http.Server.Shutdown timeout boundary for zero-downtime migration

Goal is to migrate a small Go HTTP service without dropping in-flight requests. The design relies on http.Server.Shutdown to stop accepting new connections while allowing existing handlers to finish, supporting a zero-downtime hand-off.

Constraints involve the shutdown signal timing, the boundary for long-running handlers, and behavior with TLS connections. Shutdown returns after signaling stop, but active listeners and connections persist until handlers finish or a deadline expires. Without a bounded context, a handler can block termination indefinitely. The interaction with existing TLS connections and the effect of repeated shutdown signals in concurrent signal handling are unclear for a migration automation that must guarantee process exit.

What timeout or context deadline defines an acceptable completion window for in-flight requests during migration? Does Shutdown close existing TLS connections by default or is additional configuration required to avoid connection leaks? Is calling Shutdown multiple times safe when multiple signal handlers may trigger it concurrently?