[nick2781]

Handle application lifecycle failures consistently. Startup failures now identify their plugin/module and phase, stop later startup callbacks and exit with status 1. Missing libraries, missing entry points and standard/nonstandard exceptions retain diagnostic context.

During shutdown, accepted work drains before teardown. Add --shutdown_timeout_ms (default 0, unlimited); failed updates or expired cooperative waits retain resources and report failure once. Late completion cannot resume teardown. On Windows, capture C++ update exceptions before the structured-exception filter and rethrow after returning to the shutdown owner, preserving native structured-fault handling.

Real-process regressions cover loader/startup failures, admission sealing, callback retirement, native thread completion, normal drains, standard/nonstandard exceptions and invalid or expired deadlines. English and Chinese guides describe the lifecycle contract.

Validation: head 54be9e0babb8d740218ee244b2ea58ef913b675b has the identical Git file tree to locally tested 13cc8cb499f34bae784815f645a3fca6b2da84fe. That tree passed macOS Debug complete check-core (including startup and drain processes), 71 CI policy tests, whole-project clang-format 18 and Nimbus checks (123 HTML pages / 217 references).

Fresh Windows and the complete merge-candidate matrix remain required. Cooperative deadlines cannot interrupt a blocking user hook or unload call. Test-harness termination is not successful shutdown. Partial-start resource rollback, hot replacement and general shared-library unloading safety remain separate work.