@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Added `Config.StopAbandonTimeout` to bound how long a client waits after job contexts are cancelled during shutdown. When the timeout elapses, jobs that have not begun finalizing are abandoned, recorded as failed, and set as errored (or discarded if retries are exhausted). Worker goroutines cannot be forcibly terminated and continue running until the process exits. [PR #1289](https://github.com/riverqueue/river/pull/1289).
 - Added `EventKindJobInterrupted`, emitted when a running job is interrupted because its client is shutting down, the job was cancelled, and has been made immediately available to be worked again. [PR #1290](https://github.com/riverqueue/river/pull/1290).
 
 ### Changed
 
@@ -378,11 +378,9 @@ type Config struct {
 	Schema string
 
 	// SoftStopTimeout is the maximum amount of time that the client will wait
-	// for running jobs to finish during a stop before their contexts are
-	// cancelled. After the timeout elapses, the client escalates to a hard stop
-	// by cancelling the context of all running jobs. This applies regardless of
-	// how stop is initiated — whether by calling Stop, StopAndCancel, or by
-	// cancelling the context passed to Start.
+	// for running jobs to finish during a graceful stop before entering soft
+	// stop by cancelling job contexts. This applies when stop is initiated by
+	// calling Stop or by cancelling the context passed to Start.
 	//
 	// In combination with signal.NotifyContext on the context passed to Start,
 	// this can simplify graceful stop to:
@@ -393,16 +391,33 @@ type Config struct {
 	//	if err := client.Start(ctx); err != nil { ... }
 	//	<-client.Stopped()
 	//
-	// The signal cancels the Start context, which initiates a soft stop. If
+	// The signal cancels the Start context, which initiates a graceful stop. If
 	// running jobs haven't finished after SoftStopTimeout, their contexts are
-	// automatically cancelled to trigger a hard stop.
+	// cancelled.
 	//
-	// StopAndCancel bypasses the timeout entirely and cancels job contexts
-	// immediately.
+	// StopAndCancel cancels job contexts immediately instead of waiting for
+	// SoftStopTimeout.
 	//
 	// Defaults to no timeout (wait indefinitely for jobs to finish).
 	SoftStopTimeout time.Duration
 
+	// StopAbandonTimeout is the maximum amount of time that the client will wait
+	// after job contexts are cancelled during a shutdown "soft stop" before it
+	// abandons jobs still running (i.e. those which did not respond to context
+	// cancellation). Abandoned jobs are recorded as failed and made immediately
+	// available for retry, or discarded if they have no attempts remaining.
+	//
+	// Worker goroutines cannot be forcibly terminated, and may continue running
+	// after their jobs are abandoned. Job implementations should therefore be
+	// prepared for duplicate execution.
+	//
+	// The timer starts only after a soft stop has begun by cancelling job
+	// contexts, like after SoftStopTimeout elapses, StopAndCancel is called, or
+	// the Start context is cancelled without SoftStopTimeout configured.
+	//
+	// Defaults to no timeout (job abandonment disabled).
+	StopAbandonTimeout time.Duration
+
 	// SkipJobKindValidation causes the job kind format validation check to be
 	// skipped. This is available as an interim stopgap for users that have
 	// invalid job kind names, but would rather disable the check rather than
@@ -536,6 +551,7 @@ func (c *Config) WithDefaults() *Config {
 		RetryPolicy:                 retryPolicy,
 		Schema:                      c.Schema,
 		SoftStopTimeout:             c.SoftStopTimeout,
+		StopAbandonTimeout:          c.StopAbandonTimeout,
 		SkipJobKindValidation:       c.SkipJobKindValidation,
 		SkipUnknownJobCheck:         c.SkipUnknownJobCheck,
 		Test:                        c.Test,
@@ -566,6 +582,9 @@ func (c *Config) validate() error {
 	if c.FetchPollInterval < c.FetchCooldown {
 		return fmt.Errorf("FetchPollInterval cannot be shorter than FetchCooldown (%s)", c.FetchCooldown)
 	}
+	if c.StopAbandonTimeout < 0 {
+		return errors.New("StopAbandonTimeout cannot be less than zero")
+	}
 	if len(c.ID) > 100 {
 		return errors.New("ID cannot be longer than 100 characters")
 	}
@@ -601,6 +620,9 @@ func (c *Config) validate() error {
 	if c.Schema != "" && !postgresSchemaNameRE.MatchString(c.Schema) {
 		return errors.New("Schema name can only contain letters, numbers, and underscores, and must start with a letter or underscore")
 	}
+	if c.SoftStopTimeout < 0 {
+		return errors.New("SoftStopTimeout cannot be less than zero")
+	}
 
