RE: potentially faster fail behavior, I think it might be better to handle this in the framework if we want to go that way.  TK could check to see if the `shutdown-on-error` promise is set and forego calling further `init`s or `start`s -- like we talked about on another thread -- without having to burden each service with doing shutdown work in two places.  May not be a big enough deal either way to spend more time on at this point.