Module stop 

The stop flow behind aion server stop: resolve the pid file, verify the incarnation, signal, wait bounded, and read the drain outcome back from the death note.

The verb signals ONLY a process the record proves is ours — the estate’s kill discipline, mechanized. Wrong-incarnation is a refusal that names both incarnations and touches nothing; a dead process with a lingering file is reconciled and reported; a server that exits without writing an outcome record has that absence reported honestly, never papered over with a fabricated summary.

One window the proof cannot close: between the incarnation probe and the SIGTERM, the verified process can exit and the kernel can hand its number to a stranger. The verb handles the exit (ESRCH reconciles as already-gone) but a full pid-space wraparound inside those microseconds would land the signal on the recycled pid. Closing it needs a process-handle primitive (pidfd_open/pidfd_send_signal, Linux-only); until a piece wants that, the window is named here rather than claimed away.

Enums

StopOutcome

How the stop ended when it was allowed to act.

StopRefusal

Why the stop refused to act. Each face is distinct and names its remedy.

StopVerdict

The verb’s answer: it acted (an outcome) or it refused (a refusal).

Functions

stop

Stop the server recorded under home, waiting up to patience for it to exit. patience is operator-ruled at invocation — the CLI passes the --patience flag, the verified-running record’s drain window, or the config’s own drain_timeout; this function never invents a value.