The restart that fixed everything (and the one that broke it)

The restart that fixed everything

Friday, 23:40. Rubber-banding across every world, memory climbing all evening on the spark timeline, three plugins trading blame. Chasing a leak at that hour produces bad guesses and worse configs. So we stopped guessing: scheduled restart at 05:00 through the wrapper, players warned, world saved, box warm again by 05:04.

The climb was gone. The actual leak got found properly on Saturday with a clear head and a heap dump — an old plugin caching per-chunk objects. The restart bought the time to fix it right instead of hotpatching it live at midnight.

The one that broke it

Different server, worse instinct: "quick restart, thirty seconds" fired while the nightly backup job was mid-zip on the world folder. Region file caught between save and archive, world came back with a hole in a chunk players had spent a week building.

The half-written zip was useless. The offsite copy from the previous night saved everything — twenty-four hours of loss instead of permanent loss. Backup windows and restart windows never share a clock again.

Make restarts boring

1. Warnings at five minutes, one minute, ten seconds — broadcast and title.
2. save-all flush before stop; never interrupt a save.
3. Drain the proxy: stop accepting new joins a minute before the stop.
4. Backups on their own window, at least half an hour from the restart window.
5. After boot, health check before reopening: status ping, log scan for SEVERE, player count climbing.

All of it in a script cron runs. Boring restarts are the ones you never think about — that's the whole design goal.