Calls thunk, which is expected to call custodian-shutdown-all or kill-thread. Sensitive operations that may be performed by the to-be-killed threads can be wrapped in a call to kill-protect to avoid killing the threads at an inopportune point.
The console wraps the printing and read routines for is input and output ports with kill-protect. This means that the ports can be safely provided to threads that are subject to breaks and kills, so long as the kills are always executed via a thunk passed to kill-allow-protected.