Static SHUTDOWN_REQUESTED 

pub static SHUTDOWN_REQUESTED: AtomicBool

Graceful-shutdown request flag (O-1, orchestration). Set by the SIGTERM/SIGINT handler the dispatcher binary installs; the ventilator checks it each loop iteration and, when set, signals completion (dispatch_complete) and returns — so the manager drains the in-flight set and flushes the finalize batch before exiting, rather than the supervisor hard-killing in-flight work. ONLY a planned stop uses this; unexpected failures still fail-fast (panic → abort). Production-only — bounded test runs never install the handler, so this stays false and the dispatch path is byte-for-byte unchanged.