Retain accepted callers and KDF workers until completion, and run later
requests synchronously. Clear joined threads and unwind partial startup
so serialized restarts do not retain stale workers.
Cover shutdown boundaries and startup failures with gated tests.
