Prevent hanging prefill futures and leaked startup resources on subprocess failure #238

Problem

SubprocessPrefillWorker can leave request futures or startup resources outstanding when the receive thread fails. It parses every valid JSON line as a protocol response; JSON SDK status without id can raise KeyError. A cancelled future can raise InvalidStateError on set_result, preventing other pending requests from completing. Startup exceptions occur after allocating shared memory/spawning the child without cleanup.

Evidence

Inspection of pd_batching.SubprocessPrefillWorker in df02223: _receive has no outer exception/finally drain; submit writes outside its map lock and does not retain terminal failure state; init calls ready.result without cleanup; close waits then unlinks the slab even when the process did not stop. Existing success-path torch subprocess tests do not cover these conditions.

Scope

Reproduce with owned lightweight subprocesses, then ensure startup/fatal receive/pipe failures settle pending futures, future cancellation cannot kill the receiver, subsequent submissions fail promptly on a terminal worker, and owned child/shared-memory resources are released on failed startup/close. Keep the existing wire contract; do not automatically replay potentially completed work. Verify explicit replacement with a healthy worker and scheduler lane reuse where appropriate.

Done when

Real subprocess fault tests prove bounded failure propagation and cleanup, normal shared-memory/token correctness remains covered, and existing batching/recovery tests pass. Hardware fault/reset and auto-restart claims require separate evidence under #234/#201.

Owner

Codex; maintainer review. Related #201/#234/#236.