How should a Python web worker shut down gracefully during deployment?

I test shutdown by deploying under realistic traffic and observing accepted, completed, cancelled, and retried work. Connection draining includes downstream pools and message consumers, not only HTTP sockets. Idempotency protects callers that retry an ambiguous disconnect. Metrics expose drain duration, forced termination, cleanup failures, and requests still active at the deadline, allowing the timeout to reflect real behavior instead of hiding hung work with a very large value.