@spine-event-engine/server 2.0.0-snapshot.22 → 2.0.0-snapshot.24

package/dist/server/managed-server-application.js

@@ -106,115 +106,7 @@ const ManagedServerValues = Object.freeze({
             }
             throw error;
         }
-        // Node may emit an IPC EPIPE after a parent has already disappeared. The
-        // disconnect handler below handles shutdown; this listener prevents that
-        // transport detail from becoming an unhandled child-process exception.
-        const containIpcError = () => undefined;
-        process.on("error", containIpcError);
-        managedChildSubscriptionAccess.install((subscriptionId) => {
-            const notification = ManagedServerValues.send({
-                type: "subscription-installed",
-                slot: process.env[slotMarker],
-                incarnation: process.env[incarnationMarker],
-                subscriptionId,
-            });
-            // spine-log-boundary: server.managed_replica_subscription_ipc
-            void notification.catch(() => undefined);
-        });
-        let activated = false;
-        let releaseActivation;
-        const activation = new Promise((resolve) => {
-            releaseActivation = resolve;
-        });
-        let closing;
-        const close = () => {
-            if (closing !== undefined)
-                return closing;
-            const draining = ManagedServerValues.send({
-                type: "draining",
-                slot: process.env[slotMarker],
-                incarnation: process.env[incarnationMarker],
-            });
-            // spine-log-boundary: server.managed_replica_drain_ipc
-            const attempt = draining
-                .catch(() => undefined)
-                .then(() => {
-                environmentDeliveryWorkerAccess.cancelManagedChild();
-                managedChildSubscriptionAccess.clear();
-                releaseActivation();
-                return runningServerAccess.drainDelivery(server);
-            })
-                .then(() => {
-                return server.close();
-            })
-                .then(() => {
-                const closed = ManagedServerValues.send({
-                    type: "closed",
-                    slot: process.env[slotMarker],
-                    incarnation: process.env[incarnationMarker],
-                });
-                // spine-log-boundary: server.managed_replica_closed_ipc
-                return closed.catch(() => undefined);
-            }, (error) => {
-                const failed = ManagedServerValues.send({
-                    type: "close-failed",
-                    slot: process.env[slotMarker],
-                    incarnation: process.env[incarnationMarker],
-                });
-                // spine-log-boundary: server.managed_replica_close_failed_ipc
-                void failed.catch(() => undefined);
-                if (closing === attempt)
-                    closing = undefined;
-                throw error;
-            })
-                .then(() => {
-                process.off("disconnect", onDisconnect);
-                if (process.connected && typeof process.disconnect === "function")
-                    process.disconnect();
-                process.off("error", containIpcError);
-                process.off("message", onMessage);
-            });
-            closing = attempt;
-            return attempt;
-        };
-        const onMessage = (message) => {
-            if (message.type === "activate" && !activated) {
-                activated = true;
-                environmentDeliveryWorkerAccess.activateManagedChild();
-                releaseActivation();
-            }
-            else if (message.type === "close") {
-                ManagedServerValues.closeFromEvent(close);
-            }
-        };
-        const onDisconnect = () => {
-            ManagedServerValues.closeFromEvent(close);
-        };
-        process.on("message", onMessage);
-        process.once("disconnect", onDisconnect);
-        try {
-            await ManagedServerValues.send({
-                type: "synchronizing",
-                slot: process.env[slotMarker],
-                incarnation: process.env[incarnationMarker],
-                endpoint: server.baseUrl,
-            });
-        }
-        catch (error) {
-            await close();
-            throw error;
-        }
-        await activation;
-        await ManagedServerValues.send({
-            type: "ready",
-            slot: process.env[slotMarker],
-            incarnation: process.env[incarnationMarker],
-            endpoint: server.baseUrl,
-        });
-        return {
-            ready: true,
-            close,
-        };
+        return new ManagedChildLifecycle(server).start();
     },
     /**
      * Starts a coordinator for the configured complete-replica cohort.
@@ -277,6 +169,174 @@ const ManagedServerValues = Object.freeze({
         });
     },
 });
+/**
+ * Runs the private child IPC lifecycle while keeping its listener open for relay cleanup.
