- Logger validation now requires info/warn/error (was info-only)
- Force-exit timer now survives manager stop drain so a hung manager
cannot trap the process in half-shutdown
- installSignalHandlers is now actually idempotent — tracks installed
signals on coordinator and skips duplicates
Codex grade D flagged two real defects:
1. Managers were stopped before HTTP server finished draining, so in-flight
requests could fail when their backing services were already down.
2. _stopManager() promises weren't awaited, contradicting the documented
'declaration order' claim for async stop methods.
Fix: server.close callback now awaits _stopManagersInOrder() before
exiting. The 'shutdown' event fires first (so listeners can observe the
signal); the 'closed' event fires after all managers are stopped.
hermes