Compose Multiplatform Skiko Vulkan Surface Lifecycle Synchronization Guardrail

--- description: Compose Multiplatform Skiko Vulkan Surface Lifecycle Synchronization Guardrail - Prevents catastrophic render pipeline panics, SIGSEGV crashes, and VK_ERROR_SURFACE_LOST_KHR exceptions during rapid Android activity teardown, configuration changes, or background transitions. Guarantees that the native ANativeWindow surface destruction is synchronously fenced against Skiko render loop dispatches and Skia GPU context flushes. globs: **/*.kt, **/*.kts, **/nativeInterop/**/*.def, **/cpp/**/*.cpp alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/compose-skiko-vulkan-surface-lifecycle-guardrail" --- # Compose Multiplatform Skiko Vulkan Surface Lifecycle Synchronization Guardrail > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Asynchronous Surface Teardown Allowing Skiko Render Threads to Draw to Deallocated Native Surfaces ## System Constraints You are a Principal Engineer enforcing Compose Multiplatform Skiko Vulkan Surface Lifecycle Invariants. Mandate that any native Android SurfaceHolder destruction, window detachment, or configuration teardown synchronously halts and awaits the Skiko rendering dispatch thread before allowing the operating system to deallocate the backing native window handle. Disallow fire-and-forget detach calls, asynchronous coroutine disposals across lifecycle callbacks, or un-synchronized native surface lifecycle wrappers. ## Strict Guidelines - Engineers MUST ALWAYS block the Android UI thread synchronously in SurfaceHolder.Callback.surfaceDestroyed until Skiko render delegate has completely flushed and detached the Vulkan context. - Engineers MUST NOT dispatch SkiaLayer or Skiko surface detachment into asynchronous background coroutines (e.g., CoroutineScope.launch { skiaLayer.detach() }) during lifecycle callbacks. - Code MUST explicitly synchronize surface state transitions using an atomic flag or reentrant lock shared between the native platform callback and the Skiko render loop. - Services MUST ensure that vkDeviceWaitIdle or equivalent Skiko GPU device idle synchronization completes prior to yielding execution back to the window manager from surfaceDestroyed. - Components NEVER continue submitting frame rendering passes when the underlying native surface lock has been flagged as destroying or invalid. ## Bad vs Good Implementations ### Synchronous Surface Destruction with Skiko Render Flush #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Launching an asynchronous coroutine inside surfaceDestroyed allows the callback to complete before Skiko stops rendering. The operating system invalidates ANativeWindow, causing the active Vulkan rendering pipeline to execute against a dangling handle and panicking the process. ```kotlin class SkikoSurfaceBridge(private val skiaLayer: SkiaLayer) : SurfaceHolder.Callback { private val scope = CoroutineScope(Dispatchers.Default) override fun surfaceCreated(holder: SurfaceHolder) { skiaLayer.attachTo(holder) } override fun surfaceChanged(holder: SurfaceHolder, format: Int, width: Int, height: Int) { skiaLayer.update(width, height) } // CRITICAL BUG: Asynchronous detachment allows surfaceDestroyed to return // to the Android OS immediately. The OS destroys ANativeWindow while Skiko // is executing vkQueueSubmit/vkQueuePresentKHR on the render thread, causing SIGSEGV. override fun surfaceDestroyed(holder: SurfaceHolder) { scope.launch { skiaLayer.detach() } } } ``` #### Production Standard (Correct) > **Standard**: Surface destruction synchronizes on a common lock and executes detachment synchronously. This ensures all active command buffers finish execution and Skiko decouples from the surface before the Android OS deallocates the ANativeWindow. ```kotlin class SkikoSurfaceBridge(private val skiaLayer: SkiaLayer) : SurfaceHolder.Callback { private val renderLock = Any() @Volatile private var isSurfaceAlive = false override fun surfaceCreated(holder: SurfaceHolder) { synchronized(renderLock) { skiaLayer.attachTo(holder) isSurfaceAlive = true } } override fun surfaceChanged(holder: SurfaceHolder, format: Int, width: Int, height: Int) { synchronized(renderLock) { if (isSurfaceAlive) { skiaLayer.update(width, height) } } } // PRODUCTION FIX: Block synchronously to force the render thread // to drain remaining commands and detach before releasing the native window. override fun surfaceDestroyed(holder: SurfaceHolder) { synchronized(renderLock) { isSurfaceAlive = false // Synchronously drain pipeline, wait for device idle, and release context skiaLayer.detach() } } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Compose Multiplatform Skiko Vulkan Surface Lifecycle Synchronization Guardrail

Compose Multiplatform Skiko Vulkan Surface Lifecycle Synchronization Guardrail defines an industrial-grade behavioral standard for mobile engineering. Prevents catastrophic render pipeline panics, SIGSEGV crashes, and VK_ERROR_SURFACE_LOST_KHR exceptions during rapid Android activity teardown, configuration changes, or background transitions. Guarantees that the native ANativeWindow surface destruction is synchronously fenced against Skiko render loop dispatches and Skia GPU context flushes. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Asynchronous Surface Teardown Allowing Skiko Render Threads to Draw to Deallocated Native Surfaces Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Asynchronous Surface Teardown Allowing Skiko Render Threads to Draw to Deallocated Native Surfaces	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS block the Android UI thread synchronously in SurfaceHolder.Callback.surfaceDestroyed until Skiko render delegate has completely flushed and detached the Vulkan context.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.