *current* `mysql_inst=` value from CustomBuild's `options.conf`
+and record it (`mariadb` or `mysql`) — this is what rollback restores.
+
+### Step 2: Idempotency check
+
+If the current native port (from Step 1) is already something other than 3306, log
+"already done" and exit 0. Nothing further to do.
+
+### Step 3: Preflight the new port
+
+Confirm `NEW_NATIVE_PORT` is not already bound by anything (reuse `install_db.sh`'s
+`port_is_listening` pattern). Refuse before making any change if it is.
+
+### Step 4: Disable CustomBuild's MySQL management
+
+Run `da build set mysql_inst no` — DirectAdmin's supported CLI, not a raw edit of
+`options.conf`. Skip if Step 1 already found it set to `no` (idempotency).
+
+### Step 5: Locate, back up, and rewrite the active `port=` directive(s)
+
+Scan `NATIVE_MY_CNF` and every `NATIVE_MY_CNF_D/*.cnf` for a `port=` line inside a
+`[mysqld]`/`[mariadb]`/`[server]` section (later-loaded `my.cnf.d` files override
+`my.cnf`'s own value for the same directive — both must be checked, not just one). Back up
+every file before editing it (timestamped copy, matching `install_db.sh`'s
+`backup_existing_file` convention). If no explicit `port=` line exists anywhere (implicit
+default), add one to `[mysqld]` in `NATIVE_MY_CNF`. If matches exist, rewrite each to
+`NEW_NATIVE_PORT`.
+
+### Step 6: Update `mysql.conf`
+
+Rewrite only the `port=` field in `NATIVE_MYSQL_CONF` to `NEW_NATIVE_PORT`, via a targeted
+line replacement — not full-file regeneration — so `user=`/`passwd=`/`host=`/`socket=` are
+left untouched exactly as they were.
+
+### Step 7: Restart native MariaDB
+
+Restart the native MariaDB service (reuse `mysql_service_name()`-style detection). Verify
+it is listening on `NEW_NATIVE_PORT` and specifically **not** on 3306.
+
+### Step 8: Restart DirectAdmin
+
+Restart the `directadmin` service so DA's core picks up the new port immediately, rather
+than relying on an unconfirmed lazy-reload behavior. This causes a brief (seconds-long)
+panel interruption — expected, not a failure.
+
+### Step 9: Verify DA's own connectivity
+
+Confirm DA's credentials (from the now-updated `mysql.conf`) can connect to the native
+engine on `NEW_NATIVE_PORT`. This is the real pass/fail gate for the whole operation.
+
+Only if Step 9 succeeds does `install_db.sh` continue installing `alt-mariadb`, now
+targeting port 3306 (already free).
+
+## Error handling and rollback
+
+Any failure at Step 4 or later triggers rollback of everything done so far, in reverse
+order, before the script aborts non-zero:
+
+- Restore every file backed up in Step 5 from its timestamped copy.
+- Run `da build set mysql_inst <original_value>` (the value captured in Step 1) to restore
+  CustomBuild management.
+- Attempt to restart native MariaDB back on 3306; verify it's reachable again via the
+  *original* credentials/port.
+- If DirectAdmin was already restarted (Step 8+), restart it again so it re-picks-up the
+  reverted config, then verify reachability.
+
+The script logs clearly what it reverted and always exits non-zero on any rollback path.
+`install_db.sh` must not proceed to installing `alt-mariadb` if this script exits non-zero,
+for any reason. One exception: if Step 9 fails only because DirectAdmin itself won't
+restart cleanly (unrelated to the port change), the script should say so explicitly rather
+than reporting it as a takeover failure.
+
+## Testing
+
+Matching this repo's established convention (plain bash test scripts under `tests/`, fake
+command stubs via `PATH`/env-var injection, no external test framework): a new
+`tests/native_mariadb_port_takeover_test.sh` fakes `da`, `systemctl`, and the
+`mysql`/`mariadb` client binaries as stub scripts that log their invocations, plus fixture
+copies of `/etc/my.cnf`, `/etc/my.cnf.d/*.cnf`, and `mysql.conf` under a temp directory (all
+overridable via the script's own env vars, same pattern as `alt_mysql_native_backup_restore.sh`'s
+tests). Scenarios:
+
+- Happy path: native on 3306 → ends up on 3307, `mysql.conf` updated, exit 0.
+- Idempotency: native already on 3307 → no-op, exit 0, no file changes.
+- OS guard: non-AlmaLinux or AlmaLinux outside 8/9 → refuses immediately, no files touched.
+- Preflight rejection: `NEW_NATIVE_PORT` already in use → refuses before any change.
+- Rollback: simulate failure at each of Steps 5 through 9 in turn → confirm every backed-up
+  file is restored and `da build set mysql_inst <original>` is called with the correct
+  original value in each case.
+
+## Out of scope
+
+- Migrating an already-running `alt-mariadb` instance to a new port (not needed — this
+  server has no `alt-mariadb` installed yet).
+- Any OS other than AlmaLinux 8/9.
+- A documented path back to CustomBuild-managed MySQL/MariaDB after this runs.
+- Changing `/etc/services` or CSF/firewall rules (native MariaDB is not intended to be
+  remotely reachable; out of scope unless that changes).
+
+## Risks / open items for implementation planning
+
+- The exact `[mysqld]`/`[mariadb]`/`[server]` section name in use on this server's
+  `/etc/my.cnf.d/*.cnf` files should be confirmed empirically during implementation (grep
+  the actual files) rather than assumed, since MariaDB accepts more than one section name
+  for the same server-level directives.
+- `da build set mysql_inst no` and its reverse are assumed to be synchronous, side-effect-free
+  writes to `options.conf` with no network/build side effects; this should be confirmed
+  empirically (e.g. by diffing `options.conf` before/after and confirming no other files
+  change) during the first implementation task, consistent with how this project has
+  handled other empirically-verified-not-documented DirectAdmin behaviors.

plugin.conf

@@ -2,7 +2,7 @@ name=alt-mysql
 id=alt-mysql
 type=user
 author=HITME.PL
-version=1.2.18
+version=1.2.19
 active=no
 installed=no
 user_run_as=root

scripts/install_db.sh

@@ -17,6 +17,7 @@ ALT_MYSQL_CONF="/usr/local/directadmin/conf/alt-mysql.conf"
 ALT_MY_CNF="/usr/local/directadmin/conf/alt-my.cnf"
 ALT_METADATA_ENV="/usr/local/directadmin/conf/alt-mariadb.env"
 INSTANCE_CNF="/etc/alt-mariadb.cnf"
+NATIVE_TAKEOVER_SCRIPT="${NATIVE_TAKEOVER_SCRIPT:-$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/setup/native_mariadb_port_takeover.sh}"
 SERVICE_NAME="alt-mariadb"
 SERVICE_FILE="/etc/systemd/system/alt-mariadb.service"
 LOG_DIR="/var/log/alt-mariadb"
@@ -69,14 +70,21 @@ trap cleanup EXIT
 usage() {
     cat <<EOF
 Użycie:
-  $0 <MARIADB_VERSION> <PORT>
+  $0 <MARIADB_VERSION> [PORT]
 