+ */
+class ManagedChildLifecycle {
+    #activation = ManagedServerCoordinatorValues.deferred();
+    #serverCloseRelease = ManagedServerCoordinatorValues.deferred();
+    #server;
+    #activated = false;
+    #waitForParentClose = false;
+    #closing;
+    /**
+     * Creates the lifecycle around an assembled child server.
+     *
+     * @param server The already assembled and synchronized child server.
+     */
+    constructor(server) {
+        this.#server = server;
+    }
+    /**
+     *
+     * Starts the child and waits for Coordinator activation.
+     *
+     * @returns A child handle after the private READY notification.
+     */
+    async start() {
+        process.on("error", this.#containIpcError);
+        managedChildSubscriptionAccess.install((subscriptionId) => {
+            const notification = ManagedServerValues.send({
+                type: "subscription-installed",
+                slot: process.env[slotMarker],
+                incarnation: process.env[incarnationMarker],
+                subscriptionId,
+            });
+            // spine-log-boundary: server.managed_replica_subscription_ipc
+            void notification.catch(() => undefined);
+        });
+        process.on("message", this.#onMessage);
+        process.once("disconnect", this.#onDisconnect);
+        try {
+            await this.#notify("synchronizing", this.#server.baseUrl);
+        }
+        catch (error) {
+            this.#serverCloseRelease.resolve(undefined);
+            await this.close();
+            throw error;
+        }
+        await this.#activation.promise;
+        await this.#notify("ready", this.#server.baseUrl);
+        return { ready: true, close: () => this.close() };
+    }
+    /**
+     *
+     * Closes Delivery before closing the child listener and its server.
+     *
+     * @returns The shared close attempt; a failed attempt may be retried.
+     */
+    close() {
+        this.#closing ??= this.#closeOnce().catch((error) => {
+            this.#closing = undefined;
+            throw error;
+        });
+        return this.#closing;
+    }
+    /**
+     *
+     * Performs child shutdown and observes a failed completion notification.
+     *
+     * @returns Completion after the child server closes.
+     */
+    async #closeOnce() {
+        try {
+            await this.#drainDelivery();
+            await this.#closeServerAfterRelayCleanup();
+            // spine-log-boundary: server.managed_replica_closed_ipc
+            await this.#notify("closed").catch(() => undefined);
+            this.#disconnect();
+        }
+        catch (error) {
+            // spine-log-boundary: server.managed_replica_close_failed_ipc
+            await this.#notify("close-failed").catch(() => undefined);
+            throw error;
+        }
+    }
+    /**
+     *
+     * Stops new child Delivery work and awaits admitted effects.
+     *
+     * @returns Completion when admitted work drains.
+     */
+    async #drainDelivery() {
+        environmentDeliveryWorkerAccess.cancelManagedChild();
+        managedChildSubscriptionAccess.clear();
+        this.#activation.resolve(undefined);
+        // spine-log-boundary: server.managed_replica_drain_ipc
+        void this.#notify("draining").catch(() => undefined);
+        await runningServerAccess.drainDelivery(this.#server);
+    }
+    /**
+     *
+     * Waits for parent relay cancellation before closing the child listener.
+     *
+     * @returns Completion after final server close.
+     */
+    async #closeServerAfterRelayCleanup() {
+        // spine-log-boundary: server.managed_replica_delivery_drained_ipc
+        void this.#notify("delivery-drained").catch(() => undefined);
+        if (this.#waitForParentClose)
+            await this.#serverCloseRelease.promise;
+        await this.#server.close();
+    }
+    /**
+     *
+     * Sends one child lifecycle notification on the private IPC channel.
+     *
+     * @param type The lifecycle phase to report.
+     * @param endpoint The listening endpoint for readiness messages.
+     * @returns Completion after the parent accepts the frame.
+     */
+    #notify(type, endpoint) {
+        return ManagedServerValues.send({
+            type,
+            slot: process.env[slotMarker],
+            incarnation: process.env[incarnationMarker],
+            ...(endpoint === undefined ? {} : { endpoint }),
+        });
+    }
+    /**
+     *
+     * Releases child startup and close gates for matching parent messages.
+     *
+     * @param message The private parent frame.
