Production defaults
Most of what separates a demo from a deployable service is undramatic and easy to forget: draining in-flight work on shutdown, telling an orchestrator when you're ready, not leaking internal errors, not corrupting state under concurrent writes. Nwire's posture is that these are defaults, not a hardening checklist you reach at the end. The first run() is already shaped for production.
Graceful drain
When the process receives SIGTERM — the signal Kubernetes, Docker, and most process managers send to stop you — the endpoint:
- Stops accepting new requests, jobs, and timers.
- Lets in-flight work finish, within a timeout.
- Disposes plugins in reverse boot order (so a pool that opened last closes first).
- Exits cleanly.
No request is severed mid-flight, no connection pool is abandoned. You don't write signal handlers; run() installed them.
Health probes
HTTP transports expose liveness and readiness endpoints. The distinction is the point: live means the process is up; ready means it has booted its plugins and can serve. An orchestrator uses readiness to hold traffic off a pod that's still booting — or one that's already draining — so a rollout doesn't route requests into a process that can't answer them yet.
Errors don't leak
A thrown value that isn't a typed defineError is redacted to an opaque internal_error before it leaves the process, in every environment. A driver message, a stack trace, or PII attached to an Error can't reach a caller by accident — exposing an error is something you define, never the default.
Safe writes under concurrency
State that's guarded by a rule — a seat that can't be double-booked, a balance that can't go negative — is written through an actor, and the actor store applies changes under a per-key lock with optimistic-concurrency versioning. Two requests racing on the same key don't interleave into a corrupt state; one wins and the other retries against the new version. The safe path is the default path, not an advanced configuration.
Why this is the default
The framework's bet is that you shouldn't have to remember production discipline — the rewrite trap, the dropped request on deploy, the leaked stack trace, the lost write. Each is handled at the seam where it belongs (the endpoint, the transport, the actor store), so the cost of doing it right is zero and the cost of doing it wrong is something you'd have to go out of your way to choose.
See also
- The endpoint — where drain and probes live.
- Errors and resources — the redaction default in full.
- Graceful shutdown + K8s probes recipe.