Bug 911820 demonstrates that we currently do not shutdown all services in a shutdown-safe way. In this case, some writes may started too late and be interrupted while in progress, causing data loss. Examining some parts of the code seems to indicates that attempts to avoid such data loss results in code that may deadlock. Opening this bug to track the effort on making our services shutdown-safe: - every service that performs asynchronous operations must have the opportunity to call the services from which it depends before they become unavailable; - such calls must not cause deadlocks.