+     */
+    #onMessage = (message) => {
+        if (message.type === "activate" && !this.#activated) {
+            this.#activated = true;
+            environmentDeliveryWorkerAccess.activateManagedChild();
+            this.#activation.resolve(undefined);
+        }
+        else if (message.type === "close") {
+            this.#waitForParentClose = true;
+            ManagedServerValues.closeFromEvent(() => this.close());
+        }
+        else if (message.type === "finish-close") {
+            this.#serverCloseRelease.resolve(undefined);
+        }
+    };
+    /**
+     * Releases the final close phase if the parent disappears.
+     */
+    #onDisconnect = () => {
+        this.#serverCloseRelease.resolve(undefined);
+        ManagedServerValues.closeFromEvent(() => this.close());
+    };
+    /**
+     * Contains IPC EPIPE after an already disappeared parent.
+     */
+    #containIpcError = () => undefined;
+    /**
+     * Removes private listeners once the child server has closed.
+     */
+    #disconnect() {
+        process.off("disconnect", this.#onDisconnect);
+        if (process.connected && typeof process.disconnect === "function")
+            process.disconnect();
+        process.off("error", this.#containIpcError);
+        process.off("message", this.#onMessage);
+    }
+}
 /**
  *
  * Coordinates the parent-only lifecycle of managed application replicas.
@@ -288,6 +348,8 @@ export class ManagedServerCoordinator {
     #restart;
     #options;
     #dependencies;
+    #terminalChildFailure;
+    #drainStart;
     #closing = false;
     #starts = 0;
     #ready;
@@ -394,6 +456,16 @@ export class ManagedServerCoordinator {
             this.#drainStarts();
             return;
         }
+        this.#installReplica(slot, incarnation, child);
+    }
+    /**
+     * Records a spawned child and observes its private lifecycle messages.
+     *
+     * @param slot The configured replica slot.
+     * @param incarnation The current child incarnation identifier.
+     * @param child The spawned process handle.
+     */
+    #installReplica(slot, incarnation, child) {
         const replica = {
             slot: slot.slot,
             incarnation,
@@ -404,6 +476,9 @@ export class ManagedServerCoordinator {
             draining: false,
             subscriptionWaiters: new Map(),
             closeAttempt: undefined,
+            closePromise: undefined,
+            closeFailure: undefined,
+            forcedFailure: undefined,
             expectedExit: false,
             terminal: false,
         };
@@ -428,43 +503,86 @@ export class ManagedServerCoordinator {
      * @param message The untrusted child IPC notification.
      */
     #onMessage(slot, replica, message) {
+        if (this.#onCloseMessage(slot, replica, message))
+            return;
+        if (ManagedServerCoordinatorValues.subscriptionInstalledMessage(message, slot.slot, replica.incarnation)) {
+            if (slot.replica === replica)
+                this.#settleSubscriptionWaiter(replica, message.subscriptionId);
+            return;
+        }
+        if (this.#onTransitionMessage(slot, replica, message))
+            return;
+        this.#onReadyMessage(slot, replica, message);
+    }
+    /**
+     * Settles the private child shutdown notifications.
+     *
+     * @param slot The reported replica slot.
+     * @param replica The matching child incarnation.
+     * @param message The candidate notification.
+     * @returns Whether a close-phase notification was consumed.
+     */
+    #onCloseMessage(slot, replica, message) {
         const closeResult = ManagedServerCoordinatorValues.closeResultMessage(message, slot.slot, replica.incarnation);
         if (closeResult !== undefined) {
             if (slot.replica !== replica || !replica.draining || replica.closeAttempt === undefined)
-                return;
+                return true;
             if (closeResult === "closed")
                 replica.closeAttempt.outcome.resolve(undefined);
-            else
+            else {
+                replica.closeAttempt.drained.reject(new Error("Managed child Delivery drain failed."));
                 replica.closeAttempt.outcome.reject(new Error("Managed child server close failed."));
-            return;
+            }
+            return true;
         }
-        if (ManagedServerCoordinatorValues.subscriptionInstalledMessage(message, slot.slot, replica.incarnation)) {
-            if (slot.replica !== replica)
-                return;
-            this.#settleSubscriptionWaiter(replica, message.subscriptionId);
-            return;
+        if (ManagedServerCoordinatorValues.deliveryDrainedMessage(message, slot.slot, replica.incarnation)) {
+            if (replica.closeAttempt !== undefined)
+                replica.closeAttempt.drainedAcknowledged = true;
+            replica.closeAttempt?.drained.resolve(undefined);
+            return true;
         }
+        return false;
+    }
+    /**
+     * Advances a synchronizing or draining child without completing public readiness.
