Skip to content

Bounded, resumable shutdown

One deadline, resumable shutdownHelpers may outlive the caller. Incomplete shutdown must remain visible. MONGOOSE / RUNTIME ARCHITECTURE One deadline, resumable shutdown Helpers may outlive the caller. Incomplete shutdown must remain visible. 1 Fence admission and startup Snapshot groups; wait only for the remaining deadline. 2 Stop feeds Close feed-only groups; remove feeds from mixed service groups. 3 Drain queued inputs Bound the drain; report and release remaining backlog on expiry. 4 Close processor groups Join tracked helpers; preserve non-feed dependencies while groups run. 5 Close remaining services Join service groups, stop owned services, account for capture cleanup. Deadline expires Return incomplete StopResult Keep STOPPING Report unfinished ownership Call shutdown again Rejoin existing helpers Resume unfinished phases Do not claim stuck work stopped STOPPED requires completed shutdown; it is not another name for “the caller stopped waiting”.

MongooseServer.shutdown() fences new admission and snapshots the groups. LifecycleManager advances through ordered phases using one deadline. A potentially blocking AgentRunner.close() or service stop runs on a tracked helper; the caller joins it only for the remaining time.

Feeds are stopped first, including taking feeds off mixed service groups. Remaining non-feed service dependencies are retained while any processor group is running. The queue-drain phase has its own bound capped by the overall deadline; on expiry it may drop the remaining queued events. An empty queue does not prove that an already-polled handler has finished, so closing and joining the processor groups remains essential.

If a callback is stuck, shutdown returns an incomplete StopResult and the server remains STOPPING. Calling shutdown again rejoins existing helpers and resumes unfinished phases. It does not forcibly kill callback threads or repeat a completed close. Failed service stops and unresolved physical captures remain visible; a second call is not a guarantee they can recover.

For a never-started server, shutdown closes admitted groups and answers queued adds without running their suppliers. Calls from agent/startup contexts hand the stop to a separate thread. See shutdown contracts for exact results and timeout settings.