implement graceful shutdown for outstanding requests

By going into single-threaded mode, we can drastically simplify our
shutdown sequence to avoid race conditions.  This also allows us
to not have additional overhead during normal runtime: as all the
shutdown-specific logic is isolated to only a few portions of
the code.

Like all graceful shutdown schemes, this is one is still vulnerable to
race conditions due to network latency, but this one should be no worse
than any other server.  Fortunately all requests we service are
idempotent.

1 files changed, 0 insertions, 1 deletions

diff --git a/TODO b/TODO
index 08f52b3..3b6a4b5 100644
--- a/TODO
+++ b/TODO
@@ -1,4 +1,3 @@
-* graceful shutdown
 * hot management interface
 * tunable thread counts
 * keepalive expiry/timeouts?