The settings the web layer needs to serve that the composition-root Env does not carry. Not the request-body cap: the publish route bounds its own body as a value.

Build a ServerConfig over the mount bindings on defaultPort. There is no built-in mount: the web layer serves only the ecosystems the composition root binds here.

The conventional npm proxy listen port (4873), the mkServerConfig default.

The proxy's WAI Application: the request dispatch under the cross-cutting middleware stack (serverMiddleware).

application with the OpenTelemetry server-span middleware wrapped outermost, so one server span covers the whole request. The wrapper is id when telemetry is off.

Serve the front door over one live DrainSignal, which the probe, the going-away header, and the shutdown handler share. warp drains under scDrainTimeout, and a TTY adds Ctrl-D.

Bind as runSettings does, log the bound port, then serve.

The proxy's listener name, which starts the line it logs once bound.

The start of the line a named listener logs once bound, followed by the port.

Race a server arm against a never-returning background loop, the single-process shutdown shape. race_ is the invariant: concurrently_ would wait forever, brackets un-unwound.

The control-plane health probes, answered above any mount: /livez from the injected liveness check, /readyz from the drain signal and startup gate. Any other path is a 404.

The WAI Application of a role that serves the health probes and nothing else. Every path outside /livez and /readyz is the neutral 404.

Run one route's handler behind a commit-tracking respond, catching synchronous escapes only. Pre-commit one answers the neutral fallback with no detail, post-commit it rethrows.

The shutdown-drain flag the front door observes during a graceful rollover. Nothing lowers it again. The readiness probe and the going-away middleware read it per request.

Allocate a live drain signal, lowered. runWarp allocates one per launch and raises it from the shutdown signal handler.

The inert drain signal: permanently lowered, and raising it does nothing. It is the mkServerConfig default, so a socket-free test reports ready and stamps no going-away header.

Raise a drain signal: the one-way transition into draining. Idempotent.

Read whether a drain signal is raised.

The bound on the graceful drain, in seconds. The server stops accepting connections, waits this long for in-flight requests and artifact streams, then exits regardless.

The default graceful-drain bound: 30 seconds. It covers an in-flight metadata fetch or a moderate artifact stream, and stops a stuck request pinning the old instance.

The local-development immediate-halt wiring, as injection points a test drives without a terminal. Ctrl-D exits the process at once and aborts the drain. It is inert on a non-TTY.

The real local-dev halt: armed only on a terminal and fired by end-of-input, exiting at once without a drain. Status 130 is the conventional "terminated from the terminal" code.

Run an action with the immediate-halt watcher armed only when haltOnInteractive is True. The watcher lives exactly as long as the action, so it never outlives it.

The cross-cutting stack around the proxy Application. The body cap is not a middleware: it would throw across the request perimeter, and Autohead and Gzip fight streaming.