# HTTP shutdown store drain ordering

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "http-shutdown-store-drain-2026-09-07",
  "problems": [
    {
      "problemId": "http-shutdown-closes-store-before-request-drain",
      "summary": "Service shutdown closed the shared analysis store before in-flight HTTP analysis requests completed.",
      "status": "candidate",
      "applicability": "Auto-oncall HTTP requests that are still using the shared AutoAnalysisStore when the service receives SIGINT or SIGTERM.",
      "issueKeys": ["APID-29470"],
      "sourceRefs": ["https://tidb.atlassian.net/browse/APID-29470#problem:current-shutdown-closes-store-before-http-drain"],
      "signalTextIncludesAny": ["Pool is closed.", "internal_error", "current-shutdown-closes-store-before-http-drain"],
      "observedThrough": "2026-09-07",
      "effectiveAt": null,
      "verifiedAt": null,
      "attemptedAction": "Stop accepting HTTP connections, stop background runtimes, wait for in-flight HTTP requests to finish, and only then close the shared analysis store.",
      "evidenceUrl": "https://tidb.atlassian.net/browse/APID-29470"
    }
  ]
}
-->

- Owner: auto-oncall-services HTTP server shutdown lifecycle
- Source reference: APID-29470
- Implementation status: candidate
- Effective status: candidate

## Bounded problem

The process shutdown path closed `AutoAnalysisStore` before asking the HTTP
server to drain. An analysis request that was already running could therefore
reach a later store operation after `pool.end()` and terminate with `Pool is
closed.` instead of delivering its result.

## Change

Shutdown now stops accepting new HTTP connections immediately, stops the
background runtimes, waits for every in-flight HTTP request to complete, and
then closes the shared store. Analysis contracts, gates, Provider behavior,
diagnostic decisions, and customer-write boundaries are unchanged.

## Verification

A deterministic HTTP regression holds one request in flight during shutdown
and verifies that the request completes while the store remains open, followed
by store closure.

## Unresolved gaps

The candidate has not been deployed or verified against a live termination, so
it is not yet effective or verified.

## Next validation action

After deployment, terminate the service during one bounded read-mode request
and verify that the request completes before the store closes, without an
internal `Pool is closed.` response.