Add fail-closed shutdown drain checkpoint

README.md

@@ -27,6 +27,7 @@ WinForms tool for controlled Microsoft BizTalk Server 2020 platform operations d
 - Automatic operation-log restoration into the grid after an application restart
 - Thirty-day runtime-log retention with GZip compression for completed daily logs
 - Process-local ScheduledTask adapter dependency resolution for `scheduler:` receive locations without modifying the GAC
+- Fail-closed operator drain checkpoint after all receive locations and before later shutdown phases
 - Best-effort plan execution: one isolated WMI failure is recorded while remaining independent steps continue
 - Idempotent execution that skips artifacts already in the requested target state
 - Durable per-step result reports even when a shutdown or restore completes only partially
@@ -47,8 +48,9 @@ WinForms tool for controlled Microsoft BizTalk Server 2020 platform operations d
 4. Click **Snapshot Before**.
 5. Click **Shutdown** and review `shutdown-plan.json`.
 6. Disable **Dry run** only when the plan is correct.
-7. After maintenance, click **Restore** using the saved `before.json`.
-8. Click **Snapshot After** and **Compare**.
+7. During a real shutdown, keep the drain dialog open until Group Hub and enterprise monitoring show that in-flight processing has emptied; choose **Yes** only then.
+8. After maintenance, click **Restore** using the saved `before.json`.
+9. Click **Snapshot After** and **Compare**.
 
 If a shutdown was interrupted and only the original `before.json` remains, select that file with **State...**, run **Validate State**, keep **Dry run** enabled and click **Emergency Restore**. The recovery plan never overwrites the source snapshot, ensures the `ENTSSO` service is running first, skips already-correct runtime states and continues after isolated step failures. Disable Dry run only after reviewing the timestamped emergency plan. A real run automatically writes a timestamped target/actual diff when the post-operation snapshot succeeds.
 
@@ -62,6 +64,7 @@ Before a real shutdown or restore, the exact fresh plan is saved and a second di
 
 Shutdown:
 - Disable receive locations that were enabled.
+- Pause at the persisted inbound-drain checkpoint and require an explicit operator decision.
 - Stop orchestrations that were started.
 - Stop send ports that were started.
 - Stop host instances that were started on the selected server.
@@ -74,6 +77,10 @@ Restore:
 
 Orchestrations that were `Bound` are deliberately left unchanged during restore to avoid accidentally making them `Unbound`.
 
+The drain checkpoint is part of `shutdown-plan.json`. In a real run, **Yes** records `CheckpointDecision=Continue`; **No**, a closed dialog or a callback error fails closed before orchestrations, send ports and host instances. All later rows are persisted as `NotExecuted`, followed by a partial-state snapshot and `shutdown-result.json`. Dry-run shows the checkpoint but never opens a decision dialog.
+
+BizTalk applications displaying `Partially Started` immediately after receive locations are disabled is expected. Microsoft defines “Partial Stop - Allow running instances to continue” as disabling only receive locations so in-flight instances can finish. The tool deliberately does not issue an additional application-level stop: its stronger variants can stop or unenlist artifacts, remove subscriptions, undeploy policies or terminate instances. The existing artifact-level plan preserves exact snapshot state and controlled global ordering.
+
 ## Outputs
 
 - `before.json`, `after.json`
@@ -97,6 +104,8 @@ The Operation Log shows the WMI class, key property, key value and method for re
 
 Execution is deliberately best-effort. A failure such as an adapter-specific validation exception is written as `Failed` in the result report, but later independent plan steps are still attempted. The GUI ends in a failed/operator-review state when any step failed; it never reports a partial execution as an unconditional success. The post-operation snapshot is attempted independently and its own failure is preserved in the same report.
 
+The operator checkpoint is the explicit exception to best-effort continuation: declining it or losing the confirmation mechanism intentionally prevents every later shutdown phase. This is a safe incomplete operation, not a successful full shutdown, and remains visible in the report and grid.
+
 For a ScheduledTask receive location, the operation plan retains adapter name and address. Immediately before a real `Enable` or `Disable`, the tool preloads `Microsoft.BizTalk.Scheduler.dll` from the locally installed BizTalk directory and resolves further dependencies from identity-checked BizTalk/ScheduledTask adapter directories. Conventional BizTalk 2020 and `BizTalk ScheduledTask Adapter 7.x` folders plus BizTalk registry paths are discovered automatically. An exceptional installation path can be added to the semicolon-delimited `AdapterAssemblySearchPaths` value in `BizTalkPlatformManagementTool.exe.config`. This is process-local: the tool neither copies DLLs nor changes the GAC. Never point the setting at assemblies from a different BizTalk version.
 
 Error records in the grid, execution report and file log include exception type, HRESULT, complete inner-exception chain, available Fusion loader information and stack trace. For the PROD validation and support bundle, follow [ScheduledTask control and runtime logging runbook](docs/PROD-ScheduledTask-und-Laufzeitlogging-2026-08-26.md).
@@ -134,5 +143,6 @@ Targeted German inline comments explain non-obvious operational decisions such a
 - [ACC runtime shutdown incident and recovery fix](docs/ACC-Runtime-Shutdown-Exception-2026-08-19.md)
 - [PROD ScheduledTask control and runtime logging runbook](docs/PROD-ScheduledTask-und-Laufzeitlogging-2026-08-26.md)
 - [PROD runtime-log storage validation and 2.3.1 fix](docs/PROD-Laufzeitlog-Ablage-2026-08-26.md)
+- [PROD shutdown drain checkpoint and application-status analysis](docs/PROD-Shutdown-Drain-Checkpoint-2026-08-26.md)
 - [AI maintainer handoff](AI-README.md)
 - [References](REFERENCES.md)