Function drain 

pub(crate) async fn drain<G, H>(
    stop: Sender<()>,
    grpc: JoinHandle<G>,
    http: JoinHandle<H>,
    flushers: [Flushers; 3],
    grace: Duration,
)

Stop accepting, then let everything already in flight land.

Three ordered steps, and the order is the whole point.

1. Stop accepting, but let in-flight exports run to their acknowledgement. Skipping this is not a data-loss bug — the queued job is still sealed below — it is a duplicate bug: the exporter sees a reset, OTLP tells it to retry, and it re-sends data that did get stored. Every rolling restart would double-write whatever was in flight.
2. Await the servers, which drops the last Ingest clone per signal and so closes each flusher’s channel.
3. A flusher answering a closed channel seals whatever is open, publishes it and acks the waiters (pipeline::flusher). Exiting before that lands is what turns step 1’s ack into a reset after all.

ponytail: bounded by grace because a hung fsync must not outlive the orchestrator’s grace period and become a SIGKILL with no explanation in the log. Whatever had not landed by then is lost, which is why the bound is a last resort and not a policy.