implements PLN-0121

crates/host/prometeu-host-desktop-winit/src/runner.rs

@@ -97,6 +97,10 @@ fn desired_control_flow(
     }
 }
 
+fn should_present_worker_frame(state: &FirmwareState) -> bool {
+    matches!(state, FirmwareState::GameRunning(_))
+}
+
 /// The Desktop implementation of the PROMETEU Runtime.
 ///
 /// This struct acts as the physical "chassis" of the virtual console. It is
@@ -301,9 +305,7 @@ impl ApplicationHandler for HostRunner {
                     // Mutable borrow of the frame (lasts only within this block)
                     let frame = pixels.frame_mut();
 
-                    let use_worker_frame =
+                    if should_present_worker_frame(&self.firmware.state)
-                        matches!(self.firmware.state, FirmwareState::GameRunning(_));
-                    if use_worker_frame
                         && let Some(worker_frame) =
                             self.firmware.os.vm().repeat_latest_render_worker_frame()
                     {
@@ -402,8 +404,7 @@ impl ApplicationHandler for HostRunner {
             self.stats.record_frame();
         }
 
-        let use_worker_frame = matches!(self.firmware.state, FirmwareState::GameRunning(_));
+        if should_present_worker_frame(&self.firmware.state)
-        if use_worker_frame
             && let Some(worker_frame) = self.firmware.os.vm().latest_render_worker_frame()
         {
             self.presentation.note_published_frame(worker_frame.frame_id.get());
@@ -449,8 +450,12 @@ impl ApplicationHandler for HostRunner {
 mod tests {
     use super::*;
     use prometeu_firmware::BootTarget;
+    use prometeu_firmware::firmware::firmware_state::{
+        GameRunningStep, HubHomeStep, ShellRunningStep,
+    };
     use prometeu_hal::debugger_protocol::DEVTOOLS_PROTOCOL_VERSION;
     use prometeu_hal::telemetry::{CertificationConfig, TelemetryFrame};
+    use prometeu_system::task::TaskId;
     use std::io::{Read, Write};
     use std::net::TcpStream;
 
@@ -518,6 +523,17 @@ mod tests {
         }
     }
 
+    #[test]
+    fn worker_frame_presentation_is_game_only() {
+        assert!(should_present_worker_frame(&FirmwareState::GameRunning(GameRunningStep::new(
+            TaskId(1),
+        ))));
+        assert!(!should_present_worker_frame(&FirmwareState::ShellRunning(ShellRunningStep::new(
+            TaskId(2)
+        ),)));
+        assert!(!should_present_worker_frame(&FirmwareState::HubHome(HubHomeStep)));
+    }
+
     #[test]
     fn host_debugger_maps_cert_events_from_host_owned_sources() {
         let telemetry = TelemetryFrame {

discussion/workflow/plans/PLN-0121-final-worker-path-validation-and-hardening.md

@@ -2,7 +2,7 @@
 id: PLN-0121
 ticket: real-render-worker-establishment
 title: Final Worker Path Validation and Hardening
-status: open
+status: done
 created: 2026-06-15
 completed:
 ref_decisions: [DEC-0033]
@@ -91,3 +91,12 @@ Prove the real render worker path satisfies DEC-0033 across HAL, system, drivers
 
 - Final validation may expose earlier plan gaps; fix them in the narrowest affected plan/module.
 - Manual host evidence can be flaky if tied to native window availability; keep automated host-unit evidence as the primary gate.
+
+## Validation Evidence
+
+- `cargo test --workspace`: passed.
+- `cargo test -p prometeu-system -p prometeu-drivers -p prometeu-hal -p prometeu-firmware -p prometeu-host-desktop-winit`: passed.
+- Native API coupling scan for worker/runtime console code: no `winit`, `pixels`, SDL, swapchain, or native texture API references found.
+- Mutable boundary scan for worker/runtime console code: no `&mut Hardware`, `&mut Gfx`, or concrete live `FrameComposer` references found.
+- Timing scan for render worker runtime tests: no `thread::sleep` / `sleep(` usage found.
+- Added host-unit evidence that worker frame presentation is restricted to `GameRunning`; Shell/Hub paths keep local presentation behavior.