Function shutdown_plan 

pub fn shutdown_plan(total: Duration, backup_bound: Duration) -> ShutdownPlan

Divide total between the phases. backup_bound is the backup’s own shutdown bound (BackupConfig::shutdown_budget), zero without backup.

With room (total at least drain cap + 8 s + backup_bound) the drain gets its cap, the backup its bound, and the snapshot the rest. With less, all three scale down in proportion, except that the backup keeps a floor ([SHUTDOWN_BACKUP_FLOOR], never more than its bound) and the drain gives way first: it is the phase a stuck client can stretch.