mark_stop_requested recorded intent for every running gateway before the first
request; an updater killed in between left a never-asked, still-serving gateway
held as 'draining' forever, and restarted it after a later user stop.
Now the intent also names where each request goes (planned-stop marker) and the
stopper; mark_stop_sent records each request once issued (marker on disk, else a
positive socket ACK), before the socket call. A live entry is owed only when it
was recorded sent or this update's own marker still names it (a user's stop
marker is not evidence); the evidence is resolved once into stop_sent so a merge
or a hand-back carries it. Force-killed pids need no record (dead = owed).
(cherry picked from commit e199442e5690614065e3013f06ad54b18584811d)
(cherry picked from commit f2af22c6e8a45a7712046107b10c17fc9ad9d690)
b00c919cf7