Verify shutdown invoked only once