# Lifecycle and Recovery

## Startup and readiness

Distinguish process liveness, initialization completion, and safe traffic readiness. Define behavior for critical and non-critical dependency failures. Bound reconnect, registration, and warm-up with backoff and jitter; avoid synchronized work across all instances.

Record sanitized configuration and component state. Do not claim readiness before required routes, workers, or dependencies are usable, and do not block all service behavior on a dependency that is genuinely optional.

## Recovery capacity

Recovery often combines live traffic, backlog, retries, and cache fallback:

```text
catch-up capacity = total processing capacity - normal input rate
```

Rate-limit replay, warm-up, and backlog drain so recovery does not overload the database, cache, or external API. Make recovery rate observable and adjustable.

## Background and scheduled work

Define multi-instance re-entry, missed-run handling, restart recovery, maximum duration, and concurrency. Do not launch ownerless background work from a request handler.

## Shutdown

Stop accepting work, stop pulling or propagate cancellation, drain or safely return in-flight work, flush required state, then close dependencies. Bound every wait and define forced-termination behavior. Do not ACK unfinished work or allow diagnostic flush to extend shutdown indefinitely.

Validate restart, repeated reconnect, rolling replacement, backlog replay, cold cache, dependency recovery, and forced termination according to risk. Observe downstream pressure and user-visible latency during recovery.