---
id: PLN-0096
ticket: vm-render-parallel-execution-boundary
title: Define Render Shutdown and Failure Handling
status: done
created: 2026-06-05
ref_decisions: [DEC-0031]
tags: [runtime, renderer, shutdown, errors]
---

## Briefing

`DEC-0031` requires shutdown to stop obsolete presentation, discard pending/current work, and terminate worker execution in a bounded way. Worker panic must become controlled failure, not VM panic.

## Objective

Define and implement render shutdown, cancellation, and failure handling for both synchronous and worker-capable paths.

## Dependencies

- `PLN-0089` handoff abstraction.
- `PLN-0092` epoch/ownership transitions.
- `PLN-0093` telemetry.
- `PLN-0095` if a real worker is being exercised.

## Scope

- Add stop token or equivalent cancellation state for worker/current render work.
- Discard pending submissions on shutdown.
- Prevent obsolete current work from presenting after shutdown/owner change.
- Convert worker panic/render backend failure into controlled runtime/host error state.
- Record shutdown discards and errors in telemetry.

## Non-Goals

- Do not design full crash UI policy beyond render ownership requirements.
- Do not implement automatic worker restart unless existing host policy already supports it.
- Do not expose failure ACK to VM program semantics.

## Execution Method

1. Define shutdown state machine for render consumer.
2. Add bounded worker termination behavior where worker exists.
3. Add pending/current discard paths.
4. Ensure present path checks stop/epoch before publishing.
5. Wrap worker entrypoint with panic/error containment.
6. Add telemetry for shutdown discards, render errors, present errors, and worker failure.

## Acceptance Criteria

- Shutdown does not drain obsolete frames to screen.
- Pending work is discarded.
- Current work cannot present after stop/epoch invalidation.
- Worker failure is reported without panicking the VM.
- Shutdown completes in bounded time.

## Tests

- Unit test pending discard on shutdown.
- Integration test shutdown during currently-rendering submission.
- Simulated worker panic/error test.
- Telemetry assertions for shutdown/error counters.

## Affected Artifacts

- Render handoff.
- Worker runtime integration.
- `RenderManager`.
- Telemetry modules.
- Host error handling.