See BF-6795 linked below. In summary, we create a service and register a shutdown task during sharding state initialization, at which time we can be in shutdown mode and invariant the shutdown task registration. This can happen generically for any task we register for shutdown.

Perhaps a mutex could protect the shutdownFlag, such that a service can be both created and its shutdown task registered, before allowing modification to the shutdownFlag, thus adding safety.