> I don't think throwing an exception is a good idea here, because that could leave the shutdown process in a weird state

Agreed. 

> What do you think?

On further thought, I think it’s fine to leave the `assert`s.