Function runtime_worker_handle_stop

src/daemon/runtime.c:1518–1592

}

static void runtime_worker_handle_stop(cbm_daemon_runtime_worker_t *worker, const uint8_t *payload,
                                       uint32_t length) {
    cbm_daemon_runtime_service_t *service = worker->service;
    char requested_build[CBM_DAEMON_BUILD_FINGERPRINT_SIZE] = {0};
    bool peer_verified =
        runtime_control_request_decode(payload, length, requested_build) &&
        runtime_activation_peer_matches_claim(service, worker->peer_process_id, requested_build);
    uint8_t response[CBM_DAEMON_STOP_RESPONSE_SIZE];
    memset(response, 0, sizeof(response));
    bool accepted = false;
    if (peer_verified) {
        uint8_t count = 0U;
        uint32_t pids[CBM_DAEMON_CONTROL_CLIENT_CAP] = {0};
        uint64_t deadline = runtime_deadline_after(service->shutdown_timeout_ms);
        cbm_mutex_lock(&service->mutex);
        response[0] = 1U;
        uint16_t committed = service->committed_clients > UINT16_MAX
                                 ? UINT16_MAX
                                 : (uint16_t)service->committed_clients;
        runtime_control_collect_clients_locked(service, worker, &count, pids);
        if (service->committed_clients > 0) {
            /* Refuse-if-busy: the caller reports these pids to the user as
             * the processes that must exit before a graceful stop. */
            response[1] = 0x02U;
        } else if (service->state == CBM_DAEMON_RUNTIME_SERVICE_RUNNING) {
            /* Explicit stop is the sanctioned exit for PERMANENT generations
             * as well — begin_stopping here overrides the permanence gate.
             * Mirror the activation-shutdown ACK protocol: the stopping
             * teardown must not consume this requester's response slot before
             * the acceptance byte leaves. */
            runtime_service_begin_stopping_locked(service, deadline, false,
                                                  "daemon_stop_requested");
            /* Same exit criterion as an activation drain: a permanent
             * coordinator never reports client-terminal, so resource
             * emptiness must be allowed to complete this stop promptly. */
            service->activation_shutdown_requested = true;
            service->activation_response_inflight = true;
            worker->final_response_inflight = true;
            response[1] = 0x01U;
            accepted = true;
        }
        response[2] = (uint8_t)(committed >> 8);
        response[3] = (uint8_t)(committed & 0xFFU);
        response[4] = count;
        for (size_t index = 0; index < CBM_DAEMON_CONTROL_CLIENT_CAP; index++) {
            size_t offset = 8U + index * 4U;
            response[offset] = (uint8_t)(pids[index] >> 24);
            response[offset + 1U] = (uint8_t)(pids[index] >> 16);
            response[offset + 2U] = (uint8_t)(pids[index] >> 8);
            response[offset + 3U] = (uint8_t)(pids[index] & 0xFFU);
        }
        cbm_mutex_unlock(&service->mutex);
    }
    if (accepted) {
        char requester_pid[32];
        (void)snprintf(requester_pid, sizeof(requester_pid), "%llu",
                       (unsigned long long)worker->peer_process_id);
        cbm_log_info("daemon.stop_requested", "requester_pid", requester_pid, "requester_build",