 	for queue, queueConfig := range c.Queues {
 		if err := queueConfig.validate(queue, c.FetchCooldown, c.FetchPollInterval); err != nil {
@@ -1069,10 +1091,12 @@ func NewClient[TTx any](driver riverdriver.Driver[TTx], config *Config) (*Client
 // A graceful shutdown stops fetching new jobs but allows any previously fetched
 // jobs to complete. This can be initiated with the Stop method.
 //
-// A more abrupt shutdown can be achieved by either cancelling the provided
-// context or by calling StopAndCancel. This will not only stop fetching new
-// jobs, but will also cancel the context for any currently-running jobs. If
-// using StopAndCancel, there's no need to also call Stop.
+// A soft stop cancels job contexts after fetching has stopped. It can be
+// initiated by calling StopAndCancel, by cancelling the provided context when
+// SoftStopTimeout is not configured, or by waiting for SoftStopTimeout to elapse
+// during graceful stop. If StopAbandonTimeout is configured, jobs still running
+// after that timeout will be abandoned and recorded as failed. If using
+// StopAndCancel, there's no need to also call Stop.
 func (c *Client[TTx]) Start(ctx context.Context) error {
 	fetchCtx, shouldStart, started, stopped := c.baseStartStop.StartInit(ctx)
 	if !shouldStart {
@@ -1086,9 +1110,13 @@ func (c *Client[TTx]) Start(ctx context.Context) error {
 	// sure to take a channel reference before finishing stopped.
 	c.stopped = c.baseStartStop.StoppedUnsafe()
 
-	producersAsServices := func() []startstop.Service {
+	producers := func() []*producer {
+		return maputil.Values(c.producersByQueueName)
+	}
+
+	producersAsServices := func(producers []*producer) []startstop.Service {
 		return sliceutil.Map(
-			maputil.Values(c.producersByQueueName),
+			producers,
 			func(p *producer) startstop.Service { return p },
 		)
 	}
@@ -1142,8 +1170,8 @@ func (c *Client[TTx]) Start(ctx context.Context) error {
 		// We use separate contexts for fetching and working to allow for a
 		// graceful stop. When SoftStopTimeout is configured, the work context
 		// is detached from the start context so that cancelling the start
-		// context initiates a soft stop (with timeout escalation) rather than
-		// an immediate hard stop. When SoftStopTimeout is not configured, the
+		// context initiates a graceful stop (with timeout escalation) rather
+		// than an immediate soft stop. When SoftStopTimeout is not configured, the
 		// work context inherits from the start context to preserve the
 		// existing behavior where cancelling the start context is equivalent
 		// to StopAndCancel.
@@ -1166,7 +1194,7 @@ func (c *Client[TTx]) Start(ctx context.Context) error {
 		for _, producer := range c.producersByQueueName {
 			if err := producer.StartWorkContext(fetchCtx, workCtx); err != nil {
 				workCancel(err)
-				startstop.StopAllParallel(producersAsServices()...)
+				startstop.StopAllParallel(producersAsServices(producers())...)
 				stopServicesOnError()
 				return err
 			}
@@ -1188,7 +1216,7 @@ func (c *Client[TTx]) Start(ctx context.Context) error {
 	// Generate producer services while c.queues.startStopMu.Lock() is still
 	// held. This is used for WaitAllStarted below, but don't use it elsewhere
 	// because new producers may have been added while the client is running.
-	producerServices := producersAsServices()
+	producerServices := producersAsServices(producers())
 
 	go func() {
 		// Wait for all subservices to start up before signaling our own start.
@@ -1215,22 +1243,57 @@ func (c *Client[TTx]) Start(ctx context.Context) error {
 		c.queues.startStopMu.Lock()
 		defer c.queues.startStopMu.Unlock()
 
+		producerList := producers()
+
+		abandonTimerCtx, abandonTimerCancel := context.WithCancel(context.WithoutCancel(ctx))
+		defer abandonTimerCancel()
+
+		startAbandonTimer := sync.OnceFunc(func() {
+			if c.config.StopAbandonTimeout <= 0 {
+				return
+			}
+
+			go func() {
+				timer := time.NewTimer(c.config.StopAbandonTimeout)
+				defer timer.Stop()
+
+				select {
+				case <-timer.C:
+					c.baseService.Logger.WarnContext(ctx, c.baseService.Name+": StopAbandonTimeout elapsed; abandoning remaining jobs", slog.Duration("stop_abandon_timeout", c.config.StopAbandonTimeout))
+					for _, producer := range producerList {
+						producer.abandon()
+					}
+				case <-abandonTimerCtx.Done():
+				}
+			}()
+		})
+
+		workCtx := c.queues.workCtx
+		go func() {
+			select {
+			case <-workCtx.Done():
+				startAbandonTimer()
+			case <-abandonTimerCtx.Done():
+			}
+		}()
+
 		// If SoftStopTimeout is configured, start a timer that will cancel
-		// the work context (escalating to a hard stop) if producers don't
-		// finish in time. StopAndCancel also calls workCancel, in which case
-		// this timer is a harmless no-op because the context is already done.
+		// the work context if producers don't finish in time. Once the work
+		// context is cancelled, the optional abandonment timer starts.
 		if c.config.SoftStopTimeout > 0 {
 			softStopTimer := time.AfterFunc(c.config.SoftStopTimeout, func() {
 				c.baseService.Logger.WarnContext(ctx, c.baseService.Name+": Soft stop timeout; cancelling remaining job contexts", slog.Duration("soft_stop_timeout", c.config.SoftStopTimeout))
 				c.workCancel(rivercommon.ErrStop)
+				startAbandonTimer()
 			})
 			defer softStopTimer.Stop()
 		}
 
