Split harness shutdown initiation from settlement so callbacks can request shutdown without deadlocking active work.