prometeu-runtime/discussion/workflow/plans/PLN-0096-define-render-shutdown-and-failure-handling.md

id	ticket	title	status	created	ref_decisions	tags
PLN-0096	vm-render-parallel-execution-boundary	Define Render Shutdown and Failure Handling	done	2026-06-05	DEC-0031	runtime renderer shutdown errors

Briefing

DEC-0031 requires shutdown to stop obsolete presentation, discard pending/current work, and terminate worker execution in a bounded way. Worker panic must become controlled failure, not VM panic.

Objective

Define and implement render shutdown, cancellation, and failure handling for both synchronous and worker-capable paths.

Dependencies

• PLN-0089 handoff abstraction.
• PLN-0092 epoch/ownership transitions.
• PLN-0093 telemetry.
• PLN-0095 if a real worker is being exercised.

Scope

• Add stop token or equivalent cancellation state for worker/current render work.
• Discard pending submissions on shutdown.
• Prevent obsolete current work from presenting after shutdown/owner change.
• Convert worker panic/render backend failure into controlled runtime/host error state.
• Record shutdown discards and errors in telemetry.

Non-Goals

• Do not design full crash UI policy beyond render ownership requirements.
• Do not implement automatic worker restart unless existing host policy already supports it.
• Do not expose failure ACK to VM program semantics.

Execution Method

1. Define shutdown state machine for render consumer.
2. Add bounded worker termination behavior where worker exists.
3. Add pending/current discard paths.
4. Ensure present path checks stop/epoch before publishing.
5. Wrap worker entrypoint with panic/error containment.
6. Add telemetry for shutdown discards, render errors, present errors, and worker failure.

Acceptance Criteria

• Shutdown does not drain obsolete frames to screen.
• Pending work is discarded.
• Current work cannot present after stop/epoch invalidation.
• Worker failure is reported without panicking the VM.
• Shutdown completes in bounded time.

Tests

• Unit test pending discard on shutdown.
• Integration test shutdown during currently-rendering submission.
• Simulated worker panic/error test.
• Telemetry assertions for shutdown/error counters.

Affected Artifacts

• Render handoff.
• Worker runtime integration.
• RenderManager.
• Telemetry modules.
• Host error handling.