Queued submissions can execute after shutdown closes storage #175

Problem

Engine shutdown pauses execution while dumping state and closing storage, but releasing the ordinary barrier lets the sequencer resume processing buffered submissions. A submission racing shutdown can therefore execute after storage closes.

Expected

Shutdown must close execution ingress and finish scheduled execution before closing storage. Work queued behind the terminal boundary must not execute, even if queueing was acknowledged.

Context

Source-level race in Engine 0.14.2 (698d037), across Engine::shutdown and the Processor sequencer. No deterministic reproduction is available.