A Discord bot is not a web server. It holds a long-lived connection, it is rate limited on reconnect, and it fails in ways a health check on a port will never notice. For a year we ran shards under a general-purpose process manager and papered over the difference. This is what that cost, and what we did about it.
The failure mode nobody watches
The interesting failure is not a crash. It is a shard that stays up, keeps its socket open, and quietly stops receiving events. A restart-on-exit supervisor sees a healthy process and does nothing, and the first person to notice is a customer whose commands stopped working an hour ago.
What replaced it
- Liveness is measured from gateway heartbeat acknowledgements, not process state.
- Restarts are budgeted per shard so a reconnect storm cannot self-inflict a rate limit.
- Resharding is scheduled against guild count with hysteresis, so growth does not cause flapping.
- Every restart writes a reason to the customer-visible log, because 'it restarted' is not an answer.
“If the customer has to tell you your platform is broken, the monitoring was decorative.”
