Context
Local image generation runs as a governed mission. The core owns the worker processes, and they run inside quotas for wall time, CPU, memory and GPU. That makes it a good test of the E-stop. A GPU render is expensive, runs in child processes and is easy to leave half-finished.
The run
A render mission was admitted (“solver local.image admitted”) and reached the rendering state, step 1 of 4. At its peak it had about 8.4 GB of GPU memory allocated. The E-stop was then triggered.
- The stop was acknowledged in 19.4 ms.
- All three owned processes settled by 374.68 ms, with 0 survivors.
- The worker’s state became
cancelled, and the mission’s state becamefailedwith the detail “SolveCancelled: solve cancelled before publication”. artifact_availablewas false: no partial image was published.- The core shut down cleanly.
A companion case the same night killed the core in the middle of a render. The mission came back BLOCKED without re-rendering, and again no owned process survived.
The evidence
docs/ledger/evidence/A06/estop.json records the operation, the acknowledgement and stop timings, the checkpoint at the moment of the stop, the worker’s quota and exit state, the survivor count and the clean shutdown. It was read at 01:32 UTC on 19 September against head 71fbf83e. No footage exists yet.
The limits
This is one stop on one kind of job. It shows that the E-stop reaches GPU child processes and that nothing is published after the stop. It is not a worst-case figure and not a distribution. The project’s under-150 ms E-stop budget applies mid-utterance, to speech, and this run does not qualify it. Settling software processes is also a different claim from stopping a physical machine. For the printer, the project records the E-stop’s local trip time but lists the printer’s actual pause as unproven.