+     *
+     * @param slot The reported replica slot.
+     * @param replica The matching child incarnation.
+     * @param message The candidate notification.
+     * @returns Whether a transition notification was consumed.
+     */
+    #onTransitionMessage(slot, replica, message) {
         if (ManagedServerCoordinatorValues.synchronizingMessage(message, slot.slot, replica.incarnation)) {
             if (slot.replica !== replica || replica.endpoint !== undefined)
-                return;
+                return true;
             replica.endpoint = message.endpoint;
             replica.synchronizing = true;
             this.#notifyReadyMembers();
             if (this.#nodeCoordinator === undefined)
                 replica.child.send({ type: "activate" }, () => undefined);
-            return;
+            return true;
         }
         if (ManagedServerCoordinatorValues.drainingMessage(message, slot.slot, replica.incarnation)) {
             if (slot.replica !== replica)
-                return;
+                return true;
             replica.closeAttempt?.acknowledged.resolve(undefined);
             if (replica.draining)
-                return;
+                return true;
             replica.draining = true;
             replica.expectedExit = true;
             this.#notifyReadyMembers();
-            return;
+            return true;
         }
+        return false;
+    }
+    /**
+     * Publishes one fully ready child after its synchronization phase.
+     *
+     * @param slot The reported replica slot.
+     * @param replica The matching child incarnation.
+     * @param message The candidate notification.
+     */
+    #onReadyMessage(slot, replica, message) {
         if (!ManagedServerCoordinatorValues.readyMessage(message, slot.slot, replica.incarnation))
             return;
         if (slot.replica !== replica || replica.readyAt !== undefined || this.#closing)
@@ -490,6 +608,9 @@ export class ManagedServerCoordinator {
         if (slot.replica !== replica || replica.terminal)
             return;
         replica.terminal = true;
+        if (this.#closing && replica.closeFailure !== undefined)
+            this.#terminalChildFailure ??= replica.closeFailure;
+        this.#failIncompleteDrain(replica.closeAttempt);
         this.#clearSubscriptionWaiters(replica, new Error("Managed child exited before subscription installed."));
         slot.replica = undefined;
         this.#notifyReadyMembers();
@@ -499,10 +620,10 @@ export class ManagedServerCoordinator {
         }
         if (this.#closing || replica.expectedExit)
             return;
-        if (replica.readyAt !== undefined &&
-            this.#dependencies.clock.now() - replica.readyAt >= this.#restart.healthyReadyMs) {
+        const healthy = replica.readyAt !== undefined &&
+            this.#dependencies.clock.now() - replica.readyAt >= this.#restart.healthyReadyMs;
+        if (healthy)
             slot.failures = 0;
-        }
         // spine-log-boundary: server.managed_replica_exit
         emitServerWarning(lifecycleLogger, "Managed replica exited unexpectedly.", {
             operation: "managed_replica.exit",
@@ -514,6 +635,20 @@ export class ManagedServerCoordinator {
         this.#scheduleReplacement(slot);
         this.#drainStarts();
     }
+    /**
+     * Retains an exited child's missing drain acknowledgement across close attempts.
+     *
+     * @param closeAttempt The pending close attempt, if any.
+     */
+    #failIncompleteDrain(closeAttempt) {
+        if (closeAttempt === undefined || closeAttempt.drainedAcknowledged)
+            return;
+        const failure = new Error("Managed child exited before Delivery drained.");
+        closeAttempt.exitFailure = failure;
+        if (this.#closing)
+            this.#terminalChildFailure ??= failure;
+        closeAttempt.drained.reject(failure);
+    }
     /**
      * Retires a child after a process error and starts bounded termination.
