[KaiserIIII]

Closing the station can fail while persisting an active task's interrupted state. Previously that exception skipped SQLite cleanup and the closed flag, retaining database ownership even after the old worker stopped and allowing its late callback to mutate evidence.

Wrap the existing shutdown write in try/finally: close storage and reject late callbacks even after a failed commit, preserve the original database error when cleanup succeeds, and keep ownership until the active worker or legacy operation exits. The two-second join, other service methods, protocol requests and database schema are unchanged.

Validation: 6 new regressions use native temporary SQLite trigger/write-lock faults, actual OS ownership, late callbacks, concurrent closers and restart/no-replay controls. Final fixtures produce 5 failures/1 pass before the fix; 24 focused tests and the full 427 local suite pass afterward. Configuration validation, 23 offline self-checks and 39 source Python syntax checks pass. Broad coverage is 54.37% of lines and 43.68% of branches; no complete coverage or field-hardware certification is claimed. Existing transport tests are loopback/Fake only.

Implementation, tests, documentation and independent review are AI-assisted. No physical device, production database, network deployment or dependency change is involved.