 Przykłady:
+  $0 10.11
   $0 10.11 33033
   $0 11.4 3020
   $0 11.8 3021
 
 Dozwolone gałęzie MariaDB: 10.11, 11.4, 11.8.
+
+Jeżeli PORT zostanie pominięty, przyjmowana jest wartość domyślna 3306. W takim
+przypadku skrypt najpierw przenosi natywną instancję MariaDB zarządzaną przez
+CustomBuild na inny port (patrz scripts/setup/native_mariadb_port_takeover.sh),
+aby zwolnić port 3306 dla alt-mariadb. To automatyczne przejęcie portu działa
+wyłącznie na AlmaLinux 8/9 - na innych systemach podaj PORT jawnie (inny niż 3306).
 EOF
 }
 
@@ -98,19 +106,15 @@ apply_cli_args() {
     fi
 
     if [[ $# -gt 2 ]]; then
-        usage_error "Podano zbyt wiele argumentów. Oczekiwano: MARIADB_VERSION PORT."
+        usage_error "Podano zbyt wiele argumentów. Oczekiwano: MARIADB_VERSION [PORT]."
     fi
 
-    if [[ $# -lt 2 ]]; then
-        usage_error "Podaj wersję MariaDB i port TCP, np. 11.4 3020."
-    fi
-
-    if [[ $# -ge 1 && -n "${1:-}" ]]; then
     MARIADB_VERSION="$1"
-    fi
 
     if [[ $# -ge 2 && -n "${2:-}" ]]; then
         PORT="$2"
+    else
+        PORT="3306"
     fi
 
     MARIADB_DIR="/usr/local/mariadb-$MARIADB_VERSION"
@@ -122,6 +126,17 @@ require_root() {
     fi
 }
 
+maybe_takeover_native_port() {
+    if [[ "$PORT" != "3306" ]]; then
+        return 0
+    fi
+
+    [[ -x "$NATIVE_TAKEOVER_SCRIPT" ]] || die "Nie znaleziono skryptu przejęcia portu natywnego MariaDB: $NATIVE_TAKEOVER_SCRIPT"
+
+    log "PORT=3306 wybrany dla alt-mariadb - uruchamiam przejęcie portu natywnej instancji MariaDB."
+    "$NATIVE_TAKEOVER_SCRIPT" || die "Przejęcie portu natywnej instancji MariaDB nie powiodło się. Przerwano instalację alt-mariadb."
+}
+
 detect_os() {
     [[ -r /etc/os-release ]] || die "Nie można odczytać /etc/os-release."
     . /etc/os-release
@@ -850,6 +865,7 @@ main() {
     validate_port
     require_root
     detect_os
+    maybe_takeover_native_port
     load_da_credentials
     validate_paths
     install_dependencies

