Protect writer stop jobs from competing healthcheck requests

lib/common.sh

@@ -444,7 +444,13 @@ stop_service() {
       STOPPED_SERVICES+=("$1")
       save_recovery
       echo "-- Stopping service: $1 (waiting for systemd)"
-      systemctl stop "$1"
+      # Conditions block activation, but a concurrent reload/start can still
+      # replace a pending stop job before conditions are evaluated. Protect the
+      # job until it finishes; this is not a persistent mask and does not alter
+      # stop timeouts or the normal recovery start after releasing our guards.
+      if ! systemctl stop "$1" --job-mode=replace-irreversibly; then
+        die "Could not stop writer $1; inspect its systemd journal (stop failure or explicit job cancellation)"
+      fi
       echo "-- Service stopped: $1"
       ;;
     inactive|failed) ;;