Method Stop

internal/server/server.go:426–480

Stop waits for all background goroutines started via goAsync to finish AND drains the rate-limiter cleanup goroutines spawned at construction time (BUG-851). Safe to call multiple times. Should be called before Store.Close() so in-flight DB writes don't race a closed connection (or worse, the SQLite

()

// Store.Close() so in-flight DB writes don't race a closed connection
// (or worse, the SQLite -wal/-shm file removal in t.TempDir cleanup).
func (s *Server) Stop() {
	// Signal long-running background loops (orphan GC, etc.) to exit.
	// Each loop registers itself on s.bg, so the Wait() below blocks
	// until they actually finish and any in-flight goroutines drain.
	s.stopOrphanGC()
	// Yjs op-log prune sweeper (TASK-1309). Same lifecycle pattern;
	// signals BEFORE Wait() so the goroutine sees the close and exits.
	s.stopOpLogGC()
	// Short-lived-credential reaper (PLAN-1933 DR-5 / TASK-1936). Same
	// lifecycle pattern; signal BEFORE Wait() so the goroutine exits.
	s.stopTokenReaper()
	// Soft-deleted-workspace hard-purge sweeper (TASK-1966). Same
	// lifecycle pattern; signal BEFORE Wait() so the goroutine exits.
	s.stopWorkspacePurgeSweeper()
	// SPEC-3 event outbox drain (TASK-2714). Same lifecycle pattern; an
	// in-flight delivery is tracked on s.bg and awaited below.
	s.stopOutboxDrain()
	// MCP audit writer / sweeper run on s.bg too. Signal first so
	// the workers see the close BEFORE Wait() blocks; without the
	// signal Wait would hang forever on the writer's blocking
	// queue receive.
	s.stopMCPAuditWriter()
	// MCP session tracker (TASK-1120) runs its sweeper on s.bg too.
	// Order with the audit writer doesn't matter — both are
	// independent goroutines; we just need the close BEFORE Wait().
	s.stopMCPSessionTracker()
	// Close the collab room manager BEFORE bg.Wait() so any in-flight
	// op-log GC sweep (TASK-1309) blocked on a per-item lock behind
	// an active Join can drain. collab.Close() tears down the Joins
	// (their WS readLoops return, runConn unwinds, itemLocks
	// release), which unblocks the GC's per-item PruneItemOpLogIfDormantBefore
	// call. Without this ordering, Stop() can deadlock: GC waits on
	// itemLock; Join holds itemLock until WS closes; WS only closes
	// when collab.Close() runs; collab.Close() only runs after
	// bg.Wait(); bg.Wait() never returns because GC is stuck.
	// Per Codex review of TASK-1309 [P2]. nil-safe: collab is optional.
	if s.collab != nil {
		s.collab.Close()
	}
	s.bg.Wait()
	// Watch/nudge bus (BUG-2651). Closed AFTER bg.Wait() so a background
	// producer cannot publish into a bus that is already tearing down; both
	// implementations are safe if one does anyway (MemoryBus finds no
	// subscribers, RedisBus finds a cancelled context and fails closed).
	//
	// This matters more than it did for MemoryBus, whose Close only dropped
	// channels: RedisBus holds a receive goroutine and a Redis subscription
	// from construction, so skipping it leaks both for the process's life
	// (Codex round 1 P2). Closing also closes every subscriber channel, which
	// is how a still-open SSE stream learns to unwind.
	if s.watchEvents != nil {
		s.watchEvents.Close()
	}
	s.rateLimiters.Stop() // nil-safe via the RateLimiters receiver guard
}

func New(s *store.Store) *Server {
	rl := NewRateLimiters()