Documentation

The shared shutdown-drain flag the front door observes during a graceful rollover, as a small handle (a reader plus a one-way raise) rather than a bare TVar -- so the same field can hold either a live, flip-once signal (newDrainSignal) or the inert neverDraining constant the socket-free tests assemble against, and nothing downstream can lower it back. It is raised once, on a shutdown signal, and read on every request by the readiness probe and the going-away middleware.

Allocate a live, lowered shutdown-drain signal backed by a TVar. runWarp allocates one per launch, hands it to the application builder through the ServerConfig it passes, and flips it from the signal handler, so the readiness probe and the going-away middleware read the very same signal the instant the handler raises it.

The inert drain signal: permanently lowered, raising it is a no-op. The mkServerConfig default, so an application assembled for a socket-free test (and one driven without ever entering shutdown) reports ready and adds no going-away header. A real launch overrides it with newDrainSignal in runWarp.

Raise a drain signal -- the one-way transition into draining. Idempotent.

Read whether a drain signal is raised.

The bound on the graceful drain: how many seconds the server waits for in-flight requests and in-progress artifact streams to finish after it stops accepting new connections, before the process exits regardless. A newtype so a raw seconds count is not mistaken for some other Int, and so a non-positive value cannot be passed where a positive timeout is meant (see runWarp).

The default graceful-drain bound: 30 seconds. Long enough for an in-flight metadata fetch or a moderate artifact stream to complete during a rolling deploy, short enough that a stuck request cannot pin the old instance indefinitely.