 		// On stop, have the producers stop fetching first of all.
 		c.baseService.Logger.DebugContext(ctx, c.baseService.Name+": Stopping producers")
-		startstop.StopAllParallel(producersAsServices()...)
+		startstop.StopAllParallel(producersAsServices(producerList)...)
 		c.baseService.Logger.DebugContext(ctx, c.baseService.Name+": All producers stopped")
+		abandonTimerCancel()
 
 		c.workCancel(rivercommon.ErrStop)
 
@@ -1259,12 +1322,17 @@ func (c *Client[TTx]) Start(ctx context.Context) error {
 // complete before exiting. If the provided context is done before shutdown has
 // completed, Stop will return immediately with the context's error.
 //
-// If SoftStopTimeout is configured, running job contexts will be automatically
-// cancelled after the timeout elapses, escalating to a hard stop. This also
-// applies when stop is initiated by cancelling the context passed to Start.
+// If SoftStopTimeout is configured, jobs still running after the timeout
+// elapses have their contexts cancelled.
+//
+// If StopAbandonTimeout is configured, jobs still running after SoftStopTimeout
+// and StopAbandonTimeout have elapsed (i.e. waited for jobs to stop gracefully
+// before cancelling, then waited again for them to stop on cancel) are abandoned
+// and recorded as failed so they can be retried immediately. This also applies
+// when stop is initiated by cancelling the context passed to Start.
 //
-// There's no need to call this method if a hard stop has already been initiated
-// by cancelling the context passed to Start or by calling StopAndCancel.
+// There's no need to call this method if shutdown has already been initiated by
+// cancelling the context passed to Start or by calling StopAndCancel.
 func (c *Client[TTx]) Stop(ctx context.Context) error {
 	shouldStop, stopped, finalizeStop := c.baseStartStop.StopInit()
 	if !shouldStop {
@@ -1283,10 +1351,11 @@ func (c *Client[TTx]) Stop(ctx context.Context) error {
 
 // StopAndCancel shuts down the client and cancels all work in progress. It is a
 // more aggressive stop than Stop because the contexts for any in-progress jobs
-// are cancelled. However, it still waits for jobs to complete before returning,
-// even though their contexts are cancelled. If the provided context is done
-// before shutdown has completed, StopAndCancel will return immediately with the
-// context's error.
+// are cancelled immediately. If StopAbandonTimeout is configured, jobs that
+// still remain running after the timeout are abandoned; otherwise, StopAndCancel
+// waits for jobs to complete even though their contexts are cancelled. If the
+// provided context is done before shutdown has completed, StopAndCancel will
+// return immediately with the context's error.
 //
 // This can also be initiated by cancelling the context passed to Start. There is
 // no need to call this method if the context passed to Start is cancelled
@@ -1298,7 +1367,7 @@ func (c *Client[TTx]) Stop(ctx context.Context) error {
 // graceful stop semantics without requiring manual orchestration of Stop and
 // StopAndCancel.
 func (c *Client[TTx]) StopAndCancel(ctx context.Context) error {
-	c.baseService.Logger.InfoContext(ctx, c.baseService.Name+": Hard stop started; cancelling all work")
+	c.baseService.Logger.InfoContext(ctx, c.baseService.Name+": Soft stop started; cancelling all work")
 	c.workCancel(rivercommon.ErrStop)
 
 	shouldStop, stopped, finalizeStop := c.baseStartStop.StopInit()
@@ -2298,6 +2367,7 @@ func (c *Client[TTx]) producerAdd(queueName string, queueConfig QueueConfig) (*p
 		JobStuckCount:                &c.stuckJobCount,
 		JobStuckThreshold:            c.config.JobStuckThreshold,
 		JobTimeout:                   c.config.JobTimeout,
+		JobUpdateCallback:            c.subscriptionManager.distributeJobUpdates,
 		MaxWorkers:                   queueConfig.MaxWorkers,
 		Notifier:                     c.notifier,
 		Queue:                        queueName,