      *
@@ -571,37 +706,7 @@ export class ManagedServerCoordinator {
         const closing = this.#close;
         if (closing !== undefined)
             return closing;
-        const close = (async () => {
-            this.#closing = true;
-            this.#removeSignalHandlers();
-            for (const slot of this.#slots) {
-                if (slot.replacementTimer !== undefined)
-                    this.#dependencies.clock.clearTimeout(slot.replacementTimer);
-                slot.replacementTimer = undefined;
-            }
-            // `beginDrain()` makes the unary snapshot empty synchronously. Start every
-            // child quiescence attempt without waiting for its reconciliation promise:
-            // child close IPC must be issued in this turn, while the Coordinator keeps
-            // subscription relays alive until every child has settled.
-            const draining = this.#nodeCoordinator?.beginDrain();
-            for (const slot of this.#slots)
-                if (slot.replica !== undefined)
-                    this.#clearSubscriptionWaiters(slot.replica, new Error("Managed application is closing before subscription installed."));
-            const childCloses = [
-                ...this.#slots.map((slot) => this.#closeReplica(slot.replica)),
-                ...[...this.#retired].map((replica) => this.#closeRetired(replica)),
-            ];
-            const results = await Promise.allSettled([draining, ...childCloses]);
-            const failures = [];
-            for (const result of results)
-                if (result.status === "rejected")
-                    failures.push(result.reason);
-            if (failures.length === 1)
-                throw failures[0];
-            if (failures.length > 1)
-                throw new AggregateError(failures, "Managed child quiescence failed during drain.");
-            await this.#nodeCoordinator?.close();
-        })();
+        const close = this.#closeGracefully();
         this.#close = close;
         void close.then(undefined, () => {
             if (this.#close === close)
@@ -609,6 +714,91 @@ export class ManagedServerCoordinator {
         });
         return close;
     }
+    /**
+     * Stops replacement starts and awaits all cleanup phases.
+     */
+    async #closeGracefully() {
+        this.#closing = true;
+        this.#removeSignalHandlers();
+        for (const slot of this.#slots) {
+            if (slot.replacementTimer !== undefined)
+                this.#dependencies.clock.clearTimeout(slot.replacementTimer);
+            slot.replacementTimer = undefined;
+        }
+        await this.#drainAndCloseReplicas();
+    }
+    /**
+     * Drains admitted child work, removes relays while listeners live, then closes children.
+     *
+     * @returns Completion after Coordinator and child cleanup attempts settle.
+     */
+    async #drainAndCloseReplicas() {
+        this.#drainStart ??= this.#nodeCoordinator?.beginDrain() ?? Promise.resolve();
+        const closing = new Error("Managed application is closing before subscription installed.");
+        for (const slot of this.#slots)
+            if (slot.replica !== undefined)
+                this.#clearSubscriptionWaiters(slot.replica, closing);
+        const replicas = this.#slots.flatMap((slot) => slot.replica === undefined ? [] : [slot.replica]);
+        const childCloses = [
+            ...replicas.map((replica) => this.#closeReplica(replica)),
+            ...[...this.#retired].map((replica) => this.#closeRetired(replica)),
+        ];
+        const children = Promise.allSettled(childCloses);
+        const failures = await this.#awaitDeliveryDrains(replicas);
+        await this.#finishClose(replicas, children, failures);
+    }
+    /**
+     * Cancels relays, releases children, and closes the Coordinator after a drain attempt.
+     * @param replicas The active children being closed.
+     * @param children The already-running bounded child close attempts.
+     * @param failures Errors collected from the drain phase.
+     */
+    async #finishClose(replicas, children, failures) {
+        try {
+            await this.#nodeCoordinator?.closeSubscriptions();
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        for (const replica of replicas) {
+            try {
+                if (replica.child.connected)
+                    replica.child.send({ type: "finish-close" }, () => undefined);
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        const childResults = await children;
+        const coordinator = Promise.resolve().then(() => this.#nodeCoordinator?.close());
+        const [coordinatorResult] = await Promise.allSettled([coordinator]);
+        for (const result of childResults)
+            if (result.status === "rejected" && !failures.includes(result.reason))
+                failures.push(result.reason);
+        if (coordinatorResult.status === "rejected")
+            failures.push(coordinatorResult.reason);
+        if (this.#terminalChildFailure !== undefined && !failures.includes(this.#terminalChildFailure))
+            failures.push(this.#terminalChildFailure);
+        if (failures.length === 1)
+            throw failures[0];
+        if (failures.length > 1)
+            throw new AggregateError(failures, "Managed child quiescence failed during drain.");
+    }
+    /**
+     * Waits for actual child Delivery drains without awaiting final child exits.
