From Mark Little,

There's no good clean solution to this. They either:

(i) accept that forcing a shutdown of the AS instance leaves some things in a locked state and they have to resolve them manually.

(ii) accept that forcing a shutdown of the AS instance may cause heuristic outcomes for transactions (their transactions as well as anyone elses that may be running at the same time).

(iii) use a stand-alone TM, but if its also being shutdown you are back to the same situation.

(iv) put "shutdown hooks" in on a per transaction basis that can be used to determine whether or not to force a rollback/termination or wait for the transaction to terminate normally. Transaction managers like ATS supports this kind of operation. However, it only reduces the window of vulnerability and also increases the time to shutdown the AS instance.

Basically it's always going to be a trade-off: correctness versus data inconsistencies.