Maintenance scripts used to be scheduled as cron jobs, running only in the active data center. Now, instead, they run as systemd timers in both DCs, but they're called via the mw-cli-wrapper script. That wrapper first checks confd to see if it's running in the active DC, and exits if not, so the actual maintenance work is still only performed in the active DC.
The switchdc cookbook stops cron jobs in the origin DC before the switch, and then starts them in the destination DC afterward -- which means it no longer has any effect on the maintenance scripts using this wrapper (i.e., most of them). That's mostly fine, because mw-cli-wrapper reads from confd, which is updated as part of the switchover. But it means nothing stops those scripts from running during the switch.
We could fix this by adding another field to the mwconfig confd entity, called maintenance_disabled. mw-cli-wrapper would exit early if it was in the inactive data center or if maintenance_disabled was true, so setting that flag would effectively pause maintenance scripts in both DCs. Then the 01-stop-maintenance cookbook can set the maintenance_disabled flag, and 08-start-maintenance can clear it.