The debounced flusher could rewrite snapshot.json after the shutdown save:
teardown changes (a native permission waiter clearing its decision on
disconnect, panes exiting during host shutdown) set persist_pending, and a
2 s tick before exit saved them. Restart then lost the pending decision
(the flaky native_permissions::shutdown_and_restart_cannot_restore_an_
answer_channel). A later SIGTERM after logind or server.shutdown did the
same through a second final save.

Ctx::save_final now writes the shutdown snapshot once, whichever trigger
comes first, under a write lock the flusher shares; the flusher checks the
stopping flag under that lock, so an in-flight flush cannot land after it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>