> A potential implementation is in termination.patch.  Basically,
> try to shut down gracefully, but if you timeout, just give up and
> kill everything.

You can't have a sensible default timeout, because the worker may be processing something important...

> It's a lot less code (one could write an even shorter patch
> that doesn't try to do any additional graceful error handling),
> doesn't add a new monitor thread, doesn't add any more IPC
> mechanism, etc..  FWIW, I don't see any of these changes as bad,
> but I don't feel like I have a sense of how generally useful they
> would be.

Not everything can be simple. Getting this right may require a bit
of code. I think we can get rid of the ack_handler thread by making
the result handler responsible for both acks and results, but I haven't tried it yet, and this code is already running in production by many so didn't want to change it unless I had to.