+     *
+     * @param replicas The active child incarnations.
+     * @returns Drain failures to report after child and Coordinator cleanup.
+     */
+    async #awaitDeliveryDrains(replicas) {
+        const deliveryDrains = replicas.map((replica) => replica.closeAttempt?.drained.promise ?? Promise.resolve());
+        const results = await Promise.allSettled([this.#drainStart, ...deliveryDrains]);
+        const failures = [];
+        for (const result of results)
+            if (result.status === "rejected")
+                failures.push(result.reason);
+        return failures;
+    }
     /**
      * Closes the current replica through the bounded child shutdown procedure.
      *
@@ -616,7 +806,28 @@ export class ManagedServerCoordinator {
      * @returns Completion after child shutdown.
      */
     #closeReplica(replica) {
-        return ManagedServerCoordinatorValues.close(replica, this.#dependencies.clock);
+        if (replica === undefined)
+            return Promise.resolve();
+        if (replica.closePromise !== undefined)
+            return replica.closePromise;
+        replica.closeFailure = undefined;
+        const close = ManagedServerCoordinatorValues.close(replica, this.#dependencies.clock);
+        replica.closePromise = close;
+        void close.then(() => {
+            replica.closeFailure = undefined;
+        }, (error) => {
+            replica.closeFailure = error;
+            if (replica.forcedFailure !== undefined || replica.terminal)
+                this.#terminalChildFailure ??= replica.forcedFailure ?? error;
+        });
+        // spine-log-boundary: server.managed_replica_close_finally_observer
+        void close
+            .finally(() => {
+            if (replica.closePromise === close)
+                replica.closePromise = undefined;
+        })
+            .catch(() => undefined);
+        return close;
     }
     /**
      * Terminates a retired replica and removes it from the pending set.
@@ -928,6 +1139,8 @@ const ManagedServerCoordinatorValues = Object.freeze({
             resolve = next;
             reject = fail;
         });
+        // spine-log-boundary: server.managed_deferred_rejection_observer
+        void promise.catch(() => undefined);
         return { promise, resolve, reject };
     },
     /**
@@ -943,7 +1156,7 @@ const ManagedServerCoordinatorValues = Object.freeze({
     },
     dependencies: {
         clock: {
-            now: () => Time.currentTimeMillis(),
+            now: () => Time.monotonicTime(),
             setTimeout: (onTimeout, delay) => setTimeout(onTimeout, delay),
             clearTimeout: (timer) => {
                 clearTimeout(timer);
@@ -1053,6 +1266,22 @@ const ManagedServerCoordinatorValues = Object.freeze({
             candidate.slot === String(slot) &&
             candidate.incarnation === incarnation);
     },
+    /**
+     * Matches the child's completed Delivery drain before its listener closes.
+     *
+     * @param message The candidate child IPC notification.
+     * @param slot The expected replica slot.
+     * @param incarnation The expected child incarnation token.
+     * @returns Whether the notification belongs to that child.
+     */
+    deliveryDrainedMessage(message, slot, incarnation) {
+        if (typeof message !== "object" || message === null)
+            return false;
+        const candidate = message;
+        return (candidate.type === "delivery-drained" &&
+            candidate.slot === String(slot) &&
+            candidate.incarnation === incarnation);
+    },
     /**
      * Matches a CLOSED or CLOSE-FAILED notification from the expected child.