scripts/setup/native_mariadb_port_takeover.sh

@@ -0,0 +1,343 @@
+#!/bin/bash
+set -Eeuo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PLUGIN_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+COMMON_FILE="$SCRIPT_DIR/mysql_common.sh"
+
+NATIVE_MY_CNF="${NATIVE_MY_CNF:-/etc/my.cnf}"
+NATIVE_MY_CNF_D="${NATIVE_MY_CNF_D:-/etc/my.cnf.d}"
+NATIVE_MYSQL_CONF="${NATIVE_MYSQL_CONF:-/usr/local/directadmin/conf/mysql.conf}"
+CUSTOMBUILD_OPTIONS_CONF="${CUSTOMBUILD_OPTIONS_CONF:-/usr/local/directadmin/custombuild/options.conf}"
+NEW_NATIVE_PORT="${NEW_NATIVE_PORT:-3307}"
+DA_CLI_BIN="${DA_CLI_BIN:-da}"
+OS_RELEASE_FILE="${OS_RELEASE_FILE:-/etc/os-release}"
+
+LOG_FILE="${NATIVE_TAKEOVER_LOG:-$PLUGIN_DIR/data/logs/native-port-takeover.log}"
+mkdir -p "$(dirname "$LOG_FILE")" 2>/dev/null || true
+
+log() {
+  printf '[%s] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*" >> "$LOG_FILE"
+  printf '[INFO] %s\n' "$*"
+}
+
+die() {
+  log "ERROR: $*"
+  printf '[BŁĄD] %s\n' "$*" >&2
+  exit 1
+}
+
+# --- state populated by the detection functions, consumed by later steps ---
+NATIVE_CURRENT_PORT=""
+NATIVE_CURRENT_SOCKET=""
+NATIVE_CURRENT_HOST=""
+NATIVE_CURRENT_USER=""
+NATIVE_CURRENT_PASS=""
+NATIVE_CURRENT_MYSQL_INST=""
+
+require_root() {
+  [ "$(id -u)" -eq 0 ] || die "Ten skrypt musi zostać uruchomiony jako root."
+}
+
+check_os_guard() {
+  [ -r "$OS_RELEASE_FILE" ] || die "Nie można odczytać $OS_RELEASE_FILE."
+  local os_id="" os_version=""
+  os_id="$(awk -F= '$1=="ID"{gsub(/"/,"",$2); print $2}' "$OS_RELEASE_FILE")"
+  os_version="$(awk -F= '$1=="VERSION_ID"{gsub(/"/,"",$2); print $2}' "$OS_RELEASE_FILE")"
+
+  [ "$os_id" = "almalinux" ] || die "Ten skrypt obsługuje wyłącznie AlmaLinux 8/9 (wykryto: ${os_id:-nieznany})."
+  case "$os_version" in
+    8*|9*) ;;
+    *) die "Ten skrypt obsługuje wyłącznie AlmaLinux 8/9 (wykryto wersję: ${os_version:-nieznana})." ;;
+  esac
+  log "Wykryto obsługiwany system: AlmaLinux $os_version."
+}
+
+read_native_mysql_conf() {
+  [ -r "$NATIVE_MYSQL_CONF" ] || die "Nie znaleziono pliku $NATIVE_MYSQL_CONF."
+  NATIVE_CURRENT_USER="$(mysql_read_key_value "$NATIVE_MYSQL_CONF" user || true)"
+  NATIVE_CURRENT_PASS="$(mysql_read_key_value "$NATIVE_MYSQL_CONF" passwd || true)"
+  NATIVE_CURRENT_PORT="$(mysql_read_key_value "$NATIVE_MYSQL_CONF" port || true)"
+  NATIVE_CURRENT_SOCKET="$(mysql_read_key_value "$NATIVE_MYSQL_CONF" socket || true)"
+  NATIVE_CURRENT_HOST="$(mysql_read_key_value "$NATIVE_MYSQL_CONF" host || true)"
+  [ -n "$NATIVE_CURRENT_USER" ] || die "Nie udało się odczytać pola user z $NATIVE_MYSQL_CONF."
+  [ -n "$NATIVE_CURRENT_PORT" ] || die "Nie udało się odczytać pola port z $NATIVE_MYSQL_CONF."
+}
+
+read_current_mysql_inst() {
+  [ -r "$CUSTOMBUILD_OPTIONS_CONF" ] || die "Nie znaleziono pliku $CUSTOMBUILD_OPTIONS_CONF."
+  NATIVE_CURRENT_MYSQL_INST="$(mysql_read_key_value "$CUSTOMBUILD_OPTIONS_CONF" mysql_inst || true)"
+  [ -n "$NATIVE_CURRENT_MYSQL_INST" ] || die "Nie udało się odczytać mysql_inst z $CUSTOMBUILD_OPTIONS_CONF."
+  log "Bieżąca wartość mysql_inst: $NATIVE_CURRENT_MYSQL_INST."
+}
+
+already_migrated() {
+  [ "$NATIVE_CURRENT_PORT" != "3306" ]
+}
+
+check_native_reachable() {
+  local bin
+  bin="$(mysql_detect_binary mysql)" || die "Nie znaleziono klienta mysql/mariadb do sprawdzenia natywnej instancji."
+  MYSQL_PWD="$NATIVE_CURRENT_PASS" "$bin" \
+    --user="$NATIVE_CURRENT_USER" \
+    --protocol=TCP --host=127.0.0.1 --port="$NATIVE_CURRENT_PORT" \
+    -e "SELECT 1" >/dev/null 2>>"$LOG_FILE" \
+    || die "Natywna instancja MariaDB nie odpowiada na porcie $NATIVE_CURRENT_PORT z bieżącymi poświadczeniami."
+  log "Natywna instancja MariaDB odpowiada na porcie $NATIVE_CURRENT_PORT."
+}
+
+port_is_listening() {
+  local port="$1"
+  if command -v ss >/dev/null 2>&1; then
+    ss -ltn "( sport = :$port )" 2>/dev/null | awk 'NR > 1 { found=1 } END { exit !found }'
+    return $?
+  fi
+  if command -v lsof >/dev/null 2>&1; then
+    lsof -nP -iTCP:"$port" -sTCP:LISTEN >/dev/null 2>&1
+    return $?
+  fi
+  log "Nie znaleziono ss ani lsof - zakładam, że port $port jest wolny."
+  return 1
+}
+
+preflight_new_port_free() {
+  if port_is_listening "$NEW_NATIVE_PORT"; then
+    die "Port $NEW_NATIVE_PORT jest już zajęty. Zmień NEW_NATIVE_PORT i spróbuj ponownie."
+  fi
+  log "Port docelowy $NEW_NATIVE_PORT jest wolny."
+}
+
+DID_SET_MYSQL_INST_NO=0
+CONFIG_BACKUPS=()
+
+disable_custombuild_mysql_management() {
+  if [ "$NATIVE_CURRENT_MYSQL_INST" = "no" ]; then
+    log "mysql_inst jest już ustawione na 'no' - pomijam."
+    return 0
+  fi
+  "$DA_CLI_BIN" build set mysql_inst no >>"$LOG_FILE" 2>&1 \
+    || die "Nie udało się ustawić mysql_inst=no przez '$DA_CLI_BIN build set mysql_inst no'."
+  DID_SET_MYSQL_INST_NO=1
+  log "Ustawiono mysql_inst=no przez CustomBuild."
+}
+
+restore_custombuild_mysql_management() {
+  [ "$DID_SET_MYSQL_INST_NO" -eq 1 ] || return 0
+  "$DA_CLI_BIN" build set mysql_inst "$NATIVE_CURRENT_MYSQL_INST" >>"$LOG_FILE" 2>&1 \
+    || log "OSTRZEŻENIE: nie udało się przywrócić mysql_inst=$NATIVE_CURRENT_MYSQL_INST."
+  log "Przywrócono mysql_inst=$NATIVE_CURRENT_MYSQL_INST."
+}
+
+backup_config_file() {
+  local file="$1"
+  local backup
+  backup="${file}.bak.$(date +%Y%m%d%H%M%S)"
+  cp -a "$file" "$backup"
+  CONFIG_BACKUPS+=("$file:$backup")
+  log "Utworzono kopię zapasową $file jako $backup."
+}
+
+rewrite_port_in_file() {
+  local file="$1" new_port="$2"
+  local tmp changed=0
+
+  [ -r "$file" ] || return 1
+  tmp="$(mktemp)"
+
+  awk -v new_port="$new_port" '
+    BEGIN { in_section = 0; changed = 0 }
+    /^[[:space:]]*\[[^]]+\][[:space:]]*$/ {
+      section = tolower($0)
+      gsub(/^[[:space:]]*\[[[:space:]]*/, "", section)
+      gsub(/[[:space:]]*\][[:space:]]*$/, "", section)
+      in_section = (section == "mysqld" || section == "mariadb" || section == "server")
+      print
+      next
+    }
+    in_section && /^[[:space:]]*port[[:space:]]*=/ {
+      print "port=" new_port
+      changed = 1
+      next
+    }
+    { print }
