Function drain_grace 

pub fn drain_grace() -> Duration

Resolve the drain grace from POLYCHROME_DRAIN_GRACE_SECS, falling back to a default of 25 seconds, comfortably under the Kubernetes default terminationGracePeriodSeconds (30s).

The right budget is per-deployment: a binary running long in-flight work (the harness drains LLM turns and sets terminationGracePeriodSeconds: 150) must drain for most of its grace, while edges/control-plane keep the 30s default. A single compile-time const would either truncate the harness’s drain or overrun an edge’s grace, so it is read from the environment and the deployment sets it to sit just under its own terminationGracePeriodSeconds.

pub, not module-private, so a caller with a task OUTSIDE the servers JoinSet this module otherwise bounds — polyc-control-plane’s post-drain awaits, #1370 review finding 3 — can bound those awaits against this budget instead of inventing one.

Such a caller must spend what is LEFT of this budget. It must not take a fresh copy. The post-drain awaits run after until_shutdown has already spent part of the budget. They also run one after another. A fresh copy per phase lets the total reach a multiple of what the deployment sized. The kubelet then kills the pod mid-drain. polyc-control-plane stamps an Instant before until_shutdown. It subtracts the elapsed time at each later phase.