      *
@@ -1090,35 +1319,93 @@ const ManagedServerCoordinatorValues = Object.freeze({
         }));
         const closeAttempt = {
             acknowledged: ManagedServerCoordinatorValues.deferred(),
+            drained: ManagedServerCoordinatorValues.deferred(),
             outcome: ManagedServerCoordinatorValues.deferred(),
         };
         replica.closeAttempt = closeAttempt;
         try {
-            if (child.connected)
-                child.send({ type: "close" }, () => undefined);
-            const observation = Promise.race([
-                closeAttempt.acknowledged.promise.then(() => "acknowledged"),
-                exited.then(() => "exited"),
-            ]);
-            if (await ManagedServerCoordinatorValues.within(observation, closeGraceMs, clock)) {
-                if ((await observation) === "exited")
-                    return;
-                await Promise.race([
-                    closeAttempt.outcome.promise,
-                    exited.then(() => {
-                        throw new Error("Managed child exited before graceful close completed.");
-                    }),
-                ]);
-                await ManagedServerCoordinatorValues.terminate(child, clock, exited);
-                return;
-            }
-            await ManagedServerCoordinatorValues.terminate(child, clock, exited, false);
+            await ManagedServerCoordinatorValues.awaitChildClose(child, closeAttempt, exited, clock);
+        }
+        catch (error) {
+            replica.forcedFailure = closeAttempt.forcedFailure;
+            throw error;
         }
         finally {
             if (replica.closeAttempt === closeAttempt)
                 replica.closeAttempt = undefined;
         }
     },
+    /**
+     * Waits for child drain and final close, escalating only after bounded acknowledgement.
+     *
+     * @param child The child process to close.
+     * @param closeAttempt Tracks the child's IPC phase acknowledgements.
+     * @param exited Resolves when the child exits.
+     * @param clock Supplies bounded shutdown timers.
+     * @returns Completion after the child has exited or close failed.
+     */
+    async awaitChildClose(child, closeAttempt, exited, clock) {
+        if (child.connected)
+            child.send({ type: "close" }, () => undefined);
+        const observation = Promise.race([
+            closeAttempt.acknowledged.promise.then(() => "acknowledged"),
+            exited.then(() => "exited"),
+        ]);
+        if (!(await ManagedServerCoordinatorValues.within(observation, closeGraceMs, clock))) {
+            await this.missingDrainAck(child, closeAttempt, exited, clock);
+        }
+        if ((await observation) === "exited") {
+            this.verifyExitedDrain(closeAttempt);
+            return;
+        }
+        await ManagedServerCoordinatorValues.awaitChildOutcome(closeAttempt, exited);
+        await ManagedServerCoordinatorValues.terminate(child, clock, exited);
+    },
+    /**
+     * Rejects an unacknowledged Delivery drain after bounded child termination.
+     *
+     * @param child The unresponsive child process.
+     * @param closeAttempt The current close attempt.
+     * @param exited Resolves when the child exits.
+     * @param clock Supplies bounded shutdown timers.
+     * @returns No value; the missing acknowledgement always rejects.
+     */
+    async missingDrainAck(child, closeAttempt, exited, clock) {
+        const failure = new Error("Managed child did not acknowledge Delivery drain.");
+        closeAttempt.forcedFailure = failure;
+        closeAttempt.drained.reject(failure);
+        try {
+            await this.terminate(child, clock, exited, false);
+        }
+        catch (termination) {
+            throw new AggregateError([failure, termination], "Managed child shutdown failed.");
+        }
+        throw failure;
+    },
+    /**
+     * Rejects a child exit that preceded its Delivery drain acknowledgement.
+     *
+     * @param closeAttempt The observed close attempt.
+     */
+    verifyExitedDrain(closeAttempt) {
+        if (closeAttempt.exitFailure !== undefined)
+            throw closeAttempt.exitFailure;
+    },
+    /**
+     * Waits for the real child close outcome before process reaping.
+     *
+     * @param closeAttempt Tracks the child's close notifications.
+     * @param exited Resolves when the child process exits.
+     * @returns Completion after the child's final close fact.
+     */
+    async awaitChildOutcome(closeAttempt, exited) {
+        await Promise.race([
+            closeAttempt.outcome.promise,
+            exited.then(() => {
+                throw new Error("Managed child exited before graceful close completed.");
+            }),
+        ]);
+    },
     /**
      * Waits for child exit, then escalates through SIGTERM and SIGKILL within bounded intervals.
      *
@@ -1161,6 +1448,9 @@ const ManagedServerCoordinatorValues = Object.freeze({
             void promise.then(() => {
                 clock.clearTimeout(timer);
                 resolve(true);
+            }, () => {
+                clock.clearTimeout(timer);
+                resolve(true);
             });
         });
     },