+    END { if (changed) exit 0; else exit 1 }
+  ' "$file" > "$tmp"
+  local awk_status=$?
+
+  if [ "$awk_status" -eq 0 ]; then
+    cp "$tmp" "$file"
+    changed=1
+  fi
+  rm -f "$tmp"
+  [ "$changed" -eq 1 ]
+}
+
+find_and_rewrite_native_port_configs() {
+  local any_changed=0
+  local f
+
+  for f in "$NATIVE_MY_CNF" "$NATIVE_MY_CNF_D"/*.cnf; do
+    [ -f "$f" ] || continue
+    if grep -Eq '^[[:space:]]*port[[:space:]]*=[[:space:]]*3306[[:space:]]*$' "$f"; then
+      backup_config_file "$f"
+      if rewrite_port_in_file "$f" "$NEW_NATIVE_PORT"; then
+        any_changed=1
+        log "Zaktualizowano port w $f."
+      fi
+    fi
+  done
+
+  if [ "$any_changed" -eq 0 ]; then
+    backup_config_file "$NATIVE_MY_CNF"
+    if grep -Eq '^[[:space:]]*\[mysqld\][[:space:]]*$' "$NATIVE_MY_CNF"; then
+      awk -v new_port="$NEW_NATIVE_PORT" '
+        { print }
+        /^[[:space:]]*\[mysqld\][[:space:]]*$/ && !done { print "port=" new_port; done=1 }
+      ' "$NATIVE_MY_CNF" > "${NATIVE_MY_CNF}.tmp" && mv "${NATIVE_MY_CNF}.tmp" "$NATIVE_MY_CNF"
+    else
+      printf '\n[mysqld]\nport=%s\n' "$NEW_NATIVE_PORT" >> "$NATIVE_MY_CNF"
+    fi
+    log "Brak istniejącej dyrektywy port= w sekcji serwera - dodano port=$NEW_NATIVE_PORT do $NATIVE_MY_CNF."
+  fi
+}
+
+update_native_mysql_conf_port() {
+  local target_port="$1"
+  local tmp
+  tmp="$(mktemp)"
+  awk -v new_port="$target_port" '
+    BEGIN { done = 0 }
+    /^[[:space:]]*port[[:space:]]*=/ { print "port=" new_port; done=1; next }
+    { print }
+    END { if (!done) print "port=" new_port }
+  ' "$NATIVE_MYSQL_CONF" > "$tmp"
+  cp "$tmp" "$NATIVE_MYSQL_CONF"
+  rm -f "$tmp"
+}
+
+apply_config_mutations() {
+  backup_config_file "$NATIVE_MYSQL_CONF"
+  find_and_rewrite_native_port_configs
+  update_native_mysql_conf_port "$NEW_NATIVE_PORT"
+  log "Zaktualizowano $NATIVE_MYSQL_CONF na port $NEW_NATIVE_PORT."
+}
+
+rollback_config_changes() {
+  local pair file backup
+  for pair in "${CONFIG_BACKUPS[@]}"; do
+    file="${pair%%:*}"
+    backup="${pair#*:}"
+    if [ -r "$backup" ]; then
+      cp -a "$backup" "$file"
+      log "Przywrócono $file z kopii zapasowej $backup."
+    fi
+  done
+}
+
+NATIVE_SERVICE_NAME=""
+DID_RESTART_NATIVE=0
+DID_RESTART_DA=0
+# Guards rollback_service_state so it only acts while wired via the EXIT trap
+# below. NOTE: this is intentionally an EXIT trap, not an ERR trap - see the
+# comment above the trap installation in main() for why.
+ROLLBACK_ARMED=0
+
+detect_native_service_name() {
+  NATIVE_SERVICE_NAME="$(mysql_service_name)"
+  log "Wykryta usługa natywnej MariaDB: $NATIVE_SERVICE_NAME."
+}
+
+restart_native_service() {
+  systemctl restart "$NATIVE_SERVICE_NAME" || die "Nie udało się zrestartować usługi $NATIVE_SERVICE_NAME."
+  DID_RESTART_NATIVE=1
+}
+
+verify_native_listening_new_port() {
+  local i
+  for i in $(seq 1 30); do
+    if port_is_listening "$NEW_NATIVE_PORT" && ! port_is_listening 3306; then
+      log "Natywna instancja nasłuchuje na porcie $NEW_NATIVE_PORT, port 3306 wolny."
+      return 0
+    fi
+    sleep 1
+  done
+  die "Natywna instancja nie nasłuchuje na porcie $NEW_NATIVE_PORT po restarcie (lub port 3306 wciąż zajęty)."
+}
+
+restart_directadmin_service() {
+  systemctl restart directadmin || die "Nie udało się zrestartować usługi directadmin."
+  DID_RESTART_DA=1
+}
+
+verify_da_connectivity_new_port() {
+  local bin
+  bin="$(mysql_detect_binary mysql)" || die "Nie znaleziono klienta mysql/mariadb do weryfikacji łączności DA."
+  MYSQL_PWD="$NATIVE_CURRENT_PASS" "$bin" \
+    --user="$NATIVE_CURRENT_USER" \
+    --protocol=TCP --host=127.0.0.1 --port="$NEW_NATIVE_PORT" \
+    -e "SELECT 1" >/dev/null 2>>"$LOG_FILE" \
+    || die "DirectAdmin nie może połączyć się z natywną instancją na nowym porcie $NEW_NATIVE_PORT."
+  log "Potwierdzono łączność DirectAdmina z natywną instancją na porcie $NEW_NATIVE_PORT."
+}
+
+rollback_service_state() {
+  [ "$ROLLBACK_ARMED" -eq 1 ] || return 0
+  rollback_config_changes
+  restore_custombuild_mysql_management
+  if [ -n "$NATIVE_SERVICE_NAME" ]; then
+    systemctl restart "$NATIVE_SERVICE_NAME" \
+      || log "OSTRZEŻENIE: nie udało się zrestartować $NATIVE_SERVICE_NAME podczas wycofywania zmian."
+  fi
+  if [ "$DID_RESTART_DA" -eq 1 ]; then
+    systemctl restart directadmin \
+      || log "OSTRZEŻENIE: nie udało się zrestartować directadmin podczas wycofywania zmian."
+  fi
+  log "Wycofano zmiany przejęcia portu natywnej instancji MariaDB."
+}
+
+main() {
+  require_root
+  check_os_guard
+  read_native_mysql_conf
+  read_current_mysql_inst
+
+  if already_migrated; then
+    log "Natywna instancja już działa na porcie $NATIVE_CURRENT_PORT (nie 3306) - pomijam przejęcie."
+    exit 0
+  fi
+
+  check_native_reachable
+  preflight_new_port_free
+  detect_native_service_name
+
+  # NOTE: deliberately an EXIT trap, not an ERR trap as originally planned.
+  # die() (used by every failure path below) calls `exit` directly, and bash's
+  # ERR trap does not fire for a function that terminates via an explicit
+  # `exit` call - it only fires when a command's non-zero status propagates
+  # through normal control flow. An EXIT trap fires on *any* shell exit
+  # (explicit exit, errexit-triggered exit, or falling off the end of the
+  # script), which is what "any failure from this point on triggers
+  # rollback" actually requires here. ROLLBACK_ARMED guards it so it is a
+  # no-op before this point and after a successful run.
+  ROLLBACK_ARMED=1
+  trap 'rollback_service_state' EXIT
+
+  disable_custombuild_mysql_management
+  apply_config_mutations
+  restart_native_service
+  verify_native_listening_new_port
+  restart_directadmin_service
+  verify_da_connectivity_new_port
+
+  ROLLBACK_ARMED=0
+  trap - EXIT
+  log "Przejęcie portu natywnej instancji MariaDB zakończone powodzeniem: $NATIVE_CURRENT_PORT -> $NEW_NATIVE_PORT."
+}
+
+[ -r "$COMMON_FILE" ] || die "missing helper: $COMMON_FILE"
+# shellcheck source=./mysql_common.sh
+source "$COMMON_FILE"
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  main "$@"
+fi

