tls: mark ho done atomically after ctx init