(PE-3194) improve shutdown-on-error error handling

Esnure that `shutdown-on-error` never throws an exception by replacing
its pre-conditions with assertions inside the body of the function,
so when they fail, they are handled by the `catch`.