tests/install_db_cli_test.sh

@@ -41,10 +41,20 @@ set -e
 [ "$NO_ARGS_STATUS" -eq 2 ] || fail "install_db.sh without arguments should exit with status 2, got $NO_ARGS_STATUS"
 printf '%s\n' "$NO_ARGS_OUTPUT" | grep -Fq 'Użycie:' \
   || fail "install_db.sh without arguments does not print usage"
-printf '%s\n' "$NO_ARGS_OUTPUT" | grep -Fq '<MARIADB_VERSION> <PORT>' \
+printf '%s\n' "$NO_ARGS_OUTPUT" | grep -Fq '<MARIADB_VERSION> [PORT]' \
-  || fail "install_db.sh usage does not show required version and port"
+  || fail "install_db.sh usage does not show optional port"
 if printf '%s\n' "$NO_ARGS_OUTPUT" | grep -Fq 'Ten skrypt musi zostać uruchomiony jako root'; then
   fail "install_db.sh without arguments reaches root check instead of usage"
 fi
 
+set +e
+ONE_ARG_OUTPUT="$("$SCRIPT" 10.11 2>&1)"
+ONE_ARG_STATUS=$?
+set -e
+
+[ "$ONE_ARG_STATUS" -eq 1 ] \
+  || fail "install_db.sh with only a version argument should reach the root check (status 1), got $ONE_ARG_STATUS: $ONE_ARG_OUTPUT"
+printf '%s\n' "$ONE_ARG_OUTPUT" | grep -Fq 'Ten skrypt musi zostać uruchomiony jako root' \
+  || fail "install_db.sh with only a version argument should default PORT to 3306 and reach the root check, got: $ONE_ARG_OUTPUT"
+
 echo "install_db_cli_test: OK"

tests/install_db_native_takeover_wiring_test.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+set -euo pipefail
+
+PLUGIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+REAL_SCRIPT="$PLUGIN_DIR/scripts/install_db.sh"
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+# Extract the exact, real maybe_takeover_native_port() function body from the
+# real script (rather than reimplementing it), so this test exercises the
+# actual production logic without triggering the script's own main() (which
+# needs a full install environment).
+FUNCS_FILE="$TMP_DIR/funcs.sh"
+{
+  echo '#!/bin/bash'
+  echo 'log() { echo "[INFO] $*"; }'
+  echo 'die() { echo "[BŁĄD] $*" >&2; exit 1; }'
+  awk '/^maybe_takeover_native_port\(\)/,/^\}/' "$REAL_SCRIPT"
+} > "$FUNCS_FILE"
+
+grep -q '^maybe_takeover_native_port()' "$FUNCS_FILE" \
+  || fail "could not extract maybe_takeover_native_port() from $REAL_SCRIPT"
+
+# shellcheck source=/dev/null
+source "$FUNCS_FILE"
+
+mkdir -p "$TMP_DIR/setup"
+CALL_LOG="$TMP_DIR/calls.log"
+cat > "$TMP_DIR/setup/native_mariadb_port_takeover.sh" <<EOF
+#!/bin/bash
+echo "CALLED" >> "$CALL_LOG"
+exit 0
+EOF
+chmod 755 "$TMP_DIR/setup/native_mariadb_port_takeover.sh"
+
+NATIVE_TAKEOVER_SCRIPT="$TMP_DIR/setup/native_mariadb_port_takeover.sh"
+
+# --- Scenario 1: PORT=3306 must call the takeover script ---
+PORT="3306"
+: > "$CALL_LOG"
+maybe_takeover_native_port
+grep -Fxq "CALLED" "$CALL_LOG" || fail "expected takeover script to be called when PORT=3306"
+
+# --- Scenario 2: PORT!=3306 must NOT call the takeover script ---
+PORT="33033"
+: > "$CALL_LOG"
+maybe_takeover_native_port
+[ ! -s "$CALL_LOG" ] || fail "expected takeover script NOT to be called when PORT=33033"
+
+# --- Scenario 3: takeover script failure must abort (non-zero exit) ---
+cat > "$TMP_DIR/setup/native_mariadb_port_takeover.sh" <<EOF
+#!/bin/bash
+echo "CALLED-FAIL" >> "$CALL_LOG"
+exit 1
+EOF
+chmod 755 "$TMP_DIR/setup/native_mariadb_port_takeover.sh"
+
+PORT="3306"
+set +e
+FAIL_OUTPUT="$(maybe_takeover_native_port 2>&1)"
+FAIL_STATUS=$?
+set -e
+[ "$FAIL_STATUS" -ne 0 ] || fail "maybe_takeover_native_port should fail when the takeover script fails"
+printf '%s\n' "$FAIL_OUTPUT" | grep -Fq "Przejęcie portu" \
+  || fail "expected a clear error message on takeover failure, got: $FAIL_OUTPUT"
+
+echo "install_db_native_takeover_wiring_test: OK"

