Gracefully drain workers on shutdown instead of terminating them

CHANGELOG.rst

@@ -1,3 +1,9 @@
+0.18.1 (unreleased)
+-----------------
+
+* Bugfix the master process does not terminate workers still serving in-flight
+  requests when another worker exits on SIGTERM/SIGINT.
+
 0.18.0 2025-11-08
 -----------------
 

src/hypercorn/run.py

@@ -100,8 +100,7 @@ def shutdown(*args: Any) -> None:
                 shutdown_event.set()
                 active = False
 
-        for process in processes:
-            process.terminate()
+        _drain(processes)
 
         exitcode = _join_exited(processes) if exitcode != 0 else exitcode
 
@@ -139,6 +138,19 @@ def _populate(
             time.sleep(0.1)
 
 
+def _drain(processes: list[BaseProcess]) -> None:
+    """Wait for the workers to exit gracefully.
+
+    On SIGTERM/SIGINT the master used to ``terminate()`` the workers still
+    processing requests as soon as an idle worker exited, cutting off
+    in-flight requests. Workers instead need to finish their own shutdown
+    (bounded on their side by ``config.graceful_timeout``), so the master
+    waits for them to exit on their own (see #386).
+    """
+    for process in processes:
+        process.join()
+
+
 def _join_exited(processes: list[BaseProcess]) -> int:
     exitcode = 0
     for index in reversed(range(len(processes))):

tests/test_run.py

@@ -0,0 +1,17 @@
+from __future__ import annotations
+
+from unittest import mock
+
+from hypercorn.run import _drain
+
+
+def test_drain_waits_for_workers_to_exit() -> None:
+    """The master must join the workers instead of terminating them, so
+    that in-flight requests are served on shutdown (see #386)."""
+    processes = [mock.Mock(), mock.Mock()]
+
+    _drain(processes)
+
+    for process in processes:
+        process.join.assert_called_once_with()
+        process.terminate.assert_not_called()