tests/native_mariadb_port_takeover_detect_test.sh

@@ -0,0 +1,115 @@
+#!/bin/bash
+set -euo pipefail
+
+PLUGIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+SCRIPT="$PLUGIN_DIR/scripts/setup/native_mariadb_port_takeover.sh"
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+# Source only the detection functions, without triggering main() (main() is
+# added in Task 4, guarded behind a BASH_SOURCE check).
+NATIVE_TAKEOVER_LOG="$TMP_DIR/takeover.log" \
+  source "$SCRIPT"
+
+# --- check_os_guard: AlmaLinux 9 must pass ---
+cat > "$TMP_DIR/os-release-alma9" <<'EOF'
+ID="almalinux"
+VERSION_ID="9.4"
+PRETTY_NAME="AlmaLinux 9.4"
+EOF
+OS_RELEASE_FILE="$TMP_DIR/os-release-alma9" check_os_guard \
+  || fail "AlmaLinux 9 should pass the OS guard"
+
+# --- check_os_guard: AlmaLinux 8 must pass ---
+cat > "$TMP_DIR/os-release-alma8" <<'EOF'
+ID="almalinux"
+VERSION_ID="8.10"
+EOF
+OS_RELEASE_FILE="$TMP_DIR/os-release-alma8" check_os_guard \
+  || fail "AlmaLinux 8 should pass the OS guard"
+
+# --- check_os_guard: CloudLinux must be refused ---
+cat > "$TMP_DIR/os-release-cloudlinux" <<'EOF'
+ID="cloudlinux"
+VERSION_ID="8.9"
+ID_LIKE="rhel fedora centos"
+EOF
+if ( OS_RELEASE_FILE="$TMP_DIR/os-release-cloudlinux" check_os_guard 2>/dev/null ); then
+  fail "CloudLinux must be refused by the OS guard"
+fi
+
+# --- check_os_guard: AlmaLinux 7 (out of supported range) must be refused ---
+cat > "$TMP_DIR/os-release-alma7" <<'EOF'
+ID="almalinux"
+VERSION_ID="7.9"
+EOF
+if ( OS_RELEASE_FILE="$TMP_DIR/os-release-alma7" check_os_guard 2>/dev/null ); then
+  fail "AlmaLinux 7 must be refused by the OS guard (only 8/9 supported)"
+fi
+
+# --- read_native_mysql_conf + already_migrated ---
+cat > "$TMP_DIR/mysql.conf.3306" <<'EOF'
+user=da_admin
+passwd=secret
+port=3306
+socket=/var/lib/mysql/mysql.sock
+host=
+EOF
+NATIVE_MYSQL_CONF="$TMP_DIR/mysql.conf.3306" read_native_mysql_conf \
+  || fail "read_native_mysql_conf should succeed on a valid mysql.conf"
+[ "$NATIVE_CURRENT_USER" = "da_admin" ] || fail "expected user da_admin, got: $NATIVE_CURRENT_USER"
+[ "$NATIVE_CURRENT_PORT" = "3306" ] || fail "expected port 3306, got: $NATIVE_CURRENT_PORT"
+already_migrated && fail "already_migrated should be false when native port is still 3306"
+
+cat > "$TMP_DIR/mysql.conf.3307" <<'EOF'
+user=da_admin
+passwd=secret
+port=3307
+socket=/var/lib/mysql/mysql.sock
+host=
+EOF
+NATIVE_MYSQL_CONF="$TMP_DIR/mysql.conf.3307" read_native_mysql_conf \
+  || fail "read_native_mysql_conf should succeed on an already-migrated mysql.conf"
+already_migrated || fail "already_migrated should be true when native port is 3307"
+
+# --- read_current_mysql_inst ---
+cat > "$TMP_DIR/options.conf" <<'EOF'
+mysql_inst=mariadb
+mariadb=10.6
+EOF
+CUSTOMBUILD_OPTIONS_CONF="$TMP_DIR/options.conf" read_current_mysql_inst \
+  || fail "read_current_mysql_inst should succeed"
+[ "$NATIVE_CURRENT_MYSQL_INST" = "mariadb" ] || fail "expected mysql_inst=mariadb, got: $NATIVE_CURRENT_MYSQL_INST"
+
+# --- preflight_new_port_free using a faked `ss` on PATH ---
+mkdir -p "$TMP_DIR/bin"
+cat > "$TMP_DIR/bin/ss" <<'STUB'
+#!/bin/bash
+# Pretends port 3307 is free and port 9999 is occupied.
+for arg in "$@"; do
+  case "$arg" in
+    *:3307*) exit 0 ;;
+    *:9999*)
+      echo "header line"
+      echo "occupied line"
+      exit 0
+      ;;
+  esac
+done
+exit 0
+STUB
+chmod 755 "$TMP_DIR/bin/ss"
+
+PATH="$TMP_DIR/bin:$PATH" NEW_NATIVE_PORT="3307" preflight_new_port_free \
+  || fail "preflight_new_port_free should pass when the target port is free"
+
+if ( PATH="$TMP_DIR/bin:$PATH" NEW_NATIVE_PORT="9999" preflight_new_port_free 2>/dev/null ); then
+  fail "preflight_new_port_free should refuse when the target port is already occupied"
+fi
+
+echo "native_mariadb_port_takeover_detect_test: OK"

tests/native_mariadb_port_takeover_e2e_test.sh

@@ -0,0 +1,213 @@
+#!/bin/bash
+set -euo pipefail
+
+PLUGIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+SCRIPT="$PLUGIN_DIR/scripts/setup/native_mariadb_port_takeover.sh"
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+setup_fixture() {
+  local dir="$1"
+  mkdir -p "$dir/bin" "$dir/my.cnf.d"
+
+  cat > "$dir/my.cnf" <<'EOF'
+[client]
+port=3306
+
+[mysqld]
+datadir=/var/lib/mysql
+port=3306
+socket=/var/lib/mysql/mysql.sock
+EOF
+
+  cat > "$dir/mysql.conf" <<'EOF'
+user=da_admin
+passwd=secret
+port=3306
+socket=/var/lib/mysql/mysql.sock
+host=
+EOF
+
+  cat > "$dir/options.conf" <<'EOF'
+mysql_inst=mariadb
+mariadb=10.6
+EOF
+
+  cat > "$dir/os-release" <<'EOF'
+ID="almalinux"
+VERSION_ID="9.4"
+EOF
+}
+
+# run_takeover DIR
+# Runs the script under test against the fixture already prepared at DIR
+# (by a prior call to setup_fixture, possibly customized further by the
+# scenario since) - writes stdout+stderr to "$DIR/run.out". Does NOT touch
+# the fixture itself, so scenario-specific customizations made after
+# setup_fixture (e.g. editing mysql.conf, swapping os-release) are preserved.
+run_takeover() {
+  local dir="$1"
+
+  env \
+    NATIVE_TAKEOVER_LOG="$dir/takeover.log" \
+    NATIVE_MY_CNF="$dir/my.cnf" \
+    NATIVE_MY_CNF_D="$dir/my.cnf.d" \
+    NATIVE_MYSQL_CONF="$dir/mysql.conf" \
+    CUSTOMBUILD_OPTIONS_CONF="$dir/options.conf" \
+    OS_RELEASE_FILE="$dir/os-release" \
+    NEW_NATIVE_PORT="3307" \
+    DA_CLI_BIN="$dir/bin/da" \
+    PATH="$dir/bin:$PATH" \
+    bash "$SCRIPT" > "$dir/run.out" 2>&1
+}
+
+# --- Fake command stubs shared by scenarios; each scenario builds its own copies ---
+write_common_stubs() {
+  local dir="$1"
+  local mode="${2:-happy}"
+
+  cat > "$dir/bin/id" <<'EOF'
+#!/bin/bash
+if [ "$1" = "-u" ]; then
+  echo 0
+  exit 0
+fi
+exit 1
+EOF
+  chmod 755 "$dir/bin/id"
+
+  cat > "$dir/bin/da" <<EOF
+#!/bin/bash
+echo "\$*" >> "$dir/da_calls.log"
+exit 0
+EOF
+  chmod 755 "$dir/bin/da"
+
+  cat > "$dir/bin/mysql" <<EOF
+#!/bin/bash
+CURRENT_PORT_FILE="$dir/current_port"
+requested_port=""
+for arg in "\$@"; do
+  case "\$arg" in
+    --port=*) requested_port="\${arg#--port=}" ;;
+  esac
+done
+if [ "\$requested_port" = "\$(cat "\$CURRENT_PORT_FILE" 2>/dev/null || echo 3306)" ]; then
+  exit 0
+fi
+exit 1
+EOF
+  chmod 755 "$dir/bin/mysql"
+  echo "3306" > "$dir/current_port"
+
+  cat > "$dir/bin/systemctl" <<EOF
+#!/bin/bash
+# mysql_service_name() (mysql_common.sh) probes "mysqld", then "mariadb", then
+# "mysql" via 'systemctl list-unit-files <name>.service' and picks the first
+# that succeeds - only mariadb.service "exists" here, matching a real
+# AlmaLinux+MariaDB box where mysqld.service does not exist.
+if [ "\$1" = "list-unit-files" ]; then
+  case "\$2" in
+    mariadb.service) exit 0 ;;
+    *) exit 1 ;;
+  esac
+fi
+
+echo "systemctl \$*" >> "$dir/systemctl_calls.log"
+if [ "\$1" = "restart" ] && [ "\$2" = "mariadb" ] && [ "$mode" = "restart-fail" ]; then
+  exit 1
+fi
+if [ "\$1" = "restart" ] && [ "\$2" = "mariadb" ]; then
+  echo "3307" > "$dir/current_port"
+fi
+if [ "\$1" = "restart" ] && [ "\$2" = "directadmin" ] && [ "$mode" = "da-restart-fail" ]; then
+  exit 1
+fi
+exit 0
+EOF
+  chmod 755 "$dir/bin/systemctl"
+
+  cat > "$dir/bin/ss" <<EOF
+#!/bin/bash
+current="\$(cat "$dir/current_port" 2>/dev/null || echo 3306)"
+for arg in "\$@"; do
+  case "\$arg" in
+    *":\$current"*) echo header; echo occupied; exit 0 ;;
+  esac
+done
+exit 0
+EOF
+  chmod 755 "$dir/bin/ss"
+}
+
+# --- Scenario 1: happy path ---
+DIR="$TMP_DIR/happy"
+setup_fixture "$DIR"
+write_common_stubs "$DIR" happy
+run_takeover "$DIR"
+STATUS=$?
+[ "$STATUS" -eq 0 ] || fail "happy path should exit 0, got $STATUS: $(cat "$DIR/run.out")"
+grep -Fxq "port=3307" "$DIR/mysql.conf" || fail "happy path should leave mysql.conf on port 3307"
+grep -Fq "build set mysql_inst no" "$DIR/da_calls.log" || fail "happy path should call da build set mysql_inst no"
+grep -Fq "restart mariadb" "$DIR/systemctl_calls.log" || fail "happy path should restart mariadb"
+grep -Fq "restart directadmin" "$DIR/systemctl_calls.log" || fail "happy path should restart directadmin"
+
+# --- Scenario 2: already migrated (idempotent no-op) ---
+DIR="$TMP_DIR/already"
+setup_fixture "$DIR"
+write_common_stubs "$DIR" happy
+sed -i.orig 's/^port=3306$/port=3307/' "$DIR/mysql.conf"
+run_takeover "$DIR"
+STATUS=$?
+[ "$STATUS" -eq 0 ] || fail "already-migrated case should exit 0, got $STATUS"
+grep -Fq "build set" "$DIR/da_calls.log" 2>/dev/null && fail "already-migrated case should not touch CustomBuild settings"
+
+# --- Scenario 3: OS guard rejection ---
+DIR="$TMP_DIR/badose"
+setup_fixture "$DIR"
+write_common_stubs "$DIR" happy
+cat > "$DIR/os-release" <<'EOF'
+ID="cloudlinux"
+VERSION_ID="8.9"
+EOF
+set +e
+run_takeover "$DIR"
+STATUS=$?
+set -e
+[ "$STATUS" -ne 0 ] || fail "CloudLinux should be refused, not exit 0"
+grep -Fq "build set" "$DIR/da_calls.log" 2>/dev/null && fail "OS-guard rejection must not touch CustomBuild settings"
+
+# --- Scenario 4: rollback when native restart fails ---
+DIR="$TMP_DIR/restartfail"
+setup_fixture "$DIR"
+write_common_stubs "$DIR" restart-fail
+set +e
+run_takeover "$DIR"
+STATUS=$?
+set -e
+[ "$STATUS" -ne 0 ] || fail "a failed native restart should not exit 0"
+grep -Fxq "port=3306" "$DIR/mysql.conf" \
+  || fail "mysql.conf should be rolled back to port 3306 after a failed native restart"
+grep -Fq "build set mysql_inst mariadb" "$DIR/da_calls.log" \
+  || fail "mysql_inst should be restored to mariadb after a failed native restart"
+
+# --- Scenario 5: rollback when DirectAdmin restart fails ---
+DIR="$TMP_DIR/darestartfail"
+setup_fixture "$DIR"
+write_common_stubs "$DIR" da-restart-fail
+set +e
+run_takeover "$DIR"
+STATUS=$?
+set -e
+[ "$STATUS" -ne 0 ] || fail "a failed directadmin restart should not exit 0"
+grep -Fxq "port=3306" "$DIR/mysql.conf" \
+  || fail "mysql.conf should be rolled back to port 3306 after a failed directadmin restart"
+grep -Fq "build set mysql_inst mariadb" "$DIR/da_calls.log" \
+  || fail "mysql_inst should be restored to mariadb after a failed directadmin restart"
+
+echo "native_mariadb_port_takeover_e2e_test: OK"

tests/native_mariadb_port_takeover_mutation_test.sh

@@ -0,0 +1,100 @@
+#!/bin/bash
+set -euo pipefail
+
+PLUGIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+SCRIPT="$PLUGIN_DIR/scripts/setup/native_mariadb_port_takeover.sh"
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+mkdir -p "$TMP_DIR/bin" "$TMP_DIR/my.cnf.d"
+CALL_LOG="$TMP_DIR/calls.log"
+
+cat > "$TMP_DIR/bin/da" <<EOF
+#!/bin/bash
+echo "\$*" >> "$CALL_LOG"
+exit 0
+EOF
+chmod 755 "$TMP_DIR/bin/da"
+
+cat > "$TMP_DIR/my.cnf" <<'EOF'
+[client]
+port=3306
+
+[mysqld]
+datadir=/var/lib/mysql
+port=3306
+socket=/var/lib/mysql/mysql.sock
+EOF
+
+cat > "$TMP_DIR/mysql.conf" <<'EOF'
+user=da_admin
+passwd=secret
+port=3306
+socket=/var/lib/mysql/mysql.sock
+host=
+EOF
+
+NATIVE_TAKEOVER_LOG="$TMP_DIR/takeover.log" \
+  source "$SCRIPT"
+
+NATIVE_MY_CNF="$TMP_DIR/my.cnf"
+NATIVE_MY_CNF_D="$TMP_DIR/my.cnf.d"
+NATIVE_MYSQL_CONF="$TMP_DIR/mysql.conf"
+NEW_NATIVE_PORT="3307"
+DA_CLI_BIN="$TMP_DIR/bin/da"
+NATIVE_CURRENT_MYSQL_INST="mariadb"
+
+# --- disable_custombuild_mysql_management ---
+: > "$CALL_LOG"
+disable_custombuild_mysql_management
+grep -Fxq "build set mysql_inst no" "$CALL_LOG" \
+  || fail "expected 'da build set mysql_inst no' to be called, got: $(cat "$CALL_LOG")"
+[ "$DID_SET_MYSQL_INST_NO" -eq 1 ] || fail "expected DID_SET_MYSQL_INST_NO to be set"
+
+# --- idempotency: already "no" must skip calling da ---
+: > "$CALL_LOG"
+DID_SET_MYSQL_INST_NO=0
+NATIVE_CURRENT_MYSQL_INST="no"
+disable_custombuild_mysql_management
+[ ! -s "$CALL_LOG" ] || fail "expected no 'da' call when mysql_inst is already 'no'"
+[ "$DID_SET_MYSQL_INST_NO" -eq 0 ] || fail "DID_SET_MYSQL_INST_NO should stay 0 when already 'no'"
+NATIVE_CURRENT_MYSQL_INST="mariadb"
+
+# --- apply_config_mutations ---
+CONFIG_BACKUPS=()
+apply_config_mutations
+
+grep -Fxq "port=3307" "$TMP_DIR/mysql.conf" \
+  || fail "expected mysql.conf port to be rewritten to 3307, got: $(cat "$TMP_DIR/mysql.conf")"
+grep -Fxq "passwd=secret" "$TMP_DIR/mysql.conf" \
+  || fail "expected mysql.conf passwd to be preserved untouched"
+
+grep -A2 '^\[mysqld\]' "$TMP_DIR/my.cnf" | grep -Fxq "port=3307" \
+  || fail "expected [mysqld] port in my.cnf to be rewritten to 3307"
+grep -A1 '^\[client\]' "$TMP_DIR/my.cnf" | grep -Fxq "port=3306" \
+  || fail "expected [client] port in my.cnf to be left at 3306 (only server sections rewritten)"
+
+[ "${#CONFIG_BACKUPS[@]}" -ge 2 ] \
+  || fail "expected at least 2 backup entries (my.cnf + mysql.conf), got ${#CONFIG_BACKUPS[@]}"
+
+# --- rollback_config_changes ---
+rollback_config_changes
+
+grep -A2 '^\[mysqld\]' "$TMP_DIR/my.cnf" | grep -Fxq "port=3306" \
+  || fail "expected [mysqld] port in my.cnf to be restored to 3306 after rollback"
+grep -Fxq "port=3306" "$TMP_DIR/mysql.conf" \
+  || fail "expected mysql.conf port to be restored to 3306 after rollback"
+
+# --- restore_custombuild_mysql_management ---
+: > "$CALL_LOG"
+DID_SET_MYSQL_INST_NO=1
+restore_custombuild_mysql_management
+grep -Fxq "build set mysql_inst mariadb" "$CALL_LOG" \
+  || fail "expected 'da build set mysql_inst mariadb' to be called on rollback, got: $(cat "$CALL_LOG")"
+
+echo "native_mariadb_port_takeover_mutation_test: OK"

tests/package_archive_test.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 PLUGIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-ARCHIVE="${1:-$(cd "$PLUGIN_DIR/.." && pwd)/archives/1.2.18/alt-mysql.tar.gz}"
+ARCHIVE="${1:-$(cd "$PLUGIN_DIR/.." && pwd)/archives/1.2.19/alt-mysql.tar.gz}"
 
 fail() {
   echo "FAIL: $*" >&2
@@ -40,7 +40,7 @@ fi
 CONF="$(tar -xOzf "$ARCHIVE" ./plugin.conf 2>/dev/null || tar -xOzf "$ARCHIVE" plugin.conf)"
 printf '%s\n' "$CONF" | grep -Fxq "name=alt-mysql" || fail "archive plugin name is not alt-mysql"
 printf '%s\n' "$CONF" | grep -Fxq "id=alt-mysql" || fail "archive plugin id is not alt-mysql"
-printf '%s\n' "$CONF" | grep -Fxq "version=1.2.18" || fail "archive plugin version is not 1.2.18"
+printf '%s\n' "$CONF" | grep -Fxq "version=1.2.19" || fail "archive plugin version is not 1.2.19"
 
 SETTINGS="$(tar -xOzf "$ARCHIVE" ./plugin-settings.conf 2>/dev/null || tar -xOzf "$ARCHIVE" plugin-settings.conf)"
 printf '%s\n' "$SETTINGS" | grep -Fxq "PHPMYADMIN_INSTALL_DIR=/var/www/html/alt-mysql-phpmyadmin" \
@@ -69,8 +69,8 @@ printf '%s\n' "$DB_INSTALLER" | grep -Fq 'SKIP_PLUGIN_INSTALL_REFRESH' \
   || fail "archive install_db.sh does not expose a test/maintenance escape hatch for plugin refresh"
 printf '%s\n' "$DB_INSTALLER" | grep -Fq '[[ $# -eq 0 ]]' \
   || fail "archive install_db.sh does not show usage when called without arguments"
-printf '%s\n' "$DB_INSTALLER" | grep -Fq '<MARIADB_VERSION> <PORT>' \
+printf '%s\n' "$DB_INSTALLER" | grep -Fq '<MARIADB_VERSION> [PORT]' \
-  || fail "archive install_db.sh usage does not require version and port"
+  || fail "archive install_db.sh usage does not show optional port"
 
 INSTALLER="$(tar -xOzf "$ARCHIVE" ./scripts/setup/phpmyadmin_install.sh 2>/dev/null || tar -xOzf "$ARCHIVE" scripts/setup/phpmyadmin_install.sh)"
 printf '%s\n' "$INSTALLER" | grep -Fq "\$cfg['Servers'][\$i]['SignonURL'] = da_mysql_phpmyadmin_signon_url(\$runtimeConfig);" \

tests/plugin_identity_test.sh

@@ -14,7 +14,7 @@ case "$(basename "$PLUGIN_DIR")" in
 esac
 grep -Fxq "name=alt-mysql" "$PLUGIN_DIR/plugin.conf" || fail "plugin.conf name is not alt-mysql"
 grep -Fxq "id=alt-mysql" "$PLUGIN_DIR/plugin.conf" || fail "plugin.conf id is not alt-mysql"
-grep -Fxq "version=1.2.18" "$PLUGIN_DIR/plugin.conf" || fail "plugin.conf version is not 1.2.18"
+grep -Fxq "version=1.2.19" "$PLUGIN_DIR/plugin.conf" || fail "plugin.conf version is not 1.2.19"
 grep -Fq "return '/CMD_PLUGINS/alt-mysql';" "$PLUGIN_DIR/exec/lib/AppContext.php" \
   || fail "AppContext base URL is not alt-mysql"
 grep -Fq "\$pluginId = 'alt-mysql';" "$PLUGIN_DIR/exec/lib/DirectAdminUser.php" \